Slashdot Mirror
U.K. Outlaws Denial of Service Attacks
gnaremooz writes "A U.K. law has been passed that makes it an offense to launch denial-of-service attacks. The penalties for violating the new statues are stiff, with sentences increased from 5 to 10 years. The five year penalty was from the 1990 "Computer Misuse Act", which was enacted before the Internet became widespread. The idea of stiffer penalties for DoS attacks are probably something we can all get behind, but the language of the law is frustratingly vague." From the article: "Among the provisions of the Police and Justice Bill 2006, which gained Royal Assent on Wednesday, is a clause that makes it an offense to impair the operation of any computer system. Other clauses prohibit preventing or hindering access to a program or data held on a computer, or impairing the operation of any program or data held on a computer."
Another law with good intent.
Another set of wording so vague it's no use against those it's meant to stop.
Another set of abuses waiting to happen.
Is crushing a suspect's child's testicles illegal?
John Yoo: "No, [if] the President thinks he needs to do that."
This is a pretty good description of DRM! So it's illegal now?
Unfortunately merely meaning to do good isn't enough if you don't understand the root of the problem. This isn't going to deter people who are doing DoS attacks anyways. Usually they're using DDoS, through hijacked computers... This is pointless. But good for them for taking an interest.
The original poster sounds a bit silly - but he is getting close to an important point.
I don't think anyone here denies that it is important if websites go down. It can cot businesses millions if their website is not available to customers. If DDOSing hurts business, then why should it not be a civil issue? Let the civil jurisdiction deal with it, because it certainly isn't something that is worthy of jail time.
This needs to be a civil offense, not a criminal offense. When it's a criminal offense, we have these types of problems: vague-ness. Leave it to civil courts and have the victim sue the offender for so much money it's going to financially ruin the attacker.
If this is going to be a criminal case, a year in jail in addition to computer-banishment would be proficient. One, it prevents the person from repeating the crime. Two, it's going to be unpleasant for someone to spend a year in jail, not to be confused with prison, for something as physically harmless as denial of service attacks.
However, if a denial of service attack affects a medical institution or is against the government, then it needs to be a crime.
So let's see... DDOS takes down a site for a period of time (maybe more if its a shared server). And so we respond with 10 years in jail?
First of all, economically that's a moronic decision. Jail costs the state between 20-30 thousand dollars a year depending on where it is. Unless someone is DDosing Amazon, and here's where the vague wording of the law is an important shortfall, we're spending hundreds of thousands of dollars punishing someone who did perhaps a few thousand dollars worth of damage. That's bad economics, and I'm sure that money could be better used say, feeding the starving or allowing someone to go to college who otherwise wouldn't be able to.
Second of all, the kind of person you're going to be able to catch is not the person you want to throw in jail. We already have laws to punish people who run large botnets, and moreover by and large experienced blackhats won't be caught because they administrate their nets from countries ending in -stan. So the people who this legislation will put in jail will by and large be stupid college kids and people making a bad, poorly thought out decision as evidenced by the fact that they're using their home computer. These people need to be slapped with a big fine to they smarten them up, and then allowed to contribute to society.
This should be a poster case of a crime that should not carry criminal penalty.
Relax I just want some peanuts.
Damn! So now its illegal to use a script to flood a phishing site with dummy credit card info.
Or to load the ladvampire to use up the daily file transfer allowances on 419er's fraudulent "banks"....
When one of my websites (with over 130,000 active members) was being attacked, South Wales Police told me they couldn't do much to investigate the perpetrator because all the funds were tied up in fighting online paediaphilia.
What's the point in making the term of sentance tougher, if there aren't any resources to investigate online crime in many UK forces?
Say I have an encrypted drive on my computer and its seized by the authorities? Is that not impeding access to a computer system?
Also I totally agree with the earlier statement on REAL damage. Say a company's website is down and they sell things online. Someone who was really intent on buying something from that website will wait until its back up. Someone who was just shopping around will likely continue to do so, and the casual websurfer would pass it by, perhaps trying again later. They're really not LOSING any business, they're merely delaying it till later. How many individuals'/organisations' business would they honestly lose? There's no way of knowing, so they just pull a number out of their ass and say "This much!" and expect to be rewarded that amount, plus legal expenses of course.
Now say the victim is an individual in their home. Can they claim damages under this law? Most likely not since they're not "losing" anything (in a business sense), other than access to a service they've paid for. Sure you can ring up your provider and complain but they'll probably blame it on you and tell you its your computer being full of spyware and viruses and you should reinstall Windows. If you tell them you run *nix they'll probably say I'm sorry that's not supported we can't help you. Big firms (*cough* BT *cough) are all too happy to blame the customer first.
