Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

The ACTA Fight Returns: What Is At Stake & What You Can Do

Soulskill posted more than 2 years ago | from the sopa-was-a-warmup dept.

Censorship 82

An anonymous reader writes "The reverberations from the SOPA fight continue to be felt in the U.S. and elsewhere, but it is the Anti-Counterfeiting Trade Agreement that has captured increasing attention this week. Several months after the majority of ACTA participants signed the agreement, most European Union countries formally signed the agreement yesterday (notable exclusions include Germany, the Netherlands, Estonia, Cyprus and Slovakia). Michael Geist has a full rundown on what is at stake and what you can do, wherever you live."

Sorry! There are no comments related to the filter you selected.

Obama! (2, Informative)

Anonymous Coward | more than 2 years ago | (#38844805)

He'll change... oh wait... no fuck that.

Re:Obama! (5, Interesting)

sycodon (149926) | more than 2 years ago | (#38844869)

He signed the treaty, despite it not being ratified by the Senate. I don't think he can weasel out by whining the Senate was ignoring it. The Constitution is pretty clear on this.

[The President] shall have Power, by and with Advice and Consent of the Senate, to make Treaties, provided two thirds of the Senators present concur.

BTW (4, Informative)

sycodon (149926) | more than 2 years ago | (#38844971)

Re:BTW (3, Informative)

rahvin112 (446269) | more than 2 years ago | (#38845523)

Presidents routinely sign treaties that aren't later ratified by Congress, there is nothing special about what Obama did compared to any of the other dozen treaties that Congress never ratified.

Re:BTW (1)

sycodon (149926) | more than 2 years ago | (#38845593)

I am wondering if it is considered by whatever groups to be binding at that point.

Re:BTW (1)

hitmark (640295) | more than 2 years ago | (#38848583)

Yea, i think the recent bruhaha about some books and such going out of public domain was a side effect of a treaty signed a couple of decades ago but only recently ratified.

Hell, the list of non-ratified treaties is a long one i suspect. The sad part is when the rest of the world is expected to behave as if everyone is bound by the treaty while it sits as non-ratified in the US governmental system.

So this makes it OK? (0)

Anonymous Coward | more than 2 years ago | (#38851369)

Your argument is that the U.S. Constitution has been violated in the past, so it's OK if it is done again.

Re:Obama! (1)

Drafell (1263712) | more than 2 years ago | (#38845115)

So, providing the Senator that was with him agreed, it was all good.

Re:Obama! (0)

Anonymous Coward | more than 2 years ago | (#38846051)

So, providing the Senator that was with him agreed, it was all good.

I dunno, it's not very clear whether it has to be exactly two thirds. 100% of those present might be too much.

Re:Obama! (2)

poetmatt (793785) | more than 2 years ago | (#38845339)

Wha? Ron Wyden is already seeking answers quite appropriately about the question of "does the president even have authority to call this an executive agreement" - it seems the president has defined it as one himself. [techdirt.com]

Where are you getting treaties from? It's defined as a trade agreement, and the president is calling it an executive agreement.

Re:Obama! (4, Interesting)

sycodon (149926) | more than 2 years ago | (#38845565)

Here is what the Feds say [state.gov]

But it seems to me that an "Executive agreement" as it is defined in that reference is pretty much unconstitutional.

I think your average reasonable man would say that a Treaty, duly ratified, has the force of law and is applicable to all citizens.

An Agreement, on the other hand, would have the parties conduct themselves in a certain manner (follows certain protocols or procedures) with respect o the subject matter. but do so within the framework of the law.

So, while an "Agreement" would have the Feds use the existing U.S. laws to enforce the goals, they would still have to follow the law (i.e. get a court order to shut down a site).

A Treaty, on the other hand, would have the force of law and presumably not require the government to get a court order.

That's my guess anyway. But only a fool relies on internet posts for their information eh?

Re:Obama! (1)

poetmatt (793785) | more than 2 years ago | (#38865397)

heh. the funny thing is, I see no reference to the executive branch in any way. Quite interesting.

Just the reference to "Executive agreement", but even that seems to indicate "The senate needs to be involved"

Re:Obama! (0)

Anonymous Coward | more than 2 years ago | (#38846299)

Why is this flamebait?

Re:Obama! (1)

hitmark (640295) | more than 2 years ago | (#38848601)

New guy, same as old guy. I find myself wondering if all of the worlds democracies (leave the debate about the definition of that alone, thanks) have ended up with some combo of regulatory and bureaucratic capture. With that i mean that the staff that is not replaced after a election can slow walk any policy change they do not agree with, and so the de facto policy never changes between elections.

protests (0)

Anonymous Coward | more than 2 years ago | (#38850819)

Polish protest against ACTA http://www.youtube.com/watch?v=YPiV_SB-scM

Shut it down (4, Funny)

geekoid (135745) | more than 2 years ago | (#38844815)

shut is all down.

How about a week long blackout?
Or a week of backhoe accidents.

Re:Shut it down (0)

kiwimate (458274) | more than 2 years ago | (#38845363)

Or a week of backhoe accidents

Nice. Really mature attitude, there.

And then you wonder why governments get heavy handed.

