Email Bomber Faces Retrial

An anonymous reader writes "A UK teenager who was cleared last year of launching a denial-of-service attack now faces a retrial. Judges have ruled that crashing a server with five million emails probably isn't permitted under the law. With NASA hacker Gary McKinnon vowing to fight on after losing his extradition fight yesterday, it's been a busy few days for the UK courts."

Comments

What is british spam like, anyway?

[Orrin Bloquy]

T/\lly H0! Av01d y0ur ch3m15t's f0r ch33p laudanum!

Re:What is british spam like, anyway?

[slashbob22]

No, as far as I remember British spam comes with Bacon, spam, eggs and spam. And if you take it easy on the spam it's actually quite good.

Re:What is british spam like, anyway?

[Xugumad]

Nah, it's just like American spam... in no small part because a hell of a lot of is American spam. More or less the half that's not from China...

Re:What is british spam like, anyway?

[70Bang]

What's from China is Ralsky and his slimeball buddies (there was a pretty decent DNA match, so they must be slimeballs) connect from the US and blast everyone from there. If China wants to isolate its people from the real world, let's cut the cables going in and let Ralsky et alia find another swimming pool to p-ss in.

Re:What is british spam like, anyway?

[07734]

Let's not forget where spam get's it's name from, the rather British Monty Python.

Re:What is british spam like, anyway?

[WebfishUK]

Not so. The original food item is an American invention. Unsuprisingly Wikipedia has a rather extensive article on the subject

Re:What is british spam like, anyway?

[generic-man]

That's true, but the reason bulk e-mail is called spam comes from the Monty Python sketch, mimicking the annoying characters who constantly offer SPAM(R) to patrons. Unsurprisingly Wikipedia has long entries on the sketch, the messaging phenomenon, and other related topics.

nothing to do

[Mydron]

it's been a busy few days for the UK courts

Yes, I'm sure they had nothing to do before these guys came along.

Re:nothing to do

[icydog]

You must be one of those ignorant Americans. Don't you know that the UK only ever has two types of criminals? Those who hack into US military servers and those who blow up servers with emails?

Re:Uh huh

[heinousjay]

Shhh. Here on Slashdot we like to pretend that the world revolves around the twin pillars of technology and socialism.

named for being 18

[Kaenneth]

Why can they now name him?

I thought the general principle under which juvinile records are sealed is to protect someone from being punished for life for a childhood mistake.

Re:named for being 18

[drinkypoo]

What are you talking about? In the US you get one name change basically for free, you do the filing fee and go get new stuff with your new name on it. In addition, if you get married you also get a free name change, and it can be to anything you want, there's no law or rule saying it has to be to change just your last name. If you want to change your name more than once in the US, you may have to appear before a judge and state your reasons.

Re:named for being 18

[ObsessiveMathsFreak]

I thought the general principle under which juvinile records are sealed is to protect someone from being punished for life for a childhood mistake.

Juviniles enjoy enourmous privilage under the law. They are effectively exempt from all but the most grevious of crimes. They will often literally have to kill one, possibly two people before they are given a serious sentance. Even then, the killings will have to be in cold blood, not in a fracas or the like, and the victims will probably have to be "innocents" of some kind rather than society's persona non grata.

To answer you question, if he were put on trial as a juvinile, he may have stood trial, and might even be convicted, but his sentance would be extremely lienient. It's probable he would have faced a small fine and perhaps a week or two of community service, if that.

However, having been visited by the wonderous Majority Fairy at the stroke of midnight on his 18th birthday, his juvinile privilages, exemptions, and get out of jail free cards have been revoked along with, presumably; his sexual innocence, mental incompetance and intolerance for alcohol. He is now fair game for the full weight of the law to be set on his shoulders as an example to all. A five year sentance is not out of the question, a step up from five weeks visting old folks homes to be sure.

Re:named for being 18

[brainburger]

It's kinda tricky to do any of that stuff when you are dead though...