So what this boils down to is that we've now got yet another lovely new law that's beneficial to big business and no one else. Oh happy day!
Cam
Does this mean people can be prosecuted for installing Windows onto a computer system?
Maybe. But more likely it means you can be prosecuted for installing a browser. The only purpose of a browser is to use the bandwidth and cpu time of some other computer. That obviously interferes with anything running on that computer, impairing it for all other users.
Those who do study history are doomed to stand helplessly by while everyone else repeats it.
The problem with tagging some sites is that they can get millions of hits per day. Down time can cost a helluva lot. It would be more like vandalising voting booths on election day; Lots and lots of people would be inconvenienced.
You know, there is a difference between trolling and pointing out the flaws in your reasoning. Just saying.
Why wouldn't do you think the law would protect you? If someone did DoS your broadband, then yes, they could be charged as a criminal. I don't know how else it could be.
You know, there is a difference between trolling and pointing out the flaws in your reasoning. Just saying.
I disagree! You buy a computer - you're responsible for it. If you don't have the knowledge to secure it, you pay the professional to do it for you. You may also insure yourself for any damage caused by your system, insurance companies exist for that.
It's like having a car: You are liable for the damage caused by the car independent of who drives it. If it is stolen or hijacked, you are still liable. Therefore your are required to have an insurance that can cover the damage, there are safety requirements for the vehicle, and you are responsible to see that your car meet these requirements. If you are not professional you go to the mechanic and have it done. And even if everything is OK, and your car is stolen and involved in an accident, you are liable, your insurance will cover damage, and if the thief is caught the insurance company will seek to get the thief to pay up.
The same should go for the Internet: Once you're on the public network you are liable for any damage caused. If we hold people liable they will make sure that their systems does not inflict any damage, reduce the risk. Currently, people just say:
"Oh sorry, I didn't patch my system, I didn't update my anti-virus and someone broke into my system without my knowledge... but that's not my fault!"
and
"I don't know how to maintain my system, but I just want to use e-mail anyway, so why should I need to care?"
Of course, it is not entirely fair just to blame the user. Software vendors disclaim ALL liability, even for errors they have knowledge of. Schneier's dream is to make software vendors liable for their products. I think that unless the public have full access to the code vendors should not be able to disclaim liability. You can't both disclaim liability and impose restrictions on how the product may be used.
If there is product liability, then it is also fair to hold users liable for inappropriate use and abuse caused by their misconfiguration or negligence and liability cannot be passed onto the vendor.
If this means that uncle Bob and aunt Alice can't use the Internet, because they wont accept responsibility for their systems and won't buy insurance against abuse, fine! Cut the connection!
If you were to stand in front of Wal-Mart's doors and refused to let customers enter the store, I think you would go to jail. A DoS attack does the same thing.
"I believe you should only be able to disclaim liability if you also disclaim all rights to control the product - ie. open source."
I agree wholeheartedly with that!
As for defending ignorance, I guess it does come across that way, but there's a subtle difference between defending a person's right to be ignorant and defending ignorance. Ignorance is no excuse for breaking the law, but it isn't, and it shouldn't, be against the law to be running a computer that has been invaded by a malicious user!
I hate to say it, but it's almost exactly like forcing a rape victim to pay a fine for wearing skimpy clothes while walking the streets at night. Is it a stupid thing to do? Sure. Is the person liable for being raped? No! And computer virgins regularly get raped, so to speak.
I certainly DO believe that users should take an active responsibility to learn how to use their computers well. I'm not defending the right to be eternally dumb, but I am saying that the average user shouldn't be penalized for not having above average technical skills, because obviously half the people are always going to be below average in that respect. I believe users should learn, and learning computers should be treated exactly like learning anything else: for example, if you're learning computer science in school, and you don't study, you get a failing grade, yes? But you don't get taken to court and fined for being a poor student. As for penalties, surely a fine counts a financial penalty, no?
I do agree with your point that vendors should assume liability to protect their users. And I do agree that people should be responsible for learning how to use their computers well, including about matters of security. But if we're going to make people pay for not knowing they should have installed Bogosoft's latest virus definitions, or installed Fakeware's latest anti-spyware-botware-nosyware product, I think that's going a bit too far.
I mean, where would this lead to? To use the tortured car analogy, should Uncle Bob and Aunt Alice be forced to complete a written and hands-on computer test before being allowed to use a computer to send an e-mail to Aunt Carol? Not that you are suggesting this, of course, but it doesn't sound that far-fetched when you use the car analogy for liability.
Should users pay internet insurance to their ISPs? I dunno. I think it's crazy, but I'm suddenly envisioning a society where that is the case. O Brave New World! You might be on to something after all.
Professional Dilettante