SlideShare a Scribd company logo
Cops hacking into computers to
investigate crimes
What could go wrong?
Panel
Moderator:
• Lucian Constantin, Romania Correspondent for IDG News Service
(PCWorld, Computerworld etc.)
Participants:
• Carsten Eiram, Chief Research Officer at Risk Based Security , vulnerability research
and management expert with a 10-year experience, led the research team at
Secunia
• Raoul “Nobody” Chiesa, Founder & President The Security Brokers, Member of the
European Network & Information Security Agency (ENISA) Permanent
Stakeholders’ Group (PSG), UN agency “UNICRI” (United Nations Interregional
Crime and Justice Research Institute), working on “HPP”, the Hackers Profiling
Project run by ISECOM and UNICRI; in 2005 he has been officially recognized as a
cybercrime advisor.
• Bogdan Manolea, Executive Director of Association for Technology and
Internet, legal advisor, IT&C law expert, Editor of EDRi-gram, a biweekly
newsletter on digital civil rights in Europe.
• Silviu Sofronie, Forensics Specialist at Bitdefender, acts as liason with law
enforcement
What we know so far
• In October 2012, the Dutch Minister of Justice proposed a
law that would allow law enforcement (police) to remotely
infiltrate computers and install surveillance software and
gather evidence.
• The new legislation will provide strict safeguards for the
proposed investigative powers, Opstelten said. Law
enforcement authorities will only be able to exercise such
powers when investigating offenses that carry a maximum
prison sentence of four years or more and only after
obtaining authorization from a judge, he said. Furthermore,
all such actions will be automatically logged and the logs
will be accessible for later review.
What we know so far
• Draft presented in May 2013 (obviously in Dutch)
• Some highlights:
• The Dutch proposal allows police "lawful intrusion" into
computers located in the Netherlands or computers whose
location cannot be established (like those running Tor
hidden services). If the computer is clearly in another
country, the intrusion shouldn't take place.
• The Dutch proposal is not limited to cybercrime. It does
seek to restrict the use of such intrusions only for serious
offenses -- offenses that carry a certain minimum prison
sentence.
• It's not only about hacking to gather evidence, but also to
disrupt/stop attacks or crimes in progress.
What we know so far
• We don’t call it hacking, and we definitely don’t call it hacking
back, because we won’t be waiting until we are hacked. The more
appropriate term would be “lawful intrusion,” - Peter Zinn, a senior
cybercrime adviser for the Dutch National High Tech Crime Unit (NHTCU)
• Lawful interception and intrusion, done in a very strict and transparent
manner, will be necessary because in many cases cybercriminals will not
be from neighboring countries and may not even be from the European
Union. They will be from areas where it will be very hard to gather
evidence from, and we might not even be able to call the police force that
has the capacity to help us. - Troels Oerting, the head of the European
Cybercrime Centre (EC3) at Europol
• There are already similar agreements in the physical world. The Schengen
Area agreement, an agreement among 25 European countries that
abolishes passport and immigration control at their common
borders, allows police officers from one country to follow suspects into
another country while in hot pursuit - Troels Oerting, the head of the
European Cybercrime Centre (EC3) at Europol
What we know so far
• In the physical world, a police officer has the power to
detain suspects for 24 hours, search their bodies for
evidence, search their houses for evidence, use violence
against suspects if they don’t comply with orders and even
shoot them in certain circumstances, Oerting said. “We
accept this because we have a transparent system, we have
rules and we have the rule of law.”
• Why is it, then, that if they do some of those same things
on a computer, it suddenly becomes such a big privacy
issue and those actions should be banned? he asked. “I
think that we need to have a balance between
privacy, which I think we should respect, and
anonymity, which I think is dangerous.”
What can go wrong?
• - How will this influence the market for zero-day vulnerabilities and
overall security of software? What are the implications of police
joining intelligence agencies in buying 0days? Will this create an
incentive to keep those vulnerabilities unpatched? Will it decrease
overall software security or keep it from improving?
- Legal and privacy considerations? Will Dutch police violate the
laws of other countries? Should they be arrested if they travel
there? If a lawyer claims police planted the evidence obtained in
this way, can police disprove giving how computers work and the
computer environment?
- Who will help police do this? Should the police hire ethical hackers
(consultants) or should they train their own people?
- How will security vendors respond? Will they differentiate
between police attacks and malicious attacks?
- Ethical considerations.
Q&A
Thank you
Previus coverage:
• http://www.cio.com/article/719307/Dutch_Governme
nt_Seeks_to_Let_Law_Enforcement_Hack_Foreign_Co
mputers
• http://www.computerworld.com/s/article/9238849/Du
tch_bill_would_give_police_hacking_powers?taxonom
yId=82&pageNumber=1
• http://www.pcworld.com/article/2059800/copsshould-be-allowed-to-hack-into-computers-policeofficials-say.html

More Related Content

More from DefCamp

Mobile, IoT, Clouds… It’s time to hire your own risk manager!
Mobile, IoT, Clouds… It’s time to hire your own risk manager!Mobile, IoT, Clouds… It’s time to hire your own risk manager!
Mobile, IoT, Clouds… It’s time to hire your own risk manager!
DefCamp
 
The Charter of Trust
The Charter of TrustThe Charter of Trust
The Charter of Trust
DefCamp
 
Internet Balkanization: Why Are We Raising Borders Online?
Internet Balkanization: Why Are We Raising Borders Online?Internet Balkanization: Why Are We Raising Borders Online?
Internet Balkanization: Why Are We Raising Borders Online?
DefCamp
 
Bridging the gap between CyberSecurity R&D and UX
Bridging the gap between CyberSecurity R&D and UXBridging the gap between CyberSecurity R&D and UX
Bridging the gap between CyberSecurity R&D and UX
DefCamp
 
Secure and privacy-preserving data transmission and processing using homomorp...
Secure and privacy-preserving data transmission and processing using homomorp...Secure and privacy-preserving data transmission and processing using homomorp...
Secure and privacy-preserving data transmission and processing using homomorp...
DefCamp
 
Drupalgeddon 2 – Yet Another Weapon for the Attacker
Drupalgeddon 2 – Yet Another Weapon for the AttackerDrupalgeddon 2 – Yet Another Weapon for the Attacker
Drupalgeddon 2 – Yet Another Weapon for the Attacker
DefCamp
 
Economical Denial of Sustainability in the Cloud (EDOS)
Economical Denial of Sustainability in the Cloud (EDOS)Economical Denial of Sustainability in the Cloud (EDOS)
Economical Denial of Sustainability in the Cloud (EDOS)
DefCamp
 
Trust, but verify – Bypassing MFA
Trust, but verify – Bypassing MFATrust, but verify – Bypassing MFA
Trust, but verify – Bypassing MFA
DefCamp
 
Threat Hunting: From Platitudes to Practical Application
Threat Hunting: From Platitudes to Practical ApplicationThreat Hunting: From Platitudes to Practical Application
Threat Hunting: From Platitudes to Practical Application
DefCamp
 
Building application security with 0 money down
Building application security with 0 money downBuilding application security with 0 money down
Building application security with 0 money down
DefCamp
 
Implementation of information security techniques on modern android based Kio...
Implementation of information security techniques on modern android based Kio...Implementation of information security techniques on modern android based Kio...
Implementation of information security techniques on modern android based Kio...
DefCamp
 
Lattice based Merkle for post-quantum epoch
Lattice based Merkle for post-quantum epochLattice based Merkle for post-quantum epoch
Lattice based Merkle for post-quantum epoch
DefCamp
 
The challenge of building a secure and safe digital environment in healthcare
The challenge of building a secure and safe digital environment in healthcareThe challenge of building a secure and safe digital environment in healthcare
The challenge of building a secure and safe digital environment in healthcare
DefCamp
 
Timing attacks against web applications: Are they still practical?
Timing attacks against web applications: Are they still practical?Timing attacks against web applications: Are they still practical?
Timing attacks against web applications: Are they still practical?
DefCamp
 
Tor .onions: The Good, The Rotten and The Misconfigured
Tor .onions: The Good, The Rotten and The Misconfigured Tor .onions: The Good, The Rotten and The Misconfigured
Tor .onions: The Good, The Rotten and The Misconfigured
DefCamp
 
