Microsoft Calls Viruses "Industrial Terrorism"

evenprime writes: "John Ashcroft wants congress to declare computer crimes to be terrorism, and now it looks like microsoft is trying to jump on the bandwagon. In a recent column discussing microsoft's new STPP security program, microsoft's Michael Lane Thomas stated that destructive viruses should be recognized as acts of 'industrial terrorism.' Sounds like microsoft's future security plans may depend more on legislation than on code audits."

Comments

Naturally

[drinkypoo]

If you call it a virus, then you have to deal with it yourself. Microsoft has repeatedly shown an inability to handle such things. If you call it terrorism, it's the government's responsibility.

Re:Naturally

[Green Aardvark House]

If viruses are terrorism, then Microsoft is guilty by association under this very proposal.

They are the ones writing the easily-exploited software, providing a convenient medium in which the virus-writes can conduct their attack.

Re:Naturally

[drinkypoo]

If viruses are terrorism, then Microsoft is guilty by association under this very proposal.

They are the ones writing the easily-exploited software, providing a convenient medium in which the virus-writes can conduct their attack.

By your logic, the airlines are the cause of the terrorists crashing their planes into buildings. While there are things they could have done to help prevent it, and in fact they are things they SHOULD have done to prevent the tragic happenings of 9/11, we are shoring them up with taxpayer money so that they don't have to lay several thousand people off, and perhaps go under.

I have no idea if we'd do the same for microsoft. Probably not, in light of the DOJ's continuing (but limping) crusade against them. At another time? Probably.

Re:Naturally

[tanpiover2]

I agree. If a "circumvention device" is illegal, then "virus enabling software" should be too. :)

Re:Naturally

[Dan Jagnow]

If you call it a virus, then you have to deal with it yourself. Microsoft has repeatedly shown an inability to handle such things. If you call it terrorism, it's the government's responsibility.

No, Microsoft can't transfer all responsibility to the government simply by pushing to get viruses classed as terrorism. Theft is a crime, and the government is responsible for enforcing laws that forbid it, but that hasn't stopped companies and individuals from employing security guards, locks, car alarms, etc. Think about it; suppose you're putting some of your stuff in storage. There's a convenient storage place nearby, but you know they have a history of breakins. Are you going to be reassured that theft is illegal, and the government is responsible to find and punish the criminals, or are you going to look for some place with better security measures?

Re:Naturally

[davecb]

It's a cool conceit to call virus-writing a form of terrorism, but I don't expect it to be taken all that seriously.

We had home-grown terrorists in Canada some years ago, panicked, declared martial law, called in the army and started declaring all sorts of things terrorism, not just blowing up mailboxes and murdering diplomats. found the terrorists.

Six months later we were back to normal, and all the quasi-terroristic things we prohibited (public gatherings, for one) were back legal again. I expect no less from the U.S.

Re:Naturally

[dillon_rinker]

Who was responsible for security on their ariplanes? The airlines. Who skimped on security because it was too expensive? The airlines. Who lobbied Congress to prevent governmental mandates that would have required greater security? The airlines.

In case you hadn't noticed, they have already laid of several thousand people - tens of thousands, actually. In a capitalistic economy, if you can't find enough customers, your business goes under.

I believe that the airlines negligently contributed to the tragedies of 9/11. They didn't pull the trigger, so to speak, but they left a loaded gun where the bad guys could find it.

In the same vein, Microsoft is guilty of negligence in the design of their OS and applications. They have created products whose purpose is to be connected to the National Information Infrastructure. They have cut costs, in part, by ignoring security issues.

Re:Naturally

[czardonic]

If viruses are terrorism, then Microsoft is guilty by association under this very proposal.

They are the ones writing the easily-exploited software, providing a convenient medium in which the virus-writes can conduct their attack.

If hijackings are terrorism, then American Airlines is guilty by association under this very proposal.

They are the ones employing the easily-exploited security-checks, providing a convenient forum in which the hijackers can conduct their attack.

Re:Naturally

[susano_otter]

What, exactly, is "industrial terrorism", anyway? Can corporations be "terrorized"? Is this the same thing as "terrorizing" ("causing to become terrified"?) a civilian population?

Re:Naturally

[susano_otter]

And another thing: Is Microsoft trying to say that it (the corporation) is, or should be, terrified of viruses? This seems completely at odds with their historical nonchalance on the subject. Perhaps this conversion to a "state of intense fear" is a step in the right direction. Right?

Re:Naturally

[CmdrPinkTaco]

If you are going to use an analogy then you should at least carry through with it.

So then you are suggesting that the airlines combat terrorism via legislation. I think that this is hardly a plausable answer. Legislation only tends to beget more legislation. And only in some rare cases completely eliminates the problem that is being addressed.

OT, but I feel the need to rant here. I find the people who use analogies tend to use them much like statistics - very poorly and only when they can make an attmept to show one side ...but I digress.

Re:Naturally

[ladykadyj]

Negligence? So, does that mean that if I have a fenced in yard, and you trespass and slip on my kids' ice rink in my *fenced-in* back yard, that I am negligent? Why is it my responsibility to prevent you from hurting yourself? There is a fine line between negligence and blame-throwing and too often it is crossed.

But that is off the topic at hand...

I do, however, feel that Microsoft is responsible for the security issues with their software. I, for one, am thankful that the hackers force MS to patch their stuff, although it is a nuisance and it is destructive.

It is NOT the government's responsibility to provide an environment where we don't have to write efficient, secure code. Be responsible for yourself and for your product.

Re:Naturally

[endersdad]

I can see it now

October 23, 2001 - Today, Microsoft has applied for $4.2 Billion dollars in federal aid money. They fear a substantial drop in revenue caused by people switching from IIS to Apache to ward off 'terrorist' attacks.

Bill Gates was quoted as saying there are no definite plans to actually apply the money to fixing the security holes.

Re:Naturally

[ceesco]

If you have a pool in a fenced-in backyard, and some kid climbs over your fence and drowns, you can bet your ass you're responsible. It's called an "attractive nuisance." Now, one could argue that hole-y software is a attractive nuisance to script kiddies...

Re:Naturally

[Jason Earl]

Precisely. Microsoft wants getting viruses criminalized using the new set of "lock them up forever" terrorism rules. Then, once they have accomplished this, they will go after the security community and force them to stop pointing out security problems. At the very least they will force them to stop releasing example exploits.

Microsoft knows that these changes aren't likely to actually have much of an effect on the actual virus writers. But they know that it will have a profound effect on those people that are actively trying to secure our software.

You have got to hand it to Microsoft. I thought for sure that their recent spouting about the security community was nothing more than hot air. It would appear that the rules in the security industry are about to change.

Re:Naturally

[farnham]

Mod this guy UP!
This is extremely insightful. As soon as I saw the Ice rink comment I thought of "Attractive Nuisance" It's a concept of common law that is supposed to encourage people to think about their actions. Like if a farmer parked his combine next to a McDonalds and a bunch of kids decided to play on it like it was a magic fun house.
Sounds like script kiddies to me. Damn, this could work legally. Thank you Dr. Olexa.

Re:Naturally

[Anonymous Coward]

You are right on about the "attractive nuisance" bit visa Microsoft, but wrong about the kid climbing over your fence.

Generally a decent locked fence would give you legal immunity from this sort of thing. Now, if your had one of those 3' chainlink deals, or you left the gate open, that might be a different story. Random URL: http://www.lectlaw.com/files/civ01.htm

Re:Naturally

[Sarcasmooo!]

I won't even be as compromising as the other response; the fact is that no one needs to be in your yard, and if the country is to operate on a day to day basis, people need to fly. I better metaphor would be a company that does something stupid like making car tires that explode randomly.

By the way, anyone else wondering where the bailout money is for the people who airlines supposedly 'had' to fire after the 11th? Pfft.

Re:Naturally

[DouglasA]

I believe that the airlines negligently contributed to the tragedies of 9/11.

The hijackings were pulled off with the use of box cutters, or similar small-bladed instruments, which were permitted under general security rules at almost every airport. I doubt you could have found very many people who would have thought they should be banned, pre-9/11. No one thought such a thing was possible. Any real blame here lies with the US Gov't, who repeatedly neglected to remove and/or ban the illegals who were among the terrorists here. What would you have the airlines do, without the benefit of hindsight, to prevent that act?

And while I agree that MS bears some responsibility for the spread of these viruses, that shouldn't stop a discussion of the appropriate level of punishment for virus perpetrators. Bike locks, particularly cheap, common ones, are inherently insecure, but that doesn't make bike theft less of a crime.

Re:Naturally

[ryanwright]

If you have a pool in a fenced-in backyard, and some kid climbs over your fence and drowns, you can bet your ass you're responsible.

In our fucked up society, you're right. But that's not how it should be. If someone circumvents your protection device (a fence) and harms themselves (drowns in your pool), he only has himself to blame.

Personally, if some kid ever drowns in my swimming pool after climbing my fence, I'm going to sue his parents for trespassing and mental anguish. With any luck, a nice trespassing conviction would prevent a successful lawsuit against me.

Re:Naturally

[kinaole]

if viruses are trrorism, then m$oft must be a terrorist organization!!!!

Re:Naturally

[Anonymous Coward]

Unless it were your kid, then you would you sue the fence-owner for not building the fence high-enough.

You have just been on the receiving end of the hypocrisy bat-2000! Please move along!

Re:Naturally

[Miguelito]

If you have a pool in a fenced-in backyard, and some kid climbs over your fence and drowns, you can bet your ass you're responsible. It's called an "attractive nuisance."

I believe you are wrong. I just bought a house 5 months ago.. with a pool, I was told by the property inspector that my duties are to have doors/gates that are both self closing, and self latching.

Now, are society is f'd up enough that if a kid did climb my fence (and the whole neighborhood would likely see it) and drowned... his parents would probably sue me. But I can't be brought up on criminal charges since I have the required gates. The civil law, OTOH, might still be fubar'd enough to screw me in the end for another's criminal intent!

Re:Naturally

[drsquare]

So, first you make a complete assumption, and then you call him a hypocrite based on that complete assumption? That doesn't make any sense at all.

Re:Naturally

[atomic brainslide]

The hijackings were pulled off with the use of box cutters, or similar small-bladed instruments, which were permitted under general security rules at almost every airport. I doubt you could have found very many people who would have thought they should be banned, pre-9/11. No one thought such a thing was possible.

it shows that you do not travel internationally very much. if you did, you would know that airport security in the USofA is about the most lax in the world. go to europe, the middle east or asia and you will see how much tougher it is to get anything like 'mere' box cutters or other implements on board. these other countries DID think those kinds of things were possible and have for some time been prepared for such events. they have tougher regulations for their airlines and it shows.

Re:Naturally

[Fesh]

Hmm. Sounds like it's time for the security industry to take a sabbatical... And then sweep up the pieces after everything self-destructs...

I don't see any other way, really. If security is outlawed, only outlaws will have security.

Re:Naturally

[COAngler]

I agree. If a "circumvention device" is illegal, then "virus enabling software" should be too. :)

Excellent insight. I'm going to write my Senators and demand that C and perl compilers be subject to strict licensing requirements. The Founding Fathers clearly never intended for just anybody to have the power to write virii and copy-prevention circumvention devices and strong cryptography.

Re:Naturally

[styopa]

Can corperations be "terrorized"?
Sure, MS has been doing it to many a tech company for years now.

Re:Naturally

[drinkypoo]

I'm not sure where to start, here.

No, Microsoft can't transfer all responsibility to the government simply by pushing to get viruses classed as terrorism.

There's no responsibility to transfer. Smith & Wesson isn't liable when someone uses one of their guns to shoot someone; Hell, Glock isn't responsible when a nice plastic and ceramic gun is taken on board a plane and used for a hijacking. Microsoft supplies an operating system, and a development system for it. This is more or less an analogous situation.

Theft is a crime, and the government is responsible for enforcing laws that forbid it, but that hasn't stopped companies and individuals from employing security guards, locks, car alarms, etc.

That's right. Kind of like needing a firewall if you want to have a machine running a microsoft operating system on the 'net. Like needing to do away with the supplied webserver and email software (both client and server) and use other packages to handle those jobs because the stock ones are insecure. Like applying patches on a regular basis. You can do all of this and still have your personal disk space invaded, much like you can have all the physical security in the world and still be invaded. What does that have to do with liability?

Think about it; suppose you're putting some of your stuff in storage. There's a convenient storage place nearby, but you know they have a history of breakins. Are you going to be reassured that theft is illegal, and the government is responsible to find and punish the criminals, or are you going to look for some place with better security measures?

Are you asking me if I run NT? I do in fact have a fileserver which runs Windows 2000. It sits on the same side of a linksys firewall (cheap and good enough for a household, really, though its DHCP server is for shit) as my WinME system at which I sit (Yes, I know I just lost a billion geek points. Smeg off) which also runs ZoneAlarm, which I keep updated. I of course apply patches and packs frequently. So I am keeping my security measures, as you put it, up to date.

The problem is that people are lazy. They expect the OS to be secure out of the box. The OpenBSD folks have done us a great favor by dramatically increasing the odds of such a thing, but we should never expect it. We should be taking measures on top of our measures as a matter of course. Does anyone in the know really expect a microsoft operating system to be secure out of the box? Nope, just the Morons Confused by Sun Equipment, and the like. You know who I mean. But people have always been doing malicious things with computers. It's natural that such things should be internet-based in this age where if you (as a computer, really) are not 'net-connected, you are at the least uninteresting, and probably ignorable.

So anyway, the dirty secret is that I was just talking about shifting blame. Microsoft will attempt to use this as spin ammunition - No, not the discfusor, but PR material. Now that I've branded myself as a gamer, I'm going to retreat back into the dark hole in which I live.

Re:Naturally

[drinkypoo]

...they will go after the security community and force them to stop pointing out security problems. At the very least they will force them to stop releasing example exploits.

I don't know about that. If you can get busted for providing an exploit, you should be able to be busted for providing the easily exploited software. I don't think Microsoft will want to draw that much attention to the flaw. People actually using them for a greater work bent on destruction, they're the criminals.

Re:Naturally

[fferreres]

Oh, they didn't install scissors detectors and didn't take the psycho test in everyone boarding the plane. And they didn't have rambo onboard.

The Airlines did such a bad job. So bad, we can make a comparison with the smail companies that distribute antrax due to lack of security measures. Oh companies are doing such poor jobs they're ruining America and most civ. countries as well!

Virus are bad, but they don't cost lifes (so it's not a good comparison). But....any closed source firm should be liable for any security vulnerabily found on their programs. Why? Because they are the only ones that can find the vulnerability and the only ones that can fix it. Hence, they are the ones that can be blamed.

If you have the source, you can find the vulnerability and fix it yourself. So you can't sue anyone.

Re:Naturally

[drinkypoo]

So then you are suggesting that the airlines combat terrorism via legislation. I think that this is hardly a plausable answer. Legislation only tends to beget more legislation. And only in some rare cases completely eliminates the problem that is being addressed.

It does seem to me like that is what they are trying to do, though. They throw themselves on the mercy of the government, say "Hey, tell us what to do now to save face and so that everyone believes you're doing your phoneybaloney jobs, and then throw us a bone so we can keep generating revenue, and here's some bribe money." Well, okay, that's just paranoia, but it does sound pretty plausible, doesn't it? I'm pretty sure about everything other than the bribes, anyway.

Whatever they do will probably not solve the problem, which is not really being addressed at all. Why do we keep running around and pissing in the cheerios of other nations? If we're going to do that kind of shit, we have to do it all above board and cleanly so we can get international support if they come and take a giant shit on us. Now we have some people (who are damned to hell or something equally appropriate, I hope) who are really pissed off at us, and doing something inappropriate about it, and we need to deal with it.

Regardless, people become very powerful when they're willing to die and actually plan around that event. I'm not sure there's anything we can do to prevent terrorism in a world with intelligent and/or dedicated terrorists, especially when the intelligent lead the dedicated. It would be nice to try not to piss them off.

Re:Naturally

[Anonymous Coward]

Please note in Europe at least the Airlines and the airports are different entities. Airports install off site security measures, not airlines. The reason for more security here is we have had more terrorism on our soil in the past than the USA.

Mind too most people want to get their flights cheap yet security does not come for free.

Re:Naturally

[budgenator]

I'll bet if an American airline and an el Al airlines flew the same routes at comparable prices, the American airline would be at a serious competative disadvantage right now. Because of past events the el Al takes security matters much more seriously, they go beyond the minimum legislated standards, or they don't fly there.

This is a much fairer analogy to the problem than compairing airlines to bus lines as Microsoft's PR is trying to do. Same minimum standards diferent implimentation

IIS Vs. Apache?
Outlook Vs. Eurdora?
Windows NT/ 2K Security Vs. Unix/Linux Security

Sure Linux/unix isn't perfect, but there is constant improvement, What happens to Microsoft when things like the secure Linux thing the NSA started, starts to come online. I'll tell you what Microsoft have to dump legacy support, the legacy is unsecurable and hamstrings any attempt to provide real security.

Re:Naturally

[Anonymous Coward]

if i remember my uk law correctly( v long time since studied it ) then yes you responsible for any one on your property ( + kids will be kids , and you are expected to realise that ).

there is some protection if the person was criminal, but even that is not absolute protection. and kids under 10 are never criminal , between 10-14 very strong presumption of not criminal.

Re:Naturally

[ceesco]

Yes, that was the point I was making. I doubt you can be arrested, but you might very well be brought into civil court, especially in this day and age.

Re:Naturally

[Alan Partridge]

of course they can be. It's just that we normally call it "consumer rights". :-]

Now Everything is Terrorism

[greyrat]

whoo hoo.

Re:Now Everything is Terrorism

[ekrout]

Your statement mocking the anti-terrorism legislation proposed by the greatest country to ever exist, the United States of America, is terroristic in nature. As I type, officials are currently en-route to your place of residence with the full intention of confiscating your terrorist propaganda, specifically your 1337 Windoze VBScript editor (often referred to as NotePad and compiled as NotePad.exe).

Re:Now Everything is Terrorism

[Anonymous Coward]

I believe 'ekrout' was joking, so don't mod it down.

Re:Now Everything is Terrorism

[dead sun]

Yes, and aren't you terrified of somebody writing a virus that would infect your computer? Come on, really now, how does a virus do anything to inspire terror? Or am I just being a purist in what terrorism should define?

Crashing planes into buildings, yes, that scared the daylights out of me. Having data I'm diligent about backing up erased off my hard drive, that hardly measures up.

Re:Now Everything is Terrorism

[ouija147]

No, you are not being a purist.

Calling virus writers terrorists trivializes what happened on the 11th of October.

This is just wrong...on too many levels

Re:Now Everything is Terrorism

[kaimiike1970]

How YOU feel about your data is irrelevant isn't it? If a person or persons wrote a virus whose intent was to, say erase all banking information and plunge the US into financial anarchy, wouldn't you classify this as terrorism? I certainly would. If it is an attack on our way of life for the purpose of destabilizing our country, is that not terrorism?

Re:Now Everything is Terrorism

[ouija147]

Err
Buffer Overrun...yeah

Typing to fast thinking to slow, meant September of course

Re:Now Everything is Terrorism

[t]

is that not terrorism?

no.
terrorism -- (the systematic use of violence as a means to intimidate or coerce societies or governments)

Note the key word "violence". Maybe you could call it white-collar terrorism.

t.

Re:Now Everything is Terrorism

[Spruitje]

How YOU feel about your data is irrelevant isn't it? If a person or persons wrote a virus whose intent was to, say erase all banking information and plunge the US into financial anarchy, wouldn't you classify this as terrorism? I certainly would. If it is an attack on our way of life for the purpose of destabilizing our country, is that not terrorism?

No, that happens if you trust M$ software...
And that is YOUR own fault.
Good banks don't use MS software for sensitive information.
And that is a good thing!!

Business as usual

[VRisaMetaphor]

"Sounds like microsoft's future security plans may depend more on legislation than on code audits."

Make that "past and future."

Re:Business as usual

[Anonymous Coward]

does that mean that Microsoft supports platform for the growth of terrorism ?? .. so Microsoft is guilty for weakness ...

Draper calls Windows "Marketing Terrorism"

[PD]

Two can play their silly reindeer game.

Good for Goose...

[BrK]

If that is the case, then Microsoft's total lack of security, and lack of timely response to reported security holes should be regarded as "harboring a terrorist".

If we're going to make virus' a terrorist crime, then we need to follow through all the way.

Re:Good for Goose...

[czardonic]

total lack of security, and lack of timely response to reported security holes should be regarded as "harboring a terrorist"

This disregard for common sense applies to most of the air travel industry as well. Given that, we should be expecting massive tax-payer funded bail-outs to M$ in response to future acts of "industrial terrorism."

Re:Good for Goose...

[BrK]

Many of the airlines are near-bankrupt, or at the very least, their balance sheets show them to be just-about bankrupt.

I don't think that anyone could really declare Microsoft to be "cash-strapped" by any sense of the imagination.

No offense, but I don't believe your analogy holds water

Re:Good for Goose...

[Dimensio]

I find it more likely that if viruses are called acts of terrorism, MS will accuse security companies of aiding and providing information to terrorists with security alerts exposing backdoors and other security holes.

Re:Good for Goose...

[czardonic]

All true, for now. However, if M$ continues to show a gross disregard towards the protection of their customers, as are the airlines, they may find themselves in similar dire straits.

Re:Good for Goose...

[BrK]

Please, stop, you're making me excited ;)

Re:Good for Goose...

[Anonymous Coward]

"All true, for now. However, if M$ continues to show a gross disregard towards the protection of their customers, as are the airlines, they may find themselves in similar dire straits."

You've got to be kidding if you expect people to make the kind of connection between the airlines (thousands of lives lost) and MS (no lives lost). These days, at least in the U.S., this kind of distinction is readily being made.

MS will never be in the kind of bad straights that the airlines are in until someone uses MS software to directly cause the deaths of large numbers of people in knowingly-preventable ways.

Re:Good for Goose...

[bigox]

Well, along the same line of reasoning, we should also hold M$ liable for criminal neglect. If the US government is going to consider 'computer systems and infrastructure' critical to national security, then M$ should be held liable for knowingly and intentionally releasing flawed software. The kicker is that they don't reveal (or dont want revealed) the flaws that the consumer should be aware of.

Could you imagine other companies in other industries releasing products that they know have major flaws?

Re:Good for Goose...

[ladykadyj]

No kidding, I'd hate to get a pacemaker made "the Microsoft way". (grin)

Re:Good for Goose...

[agedman]

MS clearly has too much clout in this Administration to allow that to happen. On the other hand, MS&c might claim something similar: that SAs who don't promptly apply patches and/or improperly lockdown servers are guilty of same.

Only a step from that to requiring that all end users agree to use XP (as the only sure way to ensure that everyone has current software). I'm sure they can work a requirement to use Passport in there somehow.

But then my mother always said I worried too much. So nevermind.

A.M.

Re:Good for Goose...

[OtakuVidiot]

Then perhaps Smith & Wesson and GLOK, et al should be accused of "harboring."

Nah, I don' t buy it. Microsoft didn't force the virus writer to exploit their (albeit buggy) code anymore than S&W forced the murderer to kill two people. Bullets can have the unfortunate side-effect of killing the wrong people. Code can have the unfortunate side-effect of being poorly written and, therefore, destructive to a company.

It's taken years for the courts to not laugh out smoker v. tobacco company lawsuits. And that only happen when it became at least circumstantially clear that the tobacco companies knew their products addicted and harmed folks.

Prove that MS wanted to bolster their bottom line by making buggy code. Prove that they made this knowledge available to neer-do-wells. Prove that MS let it all happen. Then you've got a case. Otherwise, just go after the guys that took the gun and murdered two people.

Re:Good for Goose...

[AndroidCat]

In most Microsoft EULAs, it states you can't give the software to nations or individuals involved in making atomic, bacteriological, or chemical weapons.

I sleep so much more comfortably knowing that Saddam isn't running a legal copy of Windows...

Re:Good for Goose...

[BrK]

In most Microsoft EULAs, it states you can't give the software to nations or individuals involved in making atomic, bacteriological, or chemical weapons.

Do they mean *besides* the US?

Re:Good for Goose...

[Mr. Slippery]

In most Microsoft EULAs, it states you can't give the software to nations or individuals involved in making atomic, bacteriological, or chemical weapons.

So the U.S. government is violating the M$ EULA?

Re:Good for Goose...

[serutan]

Then most American airports and airlines are guilty of the same thing for the same reasons.

Re:Good for Goose...

[Anonymous Coward]

Then perhaps Smith & Wesson and GLOK, et al should be accused of "harboring.

And Sears should be held accountable when a 1 3/4 wrench is used to kill someone?

How about sueing the company that made the box cutters used on 9/11?

And automotive company when a car crashes.

Oh I have it, and we should sue the maker of program that compiles the virus!!

LOL!

Prove that MS wanted to bolster their bottom line by making buggy code. Prove that they made this knowledge available to neer-do-wells. Prove that MS let it all happen. Then you've got a case.

This can easily be done. Say there is 60 millions lines of code and it takes one person making 60k a year one minutes to audit a line. It would take about 42,000 man days to go through all the code. So by hiring 100 people, the job can be done in one year.

One hundard people is $6,000,000 dollars. At $500 a copy of Windows 2000 and one million copy sold, that is 50 billion gross. Do I fail to see why they couldn't hire a team of 100 people to audit their code? Oh yeah, they wanted to keep the profits up!! Silly me.

Re:Good for Goose...

[Anonymous Coward]

I always thought that it was sorta funny that the first thing OS/2 told you about itself was that US Government users operate under a special EULA.

But, rest assured that the US Gov (like any large MS customer) has a signed agreement that overrides the standard click-thru thing.

Re:Good for Goose...

[spectecjr]

One hundard people is $6,000,000 dollars. At $500 a copy of Windows 2000 and one million copy sold, that is 50 billion gross. Do I fail to see why they couldn't hire a team of 100 people to audit their code? Oh yeah, they wanted to keep the profits up!! Silly me.

The amusing part of your argument is that you don't seem to realize that Microsoft *DID* have Windows 2000 code-audited by external, independent auditors for security holes.

Simon

Re:Good for Goose...

[Anonymous Coward]

I've to agree, Microsoft produces 'OS-es' (big word) which have a track record of being *perfect* breeding ground for viri, so indeed, MS harbours terrorism. Big Bu(g)(ck)s Billy Boy only cares for his wallet.

Re:Good for Goose...

[einhverfr]

Actually, you can't use it to do these things in the US because it has not been certified to do these things. You also can't use it to operate air traffic control stations.

Re:Good for Goose...

[Guignol]

You aren't completely wrong with your argument, but
This is still a very bad move from Microsoft because it will effectively back-pedal against itself.
As Bush says it himself, noone will be acceptably uninvolved with terrorism.
Either you are pro-terrorism,
Either you are anti-terrorism.
You will have to prove your side with due acts
So, the airline will have to increase their security
So Microsoft will have to significantly increase its security
Also, Microsoft is calling viruses a form of terrorism, and puting Microsoft as an Airline
isn't a so bad analogy, but it isn't acurate.
For the first viruses (virii, whatever) that could hold.
They spreaded mostly with floppies and then in the Lan.
There I'd see the airline analogy.
But now, viruses are mostly spreading localy, being as destructive as they can, but they are carried by worms.
The real issue is the worm spreading, and the worm ability to inoculate a virus in your system.
The fact is, Outlook and Microsoft Exchange are worms nests.
The spreading of viruses being so succesful is effectively Microsoft fault,
and to a much higher degree than as a simple airline.
It's more like carrying gasoline at work in the non-smoking area something blows up
"hey, but you were not supposed to smoke here"
"allright, but what the fuck were you doing with gas here anyway ?"
Anyway, the interesting part is, if Microsoft has viruses be considered as terrorism,
It will have to increase security, and that would be a good thing.

Re:Good for Goose...

[rhizome]

If that is the case, then Microsoft's total lack of security, and lack of timely response to reported security holes should be regarded as "harboring a terrorist".

That may have been a quick thought, but this point does bear out. Perhaps, as another poster suggested, it's a situation closer to neglect. Microsoft is now crying to the government to step into the game now that Gartner has given a decidedly weighty voice to IIS detractors. Think of it this way: Microsoft writes the software they write because their customers demand it (see "trials of IE"), but now that some customers are visibly saying that they don't want certain features of IIS (the problems that other httpd's don't have) they ask the government to step in and fence off their part of the consumer's featurescape. Of course, they aren't saying that the government should help force people to continue using IIS, but if this kind of legislation is passed, the discourse will shift completely away from demanding any responsibility from the software developers. "Neglect" is probably the wrong word, "recklessness" is more apt.

Microsoft releases software that is written without regard for security if it impinges any marketing feature. For the sake of logical continuity, Microsoft is inarguably creating environments in which exploitive code can flourish (think of those "crack house" laws that hold landlords responsible for the actions of their tenants). It's apparent that Microsoft is running to Daddy when they realize that people they care about [are starting to] hold them to higher standards than they hold themselves.

Re:Good for Goose...

[Anonymous Coward]

At $500 a copy of Windows 2000 and one million copy sold, that is 50 billion gross. Do I fail

Yes you do.

Re:Good for Goose...

[Anonymous Coward]

who is certified ?

who does the certifying ?

nimda et al

[wiredog]

I found it interesting that nimda was released a week, almost to the minute, after the WTC attacks. Certainly if I were a cyber terrorist I'd launch something like nimda or code red that gave me a list of compromisable systems. I'm surprised that the people who launched the attacks on CNN didn't get hit with terrorism charges. This'd be a very good time for the skript kiddiez to lay low. How do you tell the difference between and idiot script kiddie and a cyber-terrorist?

Re:nimda et al

[mmcshane]

How do you tell the difference between and idiot script kiddie and a cyber-terrorist?

That's the point. To Microsoft, there is no difference.

Re:nimda et al

[the_rev_matt]

As an aspiring cyber-terrorist, I resent being compared to idiot script kiddies!

;)

Re:nimda et al

[Anonymous Coward]

And why should there be a difference? The internet is increasingly becoming a critical (if not THE critical) part of how our country does business, communicates, and conducts other essential activities. Fucking around with that system maliciously, no matter who does it is serious buisiness and should be treated as a crime. The internet isn't a toy anymore like it was back in the day (i.e early to mid 1990's).

Re:nimda et al

[Anonymous Coward]

A lot of other things happened on that day, too:

1998 ICANN, nonprofit controlling Internet naming, formed
1985 Stephen Jobs resigns from Apple

Could it be an ICANN protest?

Re:nimda et al

[Anonymous Coward]

This is not part of the scope. The article says that Microsoft is trying to buy itself out of the pinch of shitty security and poor implementations, by means of legislation in a time when the country is very vounerable to the word "TERRORISM". If I am to buy into your statement even an inch, then you need to consider further things.

Drinking and driving. Crime or Terrorism? Surely you could cause havoc driving around intoxicated. Perhaps the guy just wanted to go home but was pushed into a high speed persuit by trigger happy cops.

Having sex without a condom. Could spread venerial diseases which also could potentially spread explosively. To the person who has the venerial disease, it is just a lay. But to the victim it is a malicious act.

Assuming that you are of age, what if your 15 year old son, who is a computer wiz, creates a virus because he has found a flaw in a program that itches his head. For one reason or other, his contained network leaks the virus to the internet and all of the sudden all of these poor people end up with yet another e-mail virus. Are you going to stand by your words that your son is a terrorist? I think not.

There is a limit somewhere. Very much agreed that one shouldn't be able to crash planes into highly populated buildings, but this is quite frankly bullshit. Microsoft should be fined for coming up with something so completely rediculous as well as defining a new term "Individual Terrorism (tm)".

I am as pissed off as the next guy, but it is time that some of these politicians were put on a leash. This can't be good for the nation. The government is going to turn into a huge black operation which nobody will know about. And when the statute of limitation on the secrets are up, well we'll get a bunch of documents with blacked out parts - essentially telling us nothing. Did we win our freedom or our bondage?

I think for this very fundamental part, we should vehemently oppose these rediculous propositions and I urge everybody to write their congressmen/congresswomen to realise that Microsoft is just trying to capitalize on their own.

Re:nimda et al

[jafac]

If the terrorists' aims were to cripple the US economy, that would be reasonable:

Step 1: make businesses afraid to send people to customers face to face. (or avoid sending workers to remote training, trade shows, etc.)

Step 2: make the business that relied upon travel, now relying upon the mail - afraid to rely upon the mail.

Step 3: now that businesses are afraid of interacting person to person, and through the mail, make them afraid to interact via the internet.

Something like nimda or code red would be consistent with this plan - however, I'm not hearing about any terrorist attacks on other systems that businesses rely on for interaction:
Highways/Busses/Trains.

And I don't think that nimda really was all that effective. At least not nearly as effective as the WTC attack and Anthrax attacks were.

Industrial Terrorism...

[Greyfox]

As opposed to bugs in their code.

I call Microsoft software industrial terrorism. Of course, they contributed about $1,500,000 more than I did to the various political parties so when they call stuff terrorism it's much more likely to stick.

Re:Industrial Terrorism...

[Anonymous Coward]

I think you forgot some zeros

And...

[Massive.Hex]

Hillbilly's want to be recognized as Sons of the Soil, but it ain't gonna happen...*

*blatent Simpsons rip off.

MS: self-admited terrorists?

[MouseR]

[...] destructive viruses should be recognized as acts of 'industrial terrorism.'

And MicroSoft is harboring them? Time for retaliation, I say...

Re:MS: self-admited terrorists?

[cavemanf16]

Ha-ha! They're not harboring them, but TW/AOL DSL and Cable services sure are! I'm pretty sure that's why MS wants a law like this passed:

MS: "We just built the code. It's the terrorists who should be blamed for breaking our code and causing massive database failures and data loss!"

Me: "Well if your code didn't have such massive gaping security holes in it in the first place, maybe we wouldn't have everyone and there Islamic fundamentalist grandmother breaking in on a routine basis!"

AOL/TW: "We'll give up the 'terrorists' as soon as you can produce a massive amount of evidence proving that the terrorists aren't spoofing our IP addresses in an attempt to undermine our legitimate rule of all mass media."

So, uh, why is this news?

[jued0001]

Wasn't it considered "industrial terrorism" before, just never given that label?

And why not?

[Bowie J. Poag]

Theres alot that makes sense about this. Personally, I think virus writers should face prison time. Too many people get hurt when their work is destroyed. Its not a productivity issue--You can always keep working. Its when a virus nails something irreplacable, like data which hasn't encompassed by a backup or is otherwise made irrecoverable, thats the main issue.

The only problem with the idea is that I like the idea of "white hat" viruses, or virii that actually do constructive things like plug holes, or notify sysadmins of security breaches. Thats fine, and gentle mischeif like that is perfectly in keeping with the spirit of what makes the industry so interesting in the first place.

Lets try to distinguish between good viruses and bad viruses the same way as we're now beginning to distinguish between white hat hackers and black hat hackers, hm? :)

Cheers, and yes, PROPAGANDA is still running.

Re:And why not?

[Hard_Code]

You're going to leave it up to the *politicians* to discriminate between white hat and black hat, good and bad viruses? Thanks but no thanks, I'd rather have no legislation at all, and us techies can sort it out. Once you let politicians into the mix, all of a sudden campaign donators are the ones consistently making "good" viruses, while political enemies are the ones making "bad" viruses.

Re:And why not?

[Sc00ter]

And what is a "good" virus? If it connects to my machine and applies a patch? That's not up to you to decide.

Re:And why not?

[Anonymous Coward]

s/viruses/explosives/g

Re:And why not?

[czardonic]

Personally, I think virus writers should face prison time.

And what sould the punishment be for clicking on an unknown, unscanned attachment? Loss of essential data? Sounds good to me!

Re:And why not?

[jeff67]

I like the idea of "white hat" viruses, or virii that actually do constructive things like plug holes, or notify sysadmins of security breaches

A two-word problem with allowing "white hat" viruses: "Unintended Effects". Do you think no well-intentioned "white hat" will ever create a serious problem that s/he never foresaw?

Re:And why not?

[startled]

No, there really isn't much that makes sense about this. You think virus writers should face prison time? Guess what, they already do, at least in the U.S. (and if they use them to infect a machine-- if they simply write one and don't release it into the wild, they certainly should NOT be prosecuted). We already have plenty of laws to land computer criminals in jail, and many have already been convicted and are currently serving time.

The /. story isn't about some bill that would make virus writing a crime. At the risk of being on topic, I'll point out that the story is actually about MS taking advantage of the terrorism scare to make releasing a virus disproportionately penalized. There is additional leeway provided to law enforcement when dealing with things classified as terrorism, and the minimum penalties on conviction go way up. Some stupid script kiddie who accidentally writes and runs something on his own box, which then gets into the wild, could face life in prison if this trend continues.

Finally, I'd like to point out this statement by Thomas:

"As long as the spirit of innovation is preserved and destructive viruses are recognized as industrial terrorism, Microsoft will continue to provide revolutionary ideas.". That's the best case I've seen against this idea so far! I think he's saying that if destructive viruses aren't recognized as industrial terrorism, MS will stop making products. If anything can rouse the geeks to action, this has to be it.

Re:And why not?

[czardonic]

Congratulations, you have launched SpringCleaning.vbs! Your hard disk now contains 100% free space!

Re:And why not?

[Anonymous Coward]

A good example is people placing concrete barricades onto heavily trafficked roadways. It is doable, and certainly your taxes pay for the roads, but people prefer an agreed upon roadway so that everyone can be productive, driving places and such. To erect such a device, to throw the track switch before the train arrives, or to propagate security intrusions slow the common good, and is heralded by a select few.

Re:And why not?

[Anonymous Coward]

Bowie -

I appreciate Propaganda. Really.

But goddamn are you a fucking retard.

How'd your shoe taste after that gem of a comment about GRUB earlier?

You went from being a pretty alright guy with a good sense of humor to a total cock eater. I only wish you would shut the fuck up.

Re:And why not?

[Anonymous Coward]

HURRY! Mod this down to one. . .quick! It's stupid! Someone is not with it!!

What's the point in a field discussion if there are only similar views? Oh, you don't know? You've never left the Midwest, have you. . .

Re:And why not?

[Tim Doran]

Congratulations! You have just launched SaveTheChildren.jpg.vbs! Your harddrive is now cleared of all files, including any material potentially harmful to children.

Just *try* and argue against that one, Chester... it's for the children! Think of the children!

Re:And why not?

[gregorio]

What kind of good viruses? Microsoft Patches?

Re:And why not?

[Anonymous Coward]

+5 insightful, please. slashdot doesnt need to be subjected to bowie's trolls anymore

Re:And why not?

[kaimiike1970]

IDIOT. Following that logic, what should be the punishment for getting off on the 'wrong' offramp? Death? Robbery? What should the punishment be for a woman wearing skimpy clothing? Rape? You can not make the victim the problem. No matter how stupid that person might be.

Re:And why not?

[czardonic]

Settle down. There are already laws that make negligence a crime. Moreover, unlike your caricaturesque examples, in this case the punishment is commensurate with the crime. If you use your computer like an idiot, you should expect to screw it up.

Re:And why not?

[blang]

Personally, I think virus writers should face prison time.

Which is what they face when they're caught. Hacking (by means of virus or other) is a federal crime, and if damages are above a certain dollar amount, FBI is on the case.

What's different with MS approach, is that they want to slap a terrorist tag on the crime. Which means that as soon as they have a suspect, 20 armed spooks will storm your house, law enforment is given carte blanche to do phone taps, and they don't even need proof before they jail you.

It probably means that skate boarders with baggy pants and some piercings, and a computer will be profiled and automatically thrown in jail when teh next virus breaks out, pretty much as what happened to any arabs showing their face after september 11th.

That's why not. To use a silly metaphor, it'll be like having a swat team opening fire on you for a parking violation committed by someone purloaning your car. When it comes to terrorism, you shoot first and ask later.

That's why not. "Why not?" can be a clever phrase in many situations, but in this case it's stupidity in it's purest form.

Re:And why not?

[zerocool^]

We already have plenty of laws to land computer criminals in jail, and many have already been convicted and are currently serving time.

Some would say the laws we already have in place to do this are too harsh.
Exhibits:
Number one
Number two
Number three
Number four

~z

Re:And why not?

[Bowie J. Poag]

Don't commit any crimes, and you have nothing to worry about, clown.

Talk about "stupidity in its purest form"..yeesh.

COOL!

[Troed]

That means we can all run Anti-Terrorist programs on our computers. NAI will _love_ those headlines ...

If Viruses are terrorism ...

[unformed]

then Windows must equivalent to the National Guard

Re:If Viruses are terrorism ...

[Tackhead]

> If Viruses are terrorism ...
> then Windows must equivalent to the National Guard

Yeah, but of whose country? Afghanistan?

Re:If Viruses are terrorism ...

[Chakat]

then Windows must equivalent to the National Guard

National Guard? Nah...more like the Keystone Kops.

Maybe this is good.

[billwashere]

Microsoft could then be charged with aiding terrorism by making their OS so easily accessible :)

--billwashere

Re:Maybe this is good.

[Anonymous Coward]

So Powell and Ashcroft should go in and "drain the swamp ...?

why is it terrorism?

[turbine216]

...if i leave my back door unlocked and hanging wide open, and somebody robs me blind while i sit by and watch them do it, am i a victim of terrorism? Fuck no. Am i a victim of my own poor judgement and stupid decisions? Absolutely. So where does Gates and Co. get off calling this terrorism when they basically invite hackers to do their worst?

Sounds like another desperate attempt at grabbing some public sympathy during a time of crisis. Pity that Microsoft's million-dollar PR department couldn't come up with something better.

Re:why is it terrorism?

[wiredog]

If it's just one house, it's burglary. But what if they hit half the houses in town?

Re:why is it terrorism?

[Sc00ter]

"if i leave my back door unlocked and hanging wide open, and somebody robs me blind while i sit by and watch them do it, am i a victim of terrorism"

You're a moron, but the person that comes in is still stealing, and it's still illegal, and they can still go to jail for it.

Re:why is it terrorism?

[gmhowell]

Obviously you mean to compare installing a non-patched/updated MS server to leaving your door open. Now, how is leaving your door open any different than hiring $6 drones to perform and carry out security for jumbo jets?

Re:why is it terrorism?

[haruharaharu]

But what if they hit half the houses in town?

Then they lynch the locksmith.

Re:why is it terrorism?

[Anonymous Coward]

Then they lynch the locksmith.

Exactly, and it's still not terrorism.

Re:why is it terrorism?

[turbine216]

It's not any different...but the end result is immensely different.

Microsoft lives for this kind of public image. If they can capture the crisis of the moment...the media-induced hysteria...long enough to sway some public opinion to their side, then they'll say ANYTHING to do it. Viruses are NOT terrorist attacks. They do not instill _TERROR_ in anyone's hearts (except for the coders at MS who get fired every time this comes up).

Re:why is it terrorism?

[turbine216]

again, the legalities of virii and hacking are not at question here...the nature of the crime is the center of the debate.

If you want to compare hacking or virii to a specific type of crime, the best you could do is burglary - and that only applies to a few cases. The rest are no more than vandalism. NONE can be considered legitimate terrorism. There's a huge difference between taking a web site down for 20 minutes and taking 4 planes full of people down into a few buildings. I don't think i need to explain that to you.

Re:why is it terrorism?

[pohl]

the only reason virii appear for Windows is because they are a primary target. If the world market was in Linux, you'd find a lot more Linux Virii.

I've heard this sentiment repeated several times lately. (By people on my organization's "security team", no less, which frightens me.) I think it's a superficially appealing idea, but utter nonsense nonetheless. Do you honestly believe that a system's design has absolutely nothing to do with its exploitability? If you have two systems, and only one was consistently exploited you would rather assume that it is because it is a higher-profile target, and that it couldn't possibly be related to poor design or implementation decisions?

I would be surprised to find someone who both

• believes that crap, and
• writes code for a living.

I'm guessing you don't code.

Re:why is it terrorism?

[COAngler]

...if i leave my back door unlocked and hanging wide open, and somebody robs me blind while i sit by and watch them do it, am i a victim of terrorism?

Probably not. Terrorism is more in the actor's motivation than anything else.

However, contributory negligence doesn't really exist in criminal law. Your bad judgement is no more a mitigating factor for the defendant than the fact that a rape victim was provocatively dressed. Bank robbers can't defend themselves in court by noting that the bank didn't have armed security. And no court would accept a virus writer defending himself by saying that Microsoft writes insecure code.

Re:why is it terrorism?

[Anonymous Coward]

Obviously you mean to compare installing a non-patched/updated MS server to leaving your door open. Now, how is leaving your door open any different than hiring $6 drones to perform and carry out security for jumbo jets?

It's no different, if

1. A jumbo jet gets hijacked every day for the last few years, and this is reported in the media.
2. Before people board the plane, they are told by a fellow passenger, "This plane will be hijacked. Here is my bomb and my Uzi. See?" And then they decide to get on the plane anyway.

When those conditions are true, then using Windows is the same as having bad airline security, and subverting security will have the same degree of "terrorism" to it, for each.

