|  | ||
Statement of Concerns |
| | ||
Statement of Concerns |
Greetings:
As leading security practitioners, educators, vendors, and users of information security, we wish to register our misgivings about portions of the Council of Europe draft treaty on Crime in Cyberspace.
We are concerned that some portions of the proposed treaty may inadvertently result in criminalizing techniques and software commonly used to make computer systems resistant to attack. Signatory states passing legislation to implement the treaty may endanger the security of their computer systems, because computer users in those countries will not be able to adequately protect their computer systems and the education of information protection specialists will be hindered.
Critical to the protection of computer systems and infrastructure is the ability to
System administrators, researchers, consultants, and companies all routinely develop, use, and share software designed to exercise known and suspected vulnerabilities. Academic institutions use these tools to educate students and in research to develop improved defenses. Our combined experience suggests that it is impossible to reliably distinguish software used in computer crime from that used for these legitimate purposes. In fact, they are often identical.
Currently, the draft treaty as written may be misinterpreted regarding the use, distribution, and possession of software that could be used to violate the security of computer systems. We agree that damaging or breaking into computer systems is wrong and we unequivocally support laws against such inappropriate behavior. We affirm that a goal of the treaty and resulting legislation should be to permit the development and application of good security measures. However, legislation that criminalizes security software development, distribution, and use is counter to that goal, as it would adversely impact security practitioners, researchers, and educators.
Please do not hesitate to call on us for technical advice in your future deliberations.
This statement represents the professional opinion of each individual signer. Unless stated otherwise, it may not represent the official position of the signer's parent organization.