Needles, Haystacks and Algorithms: Using Machine Learning to detect complex t...
Needles, Haystacks and Algorithms: Using Machine Learning to detect complex t...Needles, Haystacks and Algorithms: Using Machine Learning to detect complex t...
Needles, Haystacks and Algorithms: Using Machine Learning to detect complex t...
DefCamp
 
We will charge you. How to [b]reach vendor’s network using EV charging station.
We will charge you. How to [b]reach vendor’s network using EV charging station.We will charge you. How to [b]reach vendor’s network using EV charging station.
We will charge you. How to [b]reach vendor’s network using EV charging station.
DefCamp
 
Connect & Inspire Cyber Security
Connect & Inspire Cyber SecurityConnect & Inspire Cyber Security
Connect & Inspire Cyber Security
DefCamp
 
The lions and the watering hole
The lions and the watering holeThe lions and the watering hole
The lions and the watering hole
DefCamp
 
Catch Me If You Can - Finding APTs in your network
Catch Me If You Can - Finding APTs in your networkCatch Me If You Can - Finding APTs in your network
Catch Me If You Can - Finding APTs in your network
DefCamp
 

More from DefCamp (20)

Mobile, IoT, Clouds… It’s time to hire your own risk manager!
Mobile, IoT, Clouds… It’s time to hire your own risk manager!Mobile, IoT, Clouds… It’s time to hire your own risk manager!
Mobile, IoT, Clouds… It’s time to hire your own risk manager!
 
The Charter of Trust
The Charter of TrustThe Charter of Trust
The Charter of Trust
 
Internet Balkanization: Why Are We Raising Borders Online?
Internet Balkanization: Why Are We Raising Borders Online?Internet Balkanization: Why Are We Raising Borders Online?
Internet Balkanization: Why Are We Raising Borders Online?
 
Bridging the gap between CyberSecurity R&D and UX
Bridging the gap between CyberSecurity R&D and UXBridging the gap between CyberSecurity R&D and UX
Bridging the gap between CyberSecurity R&D and UX
 
Secure and privacy-preserving data transmission and processing using homomorp...
Secure and privacy-preserving data transmission and processing using homomorp...Secure and privacy-preserving data transmission and processing using homomorp...
Secure and privacy-preserving data transmission and processing using homomorp...
 
Drupalgeddon 2 – Yet Another Weapon for the Attacker
Drupalgeddon 2 – Yet Another Weapon for the AttackerDrupalgeddon 2 – Yet Another Weapon for the Attacker
Drupalgeddon 2 – Yet Another Weapon for the Attacker
 
Economical Denial of Sustainability in the Cloud (EDOS)
Economical Denial of Sustainability in the Cloud (EDOS)Economical Denial of Sustainability in the Cloud (EDOS)
Economical Denial of Sustainability in the Cloud (EDOS)
 
Trust, but verify – Bypassing MFA
Trust, but verify – Bypassing MFATrust, but verify – Bypassing MFA
Trust, but verify – Bypassing MFA
 
Threat Hunting: From Platitudes to Practical Application
Threat Hunting: From Platitudes to Practical ApplicationThreat Hunting: From Platitudes to Practical Application
Threat Hunting: From Platitudes to Practical Application
 
Building application security with 0 money down
Building application security with 0 money downBuilding application security with 0 money down
Building application security with 0 money down
 
Implementation of information security techniques on modern android based Kio...
Implementation of information security techniques on modern android based Kio...Implementation of information security techniques on modern android based Kio...
Implementation of information security techniques on modern android based Kio...
 
Lattice based Merkle for post-quantum epoch
Lattice based Merkle for post-quantum epochLattice based Merkle for post-quantum epoch
Lattice based Merkle for post-quantum epoch
 
The challenge of building a secure and safe digital environment in healthcare
The challenge of building a secure and safe digital environment in healthcareThe challenge of building a secure and safe digital environment in healthcare
The challenge of building a secure and safe digital environment in healthcare
 
Timing attacks against web applications: Are they still practical?
Timing attacks against web applications: Are they still practical?Timing attacks against web applications: Are they still practical?
Timing attacks against web applications: Are they still practical?
 
