HPAVC/HPAVC CD-ROM.iso/pc/MAGS.ZIP/40HEX-12.ZIP/40HEX-12.008

Text File | 1993-12-04 | 17.7 KB | 339 lines

40Hex Number 12 Volume 3 Issue 3                                      File 008

Article #1
----------

Subj:   Draft Swiss AntiVirus regulation

To whom it may concern:

The Swiss Federal Agency for Informatics (Bundesamt fuer Informatik, Bern) is
preparing a legislative act against distribution of malicious code, such
as viruses, via VxBBS etc. You may know that there have been several attempts
to regulate the development and distribution of malicious software, in UK, USA
and other countries, but so far, Virus Exchange BBS seem to survive even in
countries with regulations and (some) knowledgeable crime investigators.

In order to optimize the input into the Swiss legal discussion, I suggested
that their draft be internationally distributed,  for comments and suggestions
from technical and legal experts in this area. Mr. Claudio G. Frigerio from
Bern kindly translated the (Swiss) text into English (see appended text, both
in German and English); in case of any misunderstanding, the German text is the
legally relevant one! Any discussion on this forum is helpful; please send
your comments (Cc:) also to Mr. Claudio G. Frigerio (as he's not on this list).

"The Messenger" (Klaus Brunnstein: October 9, 1993)

###############################################################
Appendix 1:
Entwurf zu Art. 144 Abs. 2 des Schweizerischen Strafgesetzbuches

"Wer unbefugt elektronisch oder in vergleichbarer
Weise gespeicherte oder uebermittelte Daten loescht,
veraendert oder unbrauchbar macht, oder Mittel, die
zum unbefugten Loeschen, Aendern oder Unbrauchbarmachen
solcher Daten bestimmt sind, herstellt oder anpreist,
anbietet, zugaenglich macht oder sonstwie in Verkehr
bringt, wird, auf Antrag, mit der gleichen Strafe belegt."

P.S.: gleiche Strafe =JBusse oder Gefaengnis bis zu 3 Jahren;
      bei grossem Schaden, bis zu 5 Jahren Gefaengnis sowie Verfolgung
      von Amtes wegen (Offizialdelikt)

###############################################################
Draft of article 144 paragraph 2 of the Swiss Penal Code
(English translation)

"Anyone, who, without authorization
   - erases, modifies, or destructs
     electronically or similarly saved or data,
or anyone who,
   - creates, promotes, offers, makes available, or circulates in
     any way
     means destined for unauthorized deletion, modification, or
     destruction of such data,
will, if a complaint is filed, receive the same punishment."

P.S.: same punishment =Jfine or imprisonment for a term of up to
      three years; in cases of a considerable dam-age, five years with
      prosecution ex officio
###############################################################
Author: Claudio G. Frigerio, Attorney-At-Law
Swiss Federal Office of Information Technology and System,
e-mail: [e-mail]
###############################################################

Article 2:
---------

Subj: More about Swiss Anti-Virus Laws

Thanks to everybody who replied on the subject of Swiss Anti-Virus Legis-
lation.

As somebody noticed there was a word missing in the English translation. It
should have been: "... destructs electronically or similarly saved or TRANS-
MITTED data will..."

The text posted to the net, was a trial to include into the "data damaging"
even creation and dealing/circulating computer viruses. The idea behind this,
is that the virus itself already carries the malicious intent of his author.
Therefore it is dangerous in any circumstance. Actually a virus can not be
abused, as the idea of abuse includes the possibility, that a virus can be
used in a good way too. As I have been told by specialists, there is no such
"good use" of a virus as any unauthorized change of data has the potential of
interfering with other data and/or programs in environments, that the virus
author did/could not foresee. And even the unauthorized use of storage space
is a damage, as this space will not be available for authorized uses of the
computer system. Computer virus are an "absolute danger", and as any other
dangerous thing (like explosive, poison, radioactiv materials or genetic
materials in specialized labs) computer virus should not be created or
circulated without restrictions.

It has been remarked that in the text there was no word about the requisite
intent or requisite knowledge of the committer. This way any BBS sysop would
always risk criminal charges, if his BBS carries any virus infected software
but the sysop isn't aware of it.

I apologize for not having told that Swiss Penal Law only considers inten-
tional crimes, if there is no explicit indication that negligent acts are
punished too. Therefore according to Swiss Penal Law terminology and system,
the text posted to the net only considers who "knowingly and willingly"
commits the act. That means that the author of the virus has to know it was
a virus, what he created: this is always the case. And who circulates the
virus has to know it was a virus and he wanted to circulate it. The know-
ledge that SW was or carried a virus can be proved easily by the fact that
nobody knowingly stores viruses without labeling or marking them in any way,
in order not to be infected himself (yes, I know: if there really is somebody
so foolish, I have to find another way to prove his knowledge). For BBS a
"Virus Directory" containing viruses or virus source codes is evidence enough
for the "requisite knowledge and intent". The law does no want to punish
accidental distribution of viruses.

