[Clips] Can writing software be a crime?

[R.A. Hettinga]

--- begin forwarded text


 Delivered-To: clips at philodox.com
 Date: Wed, 5 Oct 2005 12:56:53 -0400
 To: Philodox Clips List <clips at philodox.com>
 From: "R.A. Hettinga" <rah at shipwright.com>
 Subject: [Clips] Can writing software be a crime?
 Reply-To: rah at philodox.com
 Sender: clips-bounces at philodox.com

 <http://www.theregister.co.uk/2005/10/04/secfocus_keyloggers/print.html>

 The Register

 Biting the hand that feeds IT
 The Register » Security » Spyware »

 Can writing software be a crime?
 By Mark Rasch, SecurityFocus (MarkRasch at solutionary.com)
 Published Tuesday 4th October 2005 10:05 GMT

 Can writing software be a crime? A recent indictment in San Diego,
 California indicates that the answer to that question may be yes. We all
 know that launching certain types of malicious code - viruses, worms,
 Trojans, even spyware or sending out spam - may violate the law. But on
 July 21, 2005 a federal grand jury in the Southern District of California
 indicted 25 year old Carlos Enrique Perez-Melara for writing, advertising
 and selling a computer program called "Loverspy," a key logging program
 designed to allow users to capture keystrokes of any computer onto which it
 is installed. The indictment raises a host of questions about the
 criminalization of code, and the rights of privacy for users of the
 Internet and computers in general.

 Like many nations, the United States has laws prohibiting the surreptitious
 eavesdropping of conversations. The federal law prohibits the
 "interception" of such communications while "in transmission," as well as
 the disclosure of the contents of any such unlawfully intercepted
 communications. Under federal law there are three exceptions to this. The
 first is where you are the government and you have either a Title III court
 order, a FISA court order, or what is called a "national security letter"
 permitting such interceptions. The second exception is where you are the
 "provider of communications facilities" and the interception is "in the
 ordinary course of business" and for particular stated purposes. Finally,
 the third exception is in situations where you have obtained the consent of
 at least one of the parties to the communication.

 Thus, at least under federal law, it is legal to record a conversation, an
 e-mail, an internet communication if one and only one of the parties to the
 communication has given actual or implied consent to the "interception" or
 recording. Indeed, it is for this reason that most entities have "computer
 use policies" which explain that use of corporate computer systems implies
 their consent to monitoring of communications.
 Loverspy and EmailPI

 Carlos Enrique Perez-Melara developed, advertised and sold a spyware
 program called alternatively "Loverspy" or "E-Mail PI" on websites known as
 lover-spy.com or emailpi.com. They were sold for $89, and were advertised
 to be used to surreptitiously spy on anyone. The idea was that you would
 buy the Trojan program, e-mail it to your target (disguised in a greeting
 card) which would then cause the Trojan to be installed on any computer the
 purchaser directed it to - assuming the "victim" was dumb enough to open a
 greeting card from an ex-spouse.

 Once installed, the Trojan gave the attacker full access to the victim's
 computer by logging keystrokes, capturing e-mail, capturing websites
 visited, and even allowing remote access to things like webcams and
 microphones. Thus, the software had several different components. First, it
 was able to be installed surreptitiously as a Trojan. Second, it had both a
 key logger or e-mail logging functionality. Third, it acted as a remote
 control client, similar to programs like MS Terminal Server or Remote User,
 or commercial software like GoToMy PC.

 The government has prosecuted people under the federal wiretap laws for
 using keystroke loggers, most notably the indictment last year of Larry Lee
 Ropp, who at the time was an employee of Bristol West Insurance Group /
 Coast National Insurance company. Ropp installed physical key loggers onto
 his employers' computers to obtain evidence to support his assertion that
 the company was ripping off their customers. That case was dismissed when
 the federal judge ruled that the physical key logger, installed between the
 keyboard and the computer, did not capture communications "in interstate or
 foreign commerce" but rather captured them locally.

 The Perez-Melara case, in comparison, represents the first time the
 government has attempted to prosecute the developer of a software that can
 be used for both lawful purposes (surreptitiously monitoring conversations
 with the consent of one party, or with the "implied" consent of an employee
 or a minor) or for unlawful purposes (eavesdropping without the consent of
 either party). To be sure, the government is also going after people who
 purchased and used the software. At the time Perez-Melara was indicted, the
 government also indicted four purchasers of the software for using the
 software to spy on ex-wives or girlfriends.

 What exactly did Perez-Melara do that was illegal? Was it writing the
 software? Selling it? Advertising it? And how much illegal use must be made
 of the software before the software itself becomes a crime? There is all
 sorts of other software that can be used for legal and illegal purposes as
 well.
 The wiretap law

 In addition to criminalizing the actual interception, the U.S. law makes it
 a crime to either manufacture or possess any device if you have a reason to
 know that it is, "primarily useful for the purpose of the surreptitious
 interception of wire, oral, or electronic communications." This statute has
 been used, for example, to go after these "spy stores" that sell things
 like concealed voice activated tape recorders. Or in 1974 (remember
 Watergate?) the statute was used to prosecute someone for advertising a
 mini tape recorder that, "secretly tapes a conversation, interview,
 conference or lecture in your shirt pocket." In fact, the statute was even
 used to prosecute the manufacturer of a suction cup microphone which you
 could attach to your telephone to record a conversation.

