Bavarian Police Can Legally Place Trojans On PCs 256
An anonymous reader writes "The Bavarian Parliament passed a law that allows Bavarian police to place 'Remote Forensic Software' (Google translation) on a suspect's computer as well as on the computers of a suspect's contacts. They may break into houses in secret to install the RFS if a remote installation is not possible; and while they are there a (physical) search is permitted too. The RFS may be used to read, delete, and alter data." The translation says that RFSs may be used in cases of an "urgent threat to the existence or the security of the Federation or a country or physical, life or liberty of a person... Even where there is a reasonable assumptions on concrete preparatory acts for such serious offenses."
Yes, (Score:5, Funny)
but does the trojan run on linux?
Re:Yes, (Score:4, Interesting)
but does the trojan run on linux?
Funny how the context allows a "does it run on linux" joke get modded up as insightful....
...What about the Soviet Russia jokes? Will they get mod as informative?
Re:Yes, (Score:5, Funny)
In the German state Bavaria, the police trojans you!
No, it simply doesn't have that ring to it.
In German state of Bavaria (Score:5, Funny)
Polizei in lederhosen kann deine computerhosen.
Re:Yes, (Score:5, Funny)
Hey, at least they use trojans when they screw you.
Re: (Score:2)
Im sure if you drink enough wine, it will.
Re:Yes, (Score:4, Insightful)
If they are allowed to break in, they can install a hardware keylogger. Which yes, does run against linux.
No (Score:2)
No, they can only screw you if you're running a Windows OS.
They probably install some variant of Back Orifice before slamming in the Trojan.
Re:Yes, (Score:5, Insightful)
Re:Yes, (Score:5, Insightful)
Yeah, cause it's nothing like the PATRIOT act in the US
Please (Score:5, Informative)
Bill Clinton had Carnivor [wikipedia.org] and Magic lantern [wikipedia.org] for this sort of thing long before Bush was even in the White House, around 1995.
The Federal government has been violating due process and the US Constitution since FDR was in office.
Don't try and pretend that Bush was the first to do this sort of thing with the Patriot Act, all he did was use it to amend the Constitution.
Re:Please (Score:5, Insightful)
The Federal government has been violating due process and the US Constitution since FDR was in office.
Really? We didn't violate due process before FDR? I know you were trying to make a point, but what about Wilson? [wikipedia.org] Lincoln? [wikipedia.org] Jackson? [wikipedia.org] Or Adams? [wikipedia.org] How about Washington? [wikipedia.org]
Re:Yes, (Score:5, Funny)
Come on, now. I'm pretty sure the Gestapo knew how to break into houses and search them in secret.
Re:Yes, (Score:4, Interesting)
When I was in Munich I had a phone and a PC. The PC had voicemodem so it could act as a answering machine / fax machine. I got some cables to plug it into the phone socket. And the wierd thing is I could get the phone to work or the PC but not both. It turns out that German phone sockets will only allow one device to be connected. Someone said that this was to "prevent eavesdropping. In Germany this is regarded as important because of our experience of Nazism".
I said something like "if the Nazis tapped phones they presumably did it at the exchange, not by having some sinister dude in a leather coat, monacle and jackboots sitting in the spare room taking notes". The German guy explaining gave me a very dirty look.
Re:Yes, (Score:5, Informative)
I assumed that the system was devised to prevent overloading - most commercial exchanges have some kind of limit on how many phones they can support. In the UK it's called "ringer equivalence number" and if you exceed it they don't guarantee that your phones will work. In practice it's the ringers that fail first.
Re: (Score:2, Funny)
Yeah, I found that out later. But I thought it was funny that the first guy I asked referenced the Nazis in his (non) explanation of N and F connectors.
Re: (Score:2)
Hell, they're even dubbing 'allo 'allo [bbc.co.uk] for TV now. Times change :-)
Doesn't explain why the guy thought the N/F connectors are an anti-nazi measure though.
Sorry, you are wrong (Score:5, Informative)
Sorry, most of what you said or suspected is wrong. The system is actually a very clever design which prevents interruption of data/fax calls by the phone and in fact also eavesdropping from another phone inside the house.
