Slashdot Mirror
Sweden to Make Denial of Service Attacks Illegal
paulraps writes "Sweden is to pass legislation making Denial of Service attacks illegal. The offense will carry a maximum jail term of two years, and is thought to be a direct response to the attack which crashed the Swedish police's web site last summer. Nobody was charged for that, but the fact that it came shortly after a raid on the Pirate Bay's servers was thought by many to be not entirely coincidental. Sweden's move follows the UK, which is even tougher on web attackers — there the sentence can be over five years in prison."
So does this mean that they're gonna arrest Taco, Zonk and Co.?
My blog
As most of the time DOS attacks are performed from outside the country, and therefor outside its juridiction, I doubt they'll even invoke it in court.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Breaking their fingers is a good thought as well.
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
Don't do your DoS attacks from Sweden or the UK.
Anyone?
Good luck enforcing it and finding the C2 to punish the right person. I know my clan's site has had to move hosts a few times due to DDoS attacks, especially when the last one was pushing 10 Gb/s
Your hair look like poop, Bob! - Wanker.
It damn well SHOULD be illegal, but unfortunately making it illegal isn't going to accomplish anything. Look at marijuana, it's illegal but everyone does it anyways. It will be unenforceable.
Looks like the prison lobby has lots of pull in Europe, too. And in places you'd least expect it. If you want to make lots of money, you know where to invest.
What?
Take a quick look at everything that is illegal in Sweden, take a look at all the laws (seriously, do), and I can tell you that this doesn't really make a difference. Just because you make something illegal doesn't mean it will go away, something they refuse to realize in this country of mine...
DOS attacks are not funny. They should be treated a serious crime. Two years max sounds about right to me. It's a sufficient penalty to not be a "slap on the wrist", but neither is it a draconian "lock 'em up and throw away the key" response.
Apparently, DoS attacks were going to be labled as computer infringement. So, since I'm swedish, I can compromise your server just by loading your web site quick enough, while you guys still need to actually get into my server! This law makes it so much easier to be a cracker around here!
How do you suppose they'll handle compromised systems, proxies, or VPNs? If I root someone else's system and am knowledgeable enough to cover my tracks how do they propose to track me down? The FP also mentioned the Slashdot effect. How do you think they could handle a network of web pages which, when visited, all make requests from the targetted server (similar to pay-per-click scamming)?
the NPG electrode was replaced with carbon blac
Too bad they don't understand that the Internet is a consequences-free zone.
You can do just about anything on the Internet and are safe from prosecution. Why? Because the Internet crosses international borders and we all know that international law enforcement is just about impossible. No two countries have the same laws, the same penalties or even agree that the same things are criminal acts.
So, Sweden can pass all the laws they want to, but it will have no effect unless every country on the planet agrees that DDOS attacks are a criminal act with at least two years in jail being an appropriate penalty this will have no effect.
What is likely to happen is they will track some stupid show-off bragging script kiddie to Canada where it will be declared that they aren't going to extradite because it would bruise the delinquents ego. Or, the perp will be tracked to Romania where the response will be "So?"
Under the right circumstances, the US would probably even shield a perpetrator.
No, unfortunately for many people the Internet is destined to remain consequences-free for a long time to come.
Geez, so now it's illegal in Sweeden to crash people's websites! What's gonna be next, a law against blowing up mailboxes?
...does that mean it wasn't illegal up until now? That's actually more surprising to me.
Of course it runs NetBSD. BTC: 1NT7QvbetmANwaMzhpVL6
so who are they going to arrest? the bots?
Sweden has also made it a crime to take the last parking spot at a supermarket, or buy the last case of soda at the corner convenience store.
And in another strange coincidence, the swedish police department replaced all their web servers with a single 486 using a 10MB ethernet connections. The chief of police cryptically said "business is gonna pick up real soon now".
Seriously, I hope they define "denial of service" very precisely, or Swedish prosecutors just added another general-purpose arrow to their quiver.
This seems like a very reasonable maximum sentence. I am sure I can get 2 years for interferring with someones lawnmower or hairdrier in most jurisdictions. So I'm not sure this is even newsworthy. In fact.. I'm quite suprised this isn't already included in some kind of mischeif law thats already on the books and has been on the books for the past 500 years.
Its basically always been illegal to screw around with someone elses machinery.
No one has a right to their *own* opinion. They have a right to the TRUTH.
Probably not. But that's just because a Slashdotting is not what it used to be.