The first time it happens, it's terrorism. Then you realize that hiring $6 drones was a bad idea, and that letting people with bombs and uzis onto the plane, is also sub-optimal. And then you learn.

The millionth time it happens, when you still have $6 drones waving the guy with the Uzi onto the plane, it is not terrorism. It's Natural Selection.

That is why Windows users deserve to lose. Many years ago, using Windows was just a bad judgement call, and they were truly innocent victims that did not deserve what happened to them. In 2001, Windows users are not victims. They are Kamikaze collaborators that, as their Virus Hotels detonate, negligently harm the rest of us with their Code Red bandwidth saturation and multimegabyte Sircam mailbombs.

They know about it. They can do something about it. They choose not to. Instead, they buy Microsoft's next product, even though they know in advance that it be broken into.

Re:why is it terrorism?

[Anonymous Coward]

Me doesn't bluescreen?!?!?!

I'll trade boxes with you any day of the week, because mine is factory-specced, straight out of the box, complete and utter shit.

Re:why is it terrorism?

[Valdez]

Your anti-MS sentiments leave out a key point, basically negating your argument.

You HAD a lock on your door. It's not the lock maker's fault you didn't lock it... its YOUR fault for having a door with a lock and not "properly configuring it".

What are you going to say? The lock maker should ship all locks locked by default? I think that'd make them pretty dang hard to install and work with, and when you have such a product no one will use it... oh wait. That sounds familiar.

Re:why is it terrorism?

[jafac]

In either case, I believe it's called "blaming the victim".

So....

[moitz]

Is MS harboring "terrorist training" camps by continuing to develop and promote VBS?

moitz

Terrorism

[crumbz]

Does publishing Microsoft Bob fall under "terrorist act"?

Re:Terrorism

[sheldon]

Some of the analysis I have read on Nimda indicated that it came out of China and appeared to initially target government and financial institutions. I don't know if that's true or not, I didn't follow up to verify those statements.

It's been pretty apparent in the recent years that a lot of these computer crimes, specifically website vandalism have a purpose behind them, usually political.

Re:Terrorism

[UnhandledException]

??? What percentage of virus writers have ideological or political reasons?

Two can play at that game

[Tassach]

Abusing monopolistic power is an act of Economic Terrorism committed against the public.

Not that viruses are bad but...

[darnellmc]

How about forcing your software on the world and shutting out competition. Is that not industrial terrorism then?

Here's hoping the EU will save the US from ct

[WillSeattle]

computer terrorism - right now we here in the US are depending on our European friends to do the right thing and enforce privacy rights and slap MSFT silly, since we won't.

And we could use a little help from our Canadian friends - start using the Electronic Privacy Act that became enforceable in January 1, 2001, to reclaim your right to privacy. Use it against US firms, so that we in the US have our constitutional right to privacy.

In the meantime, all the nice American politicians will keep taking campaign donations from MSFT and other such ilk and taking away our constitutional rights ...

sounds good..

[BryceH]

then if ms fails to patch known holes, or release information on how to patch holes, can we say they are harboring industrial terrorism :)

Microsoft? Who is that?

[torpor]

Don't they make TV's or something?

Seriously though: if virii are industrial terrorism, then MS Outlook is the Taliban, and we need to bomb the shit out of Redmond.

And I do mean it. Seriously.

What Utter Bombast

[ewhac]

So now, in addition to "industrial espionage" (which has somehow entered the common lexicon), we will have "industrial terrorism?" What's next? Industrial Treason? Industrial Murder? Disturbing the Industrial Peace?

Schwab

Re:What Utter Bombast

[James Skarzinskas]

You neglected to mention Industrial Manslaughter and Industrial Sabotage. ^_^

Re:What Utter Bombast

[Westacular]

At least they have "industrial" in front of their names: nowadays, the meaning of piracy has very little to do with one-eyed captains, their parrots, and battle on the high seas.

The Westacular Wes

Re:What Utter Bombast

[david duncan scott]

What's so strange about "industrial espionage"?

I think the act of one company spying on a company for competitive advantage is related to, but distinct from, the act of a government spying upon another government. Certainly the law views the two quite differently (the people from GM who covertly take pictures of Fords at the test track are rarely executed.) It could just as easily have been called "commercial espionage", but that's a distinction without much of a difference.

Then there's the borderline case of a government spying on a commercial enterprise on behalf of other companies. The French government has often been accused of this. This might be best described as "economic espionage".

Re:What Utter Bombast

[Anonymous Coward]

The French? The FRENCH? THE FRENCH?

All I heard about was the USA's abuse of information collected through Echelon.

Re:What Utter Bombast

[david duncan scott]

Well, if you're not simply being sarcastic, look it up. I can't say that it's true from personal experience -- I hardly ever leave Maryland, much less go abroad -- but there have been persistent charges for quite some time that the French government supports their commercial enterprises with espionage, that things like sealed bids may not be secret if one of the bidders is a French company.

Frankly it makes a fair amount of sense, which is the only reason I have my doubts as to the US doing the same.

Re:What Utter Bombast

[Anonymous Coward]

Industrial Way of Life

Re:What Utter Bombast

[Anonymous Coward]

I've never heard of your french governement accusations, but like the other poster, I've heard on many occasions the tale of the US government using it's echelon spy program to help its own corporations. Whether it's true or not, I don't know.

Re:What Utter Bombast

[pompomtom]

As the others, I've really only heard that accusation levelled at the US.

Re:What Utter Bombast

[david duncan scott]

Well, perhaps people should listen more, and remember that America didn't actually invent evil. I grabbed this from the Federation of American Scientists:

Some of the specific cases are shocking. According to a recent New York Times article by Peter Schweizer, `between 1987 and 1989, French intelligence planted moles in several U.S. companies, including IBM. In the fall of 1991, a French intelligence team attempted to steal `stealth' technology from Lockheed.' Other accounts report that French intelligence units conduct 10 to 15 break-ins every day at large hotels in Paris to copy documents that belong to businessmen, journalists, and diplomats. According to other accounts, the French have been hiding listening devices on Air France flights in order to pick up useful economic information from business travelers.

But hell, you can search Google for "industrial espionage france" just as well as I can. Do I have first-hand knowledge of any of this? Hardly. Is it possible that the same people who blew the bottom out of a Greenpeace boat might play hardball elsewhere? Yup.

does that mean...

[cleetus]

all the owners of compromised MS boxen on the net are harboring terrorists? or, in the case of nimda-like viruses, that they are terrorists themselves?

Can you imagine...

[Dr Caleb]

From the article: "Windows Update Auto Update security hot fixes for businesses...."

Early afternoon. Your 20+ IIS boxen automatically get the newest hot fix..and all reboot at the same time!

Not that would be anything out of the ordinary...

Re:Can you imagine...

[Mr. Sketch]

Actually for very large server farms that could cause a problem, namely from the electricity standpoint. A lot of businesses are billed based on peak electrical usage and most of those companies have their servers set to boot up sequentially to reduce the peak usage. Since the peak usage on computers tends to be on startup, large amounts of computers rebooting at the same time could make the person who pays the electrical bill unhappy.

Re:Can you imagine...

[Anonymous Coward]

>Early afternoon. Your 20+ IIS boxen >automatically get the newest hot fix..and all >reboot at the same time!
>
>Not that would be anything out of the ordinary...

I think getting 20 Microsoft boxes to do the same thing at the same time is out of the ordinary; Unless you pull the plug.

Re:Can you imagine...

[laodamas]

Early afternoon. Your 20+ IIS boxen automatically get the newest hot fix..and all reboot at the same time!

And cut all current transactions (imagine an online banking system), and boot in the wrong order (hang!), and reinstall IE and Outlook Express, and remove all those wonderful hand tweaked registry entries, and change file permissions, and break third party server and database software and...

The fact that the Windows Update server got CODE RED infected and requires ActiveX authentication (Remember the office assistant hole?) shows how much I trust my servers to update themselves using Microsoft services.

Re:Can you imagine...

[Valdez]

That's odd, I can install hotfixes and patches under IIS 5 without rebooting or even stopping the service in some instances.

Guess its easy to make fun of thing you don't know about. That's why I don't sink to the levels of taking cheap shots at Apache based on my own misinformation... I'm no Apache expert, but I have common sense.

Grow up, Microsoft bashing is boring

[Adam Jenkins]

The mindless Microsoft bashing is getting old. There are plenty of vendors who are slower in putting out security patches etc. and after all; it is your server, it is up to you to check for security patches and download them. What do you want; Microsoft to send a fast chopper
to your place of business and hold your hand while you do it?

Don't even start, oh masses of Linux lusers. Linux is one of the least secure OSes; it's main security "strength" is that most people loathe it too much to use it.

Re:Grow up, Microsoft bashing is boring

[Anonymous Coward]

> it's main security "strength" is that most
> people loathe it too much to use it.
How true, after all M$ is not the LEAST bit afraid or worried about Linux coming on strong. Now are they.
And I guess that by your logic, that Apache is secured because it is not used either

Re:Grow up, Microsoft bashing is boring

[Anonymous Coward]

Linux is one of the more secure OS because it is maintained at any one time by thousands of people who actually care about the quality of the OS rather than the bottem line like MS. Linux was made because of the dissatisfaction with the current OSes on the market while Windows was made becasue Gates needed to compete with better OSes. Also, most other vendors DO have better update schemes. For example Apple's software update checks every so often if there is a new update and then asks politly if it can download it. When that whole root access security hole was found, I believe it was a day or two later that the update for OSX was available and automatically downloaded for me. There are some arguments that I may be able to belive when it comes to defending MS, but saying that it is the Admin's fault? That's like saying it's your fault for being robbed because the security company that is responsible for installing your alarm system left the default setting as "Let everyone in."

Re:Grow up, Microsoft bashing is boring

[gmack]

Those areguments are getting more tired by the minute. If it's all admin incompetance then why was MS Windows Update infected by CodeRed?

The problem here is that Security fixes are an after thought.. theres no cordination within MS at all.

I actually bought that load of crap when this first happened but then I realised that some software installs actually REMOVE said fixes.

That's not accepable.

To make it worse a HUGE number of people infected had no idea whatsoever that they were running a webserver.

Ohh yeah and while I'm at it just try running IIS as a user other than administrator. What good was ripping off an awesome set of ACLs from VMS when admins can't even make good use of them?

NT/2000 are 15% of my servers but they are HALF of what I spend my time dealing with.If it were up to me I'd have reformatted the lot of em.

Re:Grow up, Microsoft bashing is boring

[Anonymous Coward]

Hi Bill....you fucking Moron

Re:Grow up, Microsoft bashing is boring

[Adam Jenkins]

How long have you worked at Microsoft to know whether or not there is coordination or not? If IIS is running without a user knowing about it, then that is the administrator's fault. Same as all the people running RedHat with Apache, sendmail and ftp daemons. An administrator is being paid lots to know which things the user doesn't need and doesn't know are running, and to turn them off.

If you spend that much time dealing with NT/2000 servers then you don't know what you're doing and someone ought to fire your sorry arse. It's nothing to be proud about.

Re:Grow up, Microsoft bashing is boring

[Anonymous Coward]

Why don'y you go and e-mail love letters to Bill Gates? Sounds like you miss your lover badly. I'm not even a big Linux user, but I can see that you are mulching shit and spreading it all over this poor, defenseless page. Begone with you, oh foul demon of Redmon!

Re:Grow up, Microsoft bashing is boring

[gmack]

THat's the problem .. thanks to MS marketing we have people who think they can just set up a machine and have it work.

And as for running services by default no I don't think it's acceptable that RedHat does it either.

I noticed you said NOTHING about the fact that some software installs will remove patches.

Why should they fire me? I keep the servers running. It's my fault that some OS have more issues than others? I don't think so.

Microsoft's Liability

[daemous]

Hey if it's terrorism, Microsoft can then ask to be bailed out. They're an entire industry, right?

Awesome

[Anonymous Coward]

So now shouldn't MS be considered aiding and abetting terrorist activity by repeatedly releasing inferior software? Not to sound like a zealot, but just look at the statistics.

And really, if you put a $100 bill on the sidewalk is it really a crime when somebody walks by and snatches it up? Because that's what the MS security is like. Finding a hole in an MS box is like taking candy from a baby.

logical jump

[krog]

as Bush has declared "Either you are with us, or you are with the terrorists,"

and as Ashcroft and MS both agree that viruses are "industrial terrorism",

and as MS has consistently provided a haven for email viruses (terrorism),

one might conclude that strikes on Redmond are imminent.

not surprising

[Rai]

terrorism...bah! buzz word, buzz word. let's see how many people's attention this will get.

i'm sure there are many business that had their fill of outlook virii and have switched to other systems (or at least email clients.) maybe if microsoft wouldn't keep adding those highly insecure features to their products, they wouldn't have these problems.

Slashdot URLs

[BrianW]

Any chance URLs which reference other Slashdot stories, such as the one in the story here, could be given without a 'mode' parameter? I'd much rather see the referenced story in the mode I choose in my preferences (ie 'nested') rather than what someone else thinks I should be looking at ('thread').

Re:Slashdot URLs

[Anonymous Coward]

Good place to bring this up. I'm sure the people who can change this sit here and read all the comments attached to every story. Why not try emailing it to them?

Re:Slashdot URLs

[Anonymous Coward]

because cut and paste is easier for us lazy IT people. Don't like it? Get over it.

Re:Slashdot URLs

[kaimiike1970]

You should be reading 'threaded' anyway. Conform. Resistance is futile.

the role of service providers?

[pomakis]

Would this imply that the service providers whose services were used to spread the viruses would be condemned as aiding or harboring terrorists?

Microsoft is the king of "industrial terrorists"

[Eidolon]

Microsoft has done more to enable "industrial terrorism" than any other entity, bar none. The jaw-droppingly enormous security problems in their default OS installations are the number one reason that Windows virii, numbering in the tens of thousands, are so numerous and so destructive compared to any other OS platform. Why do they think making this kind of activity illegal would be better than nipping it in the bud, i.e. by making a decent operating system with improved security? Corporate psychosis is the only plausible explanation.

ANTI-TERRORISM BILLS VS. Computer Crime

[mr_don't]

Patriot ACT, USA ACT, ATA:

I know everyone has read and knows something about these bills, but here is a break down of what they mean in terms of things like computer crime and vandalism...

(a) Our Constitution gaurantees "due process" to all PERSONS, not all CITIZENS, meaning that immigrants may also enjoy these rights. However, under these acts, immigrants can be held on suspiscion of potential crime (ridiculous!). The Senate Bill allows for indefinite jail time without due process...

(b) These new laws broaden the definition of Terrorism to include things that include vandilism, computer crime, and (un)civil disobedience. There already exist laws that broadly define terrorism, and flying planes into buildings filled with thousands of innocent people meets those requirements. Marching in a demonstration is not terrorism, throwing a brick through a starbucks window is vandalism and property damage not terrorism, and hacking a website is not terrorism, (it is vandalism!). Also, under terrorism laws, people who harbor terrorists, or give terrorists advice can also be tried as terrorists! If you stay on my couch and then throw a brick at starbucks the next day, I am a terrorist. If I post a security weakness in Microsoft web servers on my website to warn people, and some kid uses the info to hack into someone's site, I am a terrorist!

(c) The laws give the FBI new powers to wiretap and read emails without a warrant. They can also read e-mails and URLS. If I want to read news about Bombs and Terrorists on google, and I type in "Bombs" and "Terrorists" into the field, that is all the FBI needs to suspect me of crime and set up a phone tap or a Carnivore search on me. The FBI is supposed to only be able to know where an email comes from and where it is going. They are supposed to only read the "To:" and "From:" fields of the e-mails, but how can you look at the header of an e-mail and not happen to glance at the "Subject:" line? Basically, that is what is happening in these laws and with Carnivore. ISP's have to install it on their servers. It is like a black box, no one can monitor what the FBI is doing or reading!

THESE LAWS ARE UNECESSARY FOR COMBATING TERRORISM! CURRENT LAWS ARE SUFFICIENT! WHY IS THE FBI, CIA, AND JUSTICE DEPARTMENT DOING THIS?

Resources:

• The entire Senate bill (the USA act) is here somewhere...
• The ACLU has an online chart that compares the three bills with current law.
• The EFF has great resources about these laws.
  
• EPIC (Electronic Privacy Information Center) also has good info...

Re:ANTI-TERRORISM BILLS VS. Computer Crime

[Anonymous Coward]

I hate to disagree with you, because I agree with you, but your first statement is untrue. The constitution guarantees due process to citizens only. The term "Person" could be interpreted in the way you suggest, unfortunately for you, it has already been interpreted by the Supreme Court, and they don't agree with you; Constitutional guarantees do not have to be extended to non-citizens, and a much lower standard applies.

Now, whether that is the way it should be, I'll leave to you. I've never personally been comfortable with it, but that's the way it is.

Re:ANTI-TERRORISM BILLS VS. Computer Crime

[mpe]

Our Constitution gaurantees "due process" to all PERSONS, not all CITIZENS, meaning that immigrants may also enjoy these rights.

Indeed IIRC issues of due process have also been found to apply to people illegally in the US.

However, under these acts, immigrants can be held on suspiscion of potential crime (ridiculous!). The Senate Bill allows for indefinite jail time without due process...

Maybe you need a new rule, something like random constitutional tests on US government officials. If they fail then they are considered to have resigned.

These new laws broaden the definition of Terrorism to include things that include vandilism, computer crime, and (un)civil disobedience. There already exist laws that broadly define terrorism, and flying planes into buildings filled with thousands of innocent people meets those requirements

The only way in which legislators know how to "do something" is by passing more laws. Regardless of if new laws are actually needed.

Marching in a demonstration is not terrorism, throwing a brick through a starbucks window is vandalism and property damage not terrorism, and hacking a website is not terrorism, (it is vandalism!).

The throwing a brick bit could be a few other things, all of which are well covered by laws.
Also possibly more worrying is linking demonstrating with acts of vandalism.

THESE LAWS ARE UNECESSARY FOR COMBATING TERRORISM!

Indeed the elecronic interception bits appear to be more of the same problem which lead to intelligence failing on the 11th of September. Such methods are quite easy for people to circumvent.

CURRENT LAWS ARE SUFFICIENT!

Assuming they are actually used.

Re:ANTI-TERRORISM BILLS VS. Computer Crime

[catsidhe]

THESE LAWS ARE UNECESSARY FOR COMBATING TERRORISM! CURRENT LAWS ARE SUFFICIENT! WHY IS THE FBI, CIA, AND JUSTICE DEPARTMENT DOING THIS?

You said it yourself in points a), b) and c).

This pseudo-state-code (?) may explain:


CONTACT(x,y) = person x has had contact at some point with person y

TERRORISM(x) = person x has committed a terrorist act (in the narrow sense of killing innocent people)

SUSPECTED(x) = the state x is not known but is inferred on the basis of information ranging from irrefuteable proof to an anonymous tip-off

IS_TERRORIST(x) = TERRORISM(x) | SUSPECTED(TERRORISM(x)) | CONTACT(x,IS_TERRORIST(y)) | SUSPECTED(CONTACT(x,IS_TERRORIST(y)))


Or, in english: A terrorist is anyone who has killed someone in a terrorist act, OR is thought -- on whatever evidence (or lack thereof) -- to be one, OR knows someone else who has been defined to be a terrorist OR is suspected on whatever evidence to know someone else who is defined as a terrorist. That other person has been defined under the same rules. A cursory look shows that this is recursive, and can start a cascade of 'terrorists' on the basis of one anonymous phone call about someone who may or may not have anything to do with real terrorism to begin with.

This same algorithm can be used in the McCarthyist Communist Scares, or the Salem Witch trials, or in any other moral panic where innocent people have been convicted and destroyed (ruined or killed) by accusations of wrong-doing which were later prooved vexatious or false.

Those who do not learn from history are doomed to repeat it.

Re:ANTI-TERRORISM BILLS VS. Computer Crime

[Anonymous Coward]

It's an excuse to lop off a little more of the constitution - which barely exists now anyways.

As far as terrorists go - You'd think that being charged with 6000 counts of "Conspiracy to Commit Murder" would be enough.

fine line between vandalism and terrorism

[roberto0]

What's the difference between vandalism and terrorism? The question applies to computer crimes as well as "ordinary" crimes. Any kid on the 'net can throw a brick through a window, or initiate a DOS attack if they were so motivated.

What makes this different from terrorism?
I don't know.

Minor question

[Anonymous DWord]

As long as the spirit of innovation is preserved and destructive viruses are recognized as industrial terrorism, Microsoft will continue to provide revolutionary ideas.

So if they're NOT recognized as industrial terrorism, will Microsoft promise to stop "revolutionizing" the computer industry? Please?

virus

[networkmonkey]

DEAR RECEIVER,

You have just received a Taliban virus. Since we are not so
technologically advanced in Afghanistan, this is a MANUAL virus.

Please delete all the files on your hard disk yourself and send this
mail to everyone you know.

Thank you very much for helping me.

Abdulla
Talibanian hacker

Re:virus

[Anonymous Coward]

There's a bug in your virus, you need to send the mails BEFORE you delete everything.

Re:virus

[LordKariya]

Very funny. I will, of course, comply.

Re:virus

[canning]

Somebody's got to find a fix for this one. I've deleted everything from my hard drive twice this week already and my friends are getting really pissed off.

Re:virus

[Anonymous Coward]

"Please delete all the files on your hard disk yourself and send this mail to everyone you know."

Uhh, just not in that order :-).

Re:virus

[Anonymous Coward]

This hacker IS NOT so technologically advanced.

All the files on the hard drive got deleted before he could send this message on.

Re:virus

[Amazing Quantum Man]

They already did. This is simply a variant of the honor code virus that I've been receiving for years. Luckily my anti-virus wetware can detect it and prevent its spread.

Re:virus

[Anonymous Coward]

Dear TALIBAN:

You have been infected with the RETALIATION virus.
Please deliver Osama Bin Laden and his associates to us right now or death will rain from the skies until you do.

Sincerely,

George W. Bush.

Re:virus

[gotan]

... not to mention that it comes as snail-mail

well maybe...

[surfsalot]

if they impose regulations then maybe microsoft will be FORCED to produce quality software...

nope, you're right, wake up jon! The government loves microsoft (for some reason or another... even though microsoft screws them over every chance they get) and then I was also under the assumption that microsoft was capable of producing a quality product. Oh well... it would be nice, but microsoft doesnt have to play by rules :(

I couldn't agree more with Ashcroft

[Billly Gates]

Infact Alan Cox was about to do terrorism via free speech by writing code on his computer and tlaking about on the net! Oh, the inhumanity of the whole thing.