The phrase "means destined for unauthorized deletion" has been considered
unclear. "Means" certainly includes not only software, but source code (on
paper as on disks) too. It has been remarked that it's the classical tool-
maker problem: a knife can be used as woodcarver to make a great work, but
it might be used aven as a thug to commit murder.
I realized this problem, but would you consider a knife as generally
destined to commit murder? Or would you consider explosive as generally
destined to create damage? We have to be aware that most items can be used
in a legal or abused in an illegal way. Seldom an item can only be used in
an illegal way, but computer viruses are such items! I do not speak about
software using virus specific reproduction techniques (like "killer viruses"
for copyright enforcement or "anti-viruses" supposed to fight viruses) that
make data changes with the explicit (contract/license) or implicit (highly
probable agreement of the user) authorization of the user. This kind of SW
is actually not included in the definition of "means destined for unatho-
rized deletion, modification, or destruction of data".
Therefore you cannot say that Norton Utilities, WipeFile or any other
similar general purpose SW or utilities are "destined for unautorized
deletion, modification or destruction", although they certainly could be
used for this.

The text doesn't say anything about malice, malicious intents or the intent
to damage, as these elements are very difficult to prove in trial, if the
accused denies any such intention. Actually I considered these subjective
elements as not really necessary, as the virus already carries the malicious
intent of its author: the malice of the author is proved by his virus, and
the malice of somebody circulating the virus is proved, if his knowledge,
that he was circulating a virus, is proved.

According to general principles of penal law the site of crime is the main
link to charge somebody. If a virus has been created or circulated outside
the national borders of Switzerland, Swiss Penal law cannot be applied. But
if a virus created outside Switzerland is transferred electronically to
Switzerland, the downloader will be held responsible, no matter if he was
in Switzerland or abroad, as "importing" as a way to circulate the virus.
The "success" of the act will take place in Switzerland. Anyway Art. 7 of
Swiss Penal Law follows the principle of territoriality and the
"Ubiquitaetsprinzip" (sorry: didn't find the correct English word: an act
is considered being committed not only where the committer was, when he
started his crime, but also where the "success" has been realized. Anyway
I do consider clearifing this by inserting that "importing" virus is
considered as "circulating in any way".

As this crime is prosecuted as soon as police or prosecution authority knows
about it (so called "ex officio", there is no need for a specific complaint:
a detailed information about a fact is enough to start investigations, no
matter where the information came from (e.g. abroad).

There is no doubt, that professional ant-virus specialists and scientists
should have access to viruses and be allowed to even create viruses. As
long as this is covered by the aim of studying strategies to fight
computer viruses, this is OK. I actually planned a system of registrering
these people with a federal authority (e.g. the IS Security Dptm. at the
Swiss Federal Office of Information Technology and Systems or the Ministery
of Justice). The posted text would be then need to be completed as follows:
"Who, without being registered with the proper federal authority, creates...
Only trustworthy individuals, who are professionally or scientifically
active in combatting such means, may be registered on demand."

The Swiss legislator is actually not only considering "data damaging" but
"hacking", "time theft" and computer fraud too, but these ARE NOT subjects
of the discussion in this forum now. The same applies to software piracy,
already ruled by another law. I will gladly email/fax the German, French or
Italian text of the Penal Law draft to anybody interested. Please do not
ask me an English translation of these, as I am not a professional English
translator of legal text.

I am aware that the UK and Italy have/are going to have laws allowing to
prosecute the creation and circulation of computer viruses. If anybody
knows of other contries, may he please let me know in any way and as soon
as possible.

On Monday, 25 October 1993, there will a meeting with the Ministery of
Justice in order to convince them to propose this to the Parliament. This
will be very very difficult, as there generally is very little knowledge
on, or concern for the threat through computer viruses. Most people have
simply never suffered an attack of computer viruses.

Thanks again for following this item with your comments.

Claudio G. Frigerio

P.S.: Please do not suggest to me to send them a floppy with a ..... just
to make them more aware of the risks...
P.P.S.: You can phone/email/fax/write to me in Italian, German, French,
Spanish or English.


Article #3
----------

Subj:   Detection complexity of some newish viruses. (PC)

A while back (January 93) a few people posted sizes of their algorithmic
virus detectors.  Here are the line counts for a couple more detectors
included (or to be included) in IBM AntiVirus.

These counts are for lines of C; the code is not particularly dense.
The SatanBug (*) count includes some tables.  (File I/O handling is
*not* included in these counts.  The lines-of-code counter is a standard
counter used in many IBM development projects.  I'm not completely sure
what rules this lines-of-code counter uses.  Some lines are
counted as both code and comment lines.)

SatanBug ::= 421 physical lines, 173 comment lines, and 187 code lines
Tremor ::= 165 physical lines, 36 comment lines, and 107 code lines

(*) There is some disagreement about the name of this virus.

Bill Arnold, [e-mail] (IBM AntiVirus Development)

Article 4:
----------

Subj:  Electronic Warfare

The October 18th issue of Aviation Week has an interesting item in its
Washington Outlook column on future developments in electronic warfare.
Paraphrase follows:

  A Pentagon official, H. Steven Kimmel, deputy director of C3I testing
  and evaluation in the Pentagon acquisition office, said the next
  developments in "non-lethal electronic combat" should be on methods
  of injecting deceptive information and computer viruses into enemy
  command, control, communication and intelligence systems and into
  enemy communication nodes and data bases. Kimmel was speaking to the
  Association of Old Crows, a group of electronic warfare specialists.
  He further said that the U.S. needs this "nonlethal capability" both
  defensively and offensively. It was pointed out that American C3I
  systems are vulnerable because of their many nodes and reliance on
  computers and commercial off the shelf components.

