Slashdot Mirror
U.K. Outlaws Denial of Service Attacks
gnaremooz writes "A U.K. law has been passed that makes it an offense to launch denial-of-service attacks. The penalties for violating the new statues are stiff, with sentences increased from 5 to 10 years. The five year penalty was from the 1990 "Computer Misuse Act", which was enacted before the Internet became widespread. The idea of stiffer penalties for DoS attacks are probably something we can all get behind, but the language of the law is frustratingly vague." From the article: "Among the provisions of the Police and Justice Bill 2006, which gained Royal Assent on Wednesday, is a clause that makes it an offense to impair the operation of any computer system. Other clauses prohibit preventing or hindering access to a program or data held on a computer, or impairing the operation of any program or data held on a computer."
Another law with good intent.
Another set of wording so vague it's no use against those it's meant to stop.
Another set of abuses waiting to happen.
Is crushing a suspect's child's testicles illegal?
John Yoo: "No, [if] the President thinks he needs to do that."
This is a pretty good description of DRM! So it's illegal now?
Only outlaws will be reading Slashdot?
Unfortunately merely meaning to do good isn't enough if you don't understand the root of the problem. This isn't going to deter people who are doing DoS attacks anyways. Usually they're using DDoS, through hijacked computers... This is pointless. But good for them for taking an interest.
That really is rather vague. My family are able to "impair the operation of any computer system" just by being left alone with it for 10 minutes.
The original poster sounds a bit silly - but he is getting close to an important point.
I don't think anyone here denies that it is important if websites go down. It can cot businesses millions if their website is not available to customers. If DDOSing hurts business, then why should it not be a civil issue? Let the civil jurisdiction deal with it, because it certainly isn't something that is worthy of jail time.
assuming your not being sarcastic, (also as your not being modded funny)
deny service to ebay, amazon, or countless other ecomerece sites and your doing them more real financial damage per minute than several tyres and the cost of travel delay to most companies.
this law in my opinion (or at least it's intent as IANAL and haven't read all the legalese) is a valid generalization to protect all, that if enforced correctly should do no harm to anyone causing no harm (unlike various rights infringing DRM and terrorism laws kicking about atm)
So, when MS switch-off a copy of XP (or Vista) remotely FOR WHATEVER REASON they are breaking the letter of this law - and have "the necessary intent". So will we extradite Bill and bang him up for lots of 5-year sentences?
quick, everyone pull the article up and refresh till the cows come home!
I like your Macs, but I don't like your Mac users. (with apologies to Gandhi)
So let's see... DDOS takes down a site for a period of time (maybe more if its a shared server). And so we respond with 10 years in jail?
First of all, economically that's a moronic decision. Jail costs the state between 20-30 thousand dollars a year depending on where it is. Unless someone is DDosing Amazon, and here's where the vague wording of the law is an important shortfall, we're spending hundreds of thousands of dollars punishing someone who did perhaps a few thousand dollars worth of damage. That's bad economics, and I'm sure that money could be better used say, feeding the starving or allowing someone to go to college who otherwise wouldn't be able to.
Second of all, the kind of person you're going to be able to catch is not the person you want to throw in jail. We already have laws to punish people who run large botnets, and moreover by and large experienced blackhats won't be caught because they administrate their nets from countries ending in -stan. So the people who this legislation will put in jail will by and large be stupid college kids and people making a bad, poorly thought out decision as evidenced by the fact that they're using their home computer. These people need to be slapped with a big fine to they smarten them up, and then allowed to contribute to society.
This should be a poster case of a crime that should not carry criminal penalty.
Relax I just want some peanuts.
Does this mean that usernames/passwords are illegal??
Damn! So now its illegal to use a script to flood a phishing site with dummy credit card info.
Or to load the ladvampire to use up the daily file transfer allowances on 419er's fraudulent "banks"....
http://www.publications.parliament.uk/pa/cm200506/ cmbills/119/2006119.htm
"Making, supplying or obtaining articles for use in offence under section 1 or 3
(1) A person is guilty of an offence if he makes, adapts, supplies or offers to supply any article--
(a) knowing that it is designed or adapted for use in the course of or in connection with an offence under section 1 or 3; or
(b) intending it to be used to commit, or to assist in the commission of, an offence under section 1 or 3."