Re:named for being 18

[Kaenneth]

It the US at least, it's the age at the time of offense that matters for sentancing.

I suppose that the UK is like what I heard (possibly incorrectly) about Canada, in that Minors have legal privacy protection from the press, and that the naming of the defendant in this case was not a restriction upon the court, but rather a restriction on the press (being that a Reporter could easily enough find out the name of an underage defendant, but it would be criminal for him to Publish it)

Re:named for being 18

[ScouseMouse]

I dunno about the US, but the age after which you are considered fully responsible for your actions and can be go to jail (Although usually a young offenders institute) in the UK is 14, not 18.

Re:named for being 18

[NATIK]

Its different everywhere, here in Denmark where I live its 15. It appears that where that boy lives, it is 18...

Re:named for being 18

[MBGMorden]

The US doesn't seem to have a set age (though it should). It will vary with severity of the crime and how the legal system feels like treating you at the time. IIRC, people as young as 12 have been tried as adults here.

Personally, I don't know for sure what the minimum age should be, but I can wholeheartedly say that the age of sexual consent, voting age, drafting age, driving age, drinking age, smoking age, and age at which you can be tried as an adult should ALL be the same value.

Re:named for being 18

[Frank T. Lofaro Jr.]

People as young as 16 at the time of the crime were executed in the US until recently.

Ah. Chinese spam.

[Orrin Bloquy]

So that explains why twenty minutes later I'm deleting spam again.

Double Jeopardy

[HotNeedleOfInquiry]

I thought the European Commission on Human Rights protected against double jeopardy. And no, Alex, I won't take Brussels for $200.

Re:Double Jeopardy

[Lewisham]

In the UK, you can be retried for the same offence if there is "new and compelling evidence" (usually DNA samples), or if the case was never fully closed, as here. The CPS appealed the case after the ruling, saying that the magistrate read the law wrongly, which sends it up the chain for review. If High Court had said, "Nah, it was a fair call", then the case would be closed and he could no longer be tried again. However, the High Court has sent it back for further review. IANAL so I don't know why the High Court itself doesn't make the decision, and I don't know what happens if the magistrate decides the same way again.

Such stuff happens infrequently, but is sometimes reported on the news.

Re:Double Jeopardy

[John Hasler]

I just quickly scanned through the Convention. I see nothing about double jeopardy.

Re:Double Jeopardy

[Lewisham]

The case was never closed: the CPS appealed for an intepretation of the law from a higher court. They are saying it *was* a crime when it was perpatrated.

They aren't retroactively convicting anyone: it's an ongoing case. The judge said the defendant had "nothing to answer for", and the CPS disagreed (as have the Court of Appeal).

Re:Double Jeopardy

[Lewisham]

Wikipedia helps here.

Re:Double Jeopardy

[John Hasler]

"Finally" is a huge loophole.

And, that protocol has not been ratified by the UK.

Re:Double Jeopardy

[igb]

My reading is that this isn't double jeopardy (and isn't taking advantage of the `new and compelling') clause in the recent CJA. Note to Americans: not all court systems work like yours.

It appears that the original defence was that there was no case to answer, because a mailerserver implicitly authorises mail to be sent. No case to answer => no trial and no verdict. The Crown Prosecution Service appealed that ruling, a ruling made in a magistrate's court (ie with an essentially amateur judge) and the High Court (a real judge) said that there should be a trial.

ian

Re:Double Jeopardy

[vidarh]

First of all, note that what happened in this specific case can happen in the US too in civil matters: A magistrates decisions can generally be overturned by a district judge. The difference lies in criminal matters only.

Even so, in criminal matters, the ability of an appeals court to refer a case back to a lower court is VERY restricted - generally it would apply to misapplications of the law where the appeals court decides to direct the lower court rather than make a full judgement itself.

In any case, in most European countries, double jeopardy refers to the governments general inability to start a new case against you on the basis of the same crime.

