BBC Hijacks 22,000 PCs In Botnet Demonstration

An anonymous reader writes "'[The BBC] managed to acquire its own low-value botnet — the name given to a network of hijacked computers — after visiting chatrooms on the internet. The programme did not access any personal information on the infected PCs. If this exercise had been done with criminal intent it would be breaking the law. But our purpose was to demonstrate botnets' collective power when in the hands of criminals.' The BBC performed a controlled DDoS attack, 'then ordered its slave PCs to bombard its target site with requests for access to make it inaccessible.'"

Comments

why use botnet

[fredan]

when you can use slashdot!

Re:why use botnet

[Spazztastic]

when you can use slashdot!

Well, a botnet is probably faster. By the time your article gets through the submission queue the target would probably have gone offline along with the sun burning out.

Re:why use botnet

[Opportunist]

The botnet is not stronger. But it is quicker. Easier. More seductive.

Re:why use botnet

[N1AK]

I wrote about this story on my site and submitted it to The Reg at 10:20 this morning when I read the story on their website. Now its been aired on TV it seems to be getting a lot of coverage. I added an update a few minutes ago covering the two areas of the Computer Misuse Act that are likely to be quoted quite a bit in the debate about the legality.

I find it amazing that something this dubious was allowed to get all the way to airing without someone at the BBC having a hissy fit. Perhaps they have received legal advice that said it was legit?

As an aside, if I had wanted to submit my page to Slashdot is there a way I could of done it that (assuming it got published) wouldn't result in my host wishing a painful death upon me? I didn't change it partly because it's a short write up and partly for that reason.

Re:why use botnet

[geordie_loz]

But At least your article is likeley to be duped within a week or two.

Re:why use botnet

[Ninnle Labs, LLC]

But At least your article is likeley to be duped within a day or two.

fix'd!

Re:why use botnet

[the 99th penguin]

I find it amazing that something this dubious was allowed to get all the way to airing without someone at the BBC having a hissy fit. Perhaps they have received legal advice that said it was legit?

Or the legal department were the first to be made redundant?

Re:why use botnet

[N1AK]

Or the legal department were the first to be made redundant?

If they weren't you have to think they're probably next! If they aren't lined up against the rule and shot first.

Re:why use botnet

[Piranhaa]

This demonstration never really took place. They made up a bogus story that will get Slashdot to DoS the site for them.

Re:why use botnet

[jebrew]

But At least your article is likely to be duped one or two times that day.

fix'd!

fix'd and upgrayyeddedd

the double 'd' is for a double dose of pimpin'

Re:why use botnet

[DiLLeMaN]

mmm, double d.

Re:why use botnet

[Anonymous Coward]

I think you mean Upgrayedd. And he's coming to kick your ass.

Then you're both gonna have lunch at Buttfuckers.

Re:why use botnet

[PsychoElf]

I dunno...I'm sure most people on here are pretty quick and easy.

Re:why use botnet

[Anonymous Coward]

Or the legal department were the first to be made redundant?

If they weren't you have to think they're probably next! If they aren't lined up against the rule and shot first.

If that happened to a bunch of lawyers, I wouldn't exactly shed a tear. Especially not for corporate lawyers.

Re:why use botnet

[Teancum]

I suppose that the BBC views themselves as a branch of the British government. Yes, I know that it is supposedly an "independent" organization, but it is fully-funded by taxpayers in the UK.

Then again, would many people consider a similar investigation by the U.S. Department of Defense or Department of Justice to be legit?

Real monetary damages can be calculated here as well, as depreciation value and CPU time... not to mention access to network resoruces are certainly not "free" for the taking. Furthermore, technician time spent to remove these bot program, scanner software required to find this stuff.... removing this software is likely to be the more expensive part.

Assuming â100 per computer that was infected (a rather low estimate), that would be around â200,000 that this reporter has potentially set up his company for liability damages.

Re:why use botnet

[Anonymous Coward]

Hey now, I'm not gay buy 5$ is 5$.

Re:why use botnet

[Anonymous Coward]

As an aside, if I had wanted to submit my page to Slashdot is there a way I could of done it that (assuming it got published) wouldn't result in my host wishing a painful death upon me?

C'mon, I'm sure that your host would love to be slashdotted! Seriously though, try the Coral CDN to take some of the load off. For me, it doesn't seem to be working right now (DNS error), but that could just be the DNS server at my work.

Re:why use botnet

[Anonymous Coward]

when you can use slashdot!

Well, a botnet is probably faster. By the time your article gets through the submission queue the target would probably have gone offline along with the sun burning out

Yeah, but if it does make it through the queue, you'll DDoS 'em at least twice: Once for the initial article, then again for the first dupe..

Re:why use botnet

[growse]

Well, it's fully funded by tv-owners. Not all taxpayers own tvs, and vice-versa.

Re:why use botnet

[growse]

Sorry, the above should be TV-owners who use their TVs to watch live broadcasts. Other TV-owners don't pay for it.

Re:why use botnet

[TheRaven64]

Technically, by anyone with equipment that receives live TV broadcasts. This includes video recorders and PCs that are used to stream live events (e.g. sports) from the BBC web site, but does not include TVs used solely to watch DVDs or PCs that use iPlayer to watch shows an hour or more after they are broadcast.

Re:why use botnet

[Hatta]

Is it also fitter, happier, and more productive?

Re:why use botnet

[CecilPL]

I just use 4chan as my personal army.

Re:why use botnet

[coren2000]

but once you travel down that path, forever, will it dominate your destiny.

Re:why use botnet

[Anonymous Coward]

Hey now, I'm super-gay but 5$ is 5$.

There, I fixed that for you.

Re:why use botnet

[pjt33]

I think a good case could be made for offence 1 where the access in question was to the network card drivers (which could probably be construed as programs) of the computers in the botnet.

Re:why use botnet

[jabithew]

Erm, did you RTFA? The botnet was previously existing, the BBC spammed two accounts they'd set up, and DDOS'd a site they'd set up. I'd be shocked if they didn't tell the hosts what they were going to do. As a final step, they notified all members of the botnet that they'd been hacked by changing their desktop background. I think it would be difficult to claim damages as the BBC did not propagate the botnet and anyone in their clutches got off lightly.

Re:why use botnet

[MatB]

I suppose that the BBC views themselves as a branch of the British government.

Hah! You jest, surely?

Yes, I know that it is supposedly an "independent" organization,

It is

but it is fully-funded by taxpayers in the UK.

Incorrect.

The BBC is funded by a licence fee that all TV set owners pay, it's raised independently of the government and is specifically not a tax, the money never goes anywhere close to the Treasury. Many people chose not to have a TV and thus don't need to pay the license (I was one of these people for about 3 years, I had dial-up and a DVD collection, what'd I need a TV for?)

It also gets money from overseas sales and a semi-independent part dedicated to overseas broadcasts is funded by the Foreign Office in the same way as Radio America and similar.

I suspect the BBC has broken the law. I suspect they'll get investigated. I think that, regardless, they did the right thing--most people have no idea what a botnet is, let alone how much damage they do. Anything that raises awareness amongst domestic users in an open and transparent way is good. Those that had their PCs hijacked mught do well to upgrade their security (again).

Re:why use botnet

[godfra]

NYPA

Re:why use botnet

[Chabo]

Reminds me of this, in a way:

http://www.penny-arcade.com/comic/2007/02/09/

Re:why use botnet

[orkysoft]

Yes, they did some damage, but nothing lasting (assuming that they can relatively easily disinfect the botnet afterwards), but they probably have drastically increased public awareness of the problem.

And since knowing is half the battle, and so far, little progress has been made combating botnets, the BBC is at the forefront of combating botnets.

Re:why use botnet

[Anonymous Coward]

What the article didn't mention is that the BBC was also testing the concept of the EULA. Since the users had to click a button, it's there own damn fault.

In all seriousness, I may not be a Brit, but I would agree with you. They must have opened themselves up to some liability.

Re:why use botnet

[Opportunist]

Thank you! Finally one that gets it!

Gah, what happened to "news for nerds". Nobody even responded with "this is not the trojan you're looking for".

Re:why use botnet

[bigstrat2003]

I'm pretty sure everyone got it (you were modded to +5 funny, after all), but, as with most jokes, it's not as funny if you try to continue in the vein of the original.

Re:why use botnet

[Natetheinfamous]

I felt a great disturbance in the 'Nets, it's as if a million voices suddenly cried out in terror, and were suddenly silenced...

...DDoS???

Re:why use botnet

[Cederic]

The BBC used computing resources owned by other people without their permission.

That's illegal in the UK.

Re:why use botnet

[jabithew]

In the UK you can't generally get punitive damages. Thus the damages awarded have to be proportional to the losses experienced, in this case negligible.

Besides, the BBC have breached at most the letter of the law. Their benevolent spirit is obvious from their actions. I suspect it would be difficult find evidence of actual crime.

Re:why use botnet

[Cederic]

Evidence of actual crime is being published by the BBC. It is illegal to use computing resources owned by other people without their permission.

Illegal. That means it's a crime.

I completely accept that there's minimal harm to any given individual. This does not make it legal.

