Vulnerability Development mailing list archives

Re: Publishing Nimda Logs


From: Valdis.Kletnieks () vt edu
Date: Thu, 09 May 2002 02:53:47 -0400

On Wed, 08 May 2002 14:59:50 PDT, Jordan Frank <jfranka () sfu ca>  said:

In addition to all this, I have a legal question. Probably the wrong forum,
because it seems that most legal questions posed on this list are answered
by people with no legal background who make educated guesses, but here goes.
It is my understanding that, at least in Canada and the United States, there
are laws addressing the issue of monitoring private conversations and making
the contents of such conversations public. Are any of these laws directly
applicable to the situation we're discussing.

IANAL, but.. ;)

At least in the US, 18 USC 2511(2)(d) says:

 It shall not be unlawful under this chapter for a person not acting under
color of law to intercept a wire, oral, or electronic communication where such
person is a party to the communication or where one of the parties to the
communication has given prior consent to such interception unless such
communication is intercepted for the purpose of committing any criminal or
tortious act in violation of the Constitution or laws of the United States or
of any State.

In other words, since it was your server, you're one of the parties, and
unless there are *other* reasons prohibiting it, you're free to disclose
the information - although I'd read that "unless" clause *carefully*, and then
think about if you want to publish a list where skript kiddies can get it...
-- 
                                Valdis Kletnieks
                                Computer Systems Senior Engineer
                                Virginia Tech

Attachment: _bin
Description:


Current thread: