Bad boy or Good boy's tool?

The upgradation of the UK’s computer crime laws is in progress and one of the new amendments proposed under the Computer Misuse Act is about making the creation and distribution of so called “Hacking Tools” a crime. There are strong criticisms coming from the security industry as many such tools that can be used by bad guys for breaking into a system are also used by good guys to test their systems for security. For example, a network sniffer can be used for eavesdropping as well as for trouble shooting a network. It depends on the context the tool is being used and marking any such tools as “hacking tools” and making them unavailable for distribution can hinder the work of system administrators and vulnerability researchers. These amendments are not in force at present and may be applied later this year.

After much concerns raised by the industry, the government is considering a few of the concerns and is recognizing the “dual use” status of a few such tools. It would need the prosecutor to prove that the author wrote the tool with malicious intend to prove him guilty, but the distribution of such tools may still be considered as crime. The Crown Prosecution Service will look for answers to the following questions for proving someone guilty or not:

- Has the article been developed primarily, deliberately and for the sole purpose of committing a CMA offence (i.e. unauthorized access to computer material)?

- Is the article available on a wide scale commercial basis and sold through legitimate channels?

- Is the article widely used for legitimate purposes?

- Does it have a substantial installation base?

- What was the context in which the article was used to commit the offense compared with its original intended purpose?

The following sources were used as my primary information source:

The Register, LightBlueTouchPaper and CPS.

IT laws can always be tricky to write and implement, and this law surely will raise many eyebrows. Thought it may help bring bad guys to justice, it will also make legitimate good guys nervous to create new tools and distribute them.