Its a good thing this is comming out. Think about the potential loss of lives that could exist if people voliated the dmca and wouldn't be tried as potential terrorists! OR if the SSSCA passes, writing an operating sytem could be a terrorist act. I can imainge thousands of lives being lost for such a dreaded activity. Yes, computer crimes have everything to do with terrorism. ???

Viruses ?

[DennisZeMenace]

We don't like to use the V word. We prever "Anti Windows Devices"...

DMZ

Re:Viruses ?

[Rai]

heh, i wonder if microsoft considers litestep an anti-windows device :)

Terrorism

[cluge]

Usually terrorists have some political goal. Even Anarchists have a goal. What exactly is the political motivation for l33t h@x0r from albania that wrote nimda?

Oh yeah, piss Bill Gates off and get more boxes to DOS yahoo with. Damn silly of me not to see this political movement. I wonder do they have a PAC (political action comity) yet?

One hand and the other

[nanojath]

These things cost money and interfere with business, and the perpetrators need to be treated as criminals in kind - vandals, basically, or theives.

But at a time when the word terrorism has an exceptionally heavy load of connotations and emotional overtones, when our government has declared a formal war on its existence, it is irresponsible in typical, egomaniacal Microsoft fashion to choose that term to describe a kind of mischief (and I'm sorry but all the recent worms and virii are mere mischief compared to, oh, I don't know, say crashing a plane into a building full of people) that it is universally recognized they and their customers make themselves unecessarily vulnerable to.

of course

[waspleg]

why worry about your security when you can just make it punishable by sentences worse than what murderers and rapists get..

Good, fine, but what does that really mean?

[forgoil]

First of all, does anyone here think that this would in some way stop different kinds of attacks? Second of all, what is really an attack (I didn't like the word virus, since it doesn't include a DDos nor a worm)? Now we get into more of a gray zone. Someone finding a weakness, would that person also be a criminal, or only those who does anything with the intent to cause trouble?

Let's face it, it's time for Microsoft to clean up this part of their act, and I am certain they will. These actions that are described above will not give us a more secure world, and shouldn't be compared to terrorism.

Passing the buck?

[Lxy]

Teenage script kiddie finds gaping hole in Outlook. SK writes virus to exploit it. Microsoft blames the government for not stopping it.

Microsoft is starting to get scared of this "System Admin or Microsoft?" blame game so they figure if they add the Government into it, there's only a 1 in 3 chance that they're liable. They just need another way to avoid the accusations that their software is insecure. The next Nimda/Code Red/Melissa/whatever attack Microsoft can sit back and yell at the government for not stopping it, rather than take the responsibility of patching their software.

Re:Passing the buck?

[Anonymous Coward]

Script kiddies don't write virii.

not terrorism

[Cujo]

Terrorism is an "ism" that almost no one owns up to. It's actually a strategy for achieving some other means through mass fear and hysteria. Sometimes it works, but it usually backfires.

Viruses are nearly always pranks, created primarily just because they can be. Nealy all the well-publicized viruses of recent years have been exploitations of MS's poor security. Occasionally one might be really malicious; for the purpose of stealing credit card numbers or some such. However, this is theft, not terrorism. The pranks are vandalism, not terrorism.

Ashcroft is proposing wasting vital national resources going after script kiddies. Pshaw!

They are partly right

[www.sorehands.com]

I suspect the reason that Microsoft wants virus writers to be consider terrorist is to deflect their own responsibility.

Virus writers are wrong, but does it match bombing a building or hijacking a jet? It should depend on the virus. But, then should Microsoft be arrested for aiding these terrorists by making it so easy for them?

Terror-ism

[joshtimmons]

It seems kind of new-speak to me. After all, viruses and exploits don't cause terror. I mean, sure it could be considered a crime but it's not like people are hoarding water and cipro because they're afraid of nimda.

I would too if...

[Tk42!]

A virus, worm, bug was globally exploited on my software on a weekly, even daily basis. No surprise here ;)

Hmmm, new virus called anthrax?

[3seas]

In the bandwogon, what happened to the anthrax letter that some reno shop of MS licensing received? Seems to have been totally removed from the list of Anthrax hits.

Could this have been a MS jumping on the band wagon that back fired?

Or was it some computer virus called anthrax?

Not surprising

[Anonymous Coward]

Everyone else is cashing in on the terrorist jackpot, why should Microsoft go without?

How can anyone be to plan for their own problems with so many terrorists running around? I lost my keys, give me a billion dollars!

Well......

[forsaken33]

Obviously the strategy of wait until virii come out ISN'T working, so at least theyre trying to do something else to combat this problem. As a person who has lost many, many hours of work due to a virus attack, I know what it's like to get screwed over by one. However, I don't think prison time will do anything, just make these people more pissed off, let them learn more, and make more criminals.

I hate when this happens, but i really don't have any good solutions. Charge them fines, well, thats the same thing as prisons. Maybe the solution is to be proactive and make software programs that can't be attacked with viruses, that learn from past mistakes, not keep doing things the same old way and only act when somebody notices.

JUST LIKE THE DMCA

[mr_don't]

I agree with drinkypoo, this is similar to the use of the DMCA by a company like ADOBE to cover up its own poor product security and pass it off to the Justice Department.

To pass a law (like the upcoming SSSCA or the DMCA) that takes the responsibility of corporate security in the hands of the government is yet another example of government policy that favors only corporate interests, at the expense of the basic civil rights of the general public...

There's a spectrum here...

[BillyGoatThree]

I would say that some viruses ARE terrorism. What about the big ol' DDoS we had a year or so ago? It was a smallish group targetting a list of victims for political means. Sounds like terrorism to me.

And can we really blame the architects of the WTC for not making the building plane-proof? No, I think they performed "reasonably" well.

So, hypothetically, if a software company took reasonable precautions and had a good record concerning quality and THEN had their software hit by a non-obvious virus I have no problem with the label of terrorism or the use of legislation.

What'd be really sweet is to turn this back on Microsoft. Get the congress-critters to define "reasonable precautions" and "non-obvious virus" and then only afford protection to MS if they clean up their act (i.e. fix Outlook, IIS and the macro system at the very least).

Re:There's a spectrum here...

[Secret Coward]

Terrorism is designed to strike fear in its victims. The DDoS that you describe is nothing more than blackmail.

Re:There's a spectrum here...

[Phrogz]

And can we really blame the architects of the WTC for not making the building plane-proof? No, I think they performed "reasonably" well.

Actually (my wife is an architect) the buildings WERE designed to be plane-proof...as long as the plane was a 707 or smaller and not loaded with as much fuel as the 9/11 planes were. Here's a story where the architect is quoted. You just have to set limits somewhere (as is your point) as to how far you can go. You obviously can't design the building to withstand the equivalent of a kiloton of TNT...I mean, sure you could, but it simply wouldn't be practical.

Re:There's a spectrum here...

[StormReaver]

"I would say that some viruses ARE terrorism. What about the big ol' DDoS we had a year or so ago? It was a smallish group targetting a list of victims for political means. Sounds like terrorism to me."

For an act to represent terrorism, it must have one identifying quality: people must be severely and physically injured (or killed).

Mere property damage or economic loss is not terrorism, it is vandalism. To place computer crimes under the label of terrorism is bone-headedly stupid to the extreme. DDoS attacks don't kill people (unless you DDoS essential life support systems, in which case the facility housing it should be shut down because it's being run with major incompetence).

There's a good reason we in Missouri considered Ashcroft to be an idiot.

Re:There's a spectrum here...

[Anonymous Coward]

It's only terrorism if it's done by a terrorist to terrorize people.

If it's done by a 14 year old Canadian kid for giggles then it's not really terrorism.

thanks...

Re:There's a spectrum here...

[sheldon]

Sorry, you are wrong. Even though I consider Ashcroft an idiot as well, you don't know what terrorism means.

Definition of terrorism from dictionary.com:

"The unlawful use or threatened use of force or violence by a person or an organized group against people or property with the intention of intimidating or coercing societies or governments, often for ideological or political reasons."

Notice the 'use of force...against...property' part of that definition?

Re:There's a spectrum here...

[ftobin]

And can we really blame the architects of the WTC for not making the building plane-proof? No, I think they performed "reasonably" well.

No, but we can blame the architects of the airline security for allowing terrorists to take over the plane, like providing heavily shielded doors, such as those found in Israeli airlines, who know a thing or two about security.

Basically your whole argument goes down the drain since you rely entirely on the statement I just trashed.

Re:There's a spectrum here...

[Anonymous Coward]

From dictionary.com:

<I>terrorism
n.

The unlawful use or threatened use of force or violence by a person or an organized group against people or property with the intention of intimidating or coercing societies or governments, often for ideological or political reasons.</I>

I see nothing indicating that people must be severely physically injured or killed for an act to be defined as terrorism.

A truthful man speaks only the truth, but nothing prevents the enemy from speaking truth as well.

Re:There's a spectrum here...

[kaimiike1970]

How do you think the Israeli's came by this knowledge? By HAVING PLANES HIJACKED. Was the world created yesterday? Or is it just your youth showing?

Re:There's a spectrum here...

[ftobin]

How do you think the Israeli's came by this knowledge? By HAVING PLANES HIJACKED. Was the world created yesterday? Or is it just your youth showing?

It's my understanding a certain Israeli airline has never been hijacked, yet they have solid security procedures. Furthermore, would it be too much to learn from the Israeli about how to prevent hijackings, instead of just ignoring one of most terrorist-targetted nations in the world?

Do some research before you put your foot in your mouth.

Re:There's a spectrum here...

[Kismet]

Actually, I think terrorism is exactly what it says it is, and that people are trying to apply the label to sundry other items in the hopes of promoting some personal agenda or ideal.

To understand terrorism, we need to understand what terror is. There is a dictionary definition for this word, so one would hope that its meaning isn't up for debate.

Terror is a sort of fear. Not simply your garden variety of fear, such as irrational phobias or fear of losing your job or fear of criticism, or anything like that.

Terror is the kind of fear that accompanies a very rational anxiety of physical harm, generally death, that is unexpected, un-prepared for, and likely to be violent or otherwise unpleasant.

Terrorism uses vivid real life examples to exploit these fears so that people become paranoid.

It is not important how well-orchestrated and politically motivated a DDoS attack happens to be. Such an act in and of itself, regardless of intent, does not invoke the feelings of terror in a human being. It simply is not terrorism.

Think of it this way. Suppose the heinous acts of 9/11 (and others similar) had never happened. Thus supposing, do you think computer crimes today would be publicized as "terrorism?" I would suggest that many computer crimes would continue to go unnoticed, much like the vandalism on a brick wall.

Let me also suggest that those who spread the misconception that computer crimes are equivalent to terrorism are guilty of inciting paranoia and irrational fear. Such people are far closer to the terrorists they claim to persecute.

Finally, I will admit that the potential for computer terrorism exists in those computer systems trusted to ensure safety and physical security, without which we would be vulnerable. When hackers target these systems in an attempt to kill innocent people for their cause, then they may be called terrorists.

Re:There's a spectrum here...

[StormReaver]

[dictionary definition omitted]

If someone smashes my car with a brick and threatens to do the same to me and my neighbors unless the neighborhood/local government/federal government meets some demands is terrorism.

If somebody smashes my car window and runs, that's vandalism. If somebody erases my hard drive, that's vandalism. If somebody erases millions of hard drives with a virus and threatens to send more viruses unless some government capitulates, that's extortion. If somebody sends a Windows virus that has the capability of blowing up your monitor, and threatens to detonate it unless the Government capitulates to demands, that is terrorism.

Your dictionary definition is a bit misleading to good sense. Calling someone a terrorist because he writes some stupid Windows virus that erases millions of hard drives is absurd. He is a vandal, to be sure. But a terrorist? That's really absurd, even if he does it to affect government policy.

Re:There's a spectrum here...

[Anonymous Coward]

Sounds like terrorism to me

Then please learn what terrorism is and stop posting these comments you fucking idiot.

Re:There's a spectrum here...

[sheldon]

I was referring to your claim that terrorism only exists where people are killed.

I'm glad that you have decided to start seeing the much larger picture.

Re:There's a spectrum here...

[Anonymous Coward]

Does a virus count as a "use of force"?

Hmm

[Anonymous Coward]

If there is a virus that isn't much of a worldwide threat and microsoft doesn't find it economical to make a patch, are they haboring terrorism?

Ugh...hate to say it

[haplo21112]

I gotta side with the M$ on this one...they are sorta jumping in the Buzz word of the day catagorey with this one, but there is truth there.
Viruses definately are a from of Terrrorism to the Net really should be recognized and treated as such. When they hit a company they can have a deep direct impact on that companies ability to perform.

Re:Ugh...hate to say it

[Anonymous Coward]

To be quite blunt, I don't think that the "terrorism" part of the attacks on the World Trade centre was the disruption caused to business.

Re:Ugh...hate to say it

[Anonymous Coward]

yeah, cuz a corporation's bottom line is just as(if not more) important as people's lives. If you were terrified by the last bouts of code red, et al. then you're really just a big pussy.

Re:Ugh...hate to say it

[haplo21112]

Check out the dictionary sometime...people...Terrorism is more than just killing people and blowing up buildings.
As I said M$ is jumping on the Buzzword wagon, but they DO have a point.

Re:Ugh...hate to say it

[edack]

And I gotta be against you. I'm the admin for 3 NT servers, 6 Unix and variants boxen, 100 Win 9X workstations and the odd Mac. I gotta say that M$ products seem to be designed by a group with no real concept of security or script kiddies or anything except law-abiding sheep^h^h^h^h^h users. They were late to the Internet, late to graphical interfaces and late to security. Now the seem to following their proven path of litigate not inovate.

Viruses have been a part of computers since forever, remember Wm. Morris? (I know not a virus but a worm) PC virus scanning software has been available forever as well.

The trouble with "terrorism"...

[shawnseat]

... is that it's undefined. It literally means whatever the politicians want it to mean. It's being co-opted as "anything I don't like, perpetrated by someone I don't like," and Microsoft doesn't like VB and IIS viruses because they might eventually be bad for business.

Re:The trouble with "terrorism"...

[gmhowell]

Let me take your comments a bit further.

Currently, the timeline is like this:

MS releases buggy Outlook or IE.
Bugtraq finds bug and notifies MS.
After MS waits too damned long to fix, they publish code for exploit.
Exploit(s) occur, MS is sued (or, more likely, their ISV's are sued for unscheduled downtime. Or not even sued. They just bend over.)
It all gets written off as a business expense.

Now, if viruses are terrorism:
MS releases buggy code.
Bugtraq moves to Kenya (name picked at random) so that they continue to publish (they do this for fear of being branded a 'harborer of terrorists')
Code gets published, exploits happen, etc.
Instead of it just being written off, everyone (except the end-user) ignores it. It is either:
a) act of war. Sorry, the EULA specifically exempts acts of war problems.
b) Not our problem, even if it isn't an act of war. We have an 'acts of terrorism' rider, so go talk to our insurance company, and piss off.

Dollars and cents: the legal definition of terrorism matters. M$ knows this.

disgusting

[osorronophris]

These comments from Michael Thomas (mlthomas@microsoft.com) should speak for themselves. All you Apache users out there are letting the terrorists win....

Following Gartner's recommendation to seek
alternatives to IIS only accomplishes what
the industrial terrorists want. The
terrorists who hijacked U.S. airplanes on
September 11 analyzed the airline security
system until they found a weakness, and
then they exploited it. Much in the same
way, industrial terrorists analyzed IIS
Web server security until they found a
weakness, and then they exploited it. If
Gartner wrote an equivalent recommendation
for business travelers, would it be to
take the bus rather than risk airline
travel? That would be a victory for
terrorism, as would abandoning IIS.

Re:disgusting

[CyanDisaster]

Hey Michael! Comment this! *flips him the finger*

We'll use whatever we want to host our sites, preferably something that doesn't have as many holes as IIS...

Anybody else tired of this?

[Anonymous DWord]

Microsoft and other companies of the world will continue to spend millions of man-hours and billions of dollars to produce products that will make the world a more prosperous place.

Dear Microsoft: while we're all very impressed with how much money and time you spend working on improving a flawed product, and making our lives better AT THE SAME TIME, you're doing a piss-poor job of it. The more you claim to spend on fixing stuff, the stupider you look. Where are the results?

Glass houses

[cornice]

This is like forcing everyone to buy glass houses and then making voyarism a wildly serious crime. You can put more cops on the street. The bulk of the population won't look (not much anyway) but are you still safe to take a shower? Just build a better house...

Actually viruses are expensive and this crime should be prosecuted like any other. I just don't think that paying the federal government lots of money to invade our privacy so that Microsoft doesn't have to rethink their software is stupid.

Re:Glass houses

[Anonymous Coward]

I would like to see a large company sue Microsoft. Essentially, their neglegence of security in their products has directly cost some companies a LOT of money. I mean, companies pay for Microsoft products, it is reasonable for them to expect a product that provides at least minimal protection from this sort of thing. The slow response (in terms of bug fixes), and low quality product put them in what I would consider a vulnerable position for a law suit.

why the feds call it terrorism

[evenprime]

I sort of understand the move to make computer crime a terrorist act; the feds can see that everything is moving to computerized control, and they want to prevent attacks on our critical infrastructure. That makes sense, but I'm not sure they are approaching this the right way. If it is possible to disrupt an airport control tower for six hours with a war dialer, we would be better off requiring secure communications channels for air traffic control data than we would be trying to track down every 12 year old who runs ToneLoc and charging them as terrorists.

Instead of trying to use the latest, most trendy technologies (e.g. using web based controls and XML to create the Joint Battlespace Infosphere Infrastructure) or opting for the cheapest method of getting things done, we should think about how these things might be attacked and design them to be infrastructure, and should design them to be resistant to attacks.

I'm Happy to see this

[Anonymous Coward]

Ashcroft and Bush are slowly taking away freedoms and rights in the name of fighting "terrorism". As they go further and further, ppl will see this as having stepped away from sanity. Now that they have introduced something like this, I think that ppl will realize that it is kids for the most part and not terrorists. Not only is Ben saying relevent here (those who give up liberty for security, deserve neither), but I would have to say, so is Barnums (you can fool some of the ppl all the time, you can fool all of the ppl some of the time, but you can't fool all the ppl all the time).

The further they go, the higher the probability that it will swing back.

things called terrorism

[Rai]

hey, i don't like spam. can we have that declared as terrorism. i hate woody allen. let's declare him a terrorist. microsoft doesn't like people taking advantages of the gaping security maws in their software, better call that terrorism too.

i guess that's america's new buzz. everything the gov, big corporate, and society is against will be declared acts of terrorism. drugs are terrorism. piracy is terrorism. free speech? wait and see...

Close, but not quite.

[eAndroid]

I can honestly see how this might be plausible: a great number of people are affected, money is lost and potential property is damaged or stolen. These are the sorts of things that constitute terrorism. They even share a goal of terrorism: fear and confusion. However I think that it is not actually terrorism.

It is significant that Microsoft has invented the term, "industrial terrorism". There is a reason that terrorism hasn't been refered to in the context of industry: it can't be, that's not what it is.

That doesn't mean that computer viruses aren't crime of course. But considering what existing laws are doing to virus writers and even suspect virus writers there isn't a need for stronger punishment.

Re:Close, but not quite.

[kaimiike1970]

Think about this for a second... what if we did not have to worry about viruses AT ALL? How many manhours do you think /.'ers would save collectivly? Translate that to dollars based on your annual salary. Staggering isn't it?

The worlds reaction...

[Anonymous Coward]

I can hear the entire IT department banging their heads on the wall...

Actually, that doesn't make sense

[Microsift]

Has Microsoft ever taken responsibility for damage caused by viruses that infect the OSes that Microsoft sells? No, and no one has ever asked them to (unless you count all of thos people who went to Disneyland on Microsoft's nickel)

Alternatives to IIS = terrorism??!?!

[mr_don't]

Michael Lane Thomas writes: Following Gartner's recommendation to seek alternatives to IIS only accomplishes what the industrial terrorists want.

WHAT?!! Are the terrorists fighting a IIS vs. Apache holy war? Michael Lane Thomas unjustified throws quotes around like the one above along with things like:

Did the Code Red worm exploit a flaw in the underlying technology or the flaw in human nature commonly known as procrastination?

It exploited a flaw in the TECHNOLOGY!!!!

MS Is State Sponsor Numero Uno

[PingXao]

If viruses are "Industrial Terrorism" then Microsoft is clearly Afghanistan, Iraq, Sudan and Libya all rolled into one. Now, you get three guesses as to who Bill Gates is.

Hint: the first 2 guesses don't count!

Sesame Street - the industrial version:

[Tackhead]

If he'll forgive the armchair quarterbacking, perhaps Mr. Gates will allow someone to give him a primer on "industrial terrorism":

• Scanning port 137.
• Zombifying some machines to DDOS eBay.
• writing c0de r3d and writing 4LL J00r IIS R B3L0NG 2 US on your website.
• Flying three commercial aircraft, fully-loaded with fuel, into office buildings, murdering 6000-7000 people in the process, wiping out $100B in property, shutting down all commercial air traffic for days, practically bankrupting half the airline industry, knocking out Wall Street for a week, and making hundreds of millions in profits by buying put options on airline stocks the week before you attack.

"One of these things is not like the other. One of these things does not belong."

Bush logic:

[CoolVibe]

Well, if we apply that, then every company/country that is a save haven or facilitates viruses are the 'terrorist''s allies and should be dealt with. Oh, and get McAfee and friends as well, since they make money and give the viruses a safe home (storage etc.) to live in...

Microsoft shouldn't whine. They should write less crap. That way, the whole virus mess wouldn't exist.

The whole 'industrial terrorism' idea doesn't hold water. Actually It's laugheable. This should have been posted under the "It's funny, Laugh" topic.

Airlines vs. Buses

[devnullkac]

Michael Lane Thomas write in his article:

Following Gartner's recommendation to seek alternatives to IIS only accomplishes what the industrial terrorists want. The terrorists who hijacked U.S. airplanes on September 11 analyzed the airline security system until they found a weakness, and then they exploited it. Much in the same way, industrial terrorists analyzed IIS Web server security until they found a weakness, and then they exploited it. If Gartner wrote an equivalent recommendation for business travelers, would it be to take the bus rather than risk airline travel? That would be a victory for terrorism, as would abandoning IIS.

Give me a break. The implication that IIS is a jet plane while Apache is a bus is just a little over the top. How about a better analogy: ABC Airlines and XYZ Airlines each have their own security philosophies and implementations (not true, but the airline industry isn't exactly like the web server market, after all). Terrorists analyzed and subverted ABC's security methods, but were unable to subvert XYZ's. Gartner recommends fliers switch to XYZ until ABC gets its act together.

Is this a victory for terrorists?