The "multi-way phone sockets" are usually of the NFN-Type. Here F means "Fernsprecher" (Phone) while N means "Nicht-Fernsprecher" (Non-Phone). The socket is designed so that the line goes first to the left N socket , then to the right N socket and finally to the F socket. The phone will always be the last in chain. A non-phone device (fax, modem) plugged into one of the N sockets is supposed to have two electronic switches inside which will chain-through the line to the next socket when the device does not use the line. So if you are not sending a fax or surfing the net, you will be able to use the phone normally. However when the fax/modem takes over, the phone will be cut off. This clever trick prevents you from interfering with the transmission by picking up the phone.
As you are not supposed to plug two phones into one box, this also prevents eavesdropping. Overload prevention is not the reason. There were and are devices available which either are put before the NFN-box and allow to wire another NFN-box or contain a F or NFN socket themselves. Both will allow to wire a second phone and of course you could use more than one of these devices. These device however contain a automatic switch will will cut-off the other phone when one is in use. But they will all ring.
Re:Sorry, you are wrong (Score:4, Informative)
A non-phone device (fax, modem) plugged into one of the N sockets is supposed to have two electronic switches inside which will chain-through the line to the next socket when the device does not use the line. So if you are not sending a fax or surfing the net, you will be able to use the phone normally. However when the fax/modem takes over, the phone will be cut off. This clever trick prevents you from interfering with the transmission by picking up the phone.
One addition: The design can also be used to detect if the chained-through phone is picked up. This allows to design for example a answering machine (plugged into N) in such a way that the machine automatically stops when the phone is picked up, allowing the human user to "take over" the call from the machine.
Re: (Score:2)
Re: (Score:3, Interesting)
I said something like "if the Nazis tapped phones they presumably did it at the exchange, not by having some sinister dude in a leather coat, monacle and jackboots sitting in the spare room taking notes". The German guy explaining gave me a very dirty look.
The Nazis paid rewards for informers. Lots of people got turned in by people they trusted, including people they lived with, who found out that they were a jew.
Of course, telling secrets into a phone whose wire goes... where!?! It's just stupid anyway. But you can't expect people to be rational or informed at the best of times, and those weren't them.
Re: (Score:2)
Gestapo rarely did it in secret, why should they? They were right, the 'subject' was wrong and a lesson to others needed to be taught.
Re:Yes, (Score:5, Informative)
The original post has few problems
1. the link does not work - I suppose it was meant to be this:
http://www.heise.de/newsticker/Bundesrat-will-heimliche-Online-Durchsuchungen-auf-Terrorabwehr-beschraenken--/meldung/110466 [heise.de]
2. this article says that Bavaria did NOT managed to extend existing proposal on searching, eavesdropping etc, existing proposal is maybe not that nice but it was apparently less harmful politically than the Bavaria's extension.
Besides similar laws (lows?) already exist although not really in such drastic form. OTOH secret services do what it wants anyway - Germans violated its own and other countries' law to get account data of tax criminals. I believe there are countries where even suspicion that evidence was produced illegally or on information received illegally would nullify the whole proceeding. In Germany it apparently is not that important how you get your data as long as you can prosecute whoever you want. I guess each country has its quirks when it comes to powers that the state has.
Re:Yes, (Score:5, Informative)
http://www.heise.de/newsticker/Bayerischer-Landtag-setzt-den-Bayerntrojaner-frei--/meldung/110426 [heise.de]
It's from yesterday. The story you link to is today's and is talking about the Bundesregierung as opposed to the Staatsregierung Bayern. Roughly speaking, it's the equivalent of Federal and State government in the US.
The article says that the law has no chance of survival - it's pretty clearly in violation of the German constitution, and most Germans take their constitution *very* seriously.
My take is that it's a typical "bargaining play": aim for the moon, and if you fall on the clouds, well, it's still better than the hilltop position that you really wanted. Compare the tactic with the *IAA's lobbying. They ask for outrageous new laws, everyone gets upset and writes to their reps, the law eventually gets watered down, and everyone goes home happy, failing to notice that the *IAA have achieved yet another step along the way to their goal of total control.