Tor .onions: The Good, The Rotten and The Misconfigured
Tor .onions: The Good, The Rotten and The Misconfigured Tor .onions: The Good, The Rotten and The Misconfigured
Tor .onions: The Good, The Rotten and The Misconfigured
 
Needles, Haystacks and Algorithms: Using Machine Learning to detect complex t...
Needles, Haystacks and Algorithms: Using Machine Learning to detect complex t...Needles, Haystacks and Algorithms: Using Machine Learning to detect complex t...
Needles, Haystacks and Algorithms: Using Machine Learning to detect complex t...
 
We will charge you. How to [b]reach vendor’s network using EV charging station.
We will charge you. How to [b]reach vendor’s network using EV charging station.We will charge you. How to [b]reach vendor’s network using EV charging station.
We will charge you. How to [b]reach vendor’s network using EV charging station.
 
Connect & Inspire Cyber Security
Connect & Inspire Cyber SecurityConnect & Inspire Cyber Security
Connect & Inspire Cyber Security
 
The lions and the watering hole
The lions and the watering holeThe lions and the watering hole
The lions and the watering hole
 
Catch Me If You Can - Finding APTs in your network
Catch Me If You Can - Finding APTs in your networkCatch Me If You Can - Finding APTs in your network
Catch Me If You Can - Finding APTs in your network
 

Recently uploaded

HCL Notes and Domino License Cost Reduction in the World of DLAU
HCL Notes and Domino License Cost Reduction in the World of DLAUHCL Notes and Domino License Cost Reduction in the World of DLAU
HCL Notes and Domino License Cost Reduction in the World of DLAU
panagenda
 
Columbus Data & Analytics Wednesdays - June 2024
Columbus Data & Analytics Wednesdays - June 2024Columbus Data & Analytics Wednesdays - June 2024
Columbus Data & Analytics Wednesdays - June 2024
Jason Packer
 
Building Production Ready Search Pipelines with Spark and Milvus
Building Production Ready Search Pipelines with Spark and MilvusBuilding Production Ready Search Pipelines with Spark and Milvus
Building Production Ready Search Pipelines with Spark and Milvus
Zilliz
 
Programming Foundation Models with DSPy - Meetup Slides
Programming Foundation Models with DSPy - Meetup SlidesProgramming Foundation Models with DSPy - Meetup Slides
Programming Foundation Models with DSPy - Meetup Slides
Zilliz
 
Introduction of Cybersecurity with OSS at Code Europe 2024
Introduction of Cybersecurity with OSS  at Code Europe 2024Introduction of Cybersecurity with OSS  at Code Europe 2024
Introduction of Cybersecurity with OSS at Code Europe 2024
Hiroshi SHIBATA
 
Finale of the Year: Apply for Next One!
Finale of the Year: Apply for Next One!Finale of the Year: Apply for Next One!
Finale of the Year: Apply for Next One!
GDSC PJATK
 
How to Interpret Trends in the Kalyan Rajdhani Mix Chart.pdf
How to Interpret Trends in the Kalyan Rajdhani Mix Chart.pdfHow to Interpret Trends in the Kalyan Rajdhani Mix Chart.pdf
How to Interpret Trends in the Kalyan Rajdhani Mix Chart.pdf
Chart Kalyan
 
Recommendation System using RAG Architecture
Recommendation System using RAG ArchitectureRecommendation System using RAG Architecture
Recommendation System using RAG Architecture
fredae14
 
June Patch Tuesday
June Patch TuesdayJune Patch Tuesday
June Patch Tuesday
Ivanti
 
Trusted Execution Environment for Decentralized Process Mining
Trusted Execution Environment for Decentralized Process MiningTrusted Execution Environment for Decentralized Process Mining
Trusted Execution Environment for Decentralized Process Mining
LucaBarbaro3
 
Digital Marketing Trends in 2024 | Guide for Staying Ahead
Digital Marketing Trends in 2024 | Guide for Staying AheadDigital Marketing Trends in 2024 | Guide for Staying Ahead
Digital Marketing Trends in 2024 | Guide for Staying Ahead
Wask
 