I don't want punitive damages. I don't really care about punishment of any tangible form. I do want prosecution and the full process of the law.

Re:why use botnet

[zmollusc]

Fair enough, here you are.

Law : OMG, j00 pwnt a lot of boxes!!!! That is a really serious offence, with the huge fines and the long time in prisons!!!!!!!!11111eleven

BBC : But I are a corporation!

Law : OK, case dismissed. Next case.

Re:why use botnet

[Cederic]

Hence writing to my MP asking that this matter be taken seriously.

The BBC is a corporation. The individuals that perpetrated these actions are not. They can and should be prosecuted.

Re:why use botnet

[rtfa-troll]

Of course, you could reasonably argue that, by installing Windows, these people consented to use of their computing resources by any media organisation who wishes to (including the BBC). Now, if this was a computing security organisation or a bunch of do gooders then they might be in trouble.

Re:why use botnet

[Anonymous Coward]

A show that airs at god knows what time in the morning on BBC News 24 raising awarness? There will be about 12 viewers probably.

Re:why use botnet

[zmollusc]

I agree with your sentiment, but don't expect anything so sensible to occur.

Re:why use botnet

[Anonymous Coward]

> I don't want punitive damages. I don't really care about punishment of any tangible form. I do want prosecution and the full process of the law.

Wtf ? Are you a botnet owner that want to force reporters to stop reporting about them ?

Re:why use botnet

[laddiebuck]

They certainly do not view themselves as having anything to do with the British government. They are funded not by taxpayers but by television viewers, and by a provision of law. Their ties to the government are merely that the legislature determines their increase in funding, and around that time, the government might try to suppress or delay some embarrassing stories. That's pretty much as it is around the world, though.

Considering the BBC spend millions on each episode of some of their more expensive programmes, and how much they pay the announcers on their news channels, they might have figured the possible legal damages as an acceptable risk in making the programme.

Re:why use botnet

[Anonymous Coward]

I suppose that the BBC views themselves as a branch of the British government. Yes, I know that it is supposedly an "independent" organization, but it is fully-funded by taxpayers in the UK.

The BBC is not funded by UK taxpayers, it is funded by an excise duty known as the "TV License". I am a UK taxpayer but as I do not own a TV I do not contribute to the funding of the BBC despite the fact that I make good use of its Radio and Internet services.

Re:why use botnet

[Laurence0]

Looks Welsh...

Re:why use botnet

[bluefoxlucid]

ENOTXKCD, EAGAIN

Re:why use botnet

[iYk6]

The BBC is funded by a licence fee that all TV set owners pay

Sounds like a tax.

it's raised independently of the government and is specifically not a tax

It still sounds like a tax.

Many people chose not to have a TV and thus don't need to pay the license

Seriously? You think that argument holds any water at all? I can choose not to have any income and won't have to pay income tax. I can choose not to drive and not pay gasoline tax. It seems you lack a fundamental understanding of what a tax is.

If I don't pay income tax, the gov puts me in jail. If a drug dealer doesn't pay a mob tax, he gets beaten to a pulp, his cash taken from him, and his family threatened. If you get caught avoiding the BBC tax, you are heavily fined.

Re:why use botnet

[shermo]

And he actually lost karma in the entire exchange.

Now I'm sure someone's going to vote me down in a poor attempt at irony, but hopefully my correct use of apostrophes will save me.

Re:why use botnet

[JWSmythe]

    Code your site well.

    If your site doesn't have a lot of images, Apache is tuned up well, and you aren't on a lame hosting environment that has a few thousand other badly coded sites, you'll be fine. Caching of your pages, even for a short time, so you're only sending out simple HTML, will save you.

    If you can't do it with one machine, do it with multiple web servers. Even if you're connecting to a common database, if you're caching your pages, you won't kill the database in the process.

    But, you're just hopeful that you both have something decent to post, AND you'll get posted here. I'm pretty sure if you try to automate submitting every story here, they'll block you.

Re:why use botnet

[JWSmythe]

Hey now, the fixed it meme is suppose to make it funny, not just fix his mistakes. :)

Re:why use botnet

[JWSmythe]

Oh, I'm sure there's a whole stack of laws that it broke.

    I thought the BBC was a government owned entity, but I just looked, and they aren't as of 2007. My bad. That could have protected them to some degree.

    The question would be, will there be any prosecution.

    If there's a house with the front door open, and I walk in, look around, and lock the door on my way out, I was trespassing. Since I did no harm, it's very likely that my act of trespass would be ignored.

    Since they trespassed (electronically) on 22,000 computers, they did commit a crime. They even went as far as to make a change to those computers, incurred expenses (used bandwidth to stage attacks on willing 3rd party servers), this was a very bad thing to do.

    The better thing would have been to write the story as a 3rd party. "We were invited to observe an attack by an anonymous botnet controller. In this, they...."

    The "didn't access personal information" is not a defense. Defendants in cases lie all the time. I didn't rob them. I wasn't speeding. I didn't steal financial information from the 22,000 people who I had broken into their computers.

    Most likely, they won't be prosecuted, simply because they are the BBC. If *I* had done it, and wrote the story, I'd be sitting in jail right now. I'm in the US, so they'd have a nice cell, decorated with a crappy mattress and a copy of the Koran, in Southeastern Cuba. The prosecution would attempt to acquire as much information as they could from the exploited computers. I'd have to hand over the list of the computers I used, because it would be the only way I could even hope for leniency. Hopefully the investigation would find that I didn't do anything wrong. Unfortunately, if the machines were exploited with one thing, they were probably exploited with others that weren't quite so polite. The evidence would show that the machines were exploited, and personal information had been stolen. I'd be screwed. "Big Bob" would be in my cell, offering me a sandwich. Those are things I never want to happen, so I'll keep my hands way way away from any botnets, and I sure as hell won't write about it in an international publication.

Re:why use botnet

[Cederic]

Cynically part of me wants the BBC staff to go through the fear of having all that happen to them - purely because then we might finally get some realistic reporting of the stupidity of current computer related laws.

Accessing an open wifi connection that's broadcasting an offer of service can get you time in prison; hacking 22k computers had better have some comeback.

The double standards are a factor. I name-dropped Gary McKinnon as a reference point when I wrote to my MP; he did nothing worse than the BBC yet he's facing decades in prison in a foreign country he didn't even enter.

There's a thought. I bet some of those 22,000 computers were in the US. Can someone in America please ask the FBI to extradite the BBC reporter and prosecute him?

Re:why use botnet

[trick-knee]

Hey now, I'm not stupid but $5 is $5.

There, I fixed that for you.

okay. I fixed that for you.

Re:why use botnet

[trick-knee]

Hey now, the fixed it meme is suppose to make it funny, not just fix his mistakes. :)

crap. sorry.

Re:why use botnet

[godglike]

I suspect they'll claim it was good journalism for the public good and the police will go do something useful.

Re:why use botnet

[Anonymous Coward]

Hmmm...I am guessing that the quick and dirty way making your page slashdot proof would be to produce a stripped down static page and make sure that its cache property is set to public. I would also make sure that you have at least a couple of secondary name servers setup maybe on everydns.net. If you want it to be available and are not worried about a bit of extra costs you could post the page on Amazon s3 under a sub-domain.

Re:why use botnet

[magarity]

most people on here are pretty quick and easy
 
I notice you were careful to leave 'seductive' off your list.

Re:why use botnet

[Anonymous Coward]

Protip: You just did.

Re:why use botnet

[ztransform]

I find it amazing that something this dubious was allowed to get all the way to airing without someone at the BBC having a hissy fit. Perhaps they have received legal advice that said it was legit?

It didn't contain anything that could possibly be construed as racist. That's all the BBC and the UK legal system are concerned about.

Re:why use botnet

[Haeleth]

I suppose that the BBC views themselves as a branch of the British government.

How would that help? The government has to obey the law, just like everyone else.

There are exceptions that let the government do things that would otherwise be illegal, like imprison people or tap their phones, but those exceptions are always very limited in scope and usually require the direct approval of a court or senior minister. They certainly don't cover "breaking the law just to make a point".

Re:why use botnet

[SausageOfDoom]

Exactly what I thought. Saying "Oh, we didn't do it with criminal intent, so it's not a crime" is like saying "Sorry officer, but I wasn't doing 150 MPH past that school with criminal intent, so it's not a crime", or "I walked into a bank, pointed a gun at the cashiers and told them to empty their vault in to the back of my truck. But I didn't do it with criminal intent, so it's not a crime."

There's a reason security researchers don't disable botnets by hijacking them and using them on themselves - not just is it illegal, but it risks further damage to the machine - damage which they would be liable for.

Whoever did this at the BBC may have done it with good intentions, but that is no defence in the eyes of the law. They showed incredibly poor judgement, and there should definitely be a police investigation.

Re:why use botnet

[6foothobbit]

The BBC does stuff like steal someones handbag then give it back. They then give the person and the viewers advice on preventing real criminals from doing the same. I don't think they're going to be in legal trouble for this one.