Re: (Score:2)
I think most countries have this right already. Its called a warrant. It is issued by a judge to allow searches and seizures You DONT have to be informed.
This sounds only like its lowering the burden bar, not creating a 'new right of the state'.
mmmmhhh the comnparison is no good (Score:2)
Re: (Score:3, Interesting)
These swine seem to come around just about every generation and attempt to throw individual rights into the nearest garbage can. What frightens me, though, is that each time, the technology to make their efforts more likely to succeed gets better and better.
Re:Yes, (Score:4, Funny)
Re:Yes, (Score:5, Interesting)
China has quietly been spending as much as the US on their military (without the outgoing expense of 2 theatres of war) for 10 years and has 2,000,000 soldiers in uniform. 10 years ago your view would have been stupid but nowadays it is worrying that people have not noticed how the world has changed. China is already stronger than the US and is growing while the US is in decline. Russia is already back in the frame and growing fast. The US could easily be in 3rd place in 10 years time if people do not wake up soon.
People talk about the 1990s as if Russia collapsed but it did not. It had 4 times the military that the US had and it could not cope with the cost. It cut right back at a speed which looked like collapse but they kept all the good stuff (titanium hulled subs etc.) and grew from that. They are back in the game and growing fast.
I was in China 10 years ago (I look forward to going back) and could see no reason why they would want to rise up against anything. The country is so different from the picture painted in our media that it was hard to recognise it. I was in Russia 5 years ago (and hated the place) and saw a people wholeheartedly behind their government.
If we, in the west, do not pull our heads out of our arses we will end up losing a major conflict soon as we will end up having to fight in Taiwan or North Korea and we could easily be on the losing side if we still think that Chinese missiles are 1950 models when they took our designs 10 years ago and improved on them.
Bavaria? (Score:5, Informative)
In my ignorance, I asked myself "where the hell is Bavaria?". So I wiki'd it [wikipedia.org]. Turns out, it's in Germany.
The more you know...
Re: (Score:2, Funny)
I also enjoy the beer (wait... that's Brava...). oh well.
Sadly, I also realized I had no idea where Colorado was yesterday. I think I need to spend a few hours with a map and un-dumb myself...
Re: (Score:3, Interesting)
The best geography tutorial I've ever had was a game called Hearts of Iron 2. Nothing like learning about the names and basic geographical features of the world while moving various types of military units across the landscape. Cursing a province with mountains by name as your troops take months to march and/or roll through them makes it memorable, especially if you lose your beachhead because your goofy MechInf decides to take 2 weeks going a distance that would take them 2 days, if it were plains they a
Re:Bavaria? (Score:4, Funny)
Re: (Score:2)
Re: (Score:3, Funny)
China
Yeah, Wiki got... (Score:3, Funny)
Re: (Score:2, Funny)
In my ignorance, I asked myself "where the hell is Bavaria?". So I wiki'd it [wikipedia.org]. Turns out, it's in Germany.
The more you know...
Don't say that to Bavarians. They prefer to be known as the northernmost state of Italy.
Re:Where? (Score:4, Funny)
Thats simply because not enough of it is on fire to make it stand out on google earth!
Re: (Score:3, Interesting)
So... (Score:2, Interesting)
I hope not.
Will this code be safe? What if it opens the infected PC up to access by hackers and the PC is damaged or materials (virtual) are stolen? Is there any liability for the police?
Re: (Score:2)
Re: (Score:2)
If the Bavarian police can install a trojan on your PC, then your PC was *already* accessible to hackers.
This is strange... (Score:3)
Re:This is strange... (Score:4, Interesting)
I thought that the memories of the Geheime Staatspolizei made sure the germans would never approve of such things...
Most people who were alive to see World War II Germany have passed on. I think this allows the forgetfullness we see across the world -- and unfortunately is allowing history to repeat itself in the restriction of rights in many countries...
Re: (Score:3, Interesting)
WW2 was before my time, but I grew up during the Cold War. It's definitely scary to watch our country turn into the backside of the Iron Curtain that we worked for so long to tear down.
