Re: Legality of Open Source Tools

[Toni Korpela <admin () xorfork com>]

On 04/06/2014 11:54 AM, Jeffrey Walton wrote:
> On Sun, Apr 6, 2014 at 4:24 AM, Henri Salo <henri () nerv fi> wrote:
> > Basic examples, which I have personally encountered:
> >
> > 1) Not allowed to port scan. Some ISPs are already monitoring and warning users
> > in case they do port scanning, but the reason for alerting might only be that
> > they monitor and try to get rid of malware in their networks.
> > 2) Not allowed to list vulnerable systems. I can't for example list all
> > non-updated WordPress installations with their version numbers even this
> > information is available to anyone.
> Item 2 is kind of interesting. Can you cite a reference?
>
> I ask because the US's DMCA has provisions for Security Testing &
> Evaluation and Reverse Engineering. So we are allowed to "test" the
> system (some hand waiving), but its unclear [to me] what can be done
> after the testing.
>
> The ST&E exemption is in Section 1205 (i) SECURITY TESTING. The RE
> exemption is in Section 1205 (f) REVERSE ENGINEERING.
>
> Sorry to wander off-topic...

I did not mention this on my earlier post because it is offtopic,
but as you asked for reference here it is:

The Finnish Criminal Code sections 9 a and 9 b do contain
passwords, access codes or other corresponding information
which can be used to endanger or harm information and
communication systems.

http://www.finlex.fi/fi/laki/kaannokset/1889/en18890039.pdf

The sections are in the translated document on pages 143 and 144.

-Toni



_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/