Re:why use botnet

[stephanruby]

And don't forget radios, if you live in the UK and own a radio that can receive a BBC signal (which pretty much means all AM/FM radios in the UK), then you have to pay at least half of the TV-licence fee each year (I recall that was what a blind man with a radio was ordered to pay).

In any case, I'd still call the TV-licence a tax thought. It's a revenue stream that's predicated on coercive governmental powers, and special preferential treatment -- which other television channels have no access to. Also, a tax is not necessarily paid by everyone. For instance, there is a pretty hefty tax on alcohol in the UK, but it's still called a tax even if not everyone buys alcohol. Also, the TV-licence is not directly correlated with consumption, like getting stamps for instance or getting gas and electricity. You can have multiple TVs in one household, or you could have just one working TV -- but never watch it, and you'd still have to pay for one licence for your household either way. So I'd say, the TV-licence is more tax-like because of this (even thought, I'll concede that alcohol doesn't really follow that model)

And taxes don't necessarily all go through one central location (at least, in the US they don't, I'm not sure about the UK, I've only lived in the UK a short while some time ago, but I'd suspect that even there the smaller city/council governments wouldn't want to mingle all their revenue streams with the national/regional governments, and I'd guess the same would be true as well for a number of independent governmental agencies, or semi-independent governmental agencies, or former governmental agencies, although I'll admit that there must still be a significant amount of money that still primarily goes through the Treasury of course).

Re:why use botnet

[MatB]

There are semantic definitions that could include the fee, but in the UK, a tax is defined as revenue raised to go to the treasury of a form of government, the BBC isn't part of the Govt, and the fee is raised independently by a subcontracted private firm.

You do not need to pay the fee, if you choose not to receive broadcast television: I owned two sets for the period I wasn't paying the fee, but I didn't have them plugged into an aerial and only used them to watch DVDs and videos.

If you choose to take a service (broadcast television) and then refuse to pay for it, then you're subject to civil constraints backed up by legislation. It's not a tax under UK definitions. I'm aware that the US has different definitions, hence the US embassy refusing to pay usage fees for London roads, etc. Specifically, under UK law, it's not a tax. Thus the BBC is not funded by taxpayers, it's funded by licencepayers (and DVD buyers, which I always remained).

Re:why use botnet

[Anonymous Coward]

Swedish laws are more evil :-( We have to pay TV-license if we have a piece of equipment that *could* be used to view TV-programs. And since SVT (Swedish equivalent to BBC) are finishing up the possibility to view all their programs live online that means that any computer with network capabilities and every cellphone with a browser counts.

TV's counted before even if you chose to not put in the antenna, only way to watch DVD's was if your display technically didn't have the means to view receive signals.

Re:why use botnet

[Anonymous Coward]

Idiot.
If the BBC was truely independant then the tv license would be shared equally around all stations. It would rely upon advertising for funding and other sources instead of forced funding.

If the bbc was independant there would be no tv license.

Re:why use botnet

[MatB]

Because reliance on advertising revenue as the sole model works really well for the independence of the media in the US. You never ever hear of stories or entire shows being quashed because the advertisers wouldn't stand for it. Oh, wait...

The TV licence allows the BBC to be more independent of outside influence than advertising funding. Doesn't make the BBC perfect, but does mean it has a guaranteed predictable revenue stream that allows it to commit to medium term projects that fulfill a public service remit. Like the iPlayer, and local news gathering, and coverage of non-mainstream events, etc.

Re:why use botnet

[TheRaven64]

And don't forget radios, if you live in the UK and own a radio that can receive a BBC signal (which pretty much means all AM/FM radios in the UK), then you have to pay at least half of the TV-licence fee each year

Not true. You don't need a license for a radio. If you are blind, you pay a significantly-reduced TV license if you own a TV and just listen to the audio.

Re:why use botnet

[Teancum]

This is still a mandatory tax. Yes, there are similar sorts of licensing fees that show up for using some content in the USA... the most obvious off the top of my head is the licensing fees for internet broadcasting that are collected through the Library of Congress.

BTW, I still call this a tax (in both cases), as it is mandated by official government legislation and can be enforced by government agents, up to and including the Royal Army (if you become enough of a prick).

What really throws a monkey into the independent organization bit is how the BBC has acted during war time efforts, particularly during World War II. It really did act as a branch of the British government and openly involved itself into the war effort in a number of ways, not the least of which was being directly involved with communications systems of the British foreign intelligence service. Sure, AT&T did some similar kinds of quasi-government actions as well during the same period (as well as during the Cold War... and even arguably during the "war on terrorism").

Re:why use botnet

[mdwh2]

50% off in fact (how generous of them! I guess visual is half, and audio is half ...)

The bit that I love is that a black and white TV licence gives a much bigger discount (it costs £47.00, that's about two-thirds off). I can just imagine blind people specifically buying old black and white TVs, just so they can pay less...

Re:why use botnet

[rtb61]

The reality is they did indeed have criminal intent as they stole computer processing power, wear and tear of hardware, electricity and of cost data transmission which affects user upload/download caps. It really was not their right to make use of other peoples machines regardless of the use to which they were put, it really was a bad mistake and they obviously received bag legal advice. Of course in the UK the individual doesn't press charges, the government does and the victim is just a witness, so it is really up to the police as to whether they should or will pursue the illegal access and use of other peoples computer systems as well as internet accounts. The worst of it all, they did it to make money, not for free, they were all paid, they derived a fiscal reward from their theft.

Re:why use botnet

[mdwh2]

The ability to charge a licence is backed by the Government - you go to prison for not paying. Referring to it as a tax as well as a licence is reasonable.

The fact that not everyone pays it is irrelevant. I don't pay car tax because I don't have a car, but that doesn't stop it being a tax.

I think that, regardless, they did the right thing--most people have no idea what a botnet is, let alone how much damage they do.

I don't think anyone really thinks they did a bad thing, it's more the double standard that anyone else doing it would be finding themselves in prison for a long time. And maybe we'd get some fairer coverage from the BBC on these stupid laws, if they themselves were affected by them...

Re:why use botnet

[Anonymous Coward]

In the UK criminal prosecutions are handled by the Crown Prosecution Service. In order for a prosecution to go ahead they have to decide that there is enough evidence to give a realistic prospect of a conviction, and that the prosecution is "in the public interest".

I suspect that in this case they would conclude that the BBC had been performing a useful public service and drop the case "in the public interest".

In addition the BBC would have a strong defence in that they performed a criminal action in order to prevent a larger crime (continued use of the botnet, sniffing data on the controlled machines, use against real targets). If you are threatening someone with a gun and I break your arm to stop you then although I have performed an illegal action I am highly unlikely to get prosecuted or convicted for it.

Re:why use botnet

[oggiejnr]

The radio tax was abolished 1971.

Now this...

[kcbanner]

...is good journalism. Good job BBC, the masses need to know about NOT USING IE6 TO SURF THE WEB.

Re:Now this...

[sopssa]

Accessing and modifying data on other peoples computers is illegal. Better article written by a known security researcher Dancho Danchev, who also thinks it was controversial and illegal act.

Even if your intentions are good, I DO NOT WANT you using my computer or making changes to it without my permissions.

Re:Now this...

[sakdoctor]

Then get some security.

No unlocked car or house door analogy is even slightly useful in this case.

Computer security by law is worse than security by obscurity, or security by Symantec product.

Re:Now this...

[Anonymous Coward]

...is good journalism. Good job BBC, the masses need to know about NOT USING IE6 TO SURF THE WEB.

Unfortunately, they do not mention anything about IE6 (or Windows, for that matter).

Re:Now this...

[N1AK]

Accessing and modifying data on other peoples computers is illegal.

It's not that simple, accessing someones computer itself is a crime under the Computer Misuse Act. Modifying data is another crime but I think the BBC can safely argue that they didn't have 'requisite intent':

For the purposes of subsection (1)(b) above the requisite intent is an intent to cause a modification of the contents of any computer and by so doing--
(a) to impair the operation of any computer;
(b) to prevent or hinder access to any program or data held in any computer; or
(c) to impair the operation of any such program or the reliability of any such data.

I have written a longer analysis of the Computer Misuse Act and how it relates to the BBC Click Botnet if you are interested. Please note IANAL and I don't mean in the kinkeh sex sense either.

Re:Now this...

[Anonymous Coward]

It is highly unlikely that any journalist doing such a thing publicly has anything to fear from the law. This was clearly done in the public interest, which is such a strong defence it's even codifies into certain laws which would otherwise makes things such as publishing "sensitive" details illegal, for example.

Re:Now this...

[Eternauta3k]

This reminds me of a certain video by The Onion

Re:Now this...

[Anonymous Coward]

a friend of mine was trusting Windows Defender (EEK!) as their primary firewall. I promptly got Avast! and put it on their system. After running a thorough scan, I found at least 90 trojans, worms, and other malware.
i personally recommend Kaspersky or Avast! and if you want your little kid to not be able to download these, consider DansGuardian [http://dansguardian.org/] as a pretty good filter.

Re:Now this...

[mike2R]

Out Law have an article:

Though the activity is likely to have been technically illegal, Robertson said that it is unlikely that the corporation will be punished for it.