--

Re:Airlines vs. Buses

[jimbolaya]

Indeed, I can see the pictures on my TV now. Palestinians celebrating in the streets, tongues wagging, as they learn that another US web site has switched, in fear, to using Apache or iPlanet.

Sometimes, I wonder if even Microsoft can take themselves seriously. Then again, maybe they are smart by implying that sticking with IIS is our patriotic duty.

Every time I think Microsoft can't possibly be as evil as they are made out to be, they prove me wrong.

Re:Airlines vs. Buses

[Anonymous Coward]

Seems almost the same to me. What was it that incensed you, the fact that IIS is a plae and Apache is a bus?

Re:Airlines vs. Buses

[elefantstn]

Equating abandoning IIS with terrorism winning is possibly the most cynical, self-serving, absolutely repulsive act I think I've witnessed in the aftermath of the attacks. It's simply mind-blowing that someone could actually write that. Unbelievable.

Re:Airlines vs. Buses

[statusbar]

Boy, that article sure is a stretch.

In reality however the real analogy would be that Microsoft represents an airport with shoddy security like the Boston airport was - Boston airport was fined many times previously by the FAA for failing their security tests.

Therefore, Microsoft should be fined by the government for shoddy security in IIS! They are allowing terrorists to wreak havoc!

--jeff

Re:Airlines vs. Buses

[Anonymous Coward]

I truely is a shame how some corporations can use such a terrible tragedy for their own profit. Sickening.

Re:Airlines vs. Buses

[Malcontent]

If this article doesn't point out how morally corrupt MS employees are then nothing will. This guy demeans the lives of 6000 innocent dead people by comparing their trategy to a computer virus. As if profiteering off their death was not enough.

Makes me sick.

Re:Airlines vs. Buses

[epeus]

How about a better analogy: ABC Airlines and XYZ Airlines each have their own security philosophies and implementations (not true, but the airline industry isn't exactly like the web server market, after all).

This analogy is better than you think - El Al would be the XYZ in this example.

A better analogy would be IIS as a little shiny metal scooter, which I used as a substitute for my (Apache) bike for a while, until the low ground clearance when going over a driveway kerb caused me to fall off and need 12 stitches in my chin.

Wrong Buzzword

[FortKnox]

Yes, Virii writers and script kiddies should be punished, but "Terrorists"??

New virus comes out. You know it can happen to you. Do you fear for your life so as not to turn on the computer????

Terrorism is starting to become a buzzword, but it is a state of combat (a step below guerilla warfare) where you have the finances and a small group of men to do some small damages, but not enough to do "hit and run tactics" (guerilla warfare).

How about using another word and lay off the terrorism?

Re:Wrong Buzzword

[DoubleD]

Terrorism: The unlawful use or threatened use of force or violence by a person or an organized group against people or property with the intention of intimidating or coercing societies or governments, often for ideological or political reasons. (from dictionary.com)

Sabotage: 1.(omitted) 2. Treacherous action to defeat or hinder a cause or an endeavor; deliberate subversion.

I Agree. Viruses are not terrorism (Unless maybe if a virus was purposely targeted to kill people via airtraffic control or hospital records). A computer virus is more akin to wreaking the productivity of a factory by dropping a wrench into the machinery. They are inconvenient, disruptive, and even damaging but hardly make you fear for life and limb.

DD

Re:Wrong Buzzword

[_Sprocket_]

Terrorism is starting to become a buzzword, but it is a state of combat (a step below guerilla warfare) where you have the finances and a small group of men to do some small damages, but not enough to do "hit and run tactics" (guerilla warfare).

I believe you're missing a really important distinction here. Terrorism, in the common context used these days, involves civilian targets that have no military significance. That's the distinction which labels most acts of terrorism a crime.

That's not to say terrorism, in the most stringent definition, isn't used as a part of military operations. Special operations involving non-conventional warfare often deals with creating confusion, chaos, and terror within enemy ranks. Guerilla warfare is definately involved in that tactic.

The attack on the WTC was definately terrorism, the crime. I have a harder time labeling attacks on the Pentagon and military housing in Khobar Towers, Saudi Arabia as criminal acts. Even if all those attacks were, in fact, attacks.

I completely agree that Nimda has even less to do with terrorism. Sure, there is some level damage involved. But an attack does not make a criminal act of terrorism.

Re:Wrong Buzzword

[nomis80]

How about using another word and lay off the terrorism?

I suggest using the word crime. It could be used in sentences such as:

• I infected a computer with a virus and caused near-zero damage, I committed a crime against the computer user.
• I drove a plane into a building and killed thousands, I committed a crime against millions.
• I installed Windows XP on 1000+ boxed, I committed a crime against humanity (although the usage of "terrorism" could be accepted in a case such as this).

Re:Wrong Buzzword

[Ouroboro]

This is slightly off topic, but I would disagree with your definition of terrorism and guerilla warfare.

Guerilla warfare is the killing or destruction of tactically important targets in a hit and run fashion. Guerilla warfare is a long accepted tactic for attacking and defeating a more powerful and better defended enemy.

Terrorism on the other hand is the killing or destruction of targets without regards to tactical importance, intended to put a population ill at ease in their own surroundings.

Flying a plane into the WTC is Terrorism. Flying a plane into the Pentagon could (I don't think it is) be considered Guerilla Warfare. The difference lies in the fact that by destroying a military target some tactical advantage can be gained, but destroying a civilian target only serves to spread fear.

Or if you like a more historically remote example. The Free French Resistance's bombing of railway supply lines durring WWII was Guerilla warfare, but the firebombing of Dresdin by the Allies was Terrorism.

Re:Wrong Buzzword

[Anonymous Coward]

destroying a civilian target only serves to spread fear

In other words, terrorism involves generating terror in the general populus. Sometimes it pays off to look at the root of a word.

I doubt anyone rational was in terror over the Nimda worm, at least not to the point of moving to another country or something.

Re:Wrong Buzzword

[Valdez]

Perhaps you should hop down out of your ivory technology tower and look at the real world.

Afraid to turn on the computer? YES. It happens. I have more than one _very_ non-tech friends who heard about the Code red virus months ago and would not turn on their computer for fear of losing their credit card numbers to hackers. I'm sure this happens to some people every time a big virus gets media coverage, and non-geeks stay off the computer or internet until their trusted geek advisor assures them that its safe.

Sure, this wasn't the case with you, being a part of the techno-elite, but it can be likened to a top General on a military base not being scared of being bombed by terrorists.

"What are they gonna do, bomb me? I'm a top general on a military base for crying out loud, I know what's up and can protect myself with my vast knowledge and armaments."

You do of course know that one of the mainstays of terrorism is fear by ignorance. Despite the news coverage, the chances of you getting a letter containing Anthrax spores are still slim to none (read: one in every hundred thousand or so). Does this mean no one is scared of Anthrax? Don't think so.

Re:Wrong Buzzword

[Cro Magnon]

If bin Loser or one of his cohorts wrote a virus INTENDED to crash our computing infrastructure and make us as afraid to use e-mail as we are to use snail-mail, THAT would be terrorism. The "kewl haxor" that defaces websites and writes "lovebugs" is no more a terrorist than the jerkweed burglar that stole my 8088(that was when 8088's actually cost money). Keep it in perspective!

Seems about right to me

[SumDeusExMachina]

Have you ever considered the sheer costs that pile up every time some hacker writes an e-mail worm that kills thousands of corporate mail servers? Not to mention all the lost productivity when it hits workstations too? I think they have every right to classify this as "terrorism", as it destorys our national infrastructure and destroys the economy. You should be grateful that such a great and powerful company such as Microsoft is taking this cause as their own, instead of deriding them based on your opinion of their actions in other matters.

Sheesh, there really is no pleasing you people.

Just a Thought

[greysky]

The terrorists who hijacked U.S. airplanes on September 11 analyzed the airline security system until they found a weakness, and then they exploited it. Much in the same way, industrial terrorists analyzed IIS Web server security until they found a weakness, and then they exploited it. If Gartner wrote an equivalent recommendation for business travelers, would it be to take the bus rather than risk airline travel?

If you honestly want to compare the two, the Microsoft equivalent of Sept 11 is where terrorists hijack one plane, and then use it to drive all other airplanes in the sky into the twin towers.

But what are their demands?

[TeamSPAM]

If these viruses are really the tools of terrorism, what do the terrorists want? Given that terrorists take action against those that have offended them, then half the world could be suspected of being part of this "terrorist" organization. ;-)

Yipes

[Anonymous Coward]

So what happens when my nic card goes spastic and floods packets to whitehouse.gov? Should I expect the FBI to pay a visit?

Let's apply a little logic...

[infinite9]

If a terrorist uses an airplane to commit an act of terrorism, then that airplane is a weapon, right? Therefore, if a hacker writes a virus that exploits a security home in IIS, would IIS be a weapon? And if that security hole can bring down 100,000 machines, would it be a weapon of mass destruction? ;-)

Indecent exposure

[wfrp01]

And hanging out in the network neighborhood with your willie on outlook should be called indecent exposure.

Not THIS stupid metaphor again

[fobbman]

Last time I checked even if someone walks through your unlocked back door to steal your prized possessions it is STILL illegal, no matter how much you were "asking for it". Just as the "slut" doesn't deserve to get raped for dressing the way she does. Just like it's illegal to hack into even the most wide-open of servers.

Yes it's stupid to run a server without proper hardening. Yes, Microsoft has a record of sucking hind end when it comes to securing their operating systems. And if, after due warning a server admin doesn't patch the holes, his server is hacked, and then used to hack or DDOS others, then maybe the owner of the server can be held liable for damages. However, trespassing is still illegal no matter how stupid the sysadmin is.

The laws that we live by protect both the intelligent and the blithering idiots. Be thankful for that.

Re:Not THIS stupid metaphor again

[turbine216]

In no way did i make reference to the legality of hacking a server. I firmly believe that if convicted, a hacker should be held responsible (financially or otherwise) for any damage he or she causes, much the same as a burglar.

But that still does not dismiss the fact that hacking a server is NOT terrorism. Terrorism is an act that is intended to literally "terrify" a group of people - in this case all American citizens. Infecting an IIS server or someone's Outlook inbox does not terrify anyone except for the end user, a couple of poorly-prepared sysadmins, and Bill Gates. And it only terrifies them becaues they know that they could have easily prevented it.

Re:Not THIS stupid metaphor again

[jafac]

You don't think that high-profile cases of Hotmail getting hacked or ecommerce vendor's credit card databases don't terrify people?

If people were 100% certain that their computer use was secure - don't you think that a LOT more people would rely on computers for a lot more economic activity?

As it is - the PC industry's poor reliability has been the greatest drawback. Who wants to trust important data to a PC that they KNOW will crash and lose it? The Industry has done a SHITTY job both with reliabiltiy, and with security.

Of course they want to point fingers at the hackers, white or black hat. They're all a pain in the ass to the industry from a PR standpoint, even though the white-hat hackers are actually more of a benefit.

So let's see how well people trust the Internet, and run out to buy PC's and broadband connections when all those nasty white-hat hackers are safely behind bars, and nobody is allowed to even print anything disparaging about our sacred Computer Companies' products.

After September 11, we now know that our airport security was lax, and SUCKED.

At some point, after the government has sucked up to the computer industry to the point where actual security is like a wet paper tissue, we'll see a day where all computer screens go blank, and we'll realize that those white-hat hackers and accountability was actually a good thing.

....Terrorism?

[KaB0b0]

In the world of software, it's hard to imagine such material things being compared to the loss of life usually associated with terrorism.
Are we to believe that a l33tist click nuking some "windoze l4m4h" is the same as a foreign leader organizing troops together with intentions of the mass murder and suicide of their own and others?

What a tangled web...

[AndroidCat]

First the RIAA wanted to be able to legally hack into any machine that they thought had copyright violations, or at least commit a DoS attack.

Now Microsoft wants to label anyone who does something like that a terrorist.

Well, this should be interesting!

Rich

[arpit]

What an excuse to avoid making their products safe. Microsoft sucks unbelievably.

Funniest MS article ever?

[startled]

All cynicism aside (okay, about half of it), I think this is one of the funniest MS articles ever. This reads like it's straight out of the Onion. First, here's a bit where IIS is compared to Christianity:

"Just like the ideologies and religions of the world or the political parties of a given country, the technical innovations promoted by competing software companies will always be at odds because they embody the ideas of individuals.".

Even better, however, is the part where he tells you that if you stop using MS software, the terrorists have won:

"Following Gartner's recommendation to seek alternatives to IIS only accomplishes what the industrial terrorists want.".

Finally, though, I especially like the part where he threatens that MS might (Bill forbid) stop making software. Wow, I just don't know what we'd do without a new version of Word! Here's the threat-- if we don't classify this as industrial terrorism, MS might not charge you that yearly subscription fee:

"But as long as the spirit of innovation is preserved and the implementation of destructive viruses is recognized as the industrial terrorism that it is, then revolutionary ideas like .NET will continue to be provided to the consumer, one innovative step at a time.".

One innovative step at a time, indeed-- one more step, and he'll be writing for the Brunching Shuttlecocks.

that might stop writers...but not hapless users

[ruebarb]

Face it...the vast majority of virus problems are spread by hapless users who mistakenly send their buddies emails containing the viruses.

Does that mean if someone accidently open an html based email that sends a virus to all his contact list that we can be prosecuted as terrorists?

On the bright side...all the guys in the big house doin' time will get a fresh batch of teenage hacker boys who get to be their bitch

If VIRUSES=TERRORISM then MICROSOFT=TALIBAN

[dcavanaugh]

I agree that the people who create viruses can/should be held accountable, but we have problems with viruses primarily because Microsoft gave the virus writers such a fertile playground. Notice how Microsoft works around the clock to give away features like web browsers and media players, while the ONE REALLY USEFUL THING THEY PUT IN THE OS IS ANTI-VIRUS PROTECTION!!!

If Microsoft ran airports, anyone could skip the security checkpoint by clicking "Cancel" or "Next". Most of the people writing viruses aren't even old enough to work as airport baggage checkers! I wonder just how much enforcement there will be when Mr. Ashcroft discovers that most of the offenders are juveniles.

I believe that the free market should be allowed to do its job. When people get tired of inferior products with excessive vulnerabilities, they will create a market for superior products that are not hackable by a 10-year-old. Those who don't know the difference between the two types of products will create a market for consultants who do. There is nothing happening here that the free market can't fix all by itself.

Industrial Terrorism ?

[CaptIronfist]

The only industrial terrorism made on the software market is the one made by Microsoft itself ;)

Think about it ! You'll know it's the truth.

Wrapping itself in the flag...

[gamgee5273]

Now, I'm not going to knock MS on their response to the 9/11 attacks - they were admirable (well, as admirable as they can be). However, the way they're co-opting the jingoism of the day is slightly disturbing: Linux is "Communism" and "un-American;" viruses are now "terrorism."

I wonder how long it will be before a national ID proposal comes from Gates and ilk wrapped in wartime gallantry and hawkish statements while slamming the Oracle and Sun proposals as "fascist."

Curiouser and curiouser.

Does this work in MS's favor?

[Phrogz]

As others have noted, perhaps this helps shift the war in fighting viruses from MS to the Government (to some extent). But if a virus is an act of terrorism (and I'm not even going to get into debating that right now) then what do you call those who enable a terrorist act? What punishment is appropriate?

I'm looking for similar examples where the actions of a private company can determine the vulnerability of the country to a terrorist attack. Airlines and airports are close examples, but they already have government regulation going on. It's yet another case of the problem where the new digital electronic era runs into problems with those accustomed to the physical world. It is almost as though a private company were responsible for a section of the country's borders, and then let down their guard.

Some people say that , as much as we love to hate MS, you have to be careful not to blame the victim. (Just as you don't want to blame a woman dressed provocatively for getting raped.) But in this case MS isn't really the victim. They're a 3rd party, selling a product with flaws which enables the victimization of the consumer. In a fair market, their product would just be drop-kicked into the bin of Losers...but Windows is so prevalent now that the cons far outweigh the pros for most businesses.

It really is an interesting question...what do you do to a private company which unwittingly enables terrorism, and not just once, but again and again and again...?

Irony

[kin_korn_karn]

The irony kills me. Instead of fixing their swiss cheese code they just want to make it a life-sentence offense to exploit it?

All tech people should be sickened by this.

That's fine by me...

[RiscIt]

If they want to "declare computer crimes to be terrorism", that sounds great.

That makes MS the biggest terrorist in the world by my book....

Ataaaaaccck!!!

[iMMo]

If viruses are terrorism, does that mean we get to invade Microsoft for harboring terrorism?

What about

[Anonymous Coward]

The virus writers? They had nothing to do with it?

Analogies

[RandomPeon]

Is anyone else driven beserk by some of the analogies used? This guy is comparing the deaths of over 5,000 people to some computer downtime? Is there anybody unwilling to exploit the WTC tragedy in a despicable manner>BR>

And this one really makes me mad: the Gartner group telling people to switch to IIS is "giving in to terrorist" - like riding Greyhound instead of flying United. This guy argues switching webservers (a change in product) is equivalent to switching to a totally different mode of doing business. What a terrible analogy. Better analogy: One airline lets armed wackos onto planes, the other one won't. You should fly airline number two, since the hijackers will most likely fly airline number one. Using Apache is no more "giving in to terrorists" than demanding new airline security measures - it is a prudent response to bad people.

And what is this nonsense about "we're gonna find all the buffer overflows"???? You claim your product is secure, it's been on the market for years, and now it's time to find buffer overflows?

If Apache can do it why can't Microsoft?

[Droxun]

Look at Apache's track record then look at IIS's. Anyone see a problem here? Microsoft basically has unlimited resources (money) yet it can't seem to write secure software. Why is it most of the popular free software that is available has better track records than the opposing Microsoft product? Apache - 31 since 12/01/1997 IIS - 47 Since 02/02/2000 Thats off of securityfocus.com So whos the real problem here, the people who write viruses and worms or Microsoft's inability to write secure software?

Complete perspective failure...

[Rothfuss]

Consider these two scenarios:

1) Your wife and son are sitting in front of a cafe having lunch. You head to an ATM to get some cash to pay for lunch. A car bomb blows up in front of the cafe killing your wife and son.

2) Your wife and son are sitting in front of a cafe having lunch. You head to an ATM to get some cash to pay for lunch. A hacker has somehow managed to steal all of the money from your checking account.

Only one of these scenarios inspires terror. Legislators and business persons need to maintain a sense of perspective here. Hacking does not by itself terrify.

It is honestly shameful that corporations are playing off the fears of the public brought on by 9/11 to promote their own political agendas. By equating hacking with terrorism, they belittle the event.

Re:Complete perspective failure...

[jelle]

How about:

3) Your wife and son are sitting in front of a cafe having lunch. You head to an ATM to get some cash to pay for lunch. A gun owner shoots a bullet into a pile of sand on the gun range right next to the ATM.

That would make me jump and skip a beat, but what is it?

Re:Complete perspective failure...

[ocie]

Took a bit to find the link for this (strange how gnu.org's on search engine missed it). What RMS says in this section I think could apply to terrorists as well.

Re:Complete perspective failure...

[jamesl]

3) Your wife and son are sitting in front of a cafe having lunch. You head to an ATM to get some cash to pay for lunch. A hacker has somehow managed to steal all of the money from your checking account and that of one million other people.

Having your checking account cleaned out by an unknown someone is much more than an inconvenience. Some poeple don't handle those kinds of things well. Similarly, people who have had their identities stolen and credit cards maxed out look a little terrorized after a few weeks of trying to straighten things out.

If one person is an annoyance and a million is something else (terror?), where does the break occur. At 10? 100?

Re:Complete perspective failure...

[Rothfuss]

I don't believe it *is* something else. I think it is just terribly inconvient for 1 million people. There is no threshold where I consider it equivalent to my wife being blown up.

-Rothfuss

Re:Complete perspective failure...

[Anonymous Coward]

How about this?

4) You're at a cafe lunching on your wife, when the man who owns the gun range next door accidentally shoots Stephen King, killing him at age 56? Now imagine this at a beowulf cluster of
cafe's.

Re:Complete perspective failure...

[jafac]

I can see the point though.

Part of the Terrorist's aims in the Hijackings were to scare people into not using air travel, scare businesses into not locating their offices in high-profile targets. Scare people into not going to work. Scare people into not trusting the economy and their jobs - so they stop spending; in effect, a self-fulfilling prophecy.

A hacker who hacks into an ATM is not a terrorist in that respect - he's just after money. But if you lose all your money in your account (which would only happen at a Credit Union, your Bank is federally insured!) - then people might be afraid to keep their money at the Bank - which would definately have a serious impact on the economy.

I'm CERTAIN that many hackers are writing to exploits in IIS for political reasons. Their motivation is to frighten people away from using such an insecure platform.

In this regard - the definition of Terrorism truly lies in the motivation of the perpetrator.

So you can't put a blanket over all hackers and say that they are terrorists. Some hackers don't care WHAT people use as a web server. They just want to hack to stroke their own ego. Or maybe they want to P#r33 |V|1+n1c|. (which could be defined as terrorism).

In that regard - most of us here, ideologically, are WITH the hacker/terrorists. Most of us are ideologically opposed to the corporate control of the Internet, software standards, and our legal system. To us - these "hacktivists" are freedom fighters.

Or possibly they're just "consumer advocates" - who want to make sure that "safety and quality" of software and computer services are well documented so that consumers can be informed.

So we may be a bit biased when we see characterizations of hackers as "terrorists" because these activities don't kill thousands of people in a fiery explosive. But they DO have a significant negative impact on the economy, and people's trust of the internet. Hacktivists see the fault lying in the corrupt corporate/political system, and as soon as things change there, the hacking activity would stop.

What do you think the hackers would do, if the US Govt revoked Microsoft's corporate charter as punishment for it's crimes against humanity? And then the US Govt mandated the use of OpenSource software on all Government activities and business? And if the US Govt mandated file formats? And if the US Govt finally got smart on patents and copyrights, and gave us our rights back? Would the hackers stop hacking systems out there? Or would they continue their "consumer advocate" activities?

The same arugment is being used to justify non-appeasement of the Terrorists. No matter how repulsed we are at Israel's current behavior - we're (the US) not going to back off of our support, because that would be seen as caving in to terroist demands and giving them a "victory" and also, license to continue terrorizing.

Clearly, we have to be strong, and act, and even break a few eggs, to put a stop to terrorism.

There is no "consumer advocate" element in hijacking a plane and crashing into the twin-towers. Perhaps there was a side-effect of pointing out holes in our airport security system - keep in mind that since 9/11, many people have come forward to state that they've smuggled knives onto planes even with the hightened security measures. THOSE people should be respected, revered, and considered patriots.