Re:Shut it down (-1)

Anonymous Coward | more than 2 years ago | (#38845911)

Straw man argument. We don't wonder.
They will get heavy handed *anyway*.
That's the whole damn point.

I bet you're one of those pathetic cowards, who will rather let their partner beat them up "a little bit" once a day for thirty years, than risk to be beat up ten little bits *once* to stop it now.

Re:Shut it down (1)

Zontar The Mindless (9002) | more than 2 years ago | (#38847615)

And I'll bet you're great fun at parties.

Re:Shut it down (0)

Anonymous Coward | more than 2 years ago | (#38883513)

Top argument! Really! I'm impressed.

But go ahead, retards. Let them abuse you more and more. Be the good little serf! Cause you obviously *love* it, and rather beat the messenger (because you can) than the abuser.

Re:Shut it down (0)

Anonymous Coward | more than 2 years ago | (#38849351)

There is NO excuse for a "heavy handed" government. People like you make it easy for the individuals that make up that government, remember these are your friends and neighbors, to be that way. It's not a monolith, it's people making decisions and not being made to answer for them.

So let's give gov'ts even MORE power! (-1)

Anonymous Coward | more than 2 years ago | (#38844827)

Vote for candidates that promise to raise taxes!

No way any government will use the resources that those taxes buy to reduce your freedom.

Never happen.

Right?

RIGHT????

Signing is only the start of the battle (5, Informative)

Elektroschock (659467) | more than 2 years ago | (#38844841)

Signing does not mean a thing because the European Parliament still has to decide whether to give its consent, and when a single nation asks the European court of Justice, or the Constitutional court then it's dead, because it is against EU Treaties/constitutions. it's not too late to get involved [ffii.org] .

Re:Signing is only the start of the battle (5, Interesting)

Seumas (6865) | more than 2 years ago | (#38845023)

Actually, the START of the battle was two or three years ago. At the most lenient, the start of the battle was at least a YEAR ago, when the fact that ACTA was being worked on in secret (and partly by our president, who promised his would be the most open administration!) was exposed to the public.

It's great that people are all freaking out about this in the last few days before ACTA is being signed, but WHERE THE FUCK WAS EVERYONE FOR THE LAST 12+ MONTHS?! I'd been bringing ACTA up to people over most of this time and they just returned with dumb blank stares.

Re:Signing is only the start of the battle (3, Informative)

Wowsers (1151731) | more than 2 years ago | (#38846063)

You will get blank stares because if you're like the UK, not one word has been mentioned in the press about the ACTA treaty. Even today, you can watch foreign news on protests in a few countries (there's a week long protest going on in Poland who signed the treaty), but despite the UK signing the ACTA treaty - not one word in the British press about it or that there are even protests abroad about ACTA, no mention of how devastating it will be for internet freedom democracy and rule of law.

No mentions in the press is censorship and just what proponents of ACTA like.

Re:Signing is only the start of the battle (1)

Nemyst (1383049) | more than 2 years ago | (#38847897)

How bizarre that large news corporations heavily involved in copyright lobbying wouldn't report about the negative bits of ACTA, huh?

What you can do? (4, Insightful)

geminidomino (614729) | more than 2 years ago | (#38844849)

Bend over, grab your ankles, and hold your breath.

This is why those scumbags let SOPA sputter so easily. They knew this was in the pipe. How's that "victory" taste now? Yeah, thought so.

Until there's actually some tangible consequences to stop them doing so, you'd all (and that goes for everyone in any country) best come to grips with the fact that you exist to be boned in the bottom by your governments.

Re:What you can do? (3, Informative)

Microlith (54737) | more than 2 years ago | (#38844889)

This is why those scumbags let SOPA sputter so easily. They knew this was in the pipe.

ACTA was signed by the US months ago. They were trying to pile SOPA on top of it.

Re:What you can do? (3, Interesting)

Jonner (189691) | more than 2 years ago | (#38845195)

I'm fairly certain the "signing" was legally meaningless in the US at least. Only the US Senate has the power to approve international treaties. Of course, the fact that US Congress hasn't declared war since WWII hasn't prevented US involvement in countless wars.

Re:What you can do? (2)

the eric conspiracy (20178) | more than 2 years ago | (#38845471)

Better go look up "executive agreement".

Re:What you can do? (0)

Anonymous Coward | more than 2 years ago | (#38849553)

Congress has declared war multiple times since then, most notably and recently with the AUMF with respect to AlQaeda.

-- Tom Perkins
I may not have an account, but I am not anonymous.

Re:What you can do? (1)

geminidomino (614729) | more than 2 years ago | (#38845519)

Well naturally, since it's a self serving bit of crap. OTOH, they might not have been sure that all their little minions across the water would do it, so they needed something to attack those ebil overseas websites with.

Re:What you can do? (3, Funny)

hcs_$reboot (1536101) | more than 2 years ago | (#38847867)

ACTA was signed by the US months ago. They were trying to pile SOPA on top of it.

$ rm -f ???A

Re:What you can do? (1)

Jonner (189691) | more than 2 years ago | (#38845131)

Bend over, grab your ankles, and hold your breath.