In other words, nothing stops either part from appealing a case to the highest available court, as long as the appeals are properly made within the (very limited) time windows allowed. Those appeals are considered parts of the same case.

Generally, the number of courts involved is small, and there is no opportunity from endlessly requesting retrials. In the UK it's generally "worst case" Magistrates, Crown court, High court OR Court of Appeals (not both) and (rarely) finally House of Lords at the discretion of whichever court made the last judgement. Furthermore, each step up in the system generally restricts the grounds of appeal and what you can appeal and to what court.

A superior court (all courts except the Magistrates and Crown court UNLESS it's a jury trial in which case the Crown court is also a superior court) is unlikely to hear the facts of a case again, for instance. It will be more likely to hear questions of law only.

Also, in the UK a magistrates will in serious cases (like murder etc.) only decide practical matters like bail and refer a case directly to the Crown Court, and a defendant can also demand a jury, in which case the case will be moved straight to the Crown Court.

So in practice, you can "skip a step". In practice, however, as in this case most people who have the choice choose to be tried before a magistrates first, because even though it leaves the Crown Prosecution Service (equivalent to the US DA's) one more appeals opportunity, it also leaves the defendant with one more appeals opportunity.

From a spammer

[this great guy]

So now we can't even send a small batch of 5 million emails without risking jail ? Pffffff. - Anonymous spammer

"...it's been a busy few days for the UK courts."

[John Hasler]

Two cases a busy few days of UK courts? I don't think so.

Re:Uh huh

[linvir]

I would have gone with 'technology' and 'crazy rambling' myself. See, we're not socialist, we're just really, really scared of lots of people, companies and organizations who happen to be right-wingers.

Re:Queue the oppologists

[rmsmith]

Are they like apologists?

Really....

[bsytko]

Judges have ruled that crashing a server with five million emails probably isn't permitted under the law.

So their saying crashing a server with five million hits is permitted. WOOT!

Re:Really....

[Lewisham]

Well yes, and therein lies the rub. The law states, quite categorically, that you are misusing computer equipment if it is "unauthorised use". The problem is where you define "unauthorized". Most people take it to mean that unauthorised is doing anything that would anger/damage the person who owns the machine. This means that if you work as a sysadmin, and delete all the files on the network, despire the fact you had the *capability* to do it, you stepped over the boundary into *unauthorised* use, because destroying the company's data in its entireity was not what your employer wanted.

What the magistrate said, was that if the email server is open, or indeed a web server is open, then that is authorising others to use it. While the letter of the law certainly allows that opinion, that isn't how the Computer Misuse Act has tradionally been read (which has been the above reading), and it's what the High Court sent back when they said to consider the point of view of the employer.

So whereas a Slashdotting is not a crime, because each user had a legitimate reason for using the web server for finding information that the owner had made public, DDoSing a web server is, because you are not using the bandwidth for the authorised use of reading web sites, you are using it for the unauthorised use of preventing others accessing the resource.

I expect this guy will be convicted.

Re:Time to address "the little dish"

[linvir]

As much as I always advocate vigilantism and gratuitous violence and torture, this is a case of a dickhead script kiddie, not a spammer.

Are you sure?

[maxrate]

Server crash!? That's a feature! - less spam for the day!

The good thing about extradition to the US...

[spiritraveller]

At least you know if you win the first trial, they don't get to do it over.

Re:The good thing about extradition to the US...

[icydog]

I thought the US Bill of Rights only apply to US citizens?

Re:The good thing about extradition to the US...

[Tweekster]

No, if you are in this country illegally or on a visa you are protected just the same

Re:The good thing about extradition to the US...

[Adam9]

Unless you're an "enemy combatant." The constitution doesn't cover them.

Re:The good thing about extradition to the US...

[Andrew Aguecheek]

Nor, it seems to other laws. What laws, incidently, do apply to enemy combatants? Does it work both ways?

Re:The good thing about extradition to the US...