Re: (Score:3, Informative)
Re: (Score:2)
bavaria is also the most corrupt german state. only in bavaria a politician of the ruling party (the same continous ruling party for 50 years) can kill a man and injure another one while drunk driving and get away with a year probation, a federal cross of merit and the position of a chairman of the german national railway company.
Use web based applications (Score:2)
Forensic? (Score:5, Insightful)
Um, "forensic" software is typically designed to *prevent* the alteration of data. Otherwise you can't reliably go into court and prove that you haven't planted the evidence. Last I heard, Germany still embraced the concept of due process...
Not sure whether this is a crazy law passed by some locals that will be struck down by German courts, a bad write up, or a bad translation...
Re: (Score:2)
Well, they need to be able to disable any anti-malware programs that'd stop their intrusion. That's altering data.
Re:Forensic? (Score:4, Insightful)
fud, Fud, FUD! (Score:3, Informative)
I know this is slashdot and jumping at anything so we can scream 1984!!! POLICE STATE!!11!!! gets you modded informative or insightful, but this slashdot article is just crap.
The "Bundestrojaner" will only be used as a last resort and in defense to terrorism, as you can read here in an article posted today, denying the Bavarian request to use it for other crimes not directly related to terrorism.
Poor google translation:
http://translate.google.com/translate?u=http%3A%2F%2Fwww.heise.de%2Fnewsticker%2FBundesrat-will-heimliche-Online-Durchsuchungen-auf-Terrorabwehr-beschraenken--%2Fmeldung%2F110466&hl=en&ie=UTF8&sl=de&tl=en [google.com]
Ah, screw it. 1984!!! ORWELLIAN STATE!! BURN THE WITCHES!
Re: (Score:2)
Re: (Score:2)
But she has got a wart!
Re: (Score:2)
you stuck that on her! I saw you do it!
Re:fud, Fud, FUD! (Score:5, Interesting)
Re: (Score:2)
The "Bundestrojaner" will only be used as a last resort and in defense to terrorism, as you can read here in an article posted today, denying the Bavarian request to use it for other crimes not directly related to terrorism.
It's nice that their requests for non-terrorism uses were denied, but if the law doesn't say that, those denials are temporary and subject to change.
Very few governments or government agencies have the integrity to do what's right, compared to what is legal.
Re: (Score:2)
yeah and the toll collect data would never be used for police investigations (or so they said a couple of years ago).
the problem in germany is that even if the evidence was collected in an illegal way it still may be (and often is) valid before the court.
german police and german politicians may break the law as they want and go unpunished.
bullcrap (Score:3, Interesting)
The "Bundestrojaner" will only be used as a last resort and in defense to terrorism
when the law that allows the police to monitor ALL communication (email, gsm, landline) at all times, without needing any warrant was passed here, (turkey) and gave the daily running of the operation to a small board that would be directly appointed by the prime minister and his cabinet, many idiots believed that 'only as a last resort and in defense against terrorism' bullshit too.
then somehow the private conversations of opposition party members who have had a strife with the administration have been l
Re: (Score:2)
The "Bundestrojaner" will only be used as a last resort and in defense to terrorism, as you can read here in an article posted today, denying the Bavarian request to use it for other crimes not directly related to terrorism.
I did try to read the Google translation (which, as you say, was not very good), and I immediately see a problem.
It's a translation of a news report. Not of the actual legislation. Now, I'm not a lawyer - I'm not even German - but AFAIK the legislation and the interpretation the courts give it is the important bit. News reports are rather less so. And if the law is only intended to be used in a very limited subset of cases, then it should damn well be worded so it can only be used that way otherwise y
Re: (Score:2)
The "Bundestrojaner" will only be used as a last resort and in defense to terrorism
Yes, and who defines "last resort" and "terrorism"? That's a state secret...you just have to trust em.
Can American Police not do this? (Score:2)
I am actually surprised to read this on Slashdot. I thought this was already common practise in the US? I really thought that the police can get a court order and install bugs, microcameras and trojans and whatnot on a suspects computer.
Re: (Score:2)
What puzzles me is why this would be something the Bavarian Parliment would do. I would think this would be done at the national level; US laws that enable wiretaps are all at the Federal level.