I'm now a criminal. Joe Blackhat won't care; he'll still get hold of the 'articles', but now my website which tries to teach people about responsible use of such 'articles' now makes me liable for up to 2 years in jail, plus a fine. I hate the law.
Now I don't have to know what the tools will be used for, just that they can be used for wrongdoing.
5-10 years for violating statues!
I'll never be-cone a statue ever again.
http://news.bbc.co.uk/1/hi/scotland/4264683.stm
I think the news.com.com summary, or the submitter's words make a poor summary.
Here is the amended law which certainly mentions not accessing a computer you don't have rights to touch (33) and the D.O.S. clause (34).
Specifically stated (and both need to be true) is "he does any unauthorised act in relation to a computer" and "he has the requisite intent and the requisite knowledge."
Requisite intent as far as 34.3.2.b would be D.O.S. or hacking and Requisite knowledge is defined at 34.3.4 as doing something you know is not allowed, that is, it's not an accidental D.O.S..
But.... Section 34.3.2.c could very well be taken as the UK's version of the DMCA. "If you attempt to defeat the lawful operation of a (DRM/WGA/SerialNumberCheck) program or provide tools (35.3a) to do such an act you face 10 years in goal".
IANAL
Orationem pulchram non habens, scribo ista linea in lingua Latina
When one of my websites (with over 130,000 active members) was being attacked, South Wales Police told me they couldn't do much to investigate the perpetrator because all the funds were tied up in fighting online paediaphilia.
What's the point in making the term of sentance tougher, if there aren't any resources to investigate online crime in many UK forces?
Say I have an encrypted drive on my computer and its seized by the authorities? Is that not impeding access to a computer system?
Also I totally agree with the earlier statement on REAL damage. Say a company's website is down and they sell things online. Someone who was really intent on buying something from that website will wait until its back up. Someone who was just shopping around will likely continue to do so, and the casual websurfer would pass it by, perhaps trying again later. They're really not LOSING any business, they're merely delaying it till later. How many individuals'/organisations' business would they honestly lose? There's no way of knowing, so they just pull a number out of their ass and say "This much!" and expect to be rewarded that amount, plus legal expenses of course.
Now say the victim is an individual in their home. Can they claim damages under this law? Most likely not since they're not "losing" anything (in a business sense), other than access to a service they've paid for. Sure you can ring up your provider and complain but they'll probably blame it on you and tell you its your computer being full of spyware and viruses and you should reinstall Windows. If you tell them you run *nix they'll probably say I'm sorry that's not supported we can't help you. Big firms (*cough* BT *cough) are all too happy to blame the customer first.
So what this boils down to is that we've now got yet another lovely new law that's beneficial to big business and no one else. Oh happy day!
Cam
Does this mean people can be prosecuted for installing Windows onto a computer system?
Maybe. But more likely it means you can be prosecuted for installing a browser. The only purpose of a browser is to use the bandwidth and cpu time of some other computer. That obviously interferes with anything running on that computer, impairing it for all other users.
Those who do study history are doomed to stand helplessly by while everyone else repeats it.
The problem with tagging some sites is that they can get millions of hits per day. Down time can cost a helluva lot. It would be more like vandalising voting booths on election day; Lots and lots of people would be inconvenienced.
You know, there is a difference between trolling and pointing out the flaws in your reasoning. Just saying.
Why wouldn't do you think the law would protect you? If someone did DoS your broadband, then yes, they could be charged as a criminal. I don't know how else it could be.
You know, there is a difference between trolling and pointing out the flaws in your reasoning. Just saying.
I disagree! You buy a computer - you're responsible for it. If you don't have the knowledge to secure it, you pay the professional to do it for you. You may also insure yourself for any damage caused by your system, insurance companies exist for that.
It's like having a car: You are liable for the damage caused by the car independent of who drives it. If it is stolen or hijacked, you are still liable. Therefore your are required to have an insurance that can cover the damage, there are safety requirements for the vehicle, and you are responsible to see that your car meet these requirements. If you are not professional you go to the mechanic and have it done. And even if everything is OK, and your car is stolen and involved in an accident, you are liable, your insurance will cover damage, and if the thief is caught the insurance company will seek to get the thief to pay up.