This is why those scumbags let SOPA sputter so easily. They knew this was in the pipe. How's that "victory" taste now? Yeah, thought so.

Until there's actually some tangible consequences to stop them doing so, you'd all (and that goes for everyone in any country) best come to grips with the fact that you exist to be boned in the bottom by your governments.

SOPA and PIPA have been stopped for now because many big corporations with a lot of money were against it in addition to ordinary Internet users. I haven't heard of many big corporations against ACTA.

Re:What you can do? (1)

newcastlejon (1483695) | more than 2 years ago | (#38846507)

Bend over, grab your ankles, and hold your breath.

It's best not to hold your breath; you don't want to be tensed up when they get to work.

Re:What you can do? (0)

Anonymous Coward | more than 2 years ago | (#38847949)

Bend over, grab your ankles, and hold your breath.

Nope, because for the many of us it won't change a thing about how we use the Internet.

Be a creator, not a consumer, and none of this matters.

Stop dancing to their tune, literally.

it's too late (0)

Anonymous Coward | more than 2 years ago | (#38844881)

there's nothing to be done. the internet as we know it will continue to be regulated, filtered, censored, monitored, and exploited for commercial gain.

it's time for something new.

Top down; bottom up (3, Interesting)

sakdoctor (1087155) | more than 2 years ago | (#38845225)

Ok, but it hasn't all been a top down government and corporate conspiracy.
Normal people (aka the yahoos) have played their role by placing their entire digital lives in highly centralised web-based services, (facebook, twitter, etc). This makes regulation, censorship and monitoring child's play. Even the "blogosphere" was a better model than this.

Something new? I can tell you there won't be any modern day miracles. A bunch of anti-social intellectuals will increasingly use darknets to communicate, and everyone else will stay in their gilded cages; secure beneath the watchful eyes.

Like it was yesterday.... (0)

Anonymous Coward | more than 2 years ago | (#38844893)

Man, remember user-generated content? Hard to believe that free independent media used to thrive on the net. How does slashdot manage to stay under INTERPOL's radar? You guys post a lot of pirated articles.

------
Sent from my iPhone 6

Nothing (0)

Anonymous Coward | more than 2 years ago | (#38844913)

I can do nothing. That's the beauty of ACTA.

Do you think Europe has been merged under a financial dictatorship so that random assholes like me have it easier to do something against ACTA?

Fuck NO. Someone is winning WW2 here and I am lucky if I have enough income to keep me shitting... and watch them on TV.

Re:Nothing (0)

JonySuede (1908576) | more than 2 years ago | (#38844955)

winning WW2

I thought that it was won by the Swiss bankers ?

White House "Petitions" (5, Informative)

oneiros27 (46144) | more than 2 years ago | (#38844951)

Assuming that the White House actually takes the petitions seriously [whitehouse.gov] , the current ACTA related petitions are:

... and, not ACTA related, but as I'm an ALA member, there's also one that needs another 6k signatures by next week for funding for school libraries [whitehouse.gov] . (although, personally, I'd rather it go to regular public libraries, so they have access over the summer)

Re:White House "Petitions" (2)

MobyDisk (75490) | more than 2 years ago | (#38845553)

Why would anyone want him to submit it to the Senate? So long as he does not do this, the signature is meaningless. It seems to me that everyone signing that petition is asking for it to be ratified.

Re:White House "Petitions" (1)

oneiros27 (46144) | more than 2 years ago | (#38845663)

I can see your argument, but that assumes we have someone in power who's willing to ignore it because it was improperly done.

I would assume the rationale would be to force it to be discussed in open, as opposed to these behind the scenes ways in which it might've been approved without ever having seen the light of day if it hadn't been for leaks. We'd be up with the lobbying efforts dumping money into it, but we'd also have a chance to for the citizens to petition congress as was done with SOPA.

Re:White House "Petitions" (1)

MobyDisk (75490) | more than 2 years ago | (#38882569)

Have the US courts ever enforced a treaty that was not signed by the Senate? That would be like enforcing a law that was not signed or voted upon. I think that would be real armed uprising material there.

Re:White House "Petitions" (0)

Anonymous Coward | more than 2 years ago | (#38845697)

Why would anyone want him to submit it to the Senate? So long as he does not do this, the signature is meaningless.

If he signs it as an "executive agreement" (or whatever he's calling it), then it is (for all intents and purposes) a done deal. Like all the other constitutionally questionable things he's done already.

Unless someone challenges it, like submitting it to the Senate.

Otherwise if everyone pretends it's valid, then for all intents and purposes, it's valid.

Re:White House "Petitions" (1)

MobyDisk (75490) | more than 2 years ago | (#38882685)

Define "a done deal?" As of now, his signature has no force of law. Obama can sign anything he wants: credit card receipts, autographs, or his underwear. There's nothing magical about his signature unless it is on a piece of legislation approved by the legislature. Maybe he just did it for the lolz.

What court would uphold something that the senate never voted upon? Who would arrest someone for violating an international treaty that was never ratified? Has that ever happened?

ACTA in the USA (2)

msheekhah (903443) | more than 2 years ago | (#38845059)

Since Obama signed the treaty, is there anything we can do in the US besides bend over?