Bavarian Parliament and Federal Parliament (Score:2, Informative)
What puzzles me is why this would be something the Bavarian Parliment would do. I would think this would be done at the national level; US laws that enable wiretaps are all at the Federal level.
They tried to. It came as far as the constitutional court in Germany, and failed miserably. The law now returns, slightly changed.
You have to know that in Germany, each "Land" (~County) has its own law. If there's a matter on which both a county's law and federal law exist, the federal law supercedes county law. The federal law on computer trojans failed before the constitutional court. It's been slightly changed and they're going to give it another try on the federal level the next few weeks. Meanwhile,
Re: (Score:2)
Not so common (few law enforcement agencies have the sorts of resources to make this a common occurence), but yes, that sort of thing is allowed if a judge authorizes it. The idea here is that the judge is supposed to be a neutral party who will evaluate whether law enforcement has enough evidence to justify this sort of thing. (One could do this without a judge's approval, but any data collected in such a fashion could not be used in court; plus you'd risk jail time yourself or at least you'd have your bad
Re: (Score:2)
I think you need to distinguish between monitering communications in transit (e.g. phone taps), and actively entering someones place of resedence to place a bug. The former is clearly legal with a court order, but I'm not sure about the later. The same applies in the computer world. It is one thing to intercept e-mails as they pass through the ISP, but to "break-in" to someone's computer to place the trojen is a complete other level. Further, are the police allowed to cause property damage in the proce
Even American employers can do that (Score:2)
to spy on their employees. Sure it is unethical, and maybe morally wrong, but they do it anyway.
Bill Clinton had the FBI use Magic Lantern [wikipedia.org] for that vary purpose.
Re: (Score:2)
Re: (Score:2)
Not only could they, but they already have done that. At least some of my former employers did that to me on my home computers.
Re: (Score:2)
Re: (Score:2)
I guess the Magic Lantern article wasn't enough for you then?
How to legally spy on your employees [forbes.com] and Spy cover up [usatoday.com]
Major employers such as Delta Air Lines and Google have fired employees for what they put on their own blogs. Ellen Simonetti, a Delta flight attendant, says she was fired in October 2004 after she posted pictures of herself in her uniform in suggestive poses on her blog.
"Employees should know that your employer is looking over your shoulder. If they catch you, they're canning you," says Nancy F
Re: (Score:2)
None of these links refer to (1) private companies that, (2) place trojans or other software on (3) personal non-work computers.
Magic Lantern? Government institution. Different rules (regretably).
The other links? They say nothing about personal non-work computers. They only say that either work computers are bugged, or the people might be tailed by a PI.
The straight dope... (Score:2)
One might even suggest the use of a computer to be quite counter-productive near aforementioned jugs. Ahum. Jugs.
Re: (Score:2)
Oh, I'm pretty sure that for anyone here to take advantage of said bounty, they will end up needing a computer.
Brett
will they hold? (Score:2)
How is this different than a telephone wiretap? (Score:2)
Re: (Score:2)
A wire tap intercepts communication while it is in transit. That would be similar to intercepting e-mails when they pass through the ISP. On the other hand, this trojan would be closer to the police secretly breaking into your house in order to place a (webcam?) bug.
While the former is clearly legal (with a court order), I'm not sure if the later would be. It would be dangerously close to a secret search and I imagine that while the police can serve a search warrent if you happen to not be there, they
Sounds normal (Score:2)
With a warrant the police can do that here i the US too.
Warrants can be issued for 'suspicion'.
Re: (Score:2)
A wire tap intercepts communication while it is in transit. That would be similar to intercepting e-mails when they pass through the ISP. On the other hand, this trojan would be closer to the police secretly breaking into your house in order to place a (webcam?) bug.
While the former is clearly legal (with a court order), I'm not sure if the later would be. It would be dangerously close to a secret search and I imagine that while the police can serve a search warrent if you happen to not be there, they
Re: (Score:2)
Bugging your house with cameras and microphones is legal with the proper court order, so i don't see any difference.
They can wait until you are gone under some circumstances, and setting up for long term surveillance would qualify.
Re: (Score:2)
If that is the case, then I agree there is no difference.
Do you have any citations for this? It just seems that with secret searches it would be all too easy for the police to plant evidence or make other false claims about what was found.
