Full-Disclosure is now ILLEGAL in France ! (Vulnerabilties,

[K-OTiK Security]

A new anti-security law was voted yesterday in France, this law called LEN (loi pour la confiance dans l'économie numérique), the article 34 with his 323-3-1 says :

"The fact, without legitimate reason, of holding, of offering, of
yielding or of placing at the disposal equipment, instrument, a
data-processing or program conceived or especially adapted to
make the facts envisaged by articles 323-1 to 323-3 is punished sorrows
planned respectively for the infringement itself or the infringement
most severely repressed."

Translation :

- having or distributing exploit code and/or detailed vulnerability
information and/or information about hacking techniques, is ILLEGAL.
- having or distributing hacking/security tools, scanners, pen testers, or technical white papers is ILLEGAL.
- magazines and websites distributing security information about vulnerabilities or exploits are ILLEGAL.

pathetic !

the term "hold...without legitimate reason" replaced the the presumption of innocence by the "presumption of culpability", it means : "Any person handling exploits/viruses (researcher,consultant,hacker or kiddie) is guilty, and is in an illegal situation
which could lead him to be charged - And if you are charged, YOU have to prove that you are
innocent"

Send us our "green cards" - thanks !

K-OTik Staff /// http://www.k-otik.com

[Chris Johnson]

On 8 Apr 2004, K-OTiK Security wrote:

>
>
> A new anti-security law was voted yesterday in France, this law called LEN (loi pour la confiance dans l'économie numérique), the article 34 with his 323-3-1 says :
>
> "The fact, without legitimate reason, of holding, of offering, of
> yielding or of placing at the disposal equipment, instrument, a
> data-processing or program conceived or especially adapted to
> make the facts envisaged by articles 323-1 to 323-3 is punished sorrows
> planned respectively for the infringement itself or the infringement
> most severely repressed."
>
> Translation :
>
> - having or distributing exploit code and/or detailed vulnerability
> information and/or information about hacking techniques, is ILLEGAL.
> - having or distributing hacking/security tools, scanners, pen testers, or technical white papers is ILLEGAL.
> - magazines and websites distributing security information about vulnerabilities or exploits are ILLEGAL.
>
> pathetic !
>
> the term "hold...without legitimate reason" replaced the the presumption of innocence by the "presumption of culpability", it means : "Any person handling exploits/viruses (researcher,consultant,hacker or kiddie) is guilty, and is in an illegal situatio
n which could lead him to be charged - And if you are charged, YOU have to prove that you are
> innocent"
>
> Send us our "green cards" - thanks !
>
> K-OTik Staff /// http://www.k-otik.com
>

This is and always has been in the Napoleonic Code if I remember
correctly from my school days.

--------------------------------------------------------------------------------
Chris Johnson |Internet: johnson@nmr.mgh.harvard.edu
Systems Administrator |Web: http://www.nmr.mgh.harvard.edu/~johnson
NMR Center |Voice: 617.726.0949
Mass. General Hospital |FAX: 617.726.7422
149 (2301) 13th Street |Why do I even bother?
Charlestown, MA., 02129 USA | Me
--------------------------------------------------------------------------------

[Chris Wysopal]

In-Reply-To: <E1BBxu4-0000l0-00@smtp01.mrf.mail.rcn.net>

>From: "Richard M. Smith" <rms@computerbytesman.com>
>
>Would this new French law apply to an American (or other foreigner) who
>travels to France for business or on a vacation if this person has >published exploit code on a Web site?

Will it apply to any web site with exploit code/tools accessible from France? In November 2000 a French court ruled that Yahoo must block French users from accessing sales of Nazi memorabilia. Yahoo was subject to fines of 100,000 francs (US$12,853) per
day if it didn't block French users.

CDT has the story:
http://www.cdt.org/publications/pp_6.20.shtml

-Chris

[Chris Johnson]

On Fri, 9 Apr 2004, Geoffrey wrote:

> Chris Johnson wrote:
>
> > This is and always has been in the Napoleonic Code if I remember
> > correctly from my school days.
>
> Then you don't want to do business in Louisiana, USA either then. The
> laws there are based on the Napoleonic code as well. One reason they
> have parishes rather than counties..
>
> --
> Until later, Geoffrey Registered Linux User #108567
> Building secure systems in spite of Microsoft
>

I should have been more explicit. The assumption of guilt
before innocense is a part of French law and has been since Napoleonic
times I believe. You'll find that Napoleonic law and that which is
derived from it (including Louisiana law) is a very different creature
than that which is derived from English Common Law. The wording of
the French law doesn't surprise me at all.

-------------------------------------------------------------------------------
Chris Johnson |Internet: johnson@nmr.mgh.harvard.edu
Systems Administrator |Web: http://www.nmr.mgh.harvard.edu/~johnson
NMR Center |Voice: 617.726.0949
Mass. General Hospital |FAX: 617.726.7422
149 (2301) 13th Street |If ignorance is bliss, why aren't there more
Charlestown, MA., 02129 USA |happy people? Tea bag tag
-------------------------------------------------------------------------------

[Geoffrey]

Chris Johnson wrote:

> This is and always has been in the Napoleonic Code if I remember
> correctly from my school days.

Then you don't want to do business in Louisiana, USA either then. The
laws there are based on the Napoleonic code as well. One reason they
have parishes rather than counties..

--
Until later, Geoffrey Registered Linux User #108567
Building secure systems in spite of Microsoft

[Romain Francoise]

Chris Johnson <johnson@nmr.mgh.harvard.edu> writes:

> The assumption of guilt before innocense is a part of French law and
> has been since Napoleonic times I believe.

Er... hello? France, the country of the Declaration of the Rights of
Man and of the Citizen?

You're wrong, presumption of innocence is the rule in all democracies,
and in particular in France. Get your facts straight before posting
that kind of misinformation to a public mailing-list.

Reading for the week-end:

http://en.wikipedia.org/wiki/Presumption_of_innocence
http://en.wikipedia.org/wiki/Declaration_of_the_Rights_of_Man_and_of_the_Citize n
http://en.wikipedia.org/wiki/Democracy

--
Romain Francoise <romain@orebokech.com> | I've become someone else's
it's a miracle -- http://orebokech.com/ | nightmare...