Computer Security Companies Vow to Block Police

Two computer security vendors claim that they will block police access to protected systems, even if the law allows it.

A little known part of the Computer Misuse Act (1995) allows UK Police to hack into "compromised" systems without the use of a warrant, and since the Home Office is pushing to extend police powers in this area due to Europol, UK security firms find themselves faced with a dilemma: whether to allow Police hacking, and theoretically leave the system wide open, or to block all attempts.

Kapersky Labs said on Tuesday it would block all attempts to access its customers' systems, regardless of the agency attempting the entry. David Em, Kaspersky's UK senior technology consultant said "If we provided a backdoor, it could be used by malware authors. People would be able to drive a coach and horses through our security."

Sophos took the same stance. "We block spyware, regardless of where it comes from," said Graham Cluley, the security vendor's senior technology consultant.

Symantec, however, has declined to comment on whether it would block a police hack, saying the matter was "politically sensitive," although they are known not to scan for the FBI's "Magic Lantern" software, whether it actually exists or not.

The real problem, which Symantec has alluded to, is that to fully co-operate with the police, there would need to be a "skeleton key," of sorts, for the police to use. If this key exists, then it could be forged, and that would invalidate the very security that they provide.

The most likely way for police to hack into a system, according to security expert Richard Clayton, would be to place a keylogger on the system, something that they would need access to do. Failing that, they could try the brute force method of breaking your router password, and connect using your WiFi. Both options are very costly in terms of manpower.

The Association of Chief Police Officers (ACPO) said that between 2007 and 2008 there had been 194 warrantless searches performed by the police, but an ACPO spokesperson was unable to confirm at the time of writing how many of those searches had been of computers.

Source: ZDNet
(Image)

Permalink

yeah i'm kinda glad i don't live in the uk, tho america is just as bad with the partiot act

cleverlymadeup:
yeah i'm kinda glad i don't live in the uk, tho america is just as bad with the partiot act

Except that it's worse.

You know what, I used to hate people who say the UK's turning into one of those facist, government controlled places. But every day something else happens. A bit more liberty is taken away. And if I'm honest it makes me sick. Rant over.

The_root_of_all_evil:

A little known part of the Computer Misuse Act (1995)

This was updated in 1998, is it still there?

Arg, I want people to just leave my computer alone.

Danny Ocean:

The_root_of_all_evil:

A little known part of the Computer Misuse Act (1995)

This was updated in 1998, is it still there?

Yep, and in 2000. The full law is here.

The original act was made in 1990, but the current one has been updated a few times. The 1995 addition extended powers to the Police.

Optimus Prime:
You know what, I used to hate people who say the UK's turning into one of those facist, government controlled places. But every day something else happens. A bit more liberty is taken away. And if I'm honest it makes me sick. Rant over.

That's why I voted for Ron Paul!

WHAT? You should have voted for me!

It's good to see that the biggest web security firms and the police have a friendly relationship. Because we wouldn't want them spending resources fighting each other when they could be working together to stop child predators and terrorists.

At any rate, come what may, they need to get on the same page. When those responsible for law enforcement and security fight each other, the only winners are the predators and pirates.

Isn't it great ot know we may soon (or may as well) have next to no privacy at all?

If they're going this far, then why don't they just go the whole hog and let them come in and search our homes whenever they feel like it without even having a warrant. Good to hear that not all parties are just going to take this sort of thing lying down. I remember when the UK used to be a democratic nation. How times have changed....

Breaking in through the router? What if there was no wireless network and only the cable router system, I mean that's how top security places operate.

Before this hysteria gets fully out of control, remember that this Act was made in 1990, so it's been in effect for most of our lifetimes; and if you're going to fight cyber-terrorism, you need to have stop/search powers. Kapersky and Sophos, as well as the Police, are actually doing the job they're paid to do. The main problem with the keylogger system is that you need to gain access to the computer to install it, which technically would be a breach of security that you need a warrant for.

If a Predator or Pirate buys his groceries from the supermarket, should the supermarket refuse to sell them? It's a very grey area.