Article 5:
----------

Subj:  Swiss Anti Virus Law

On November 11, 1993 the Law Committee of the 2nd Chamber of the Parliament
(German: "Staenderat"; a kind of "Swiss Senate") decided to accept the anti-
virus propositions. The Staenderat will probably discuss in Parliament and
decide on the subject by December 1993. In the Law Committee there was
practically no opposition to the law draft; thus it is very likely that the
Staenderat will accept it too. After this the "Nationalrat" (the 1st Chamber of
Parliament, a kind of "Swiss House of Representatives" or "Swiss Congress")
will  discuss the draft and decide about it by Spring 1994.

The Swiss law draft, posted to the net, has been changed considerably in the
last few weeks. The draft actually discussed in Parliament will be:

German text:
Schweizerisches Strafgesetzbuch, Artikel 144bis, Datenbeschaedigung
1. Wer unbefugt elektronisch oder in vergleichbarer Weise
   gespeicherte oder uebermittelte Daten loescht, veraendert oder
   unbraucbar macht, wird, auf Antrag, mit Gefaegnis oder mit Busse
   bestraft.
   Hat der Taeter einen grossen Schaden verursacht, so kann auf
   Zuchthaus bis zu fuenf Jahren erkannt werden. Die Tat wird von
   Amtes wegen verfolgt.
2. Wer Programme, von denen er weiss oder annehmen muss, dass sie
   zu den in Ziffer 1 genanten Zwecken verwendet werden sollen,
   herstellt, einfuehrt, in Verkehr bringt, anpreist, ueberlaesst oder
   sonstwie zugaenglich macht oder zu ihrer Herstellung Anleitung gibt,
   wird mit Gefaegnis oder mit Busse bestraft.
   Handelt der Taeter gewerbsmaessig, so kann auf Zuchthaus bis zu
   fuenf Jahren erkannt werden.

English text:
Swiss Criminal Code, Article 144bis, Damaging of data
1. Anyone, who without authorization deletes, modifies or renders
   useless electronically or similarly saved or transmitted data, will,
   if a complaint is filed, be punished with the imprisonment for a
   term of up to 3 years or a fine of up to 40000 Swiss francs.
   If the person charged has caused a considerable damage, the
   imprisonment will be for a term of up to 5 years. The crime will
   be prosecuted ex officio.
2. Anyone, who creates, imports, distributes, promotes, offers,
   makes available, circulates in any way, or gives instructions to
   create programs, that he/she knows or has to presume to be used
   for purposes according to item 1 listed above, will be punished
   with the imprisonment for a term of up to 3 years or a fine of up
   to 40000 Swiss francs.
   If the person charged acted for gain, the imprisonment will be for
   a term of up to 5 years.

This English translation may not be perfect. The text will be available by
January 1994 in all official Swiss languages: German, French and Italian.

The protected item of this article are just data (immaterial goods). Any damage
to computer systems, like the burning of floppies, plug-pulling, sledgehammers
etc. are damages to "physical/material things" covered by article 144
(Sachbeschaedigung, damage to property).

According to Swiss penal legislation the requisite knowledge and intent
("knowingly and willingly") have not to be mentioned specifically.

As you may have noticed, the "registration" of IS security pros has been
dropped. The expression "that he/she knows or has to presume to be used for
purposes according to item 1 listed above" will exclude any penal responsibi-
lity if the committer e.g. gave a virus to a professional anti-virus software
developer or is creating viruses for research, as in these and similar special
situations a misuse of the virus is highly unlikely. The committer will not be
prosecuted, if he had reasonable motives, to practically exclude a misuse. On a
retrospective analysis the judge will check if the person who gave a viruses to
somebody else (who misused it to cause damage) could in any way be blamed for
not having foreseen the occurred misuse. If you give a virus to a notorious
anti-virus professional, known for spreading viruses or source codes, or simply
to somebody who does not give a special guarantee for not misusing the virus,
you will be prosecuted. Who just trusted in the promise of a virus-recipient,
that the latter will not misuse it, will be in trouble, if he did not have a
very special additional reason to trust him. The law considers viruses as so
dangerous for the general public, that any act making them available to
somebody else, represents a general risk to the general public. Who invokes an
exception,that an act of making a virus available to somebody else, did not
represent such a risk has to prove it.

This may cause some concern, but law can not foresee any situation. Judges will
have to carefully check if the reasons to give a virus to somebody else, were
good enough to practically exclude any misuse.

Making a newly discovered virus available to McAfee or the Virus Test Center
will not be a crime, as long as the reputation of these recipients is above any
suspicion.

As the draft is now in the Parliament, there is practically no way to change
any thing in this text anymore (by the administration). Now it is up to the
politicians to decide about the subject and to make any additional change.