"The maximum penalty for this offence is two years' imprisonment. But it is very unlikely that any prosecution will follow because the BBC's actions probably caused no harm. On the contrary, it probably did prompt many people to improve their security," he said.

A blog posting from security firm Sophos suggests that the BBC has committed an offence of making unauthorised modifications to a computer. Robertson said that that is unlikely.

"The offence of unauthorised modification requires a recklessness or an intent that I don't think the BBC has displayed," he said.

Section three of the Computer Misuse Act describes the need for an intent to impair the operation of a computer or to hinder access to data. Such intent is not required for the section one offence of unauthorised access, said Robertson.

The BBC did not respond to OUT-LAW's request for comment. However, a message on the programme's Twitter account suggests that the team did consult lawyers. "We would not put out a show like this one without having taken legal advice," it said.

Re:Now this...

[ciderVisor]

I hope you took time to explain to them that Windows Defender is not a firewall. If you want a firewall then Windows....erm, Firewall might be more appropriate, funnily enough.

I've been running Windows XP malware-free for over 2 years thanks to Windows Firewall, Windows Defender and LUA accounts. Do your friends a favour and set them up properly. Free them from third-party AV hell.

Re:Now this...

[Anonymous Coward]

You saying that IE5 is good enough then?

Re:Now this...

[commodore64_love]

>>>Accessing and modifying data on other peoples computers is illegal.

"When the government does it, that means it's not illegal." - paraphrase of that Frost v. Nixon movie. Yep. Your BBC Taxpayer dollars at work! Yay. I wonder what would happen if U.S.-PBS did this? Probably me a major shitstorm and congressional investigation. I hope the UK Parliament brings the BBC to task.

Re:Now this...

[commodore64_love]

>>>No unlocked car or house door analogy is even slightly useful in this case.

Yes it is. Even if you leave your car or house unlocked, the person can still be prosecuted for entering & trespassing. Private property is sacrosanct and "he left the door open" is not a valid defense whether you're discussing a car, a house, or a computer.

Re:Now this...

[Anonymous Coward]

we'll find out. I just contacted the police about it.

Re:Now this...

[DoofusOfDeath]

Even if your intentions are good, I DO NOT WANT you using my computer or making changes to it without my permissions.

Then get some security.

No unlocked car or house door analogy is even slightly useful in this case.

Computer security by law is worse than security by obscurity, or security by Symantec product.

It's foolish to leave one's computer insecure, but we should all be ably to rely on after-the-fact prosecution of crimes against us.

Re:Now this...

[Nick Ives]

Ditto. Vista's much derided UAC actually makes running Windows securely much easier too, it's actually the best part about Vista and I'm disappointed that MS is sacrificing security for ease of use in Win7. MS needs to stand firm against apps that bring up UAC prompts during normal operation whilst streamlining the UI to make the prompts more descriptive and eliminate multiple UAC prompts during certain operations.

To paraphrase, those who sacrifice security for ease of use deserve neither.

Re:Now this...

[Anonymous Coward]

But maybe a necessary act to actually drive the point home.

Even the BBC can do it! That's the shocking thing.

Re:Now this...

[Ralish]

Free them from third-party AV hell.

Windows Defender is an anti-spyware product, and not a virus scanner. It will NOT protect you against most virus threats, nor is it intended to.

In this respect, a 3rd-party virus scanner is still required if the detection and removal of viruses is important to you. Yes, there is Windows Live OneCare, but apart from the fact that it's scheduled to be discontinued in the future, you still have to pay for it.

Re:Now this...

[NonUniqueNickname]

Click has acquired control of 22,000 home computers

Meaning they put out a porn and warez site infested with malware? Or did they buy a botnet? If they paid, are the botnet sellers also free of criminal intent? The legality of what they ended up doing with the botnet might be up for debate. The acquisition, unquestionably illegal.

Re:Now this...

[Mikkeles]

'(c) to impair the operation of any such program or the reliability of any such data'

Screensaver operation was impaired by changing the picture.

Re:Now this...

[N1AK]

Screensaver operation was impaired by changing the picture.

You may be right, I am not a lawyer and so can't offer anything more than my own limited opinion. I do however have my doubts that the CPS would take impairing a screensaver as reason enough to attempt prosecution, and that any Jury would convict the BBC over the changing of a screensaver image. I would however love to hear the opinion of someone with some real experience of cases involving these laws.

Re:Now this...

[Anonymous Coward]

but if you know where to get a kinky sixth sense then i'd be more interested.

Re:Now this...

[Locke2005]

If that woman didn't want to have sex with me, she should have been wearing a chastity belt! Its her own fault for not having the appropriate security in place!

Sorry, I don't think that explanation is going to fly in court.

Re:Now this...

[Anonymous Coward]

They intended to impair the operation of their own computer by DOSing it. The law as stated doesn't care whether that impairment is authorised or not. They are guilty.

Whether they will be prosecuted is another matter. I hope they are. This act has been used for some absurd prosecutions and it needs to be changed. A journo in clink might do the job.

Re:Now this...

[themacks]

They installed a program, which participated in a DDoS, I think any decent lawyer could get them charged with something.

Re:Now this...

[bill_kress]

I'd go further to say that Computer Security by law is criminal in itself since it prevents defects from being found and brought into the light!

I think there should be a system in place to reward hackers that find a flaw and submit it. Abusing it, of course, should still be treated harshly.

Re:Now this...

[Anonymous Coward]

I've been using Antivirus 2009 (recently updated from 2008 per recommendations even from all the other anti-virus websites).
Since using it, I haven't had any viruses at all. I really don't understand how people can still get caught out in this day and age where we have such good tools available to us.

Re:Now this...

[jabithew]

Erm, the BBC is not part of the British Government. Besides, I think one has to consider the spirit of the law here, and the BBC had only benevolent intentions.

I'm not the BBCs biggest fan, I consider them Labour-biased. Nevertheless, I'd say this is an unequivocally good production. For crying out loud, they're educating the UK about the risks of unpatched/unprotected internet use, potentially dramatically reducing spam and DDOS risks, and Slashdot complains about the legality!

Re:Now this...

[Anonymous Coward]

Fine. We get it. But the analogy still doesn't hold, and if what they did happens to be against the law, then the law is wrong.

MSIE6's known functionality is that it does bad things and should never ever, under any circumstances, be used with the internet. If a person knows this (and everyone does or has had enough years to learn) and still chooses to use a program that downloads hostile code and runs that code, then that user must want to download and run hostile code.

So here's your analogy. You put a sign up in front of your house, saying, "Please come in and take something." You are robbed every day for 8 years while that sign is up. You don't complain. You meet the "thieves" and offer them lemonade as they peruse your stuff. You give them a kiss as they leave, saying, "Come back again soon!"

At 8 years and one day, someone from the BBC comes in and you shout "thief!!" and call the cops, even though your "please come in and take something" sign is still out front.

When something like that happens, the correct thing for society to do, is have a policy where the cops ignore the call. A crime did not take place.

If you play Russian Roulette every day, don't bitch about your head wounds.

Re:Now this...

[Qzukk]

Screensaver operation was impaired by changing the picture.

Did the picture fail to save the screen?

Re:Now this...

[Anonymous Coward]

I've been running Windows XP malware-free for over 2 years thanks to Windows Firewall, Windows Defender and LUA accounts. Do your friends a favour and set them up properly. Free them from third-party AV hell.

Yeah, but now try pluggin it in to the Internet...

Re:Now this...

[the_womble]

I am not up to date on this, but British law does not make trespassing itself an criminal offence, only a tort and unless damage is caused it is not worth suing.

Breaking and entering is a criminal offence.

Re:Now this...

[osu-neko]

Way to miss the point. Try rereading, including the "Computer security by law is worse than security by obscurity, or security by Symantec product." part.

Yes you're absolutely right that if you leave your bike unlocked and unattended, the person who will inevitably steal it can be prosecuted if caught and "it wasn't locked up" isn't a valid defense.

The point, however, is you still need to lock up your bike if you don't want it stolen. "Security by law" is not secure.

Re:Now this...

[Cederic]

They broke the law. Someone needs prosecuting for this.

I don't mind if the courts hand out a wrist-slap of a sentence, but I do think it's important that media outlets understand that breaking the law like this to get a story is not acceptable.

Re:Now this...

[godfra]

lol... I actually got caught out by that one a few months back. Very embarrassing.

Re:Now this...

[Tony Hoyle]

True. eg. if you find someone one your property and they've not broken in (eg. unlocked door) they're only trespassing and you can't arrest them (only the police can arrest for civil offences). If however they're carrying an offensive weapon - screwdriver, knife, etc. then you can arrest them for that, and if they try to hit you (assault) you can arrest them for that.

Not that I'd recommend arresting someone yourself unless you were damned sure you could keep them in one place until the police arrived without them doing serious damage to themselves or you... but it *is* an option.

btw. Do citizens have arrest powers in the US? I'm guessing not as it's the kind of think you'd see in hollywood movies if so.

Re:Now this...

[turgid]

I'm not the BBCs biggest fan, I consider them Labour-biased.