Server hardware has gotten so powerful that even a site running an untuned and uncached PHP/MySQL-based CMS can readily withstand a Slashdotting. With most low-end hosting plans offering 100 GB or more of bandwidth each month, exhausting such limits is no longer an issue.
While it may be somewhat suspect, we can look at the Alexa data showing Digg getting far more traffic than Slashdot, and other sites like Reddit and Netscape being close behind. If a site can survive a Digging, then handling a Slashdotting is going to be virtually nothing.
They're already interference with private property, DDoS attacks are illegal. They may not be specifically outlawed, but make no mistake, they are by no means legal.
MEF
As the internet continues to be extended to provide vital services (including access to emergency services etc), making denial of service illegal makes sense.
Engineering is the art of compromise.
People who get charged with DUI's and other more grievous crimes don't even necessarilly end up in prison for the first offense. Sending people to prison for over 5 years for taking down a website is absurd. It's something that should probably be dealt with via stiff fines. In most cases it's just a frikkan' website. In most cases no ones life or well-being rely on it... perhaps a separate more severe punishment like prison time could be reserved for those public service type sites that might exist with a greater purpose...
At least the 'maximum punishment' of 2 years they are seeking does not seem too severe. If that maximum sentence isn't abused, and used only for those repeat offenders who just don't learn it seems alright...
I think they mean they're making DDOS attacks more illegal. I can't believe that such destructive behavior was previously legal, nor do I believe that merely passing a law will have the slightest effect on reality. I mean, I'm frequently amazed at how stupidly U.S.-centric our Congress is when it passes laws regarding Internet crime, but I guess such thinking isn't limited to just our government. Practically speaking, such a law is likely to encourage more and more damaging attacks, just to show how ineffectual it is.
... nah, they're not that smart.
Personally, I think that government (any government) would be better off quietly diverting sufficient resources to law enforcement to enable them to catch these assholes. Throwing down the gauntlet by passing more legislation with much fanfare is just stupid and serves no real purpose. Unless they're being sneaky and trying to attract the DOS lightning to make it easier to nail the perpetrators
The higher the technology, the sharper that two-edged sword.
... we can no longer use the term "the server is borked".
Anybody want a peanut?
It has been illegal, just not in the same sense as it now will be, as now it will be covered by the law regarding computer intrusion. The DDoS attacks against the police's website last year were filed under "taking the law into one's own hands" (egenmäktigt förfarande). Which is a bit nebulous of a category for it.
I am very sceptical that this law will have any real effect. Just some sable rattling to give an illusion that the government is in control of these things.
while true; do eject; eject -t; done
Heh...I read this as "Sweden to Make Dental Service Attacks Illegal". No comment........
Quite a bit of assembly required, actually....
Of course, this being /. I didn't read TFA but any country where if I stagger into a bar already drunk, they deny me service and throw me out physically and _they_ get charged for it is alright by me!
I don't therefore I'm not.
What is just briefly mentioned in the article is that conspiracy to make a DOS attack will be punishable. It seems like a very vaguely defined crime and because the tough sentences it would give the police search warrants way too easily. Technically to be a suspect all you need to have is a computer - what else kind of evidence could there be before an attack is actually committed?
By the way... here is the link to the Swedish police: http://www.polisen.se/
inmate one:hey
inmate two:yea, what are you in for?
inmate one:I murdered my family. You?
inmate two:... DOS
IKEA is an abbrevation for Ingvar Kamprad Eltmaryd Agunnarryd (the first two are the names of the founder and the two second are the name of the farm he grew up at and the parish of said farm). IKEA is not a word in Swedish.
"Sweden's move follows the UK, which is even tougher on web attackers -- there the sentence can be over five years in prison..."
And in America the setence is life plus 5 years of probation, Japans setencing had no comment.
How about a MINIMUM of two years in prison?
Will microsoft and the zombiefied MS users be charged for maintaining an attractive nuisance when their computers running that paragon of computer security called "windows" are used in a DDoS attack? I mean, isn't this the usual and most common way those attacks occur in the first place?
If you leave your keys in the car and it gets swiped, your insurance company will take a pretty dim view of this behavior and could very well contest any theft claim you made. If some site gets nailed, from thousands of people who "left their keys in their computer" because they are running insecure by design windows, doesn't that make them at least partially accountable? This is not "news" that MS is basically hugely insecure and quite hard-(by the numbers,let's admit reality and no personal you are so leet anecdotals, so no arguing, everyone knows it is true-windows is just a total failure on that security score for 99% of the people who use it). So, who are the swedish cops really going to nail for some DDoS event? If a windows botnet is involved, shouldn't that be part of it? Same with mass SPAM, when will people and governments just look at the multi billion dollar company and go "you know, a lot of this crap REALLY IS YOUR FAULT".