In the same way, hackers who post exploits and things - those are the true "consumer advocates"; but the problem here, I think is that they're being lumped in together with the "free mitnick" people, the hacktivists. I think that the hacktivists are the ones that really need to be stopped. And, of course the 'criminals' - people who use exploits for illegal gain, money, etc. This is where this whole problem lies - we need to be wise and distinguish the black hats and white hats.

The spate of corporate-backed legislation, the SPA, and corporate rhetoric from the software and media giants - they're painting with an overly broad brush, because though the criminals are a true threat - the white-hats are a threat to their credibility and profitability. So they're attacking them too. People should differentiate between the ones who intend harm, and the ones who intend to help. Intent makes all the difference.
The only advice I have for white-hat hackers:
Keep up the good fight! Document EVERY step you take, every bit of work you do. Cover your ass. If you get hauled into court - make sure you have good legal help from either the ACLU and EFF, and show your documentation.
Any reasonable non-biased juror should be able to tell the difference between someone who means harm, and someone who's trying to be a consumer advocate.

sabotage!=terrorism

[blang]

Computer viruses is a form of vandalism and sabotage. But that does not make it terrorism.

I think it is sad that large corporations show no moral restraints, and are doing their best to make a quick profit on other people's tragedy, which is exactly what Microsoft is doing in this case.
Other companies are shamelessly running large ad campaigns using the american flag to promote products, something that is illegal.

Also, Microsoft is in large part responsible for many of these viruses, in the form of neglect and recklessness when building products that are so harmful. If MS expects legislation to pave their way, they must also expect to be made responsible for poor quality control, just like Ford and Firestone was for the rollong explorers. The axe swings both ways, or at least it should.

According to websters:

Main Entry: terrorism
Pronunciation: 'ter-&r-"i-z&m
Function: noun
Date: 1795
: the systematic use of terror especially as
a means of coercion
- terrorist /-&r-ist/ adjective or noun
- terroristic /"ter-&r-'is-tik/ adjective

Re:sabotage!=terrorism

[jafac]

Well riddle me this:

You don't want to compare some computer downtime to the death and destruction and economic fallout from the WTC disaster.

But compare it to something that can clearly be labelled a "terrorist act".

A suicide bomer walks into a bar, and orders a drink. He says "You should pat down your customers before they come in here, free Mitnick, God is Great" and sets his bomb to explode, slightly injuring several patrons, putting the bar out of business for a week for repairs.
Nobody was killed, the business lost a lot of money because people were afraid to go into the bar after that. But this is definately an act of terrorism.

Now, what if some skript kiddie attacks the VISA web site, and steals thousands of credit card numbers. VISA's profits plummet as people cut their cards, because they didn't like having $1000 charged to all of their accounts by this skript kiddie.
VISA's annual corporate donation to the World Hunger Program is cut in half due to the loss, and statistically, 10,000 children in Nairobi starve to death because of this.

This argument definately has some of the qualities of a slippery slope.

It still doesn't mean that white-hat hackers are terrorists though. They provide a vital service, which, on the surface, shakes people's confidence in the Internet.
But when Consumer Reports finds a defective car design that tends to explode and kill people - aren't consumers ultimately MORE secure in their purchases AFTER the design flaw is fixed?
The same should apply to the Internet.

The fact that the Firestone Tire recall happened after hundreds of people were killed was a disaster. And it was a shame that an organization like Consumer's Union didn't pick up on it before hand.
It would be an attrocity if it was found that this problem was kept quiet due to legislation similar to what's going on in the computer industry (where an EULA can silence free speech - prohibiting a customer from writing disparaging remarks about a company or their products).

Re:sabotage!=terrorism

[blang]

Now, what if some skript kiddie attacks the VISA web site, and steals thousands of credit card
numbers. VISA's profits plummet as people cut their cards, because they didn't like having $1000
charged to all of their accounts by this skript kiddie.


What you describe is a serious crime, not an act of terrorism. We have laws and law enforcement to deal with these kinds of crimes, which is my whole point. What we don't need is to label cybersabotage as terrorism. When it's called terrorism, law enforcement and spooks are given carte blanche in dealing with it. And less concern is given to protecting the innocent. When there's terrorism in town, you are expected to submit to all kinds of harassment, in the interest of public safety, whether you're a criminal or not. When dealing with terrorism, it's considered OK to have some casualties.

So, should US go to war against Indonesia the next time some kid comes up with a nasty email virus?
Should US freeze all Russian assets (for harboring companies selling circumvention devices)?

Any law that's created at the spur of the moment, riding on a wave of current public outrage is going to be flawed. And politicians have a hard time opposing these konds of draconian laws, because of the argumentation: "You have to vote yes to the law, or you're not being patriotic, you're not protecting the children, or you're helping the terrorists, how can you think of the first amendment in times like these?"

Wouldn't this technically make ....

[Phlatline_ATL]

Microsoft chargeable of aiding and abetting?

They know that they've been pegged with NUMEROUS security holes (god fobid there's a week that goes by that I don't hear about some hole in an MS product) and have hidden behind their EULA to clear them of any wrong doing.

Please oh please let someone find their EULA to be completely illegal and charge them with providing a route for 'industrial terrorism'

Denying accountability...

[KFury]

It seems that companies are trying to promote legislation to force the legal system to solve their engineering problems.

Microsoft too succeptable to viruses and other insecurities? Declare such acts as terrorism and then only script kiddies^H*13 terrorists will be breaking into systems.

Digital Rights security mechanisms weak? Make it a federal offense to prove it.

I mean, really: Why even bother with encryption and security? Why not preface all your emails with a header that says "This message is encrypted. Any attempt to break this ROT-26 encryption will be a violation of the DMCA. Informing others how to decrypt this document is similarly illegal."

IIS Web servers can have metatags that say "Despite the fact that Telnet and FTP access is guest-accessible, this is a secured web server. Any intrusion attempt will be considered a terrorist act and will be dealt with accordingly."

Basically it's no different than giving everyone a gun and telling them they no longer have any need to lock their doors at night.

They don't beleive what they're telling us...

[Anonymous Coward]

The article says: Microsoft Aligns Company Resources to Ensure Secure Customer Networks

Offers Free Tools; Mobilizes Worldwide Customer Support Organizations And Internal Development Teams to Help Customers Get Secure and Stay Secure

Sounds like they don't have a lot of faith in their ideas.

You would think we'd know the difference.

[Anonymous Coward]

We've seen terrorism in a very real form. We know what it looks like and feels like. Calling something legally terrorism is empty and shameful.

Degree's of Criminality

[init0]

I don't understand how digital based crime can even be considered close to the same damage as bombings, hostage taking, kidnapping, murder, ect.
I think corporate america has us confused about what really matters, isn't it life, not profit, which is supposed to be most important?

What constitutes terrorism?

[GNU Zealot]

Calling a virus a form of terrorism would be similar to calling vandalism a form of terrorism. Normally terrorism is a term reserved for larger scale attacks with a political significance, not some lone person that randomly does something that disrupts things.

Problem with anti-terrorist laws

[SloWave]

That is the problem with giving up even a little bit of our rights. Corporations like Microsoft will use their influence ($) to get the feds to do anything they want. Pretty soon we will have the RIAA wanting downloading mp3's declaired a terrorist activity and the right to search out computers whenever they want.

Terrorism

[Anonymous Coward]

The unlawful use or threatened use of force or violence by a person or an organized group against people or property with the intention of intimidating or coercing societies or governments, often for ideological or political reasons.

Virus writers sound like terrorists to me.

Did anyone read this????

[Dukebytes]

"Following Gartner's recommendation to seek alternatives to IIS only accomplishes what the industrial terrorists want. The terrorists who hijacked U.S. airplanes on September 11 analyzed the airline security system until they found a weakness, and then they exploited it. Much in the same way, industrial terrorists analyzed IIS Web server security until they found a weakness, and then they exploited it. If Gartner wrote an equivalent recommendation for business travelers, would it be to take the bus rather than risk airline travel? That would be a victory for terrorism, as would abandoning IIS."

Could someone explain to me how a hacker who defaces a M$ run web site and a terrorist who hijacks a plane and crashes it into a building, killing thousands, is related? Come on, this is really weak.

I find it hard to believe that this guy is even saying this stuff. He must be working for M.. OHHH - he's a "Microsoft .NET Developer Evangelist". FUD for ALL!!!

Well that explains a lot. These Evangelists are theology students who got caught playing Doom in the dorms.....

Tough Talk!

[Anonymous Coward]

This is pretty tough talk from the company that single-handedly invented the macro virus!!!

Re:Bob and Terrorism

[Anonymous Coward]

No... but if anybody had actually *used* it it would. As it stands, it was just *attempted* terrorism.

Microsoft claims Windows == Harbour for Terrorists

[LazyDawg]

Ok, so if M$'s OS is the most virused on the planet, and Dubya wants to get rid of all places where terrorists can reside, and a computer virus is a form of "industrial terrorism..."

Can we please pretty please have carpet-bombing of a certain terrorist stronghold in Redmond, Washington?

"Terrorism" definition

[Gorimek]

Lets remind ourselves what the word actually means. Merriam Webster defines it as the systematic use of terror especially as a means of coercion , and the pertinent definition of terror it gives is violence (as bombing) committed by groups in order to intimidate a population or government into granting their demands [insurrection and revolutionary terror]

Computer viruses are of course nowhere near this. But since there will now be special rules for "terrorism", it is not surprising to see everyone scrambling to get classified as a terrorist victim. We've seen it before with people trying to get classified as disaster victims, minority members, or any other form of state sanctioned victimhood. It's just how people are.

The pressure will be to get every form of non trivial crime defined as terrorism, and morally equal to killing 7000 people with hijacked airplanes.

Re:"Terrorism" definition

[FrankBough]

This is an excellent point. Microsoft are just cheapening the word here. Terrorism is death, violence, suffering - no virus has ever caused these things. That's not to say that virus writers shouldn't pay the price for the havoc they cause.

Is anyone else worried about how easily words like 'terrorism' and 'atrocity' and 'holocaust' get wheeled out by CNN and BBC. Nowadays anything remotely unpleasant gets called an atrocity. We're going to have to come up with some new words for the really bad stuff that happens.

Cashing in on the tragedy

[Uttles]

I guess Microsoft has joined the likes of the gas gougers and the T-shirt companies charging $25 for a "God bless America" shirt. I'm sick of everyone cashing in on the worst tragedy America has seen recently, possibly ever. Computer viruses should be considered a crime and should definitely be against the law, but it's ridiculous to try and compare them to terrorism.

Lol

[Anonymous Coward]

You're freakin hilarious. And yes I would like that "fast chopper" to come with someone to hold my hand. Preferably a blond with big tits.

Declare war on MicroSoft?

[Anonymous Coward]

Of course, MicroSoft has a de facto relationship of aiding and abetting these 'industrial terrorists' with their almost rampant security loopholes in programs such as Outlook. Should the Department of Defense or the Department of Justice declare war on Microsoft and bomb Redmond if such legislation is passed? One can only hope....

Virii (AWDs) are NOT terrorism -- they lack agenda

[Pyrosophy]

Virii cannot be terrorism because terrorism is the use of terror to win over certain political or religious objectives. Kids who write viruses do it for kicks, not to keep people from using their computers. If they did that, how could they keep having their fun? This is ridiculous.

On the other hand, Microsoft has been pretty upfront about their FUD (Fear, Uncertainty, Doubt for newbs) tactics for quite some time. How does FUD differ from terrorism? It's scaring people into getting what you want, right? I hope someone reprimands Microsoft for their conduct here, trying to take advantage of a buzzword to save them work...

But most viruses ARE industrial terrorism!

[jesterzog]

I wish /. posters and moderators would just sit and think for a couple of minutes.. (I guess I shouldn't expect more from slashdot.) Try going for something that's actually insightful or interesting or informative instead of knee-jerk anti-Microsoft.

This can be brought back to the locked door argument that comes up over and over again. Just because someone's lock is faulty doesn't mean that it's okay to break into their home. Same with writing a virus.

Whether it's industrial terrorism or not should depend on the intent of the person who released the virus, and whether or not they believed or intended it would attack an industry rather than just a specific person - which would be a more ordinary crime instead.

It's the same as if someone broke into a company's building and spiked their water supply so they all got too sick to work. That's also industrial terrorism, and I don't see how it's so different from crippling a company by breaking their network.

It'd be quite hard for a person who released any of the recent anti-Microsoft worms or viruses to admit that they weren't in some way of malicious intent and didn't realise they could do serious industrial damage. That's industrial terrorism. Just because you don't have to step outside your home doesn't make it okay.

Irrespective of Microsoft's attitude toward security, which incidently is one that I wouldn't trust or use personally for anything important, I don't think you can easily claim that all viruses aren't industrial terrorism.

And yes, I do think that Microsoft should fix their own problems and no legislation they're trying to push through should let them off. I don't like Microsoft's tactics, I just agree with what they're arguing.

Re:But most viruses ARE industrial terrorism!

[droleary]

I wish /. posters and moderators would just sit and think for a couple of minutes.. (I guess I shouldn't expect more from slashdot.) Try going for something that's actually insightful or interesting or informative instead of knee-jerk anti-Microsoft.

I love your bold "do as I say and not as I do" approach. Everyone else does happen to think they're posting some content, and they're wrong no more often than you are.

This can be brought back to the locked door argument that comes up over and over again. Just because someone's lock is faulty doesn't mean that it's okay to break into their home. Same with writing a virus.

You might have a point if burglary were called "residential terrorism", but it's not. Likewise, there is no need to couch old problems with the media buzzwords of today. By making everything seem like an act of terrorism, it's just one more way the true terrorists are eating away at the freedom in the world.

Whether it's industrial terrorism or not should depend on the intent of the person who released the virus, and whether or not they believed or intended it would attack an industry rather than just a specific person - which would be a more ordinary crime instead.

You're just barely missing the point. The so-called "industrial" crimes are label as such because they are simply crimes that are committed with corporations as both the victim and the perpetrator. If a lone nut is the perp, it's just the regular crime it always was (e.g., USPS guy going postal is not the same thing as a FedEx driver being told to spray the local mail station with gunfire). And that's to say nothing of the increasingly common, over-broad use of the word "terrorism". Viri are not inherently industrial in nature nor are they necessarily acts of terror.

that would make Microsoft a terrorist

[Anonymous Coward]

Remember that virus which was shipped with Excel...

Author's email address

[Kletus Cassidy]

Instead of posting virulently on Slashdot, did anyone email the author(mlthomas@microsoft.com) of the "Industrial terrorism" article?

This is probably the most tasteless attempt to use the September 11th events to further an agenda I've seen yet.

Terrorism

[governorx]

I just wanted to point out what terrorism is supposed to be. terrorism - the systematic use of terror especially as a means of coercion Meriam-Webster Thus I would use terror as a means of inducing a state of fear unto my victims via methods of violence or other with the event of controlling my victim. What my problem is here is how viruses cause a state of fear for microsoft. Granted, microsoft could be worried that continued attacks could force microsoft to write more stable/secure programs. But microsoft isnt suffering, Im sure they arent worried just yet about going bankrupt. I also haven't seen any form of publication citing microsoft as being afraid. I just wish microsoft wouldnt be so lazy as to turn to the judicial system for problems that there own software could have prevented. But I'm not entirely without sypathy. Viruses do scare a lot of people. For instance, an elderly member of my family just got into computers and he is very afraid of viruses. The motherboard shorted on his pathetic hp minitower and his first thought was that it was caused by a malicious virus, when the blame should have been directed to the hardware manufacturer. (too bad the warranty expired a month prior.. coincidence?) Anyway, I feel that extended prosecution of viral programmers should be conducted, I feel that the intrusion on my PERSONAL computer is a crime. Just don't think this is the right way to do it. This is all an example of using the events of 09/11 for personal benefit- opportunistic? Still my own tragic hero...

definitions?

[Rev.LoveJoy]

I am really curious what defines an act of 'industrial terrorism?' I will bet this definition varies a great deal between this crowd and Joe User.

For instance, it would be simple for just about anyone here to pickup a $25 spammer CD kit and send out README.TXT.VBS to all 5 million emails on said disc (hey, you'd still get some hits).

*** README.TXT.VBS ***
c:
cd \windows
del *.*
*** README.TXT.VBS ***

Does this make me a 'terrorist?' - because MS OS allow we might consider root level scripting to execute under the user session?

I agree with the earlier poster who said in a sense what we're seeing is another attempt to fix a technology problem with legislation. How many years of current political incumbents will it take before gov't figures clue into the idea that this is a failed philosophy from the start?

- Annoyed,
- RLJ

Capitalism is Evil

[Anonymous Coward]

It's things like this that cause people to hate capitalism - a government that is created to ensure that corporations continually meet the bottom line, doling out social services when it is convinient.

George Bush has talked strong on stamping out terrorism in all its forms throughout the world, but wasn't it just a few days ago that some court or another upheld the right of the KKK to march?

If it's okay to bomb Afghanistan for hosting Bin Laden, why can't we jail the Klan, who have killed more innocent (blacks) than Bin Laden or his "terrorist organization" could ever hope to.

Microsoft an Accessory to Terrorism?

[elmegil]

I'd say that if you call viruses terrorism, Microsoft is an Accessory to terrorists because they make them SO G*Damn easy.

Of Course you realize

[couladin]

If this goes through -
depending on which Anti-Terrorism bill is/was passed - publicly demonstrating how the flaw exists and posting an exploit so that admins can test - will be considered a terrorist act.

If they can't stop the public knowing about issues one way - they can get them another.

viruses or Micro$oft bugs?

[xof]

There is an article by Cringely the pulpit : The Death of TCP/IP, Why the Age of Internet Innocence is Over which explain the symbiosis between MS and the viruses. It has already been slashdotted on TCP/MS, We'll Cure What Ails You.

What is in a name?

[atillathehun]

Well terrorism it isn't. Come on! the horror of watching those poor suffering folks falling from the sky or saying good by to loved ones while waiting for the building to collapse? There is no comparison. MS should be ashamed.

However, I would entertain some other name punishable by what ever the MS money can buy in congress. How about a contest where we decide: What do we call it? And, what is the punishment?

Mediocritism and the punishment is daily virus dat file updates....

Start at home, M$

[itsmoops]

Granted that since their operating systems are popular they are bound to attract attention of of virus writers,etc., but they are as much to blame.

Linux and other *nix have security holes, but they aren't near what the M$ holes are.

Case in point, the DDOS attacks come from security compromised Windows machines. And take your pick of the recent viruses that have crippled anyone running IIS and wasted everyone else's bandwidth. With every upgrade thay make, why couldn't they make it more secure? They either chose not to or don't know they need to. Neither is acceptable. (or as Thomas stated" Expecting software to be written flawlessly.....but unrealistic." Hey Thomas, how about reasonably instead of flawlessly? Is that too much to ask?)

Consider that since we all share the net, glaring flaws in operating systems can affect us all, regardless if we run it or not. (I am referring to DDOS and viruses like Code Red)

And it looks like it is about to get worse with XP. Some may recall GRC.com's adventure with a script kiddie using security compromised Windows machines to launch DOS attacks. To see what I mean look at: http://grc.com/dos/intro.htm

So if Microsoft wants to jump on the terrorism bandwagon, and have the legal system clean up a mess they made, they should start at home and shore up their products and protect them from script kiddies that need comparatively remedial skills to launch attacks and write trojans and viruses. I would applaud them making their own software secure before they launch yet another OS.

I am not bashing M$ but, it seems that they are partly to blame in the problem they want our legal system to fix. I do think there should be some legal accountability, but that's another post.

Jumping the bandwagon...

[bradasch]

Seems to me that MS is just another company/individual jumping the "anti-terrorism wagon". Seems that anything can relate to terrosim now.
Unfortunately, there are several people using terrorism as an excuse for their misbehaving. Even here in Brazil some corrupt politicians and other ill-intended persons are calling anything against them "acts of terrorism".
The worst part is that the 9-11 attacks scared most of us, and some people (who couldn't (yet) recover a stable state of racional thinking) are hearing and praising these attempts of using the situation in their favor.

These are terrible news. In every sense.

This just in

[3ryon]

Not to be outdone my Microsoft, the US Postal Service has released "Viruses for Snail Mail".

DENVER, CO - Postmaster General John (Jack) E. Potter today assured the American public that the U.S. Postal Service and the mailing industry are doing everything within their power to ensure that the Microsoft Monopoly in mail delievered virus comes to an end.

Altough their first attempt at viruses via mail are not as sophisticated as the self-reproducing virus that Outlook can deliever, smallpox is showing definite potential in this arena.

Not to be left out, Symantec announced two new products to protect consumers: the Norton Gas Mask, and the Norton Kiln Mailbox. The Norton Gas Mask can stop the spread of viruses, while installing the Norton Kiln Mailbox allows you to incenerate the viruses before they are even opened.

What's a good virus?

[sheldon]

Let's talk about the really bad stuff. Like say Smallpox, Anthrax, Bubonic Plague. If you use it for study, keep it in the lab and study it to try to find ways to innoculate against it. That's for a good purpose right?

But if you stick it in an envelope and mail it to someone working at the state dept... That's not a good thing, right?

So it seems pretty simple to me. Writing a virus is not a crime... Releasing it into the public *IS*.

Send them to jail. It's part of the Darwinian natural selection to weed out the morons.

Virus = Industrial Terrorism?

[Fakir]

I guess MS Outlook is industrial idiocy then...

Nothing new

[clone22]

This is just another instance of Microsoft attempting to move the responsibility for the security of its products onto a third party. The bottom line is Microsoft's products are a threat to (fill in your country here) national security. In the past they have been able to fall back on the good graces of the worm writers who have not unleashed truly malicious code or code that transmitted corporate secrets into a public forum such as Usenet. Will it take a WTC class worm to make users of their software buy a clue and start looking for alternatives?

What if

[Datasage]

What if i use a crack to break copyright protection. Should i expect the FBI, SWAT an local police to suround my house and say "we know you have the crack... come out with your hands above your head"

Virus warning!

[Eimi Metamorphoumai]

There's been a virus going around. If you see a post with the subject "Virus" instructing you to delete all your files and email it to everyone you know, DON'T do it! It will delete all your files. Thank you for your attention.

Human rights, anyone?

[jeti]

The US claim to enforce human rights all over the planet. However there seems to be a blind spot.

DoJ analysis of the Anti-Terrorism Act:
"This retroactivity provision ensures that no limitation period will bar the prosecution of crimes committed in connection with the September 11, 2001 terrorist attacks. The constitutionality of such retroactive applications of changes in statutes of limitations is well-settled."

Declaration of human rights, Article 11.2:
No one shall be held guilty of any penal offence on account of any act or omission which did not constitute a penal offence, under national or international law, at the time when it was committed. Nor shall a heavier penalty be imposed than the one that was applicable at the time the penal offence was committed.