Have you ever listened to Today on Radio 4?

Re:Now this...

[bluefoxlucid]

It will if you wear a ski mask and do it in another state from yours and use a condom and shave all your hair. They have to get you to court first, which means they have to know who you are.

Re:Now this...

[bluefoxlucid]

You can make money finding flaws. Problem is you can make more money abusing them, for more (legal) risk.

Re:Now this...

[beav007]

Better article written by a known security researcher Dancho Danchev, who also thinks it was controversial and illegal act.

Why throw the word "controversial" around like an accusation? Controversial is not a synonym for "bad". It merely means that there is contention or strong disagreement.

You'll note that without controversy, there would be no current affairs programs, and newspapers would look like pamphlets...

Re:Now this...

[Anonymous Coward]

What a bunch of absolute crap. The house/car analogy holds perfectly well. To paraphrase your own words:

A deadbolt lock's known functionality is that it can be picked by a locksmith or experienced thief in minutes or less, and therefore should not under any circumstances, be used to secure anything of any value whatsoever. If a person knows this (and everyone does or has had enough years to learn) and still chooses to use a deadbolt lock to lock their house, then that person must want to have all of their stuff stolen.

Pure and absolute crap.

Your ridiculous sign analogy doesn't hold at all. In computer terms, that's like advertising on a website, email, etc, the exact address and root/admin password of your machine, with a clear invitation to use it. Not even close to the same thing.

To summarize: Running IE :: Using a deadbolt lock on your home Freely giving out your root password and machine details :: Inviting thieves into your home

Get it? You're trying to take the first part of one analogy and equate to the second part of the other. IT DOES NOT WORK THAT WAY.

Re:Now this...

[sopssa]

Because in this case, there was a strong disagreement?

Re:Now this...

[pclminion]

Computer security by law is worse than security by obscurity, or security by Symantec product.

"Security by user" is even worse. Why on earth do some people believe that one should have to be an expert in security in order to be allowed to use a computer? Your argument basically amounts to saying that some people are just too dumb to be allowed to use a computer. That might have made sense when computers were a new thing. But asking that every computer user (a fairly large fraction of all people on earth) should be a security expert is like saying that everyone should know how to remove their own appendix. It's stupid. We should not have to be experts to safely use computers. This is idiotic. The vendors need to fix their shit.

Re:Now this...

[commodore64_love]

>>>You put a sign up in front of your house

A more-accurate analogy is that someone (Microsoft) hung a key out front without your knowledge, and you have no idea it's there, because you were not informed of the "leak" when you bought the house. That's not your fault; that's Microsoft's fault. Both MS and the people who utilize the key to enter your home (like the BBC) should be prosecuted.

Re:Now this...

[ciderVisor]

I would argue that the way most home users operate PC's these days, they don't really require to be bothered about actual computer viruses. It you tie down your XP machine as Aaron Margosis describes, then traditional viruses are pretty much rendered impotent, through both their inability to deliver their intended payload and by being unable to reproduce and proliferate.

I can only speak from personal experience and anecdotal evidence, but everyone I've turned on to using LUA's on Windows has reported the same malware-free operation since switching. Highly recommended and free as in beer !

Of course, if you're operating a gateway as opposed to being a home end-user, then an industrial-strength scanner is still very necessary to scrub incoming traffic. No argument there.

Re:Now this...

[beav007]

There was strong disagreement. Sides disagree. Whooop. Also, they only think it was controversial? It was or it wasn't, and either way, who cares? It's either a really dumb thing to say, or a really dumb way to say something else that I haven't grasped.

Re:Now this...

[Ralish]

The thing is, the usage of LUA accounts is not a typical Windows (pre-Vista) setup. You've clearly discovered how useful they can be when used correctly, but very few people do use them, preferring instead to just run as an Administrator.

In this sense, while I agree a virus scanner is likely far less useful for someone with a system configuration like yours, yours is entirely atypical, and a more typical configuration would be well served to have at least a half-decent virus scanner.

This isn't too much of a problem anyway, with several high-quality free virus scanners available for non-commercial usage.

Breaking the law

[qoncept]

If this exercise had been done with criminal intent it would be breaking the law.

Ok, so, I don't know much about the laws, but it is illegal, isn't it?

Re:Breaking the law

[jeffmeden]

Don't worry, it was a "low value" botnet... That makes it OK.

Re:Breaking the law

[Spazztastic]

If this exercise had been done with criminal intent it would be breaking the law.

Ok, so, I don't know much about the laws, but it is illegal, isn't it?

Regardless of intent it is illegal. They are gaining unauthorized access to someones PC and using it for their own personal gain. If I were to demonstrate how to crack someones WEP key in 5 minutes without the victim's explicit written permission it would be illegal, even if done just for "educational purposes." Sure, it's edgy reporting, but it is still highly illegal.

I doubt anything will come of it though.

Re:Breaking the law

[marcello_dl]

Yep, this seems more of a demonstration of people not caring if somebody gets into YOUR pc.

It's like a guy entering your house through an open windows, and standing there without stealing or ruining anything. Is it ok or it is more ok to tell him "Get The F*k Out"? You decide, sheep ;D

Re:Breaking the law

[bentcd]

Ok, so, I don't know much about the laws, but it is illegal, isn't it?

Presumably. The press tends to be given a fair amount of leeway in cases such as this though.

Re:Breaking the law

[snowraver1]

What's a botnet?

Re:Breaking the law

[rhsanborn]

I wonder if I can take the car of every BBC staffer and use it to demonstrate how a small army of cars can do something illegal if I so chose to do so. But I'm not using them to do anything illegal, so it's ok that I took them.

Re:Breaking the law

[ShieldW0lf]

It's like a guy entering your house through an open windows, and standing there without stealing or ruining anything. Is it ok or it is more ok to tell him "Get The F*k Out"? You decide, sheep ;D

I'd say it's more like you leaving your hunting rifles lying around on the front lawn and someone took them and used them for a drive-by.

Securing your machine is your responsibility. Failing to do so is negligence.

Re:Breaking the law

[PhilHibbs]

No, it's more like if your door is already busted wide open and burglars are coming in and out, and a reporter wanders in.

Re:Breaking the law

[unlametheweak]

Regardless of intent it is illegal.

Isn't the BBC "owned" by the government of Britain ("a quasi-autonomous statutory corporation as a public service broadcaster and is run by the BBC Trust; it is, per its charter, supposed to "be free from both political and commercial influence and answer only to its viewers and listeners", Ref: http://en.wikipedia.org/wiki/Bbc)? If so it would appear that they are immune from the law because, as contemporary history demonstrates, "intent", when the government is involved is never criminal in nature, but rather for the good of mankind.

Re:Breaking the law

[Dr Caleb]

It's an electrically charged net that we use to catch runaway robots. Like the Ethernet we use to catch the EtherBunny.

Re:Breaking the law

[Anonymous Coward]

There needs to be an exception for WEP and other deprecated algorithms.
These are of historical and educational interest only.

Re:Breaking the law

[Spazztastic]

These are of historical and educational interest only.

WEP is far from deprecated in the smaller community unfortunately. Old wireless cards don't support WPA/WPA2 and not everybody can afford to buy a new one (even for $30). Most WEP setups are put in by someone one time and never touched because the user doesn't know any better. I suppose it's better than having just an open network...

Re:Breaking the law

[Tukz]

By that logic, the BBC would be entitled to demonstrate how easy it is to break into people houses, or how easy it is to acquire a gun and kill someone. For educational purposes!

Re:Breaking the law

[bickerdyke]

First of all.... what do you know about BRITISH law?

Re:Breaking the law

[ianare]

I thought journalists had greater freedom in certain situations. For example interviewing a wanted felon and not reporting his/her location to police would normally be illegal (obstruction of justice, aiding a felon), but journalists do that all the time.

Re:Breaking the law

[Cimexus]

Hell, the Nintendo DS, which is a relatively new piece of hardware (released way after WPA was common) supports only WEP. So if you have a DS in the house and you actually want to use the online features ... you have to use WEP. Argh!

Re:Breaking the law

[Anonymous Coward]

I followed you until the WEP comparison. Isn't "cracking WEP" a self-contained math problem? Why would solving a math problem in your basement be considered illegal? Of course gaining unauthorized access to someone PC (using the cracked WEP key) would be illegal, but you already established that.

Re:Breaking the law

[Opportunist]

It's ok to tell him to get the f.. out. But most people, to return the analogy to the PC, don't even care that someone is standing there, in the middle of their living room, making unsolicited phone calls from your landline, telling everyone about your tv watching habits or even stuffing your jacket pockets with leaflets. As long as they don't trash the place, most people don't care that someone is standing there, coming and going as they please, leaving the window open for any burglar that wants to come in.

Re:Breaking the law

[Gryften]

The EtherBunny is the one that runs around anaesthetizing kids to commemorate the ressurection of Jesus, right?

Re:Breaking the law

[yo_tuco]

"I don't know much about the laws, but it is illegal, isn't it?"

It is legal if you wear a suit-n-tie and work in a corporate office. But if you wear a tee-shirt working from your basement, you're under arrest for unauthorized access.