WeTestAthens: Postman's AI & Automation Techniques
WeTestAthens: Postman's AI & Automation TechniquesWeTestAthens: Postman's AI & Automation Techniques
WeTestAthens: Postman's AI & Automation Techniques
Postman
 
Serial Arm Control in Real Time Presentation
Serial Arm Control in Real Time PresentationSerial Arm Control in Real Time Presentation
Serial Arm Control in Real Time Presentation
tolgahangng
 
Nunit vs XUnit vs MSTest Differences Between These Unit Testing Frameworks.pdf
Nunit vs XUnit vs MSTest Differences Between These Unit Testing Frameworks.pdfNunit vs XUnit vs MSTest Differences Between These Unit Testing Frameworks.pdf
Nunit vs XUnit vs MSTest Differences Between These Unit Testing Frameworks.pdf
flufftailshop
 
leewayhertz.com-AI in predictive maintenance Use cases technologies benefits ...
leewayhertz.com-AI in predictive maintenance Use cases technologies benefits ...leewayhertz.com-AI in predictive maintenance Use cases technologies benefits ...
leewayhertz.com-AI in predictive maintenance Use cases technologies benefits ...
alexjohnson7307
 
Main news related to the CCS TSI 2023 (2023/1695)
Main news related to the CCS TSI 2023 (2023/1695)Main news related to the CCS TSI 2023 (2023/1695)
Main news related to the CCS TSI 2023 (2023/1695)
Jakub Marek
 
Deep Dive: AI-Powered Marketing to Get More Leads and Customers with HyperGro...
Deep Dive: AI-Powered Marketing to Get More Leads and Customers with HyperGro...Deep Dive: AI-Powered Marketing to Get More Leads and Customers with HyperGro...
Deep Dive: AI-Powered Marketing to Get More Leads and Customers with HyperGro...
saastr
 
Driving Business Innovation: Latest Generative AI Advancements & Success Story
Driving Business Innovation: Latest Generative AI Advancements & Success StoryDriving Business Innovation: Latest Generative AI Advancements & Success Story
Driving Business Innovation: Latest Generative AI Advancements & Success Story
Safe Software
 
Taking AI to the Next Level in Manufacturing.pdf
Taking AI to the Next Level in Manufacturing.pdfTaking AI to the Next Level in Manufacturing.pdf
Taking AI to the Next Level in Manufacturing.pdf
ssuserfac0301
 
Nordic Marketo Engage User Group_June 13_ 2024.pptx
Nordic Marketo Engage User Group_June 13_ 2024.pptxNordic Marketo Engage User Group_June 13_ 2024.pptx
Nordic Marketo Engage User Group_June 13_ 2024.pptx
MichaelKnudsen27
 

Recently uploaded (20)

HCL Notes and Domino License Cost Reduction in the World of DLAU
HCL Notes and Domino License Cost Reduction in the World of DLAUHCL Notes and Domino License Cost Reduction in the World of DLAU
HCL Notes and Domino License Cost Reduction in the World of DLAU
 
Columbus Data & Analytics Wednesdays - June 2024
Columbus Data & Analytics Wednesdays - June 2024Columbus Data & Analytics Wednesdays - June 2024
Columbus Data & Analytics Wednesdays - June 2024
 
Building Production Ready Search Pipelines with Spark and Milvus
Building Production Ready Search Pipelines with Spark and MilvusBuilding Production Ready Search Pipelines with Spark and Milvus
Building Production Ready Search Pipelines with Spark and Milvus
 
Programming Foundation Models with DSPy - Meetup Slides
Programming Foundation Models with DSPy - Meetup SlidesProgramming Foundation Models with DSPy - Meetup Slides
Programming Foundation Models with DSPy - Meetup Slides
 
Introduction of Cybersecurity with OSS at Code Europe 2024
Introduction of Cybersecurity with OSS  at Code Europe 2024Introduction of Cybersecurity with OSS  at Code Europe 2024
Introduction of Cybersecurity with OSS at Code Europe 2024
 
Finale of the Year: Apply for Next One!
Finale of the Year: Apply for Next One!Finale of the Year: Apply for Next One!
Finale of the Year: Apply for Next One!
 