Re:Human rights, anyone?

[dazed-n-confused]

Brainfart. The crimes committed *were* penal offences at the time they were committed. The change is to the statute of limitations, i.e. if they catch up with ObL in ten years time, he can't say "time's up" because they should have caught him within seven years of committing his offence. That's all.

Now, if they retrospectively made some behaviour criminal, *that'd* be a human rights violation. Keep your sense of perspective.

what??

[melatonin]

Computer crimes as terrorism? It just seems to be a magic word that lets government agencies get whatever law they want passed nowadays.

I mean, it's already a crime. And even then, the crime you're commiting is probably already a crime- like disrupting a business.

What happened to intelligent law enforcement? Like getting Al Capone on tax evasion- where DID he get all that money from? People are already doing illegal things, there's no point in throwing more laws at the problem.

Innovation vs. Legislation

[Anonymous Coward]

Someone should remind MS of its own "Innovation, not legislation" campaign. Don't rely on legislation make up for your lack of innovation.

Does this mean...

[JohnG]

That Jerry Falwell is going to push to have homosexuality, feminism, paganism, porn, and Rock and Roll punishable as acts of terrorism?

Microsoft Tomahawks

[Gogo Dodo]

So if Microsoft launches Tomahawks at virus writers/terrorists, does it hit on the third try?

A Rose by any other name.....

[RedHat Rocky]

Ok, let's do it. We'll rename the crime from "vandalism" to "terrorism". The inept government STILL won't be able to catch them, so what's that harm?

Hmm, Microsoft has been thumbing their noses at government for years. They release software that they KNOW doesn't work and causes users lots of grief. By this new definition, wouldn't Microsoft qualify as terrorists? And since its retroactive, we can put them in jail! Yeah, that's the ticket!

I liked this part

[Amazing Quantum Man]

From the article:

But as long as the spirit of innovation is preserved and the implementation of destructive viruses is recognized as the industrial terrorism that it is, then revolutionary ideas like .NET will continue to be provided to the consumer, one innovative step at a time.

Revolutionary? I guess "all your data are belong to us" is revolutionary. I'd personally say it's counter-revolutionary (anybody else here old enough to remember the "PC Revolution"?)...

Grow up, bashing Microsoft bashing is boring

[Anonymous Coward]

The mindless Microsoft support is getting old. I can't think of a single technology vendor more synonymous with the word crap, and after all; it is your server, install Linux if you want it to be secure. What do you want; a Debian developer to hold your hand while you type "apt-get upgrade?"

Don't even start, oh diminishing masses of M$ borg. Eventually even your PHB's will get enough of a clue to force you to overcome your fear and loathing of Linux.

I get it now!

[sirgoran]

You pretend that you're five years old. You release crappy code that's full of bugs and holes into the marketplace, and rather than own up to the fact that it's bad from the get-go, you point the blame at someone else and call it terrorism.

Gee. When I was a kid and tried to pass the blame for something I did I got sent to bed without my dinner.

Being that they're a huge corporation, in Microsoft's case I'd settle for them simply fixing their crappy code.

But to hide behind the law instead of trying to correct your code leaves a bad taste in my mouth. Sure. I don't expect it to be bullet-proof, but at least it should be more secure than it is. The reason they get targeted as much as they do is because of the attitude they have for the public.

They must think that everyone is some sort of slack-jawed drooling simpleton that will blindly accept anything that placed in front of them. Sorry to dissappoint you Bill. But when we use your products, there is a certain amount of security and functionality expected. If there wasn't, then why do you think we all complain each time a new hole or flaw is found?

Goran

score 6...

[psychalgia]

...for brilliant. Well put.

Re:virus -- obviously a script kiddie

[FormerComposer]

Has to be ... It isn't even an original virus! It's just a variation of one that has been affecting systems for months. Obviously, the Taliban cannot support up-to-date technology and has to rely upon recycling viruses with some kind of script kiddie toolkit. Yet another reason to clamp down on the distribution of hacker toolz!

Cracker ethics

[Anonymous Coward]

This can be brought back to the locked door argument that comes up over and over again. Just because someone's lock is faulty doesn't mean that it's okay to break into their home. Same with writing a virus.

Slashdot is a haven of, besides hacker ethics, also cracker ethics. And that encourages the best possible solution, the best intelligence applied and the best care properly taken - especially as for writing software. Cracker ethics laugh at feeble people who just can't get their code written without holes. Cracker ethics find it very justified to show these people that they are incorrect, broken and flawed. It gives no remorse.

Technically speaking, cracker ethics leads to better products. It can be seen as a catalyst for the markets and applying knowhow. It can also cause a great deal of damage which makes it very understandable that most people are very fed up with it. There's no right or wrong, there remains only the paradox that we need better products to stand crackers but only crackers can enforce us to write better products.

Microsoft Harbours Terrorists

[booch]

Microsoft is harbouring terrorism by allowing these terrorists to easily crack systems and spread their terror. They're much like the Taliban -- they tolerate these terrorist activities and do very little to shut them down. You'll notice that good application "nations" like Apache don't allow such terrorism to go on with impunity.

You'd be surprised, AC Man

[Greyfox]

Check out Open Secrets and do a search on Microsoft. Their contributions were nickle and dime stuff for them, though it is interesting to note how they hedge their bets (Though the republicans seem to be getting about 3x more from them lately than the dems are.)

Definition

[IPFreely]

Microsoft's Dictionary

Innovation: Anything that we do that cuts in on other companies profits, control, stability or image.

Terrorism: Anything that someone else does that cuts in on our profits, control, stability or image.

Re:Naturally - Intent

[KarmaBlackballed]

There may be something here, but only if we consider intent.

I'm not so sure it is *okay* to blame microsoft when a radical group targets our technology to create caos, no matter how open and configurable, or insecure, the affected software is. It is not in our best interest to act that way.

If a kid releases a computer virus because he thinks it is cool or fun; maybe we treat that like kids at school dumping white powder on a teacher's desk.

Summary --- Punishment should match the intent and the damage done.

Re:Bob and Terrorism

[Anonymous Coward]

Nah, you're confusing "terrorism" with "innovation" now! :)

Mac

[Anonymous Coward]

Macintosh

Nough said.

Its the bunker buster of the war on Microsoft... I mean viruses... Wait both are a burden on society... Well then both need to go!

Federalize Windows Security

[lynx_user_abroad]

So, does this mean we're going to federalize
Windows security, and impose a $4-per-boot
surcharge to pay for the additional security
measures?

'You've Got Anthrax'

[tenzig_112]

[parody]

Since the first suspicious case of anthrax emerged in Florida a few weeks ago, people have been afraid to open their mail. Scouring the 24-hour news outlets for fresh anthrax exposures, citizens endeavor to defend themselves against the disease by scaring themselves half to death.

And more chilling news comes today: Computer science researchers at Carnegie Mellon University announced that they have discovered a security hole in Microsoft Outlook that allows a specific strain of anthrax to be sent via e-mail.

This Computer has been infected with: Anthrax.

Would you like me to [Ignore] or [Fix]?

Fix. The repair did not work fully as your system files are gravely corrupted.

Memory has been compromised. You will probably no longer remember most of your college years. And since the virus is loose in your central nervous system, you will probably be dead by the time you reach the end of this sentence.

[/parody]

full story: http://www.ridiculopathy.com/news_detail.php?displ ay=20011016

the correct word for virusses in most cases is :

[redzebra]

vandalism ... not terrorism ...

MS is just (like so may lobbies/groups) trying to get all kinds of bills passed in the afterheat of the wtc dissaster.

The correct description for this behaviour is : industrial profeteering from terroristic attacks.

Compared to that, virusses are just child play... sad enough.

-- red.

bin Laden's Corrolary to Godwin's Law

[Frank Sullivan]

As an Internet discussion grows larger, the probability of a comparison involving terrorism or bin Laden approaches one.

(see http://www.tuxedo.org/~esr/jargon/html/entry/Godwi n's-Law.html)

Sigh.

Well then

[aonaran]

if a virus is terrorism, then just like the deal with Osama and the Taliban, Good ole Dubya should declare war not only on the virus writers, but those who supply and harbor them. (MS)

Who is John Galt?

[gabbarsingh]

Merit be damned, use American taxpayer's money to protect mediocrity.

Now I look like a total idiot.

[tcc]

Who needs prozac?? just read Microsoft's latest PR...

That's the second time this month that microsoft makes me spit my Pepsi out of my nose because of a terrible urge to laugh my head off.... kudos to their PR departement, I mean... it's funnier than SNL... as for my nose well...

It hurts... but it's worth every mL of lost Pepsi :)

You are too funny for words

[Adam Jenkins]

Linux is seure? It's the most hacked OS on the Internet according to the last study I saw.. Redhat 6.2 to be precise. A Debian developer probably needs his dick held to take a leak! Yep apt-get. Great idea, like some half-arsed program that could be replaced by a little Perl script is going to resolve a distribution with so many dependency issues? And forgive me if this is against your indoctrination into the Debian Guild, but to me a distribution that cares more about politics than technical soundness, reliability or useability, isn't worth the price of the CDs it comes on.

Re:You are too funny for words

[drsquare]

Most hacked OS? Yes, you could say many people enjoy hacking Linux. It's one of the most hackable OSes there is. Hacking Linux is extremely enjoyable.

"Yep apt-get. Great idea, like some half-arsed program that could be replaced by a little Perl script is going to resolve a distribution with so many dependency issues?"

As for apt-get, I see you didn't actually mention anything that's wrong with it. And yes, it does resolve dependency issues. All of them. All dependency issues solved by this so-called "half-arsed program". Much better than messing about with VBRUN dll's and booting into dos to mangle with mfc43-whatever.

"to me a distribution that cares more about politics than technical soundness, reliability or useability, isn't worth the price of the CDs it comes on."

Yep, that's Debian alright. Technically sound, reliable and useable. Worth ten times more than the dirty amateurish mess you get on the Windows CD, and yet is completely free! Oh the irony!

ROFTL: MS should watch what they wish for !

[redelm]

Don't many of Microsoft's products meet the defintion of a virus?:

Makes the computer run slow

unexplained disk activity

makes files disappear randomly

causes machine lockups

Sue Microsoft

[Anonymous Coward]

We should be able to sue Microsoft for negligence for all the bugs, especially when intellectual property is compromised. Other manufacturers are sued when their products are defective and cause property damage or injury.

People have sued the airlines when relatives have been the victims of terrorism, I read it in the paper this morning!

Harboring Terrorists

[Merk]

Couldn't MS code then be said to harbor terrorists? Or couldn't it at least be said to supply terrorists needs? If terrorists take over airplanes once, the US government wants to mandate steel cockpit doors. Since "terrorists" regularly take over computers running MS pructs, shouldn't the same government force MS to replace their ultra-flimsy "cockpit" doors?

Re:Harboring Terrorists

[GMwrench]

I use Zone Alarm for a firewall and Norton for virus protection from viruses and worms on my windoz partitions. I guess if your business is securty you sell good products but if you are micro$hit you can leave holes you can drive a bus through and only blame others

Re:Harboring Terrorists

[TangoCharlie]

The first thing I did when I saw the /. headline was search for "harboring"... because I thought exactly the same. By not releasing the Source Code, Microsoft is guilty of "harboring" bugs which are the AMMUNITION for computer terrorists.
Ok, it's a poor analogy, and the whole computer terrorism thing is stupid. Let's push for this silly knee-jerk reaction to be stopped. Nah... let's Nuke Redmond :-)

Re:Harboring Terrorists

[bonithedancer]

Of course Microsoft is harboring "terrorists". They are even providing them with tools (VB, Visual Studio etc.).

BTW:I personally find using the term "terrorist" for everything you dislike, just because everybody wants to fight terrorism nowadays, very abusive.

Lessig, Code = Code

[natpoor]

One point of Lessig's Code is that software code and legal code essentially do the same thing in different ways. What Microsoft can't or won't do in software code it is supporting in legal code.

Definition of "Terrorism"

[_Sprocket_]

I would say that some viruses ARE terrorism. What about the big ol' DDoS we had a year or so ago? It was a smallish group targetting a list of victims for political means. Sounds like terrorism to me.

Terrorism Ter"ror*ism, n. Cf. F. terrorisme.
The act of terrorizing, or state of being terrorized; a mode of government by terror or intimidation. --Jefferson.

So are you telling me you're taking the phrase "phear me" seriously?

what are the consequences

[m00nshyn3]

A lot of viruses are industrial terrorism. Some are created with the intent of intimidating or coercing an industry. But should an industrial terrorist be put in the same category as a terrorist?

Lets say that some MS bully punched me the other day for running Linux. Can I call him a personal terrorist because he was trying to intimidate me into using Windows? And since he is now a terrorist can I have the government punish him the same as they would somebody who brings down buildings?

My Flame, er, Letter to Mr. Thomas

[Non-Newtonian Fluid]

Mr. Thomas:

Having known people lost in the WTC attacks, and having seen
the towers collapse with my own eyes, I take great offense at
your calling virus writers "industrial terrorists." Over
5,000 died that day, and your company would like to take
advantage of the opportunity to shirk its responsibility to write
robust code by transfering that responsibility in another form
to the government, i.e., 13-year-old script kiddies become
terrorists and are locked up, thus no more hacker problem. Are
you so enamored with your endless lines of IIS spaghetti code to
compare its poor security and thus easy demise in the hands of
pre-pubescent crackers that you would dare compare exploiting
its weaknesses to the needless and horrific taking of thousands
of innocent lives? Your (and Microsoft's) arrogance astounds me.

Burn in Hell.

Sincerely,

Daniel Wislocki
Software Developer

P.S. "Unfortunately, some individuals (or companies) seek to destroy
competing ideas rather than evolving their own."

Really? Certainly Microsoft has never been guilty of such a crime?
What disgusting propaganda.

Re:My Flame, er, Letter to Mr. Thomas

[Non-Newtonian Fluid]

Of course, it's only _after_ I send the flame that I notice the error in the message (forgot to delete the first "compare" part. I guess anger does make you sloppy. Oh well, he'll get the picture.... ;)

Ashcroft and kickbacks

[Anonymous Coward]

Im wondering, what kickbacks do Mr Ashcroft get for working with these huge corporations?

I'm not struck by terror

[andkaha]

I'm not struck by terror even if my NetBSD box without a network connection suddenly gets infected by a MS-Word macro virus. I'm just annoyed.

Terrorism is something that terrorises people. No one gets terrorised by a computer virus. No one lies awake at night fearing for their lives because they had to use a floppy that a friend gave them, but forgot to check it for viruses.

Terrorism is a little bit more sofisticated than that. Getting a whole nation to fear envelopes is a good example of terrorism (filophobia?). It's cheap, efficient and using almost no resources (most of the time, one can get the citizens themselves to help with spreading of hoaxes).

I say: If your company looses a lot of money because the MS operating system and the MS applications that you're using are faulty and insecure, then sue Microsoft!

Disturbing the Industrial Peace?

[TheMidget]

What would that be? Sending out e-mails with attachments that are not actually viruses, but are merely meant to make the recipient think that they are viruses? (in analogy to the talcum and flour shens, which are usually prosecuted under the label "disturbing the peace")

Re:Disturbing the Industrial Peace?

[einhverfr]

Yes, the .vbs attachment which does as follows:

Puts up a pop-up box saying "Do you ALWAYS run attachments? You could get infected by a virus, you know!"

Now, THAT would be industrial terrorism... Especially if sent out to everyone by a large group...

Faulty logic

[Ctrl-Z]

"The terrorists who hijacked U.S. airplanes on September 11 analyzed the airline security system until they found a weakness, and then they exploited it. Much in the same way, industrial terrorists analyzed IIS Web server security until they found a weakness, and then they exploited it. If Gartner wrote an equivalent recommendation for business travelers, would it be to take the bus rather than risk airline travel? That would be a victory for terrorism, as would abandoning IIS."

I don't understand this comparison at all. Clearly, it is still safer to fly on an airplane than to ride a bus, notwithstanding terrorism. Why would Gartner suggest a more dangerous approach? This is not the case when it comes to a comparison between IIS and other webserver software. It is to some extent safer to not use IIS, especially in light of purported "terrorism."

Another comment made by Thomas is "Did the Code Red worm exploit a flaw in the underlying technology or the flaw in human nature commonly known as procrastination?" I think it's a bit harsh to assert that all cases of Code Red were the result of procrastination. The fact of the matter is that many shops are wary of applying every patch that Microsoft sends their way without testing them first. One of the reasons why Code Red was so devastating was that it came out before companies could adequately review the patch to make sure it didn't break existing systems.

Thomas' point of view misses a lot. Perhaps the forum lends itself well to the Reader's Digest version of the story, but he should at least try to be fair rather than alienating his clientele.

Just my 2 cents worth.

Re:Faulty logic

[AlXtreme]

"The terrorists who hijacked U.S. airplanes on September 11 analyzed the airline security system until they found a weakness, and then they exploited it. Much in the same way, industrial terrorists analyzed IIS Web server security until they found a weakness, and then they exploited it. If Gartner wrote an equivalent recommendation for business travelers, would it be to take the bus rather than risk airline travel? That would be a victory for terrorism, as would abandoning IIS."

Just as a note: what if you truely stretch this metafor into bus/air-travel?
What if you could get a bus travel that is not only saver, but faster, more reliable, free and easier to support? Who would travel by plane anyway?

Oh well, might not be totally on-topic, and you have to give the guy some credit: an A for effort. The rest of his talk is pure propaganda.

Hmmm... am i the only one to see a link between Osama B. L's talks and the rant of this fellow? With Osama's terrorist network and M$'s buggy software and army of mindless GUI-programmer-wannabe's, they could disrupt the whole world. Oh wait, they did...

This post isn't worth my 2 cents

Windows = virus

[ilovecheese]

Given that MS wants to make a computer virus an act of terrorism, does this mean that the FBI will now prosecute MS for terrorism? It is a widely known fact that Windows is considered to be a virus itself.

Catch 22 perhaps?

Hypocrites!

[Anonymous Coward]

Suppose I release Anthrax to "test the ability of hospitals to respond...".

How is that any different from Suppose I release code red to "test the ability of sysops to respond..."

I'm all for developing new vacines and security patches, but releasing dangerous viruses [alive and cyberlive] is not the way to go about it.

Only terrorist would...

[iconian]

If computer crimes are acts of terrorism, then only terrorists would commit computer crimes. ;)

Seriously though, we know that all laws and legislations in the world will not deter terrorists. As bad as it might seem, crackers serve as the invisible hand that pushes the closed-source industry towards more secured software. If there were zero-tolerance laws against crackers and script kiddies, we might get less of them. Less crackers means the closed-source industry will not be compelled to fix their holes as often, if at all. This will leave more insecure software floating around.

Terrorists want to destroy economies and kill innocent lives. As bad as crackers and script kiddies may be, they do not have the same destructive mentality as terrorists. Damage from a terrorist exposing a major security hole will be far greater than that of a script kiddy. I rather have a script kiddies force companies to patch their stuff than terrorists.

MIcrosoft calls viruses 'Industrial Terrorism'

[Anonymous Coward]

Interesting. Then is ignoring known security flaws in a product 'Industrial Treason'?

What Microsoft doesn't know...

[gillbates]

Is that this legislation - making computer crimes terrorist acts - would undoubtedly incur legal liability on their part. If computer crimes are terrorist activities, then Microsoft is an accomplice by extension - they not only provide the terrorists with the tools of the trade, but specifically engineered virus weaknesses into their products. Thus, they could be tried in the same manner as the UNIX programmer who wrote a backdoor into the system. Interestingly, a EULA can't shield Microsoft from criminal liability.

Re:What Microsoft doesn't know...

[Anonymous Coward]

Somebody please the moderate parent comment up up up up!!!

difference b/w terrorism and exploiting bugs

[EggMan2000]

Terrorism is a crime, consisting of an intentional act of political violence to create an atmosphere of fear. Acts of terrorism are premeditated by their perpetrators and are conspiratorial in nature.

A software company or PC manufacture that conspired to cause death would feel the full weight of the justice system. Of course, by the nature of the Internet, it could be possible to claim that if you dropped the network, and the network was our only means of communication, and that lack of comunication caused death, MS's point could be argued.

Additionally, terrorists conspire their acts of terror to generate fear. Fear is not the ends of the terrorist, but the means to bring to pass their goal, yet the affected society is often completely consumed with this fear. It is by this generated fear the terrorist hopes to motivate the public, group or government to make changes whereby the goals of the terrorist might be realized. It is the government's responsibility to secure society from this threat.

This leads to another point: Don't blame the airlines, or the security guards at the terminal, those that perpatrated this last act of terror, were targeting our governments.

Viruses as terrorism ...

[zangdesign]

It's about damn time SOMEBODY recognized just how serious the problem is. Not just for Microsoft users - that's today's issue - tomorrow's issue might very well be Linux and BSD viruses, worms and other exploits and they will be a whole lot tougher to kill. Not to mention that there is no chance to recoup losses by or force the programmers to get things fixed.

This may sound like a troll, but I am genuinely pissed.

so does this mean...

[Anonymous Coward]

that because MS declared their distaste of virii, that we must therefore see a virus as good?

also, if someone "exploits a weakness" on my system, then that is still just as bad. I personally will see to it just as if it were my home. If you come and 'take advantage of a security weakness' like I didn't double bolt my door... or hell, I didn't lock it in a hurry to make sure my kid didn't run out into the street, then forgot... I will still hunt you down and break many things on your body.

Does that make SPAM consumer terrorism?

[idioMac]

=+P

Ah ha!

[SnapperHead]

So, if virus's are an act of terrisom, then that must mean that Microsoft is harboring those virus writters by not fixing there secruity problems and not caring ?

:)

Yes, there is a spectrum.

[Wesley Everest]

And viruses, hacking, etc. are rarely "terrorism." They might be criminal, they might be politically motivated sabotage, they might even be scary. But if you are not trying to kill or bodily injure civillians to further a political goal, you are not a terrorist.

It's pretty scary how words get slippery in times like this. Its bad enough that politicians and others are throwing the word "terrorism" around to apply to anyone they don't like, but the real danger is when the entire limits of the spectrum get shifted. Real terrorists blow up some buildings and kill thousands of civillians and everyone is screaming for revenge. Next, everyone is calling for the death of all terrorists. And, heck, few would argue that the lives of the perpetrators of 9/11 should be spared. But next, we start expanding terrorism to include destruction of property, and then hacking. And the calls for "death to all terrorists" continue.

If an arsonist burns down a building and nobody is hurt and steps were taken to prevent harm to people, they are an arsonist, and the law says they should go to prison for many years. But are we really saying that Bin Laden, with a bodycount of thousands is in the same class of criminals as an arsonist? Or someone who costs businesses millions of dollars in computer down time?