The same should go for the Internet: Once you're on the public network you are liable for any damage caused. If we hold people liable they will make sure that their systems does not inflict any damage, reduce the risk. Currently, people just say:
"Oh sorry, I didn't patch my system, I didn't update my anti-virus and someone broke into my system without my knowledge... but that's not my fault!"
and
"I don't know how to maintain my system, but I just want to use e-mail anyway, so why should I need to care?"
Of course, it is not entirely fair just to blame the user. Software vendors disclaim ALL liability, even for errors they have knowledge of. Schneier's dream is to make software vendors liable for their products. I think that unless the public have full access to the code vendors should not be able to disclaim liability. You can't both disclaim liability and impose restrictions on how the product may be used.
If there is product liability, then it is also fair to hold users liable for inappropriate use and abuse caused by their misconfiguration or negligence and liability cannot be passed onto the vendor.
If this means that uncle Bob and aunt Alice can't use the Internet, because they wont accept responsibility for their systems and won't buy insurance against abuse, fine! Cut the connection!
If you were to stand in front of Wal-Mart's doors and refused to let customers enter the store, I think you would go to jail. A DoS attack does the same thing.
DOS (or rather DDOS) attacks are rarely something you do from your computer at home. You have a herd of sheep doing that for you: Computers that you infected with a trojan which are under your control, waiting for the "drop da bomb" command.
Who's gonna feel those 5-10 years? As much as I'd love it, it won't be the people dumb enough to not even notice that their connection is at crawling speed because they're infected. That would indeed be the end of the 'net, because people would be scared to go online.
So we're after the guy controling the botnet? HA! Good effing luck! Europol backed and "encouraged" by banks is trying to get a hand on the guys doing phishing trojans. I.e. European persecution organisations with some rather "encouraging" businesses behind them are in vain trying to crack down on some people doing essentially the same a DDOS controller would do.
So why do you think a DDOS blackmailer who's most likely targeting "smaller" companies (read: Normal companies that don't have the executive forces of states at their fingertips) would ever be found out?
In a nutshell, the law is pointless. Unenforceable. Yes, it's forbidden. Yes, it's against the law. Yes, people won't give a fu.., knowing that it's impossible to get caught.
Whether a law is broken does not primarily depend on the sentence tacked to it. It mainly depends on your chances of being caught. If that chance is zero, the sentence could be worse than death and people wouldn't care.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
"I believe you should only be able to disclaim liability if you also disclaim all rights to control the product - ie. open source."
I agree wholeheartedly with that!
As for defending ignorance, I guess it does come across that way, but there's a subtle difference between defending a person's right to be ignorant and defending ignorance. Ignorance is no excuse for breaking the law, but it isn't, and it shouldn't, be against the law to be running a computer that has been invaded by a malicious user!
I hate to say it, but it's almost exactly like forcing a rape victim to pay a fine for wearing skimpy clothes while walking the streets at night. Is it a stupid thing to do? Sure. Is the person liable for being raped? No! And computer virgins regularly get raped, so to speak.
I certainly DO believe that users should take an active responsibility to learn how to use their computers well. I'm not defending the right to be eternally dumb, but I am saying that the average user shouldn't be penalized for not having above average technical skills, because obviously half the people are always going to be below average in that respect. I believe users should learn, and learning computers should be treated exactly like learning anything else: for example, if you're learning computer science in school, and you don't study, you get a failing grade, yes? But you don't get taken to court and fined for being a poor student. As for penalties, surely a fine counts a financial penalty, no?
I do agree with your point that vendors should assume liability to protect their users. And I do agree that people should be responsible for learning how to use their computers well, including about matters of security. But if we're going to make people pay for not knowing they should have installed Bogosoft's latest virus definitions, or installed Fakeware's latest anti-spyware-botware-nosyware product, I think that's going a bit too far.
I mean, where would this lead to? To use the tortured car analogy, should Uncle Bob and Aunt Alice be forced to complete a written and hands-on computer test before being allowed to use a computer to send an e-mail to Aunt Carol? Not that you are suggesting this, of course, but it doesn't sound that far-fetched when you use the car analogy for liability.
Should users pay internet insurance to their ISPs? I dunno. I think it's crazy, but I'm suddenly envisioning a society where that is the case. O Brave New World! You might be on to something after all.
Professional Dilettante