Publishing exploit code ruled illegal in France?
However, Tena's actions were not viewed kindly by Tegam, who initiated legal action against the researcher. That action resulted in a case being brought to trial at a Court in Paris, France. The prosecution claimed that Tena violated article 335.2 of the code of intellectual property and was asking for a four month jail term and a 6,000 euro fine.
On Tuesday, the French court ruled that Tena should not be imprisoned but gave him a suspended fine of 5,000 euros. This means he only has to pay the fine if he publishes more information on security vulnerabilities in software.
Chaouki Bekrar, a security consultant and co-founder of French Web site K-Otik, which is known for regularly publishing exploit codes, told ZDNet Australia that although it is good news that Tena did not have to go to jail, the ruling is very bad news for the security research industry in France.
"This seems to be a good news but that is not the case. Publishing a security vulnerability or a proof of concept using reverse engineering or disassembly is now illegal in France -- how can a researcher publish a vulnerability if he can't study the software's structure?" said Bekrar.
On his Web site, Tena argued that if independent researchers were not allowed to freely publish their findings about security software then users would only have "marketing press releases" to assess the quality of the software. "Unfortunately, it seems that we are heading this way in France and maybe in Europe," Tena said.
Tegam is also proceeding with a civil case against Tena and asking for 900,000 euros in damages.