[Detritus]

That's why we have the Geneva Conventions, to set some rules for the conduct of wars.

Re:The good thing about extradition to the US...

[spiritraveller]

Why should they get to do it all over again with a financial punishment and a lower standard of proof?

"They" don't. The criminal case is "the state" or "the people" against the defendant. The civil case is "the families of ron goldman and nicole simpson" against the defendant. Those families didn't get to decide whether the case was prosecuted criminally. They can't force the state to seek restitution for them. Instead, they have to seek it for themselves.

What "different purpose" does that serve?

It serves to compensate people for a loss that another person has caused to them. The criminal case serves the public's desire for retribution against someone who has violated our rules.

If someone steals your car and wrecks it, they can be prosecuted by the state, regardless of whether you want them to be. Either way, you still have the right to sue them for the financial loss they have caused.

Re:The good thing about extradition to the US...

[evanism]

which are the very rules *some* nasty countries choose to ignore, like the Nazi's in WW2....

Re:The good thing about extradition to the US...

[Shihar]

The Geneva Convention doesn't cover most of the wars that the US has been in. In order to get Geneva Convention protection, you need to be wearing a uniform when you are captured. The few times that the Geneva Convention has applied because it actually captured people that were wearing uniforms, the US has complied completely. The US did not see many uniformed prisoners even when it was fighting uniformed soldiers because the US tends to cause uniformed armies to designate (everyone dies or strips off their uniform and runs), rather then surrender. Everyone else though that the US has been fighting in the past few years have not been wearing uniforms, hence the US can justifiably say that it has no legal obligation to follow it.

Personally, I think that we need a new Geneva Convention for dealing with guerrilla fighters. The US is completely correct in saying that these people can not be treated like normal soldiers. In a normal war, once you win you simply let everyone go home who hasn't committed some crime against humanity. You can do this because if the nation's army is destroyed and victory declared the chances of them picking up a weapon again are very low. In these guerilla wars though there is no 'victory' that signals it is safe to send captured fighters home. True, some might happily go back to their farms, but others (perhaps many) are simply going to walk out, pick up another gun, and keep fighting. To make matters worse, you almost invariably pick up completely innocent people because the fighters all look like civilians. So, when you capture guerillas you have a group of people that range from hardened warriors who will immediately take up arms the second they are free, less hardened warriors who might or might not pick up arms when they are freed, and completely innocent people who were picked up because they were mistaken for warriors.

How the fuck do you deal with a situation like this? The hell if I know. What I do know is that this bickering about Gitmo and its legality is pointless until someone steps forward with a way to actually deal with these complexities. As to how to solve these paradoxes, I'll leave that to someone smarter then me.

Re:The good thing about extradition to the US...

[KarmaMB84]

It might work better if juries didn't think they were Robin Hood punishing the wealthy for nothing other than being wealthy. They simply love to shift wealth from one part to another in huge sums. Why else do awards from such cases almost always get stripped down on appeal...

What if?

[Zaphod2016]

I was working on a new cron tab the other day. It had been one of those 20-hour days, so I was already well-past "bobo mode" when I started. After a half an hour, I began to wonder where the hell all my confirmation emails were going....(er duh).

I wasn't "spamming", I was setting up on a new server and tired. Luckily, the default sendto was a null addy, but *what if*? What if one day I accidentally run a cron tab, and mail bomb the shit out of some poor shmoe?

Don't get me wrong: if I *did* ever do something so stupid, I would expect a civil lawsuit, and I would expect to lose. But is this really a criminal offense?

Re:What if?

[drinkypoo]

If you put up a porch poorly, and it falls and someone is injured, then you were negligent and it indeed can be a criminal offense. I don't see why running a server should be any different. As always the punishment should fit the crime, so a few hundred error messages (assuming high volume) that don't cost anyone probably wouldn't result in jail time :P

Re:What if?