Re:ACTA in the USA (2)

BenSchuarmer (922752) | more than 2 years ago | (#38845415)

It doesn't official until two thirds of the Senate approves it.

Encourage your Senators to vote against it.

Re:ACTA in the USA (2)

Nethemas the Great (909900) | more than 2 years ago | (#38845445)

Signing it means nothing if not ratified by congress.

Ignore the law? (1)

betterunixthanunix (980855) | more than 2 years ago | (#38845949)

You could just ignore the law and use the Internet to route around this sort of thing. Why follow an unjust law?

Of course, when a few people are imprisoned for doing so, and the news media tells everyone else about it, people will be frightened back into conformance. That is, of course, how things are supposed to work in the free world, right?

Re:ACTA in the USA (0)

Anonymous Coward | more than 2 years ago | (#38848019)

Since Obama signed the treaty, is there anything we can do in the US besides bend over?

Duh.! Maybe not re-elect him?

What benefits do these countries get from signing? (2)

chihowa (366380) | more than 2 years ago | (#38845221)

I understand how the US benefits from everyone else signing this treaty, but how is this in the interests of the other countries? Why is everyone else so motivated to sign this?

Re:What benefits do these countries get from signi (2)

tbird81 (946205) | more than 2 years ago | (#38845269)

To gain the permission to beg for a free trade deal with the US.

Re:What benefits do these countries get from signi (4, Interesting)

iMadeGhostzilla (1851560) | more than 2 years ago | (#38845503)

They are pressured by the US (mostly). In Serbia (where I'm from) for example, Biden attempted to force Serbia to allow importing of GMO food, currently forbidden by the Serbian law. Here's a statement made by the American ambassador in Serbia during a speech to the Serbian Chamber of Commerce: (http://serbia.usembassy.gov/g100302.html) (emphasis mine)

"Our Foreign Agricultural Service, for example, facilitates a U.S. Department of Agriculture Technical Assistance Program to assist Serbia in its WTO accession process. This support aims to help Serbia establish a trade regime consistent with the WTO and other international standards-setting. Our Foreign Agricultural Service office is currently assisting the Serbian Ministry of Agriculture to amend the new Law on Genetically Modified Organisms – or GMO’s -- to bring Serbia's GMO regime into WTO compliance and advance Serbia's WTO negotiations."

They are doing their job -- pushing interests of big corporations, we have to do ours -- defend against it.

Re:What benefits do these countries get from signi (4, Informative)

qbast (1265706) | more than 2 years ago | (#38845671)

When in Poland a parliament commission approved resolution asking prime minister to postpone signing ACTA, official from US embassy called demanding explanation why it was voted and who voted for it. Here [googleusercontent.com] is translated link from Polish source.

online petitions (3, Informative)

blackest_k (761565) | more than 2 years ago | (#38845229)

https://secure.avaaz.org/en/eu_save_the_internet/ [avaaz.org]
Acta petition to the EU with over 600,000 people signing up and growing fast.

http://stopsopaireland.com/ [stopsopaireland.com] Trying to stop Irelands version of sopa being written in to law next week with not even a debate in the house just a junior ministers signature. Recent news suggests there may be a debate since pressure has been building all this week.

Both petitions need a lot more signatures if they are going to influence the respective politicians.

Re:online petitions (0)

Anonymous Coward | more than 2 years ago | (#38847307)

quote from avaaz.org: "let's give them the push they need to reject the treaty. Sign the petition -- we'll do a spectacular delivery in Brussels when we reach 500,000 signatures!"

Actually in Poland some activists are gathering singnatures (not online, on paper) in order to start a nationwide referendum (polish law requires 500k signatures for this) about ACTA. They need 500k, they already have 200k.

Full rundown...not (4, Insightful)

kiwimate (458274) | more than 2 years ago | (#38845285)

Michael Geist has a full rundown on what is at stake

No, he doesn't. He rambles on about how it's controversial and terrible and stinky, but doesn't say why. He says India has raised concerns about how it interacts with TRIPS, but doesn't bother to say what TRIPS is, or even what the acronym stands for. (Neither does the linked article on indiatimes.com.)

If you don't already know exactly what ACTA is, then it's a waste of time reading it. Nowhere does he say what's at stake. He just says "here's how to contact someone about it, and you should because it's a bad thing (insert jedi hand wave))"

Re:Full rundown...not (3, Insightful)

jesseck (942036) | more than 2 years ago | (#38845609)

I think part of the problem is no one knows that ACTA is, exactly. My understanding when ACTA came to a year ago was that different versions were released so they could track who leaked ACTA.

What you can do (0)

Anonymous Coward | more than 2 years ago | (#38845319)

Stop funding Holywood! Don't buy movies. Cut the cord on your TV. Stop giving these guys money to lobby to take away your rights. Support local bands, and whatever true Indy movies are left. Or read a book!

*AAs are legally DDOSing us! (0)

Anonymous Coward | more than 2 years ago | (#38845761)

SOPA, PIPA, ACTA...

I learned recently some legislation already passed unnoticed and people say the recent "events" happened without the need of SOPA... because current laws are already enough.

What else is on the pipeline and will blow up in our collective faces?

IMHO they got so much money they can put up a decoy law proposal just to attract protestants while passing the good ones in a submarine fashion.