Re:Breaking the law

[Ontheotherhand]

Well. it is more draconian than american law, not underpinned by a constitution as such, but usually interpreted by a non political group of Judges so that in general it works. recent right wing hastily passed laws on anti terrorism and new fangled computer thingies not withstanding.

Re:Breaking the law

[Opportunist]

...and you complaining about the reporter who told you that burglars are coming and going, because he made you look stupid. Instead of thanking him and asking him how to get rid of the burglars. Or at least cursing him and asking him how to get rid of them.

Re:Breaking the law

[gandhi_2]

Almost all hunting rifles are bolt-action. That would make a pretty ineffective drive-by. Especially if you are the one doing the driving and shooting.

Re:Breaking the law

[sopssa]

This applies here really good actually. Botnets per se arent illegal; users can install on their machine whatever apps they want. its illegal what you do with them. Even more than botnets it worries me if random people get the authority to access your pc and change data on it without you knowing. BBC broke law here and I hope they get some conscidences, because otherwise we see lots of people with apparently 'good intentions' accessing other peoples pc's.

Re:Breaking the law

[Jurily]

Ok, so, I don't know much about the laws, but it is illegal, isn't it?

Did they do it with the permission and supervision of the police?

Re:Breaking the law

[Leafheart]

If this exercise had been done with criminal intent it would be breaking the law.

Ok, so, I don't know much about the laws, but it is illegal, isn't it?

It is not illegal if you are a journalist. It would be illegal if it were you or I though. If you are a blogger it is not clear yet.

Re:Breaking the law

[Ghostworks]

That's not "normally" illegal. That's "always" illegal. Luckily for many reporters, the authorities are often spread to thin to track down real criminals, so the chance of them wasting resources on a reporter are slim unless it would actually help to catch the fugitive in a particularly high-profile case. Reporters still go to jail every once in a while for refusing to name a source, or doing something stupid.

Re:Breaking the law

[Dishevel]

I so wish I had Mod points right now. That is the most accurate depiction of what is actually going on that I have seen.

Re:Breaking the law

[overlordofmu]

On the other hand, these 22,000 computer were already breaking the law by participating in a criminal enterprise and the BBC made them aware of it.

Analogously, if you leave you gun laying around for anyone to use, is that okay? The sheep says,"Baaaa. Sure I left my loaded shotgun on the front lawn but it isn't my fault a criminal picked it up and shot someone. Baaaa."


This sort of negligence is unbelievably widespread in the world of personal computing and the reporter was simply bringing this problem to the public's consciousness. The reporter entered a gray area but if you are going to prosecute the news people you would also need to prosecute the owners of the 22,000 computers.

This is not like someone someone walking into a home through an open window. This is like someone renting the 22,000 negligently available weapons and making a 22,000 gun salute to bring awareness of other's criminal negligence, I believe the reporter is "more okay" in their actions than are 22,000 people allowing criminals to use their PCs for crime, whether they are aware of the their participation or not.

Re:Breaking the law

[Linker3000]

Only kids with lisps

Re:Breaking the law

[DSmith1974]

If this exercise had been done with criminal intent it would be breaking the law.

Ok, so, I don't know much about the laws, but it is illegal, isn't it?

Well, apparentley not since the intent wasn't criminal. Which kind of makes you wonder why we have to extradite Gareth McKinnon since he was only trying to find out the truth about UFOs.

Re:Breaking the law

[adamchou]

No, its more like having a locked door that only required you to jiggle the lock to open it. The door was closed and locked but easy to open. Its still breaking and entering.

Re:Breaking the law

[odourpreventer]

The police still needs permission from you the property owner (the computer being your property), otherwise it is illegal.

Re:Breaking the law

[Anonymous Coward]

Damn straight it is. Intent has nothing to do with it. The BBC should be treated like any other script kiddy / haxor in a court of law. Unauthorised computer access is an extremely serious crime in the UK. If they are not prosecuted, they'll be used by the defense of every single computer crime case hereafter.

Re:Breaking the law

[Anonymous Coward]

It's a Microsoft virtual server and programming environment for cross-platform applications.

Oh, wait, that's a dotnet.

Re:Breaking the law

[odourpreventer]

> Botnets per se arent illegal

Depends how the program used to hook your computer up to the botnet was installed. If the program was called something like "botnet_node.exe" and the EULA (or similar) clearly states that it's a botnet program, then yes it's legal.

Re:Breaking the law

[idontgno]

It's an electrically charged net that we use to catch runaway robots.

What's a robit?

(transcript)

Re:Breaking the law

[AndrewNeo]

Old wireless cards don't support WPA/WPA2

I do believe that WPA is a software protocol built on top of WEP.. I don't think that hardware actually has to support it. I know Windows XP SP3 added WPA2 support to all my wireless devices, despite only supporting WPA before.

Re:Breaking the law

[mea37]

Perhaps. And yet, the person who takes your rifles is still breaking the law. The drive-by is another, separate instance of that person breaking the law; but even if he just takes them to a shooting range to teach marksmanship to orphans, taking the rifles is still illegal.

Plus, your analogy is flawed. Whether there should be or not, there are no laws requiring that an individual secure his/her PC; but there are laws about safe storage of firearms.

And just to tone down the hyperbole a bit, botnets don't kill people.

Re:Breaking the law

[ciderVisor]

It's more like eating a nectarine and marvelling at how juicy and delicious it is, then realising that it's not a nectarine you're eating but a human head !

Re:Breaking the law

[Sockatume]

Actually English, Scots, and US law do distinguish between performing the same act (actus reus) with different intent (mens rea). It's a common lay misconception that "doing X" is illegal. In fact, traditionally "doing X" with one intent is usually a particular crime, while "doing X" with a different intent is a lesser crime, or not illegal at all. A simple example would be injuring another human being. Firstly, the law distinguishes between a deliberate or accidental act. Further, the law distinguishes deliberate injury with the intent to defend oneself from injury, accidental injury through deliberate negligence of safety standards, etc. etc.

I'm not sure what the mens rea is on cyber-crime in any legal system that uses the concept, mind you. And it seems that legal systems are reworking mens rea into "circumstances" to eliminate the human part of the equation, i.e. in some legal systems if you're in situation X and you do Y, that is always illegal, regardless of intent. It's likely that, given their youth, cyber-crime laws in the UK are worded as such.

Re:Breaking the law

[snarfies]

...thereby violating the "entering" part of "breaking and entering." Which, while I don't know the laws of the UK, I'm reasonably sure is illegal almost everywhere.

Re:Breaking the law

[mea37]

"No, it's more like if your door is already busted wide open and burglars are coming in and out, and a reporter wanders in illegally."

Fixed.

Re:Breaking the law

[M-RES]

Your logic is flawed. To 'allow' someone to do something you MUST know about it. If you have no knowledge of the act being committed then you have neither allowed no disallowed it.

If someone steals a a fence post from your garden without your knowledge and uses it to beat someone else to death, are you liable because you 'allowed' them to steal the weapon? Or are you actually a victim of a separate crime?

Re:Breaking the law

[M-RES]

...neither allowed no disallowed...

no = nor

Re:Breaking the law

[tygerstripes]

NO!!!

Your quote diametrically refutes your posit! It is funded by the public and given a mandate of political neutrality and autonomy by that charter. That charter was issued by the government many years ago and has been essentially sacrosanct since then. The BBC is "owned" by the people, more so than the government is.

Contemporary History, with regards to the BBC, demonstrates that they have managed to maintain that detachment and impartiality - even to the detriment of the ruling government - on many occasions. It's out of keeping with the increasingly totalitarian character of UK government, I know, but somehow the Beeb seems to be just-about maintaining its function. Whether that will continue indefinitely is anybody's guess, but for god's sake, give them credit where it's due for now...

Re:Breaking the law

[vasp]

I don't know where you are from, but is your entire government, and all it's government run programs, puppeteered directly by one man/woman/small group of people? Usually governments in western countries have a set of regulators for every sub-organisiation and run these organisations(like BBC,) as if they were companies, untouched by the head of state. Thereby ensuring that they, the government themself, can not step outside the given set of rules in the country or state.

Re:Breaking the law

[Opportunist]

Yay for car analogies!

The problem here is that you actually take something away and thus take the resource away from its rightful owner, so he cannot use it while you are demonstrating something. If you manage to pull that off while the staffers are all at work and thus don't need their cars, I guess it's pretty much the same deal. I wouldn't mind you using my car to demonstrate how unsafe it is, provided you only take it when I leave the key in with the doors unlocked, you gas it up (so you don't actually use my gas), compensate me for wear and tear (something that's kinda unnecessary for the PC, lacking any wear) and take full responsibility if something happens while you drive it.

AND of course you don't mess with my radio or seat setting!

Still think the analogy is a good one? I haven't seen a good, working car analogy in the PC field yet, but maybe some day, someone will arrive that can actually create one.

Re:Breaking the law

[Anonymous Coward]

They are gaining unauthorized access to someones PC

As it turns out, there was a EULA embedded in the worm granting them said access.

