Bugfinder Being Indicted As Criminal ("Counterfeiter") in France

[Drew Copley]

http://www.guillermito2.net/archives/2004_03_25e.html

[thanks to AJ 'Effin' Reznor]

[Disclaimer: I don't know who has seen this already, and I do not
pretend to know the full facts of the case. -- Drew ]

Excerpt:

It's quite interesting to discover, from the inside, how the french
justice system works. I'm back from Paris. I've just been indicted and
charged of distributing programs that violated Intellectual Property
rights (literally translated, it's "counterfeiting and concealment of
counterfeiting"). Maximum punishment for these charges are two years in
jail and a fine of 150.000 euros. I'm not yet judged guilty or innocent,
but I already had to pay around two or three thousands dollars for two
trips to Paris (I live in Boston, MA, USA), plane tickets, and lawyer
fees. I already talked about my story here (in french).

....

In march 2002, I published on my website a long analysis about this
software. This webpage showed how the program worked, demonstrated a few
security flaws, and some tests with real viruses. I showed that, unlike
the advertizing claimed, this software didn't detect and stopped "100%
of viruses". So, nothing really extraordinary. The company first reacted
in a weird way: they denounced me publicly as a "terrorist", probably a
nice attempt to make me change my mind. Later on, they filed a formal
complaint against me in a Paris tribunal.=20

....

[K-OTiK Security]

In-Reply-To: <81637804AB36A644BBDE3ED9DD4E73FDC94B22@hermes.eCom pany.gov>

well ! this story is just a beta version of the new french liberticide law wich will come into effect very soon (next week).

France became a pseudo-monarchical-democracy, where the laws are made without requiring the opinion of the concerned people.

The article 323-3-1 of this "Law" will prohibit publication of any vuln. technical details, any proof of concept and any exploit.

We can see that "searching & finding vulnerabilties" is/and will be a crime !

The legislators forgot that finding vulnerabilties and publishing exploits is not the cause of the problem, it's just a consequence of the insecurity.

They want to show reality as they wish it, and not as it exists ...

God bless (in)security and god bless (in)liberty !

Bekrar Chaouki - Security Consultant
http://www.k-otik.com


>Received: (qmail 11436 invoked from network); 31 Mar 2004 22:12:32 -0000
>Received: from outgoing3.securityfocus.com (205.206.231.27)
> by mail.securityfocus.com with SMTP; 31 Mar 2004 22:12:32 -0000
>Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
> by outgoing3.securityfocus.com (Postfix) with QMQP
> id 69B15A3C45; Wed, 31 Mar 2004 15:03:09 -0700 (MST)
>Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
>Precedence: bulk
>List-Id: <bugtraq.list-id.securityfocus.com>
>List-Post: <mailto:bugtraq@securityfocus.com>
>List-Help: <mailto:bugtraq-help@securityfocus.com>
>List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
>List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
>Delivered-To: mailing list bugtraq@securityfocus.com
>Delivered-To: moderator for bugtraq@securityfocus.com
>Received: (qmail 28325 invoked from network); 31 Mar 2004 14:06:37 -0000
>X-MimeOLE: Produced By Microsoft Exchange V6.5.6944.0
>Content-class: urn:content-classes:message
>MIME-Version: 1.0
>Content-Type: text/plain;
> charset="us-ascii"
>Content-Transfer-Encoding: quoted-printable
>Subject: Bugfinder Being Indicted As Criminal ("Counterfeiter") in France
>Date: Wed, 31 Mar 2004 12:20:39 -0800
>Message-ID: <81637804AB36A644BBDE3ED9DD4E73FDC94B22@hermes.eCom pany.gov>
>X-MS-Has-Attach:
>X-MS-TNEF-Correlator:
>Thread-Topic: Bugfinder Being Indicted As Criminal ("Counterfeiter") in France
>Thread-Index: AcQXXaIuxPoBesWyT3SJ6PLz7USnzQ==
>From: "Drew Copley" <dcopley@eeye.com>
>To: <bugtraq@securityfocus.com>, <full-disclosure@lists.netsys.com>
>
>http://www.guillermito2.net/archives/2004_03_25e.html
>
>[thanks to AJ 'Effin' Reznor]
>
>[Disclaimer: I don't know who has seen this already, and I do not
>pretend to know the full facts of the case. -- Drew ]
>
>Excerpt:
>
>It's quite interesting to discover, from the inside, how the french
>justice system works. I'm back from Paris. I've just been indicted and
>charged of distributing programs that violated Intellectual Property
>rights (literally translated, it's "counterfeiting and concealment of
>counterfeiting"). Maximum punishment for these charges are two years in
>jail and a fine of 150.000 euros. I'm not yet judged guilty or innocent,
>but I already had to pay around two or three thousands dollars for two
>trips to Paris (I live in Boston, MA, USA), plane tickets, and lawyer
>fees. I already talked about my story here (in french).
>
>...
>
> In march 2002, I published on my website a long analysis about this
>software. This webpage showed how the program worked, demonstrated a few
>security flaws, and some tests with real viruses. I showed that, unlike
>the advertizing claimed, this software didn't detect and stopped "100%
>of viruses". So, nothing really extraordinary. The company first reacted
>in a weird way: they denounced me publicly as a "terrorist", probably a
>nice attempt to make me change my mind. Later on, they filed a formal
>complaint against me in a Paris tribunal.=20
>
>...
>
>
>

[Chris Wysopal]

In-Reply-To: <20040402143855.27920.qmail@www.securityfocus.com>


From: K-OTiK Security <Special-Alerts@k-otik.com>

>The article 323-3-1 of this "Law" will prohibit publication of any vuln. technical details, any proof of concept and any exploit.

Googling and translating the law gives this:

http://www.iris.sgdg.org/actions/lsi/evol/art35.html

After article 323-3 of the penal code, it is inserted article 323-3-1 thus
written:

"Art. 323-3-1. - The fact of offering, of yielding or of placing at the
disposal a data-processing program conceived to commit the offences
envisaged by articles 323-1 to 323-3 is punished sorrows planned for the
infringement itself or the infringement most severely repressed "

Sure looks like the penalty for publishing an exploit tool will be equivalent to using the tool to commit a computer crime. I guess there aren't going to be any computer security conferences in France ever again. Will Securityfocus and PacketStorm need t
o filter French addresses? Will we have to stop selling penetration testing products to French citizens?

Cheers,

Chris

[Renaud Deraison]

On Sat, Apr 03, 2004 at 08:42:52PM -0000, Chris Wysopal wrote:
> In-Reply-To: <20040402143855.27920.qmail@www.securityfocus.com>
> Googling and translating the law gives this:
>
> http://www.iris.sgdg.org/actions/lsi/evol/art35.html
>
> After article 323-3 of the penal code, it is inserted article 323-3-1 thus
> written:
>
> "Art. 323-3-1. - The fact of offering, of yielding or of placing at the
> disposal a data-processing program conceived to commit the offences
> envisaged by articles 323-1 to 323-3 is punished sorrows planned for the
> infringement itself or the infringement most severely repressed "

This is inaccurate - the link you gave comes from the initial version
of this article, which has been modified since then.

This article now reads (roughly translated) :

"Art. 323-3-1. - The fact of offering, of yielding or of placing at the
disposal a data-processing program conceived to commit the offences
envisaged by articles 323-1 to 323-3 is punished sorrows planned for the
infringement itself or the infringement most severely repressed "

This article is not applicable when the offering, the yelding or
the placing at disposal is justified by the needs of scentific or
technical research or by the needs of the security or protection
of communication networks or information systems"

[http://www.telecom.gouv.fr/internet/projet_len.html]

Of course, the "needs" in question are a purely subjective notion,
which means that if a french citizen publishes an exploit,
he must expects to argue in front of a judge why doing so was
needed.




-- Renaud

[K-OTiK Security]

In-Reply-To: <20040403225951.GA3424@nessus.org>


>From: Renaud Deraison <deraison@nessus.org>
>Subject: Re: Bugfinder Being Indicted As Criminal ("Counterfeiter") in France
>
>This article now reads (roughly translated) :
>
>"Art. 323-3-1. - The fact of offering, of yielding or of placing at the
>disposal a data-processing program conceived to commit the offences
>envisaged by articles 323-1 to 323-3 is punished sorrows planned for the
>infringement itself or the infringement most severely repressed "
>
>This article is not applicable when the offering, the yelding or
>the placing at disposal is justified by the needs of scentific or
>technical research or by the needs of the security or protection
>of communication networks or information systems"
>
>[http://www.telecom.gouv.fr/internet/projet_len.html]
>
>Of course, the "needs" in question are a purely subjective notion,
>which means that if a french citizen publishes an exploit,
>he must expects to argue in front of a judge why doing so was
>needed.

The second part of the article "..is justified by the needs of scentific or technical research .." do not exist any more (removed during the last vote).

They just added "This article is not applicable when the offering, the yelding ... is not intentional" (to protect hacked, or infected people).

http://www.senat.fr/leg/pjl03-144.html

Chaouki Bekrar - Security Consultant
http://www.k-otik.com

[K-OTiK Security]

In-Reply-To: <20040403204252.8002.qmail@search.securityfocus.com>


>From: Chris Wysopal <cwysopal@atstake.com>
>Subject: Re: Bugfinder Being Indicted As Criminal ("Counterfeiter") in France
>
>Sure looks like the penalty for publishing an exploit tool will be equivalent to using the tool to commit a computer crime. I guess there aren't going to be any computer security conferences in France ever again. Will Securityfocus and PacketStorm need
to filter French addresses? Will we have to stop selling penetration testing products to French citizens?
>

Here is the last updated version of this Art. 323-3-1 :

"The fact, without legitimate reason, to import, hold, offer, yield or place at the disposal a data-processing program conceived or especially adapted to commit one or more offences envisaged by articles 323-1 to 323-3 is punished sorrows planned for the
infringement itself or the infringement most severely repressed"

As you can see, the vicious legislators introduced into the new version of this article the term "hold...without legitimate reason" -

Concretely, this wants to say : "Any person handling exploits/viruses (researcher,consultant,hacker or kiddie) is guilty, and is in an illegal situation which could lead him to be charged - And if you are charged, YOU have to prove that you are innocent"


(Remember? "Universal Declaration of Human Rights (Article 11)")

So, if this law is voted next week, France will replace the presumption of innocence by the "presumption of culpability", and all security consultants/researchers here, will have the criminal status !

Bekrar Chaouki - Security Consultant
http://www.k-otik.com