Not a good time to be a US citizen, me thinks... or, for that matter, not a good time to be very close to the US, too...

Kill Hollywood. (3, Insightful)

unity100 (970058) | more than 2 years ago | (#38845795)

They are the carriage industry refusing to die, and blocking progress. Kill hollywood. fix your problems. and no - 'dont buy their stuff' will not work. they already have enough money to buy lawmakers until the end of century. find another way. best would be to buy lawmakers ourselves. internet/tech companies need to spearhead this shopping spree.

Re:Kill Hollywood. (1)

Thing 1 (178996) | more than 2 years ago | (#38846839)

I applaud your capitalization progress. Seriously. It is refreshing to communicate using protocols.

Re:Kill Hollywood. (2)

unity100 (970058) | more than 2 years ago | (#38846913)

there is no such progress. i am capitalizing first words so that some of you, who cant see past the form to look at the content, will not get confused. such mindset is what got us into these messes in the first place. but there is no time to wake you up to that.

Re:Kill Hollywood. (2)

Thing 1 (178996) | more than 2 years ago | (#38847261)

Hang on, "wake me up to abused protocols?" I think you have difficulty in communicating, again. I'm already awakened to abuse of protocols. I thought you were learning; again, I'm chagrined. There's hope for the future, though. Download "Thrive".

Re:Kill Hollywood. (0)

Anonymous Coward | more than 2 years ago | (#38847283)

Your "content" is awful. Form does in fact matter. And you are not in any position to judge who is "awake" regarding anything whatsoever. You are more asleep than you accuse the GP of being.

Re:Kill Hollywood. (1)

unity100 (970058) | more than 2 years ago | (#38847431)

Your "content" is awful

dont read them then.

Re:Kill Hollywood. (1)

Zontar The Mindless (9002) | more than 2 years ago | (#38847709)

Content are singular.

Re:Kill Hollywood. (0)

Anonymous Coward | more than 2 years ago | (#38846859)

You think Microsoft, Apple, Facebook, Amazon and Google aren't buying already, just to mention a few?

The problem is you can buy policos in the first place. It's supposed to be one person one vote, not one buck one vote...

sweden? (1)

WanQiaoYi (2459934) | more than 2 years ago | (#38845917)

(notable exclusions include Germany, the Netherlands, Estonia, Cyprus and Slovakia) Sweden is not on the list of countries that don't support? Seems strange .. but what do I know, I'm not from Europe

Re:sweden? (0)

Anonymous Coward | more than 2 years ago | (#38846383)

The reason Netherlands did not sign yet seem to have logistical/bureaucratical reasons. They will probably sign soon. Seem for Spain and Germany.

Source (in Dutch) [telecompaper.com]

Re:sweden? (0)

Anonymous Coward | more than 2 years ago | (#38846463)

Another source, in Dutch [webwereld.nl]

Re:sweden? (0)

Anonymous Coward | more than 2 years ago | (#38846519)

The Swedish ambassador to Japan signed it on behalf of the Swedish government.

I find that the best source for info about ACTA and Sweden is a a blog [mpbloggar.se] (Swedish) run by EU-parliamentarian Carl Schlyter (Green party).

There is a demo against ACTA on Feb 4th at 12.00 in several cities in Sweden. In Stockholm, it will be held at Sergels Torg.

What can we do? (0)

nurb432 (527695) | more than 2 years ago | (#38846247)

Pretty much nothing. We don't have the funding or strings required to even be heard, let alone action taken on our requests.

Re:What can we do? (0)

Anonymous Coward | more than 2 years ago | (#38848181)

So you just give up?

Give Obama a way out (1)

hemo_jr (1122113) | more than 2 years ago | (#38846709)

The contention is that since ACTA does not change any laws so it can just be considered an executive agreement and not a treaty. However, the President may have second thoughts on this in light of the poulist anti-SOPA/PIPA movement, the potential for a bribery scandal, and his declarations in favor of Internet freedom.

If Obama does want to dump ACTA, the best way to do it is to sent it to the Senate for ratification. He can do this by paying attention to a petition to do so:

http://wh.gov/KxA [wh.gov]

Voluntarily sending ACTA to the Senate for ratification would alienate his Hollywood contributors. In this case he may wait for a law-suit to force the issue, in which case the Supreme Court may need to decide if ACTA needs to be ratified by the Senate.

WHORES OF SILICON VALLEY, INC. (-1)

Anonymous Coward | more than 2 years ago | (#38846789)

Spook BackDoors In Cisco Routers
- Older news, but still relevant!!
    Please save this story and repost it everywhere
    Especially in Security Discussion Forum Sites
- You should use OpenBSD or a hardened Linux distro
    For a router, NOT these blackboxes offered with
    proprietary hardware & firmware!

http://www.forbes.com/2010/02/03/hackers-networking-equipment-technology-security-cisco.html [forbes.com]

"Special Report
Cisco's Backdoor For Hackers
Andy Greenberg, 02.03.10, 01:45 PM EST
The methods networking companies use to let the Feds watch suspects also expose the rest of us.

