On Sat, Apr 03, 2004 at 08:42:52PM -0000, Chris Wysopal wrote: > In-Reply-To: <20040402143855.27920.qmail@www.securityfocus.com> > Googling and translating the law gives this: > > http://www.iris.sgdg.org/actions/lsi/evol/art35.html > > After article 323-3 of the penal code, it is inserted article 323-3-1 thus > written: > > "Art. 323-3-1. - The fact of offering, of yielding or of placing at the > disposal a data-processing program conceived to commit the offences > envisaged by articles 323-1 to 323-3 is punished sorrows planned for the > infringement itself or the infringement most severely repressed " This is inaccurate - the link you gave comes from the initial version of this article, which has been modified since then. This article now reads (roughly translated) : "Art. 323-3-1. - The fact of offering, of yielding or of placing at the disposal a data-processing program conceived to commit the offences envisaged by articles 323-1 to 323-3 is punished sorrows planned for the infringement itself or the infringement most severely repressed " This article is not applicable when the offering, the yelding or the placing at disposal is justified by the needs of scentific or technical research or by the needs of the security or protection of communication networks or information systems" [http://www.telecom.gouv.fr/internet/projet_len.html] Of course, the "needs" in question are a purely subjective notion, which means that if a french citizen publishes an exploit, he must expects to argue in front of a judge why doing so was needed. -- Renaud