[Lewisham]

Yes, this is a criminal offence (in the normal reading of the Act, I make a post further up about the different readings): it was unauthorised usage of the computer you mail-bombed, whether you meant to do it or not. You might get a lesser sentence if you can show it was just negligence rather than maliciousness.

Re:What if?

[Tweekster]

Your example fails to take into account the simply concept of intent which makes any further discussion rather meaningless. But lets try anyways. first you didnt try to crash a server or cause disruptions like this person did. therefore a major element of most criminal law is nonexistant second, i doubt you would have screwed up soooo badly that it would equate to 5 million emails of traffic in a short amount of time. if anything they might notice a small problem and investigate it, alert you to knock it the hell off. It is pretty obvious when a DOS is comming and just a lot of traffic.

Re:What if?

[John Hasler]

> If you put up a porch poorly, and it falls and someone is injured,
> then you were negligent and it indeed can be a criminal offense.

Only if the prosecution can show intent or criminal recklessness.

> As always the punishment should fit the crime, so a few hundred
> error messages (assuming high volume) that don't cost anyone
> probably wouldn't result in jail time.

The mistake postulated by the OP would not be a crime no matter how many messages were sent. No intent.

Re:What if?

[iminplaya]

I don't see why running a server should be any different.

Because it didn't fall from the rack and injure anybody.

Re:What if?

[darkmeridian]

Criminal laws (at least in the United States) require the specific intent to commit the crime. For instance, that's the difference between murder and manslaughter. In both cases, the defendant has killed someone, but the difference is what was going through their minds at the time they pulled the trigger. There are rare crimes where scienter is not required, such as causing the distribution of adulterated drugs into interstate commerce. In those situations, it does not matter what you intended to do--if you did the act, you will be convicted. But generally, if you did not mean to spam someone, and you can prove it, then you won't be convicted even if you did spam someone.

Re:What if?

[comp.sci]

It's the intent that distinguishes these actions.

Re:What if?

[Black-Man]

Most mail servers have the ability to reject and deny any further messages from your *domain* when it detects a DOS attack. So... you'd probably only get fired.

Re:What if?

[Shihar]

I imagine you would explain what happened to prosecutors, they would decide if you are telling the truth, and if it was an honest mistake let you off. I can't speak for the UK (though I assume it is no different in the US) but police generally don't come down on people for complete accidents. When I was younger and just got my license I left the scene of an accident I was involved in. I left because the woman who had crashed into me said she had no insurance and said she would pay for it out of pocket. I (stupidly) agreed, took her information, and had limped my car home. This was technically against the law. There was clearly at least $1000 worth of damage which means that by law we had to wait for a police officer to arrive on the scene before leaving.

As it turns out, when I got home my parents called the police, the police already knew that I had left the scene because a witness had reported the accident, and I went to the police station. At the police station the police officer told me that I had left the scene of an accident and that it was illegal, but that they would not press charges because it was an innocent mistake and I had clearly had no malicious intent or anything to gain. The woman who had fled the scene on the other hand, they prosecuted her leaving the scene of a crime. She had no insurance because she had been in a dozen crashes. She had fled because she was an unsafe driver and didn't want to be caught in an accident again.

My point? Police can be dicks some times, but generally when it comes to stuff like this they do what is right. The kid in question spammed intentionally just to be a dick and so should pay the price. If you accidentally spam because of a computer malfunction, you are probably okay. There is a world of difference between getting a thousand "SUP FAG!!11!!" e-mails and a thousand error message from server spam.

Re:"...it's been a busy few days for the UK courts

[ickoonite]

Two cases a busy few days of UK courts? I don't think so.

Perhaps. But there's a good joke about civil servants in there somewhere...

iqu :D

Re:Queue the oppologists

[JonathanR]

And shouldn't they cue not queue

Punishment for a script kiddie

[Kadin2048]

Okay so no baseball bat .... rolled-up phone book?

Just remember, every one of those spammers was an obnoxious script kiddie at some point. And the difference between "obnoxious" and "destructive" is only one of scale.