Re:Breaking the law

[Anonymous Coward]

It's a Microsoft virtual server and programming environment for cross-platform applications.

Oh, wait, that's a dotnet.

No, you had it right, a botnet is those things too!

Re:Breaking the law

[debrain]

Regardless of intent it is illegal. They are gaining unauthorized access to someones PC and using it for their own personal gain. If I were to demonstrate how to crack someones WEP key in 5 minutes without the victim's explicit written permission it would be illegal, even if done just for "educational purposes." Sure, it's edgy reporting, but it is still highly illegal.

Why do you say that? These statements have no legal meaning or merit.

I'm not overly familiar with British criminal law, per se, but I am handy in the commonwealth legal principles (having studied law in three commonwealth countries, and being a lawyer in a commonwealth country and New York state), and while anyone would need legal advice specific to their jurisdiction (i.e. none of what I'm saying is legal advice), I can say with reasonable confidence that this act of the BBC would be criminal in only two scenarios:

1. There was mens rea, or the guilty mind, component of a criminal act; or

2. The BBC committed a crime where mens rea is not required (viz. a crime of strict or absolutely liability).

As the guilty mind seems to be lacking on these facts, only crimes of strict liability may be laid against the BBC. As I don't know of any strict liability crime arising from these facts, I surmise that they have not broken one, but I stand to be corrected.

It may be a civil wrong that is a species of trespass, or that violates some statute specific to computers and/or the internet, but in the absence of provable damages by someone affected (i.e. the botnet computer owners or the DoS'd computer), there is no cause of action that would give rise to a lawsuit. The botnet owners don't know they are on a botnet, so their damages are negligible -- if anything I would argue they benefit from being taken over by the BBC as opposed to someone with actual malicious intent. The DoS'd machine is presumably one owned by the BBC.

Even if found to be guilty of civil or criminal wrongdoing, the BBC may have a complete defence because their act was taken as part of a protected form of investigative journalism or alternatively because they are acting as a good Samaritan in the public interest. They seem to be acting with the interest of exposing to the public and documenting a very important situation on the internet. Their investigative journalism is good for the public and the owners of the botnet who may thus become aware of their participation in this grand malicious scheme. In addition to these defences, it would be bad public policy to stifle such valuable investigative journalism.

In any case I'm confident that the lawyers for the BBC have given this due consideration. That a large, sophisticated corporation actually did this for the purpose of publication, and then did publish it, strongly suggests that it is not illegal.

In the United States your mileage may vary (i.e. taking control of a botnet even with good intentions may be illegal). There are a large number of laws that are driven by commercial interest groups, which laws give rise to "criminality" in spite of the public's interests to the contrary. Thankfully most of the world, including the BBC, isn't generally subject to these laws.

Please don't mislead people with sensationalistic statements like "highly illegal", without at least providing some modicum of support for these otherwise bald assertions. What criminal law do you think the BBC broke? Your post appears wholly incorrect, unsupported and misleading. It distracts from the real issues at hand, wastes readers' time, and is disrespectful to those who value facts and truth. Please consider taking the time to research your assertions before posting to a public forum like this. Thank you.

Re:Breaking the law

[tygerstripes]

Yes, this is illegal. There was an embarrassing attempt to cover their asses with the following:

If this exercise had been done with criminal intent it would be breaking the law.

There's no question of mens rea - they knew exactly what they were doing, whether or not they thought it was a crime - while actus reus is satisfied if they undertook the crime. The crime in this case was gaining unauthorised access to personal computers. "Criminal intent" doesn't come into it - they deliberately did something which is a criminal act.

However, they won't get prosecuted. This has nothing to do with "ties to the guv'mint", and everything to do with journalistic licence. They exposed criminal activity without effecting any damage to property or reputation, and in doing so helped to inform and protect not only the several thousand people directly involved, but a whole nation of news-reading, tech-ignoring proles.

This is exactly what investigative journalism is about. While technically they broke the law, there is a fine history of decades of case-law precedent where journalists went undercover and got involved in criminal practices purely in an effort to expose and prevent it in future.

There's no way in hell the CPS (the body responsible for prosecuting criminal cases) would touch this. Flimsy though it may be, journalistic integrity is afforded impressive leniency in British culture and law, provided it is seen to be of public benefit.

Re:Breaking the law

[LingNoi]

You're assuming that the BBC didn't break into the machines themselves which is most likely what happened.

They most likely started with one machine running a program to break into others so your analogy doesn't fit at all.

Notice I say most likely because none of us know due to the article and video lacking any detail on how they collected the machines. Either way the police should look into it and determine if a crime has been committed, that is after all their job.

Re:Breaking the law

[LingNoi]

If they did then the police is guilty of assisting a crime.

Re:Breaking the law

[commodore64_love]

>>>BBC is funded by the public and given a mandate of political neutrality and autonomy

If I don't pay my TV license/tax, who comes to arrest me? The government officials? Than it is not accurate to say the BBC is autonomous from the government.

Re:Breaking the law

[commodore64_love]

>>>I'd say it's more like you leaving your hunting rifles lying around on the front lawn and someone took them and used them for a drive-by.

My rifles might be on the front lawn, but my computer is inside my house. Even if I left the front door open, it's still trespassing to enter my home without my permission, whether it was done corporeally or virtually.

Re:Breaking the law

[billcopc]

"Well, your honor, I didn't intend to take down all my competitors' sites. I was performing journalistic research, honest!"

It's great that the BBC is trying to bring attention to this idiotic problem, but they failed to acknowledge one critical factor: people are stupid when sitting at a computer. Average IQ is not enough to be "safe" on the internet, and it will never be, because the people setting up these attacks are above-average, and many of them have started using machine-learning tools to refine their techniques and pinpoint their targets.

As long as there will be non-techy people on the internet, there will be a struggle of power between the blackhat geeks and the norms, and it is a very one-sided fight.

Re:Breaking the law

[Nick Ives]

No, WPA is a protocol that can be used instead of WEP. On PCs the encryption is generally handled by the CPU although no doubt there is WiFi hardware that can handle it onboard. The main problem with WPA{,2} adoption is old embedded devices (e.g. WiFi routers) that don't have the CPU power required for WPA. Certain devices like the Nintendo DS don't support WPA for the same reason although thankfully that's changing with the new DSi (although only for new DSi aware games).

Re:Breaking the law

[Anonymous Coward]

> I'd say it's more like you leaving your hunting rifles lying around on the front lawn...

which is an obvious insecure act. What about PCs? How much public is aware of what patches are? Buffer overflows? What about the biggest OS maker touting their product as secure for a couple decades when they are worse performing than free alternatives?

Re:Breaking the law

[Nick Ives]

But in the example given no breaking occurred, the GP just posited a reporter walking through an open door which would be trespass.

It's not clear from TFA whether the BBC paid for the botnet or not. They may have just used their security experts' knowledge to break into the C&C channel of a small botnet.

Re:Breaking the law

[tygerstripes]

Almost.

Mens Rea is almost always about your level of intent, not what you intended to do. This is important for things such as assault or murder, where intent can range from "I meant to kill him" to "I just wanted to stop him hitting me" to "I didn't know he was standing there". As such, the mens rea will affect the nature of the crime.

However, in most cases it is merely a case of "Did you intend to do it?" In the case of burglary, for example, the only way you could argue the mens rea would be either by pleading insanity (didn't know you were doing it) or demonstrating that you thought you had the right to enter the place you entered and take what you took. You're pleading that you were not knowingly guilty of doing what you did. For the majority of crimes you can't be excused by claiming that you did it with good reason; though that may mitigate your sentencing, it won't mitigate the conviction.

Since the crime in this case was illegal access of someone's personal computer, the crime was knowingly undertaken irrespective of what the ultimate intention was. However, as I've said in a later post, I don't think this particular case will even see the courts; nor do I think it should.

Re:Breaking the law

[orielbean]

Most people don't understand the technical nuances of all those analogous concepts you just explained. I can see when a window is open or someone left trash on the floor. If I don't understand what a tracking cookie, port, or rootkit is - or even have a simple way to view those exposures, then I would have no idea something is amiss, unless my machine or connection runs very slow / crashes. Or notice if we were billed for excessive internet usage, vs the mostly-open connections we use today.

Re:Breaking the law

[kabocox]

Regardless of intent it is illegal. They are gaining unauthorized access to someones PC and using it for their own personal gain. If I were to demonstrate how to crack someones WEP key in 5 minutes without the victim's explicit written permission it would be illegal, even if done just for "educational purposes." Sure, it's edgy reporting, but it is still highly illegal.

I doubt anything will come of it though.

I would love for tomorrow's headline to be X at BBC arrested for computer trespass or whatever the appropriate crime is. I'd want the reporter, the guys that did it, and the show's producer all arrested. This is like a kid going down the street and throwing rocks in every window and saying what he did wasn't criminal because he didn't intend wrong. Well, if you are get caught you go to jail regardless of what you think this looks, sounds and smells illegal.

Re:Breaking the law

[unlametheweak]

Your quote diametrically refutes your posit! It is funded by the public and given a mandate of political neutrality and autonomy by that charter.