 The law also makes it a crime to disseminate by electronic means an
 advertisement of an eavesdropping device if you know or even just have
 reason to know that "the design of such [a] device renders it primarily
 useful for the purpose of the surreptitious interception of wire, oral, or
 electronic communications." This also works if you promote the use of the
 device for surreptitious interception. There is little doubt that LoverSpy,
 like hundreds of other devices, was advertised as being useful for
 surreptitious interception.

 These laws make no distinction between secretly spying on my own computer,
 and secretly spying on computers of others. Thus, if I install such a
 program in my own computer because I suspect that someone may be using the
 computer without my authorization, I may be violating the wiretap law, and
 the manufacturer of the program may likewise be committing a felony. If I
 install a key logger or other monitoring program to keep my kids away from
 porn sites (or to monitor them if they do go there) my actions may be legal
 but the sale and distribution of the software used may be illegal. What if
 I use this software on my own computers to ensure my children don't become
 victims of stalkers, or companies that violate the Children's On-line
 Privacy Protection Act (COPPA)? Again, my actions may be legal assuming -
 and this is a big assumption - that I am authorized to give "consent" to
 the interception of their communications without their knowledge. In fact,
 under federal conspiracy law, while my use of the software may have been
 legal, I may have conspired with the software developer to sell the
 product, and therefore may be guilty of a crime just by buying software I
 can otherwise use legally. In addition, while a program may be useful for
 surreptitious interception, and may even be advertised that way, it may be
 equally useful for lawful purposes. Nevertheless, as the indictment shows,
 the software may be illegal.

 As with the Groskter case decided by the U.S. Supreme Court, the
 Perez-Melara case points out that you can make software illegal simply by
 promoting or advertising its usefulness for illegal or infringing purposes.
 In the Groskter case, the Supreme Court suggested that the program might
 not be unlawful if it had substantial non-infringing uses and was promoted
 for such uses. Perhaps the same is the case for Trojanized key loggers?
 A foolish consistency

 Another problem with the Perez-Melara case is that the government's theory
 is directly opposite the position it took when they wanted to install a
 Trojanized key logger onto a computer without a Title III wiretap order.

 In the case of reputed Philadelphia mob boss "little Nicky" Scarfo, the
 government got a court order to install a key logger onto his computer.
 Scarfo objected to the introduction of evidence captured by the key logger,
 claiming that even though the government had a warrant to surreptitiously
 install the key logger, the program captured electronic communications in
 transmission, and therefore the government was required to get a more
 restrictive wiretap order to retrieve the captured communications. The
 government vehemently disagreed, claiming that the key logger did not
 "capture" any communications in transmission, and therefore a simple
 subpoena or search warrant would suffice.

 As Ralph Waldo Emerson noted, "A foolish consistency is the hobgoblin of
 little minds." Indeed, at what point does a wiretap "capture" a
 communication in transmission? For example, when the government wanted to
 gather evidence against NSA contract employee Brian Regan for spying for
 Libya, instead of installing a key logger they simply put a video camera
 pointed at the monitor. Voila! Wiretap issue solved!
 Lessons learned

 Software developers need to be aware of potentially illegal uses of the
 software that they develop, market and sell. While they generally will not
 be held liable for such illegal uses, they may have some liability if they
 know or reasonably should know about the illegal or infringing use,
 particularly if they advertise or promote the usefulness of the software
 for such use.

 This could be applied, for example, to anonymizing programs, wipe or delete
 programs, evidence eliminators, or even (potentially) access control
 programs, if developers know or should know that these will be used for
 obstruction of justice. It is kind of like holding manufacturers of
 shredders liable for their use by Enron, or holding gun manufacturers
 liable when their guns are used for illegal purposes. Oh wait, Congress
 just exempted gun manufacturers from such liability. Keep your eyes open to
 see how this one ends.


 Mark D. Rasch, J.D., is a former head of the Justice Department's computer
 crime unit, and now serves as Senior Vice President and Chief Security
 Counsel at Solutionary Inc.

 --
 -----------------
 R. A. Hettinga <mailto: rah at ibuc.com>
 The Internet Bearer Underwriting Corporation <http://www.ibuc.com/>
 44 Farquhar Street, Boston, MA 02131 USA
 "... however it may deserve respect for its usefulness and antiquity,
 [predicting the end of the world] has not been found agreeable to
 experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'
 _______________________________________________
 Clips mailing list
 Clips at philodox.com
 http://www.philodox.com/mailman/listinfo/clips

--- end forwarded text


-- 
-----------------
R. A. Hettinga <mailto: rah at ibuc.com>
The Internet Bearer Underwriting Corporation <http://www.ibuc.com/>
44 Farquhar Street, Boston, MA 02131 USA
"... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at metzdowd.com