Aren't DoS attacks already illegal by way of tort law?
http://outcampaign.org/
They're not illegal already ?
Don't they fall under some sort of Don't be an asshole common-law ?
Wanna fight ? Bend over, stick your head up your ass, and fight for air.
Correction: It is an acronym, not an abbrevation.
Probably the news was on Digg earlier, resulting in a massive influx of visitors. You say that Slashdot was responsible for less visitors, but maybe that was because some Slashdot readers had already seen the story (hours) earlier via Digg?
/. users, because Digg often has stories faster (or so I am told, I myself only visit Slashdot).
It would be interesting to see how many people regularly visit both sites. I think that people who often check Digg, will RTFA even less often than regular
Firehed - Unfortunately, thanks to medical breakthroughs, common sense is not as common as it once was.
The attack on the police homepage was nothing but a very simple javascript function on a HTML page, constantly reloading a large JPEG on www.polisen.se. The URL was then spread on a large discussion forum (namely flashback), which made everyone upset with the piratebay raid contribute to bringing down the site. Good luck charging thousands of people with broadband connections for visiting a webpage.
If you link to copyrighted material but do not host it, you're an accessory to the crime of illegally distributing the material. Story (in swedish), the actual document (pdf, swedish).
The problem with prosecuting the Pirate bay is that someone must be found guilty of a crime for another to be guilty of being an accessory to thet crime. The users of Piratebay are not suspected of a crime carrying a sentence of two years or more, meaning the police can't get their IP numbers, meaning they can't be charged with a crime that Piratebay could be an accessory to.
Your surely not trying to claim that people read digg for the comments..? The mind boggles!
I would have thought you'd have a higher percentage of people RTFAing on Digg, simply because there isn't really anything else they'd want to do there Certianly applies to all (five or so) people I know who visit Digg.
This sig all sigs devours
Make it illegal, so people stop doing it. Why didn't anyone ever come up with the idea of making Terrorism illegal, then we'd have saved a TON of money and quite a few people would've saved their lives, for example by not going to Iraq?
What do you mean, it doesn't work? It has to, or they wouldn't pass a law making a DDoS illegal. Or do you mean they would pass an unenforceable law, because
a) DDoSs are by their very definition international
b) Drones are used that don't even know they participate
c) Finding and disabling those drones is pretty much impossibe because of a) and b)
d) all of the above
?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Set your phasers on "funky"!
They won't be arrested for anything, since they probably didn't do nothing.
However, no one mentions the political change that occurred this autumn.
After twelve years of social democrats (left) we (swedes) now have the so called "alliance" (right) since a few months back.
Even though the social democrat's minister of justice (Tomas Bodström) was just the same kind of openly left and inner right kind of parrot that Blair is -- repeating whatever baloney the monkey in the white house spits out, there were never any successful arrests or trials for file sharing, torrent-sites, etc. However, it'll be interesting how much the new political power will bend over to thy mighty George Christ and arbitrary corporate organizations.
I'm sure we'll see more laws (like this), since that's the easiest way of showing political will and competence.
Personally I might move to Russia or China where you are a hell lot more free to use your hardware as you wish. Sure it has draw-backs, especially in China with the firewall and everything (and they kill their citizens, just like in the US), but what the hell... What country isn't completely fucked up today anyway? Either we have some dictators thinking they know best for everyone or we have the "democratic" corporate dictatorships (which some people refer to as "the free world")...
I think what you get is what you give, and the authorities today, give an awful lot of shit to their citizens...
What is the definition that they will use for Denial-of-Service attack i.e., when would I be considered under a DoS, if my site completely goes down? Or if I see a 50% drop in performance? Also, who will they arrest? If I had a spyware/malware on my PC without my knowledge would I be considered an offender? These things probably need to be crystallized too.
Damn marketers and their commercials! They led some of us to believe that Ikea was swedish for common sense.
It is important to note that the sentence term of 2 years was not chosen at random. When a crime carries this sentence as a possiblity, the Swedish police gets greater powers to use surveillance, wiretapping and raids to secure evidence such as the identity of person using a specific IP address.
Also, if you catch someone in the act of committing, or appearantly fleeing from the scene of crime of, a crime that carries a maximum penalty of more than two years, you may make a "citizen's arrest", that is grab and hold a person until the police arrives.
Now imagine a geek neighbourhood watch!