Germany Outlaws Hacking, Cripples Security Industry

A new law that just went into effect in Germany has many in the hacking community pulling their software and exploits from the web. The law, known as Paragraph 202C, makes it illegal to possess, use, produce, or distribute a “hacker tool” in Germany.

As Bre Pettis over at the MAKE Blog notes, the term “hacker tool” is very vague. “Nmap or other network monitoring systems could fall into this category.”

Already the makers of the excellent KisMAC, a Mac wifi sniffing and hacking software have pulled the app code and stopped developments owing to the law. KisMAC, which, like any hacking tool, can be used for good or nefarious purposes, is still the best means of demonstrating how uselessly weak WEP encryption is and convincing people to go with WPA for wireless security.

The KisMac site says the software will be reborn “soon” with a new team of hacker in the Netherlands.

Naturally the law has no practical effect on security either inside Germany or out, it simply drives hackers and innovation out of the country, similar to the way U.S. export law drove many companies that wanted to export strong cryptography to foreign shores (the U.S. laws have since been greatly relaxed, though it's still considered an “extraordinary threat to the national security”).

However, the German government is not satisfied with even this semi-deranged law, and according to TidBits, plans more, ignorant, short-sighted and downright scary laws for the future.

There's a further, broader set of changes to German law coming in 2008, too, which don't specifically deal with hacking, but which raise similar concerns. The potential new policy covering Vorratsdatenspeicherung - loosely: the retention of stored data - includes all mobile and fixed telephony and data transfers. It has an incredibly overarching effect in requiring firms to retain records about the origin, destination, and location of parties involved in calling, emailing, text messaging, and other activities. A demonstration against the law is scheduled for 22-Sep-07 in Berlin.

As a commenter over at MAKE notes, “it would be nice if politicians actually had to know something about what they were making decisions on.” Indeed it's not hard to see how, if you knew nothing about the internet and hacking, this law would seem to make at least some sense, but of course politicians the world over continue to make ill-conceived laws about things they only dimly understand at the risk of crippling entire industries.

So what's a hacker to do? Apparently the only real option is to get out of Germany. Or take up knitting instead.