Norway gives hackers free rein on Net


14 January 1999

Norway could become a haven for computer hackers after its Supreme Court ruled that trying to break into a computer over the Internet is not a crime until the system is actually breached, experts said yesterday.

In its decision, believed to be the first of its kind, the court last month said those who open an Internet connection must expect that outsiders will seek ways to enter their system and that it is the owners' responsibility to protect their computers.

But critics said the ruling is comparable to allowing burglars to check the doors and windows of a house for locks and not prosecuting them until they actually break in.

In theory, hackers in Norway can now legally search computers anywhere in the world for security holes.

The ruling arose from a 1995 case against a company that specializes in computer security.

An Oslo-based company, Norman Data Defence Systems, sought ways to break into the University of Oslo's computers through the Internet as part of a news report by the Norwegian state broadcasting network NRK.

Kai Thoergersen, a lawyer for the company, said yesterday that it simply mapped holes in the computers' security systems, without breaking in, tampering or stealing any information.

The university sued, and a lower court ordered the company to pay the equivalent of $ 13,500 U.S. for violating a law against hacking into computers. The company appealed, and the case reached the Norwegian Supreme Court, which dismissed the fine, partly because the company had not broken into the computer.

The company claimed it had done nothing more than what any Internet users do each time they search the global network for information.

But Arne Laukholm, director of Information Technology for the University of Oslo, said the Supreme Court ruling opens the way for systematic and malicious attacks on computers.

He said protecting computers hooked up to the global network against such hacking is difficult and expensive.

Dave Farber, a computer expert at the University of Pennsylvania, called it "a bad precedent" that could allow hackers to operate legally in Norway, even if their actions violate other nations' laws.

The ruling was made Dec. 15 [1998], but the court did not publish its basis for the decision until this month.

Copyright © 1998 LEXIS®-NEXIS®, a division of Reed Elsevier Inc. All rights reserved.