ARLINGTON, Va. -- Activists have long grumbled about the privacy implications of the legal "backdoors" that networking companies like Cisco build into their equipment--functions that let law enforcement quietly track the Internet activities of criminal suspects. Now an IBM researcher has revealed a more serious problem with those backdoors: They don't have particularly strong locks, and consumers are at risk.

In a presentation at the Black Hat security conference Wednesday, IBM ( IBM - news - people ) Internet Security Systems researcher Tom Cross unveiled research on how easily the "lawful intercept" function in Cisco's ( CSCO - news - people ) IOS operating system can be exploited by cybercriminals or cyberspies to pull data out of the routers belonging to an Internet service provider (ISP) and watch innocent victims' online behavior.

But the result, Cross says, is that any credentialed employee can implement the intercept to watch users, and the ISP has no method of tracking those privacy violations. "An insider who knows the password can use it without an audit trail and send the data to anywhere on the Internet," Cross says.

Cross told Cisco about his findings in December 2008, but with the exception of the patch Cisco released following the revelation of its router bug in 2008, the security flaws he discussed haven't been fixed. In an interview following Cross' talk, Cisco spokeswoman Jennifer Greeson said that the company is "confident in its framework." "We recognize that security is complicated," she said. "We're looking at [Cross'] findings and we'll take them into account."

Cisco isn't actually the primary target of Cross' critique. He points out that all networking companies are legally required to build lawful intercepts into their equipment.

Special Report
Cisco's Backdoor For Hackers
Andy Greenberg, 02.03.10, 01:45 PM EST
The methods networking companies use to let the Feds watch suspects also expose the rest of us.

ARLINGTON, Va. -- Cisco, in fact, is the only networking company that follows the recommendations of the Internet Engineering Task Force standards body and makes its lawful intercept architecture public, exposing it to peer review and security scrutiny. The other companies keep theirs in the dark, and they likely suffer from the same security flaws or worse. "Cisco did the right thing by publishing this," says Cross. "Although I found some weaknesses, at least we know what they are and how to mitigate them."

The exploitation of lawful intercept is more than theoretical. Security and privacy guru Bruce Schneier wrote last month that the Google ( GOOG - news - people ) hackings in China were enabled by Google's procedures for sharing information with U.S. law enforcement officials. And in 2004 and 2005, a group of hackers used intercept vulnerabilities in Ericsson ( ERIC - news - people ) network switches to spy on a wide range of political targets including the cellphone of Greece's prime minister.

All of that, argues IBM's Cross, means that Internet-related companies need to be more transparent about their lawful intercept procedures or risk exposing all of their users. "There are a lot of other technology companies out there that haven't published their architecture, so they can't be audited," he said in his Black Hat talk. "We can't be sure of their security as a result."

- http://search.forbes.com/search/colArchiveSearch?author=andy+and+greenberg&aname=Andy+Greenberg [forbes.com]

(C) forbes.com

Lest we forget Part 1:

https://www.networkworld.com/community/node/57070 [networkworld.com]

"Cisco backdoor still open
IBM researcher at Black Hat says opening for Feds exposes us
By Jim Duffy on Wed, 02/03/10 - 5:33pm.

The "backdoors" that Cisco and other networking companies implement in their routers and switches for lawful intercept are front and center again at this week's Black Hat security conference. A few years ago, they were cause celebre in some VoIP wiretapping arguments and court rulings.

This time, an IBM researcher told Black Hat conference attendees that these openings can still expose information about us to hackers and allow them to "watch" our Internet activity. Backdoors are implemented in routers and switches so law enforcement officials can track the Internet communications and activity of an individual or individuals under surveillance. They are required by law to be incorporated in devices manufactured by networking companies and sold to ISPs.

In this report from Forbes, IBM Internet Security Systems researcher Tom Cross demonstrated how easily the backdoor in Cisco IOS can be exploited by hackers. When they gain access to a Cisco router, they are not blocked after multiple failed access attempts nor is an alert sent to an administrator. Any data collected through the backdoor can be sent to anywhere -- not just merely to an authorized user, Forbes reports.

What's more, an ISP is not able to perform an audit trail on whoever tried to gain access to a router through the backdoor - that nuance was intended to keep ISP employees from detecting the intercept and inadvertently tipping off the individual under surveillance. But according to IBM's Cross, any authorized employee can use it for unauthorized surveillance of users and those privacy violations cannot be tracked by the ISP.

Cisco said it is aware of Cross's assertions and is taking them under consideration. To Cisco's credit, it is the only networking company that makes its lawful intercept architecture public, according to the recommendations of the IETF, the Forbes story states. Other companies do not, which means they may be susceptible to the same security flaws, or worse."

Lest we forget Part 2:

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20040407-username [cisco.com]

"Cisco Security Advisory
A Default Username and Password in WLSE and HSE Devices
Advisory ID: cisco-sa-20040407-username
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20040407-username [cisco.com]
Revision 1.4
For Public Release 2004 April 7 16:00 UTC (GMT)
Contents

        Summary
        Affected Products
        Details
        Vulnerability Scoring Details
        Impact
        Software Versions and Fixes
        Workarounds
        Obtaining Fixed Software
        Exploitation and Public Announcements
        Status of This Notice: Final
        Distribution
        Revision History
        Cisco Security Procedures

Summary

A default username/password pair is present in all releases of the Wireless LAN Solution Engine (WLSE) and Hosting Solution Engine (HSE) software. A user who logs in using this username has complete control of the device. This username cannot be disabled. There is no workaround.

