40hex nº12:(40HEX-12.008):04/12/1993 << Back To 40hex nº 12
40Hex Number 12 Volume 3 Issue 3 File 008 Article #1 ---------- Subj: Draft Swiss AntiVirus regulation To whom it may concern: The Swiss Federal Agency for Informatics (Bundesamt fuer Informatik, Bern) is preparing a legislative act against distribution of malicious code, such as viruses, via VxBBS etc. You may know that there have been several attempts to regulate the development and distribution of malicious software, in UK, USA and other countries, but so far, Virus Exchange BBS seem to survive even in countries with regulations and (some) knowledgeable crime investigators. In order to optimize the input into the Swiss legal discussion, I suggested that their draft be internationally distributed, for comments and suggestions from technical and legal experts in this area. Mr. Claudio G. Frigerio from Bern kindly translated the (Swiss) text into English (see appended text, both in German and English); in case of any misunderstanding, the German text is the legally relevant one! Any discussion on this forum is helpful; please send your comments (Cc:) also to Mr. Claudio G. Frigerio (as he's not on this list). "The Messenger" (Klaus Brunnstein: October 9, 1993) ############################################################### Appendix 1: Entwurf zu Art. 144 Abs. 2 des Schweizerischen Strafgesetzbuches "Wer unbefugt elektronisch oder in vergleichbarer Weise gespeicherte oder uebermittelte Daten loescht, veraendert oder unbrauchbar macht, oder Mittel, die zum unbefugten Loeschen, Aendern oder Unbrauchbarmachen solcher Daten bestimmt sind, herstellt oder anpreist, anbietet, zugaenglich macht oder sonstwie in Verkehr bringt, wird, auf Antrag, mit der gleichen Strafe belegt." P.S.: gleiche Strafe =JBusse oder Gefaengnis bis zu 3 Jahren; bei grossem Schaden, bis zu 5 Jahren Gefaengnis sowie Verfolgung von Amtes wegen (Offizialdelikt) ############################################################### Draft of article 144 paragraph 2 of the Swiss Penal Code (English translation) "Anyone, who, without authorization - erases, modifies, or destructs electronically or similarly saved or data, or anyone who, - creates, promotes, offers, makes available, or circulates in any way means destined for unauthorized deletion, modification, or destruction of such data, will, if a complaint is filed, receive the same punishment." P.S.: same punishment =Jfine or imprisonment for a term of up to three years; in cases of a considerable dam-age, five years with prosecution ex officio ############################################################### Author: Claudio G. Frigerio, Attorney-At-Law Swiss Federal Office of Information Technology and System, e-mail: bfi@ezinfo.vmsmail.ethz.ch ############################################################### Article 2: --------- Subj: More about Swiss Anti-Virus Laws Thanks to everybody who replied on the subject of Swiss Anti-Virus Legis- lation. As somebody noticed there was a word missing in the English translation. It should have been: "... destructs electronically or similarly saved or TRANS- MITTED data will..." The text posted to the net, was a trial to include into the "data damaging" even creation and dealing/circulating computer viruses. The idea behind this, is that the virus itself already carries the malicious intent of his author. Therefore it is dangerous in any circumstance. Actually a virus can not be abused, as the idea of abuse includes the possibility, that a virus can be used in a good way too. As I have been told by specialists, there is no such "good use" of a virus as any unauthorized change of data has the potential of interfering with other data and/or programs in environments, that the virus author did/could not foresee. And even the unauthorized use of storage space is a damage, as this space will not be available for authorized uses of the computer system. Computer virus are an "absolute danger", and as any other dangerous thing (like explosive, poison, radioactiv materials or genetic materials in specialized labs) computer virus should not be created or circulated without restrictions. It has been remarked that in the text there was no word about the requisite intent or requisite knowledge of the committer. This way any BBS sysop would always risk criminal charges, if his BBS carries any virus infected software but the sysop isn't aware of it. I apologize for not having told that Swiss Penal Law only considers inten- tional crimes, if there is no explicit indication that negligent acts are punished too. Therefore according to Swiss Penal Law terminology and system, the text posted to the net only considers who "knowingly and willingly" commits the act. That means that the author of the virus has to know it was a virus, what he created: this is always the case. And who circulates the virus has to know it was a virus and he wanted to circulate it. The know- ledge that SW was or carried a virus can be proved easily by the fact that nobody knowingly stores viruses without labeling or marking them in any way, in order not to be infected himself (yes, I know: if there really is somebody so foolish, I have to find another way to prove his knowledge). For BBS a "Virus Directory" containing viruses or virus source codes is evidence enough for the "requisite knowledge and intent". The law does no want to punish accidental distribution of viruses. The phrase "means destined for unauthorized deletion" has been considered unclear. "Means" certainly includes not only software, but source code (on paper as on disks) too. It has been remarked that it's the classical tool- maker problem: a knife can be used as woodcarver to make a great work, but it might be used aven as a thug to commit murder. I realized this problem, but would you consider a knife