Encrypted Drives (Score:3, Insightful)
If you encrypt your drive, and don't leave it running while you are gone, unless they guess your password not much they can do.
Re: (Score:2)
Hardware i agree.
But i think that a miniscule hyper-visor based monitor would have troubles with encrypted booting, and would have to be OS specific since so many now bypass bios ( and thus standard keyboard/video routines )?
Inadmissible? (Score:3, Interesting)
Ironically it is admissible (Score:3, Insightful)
in a court of law even if the trojan is programmed to download porn and other things over the Internet. I can recall American employers using trojans like that to fake employees surfing the Internet too much to fire them for it. "He surfed for porn for more than 5 hours each day, so he fired him" when really the trojan surfed porn and planted it on his computer. They do that sort of thing when they want to discriminate against an employee for their religion, race, color, national origin, disability, age, ge
Re: (Score:2)
Where have I heard this before? (Score:2)
Oh yes, this sounds exactly like other totalitarian countries, like China, USA and Sweden.
Talk About Needing a Bill of Rights (Score:2)
Typo in title (Score:4, Funny)
The Security of the Federation is at stake! (Score:2)
Of course! There is no other way to deal with the Borg; if we don't use RFSs, it could mean the end of existence for the entire Alpha Quadrant, not just the Federation!
very efficient (Score:3, Interesting)
RFSs may be used in cases of an "urgent threat to the existence or the security of the Federation or a country or physical, life or liberty of a person...
Apparently, they are drawing on a century of experience that Germany has with intrusion into people's private lives, both under right wing and left wing extremist states. Even the language of the law itself is... classic.
Fruit of the Poisoned Vine (Score:3, Insightful)
But watch: there will be abuses immediately (cops cannot help themselves, they have a compulsion to "fight crime") and in about 3 years one will be egregious and funded enough to make it to seriously senior courts. Then one of these (especially the EU) will seek to exert its' jurisdiction with a ruling like the US "fruit of the poisoned vine" doctrine.
Odd thing is, the bayricherbeamter are anything but stupid and may even see and desire this.
So, this is what one needs to do: (Score:4, Interesting)
Run Linux
Encrypt Boot and home disks.
Encrypt everything.
md5sum *everything*
Boot off a knoppix or install CD periodically.
Keep a spare motherboard around and/or change motherboards frequently.
Always buy a name brand ethernet card that is a different chipset than your motherboard.
Run wireshark on your laptop which you *NEVER* let out of your sight.
Remember, thieves will only steal your stuff. The government will steal your life and liberty if it is politically possible.
I think I spot a teeny, tiny flaw... (Score:4, Insightful)
The RFS may be used to read, delete, and alter data.
So, getting this straight... They have the right to modify data in ways that can't be [reasonably] detected... and then they can use this data to press charges?
"Of course not your honor! It was different data we changed. The incredibly convenient file that says, 'I am guilty, it's a fair cop, guv! Oh yeah, it was me!' was there all along."
You're on incredibly shaky ground when you allow the police to manufacture information where they may subsequently use information to support charges. As soon as one dirty cop gets caught manufacturing evidence, you've devalued the entire method for gaining it. How long before the standard defense becomes, "My client has never seen that file before. Given the police routinely add and modify files on people's computers, prove beyond a reasonable doubt that they didn't put it there themselves and then change the logs to simply make it look like my client did it."
Re: (Score:2)
It'd be fun to disassemble, thats for sure.
Re: (Score:2, Insightful)
Symantec and Grisoft most likely are doing the spineless thing in regards to such tools already. I have a suspicion the ClamAV guys wouldn't have a problem with the signatures and even if they do third parties have ClamAV sigs now.
Re: (Score:2)
Re:Threat to liberty... (Score:5, Interesting)
Yeah it's funny when you put it that way, but that's how it usually is. When a government takes an action under the guise of national security, the nation is actually less secure because a stronger government is a greater threat to liberty.
Re: (Score:2)
Its ok nobody RTFA so it doesnt matter if it works or not
Re: (Score:2)
They have a right-wing Christian government, but at least theirs is named that way (Christian Social Union) so nobody can complain.