Slashdot Mirror
British Teen Cleared in "E-mail Bomb" Case
legaleagll writes "According to this article , a British Judge has ruled that a teen who sent approximately 5,000,000 e-mails to his former employer was not in violation of the U.K.'s Computer Misuse Act. It appears that the Computer Misuse Act is a bit outdated being that it was created 15 years ago when a number, perhaps most, of the current methods for misuse of computers were not contemplated."
Summary says 3 million, the article clearly, even hyperlinked so it's highlighted, says 5 million.
What a nerd. "If my electronic mail-bombe doesn't inconvenience my former employer, then my name isn't Melvin Q. Ucklesworth!"
This is most likely what he said while rubbing his peach-fuzz moustache (nothing to twirl evilly quite yet.)
How do we strike a balance between a piece of legislation that covers any crime that may not have been thought up yet, without prohibiting activities that are not necesserily criminal that will be invented in the future? This is something that no country has come up with yet and this is unlikely to happen any time soon due to various governments in power. (cough)
-Palal
Perhaps it is time for that business to invest in a more modern mail server. Indeed, even the lowliest of Dell servers running Linux or FreeBSD can easily handle 5 million email messages, even if sent in a very short period of time. A large amount of mail should never cause the server to completely crash, even if it does consume much bandwidth and cause other delays.
Cyric Zndovzny at your service.
That law has a hard time keeping up with technology. It takes a long time for laws to be made, changed, proven, and stand up in court. It doesn't take nearly as long in the technological world for attacks, defenses, and things in general to change. This is where a lot of the problems are coming from, since most of the time when you get things that are pushed out quickly there are all sorts of acts or laws such as the DMCA or Canadian Do-Not-Call list) which contain all sorts of problems in one way or another. It's just a shame it will take so long for things to really shape up.
Really quite a predicament when too fast means you get poorly written laws, and too slow means the bad guys can work "legally" for a while...
At first I was a bit confused as to why this was posted in the your rights online section, until I considered this case from the point of view of the poor bastard that got blasted by the former employee. Denial of service attacks have been around quite some time before 1990. If UK law doesn't considered this sort of computer act to be illegal what else isn't? What is illegal?
What if the entire Universe were a chrooted environment with everything symlinked from the host?
maybe the company can claim that the dude made some threats in the past. Maybe they can label him as a super-advanced cyber-terrorist and extradite him to US. (Maybe they can make him disapper there - in one of the secret prisons.) Wait - with the Blunkett laws, maybe they can do this without US help.
I doubt that we will ever figure out - and I suspect that even if we did figure out we couldn't do much about it
And look at that floating comma... "According to this article , a British Judge..." They really should stop calling themselves editors and start calling themselves what they really are - cronjobs. They probably spend five minutes in the morning picking stories and play games for the rest of the day.
It's illegal to mod your gaming console or copy your copy-protected CDs to your iPod but go ahead and fuck up some email servers? Got it.
Let's all send him email's of congratulation. 5,000,000 per ./ reader seems appropriate.
Or maybe sign him up for a few catalogs.
Who would win this election: Andrew Weiner vs Andrew Weiner's weiner.
If the editors had written it like "his previous employers, who are at this link: _______", then we'd get to see if they got around to updating that server. My money is on 'yes'.
Your mom gave me a cronjob last night...
Let's see, small 5-man company with basic ISDN (128Mbit/s) or ADSL (512Mbit/s)internet access used for everything including email, web access, etc that has no dedicated IT professional and whose business grinds to a halt because they can't do anything while their server is heavily attacked.
Don't assume that everyone has full-time IT professionals to hand. Also, don't assume that the messages were small: they could have been 10KB each, but they could easily have been 2MB each, 2,000 times larger than your guess.
Also remember that the crime in question took place at least two years ago, when internet access would have been slower, disk space would have been more expensive, etc, etc. The average business today has better resources now than would have been available then, at least from a bang-per-buck point of view, if nothing else.
Of course, if you're implementing IT strategy for a large corporation then DOS contingency planning will be part of your job description, but if you're running a small company, one where the guy who looks after the PCs is the same guy who puts out the rubbish at the end of the day, then DOS attacks probably won't be on your radar.
"Accept that some days you are the pigeon, and some days you are the statue." - David Brent, Wernham Hogg
The Computer Misuse Act seems to have been designed to encode the electronic equivalent of breaking-and-entering (offences 1 & 2) and criminal damage (offence 3).
Denial of service is probably very difficult to encode in a similar fashion, since I do not see what *criminal* offence it would equate to.
In this particular care, there is no essential difference between sending a million emails and sending a million letters by post - both would swamp the service, but equally both are simply making use of the (e)mailing infrastructure as it was designed. (Yes I know letters cost more. That's irrelevant - they require more effort to deliver, and are priced accordingly).
Taking a different example, such as opening thousands of connections to a server with intent to deprive others' of access to it, I still can't see what equivalent physical world *criminal* offence has been committed. In this case an analogy requires many people, but what difference is it if a thousand people stand on the pavement outside a shop entrance effectively preventing other shoppers from entering, due to weight of numbers? Sure, the police can ask people to move on, which is the same as closing those open connections, no?
Since most electronic systems only enact operations which have equivalents in the physical world, I do not see how it would be right to create a law which makes the electronic equivalent illegal, when the physical original is not. This use of legislation creates the likes of the DMCA.
The Computer Misuse Act is a rare example of a really *good* law which is (1) broad enough to capture most offenders (2) easily tested for applicabilty i.e. not complicated with exceptions, extensions, etc and (3) not so vague that it is open to abuse.