Good cloud, bad cloud - what if...

[Tomasz Miklas]

Hi!

DISCLAIMER:
I may be asking the wrong questions, it may be the wrong place to ask them and most of all even if you are a lawyer, you are not my lawyer

I was brushing up a bit on legal stuff and something came to my mind. I think those questions are not related only to cloud environments - in my view they apply to any kind of outsourced hosting/processing configuration that you don't operate yourself (somebody else runs servers for you).

Cloud is used to provide 'magic' solutions of many kinds - from simple SaaS, through PaaS to IaaS... As far as SaaS goes, 'what you see pay for is what you get' - simple, complete, strict in form. Other cloud forms are less regulated so to say and offer more room for potential abuse or 'actions with negative consequences'.
Using PaaS or IaaS - cloud becomes kind of weapon - same rules apply. Firearms don't kill people - people kill people. Cloud can be used for good or bad purpose - all depends on the end-user. I'm not saying that one is better suited to do good or bad things, it's a question of legal responsibility for providing service, which is the gray area that I'm interested in...

Questions:

1. As far as I remember, under UK law some things can be classified as 'facilitating tools to commit crime'. Ok - there is a question of intentions (I love that part about UK law hihi) but a cloud is located in... right, that's the first problem...

Let's assume an entity has created a tool (PaaS) that can be used for good or bad purpose and that tool can utilize EC2 from Amazon for example. Question is - what's the entity's liability if an end-user (called 'boss') resident in the UK (in this example) uses their magic PaaS to help himself commit something of criminal nature?

2. Which of the laws would apply in such case:
a) UK (assuming that's where the entity operates in one formal way or another)
b) End-User's country of residence - where the 'boss' is located (UK, EU, other)
c) country where the entity's platform logic is hosted (UK, EU, other)
d) country where 'boss' runs his stuff in using our magic PaaS (where his EC2 or similar instances are)
e) country where a 'cloud provider' that hosts the servers for the boss is registered (some providers have registered offices in other countries than data centers - for example Amazon)
f) country where the potential victim resides (anywhere - it's the Internet)
g) none of the above / other
h) all of the above (yikes!)
i) it depends (favorite legal line... hey - if you pick this one, I want to know the why and what are the options :->)
j) ... I bet you can come up with some other possibilities

3. What may be the potential solutions to the problem - except creating very long T&C that would cover all possible exceptions for all possible cases above (and more), etc?

I hope you see the problem - who has authority to declare which law applies? Even simple question - I run stuff on EC2 in EU, then I use data from EC2 to commit a criminal offense in country X (outside of US/EU zone). Is that EU law (data generated in EU - facilitating tools for crime), US law (Amazon is registered in US), victim's country law or where I am running the attack (country Z)?

If anybody can knows, feel free. If you want to give your best guess - go for it, just say it's a guess so others won't take it for granted... and most of all remember - this is just a theoretical exercise (but quite real) and the disclaimer from the top of this post is still valid

[ade]

Hi, I came into this thread to ask the same question. I guess we both may wait a while as no-one has replied
in the months that followed your question

I know a little about UK law from a Adv Dip in Criminology...
The easiest option is the UK Cloud Co has a UK user called boss_uk who tried to do something on that server only
e.g. crack a password etc. then its all handled here, but that's IF the law covers what the person has done.

Any of the other alternatives get messy and I have no idea.  I am doing research in to this sort of thing and we
had this debate in the office the other day.

I guess the nightmare scenario includes a user boss_russia accessing CloudUK to connect to a compromised
server on CloudUSA and attack the Australian MOD!

Anyone got any thoughts?

Ade

[Tomasz Miklas]

Exactly, that's my feeling as well.

If you do something illegal within EU you can be arrested and maybe even put on trial, if the crime is against entity in the USA they will seek extradition (funny fact - USA requires others to extradite their citizens but never allowed any of their citizens to be extradited - seems it works one way, the one that is favorable to the US).

My question was not only about cloud - it has wider audience and consequences. See German company trying to sue 'hacker' (quotes intended) or I rather say researcher based in Belgium, that found and informed them of bugs in their software and wanted to release it later, AFTER they fix it.
Another example - Thomas Roth created software for distributed GPU hash cracking... and apparently had serious legal problems because of that (of course under German law).

I have an idea for a software that can be used for to help or to harm - if I run this thing, provide it as a service (cloud style) then I can get sued by someone in Germany for providing and distributing hacking tools. Although valid point (definitely possible scenario this can be used to help with hacking into systems) classification of the software will depend on it's use and I can't control how it's used - user will be providing his own custom logic, I don't write it. I can have T&C forbidding this and that but still the users will do what they want and it will be me standing in the court as a provider and operator of the platform. This is just messed up and at the moment is one of the key reasons why I didn't go public with this thing yet. I think I will need a very very good lawyer to write T&C in a way that can give me indemnity from possible damages caused to 3rd parties by misbehaving users

This leads me to the sad conclusion - whatever the laws are, if you don't know which one can be used to go after you, find the one with most severe consequences and take it as safe assumption that this is the one that will be used Then you don't have to worry about smaller ones even though most likely they will be added by prosecution.

Disclaimer: IANAL (I Am Not A Lawyer) and I don't play one on Youtube.