The_root_of_all_evil:
Before this hysteria gets fully out of control, remember that this Act was made in 1990, so it's been in effect for most of our lifetimes; and if you're going to fight cyber-terrorism, you need to have stop/search powers. Kapersky and Sophos, as well as the Police, are actually doing the job they're paid to do. The main problem with the keylogger system is that you need to gain access to the computer to install it, which technically would be a breach of security that you need a warrant for.

If a Predator or Pirate buys his groceries from the supermarket, should the supermarket refuse to sell them? It's a very grey area.

Yeah, but in 1990, most people dialed in to the internet if at all. IP addresses moved around, bandwidth was seriously limited, home networks were rare, and only super nerds the truly dedicated were online for more than a couple hours at a time. This law was probably far less useful/dangerous then.

Not to fan the flames of hysteria (seriously, really not trying to), but I think the paradigm has changed - computers are, if nothing else, far more ubiquitous than they were 19 years ago, and therefore have a much higher chance of affecting mainstream (read: not especially tech savvy) users than when the law was written - namely, people with less of a capability to defend themselves. This really strikes me as the kind of law that is too broad and very likely to be abused. There are plenty of other pieces of data available to track down cybercrime and cyberterrorism than allowing the police to punch into any ol' PC they feel like, warrant-less and accountability-free.

I'm not even convinced this is all that helpful a law for dealing with cybercrime - victims of the crime will almost certainly gladly provide evidence willingly to the police in the hopes of catching the criminal. And, unless I'm mistaken, even if the victim is not willing, the police can generally seize the computer for evidence collection at that point anyway. To use this against the criminals' own machines, you have to have found them already - i.e., using the tools that already exist and don't (in most cases) violate the relatively reasonable notion of no search or seizure without a warrant. And, once the police have tracked down a set of machines that are likely to be the criminal or part of the criminal activity...they probably have enough evidence at that point to get a warrant.

And, besides, this law as you say has been in effect for 19 years. How useful has it been? How many cybercrimes have been solved, thwarted or prosecuted using evidence gathered from this method?

Sorry, this really looks like an excuse to further infringe on rights and practice lazy policework (being naive here - not even thinking about potential abuses) with the excuse of "booga booga cyberterrorism". I'll grant that I'm not an expert or even that close to the field, and that I'm sure scenarios could be contrived where this law would be useful. But, in general, I'm uncomfortable by default with any kind of law that gives any kind of broad, unchallenged, unsupervised intrusion into a citizen's privacy, and I've yet to see any argument for this one that gives it a compelling reason to exist. At the very least, it would be nice to see some usage stats from the UK police justifying the need for this law's existence and extension.

Whew. Rant off.

This is just one of the many reasons I never liked, trusted, or used the big name antivirus software.

sp0rk:

I'm not even convinced this is all that helpful a law for dealing with cybercrime -

Hell, I'm not FOR this Act in anyway, but I'm just saying that if it was THE UBER LAW, we'd all be praising Big Brother at the moment.

Hold on....

;)

The_root_of_all_evil:

sp0rk:

I'm not even convinced this is all that helpful a law for dealing with cybercrime -

Hell, I'm not FOR this Act in anyway, but I'm just saying that if it was THE UBER LAW, we'd all be praising Big Brother at the moment.

Hold on....

;)

Fair enough. ;) Even so, I wasn't so much trying to argue against you as against the law itself; your point about the law having been in effect for a while just happened to crystallize some thoughts that had been bouncing around since I first read about it, so you were the unlucky winner of a quote in a sp0rk rant.

Your points about hysteria were well taken, since this is the kind of topic that inspires tinfoil hattery - I mostly try to stay away from paranoid interpretations, but I have to admit this kind of law bothers me. A lot. You might've noticed. ;p

it's actually really reassuring to know that these systems that you pay to protect you from being hacked genuinely do in every way from everyone. hacking a computer surely isen't that hard for the police though? I mean if a teenager can hack an iphone (something I still can't comprehend as to how that would be done in the slightest) then surely some military designed software can slip right into a computer with out it's commercial software and hardware even detecting it?

You know how to really stop people hacking your pc?
Burn the hard drive.
Mwuaahahhahahhaha!

I don't see how the companies could allow the police access without then opening the doors to other threats. I don't have a particularly high view of the police anyway, but regardless of possible corruption, this seems to be a catch 22 thing, whatever these companies do, they're going to be screwed if the police need access.

This is happening here?...

Crap...