[jojomodding]

So apparently some CCC-connected hackers already unmasked one of them years ago (as reported in the update, which could have also just linked to the talk here: https://media.ccc.de/v/37c3-12134-hirne_hacken_hackback_edit... )

Makes you wonder if the investigators discovered this independently, or decided to maybe ask the hackers already involved in defending against them for help...

[hobofan]

I'm not deep into the topic, but AFAIK there generally isn't a warm connection between the CCC and the BND in Germany (in the recent years mostly due to the BNDs involvement ins spying on German citizens, but I think there is also deeper history there). If a hacker collaborates with the BND they do run a risk of many of their peers not wanting to collaborate with them anymore.

[foepys]

It also has something to do with the so called "Hackerparagraph" [1] under which whitehat hacking is basically impossible in Germany. Even writing a program that could potentially be used for hacking is a crime. If you followed the law word for word the authors of e.g. curl could be charged under this law.

1: https://de.wikipedia.org/wiki/Vorbereiten_des_Aussp%C3%A4hen... [de]

[groby_b]

> If you followed the law word for word the authors of e.g. curl could be charged under this law.

They really couldn't. BVerfG (Germany's constitutional court) has clearly said that dual use tools have a presumption of not being tools to break the law. It's been very clear that mens rea matters. And that a narrow reading of the law is the only constitutional reading.

The problem here is taking "word for word" as "by dictionary meaning", which is never how laws are read.

It's still a problematic law (together with §202a/b) because it doesn't clearly carve out space for grey-hat activities (white-hat attacks with authorization really don't fall under it even with creative reading).

On the upside, Germany is considering fixing that. On the downside, it moves with the speed of classic German bureaucracy and is being "discussed" since 2024.

[Vespasian]

> The problem here is taking "word for word" as "by dictionary meaning", which is never how laws are read.

Back in the days of "smart contracts" and "DAOS" this was something many well-meaning technical people struggeled with. Humans and their societies are flexible and therefore laws must be flexible as well (to a certain degree before it becomes damaging).

It's also why a lawyer/expert is usually recommended when engaged with legal matters: We as layman lack all the context around seemingly "simple" concepts, procedures and definitions. You can learn all of that or hire a professional.

[throawayonthe]

What Colour are your bits?

https://ansuz.sooke.bc.ca/entry/23

[wil421]

Isn’t that by design so governments can prosecute citizens they don’t like? For example, curl is probably ok but that one annoying Kim Dotcom guy is probably going to catch a case under some dubious law.

[belorn]

The pirate bay case, one of the laws cited by the judges was an law written to target biker bars and their owners. It only takes a bit of creative work to bend laws and prior cases to match an already made conclusion, if that conclusion has enough political support.

In that way, I don't really think the government need to design laws to have loop holes in them. With enough political pressure they can get the judges to make any decision they like.

[NewJazz]

There's a moxie marlinspike quote about this

[PowerElectronix]

It'll nevee cease to amaze me how some countries find such creative ways to stifle innovation while they look to be caring about safety or what not.

[JumpCrisscross]

> some countries find such creative ways to stifle innovation while they look to be caring about safety or what not

I'm not sure white-hat hacking is broadly compatible with German culture. Keep in mind that going bankrupt in Germany permanently closes off lots of avenues, from future lending to whether you can be in senior management at a public company.

[dudefeliciano]

Bankruptcy does not usually permanently bar you from loans or holding senior management position, there are temporary restrictions, unless grossly negligent. But your point still stands I guess, when compared to the US

[cookiengineer]

>There (...) isn't a warm connection between the CCC and the BND in Germany

Fun fact: In the 1990s, the CCC e.V. was declared a terrorist organization by the BND. Also, a lot of members have been sued for Landesverrat (high treason) for disclosing found vulnerabilities and/or doing journalistic work.

For example, the netzpolitik guys have been sued for high treason twice.

Just as a side note on how competent the German state is to use their existing talent to work on issues in cyber security.

> If a hacker collaborates with the BND they do run a risk of many of their peers not wanting to collaborate with them anymore.

Another fun fact: There is no effective witness protection program in Germany. You have to have been attacked almost murdered twice (with legal cases leading to prosecution) before you can apply for the witness protection program.

And they're asking themselves why all the witnesses in high profile cases from Europol/Interpol keep disappearing ...

[cineticdaffodil]

Well at least the german state can collaborate with russian agents in projects like wirecard and not violate any laws when threatening journalists reporting on its collaborations.

[edm0nd]

>but AFAIK there generally isn't a warm connection between the CCC and the BND

nor should there be.

Similar to how us American hackers have a huge dislike and distrust of the FBI.

Your own law enforcement agency will lie to you, manipulate you, raid you, extort you, and imprison you over bullshit.

[lukan]

"Your own law enforcement agency will lie to you, manipulate you, raid you, extort you, and imprison you over bullshit."

But this is not, how it should be. And not all law enforcement agencies are like this.

[pjc50]

It's very difficult to stop them doing this. The extent to which it happens varies a lot, and some countries and places have a much worse problem than others, but fundamentally if you "cause trouble" to "respectable people and companies" you're going to get hassled by law enforcement. Yes, the sarcasm quotes are important.

[_the_inflator]

Sadly, there is a rift now since quite a few hackers are left leaning and therefore are by definition activists.

80th, 90th were the last time were hacking was a means to an end. C64 and Amiga scene had skindheads showing up at copy parties but no one cared really.

Some were a bit unsure but the moment they talked about their craft there was no divide but hacker spirit.

In recent years this would be unimaginable. And guess what? Talking to each other made the skins disappear.

It was more of a niche expression without doing harm. Popper, Goths, Ted’s, Rockers - in comparison to today there was more unity than today.

Hooligans were the same. Many local groups that fought each other due to political stances befriended each other later because it was more of a ritual than ideology.

It is a bit sad because politics doesn’t belong to hacking, and never did.

Hacking is Boolean only in the sense of it either works or it doesn’t. Or does a computer care about left or right?

And BtW that’s why I find local attempts in Europe for “Go EU” pathetic. It is about ideology, not improvement.

[hofrogs]

Computers don't care whether they are used for good or for evil. I would rather have a culture that encourages using computers for good, and there is nothing sad about such culture existing. Computers are already used for evil on a much larger scale by meta, palantir, etc.

[jojomodding]

Maybe the special agents watched the talk in their free time

[Pfeil]

Linus Neumann himself was also wondering in this recent german podcast episode why this is happening now. https://logbuch-netzpolitik.de/lnp550-wes-brot-ich-ess-des-l...

Apparently they had not been contacted.