How to Interpret Trends in the Kalyan Rajdhani Mix Chart.pdf
How to Interpret Trends in the Kalyan Rajdhani Mix Chart.pdfHow to Interpret Trends in the Kalyan Rajdhani Mix Chart.pdf
How to Interpret Trends in the Kalyan Rajdhani Mix Chart.pdf
 
Recommendation System using RAG Architecture
Recommendation System using RAG ArchitectureRecommendation System using RAG Architecture
Recommendation System using RAG Architecture
 
June Patch Tuesday
June Patch TuesdayJune Patch Tuesday
June Patch Tuesday
 
Trusted Execution Environment for Decentralized Process Mining
Trusted Execution Environment for Decentralized Process MiningTrusted Execution Environment for Decentralized Process Mining
Trusted Execution Environment for Decentralized Process Mining
 
Digital Marketing Trends in 2024 | Guide for Staying Ahead
Digital Marketing Trends in 2024 | Guide for Staying AheadDigital Marketing Trends in 2024 | Guide for Staying Ahead
Digital Marketing Trends in 2024 | Guide for Staying Ahead
 
WeTestAthens: Postman's AI & Automation Techniques
WeTestAthens: Postman's AI & Automation TechniquesWeTestAthens: Postman's AI & Automation Techniques
WeTestAthens: Postman's AI & Automation Techniques
 
Serial Arm Control in Real Time Presentation
Serial Arm Control in Real Time PresentationSerial Arm Control in Real Time Presentation
Serial Arm Control in Real Time Presentation
 
Nunit vs XUnit vs MSTest Differences Between These Unit Testing Frameworks.pdf
Nunit vs XUnit vs MSTest Differences Between These Unit Testing Frameworks.pdfNunit vs XUnit vs MSTest Differences Between These Unit Testing Frameworks.pdf
Nunit vs XUnit vs MSTest Differences Between These Unit Testing Frameworks.pdf
 
leewayhertz.com-AI in predictive maintenance Use cases technologies benefits ...
leewayhertz.com-AI in predictive maintenance Use cases technologies benefits ...leewayhertz.com-AI in predictive maintenance Use cases technologies benefits ...
leewayhertz.com-AI in predictive maintenance Use cases technologies benefits ...
 
Main news related to the CCS TSI 2023 (2023/1695)
Main news related to the CCS TSI 2023 (2023/1695)Main news related to the CCS TSI 2023 (2023/1695)
Main news related to the CCS TSI 2023 (2023/1695)
 
Deep Dive: AI-Powered Marketing to Get More Leads and Customers with HyperGro...
Deep Dive: AI-Powered Marketing to Get More Leads and Customers with HyperGro...Deep Dive: AI-Powered Marketing to Get More Leads and Customers with HyperGro...
Deep Dive: AI-Powered Marketing to Get More Leads and Customers with HyperGro...
 
Driving Business Innovation: Latest Generative AI Advancements & Success Story
Driving Business Innovation: Latest Generative AI Advancements & Success StoryDriving Business Innovation: Latest Generative AI Advancements & Success Story
Driving Business Innovation: Latest Generative AI Advancements & Success Story
 
Taking AI to the Next Level in Manufacturing.pdf
Taking AI to the Next Level in Manufacturing.pdfTaking AI to the Next Level in Manufacturing.pdf
Taking AI to the Next Level in Manufacturing.pdf
 
Nordic Marketo Engage User Group_June 13_ 2024.pptx
Nordic Marketo Engage User Group_June 13_ 2024.pptxNordic Marketo Engage User Group_June 13_ 2024.pptx
Nordic Marketo Engage User Group_June 13_ 2024.pptx
 

