UK Government Launches Virus Alert Service

Phil1 writes "The BBC is reporting that a rapid alerting service that tells home computer users about serious internet security problems is being launched by the UK government. Has this been attempted anywhere else in the world? Was it successful? And will they be plugging the Microsoft Anti-Spyware package (once it leaves beta)?"

Comments

how does the average user validate the source?

[MrRTFM]

Only problem with email or TXT alerts is that the sender is easily forged.

Hi, this is your government alert - please download the latest patch from http://www.alerts.gov.uk

The problem is that (apart from Slashdot users of course) that the hyperlinks are hidden, so any spammer can forge these messages to catch the unwary.

That alone would bring this thing down - it would only take a few lords or half a dozen grandmas to see goatse (or worse - gator spyware) to cause a public lack of confidence in the entire government program.

Re:how does the average user validate the source?

[Anonymous Coward]

When you sign up for the ITsafe mail, you will have to provide a "ITsafe word" which will be in the subject of the email, and therefor its easy to see if its a forged mail..

Yes! Because it's not possible for a malicious attacker to sniff SMTP!

Re:how does the average user validate the source?

[Anonymous Coward]

But then the attacker would need to send out individual emails,

But it's a valid way to attack an individual or single organisation? What if that's exactly what you want to do?

We all know what's next

[gowen]

When will we expect the first Trojan masquerading as an update from the "IT Safe" service. The over/under is about 6 hours after the service goes live.

doesn't make sense.

[jwcorder]

This does not make sense. Almost all anti-virus vendors offer this same alert. All you have to do is go to their website and signup. I know because I get 3-5 of them a day in my inbox. Why the government would want to waste taxpayer dollars on this is beyond me. Of course, I have no reason to talk because I don't live in the UK.

But when going on the US's past programs like this, any time you get the government involved, things tend to get out of hand.

I just don't understand the need especially when symantec will do this for free.

Re:doesn't make sense.

[germ!nation]

you have to do is go to their website and signup. I know because I get 3-5 of them a day in my inbox

remember that 75% of the people on the internet only vaguely know what a firewall or AV program does, let alone know to google their way to a companies website so they could sign up to be made aware of a virus alert when they know nothing about what a virus really is or what they would do about it.

If this system adds even a little bit to the education and awareness of the problems faced when you have a PC connected to the net then i say it's worth it.

Re:doesn't make sense.

[beset]

We're used to wasting our POUNDS on failed IT ventures. If you've been following the recent upgrade of the NHS (national health service) ITC systems you'll know the government IT projects work something like: 1) Get overpaid consultancy firm to suggest "great idea" 2) Insert Tax Money 3) ??? 4) Insert More Tax Money 5) ??? 6) Abandon project at a massive loss. We're Brits remember, we'll just take it on the chin and have a game of tennis to vent....

Re:doesn't make sense.

[gowen]

Almost all anti-virus vendors offer this same alert.

And in 19th century New York, there were any number of competitive Fire Companies you could call if you wanted a blaze extinguished. And yet somehow, it was decided that people with a commercial interest in selling you stuff were not the people you wanted to call for an emergency.

Governments are flawed, but AV companies have a vested interest in selling you things you don't want.

Tax spent to plug holes?

[CdXiminez]

Now that the UK is going to spend tax payer's money to prevent problems caused by poor design by private companies, are they going to put extra tax on the purchase of vulnerable products and licenses (mostly Windows)?

I wouldn't want my tax money being spend on plugging the holes in software I don't use.

Has this been attempted anywhere else?

[PHAEDRU5]

The topic asks if this has been attempted anywhere else.

Well, there is the Computer Emergency Response Team at Carnegie Mellon University, and I like their approach.

I mean, one way they respond to threats is to contact anti-virus manufacturers. From there, it's a short step patches available via subscription.

You get the deep pockets of government to maintain the watch, and the rapid response of industry when a threat's been isolated. I like that division of labor.

Hey, why not

[Badgerman]

Snarky comments and Microsoft jokes aside (not that I don't like either), this makes perfect sense, at least on an abstract level.

Weather alerts, pollution alerts, traffic alerts, tornado warnings - all those are ways to reduce damage, save lives, and make life run smoother in the face of of problems. In the internet age, viruses and such fall into a similar category, so this makes perfect sense to me.

Also, this just increases people's awareness of inernet issues. A few years of watching virus alerts fly all over the place may make people more careful, more picky - and more demanding on certain software vendors.

Now where I WILL bet a bit cynical is if this is A) done right and B) can be done right elsewhere. I'm sure it can be done right, but the "if" is anoter question.

Still, hey, go for it UK Government.

Since it's not Microsoft's Product....

[Anonymous Coward]

Yes, the giant engine works well...clearly MS wins of they get /.'ers thinking it's an MS product. "Let's buy something for a few million with a fraction of a percent of our billions, rebrand it as ours, give it away to the people who only have spyware because our software permits these drive-by installs...and hell, we should be able to write off the whole purchase PLUS get people thinking we're nice guys!"

safe word: ITsafe or Virus

[dj42]

I wonder what the frequency of choosing the words "ITsafe" or "virus" or "warning" or "alert" would be by people signing up? 50%+?

Election coming up?

[badfish99]

There's no useful information on the site, but the front page features a press release and several big pictures of a government minister.

There's an election coming up, so it looks to me like another useless publicity stunt. I'm sure the web site will be left to wither once it's been reported in all the newspapers that the government is keeping us safe from "cyber-terrorism".

MS Anti Virus?

[Barny]

Heard they are considering not releaseing it.

If they charge money for it, their makeing the industry rely on their buggy software, and then instead of fixing the software sell you "protection", sound familiar?

If they give it away, will be seen as anti competitive with all the very big business anti virus software manufacturers out there.

Headline grabbing hot air.

[jchap]

"The government estimates it will issue security alerts about six to 10 times a year"

"Those signing up will only be told about the most serious security threats that have the potential to affect millions of people."

This sounds like a particularly ineffectual and pointless exercise. This level of virus information could be picked up from doing nothing more than watching BBC news or reading their site during the year. Further, it makes you wonder if the whole project will be run by a single guy who's job description has just been extended to include 'watch BBC news programs then forward email warnings to UK PC owning in-duh-viduals'.

However, it is also an extremely cheap way of getting +ve headlines (even Reg refers to it as an 'initiative'). I guess each government department has been told to come up with crap like this because we're in the run up to a general election.

Has this been attempted anywhere else in the world

[mwood]

You mean, like US-CERT?

It's an answer to a question.

[16K Ram Pack]

When someone asks the government just what they are doing to prevent terrorism on the 6 O'clock news sometime, it's something else to pad out the answer.

Completely useless and ineffective, but that's not really the point.