as generally destined to commit murder? Or would you consider explosive as generally destined to create damage? We have to be aware that most items can be used in a legal or abused in an illegal way. Seldom an item can only be used in an illegal way, but computer viruses are such items! I do not speak about software using virus specific reproduction techniques (like "killer viruses" for copyright enforcement or "anti-viruses" supposed to fight viruses) that make data changes with the explicit (contract/license) or implicit (highly probable agreement of the user) authorization of the user. This kind of SW is actually not included in the definition of "means destined for unatho- rized deletion, modification, or destruction of data". Therefore you cannot say that Norton Utilities, WipeFile or any other similar general purpose SW or utilities are "destined for unautorized deletion, modification or destruction", although they certainly could be used for this. The text doesn't say anything about malice, malicious intents or the intent to damage, as these elements are very difficult to prove in trial, if the accused denies any such intention. Actually I considered these subjective elements as not really necessary, as the virus already carries the malicious intent of its author: the malice of the author is proved by his virus, and the malice of somebody circulating the virus is proved, if his knowledge, that he was circulating a virus, is proved. According to general principles of penal law the site of crime is the main link to charge somebody. If a virus has been created or circulated outside the national borders of Switzerland, Swiss Penal law cannot be applied. But if a virus created outside Switzerland is transferred electronically to Switzerland, the downloader will be held responsible, no matter if he was in Switzerland or abroad, as "importing" as a way to circulate the virus. The "success" of the act will take place in Switzerland. Anyway Art. 7 of Swiss Penal Law follows the principle of territoriality and the "Ubiquitaetsprinzip" (sorry: didn't find the correct English word: an act is considered being committed not only where the committer was, when he started his crime, but also where the "success" has been realized. Anyway I do consider clearifing this by inserting that "importing" virus is considered as "circulating in any way". As this crime is prosecuted as soon as police or prosecution authority knows about it (so called "ex officio", there is no need for a specific complaint: a detailed information about a fact is enough to start investigations, no matter where the information came from (e.g. abroad). There is no doubt, that professional ant-virus specialists and scientists should have access to viruses and be allowed to even create viruses. As long as this is covered by the aim of studying strategies to fight computer viruses, this is OK. I actually planned a system of registrering these people with a federal authority (e.g. the IS Security Dptm. at the Swiss Federal Office of Information Technology and Systems or the Ministery of Justice). The posted text would be then need to be completed as follows: "Who, without being registered with the proper federal authority, creates... Only trustworthy individuals, who are professionally or scientifically active in combatting such means, may be registered on demand." The Swiss legislator is actually not only considering "data damaging" but "hacking", "time theft" and computer fraud too, but these ARE NOT subjects of the discussion in this forum now. The same applies to software piracy, already ruled by another law. I will gladly email/fax the German, French or Italian text of the Penal Law draft to anybody interested. Please do not ask me an English translation of these, as I am not a professional English translator of legal text. I am aware that the UK and Italy have/are going to have laws allowing to prosecute the creation and circulation of computer viruses. If anybody knows of other contries, may he please let me know in any way and as soon as possible. On Monday, 25 October 1993, there will a meeting with the Ministery of Justice in order to convince them to propose this to the Parliament. This will be very very difficult, as there generally is very little knowledge on, or concern for the threat through computer viruses. Most people have simply never suffered an attack of computer viruses. Thanks again for following this item with your comments. Claudio G. Frigerio P.S.: Please do not suggest to me to send them a floppy with a ..... just to make them more aware of the risks... P.P.S.: You can phone/email/fax/write to me in Italian, German, French, Spanish or English. Article #3 ---------- Subj: Detection complexity of some newish viruses. (PC) A while back (January 93) a few people posted sizes of their algorithmic virus detectors. Here are the line counts for a couple more detectors included (or to be included) in IBM AntiVirus. These counts are for lines of C; the code is not particularly dense. The SatanBug (*) count includes some tables. (File I/O handling is *not* included in these counts. The lines-of-code counter is a standard counter used in many IBM development projects. I'm not completely sure what rules this lines-of-code counter uses. Some lines are counted as both code and comment lines.) SatanBug ::= 421 physical lines, 173 comment lines, and 187 code lines Tremor ::= 165 physical lines, 36 comment lines, and 107 code lines (*) There is some disagreement about the name of this virus. Bill Arnold, barnold@watson.ibm.com (IBM AntiVirus Development) Article 4: ---------- Subj: Electronic Warfare The October 18th issue of Aviation Week has an interesting item in its Washington Outlook column on future developments in electronic warfare. Paraphrase follows: A