This advisory is available at http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20040407-username [cisco.com] .

Affected Products

This section provides details on affected products.
Vulnerable Products

These products are vulnerable:

        The affected software releases for WLSE are 2.0, 2.0.2 and 2.5.
        The affected software releases for HSE are 1.7, 1.7.1, 1.7.2 and 1.7.3.

Products Confirmed Not Vulnerable

No other Cisco products are currently known to be affected by these vulnerabilities.

Details

A hardcoded username and password pair is present in all software releases for all models of WLSE and HSE devices.

This vulnerability is documented in the Cisco Bug Toolkit as Bug ID CSCsa11583 ( registered customers only) for the WLSE and CSCsa11584 ( registered customers only) for the HSE.

CiscoWorks WLSE provides centralized management for the Cisco Wireless LAN infrastructure. It unifies the other components in the solution and actively employs them to provide continual "Air/RF" monitoring, network security, and optimization. The CiscoWorks WLSE also assists network managers by automating and simplifying mass configuration deployment, fault monitoring and alerting.

Cisco Hosting Solution Engine is a hardware-based solution to monitor and activate a variety of e-business services in Cisco powered data centers. It provides fault and performance information about the Layer 2-3 hosting infrastructure and Layer 4-7 hosted services.

Vulnerability Scoring Details
Cisco has provided scores for the vulnerabilities in this advisory based on the Common Vulnerability Scoring System (CVSS). The CVSS scoring in this Security Advisory is done in accordance with CVSS version 2.0.

CVSS is a standards-based scoring method that conveys vulnerability severity and helps determine urgency and priority of response.

Cisco has provided a base and temporal score. Customers can then compute environmental scores to assist in determining the impact of the vulnerability in individual networks.

Cisco has provided an FAQ to answer additional questions regarding CVSS at
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html [cisco.com] .

Cisco has also provided a CVSS calculator to help compute the environmental impact for individual networks at
http://intellishield.cisco.com/security/alertmanager/cvss [cisco.com] .

Impact

Any user who logs in using this username has complete control of the device. One can add new users or modify details of the existing users, and change the device's configuration. Here are some more concrete examples of possible actions:

        For WLSE this means that an adversary can hide the presence of a rogue Access Point or change the Radio Frequency plan, potentially causing system-wide outages. The first action may cause long term loss of information confidentiality and integrity. The second action can yield Denial-of-Service (DOS).
        For HSE this may lead up to illegal re-directing of a Web site with the ultimate loss of revenue.
        In both cases the device itself may be used as a launching platform for further attacks. Such attacks could be directed at your organization, or towards a third party.

Software Versions and Fixes

When considering software upgrades, also consult http://www.cisco.com/go/psirt [cisco.com] and any subsequent advisories to determine exposure and a complete upgrade solution.

In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center ("TAC") or your contracted maintenance provider for assistance.

For WLSE, users need to install the WLSE-2.x-CSCsa11583-K9.zip patch. The patch can be downloaded from http://www.cisco.com/pcgi-bin/tablebuild.pl/wlan-sol-eng [cisco.com] ( registered customers only) . Installation instructions are included in the accompanying README file, WLSE-2.x-CSCsa11583-K9.readmeV3.txt, in that same download directory. This patch is applicable to WLSE 1105 and 1130 software releases 2.0, 2.0.2 and 2.5.

For HSE, users need to install the HSE-1.7.x-CSCsa11584.zip patch. The patch can be downloaded from http://www.cisco.com/pcgi-bin/tablebuild.pl/1105-host-sol [cisco.com] ( registered customers only) . Installation instructions are included in the accompanying README file, HSE-1.7.x-CSCsa11584.readme.txt, in that same download directory. This patch is applicable to HSE 1105 for versions 1.7, 1.7.1, 1.7.2, and 1.7.3.
Workarounds

There is no workaround.

Obtaining Fixed Software

Cisco has made free software available to address this vulnerability for affected customers. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment.

Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/public/sw-license-agreement.html [cisco.com] , or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml [cisco.com] .

Do not contact either "psirt@cisco.com" or "security-alert@cisco.com" for software upgrades.

Customers with Service Contracts

Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com./ [www.cisco.com]
Customers Using Third-Party Support Organizations

Customers whose Cisco products are provided or maintained through prior or existing agreement with third-party support organizations such as Cisco Partners, authorized resellers, or service providers should contact that support organization for guidance and assistance with the appropriate course of action in regards to this advisory.

The effectiveness of any workaround or fix is dependent on specific customer situations such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround or fix is the most appropriate for use in the intended network before it is deployed.
Customers Without Service Contracts

Customers who purchase direct from Cisco but who do not hold a Cisco service contract and customers who purchase through third-party vendors but are unsuccessful at obtaining fixed software through their point of sale should get their upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows.