[ade]

Hi Tomasz,
interesting stuff. My personal feeling is that you are pretty much safe. I can cite a few similar scenarios to you as many
objects can be used for good as well as harm...
I build cars. You use a car to get away from a bank robbery. Silly you, safe me.
I make gun, "guns don't kill people", you kill someone with said gun. Silly you, safe me.
M$ wrote VBA and I use a VBA macro to hack into your computer etc. I am in trouble, you are safe.
Prof Sir Tim Berners-Lee created the Web. I use the Web to phish for your bank details. He is safe, I am in trouble.
I own an ISP and you use your account with me to hack into (insert TLA here). You are in trouble, I will 'help'
the authorities where I can

There's a million more, so I think you would be safe as, like you said, you don't create the logic, the end user does.
I think as you are the provider, it would be your country's laws that would be of most interest (e.g. can they send
you to the US!) and I think your T&C is your protection.  There are many hacking tools out there already, and they
continue to be made. Maybe check out their T&Cs or borrow one from someone who has paid huge amounts

Another option would be to simply ring your cyber crime unit and ask them what they think. They will give you lots
of "don't quote me on this" etc, but you should get a good idea from them what they think.  If they say not to do it,
then take that on board

Can you give me a hint as to what it may be?

Good luck and I hope you get to do what it is you want to.

Ade

[Tomasz Miklas]

Thanks Ade, some really good points in your post.

I'm not arguing with any logic you explained - I entirely agree with it, but sadly what we see in some countries is far away from logical. The case of Thomas Roth is a textbook example - guy put together some scripts that allow to harness (tie together) GPU instances on EC2 - that was his magic sauce... and he got sued under German law for apparently providing hacking tools.

There is very little difference as to what his system and mine are doing - the key differences are:
- I'm currently resident to the UK (EU laws - kind of, I can be easily 'wanted' by German police)
- I allow user to do his own logic, not limiting it to hash cracking

And for the record... for me as a geek, hash cracking and similar things are just fun/research - trying to build more efficient and reliable systems. The same was with SETI@Home, BOINC, RC4 cracking competitions etc. Unfortunately some German lawyers are clearly very, very sad people - now they can sue us for having a bit of geeky fun which they don't understand.

On a more positive note - old saying says "if you want to hit a dog, you will always find some stick". Not sure if I should be at all bothered by that, maybe I should just release what I have and get over it

[ade]

Point taken, logic and law are not good bed fellows!
The 'wanted' in Germany thing is interesting. Our Police may think nothing of what
you / we do as we are not breaking any laws and doing what we do for research, but...
I decide to drive through Germany on my way to some country or get a flight that
stops in Berlin and all of a sudden I am being questioned. So these things are always
possible in unusual cases.

I would be inclined to ask someone at a higher level as you seem genuinely concerned.
I have found the National e-Crime Prevention Centre (Scotland Yard / The Met don't seem
to cover this sort of thing from what I have read). They have a contact page which is linked
below.  Simply tell them what you have done and ask if you could find yourself being
investigated.  I think that alone is mittigating should anything negative happen :-)
http://www.necpc.org.uk/contactus.html

Keep me posted!

Cheers
Ade

[Tomasz Miklas]

Awesome!

I definitely will do that as soon as I have some spare time to push it forward.
I know UK Police may just say 'naaaah, nothing happened' but as part of EU there are rules and legal instruments they have to obey and European Arrest Warrant is the most misused one.

I'll update this thread when I get some new info.
Thank you for posting the links and some great feedback!

Tomasz

[ade]

No worries and good luck.  One would like to hope that "intent" is still the biggest issue here.
In UK law (which I know isn't your fear) we have Mens Rea and Actus Reas.  First is guilty
mind and second is guilty act. In most crimes, the two must be present and must be present
at the same time.  e.g. I run over a cat with my car. Don't mean to though. There is no guilty
mind so no crime.  I intend to run over the cat, and I miss. Guilty mind but no guilty act, so no crime.
Some crimes are only guilty act oriented e.g. possession of a drug or speeding.  They don't care
(under the statute) whether you were holding it for someone else. You get caught with it, its yours!
Or you miss the sign that says 40 and keep doing 60. You still get the fine :-)
So under that doctrine, in the UK I would bet my car that you are fine.

I would hope that even in the EU, the fact that you have given this thought and you make an
enquiry with your national police force and are told you will be fine (keep anything they tell you!)
that should be sufficient to show due diligence.  After all, its not like you are the head of the IMF!
:-)

Let me know what the old bill say?

Cheers
Ade

[Tomasz Miklas]

Hmmmm...

The more I think about it... in this case I don't really have to worry
I provide something that can potentially help science with big computation tasks, create cure for some deadly disease or something like build another nuclear bomb that will mark the end of this world. When it comes to hacking, well - Thomas' system was designed to break hashes, mine is not - it's more universal and if I was to break hashes as serious business, I would use what Thomas created :-)

Still working on total rewrite of the software so hopefully I'll be able to present something more soon(ish).

[ade]

you're just teasing now :-)  Its really just an MS DOS batch file isn't it?
Still check with the old bill just to cover your tail, which can never be done after the event

[Tomasz Miklas]

you're just teasing now :-)  Its really just an MS DOS batch file isn't it?

Damn! How did you know?!
More seriously... this project is dragging for over 2 years now and I never had time to put finishing touches to release it to the public (but it's still very usable and useful) so I've decided to do complete rewrite (goes easier than fixing bits to provide finishing touches). Lack of time, etc, etc... excuses, excuses... so I'll better get on with this rewrite.

[ade]

standing by!