Pentagon official, H. Steven Kimmel, deputy director of C3I testing and evaluation in the Pentagon acquisition office, said the next developments in "non-lethal electronic combat" should be on methods of injecting deceptive information and computer viruses into enemy command, control, communication and intelligence systems and into enemy communication nodes and data bases. Kimmel was speaking to the Association of Old Crows, a group of electronic warfare specialists. He further said that the U.S. needs this "nonlethal capability" both defensively and offensively. It was pointed out that American C3I systems are vulnerable because of their many nodes and reliance on computers and commercial off the shelf components. Article 5: ---------- Subj: Swiss Anti Virus Law On November 11, 1993 the Law Committee of the 2nd Chamber of the Parliament (German: "Staenderat"; a kind of "Swiss Senate") decided to accept the anti- virus propositions. The Staenderat will probably discuss in Parliament and decide on the subject by December 1993. In the Law Committee there was practically no opposition to the law draft; thus it is very likely that the Staenderat will accept it too. After this the "Nationalrat" (the 1st Chamber of Parliament, a kind of "Swiss House of Representatives" or "Swiss Congress") will discuss the draft and decide about it by Spring 1994. The Swiss law draft, posted to the net, has been changed considerably in the last few weeks. The draft actually discussed in Parliament will be: German text: Schweizerisches Strafgesetzbuch, Artikel 144bis, Datenbeschaedigung 1. Wer unbefugt elektronisch oder in vergleichbarer Weise gespeicherte oder uebermittelte Daten loescht, veraendert oder unbraucbar macht, wird, auf Antrag, mit Gefaegnis oder mit Busse bestraft. Hat der Taeter einen grossen Schaden verursacht, so kann auf Zuchthaus bis zu fuenf Jahren erkannt werden. Die Tat wird von Amtes wegen verfolgt. 2. Wer Programme, von denen er weiss oder annehmen muss, dass sie zu den in Ziffer 1 genanten Zwecken verwendet werden sollen, herstellt, einfuehrt, in Verkehr bringt, anpreist, ueberlaesst oder sonstwie zugaenglich macht oder zu ihrer Herstellung Anleitung gibt, wird mit Gefaegnis oder mit Busse bestraft. Handelt der Taeter gewerbsmaessig, so kann auf Zuchthaus bis zu fuenf Jahren erkannt werden. English text: Swiss Criminal Code, Article 144bis, Damaging of data 1. Anyone, who without authorization deletes, modifies or renders useless electronically or similarly saved or transmitted data, will, if a complaint is filed, be punished with the imprisonment for a term of up to 3 years or a fine of up to 40000 Swiss francs. If the person charged has caused a considerable damage, the imprisonment will be for a term of up to 5 years. The crime will be prosecuted ex officio. 2. Anyone, who creates, imports, distributes, promotes, offers, makes available, circulates in any way, or gives instructions to create programs, that he/she knows or has to presume to be used for purposes according to item 1 listed above, will be punished with the imprisonment for a term of up to 3 years or a fine of up to 40000 Swiss francs. If the person charged acted for gain, the imprisonment will be for a term of up to 5 years. This English translation may not be perfect. The text will be available by January 1994 in all official Swiss languages: German, French and Italian. The protected item of this article are just data (immaterial goods). Any damage to computer systems, like the burning of floppies, plug-pulling, sledgehammers etc. are damages to "physical/material things" covered by article 144 (Sachbeschaedigung, damage to property). According to Swiss penal legislation the requisite knowledge and intent ("knowingly and willingly") have not to be mentioned specifically. As you may have noticed, the "registration" of IS security pros has been dropped. The expression "that he/she knows or has to presume to be used for purposes according to item 1 listed above" will exclude any penal responsibi- lity if the committer e.g. gave a virus to a professional anti-virus software developer or is creating viruses for research, as in these and similar special situations a misuse of the virus is highly unlikely. The committer will not be prosecuted, if he had reasonable motives, to practically exclude a misuse. On a retrospective analysis the judge will check if the person who gave a viruses to somebody else (who misused it to cause damage) could in any way be blamed for not having foreseen the occurred misuse. If you give a virus to a notorious anti-virus professional, known for spreading viruses or source codes, or simply to somebody who does not give a special guarantee for not misusing the virus, you will be prosecuted. Who just trusted in the promise of a virus-recipient, that the latter will not misuse it, will be in trouble, if he did not have a very special additional reason to trust him. The law considers viruses as so dangerous for the general public, that any act making them available to somebody else, represents a general risk to the general public. Who invokes an exception,that an act of making a virus available to somebody else, did not represent such a risk has to prove it. This may cause some concern, but law can not foresee any situation. Judges will have to carefully check if the reasons to give a virus to somebody else, were good enough to practically exclude any misuse. Making a newly discovered virus available to McAfee or the Virus Test Center will not be a crime, as long as the reputation of these recipients is above any suspicion. As the draft is now in the Parliament, there is practically no way to change any thing in this text anymore (by the administration). Now it is up to the politicians to decide about the subject and to make any additional change.