If someone targets a virus or DOS attack on a hospital or some other place where there is some known chance of actually bodily injuring real human beings, and the perpetrator was doing it for a political purpose, then, sure, they are a terrorist. But if it isn't reasonably expected to result in human injuries or deaths, then it is a politically motivated crime, not terrorism.

Think about it. The U.S. state department has a list of terrorist groups based on a very specific definition. If that definition were expanded to include actions that don't target civillians for injury or death, then the inescapable conclusion is that most acts to further foreign policy by any nation are actually terrorism.

Remember Watergate? Nixon's henchmen broke many laws to spy on his opponent. If computers had been around, they would have been hacked. Was Watergate an act of terrorism? Certainly not. Politically motivated breaking-and-entering and obstruction of justice, sure, subversion of democracy, no doubt. But it wasn't terrorism.

And forget about CIA actions that actually involved killing civillians. How many times have CIA employees broken laws in various countries for political purposes? While many would argue about whether the CIA are terrorists, if you allow non-violent crime to be terrorist, then there is no argument.

Even with the 9/11 tragedy, all the attacks were terrorist attacks because they all targetted civillians. But the attack on the pentagon was terrorism because of the civillians killed, not the military personel. If they had flown a bomber over D.C. and dropped a bomb on the pentagon, it would have been an act of war -- even a war atrocity, and maybe even a war crime, but not terrorism.

When you are watching the bombing of Afghanistan on TV, according to the state department's definition of terrorism, the U.S. bombing is not terrorism, even if hundreds or thousands of civillians are killed, even if the attack is being done for political reasons. The reason is that civillians are not being targetted. If Bin Laden could afford a modern airforce and carried out similar bombing raids on U.S. military targets (including power stations, government buildings, etc.) that would be no more terrorism than the U.S. bombing of Afghanistan. Yes, it would be an act of war, yes, it would be deplorable, etc. But it wouldn't be terrorism.

And if Bin Laden bombing every U.S. military base, power station, government building, etc. isn't terrorism, it's a hell of a stretch to say that some piddly DOS attack is.

Hypocrisy

[rlwaldrop]

While maybe I should examine myself as well

it is a bit frustrating that MS with its multitude

of terrorist-like business practices, software hitches

and the fact that its software is probably the

largest known virus in the community, has made such a claim.

Sarcasm?

[Anonymous Coward]

"Sounds like microsoft's future security plans may depend more on legislation than on code audits."

That's right. MS does as much as they can to not do any extra work.

Start making more intelligent statements. Your ignorance and bias are shining.

wonderfully lucid.

[3am]

you get the 3am clarity of thought award for the day (no cash value or karma).

very good reworking of the analogy.

Horse vs. Rider

[FreeMars]

I see that in Microsoft's view, users are "the horse" and Microsoft is "the rider"

A good virus

[einhverfr]

Might be a proof of concept which is never released, but built in order to test the possiblity that a virus could use similar means to propagate. Of course some of these get accidently released, like bliss or the Morris worm, but I think that these are "good viruses" because they are done in the spirit of assisting software developers build more secure software by informing them (nondestructively if all goes according to plan) of the potential for viruses to use various exploits.

breaking news (another analogy)

[Dave_bsr]

October 22, 2001 Posted: 3:53 PM EDT (1953 GMT) Redmond, Washington (CNN) In a public speech today, Microsoft executive Bill Gates apologized to the friends and families who died on American Flight 213, one of many test planes for Microsoft's PilotXP computerized pilot program. The flight crashed Wednesday, with no survivors. While the cause of the crash is still unknown, the new software is probably to blame. Gates' comment was, "If they had properly patched the software, this never would have happened. We can't be expected to sell a stable, secure product, right out of the box? That's ridiculous!" So...what if M$ built something that crashed and killed people? What then? Should Microsoft be held responsible for the software they sell, or should they blame other people for pointing out the gaping holes?

Re:breaking news (another analogy)

[drinkypoo]

That's not analogous at all. Terrorism, or even a virus, implies an attack, not just a failure. I don't think NT is recommended for use in nuclear power systems, let alone fly-by-wire.

You're talking about crash bugs. The rest of us are talking about security holes. While one can be connected to another, they're not quite the same thing.

Re:breaking news (another analogy)

[QuaZar666]

Every software from microsoft contained a EULA which gives you the ability to use the software but they are not liable for any software errors.

<eula> To the maximum extent permitted by applicable law, in no event shall Microsoft or its suppliers be liable for any special, incidental, indirect, or consequential damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information, or any other pecuniary loss) arising out of the use of or inability to use the SOFTWARE PRODUCT </eula>

Qua

OSS = terrorism?!

[Haeleth]

According to Microsoft, viruses are terrorism.

According to Microsoft, the GPL is viral.

Doesn't that make releasing software under the GPL a terrorist act?

hmm

[Anonymous Coward]

Unfortunately, some individuals (or companies) seek to destroy competing ideas rather than evolving their own.

... .... Must resist urge to point out pot calling kettle black!

Get Used to It

[4of12]

You will see more and more frequent use of the term "terrorism" in all kinds of contexts where the authors wish to gain attention to their cause.

I can see it coming...

"Down here at Bob's New and Used Car Supercenter, we're having an anti-terrorism Sale-A-Thon! We're not stopping until the last high price has been eliminated!"

Microsoft Ignoring Weaknesses

[Databass]

http://grc.com/dos/sockettome.htm

Here is Steve Gibson specifically telling Microsoft about a weakness in their sockets, allowing WindowsXP in the hands of naive users to be used as packet flooders for denial of service. He's talked to Microsoft honchos and they seemed unimpressed. But with this legislation they are for, providing the raw materials for Denial of Service attacks would be some kind of Criminal Neglect in Industrial Terrorism.

Not terrorism

[Anonymous Coward]

Newspeak like this shouldn't be tolerated.

People in the WTC had a reasonable expectation that a 767 wouldn't land there. It's not normal for an airplane to crash into a skyscraper. It had been many years since the last time it had happened. (B25 into Empire State Building, maybe?) It probably won't happen again for a very long time. They people in WTC were unconsenting victims.

People who use MS Outlook, or run potentially overflowable servers with full privledges, do not have a reasonable expectation of being free of attacks. It is normal for Outlook to execute viruses. It is normal for Windows to load and execute code on removable media by merely inserting media. It happens all the time. It will happen again. People who catch Outlook viruses are consenting victims, making them not victims at all. They are simply unwise.

If you know that you are a sitting duck, and you can trivially do something about it, then when the duck gets shot, the shooter is not a terrorist. He is merely a teacher and fulfiller of destiny.

According to this Language of War

[Anonymous Coward]

Microsoft is a bunch of Sad Sacks and Goldbricks.

Go to hell, Michael Lane Thomas

[sg3000]

I can't believe what this MS drone wrote:

> As long as the spirit of innovation is preserved
> and destructive viruses are recognized as
> industrial terrorism, Microsoft will continue to
> provide revolutionary ideas.

That guy then goes on to suggest that Microsoft is a victim of "terrorists". Look, Mr. Thomas, if a script kiddie can bring down a MS server, that's hardly the same as a terrorist. Calling it "terrorism" to gain sympathy while you tow the party line is just plain disgusting.

You want Microsoft to not be a victim? Put away your PowerPoint presentations on .NET, and go learn about the results of a real terrorist. For starters, go over to NYC and help the clean up effort. Or why don't you go donate money to the family of a fireman who lost his life trying to get people out.

Then you can put your "terrorists" in perspective: If you don't want MS to be "victimized": take security seriously and build a decent server OS, quit breaking anti-trust laws, and start acting like a company that's accountable for its actions.
Yeah, Mr. Moderator, this is a flame, but this guy makes me sick.

What's next?

[DrCode]

What's next is a divorce where one spouse claims that the other's yelling amounted to 'domestic terrorism'.

Re:What's next?

[Some Dumbass...]

Maybe the Green Party could start calling major polluters "Ecological Terrorists". Or the Libertarians could call the government "Legislative Terrorists". And how about banks which charge $1.50 for using their ATM and another $1.50 for the actual withdrawl? "Economic Terrorists" (or just "bloodsucking terrorists", expanding on the name we already gave them...).

Free...

[medina]

Free... like free beer. Mmmm... beeeer.

Microsoft Aligns Company Resources to Ensure Secure Customer Networks

Offers Free Tools; Mobilizes Worldwide Customer Support Organizations And Internal Development Teams to Help Customers Get Secure and Stay Secure

info: which is cheaper, lawyers, or programmers.

[LifesABeach]

As far as m$ is concerned, it appears to be that lawyers can be pretty cheap!...*grin*

Quality Check

[CakerX]

Viruses have had one up note. They have forced MS to tighten there products security for once. If they poured half as much money to into quality control/development instead of PR/fud/propiganda they could actually make a product I not be ashamed/fustrated to put on my desktop computer.

This Thomas guy is ridiculous

[Anonymous Coward]

How dare they try to exploit feelings of fear and anger towards terrorism to mask their inadequacies? Does this guy have no shame? The problems and consequences of Nimda and other viruses pale so much in comparison to recent tragedies it's ridiculous. I would be hopping mad if I had lost someone to the Sept. 11 tragedies.

Those don't look inconsistent

[roystgnr]

Changing the statute of limitations for a crime does not change the definition of a crime (so doesn't violate the first clause you italicized) nor does it change the penalty for the crime (so it doesn't violate the second clause). I agree that there's a bit of questionable morality going on here, but they're careful to keep it Constitutional, and that seems to be sufficient to keep it within UN guidelines as well.

I call Microsoft

[yet another coward]

an industrial extortionist.

The New American Buzzword

[Jagasian]

The New American Buzzword (sarcasm folks)
I don't like football. Football is terrorism.
Smoking is bad for people's health. Smoking is terrorism.
Stealing is wrong. Stealing is terrorism.
I dislike the winter. Winter is terrorism.
I ate a burger yesterday, and it tasted horrible. It was pure terrorism.
Racism is nothing more than terrorism.
Ford Explorers plus Firestone tires are nothing more than terrorism.
Hippies? Sheesh! They are terrorism born flesh.
P2P filesharing hurts our bottom line. Napster is terrorism.
Them peoples over in the middle east... yeah, they are different, and I don't like it. The only explanation is that they are terrorists.
Sooner or later, running red lights and other traffic violations will be equated with terrorism. Not long after that, the latest type of music popular amongst teens will be branded terrorism, just because the older generation dislikes it.


Reminds me of Object-Oriented Programming in the 90s. EVERYTHING IS AN OBJECT. Well now, EVERYTHING IS TERRORISM!

Exactly

[Anonymous Coward]

I can guarantee you nothing is going to change wrt security holes and sloppy code at Microsoft. They can't and won't fix their security holes so they blame everyone else but themselves.

How do I know this? I work for a large software company. It's not Microsoft, but they largely do things the same way when it comes to software development, and it goes like this:

Management gets a new product idea, and they declare a bunch of features they want, and that they want it done in x number of months. Then the software developers look it over and point out that the features wishlist can't be completed in the given time. Then we have a series of meetings in which we negotiate features against development time and cost.

Having been through this process, I can tell you one of the first things on the negotiation table was the security requirements. Management wanted something to demo to prospective clients and crypto libraries aren't very demoable. Engineering wanted to cut development time and security testing takes time. Out it went.

Then someone published a very embarassing piece about how to exploit security problems in one of our other products, and now suddenly management wants the security features. And everyone is pissed because the deadline hasn't changed and we don't have time to do this.

But now we are going to have to put some effort into security. But let me tell you if nobody published that exploit, we would be shipping this without any security testing whatsoever. And if a year goes by without any further embarassments, security will again be on the negotiation table.

The only way Microsoft (or any other large software company) will improve security is if people publish viruses/exploits every month. Period.

MS's Cockpit Doors are wide open - wrong focus

[Jason Straight]

They shouldn't be whining about what terrorism is, they should be taking proactive steps to combat it. If MS was an airliner they are leaving cockpit doors wide open then blaming everyone but themselves when they get hijacked. If they did their damn job right they'd be spending more time re-enforcing their OS and not bitching about who's visiting the cockpit. The key to stopping viruses is not letting them on the fscking plane in the first place, but if they do get on the plane don't let them in the cockpit. Sure it's nice to lay blame to the govt for not stopping them, but if you walk around with your pants down sooner or later someones going to have you by the balls, laws against it or not.

That is why it is called "accusations."

[El Camino SS]

Accusations are, by definition, statements made without the proof at that moment. So my suggestion would be to *perhaps* not take them as fact, and consquently not counterslap each other.

Re:Microsoft the Coward

[fferreres]

How? How's terrified at computer viruses? There are about 5000000 infected computers and even though people are pissed, they are more woried about 200 antrax letters.

Mh, i can see a patter here. People are terrified to lose their lives. People are NOT terrified about getting a computer virus infect their computer.

Microsoft should be sued to death by their lack of respect of the victims of terrorism for willing to push their agenda in this time of crisis.

There is something Microsoft can do to secure Windows, and it's laughing at the victims (dead or threatened by terrorism) is not one of them.

If they have security problems exploited by Jumbo-Gumbo of rusia or Mango-Boy from China, they can fix them and get on with whatever is their company goal. ie: World Domination.

Let's get this straight

[humming]

Terrorism:
The act of a small group of a people against rulers, hoping that the retaliation of the rulers should angry the masses enough to revolt against the government.

Terror:
What the rulers use to oppress the people.

Viruses, hacking, DoS is neither of these. There already are a strong word for it, 'sabotage'.

//Humming

Summary

[Bud]

Let's see now...

1. Microsoft makes software with security holes.

2. Microsoft chooses to spend money on leveraging their monopoly in order to expand, instead of making software of better quality.

3. Microsoft sees people are getting irritated. Uh-oh. Gotta do something.

4. Microsoft says: "Microsoft good! Virus programmers bad!" Microsoft proposes legislation against computer virii.

5. Taxpayers pay through the nose for the unsuccessful hunting down of virus programmers, many of which live in Taiwan anyway. Microsoft doesn't pay a cent.

6. Virii still exploit the still not patched security holes in Microsoft software.

7. GOTO 2

--Bud

there you have it

[geoff lane]

MS admits it's neither capable nor willing to tackle it's builtin security problems. Instead of acting responsibly as a mature member of the computer business, it's gone crying to the government, "Wah, please make them stop!"

Sadly, this beings the possibility of a balkanized internet one step closer; one half full of unprotected systems constantly attacked by "terrorist" virii, the other a calm and peaceful place consisting of systems created and run by responsible persons using secure protocols and operating systems and protected from the wild place by powerful filters and blocks.

Then finally, MS will have it's dearest wish, control of an internet. However, the rest of us will have moved on to bigger and better Internets where men are REAL men, women are REAL women and Mel is a REAL programmer :-)

Revolutionary?

[nealbutler]

"As long as the spirit of innovation is preserved and destructive viruses are recognized as industrial terrorism, Microsoft will continue to provide revolutionary ideas."

The only way MS' "ideas" could be described as revolutionary is if they actually provoked a revolution...mind you, how long have MS actually "preserved the spirit of innovation"?
Billy G probably has it locked up in a kennel somewhere...

nb

terrorist virus message

[commodoresloat]

Hi! How are you?

I send you these spores in order to have your advice

See you later. Thanks

Living versus dead things (computers)

[NKJensen]

What utter nonsense to draw parallels betweeen the killing of humans and any action taken against a computer.

only microsoft

[CheezeyWheezy]

only microsoft would call virus' acts of terrorism. doesnt shock me at all.

Contributory Negligence

[Anonymous Coward]

Running widows is just like accepting a lift in your buddies car afer he has way too much alcohol.
When you crash, get banged up - the court/insurance says you should have known better - foreseeable...

Sounds like MS is trying to get laws changed for an unsafe product . I bet someone in their security dept. is called bin sleepin. After 2 years, they now promise to get aggressive about buffer overflows. I doubt this, as only an external audit will acihive this outcome. Terrorism might be defined as anything out of control, domestic or foreign, with ill effects over and above what is tolerated by society - usually accompanied with loss of life, as opposed to vandalism.

MIcrosoft is guilty of murdering the oxford dictionarys definition of it security terms, and the politicians are guilty of not having a good enough education. all said and done, destruction of data must be the only test . I would rather police budgets be spent on THE problem, and not squandered to extend the careers of mediocre bureaucrats behind desks in the federal IT departments, rather than out on the streets saving lives - and arresting lowlifes who steal computersand laptops.

hotfix Re:virus

[leuk_he]

DEAR RECEIVER,

You received a taliban virus before. However due to a bug in the virus it is not as destructive as intented. please apply the following fix:

-First mail this to all you friends, coworkers and other americans.
-Then format you hard disk.

and only in this order.

Thank you very much for helping me.

0xaMA B1N 1aD3N
Talibanian hacker

Open Source users call for ban on M$ virus called

[Anonymous Coward]

'NT' & '2000'
and the pestilent worms it attracts
nah nah !!
Qubit

The Virus

[andy_from_nc]

I'd like to have Ashcroft call marketing pervasively insecure operating systems and infrastructure support software industrial terrorism and have it controlled like encryption.

But thats just me.

The Terrorist chat

[famazza]

A week before the attack, in #wtc@irc.terrornet.org:

• <Terrorist #1>
• Yep, it's written right here, the building will resist a 707 crash.
  <Terrorist #2> What the heck! How will we destroy that dam building
  <Terrorist #3&gt Don't worry, we'll solve this problem...

That's why they hijacked bigger planes. :o)

Breaking and Entering

[Anonymous Coward]

Folks breaking and entering is a crime in the physical world, and should be a crime in the virtual world as well, by direct analogy.

Now, I understand that some folks feel that the "breaking" has already been accomplished by Microsoft, but that doesn't make it A-OK to "enter". Unauthorized entry is a physical crime, and should be a virtual crime as well.

Both unlocked doors and criminals are likely to be with us forever, physically and virtually, but the logic for investigation and prosecution remains the same in each case. Criminal acts deserve criminal sanctions. Stop with all this "blame the victim" garbage, will 'ya!

No innovation?

[Anonymous Coward]

As a virus author, I am quite upset that Microsoft would want to stifle my innovation. With each new version of my software come new features and more ways to destroy systems easily, and quickly. The viruses of yesterday were harder to use and deploy. Today any child can do it. How can they be so against helping to bring easy virus creation to the home user? They call us terrorists, but in truth, we simply are listening and responding to what our end users need. They have the desire to corrupt large RAID arrays, we give it to them.

Vandalism ... Terrorism

[wls]

The general public needs to learn the difference between vandalism and terrorism and stop piggybacking on the media's hot word of the day.

Both acts are jammed packed with emotion, but one is more localized than the other in its duration and impact. Until people get hurt/killed or massive outages, or serious damage happens to largely shared resources, we need to stop placing defacement of web pages in the same category as recent events motivated by religious/political differences.

IMHO, the blame isn't all Microsoft's

[Control-Z]

To have a successful virus, you need:

1. Someone who wants to wreak havoc.
2. An OS with security holes.
3. Users who either don't secure their machine or allow it to become infected.

The root of the whole virus problem is #1. Of course that's just the way the world works, you've always got assholes trying to wreak some havoc. No matter how secure the OS is, people will find a way to exploit weaknesses.

As for #2, Windows is certainly full of security holes, but is any common OS totally secure? Unix isn't, MacOS isn't. Maybe most are much more secure than Windows, but maybe that's because they haven't been targeted as much. Windows is picked on because so many people run it. Microsoft is trying to make software easy for people to use, but the world isn't perfect and all their features tend to backfire when used for evil. Outlook, ActiveX, and VBScript are perfect examples. There a are a lot of things MS could change to make things much more secure.

And finally, whether Windows is secure or not, it still takes someone ignorant enough to click on an attachment to get infected. How will that problem ever be fixed? Take away the ability to receive attachments completely? That's the only way I can think of. Drive the virii back to floppy disk distribution!

Hammers and nails

[perrin]

Give someone a hammer, and he will see nails everywhere. Give politicians emergency powers, and they will see terrorists everywhere.

Industrial imperialism

[Pseudonymus Bosch]

Is industrial terrorism an answer to industrial imperialism? It seems as reasonable as the non-industrial one.

Industrial sabotage

[Pseudonymus Bosch]

Sabotage is industrial, at least according to History (throwing "sabot" shoes onto the machines)

Bollocks

[SpeelingChekka]

I would say that some viruses ARE terrorism. What about the big ol' DDoS we had a year or so ago? It was a smallish group targetting a list of victims for political means

From dictionary.com: "terrorism: The unlawful use or threatened use of force or violence by a person or an organized group against people or property with the intention of intimidating or coercing societies or governments, often for ideological or political reasons".

Now where in the DDOS attacks does "violence" come into it?

Maybe there is some vague fear that ones servers are going to be attacked. But its severely reaching to go from that to calling a DDOS attack "terrorism". Terrorism specifically implies physical violence to induce terror/fear. Fear of having ones server DDOSed is not the same as fear of being violently brutally murdered.

Terrorism=crime, but crime!=terrorism, don't get confused. Writing viruses might be a crime, but they are certainly not terrorism, unless somehow someone manages to write a virus that *directly* physically harms or kills people. Terrorism is a crime, but you can't just call any crime "terrorism", its not an umbrella term, and you can't just broaden the term to include any crime of which you don't approve. This is akin to people apparently no longer being able to distinguish "flirting in the workplace" from "sexual harassment" - the part where actual *harassment* comes into it seems to have been forgotten (for something to be "harassment" it actually is supposed to need to be pretty harsh and distressing).

If we keep going your direction (any "smallish group targetting a list of victims") we're going to end with basically everything being labelled terrorism. From everything unpleasant being seen as "damn commies" in the 50s we'll just have everything unpleasant be "damn terrorists". Oops, too late.

Even if an actual terrorist (i.e. someone who plants bombs in public places or flies planes into buildings) decides to DDOS some servers, that STILL does not make it an act of terrorism, in the same way that if Osama bin Laden runs a red light, running a red light does not become a "terrorist crime". If a terrorist commits a DDOS attack, even if for the same reasons that he bombs buildings, its still not an act of terrorism. A crime, yes, but not really different to if some naive 14-year old script kiddie commits the same DDOS attack (except in *intent*, but its not an *act of terror*).

In the 50's everyone was seeing commies under every rock. This knee-jerk business of seeing terrorists under every rock is much the same.

My neighbor is a terrorist

[skadork]

I don't like the way my neighbor mows his lawn. I think he is a terrorist, I think I'll "cry terrorist". Don't like someone? call em a terrorist and have em arrested...is there something wrong with this scenario???? or is it just me?