        +1 800 553 2447 (toll free from within North America)
        +1 408 526 7209 (toll call from anywhere in the world)
        e-mail: tac@cisco.com

Have your product serial number available and give the URL of this notice as evidence of your entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC.

Refer to http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml [cisco.com] for additional TAC contact information, including special localized telephone numbers and instructions and e-mail addresses for use in various languages.
Exploitation and Public Announcements

The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory.

Status of This Notice: Final

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.

A stand-alone copy or Paraphrase of the text of this document that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors.

Distribution

This advisory will be posted on Cisco's worldwide website at http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20040407-username [cisco.com] .

In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients.

        cust-security-announce@cisco.com
        bugtraq@securityfocus.com
        first-teams@first.org (includes CERT/CC)
        cisco@spot.colorado.edu
        comp.dcom.sys.cisco
        firewalls@lists.gnac.com

Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates.

Revision History

Revision 1.4

2004-April-12

Fixed URL for Cisco.com Downloads under Obtaining Fixed Software section.

Revision 1.3

2004-April-08

Updated Software Versions and Fixes section.

Revision 1.2

2004-April-08

Updated to include WLSE 1105 in Software Versions and Fixes section.

Revision 1.1

2004-April-07

Correction in the Obtaining Fixed Software section.

Revision 1.0

2004-April-07

Initial public release.

Cisco Security Procedures

Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html [cisco.com] . This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt [cisco.com] ."

http://www.forbes.com/2010/02/03/hackers-networking-equipment-technology-security-cisco.html?feed=rss_technology_security [forbes.com]

Cisco handholds hackers to backdoor
Routers are vunerable to wiretapping flaw
By Spencer Dalziel
Fri Feb 05 2010, 14:39

AN INSECURITY EXPERT at IBM reported to the Black Hat conference that he discovered Cisco routers are vulnerable to a potential surveillance backdoor.

According to Arstechnica, Tom Cross, security systems researcher at IBM, gave a presentation exposing the backdoor to demonstrate how the 'lawful intercept' function in Cisco's system can be targeted by hackers to gain access to data flowing through the routers.

Hackers aren't blocked after failed attempts to access a Cisco router and notification alerts aren't sent to the administrator. Making matters even worse, ISPs can't detect and track who the culprits might be because their employees aren't allowed to detect and intercept.

It is not entirely Cisco's fault. The 'lawful intercept' function was deployed after a US Federal Communications Commission (FCC) ruling a few years ago that allowed wiretapping by law enforcement agencies on all networking hardware. All telecommunications vendors had to build monitoring solutions into their hardware.

However this ruling meant all equipment with the lawful intercept functions had gaping holes that left them open to back door surveillance attacks.

Cross told Cisco about the problem in December and it issued a patch. But there are still a lot of vulnerable systems out there because network administrators haven't applied the patch.

Cisco's wiretapping system open to exploit, says researcher
By John Timmer | Published February 4, 2010 6:20 PM

To meet the needs of law enforcement, most telecommunications equipment includes hardware and software that allow for the monitoring of traffic originating with the targets of investigations. The precise capabilities are often dictated by formalized standards, which allow any hardware maker to implement a compliant system. Unfortunately, these standards often leave the hardware wide open to various attacks that leave regular users vulnerable, and provide savvy surveillance targets the opportunity to evade the snooping. An IBM researcher has put Cisco's system under the microscope at a Black Hat Conference, and found it comes up short.

Although the standard was designed to put Cisco hardware in compliance with EU directives, it has apparently been adopted by a number of other hardware makers. The presentation, described in detail by Dark Reading, describes how its reliance on SNMPv3, creates a variety of options for attack. For example, the protocol was initially vulnerable to a brute force attacks on its authentication system; although Cisco has patched that flaw, there's no way to determine how many unpatched machines remain in the wild.

SNMP also defaults to operating over UDP, and it's relatively easy to spoof things like the source address and port for that protocol. It's possible to use TCP instead, and even limit the addresses that can access the hardware, but the protocol doesn't specify either of these. Communications aren't encrypted by default, and the system won't notify administrators when a trace is activated or disabled, meaning that hackers could potentially set up or eliminate surveillance without anyone being aware of it.

The IBM researcher, Tom Cross, notified Cisco of the issues back in December, and recommends revisions to the standard that will ensure that it is more secure by default. That might be helpful, but it still wouldn't deal with the problems posed by unpatched systemsâ"Cross himself apparently recognizes that network administrators can be hesitant to risk the disruption of service that may come with updating major pieces of equipment.

if you are in a party ... (0)

Anonymous Coward | more than 2 years ago | (#38850133)

just email to the guys you sent off to the eu council and tell them that if they will vote for it when the eu council has to vote, you will leave the party ... worked for me and I will keep a close eye on him if he keeps the promise.

Should we trust the cloud? (0)

Anonymous Coward | more than 2 years ago | (#38850581)

It makes you wonder what happens to your files if you're on dropbox/skydrive/rapidshare etc and they get taken down - loads of megaupload users with legal files are angry. Can the cloud really be an alternative?

Felix article from Imperial College London raising awareness: http://felixonline.co.uk/comment/2071/sopa-who-got-the-last-lulz/

Check for New Comments
Slashdot Login

Need an Account?

Forgot your password?