I'll take Brussels for $200 any day!

[Opportunist]

If that buys me better copyright laws... Ok, more like $200k.

To comment anonymously...

[Alphager]

... use that handy checkbox saying "Post Anonymously"

Re:To comment anonymously...

[this great guy]

I didn't want to post anonymously, my post was a joke. It's surprising how hard it is to get modded funny on /., just check my history, about 50% of my supposedly funny posts are modded down because nobody get my humor :)

Re:Queue the oppologists

[Anonymous Coward]

No, they have to wait in line like everyone else.

what the hell

[tehwebguy]

they can just have a retrial like that?

man that is scary, i mean across the pond we have some seriously scary laws (esp since the patriot act) but if any case could just be re-tried because the gov thought maybe they were wrong i'd be terrified.

Re:what the hell

[cliveholloway]

No, over here, they don't bother with trials - just send you to Gitmo or an illegal CIA jail and claim you're an "enemy combatant". Some people would welcome being re-tried. In fact, they'd probably cry with happiness if they were actually tried once ;)

Re:what the hell

[myxiplx]

Errr... wtf?!!

It's not a case of a re-trial purely because the government think they're wrong. They appealed and a higher court looked at the case and said "Yup, you may have a point there", and sent it back to the lower court for re-trial. That same higher court could just have easily have said "Nope, they interpreted the law correctly, case closed.".

Re:what the hell

[vpalexander]

On that note I'd like to finally confess (and you don't know how good this feels) that I raped your grandmother. God, it feels so good to get it out. I feel like I just had a cathartic colonic and nothing can stop me now. BRAAAAP.

Re:what the hell

[Shimbo]

they can just have a retrial like that?

They can appeal against a poor reading of the law in the lower court. I don't it find it particularly scary that someone who is incorrectly acquitted on technical grounds can face a retrial, if a higher court so orders.

Stopping Chinese Spam

[cyberscan]

This one is easy. If you do not want any traffic from China to you email server, just put a few very good words about Falun Gong on a webpage that happens to be on the same mail server you want protected. The Chinese authorities will gladly block ALL traffic to your mailserver. It worked for me :-)

Re:Stopping Chinese Spam

[fReNeTiK]

Heh, good one ;) Is this the page? Do you have some numbers on how much your spam count went down?

Re:Stopping Chinese Spam

[cyberscan]

It's the plaza1.net (same ip) domain. I still get spam but very little from Red Chinese IP's

slashdot effect?

[lon3st4r]

what if a site gets slashdotted?
is slashdot liable?
is the poster liable?
Are the people who visit the link liable?

Mental Note: must post mirror links in articles to avoid liabilities :)

BE scared really scared.

[leuk_he]

Slashdotting (and bringing it down) a site is illegal if you follow the same reasoning as the judge.


"Judge Grant had said that Section 3 of the Act, which concerns unauthorised modification of data, had not been breached, as emails sent to a server configured to receive emails could not be classified as unauthorised.

But on Thursday, judges at the Royal Courts of Justice sent the case back to the Magistrates Court, saying Judge Grant "was not right to state there was no case to answer". Mr Justice Jack said the judge should consider "what answer Mr Lennon might have expected if he had asked D&G" before starting the mail bombing."

Since slashdot already brough many sites to it knees (a lot less lately i need to say....) without considereing the site owners position the editor might be guilty of the same crime.

Next time taco send the /. crowd to pico server hosting a video he might want to consder if he ever wants to visit the UK again..

Re:Uh huh

[tehcyder]

socialism

Let me guess, you're from the US?

From a European perspective, I'd have said "insane pseudo-libertarianism".

Re:Uh huh

[heinousjay]

Apparently, you don't notice the opinions that are in agreement with yours. It's a fairly common pathology, so it's nothing to be worry about. This site is such a complete left wing feedback loop that anything right of center stands out dramatically. That's why you think the prevailing opinions on this site are right wing.