DefCamp 2013 - Cops hacking into computers to investigate crimes

  • 1. Cops hacking into computers to investigate crimes What could go wrong?
  • 2. Panel Moderator: • Lucian Constantin, Romania Correspondent for IDG News Service (PCWorld, Computerworld etc.) Participants: • Carsten Eiram, Chief Research Officer at Risk Based Security , vulnerability research and management expert with a 10-year experience, led the research team at Secunia • Raoul “Nobody” Chiesa, Founder & President The Security Brokers, Member of the European Network & Information Security Agency (ENISA) Permanent Stakeholders’ Group (PSG), UN agency “UNICRI” (United Nations Interregional Crime and Justice Research Institute), working on “HPP”, the Hackers Profiling Project run by ISECOM and UNICRI; in 2005 he has been officially recognized as a cybercrime advisor. • Bogdan Manolea, Executive Director of Association for Technology and Internet, legal advisor, IT&C law expert, Editor of EDRi-gram, a biweekly newsletter on digital civil rights in Europe. • Silviu Sofronie, Forensics Specialist at Bitdefender, acts as liason with law enforcement
  • 3. What we know so far • In October 2012, the Dutch Minister of Justice proposed a law that would allow law enforcement (police) to remotely infiltrate computers and install surveillance software and gather evidence. • The new legislation will provide strict safeguards for the proposed investigative powers, Opstelten said. Law enforcement authorities will only be able to exercise such powers when investigating offenses that carry a maximum prison sentence of four years or more and only after obtaining authorization from a judge, he said. Furthermore, all such actions will be automatically logged and the logs will be accessible for later review.
  • 4. What we know so far • Draft presented in May 2013 (obviously in Dutch) • Some highlights: • The Dutch proposal allows police "lawful intrusion" into computers located in the Netherlands or computers whose location cannot be established (like those running Tor hidden services). If the computer is clearly in another country, the intrusion shouldn't take place. • The Dutch proposal is not limited to cybercrime. It does seek to restrict the use of such intrusions only for serious offenses -- offenses that carry a certain minimum prison sentence. • It's not only about hacking to gather evidence, but also to disrupt/stop attacks or crimes in progress.
  • 5. What we know so far • We don’t call it hacking, and we definitely don’t call it hacking back, because we won’t be waiting until we are hacked. The more appropriate term would be “lawful intrusion,” - Peter Zinn, a senior cybercrime adviser for the Dutch National High Tech Crime Unit (NHTCU) • Lawful interception and intrusion, done in a very strict and transparent manner, will be necessary because in many cases cybercriminals will not be from neighboring countries and may not even be from the European Union. They will be from areas where it will be very hard to gather evidence from, and we might not even be able to call the police force that has the capacity to help us. - Troels Oerting, the head of the European Cybercrime Centre (EC3) at Europol • There are already similar agreements in the physical world. The Schengen Area agreement, an agreement among 25 European countries that abolishes passport and immigration control at their common borders, allows police officers from one country to follow suspects into another country while in hot pursuit - Troels Oerting, the head of the European Cybercrime Centre (EC3) at Europol
  • 6. What we know so far • In the physical world, a police officer has the power to detain suspects for 24 hours, search their bodies for evidence, search their houses for evidence, use violence against suspects if they don’t comply with orders and even shoot them in certain circumstances, Oerting said. “We accept this because we have a transparent system, we have rules and we have the rule of law.” • Why is it, then, that if they do some of those same things on a computer, it suddenly becomes such a big privacy issue and those actions should be banned? he asked. “I think that we need to have a balance between privacy, which I think we should respect, and anonymity, which I think is dangerous.”
  • 7. What can go wrong? • - How will this influence the market for zero-day vulnerabilities and overall security of software? What are the implications of police joining intelligence agencies in buying 0days? Will this create an incentive to keep those vulnerabilities unpatched? Will it decrease overall software security or keep it from improving? - Legal and privacy considerations? Will Dutch police violate the laws of other countries? Should they be arrested if they travel there? If a lawyer claims police planted the evidence obtained in this way, can police disprove giving how computers work and the computer environment? - Who will help police do this? Should the police hire ethical hackers (consultants) or should they train their own people? - How will security vendors respond? Will they differentiate between police attacks and malicious attacks? - Ethical considerations.
  • 8. Q&A Thank you Previus coverage: • http://www.cio.com/article/719307/Dutch_Governme nt_Seeks_to_Let_Law_Enforcement_Hack_Foreign_Co mputers • http://www.computerworld.com/s/article/9238849/Du tch_bill_would_give_police_hacking_powers?taxonom yId=82&pageNumber=1 • http://www.pcworld.com/article/2059800/copsshould-be-allowed-to-hack-into-computers-policeofficials-say.html