Perhaps. But you sound like a civil servant (trying to explain that you are not a servant). I'm not convinced. If it looks like a British government institution, sounds like a British government institution, then it might just be a British government institution. The House of Lords should bring this matter up for debate.

Re:Breaking the law

[tygerstripes]

1. Nobody comes to arrest you. Why the hell would the police get involved? You'll get increasingly strongly-worded letters and then, eventually, a court summons.

2. What if you don't pay your gas/credit-card/porn-subscription bill? Same story. Does that mean NPower/Barclays/shemaleswithdiseasedsheep.com is affiliated with the government?

3. I said they were autonomous, not completely independent and uninvolved. This means they can follow that charter in whatever way they see fit.

Know what? I'm tired of discussing this point. The Beeb's history and reputation speaks for itself. If you have a serious point then please make it, and then show me a more effective alternative. Insofar as it's possible, the Beeb is as I've described.

Re:Breaking the law

[jgostling]

And just to tone down the hyperbole a bit, botnets don't kill people.

Except when used against hospitals, fire departments, traffic control systems. I could go on with situations where disrupting computer systems could end up costing lives, but you get the idea.

Re:Breaking the law

[tygerstripes]

Agreed. Less trolling in the HoL... Well, marginally.

Re:Breaking the law

[Opportunist]

And that's exactly what's wrong here. When people drove like they use PCs (yay for car analogies!), roads would be known as the primary reason for deaths in developed countries. People wouldn't worry about trans fats or lung cancer anymore, they would be somewhere in the single digits because 99% of all deaths would be related to car accidents.

People have to be held responsible for what their machines do. I could accept that, if you employ "reasonable caution" (to be defined), you won't be held responsible if your machine is part of a DDoS. If your machine is sluggish, displays all kinds of popup spam even if you don't do jack, if you have more traffic than Google and you STILL don't do anything about it, it's at very least grossly negligant.

Yes, I would demand that people are held responsible if their machines are part of the problem. Either get your machine locked down or, if you're too lazy, clueless or simply stupid to do it, hire someone who can do that. Yes, that costs money or time to get a clue. No, being on the internet is no god-given right.

I got karma to burn. Mod as you please.

Re:Breaking the law

[Locke2005]

So they could argue intent as extenuating circumstances and it is a lesser crime... but it is still a crime. That being said, you're correct -- it ain't illegal unless a prosecutor decides to prosecute it, which in this case would serve no useful purpose.

Re:Breaking the law

[Anonymous Coward]

As I don't know of any strict liability crime arising from these facts, I surmise that they have not broken one, but I stand to be corrected.

Read the Computer Misuse Act. Also the reason why Sony's rootkit was criminal.

Re:Breaking the law

[Anonymous Coward]

Like raping an ugly woman?

Re:Breaking the law

[pmarini]

does it mean that anyone directly working for a company remotely linked to the government can get away with any crime ? cool ! (this is a joke, right ?)

Re:Breaking the law

[mea37]

You could.

But can you document an actual, non-hypothetical case where a botnet has cost a life?

I can document a case where a gun has cost a life.

Re:Breaking the law

[greg_barton]

As long as they don't trash the place, most people don't care that someone is standing there, coming and going as they please...

But they would care if someone came in, stood at the window, and shot folks walking down the street, using their house as cover. That's basically what a DDoS attack does.

Re:Breaking the law

[mcgrew]

No, the EtherBunny has nothing to do with Christianity. It comes from ancient European Pagan religions which all have festivals in the Spring at the same time as Easter. Christians just kind of stole the rabbit from the Pagans.

Re:Breaking the law

[Anonymous Coward]

When you outlaw botnets only outlaws will have botnets.

Re:Breaking the law

[AGMW]

LOL! OK, so from next year the BBC will start building its own army of Private Police. All news readers and reporters will carry side arms. Heavier ordnance will be available from the OB camera crews (actually, that's probably true now, as they are often a special kinda mental to voluntier for war zones and the like!).

Traffic reports will be more "predictive" and heaven help you if you don't cause a jam on the A432 when they say there's going to be one!

Also, watching anything other than The BBC will, henceforth, be VERBOTEN!

Re:Breaking the law

[Bob-taro]

Ok, so, I don't know much about the laws, but it is illegal, isn't it?

I have no idea whether it's legal, but here's one concern I have: Did they write the virus themselves or did they just download it? If they just downloaded it, how can they be sure they know exactly what it's doing?

Re:Breaking the law

[pbhj]

I'm sure intent is not in this law, how do you prove intent? The law will make actions illegal as actions are easier to judge - did they do it? Yes.

Re:Breaking the law

[debrain]

Interesting cite; thank you. I've only glanced at it, and I do not believe it contains any offences which the BBC has committed-- though I stand to be corrected. I don't know where the case law in Britain may have taken the interpretation of this statute.

The relevant offences are reproduced below for discussion:

Computer misuse offences
1 Unauthorised access to computer material
(1) A person is guilty of an offence if
(a) he causes a computer to perform any function with intent to secure access to any program or data held in any computer;
(b) the access he intends to secure is unauthorised; and
(c) he knows at the time when he causes the computer to perform the function that that is the case.

(2) The intent a person has to have to commit an offence under this section need not be directed at
(a) any particular program or data;
(b) a program or data of any particular kind; or
(c) a program or data held in any particular computer.

(3) A person guilty of an offence under this section shall be liable on summary conviction to imprisonment for a term not exceeding six months or to a fine not exceeding level 5 on the standard scale or to both.

2 Unauthorised access with intent to commit or facilitate commission of further offences
(1) A person is guilty of an offence under this section if he commits an offence under section 1 above (the unauthorised access offence) with intent
(a) to commit an offence to which this section applies; or
(b) to facilitate the commission of such an offence (whether by himself or by any other person);
and the offence he intends to commit or facilitate is referred to below in this section as the further offence.

(2) This section applies to offences
(a) for which the sentence is fixed by law; or
(b) for which a person of twenty-one years of age or over (not previously convicted) may be sentenced to imprisonment for a term of five years (or, in England and Wales, might be so sentenced but for the restrictions imposed by section 33 of the [1980 c. 43.] Magistrates' Courts Act 1980).

(3) It is immaterial for the purposes of this section whether the further offence is to be committed on the same occasion as the unauthorised access offence or on any future occasion.

(4) A person may be guilty of an offence under this section even though the facts are such that the commission of the further offence is impossible.

(5) A person guilty of an offence under this section shall be liable
(a) on summary conviction, to imprisonment for a term not exceeding six months or to a fine not exceeding the statutory maximum or to both; and
(b) on conviction on indictment, to imprisonment for a term not exceeding five years or to a fine or to both.

3 Unauthorised modification of computer material
(1) A person is guilty of an offence if
(a) he does any act which causes an unauthorised modification of the contents of any computer; and
(b) at the time when he does the act he has the requisite intent and the requisite knowledge.

(2) For the purposes of subsection (1)(b) above the requisite intent is an intent to cause a modification of the contents of any computer and by so doing
(a) to impair the operation of any computer;
(b) to prevent or hinder access to any program or data held in any computer; or
(c) to impair the operation of any such program or the reliability of any such data.

(3) The intent need not be directed at
(a) any particular computer;
(b) any particular program or data or a program or data of any particular kind; or
(c) any particular modification o

Re:Breaking the law

[Opportunist]

They would certainly care if ANYTHING of this happened in real life. They would already cry bloody murder if someone came to their house and simply stood there.

They don't do ANYTHING at all when it happens to their PC. That's what the analogy is about. As long as the intruder (virus) does not trash their furniture (deletes files), they don't care that he's there.

Re:Breaking the law

[fm6]

What, a slashdotter who admits he's not a legal expert? That's rarer than a convict who admits that he got a fair trial!

I don't pretend to know any more than you (hey, that's two of us! anybody else?) but I do know that many hackers have been convicted despite claiming lack of criminal intent. The poster boy for this crowd has to be Randal Schwartz, who got probation and $200K in fines and legal bills after penetrating security at Intel in an attempt to show that people were using weak passwords. I think he maybe sealed his own case by trying to justify his actions to an investigator, thus supplying the prosecution with what amounted to a full confession.

Yeah, I know, stupid of Intel and law enforcement to come down so hard on somebody for a non-malicious penetration. But just as stupid is the common geek habit of equating good intentions with legality.

The law in the UK might be different, but I'd be surprised if it were weaker than U.S. law. The BBC is probably safe though, since none of the owners of the PCs they "trespassed" on have the clout of Intel.

Re:Breaking the law

[commodore64_love]

>>>eventually, a court summons.

And what happens if I ignore it? What power does the BBC have to force me to pay a television license? You mentioned credit cards, but they don't have the power to force me to pay some arbitrary fee on a device (like my chair, for example). Where does the BBC's power to tax TVs and internet-connected PCs come from? (just curious)

.

>>>The Beeb's history and reputation speaks for itself

http://biasedbbc.proboards45.com/index.cgi?board=Rant - "Examples of Bias" - Please note I am neither agreeing nor disagreeing with the website, because I don't watch the BBC (therefore have no opinion). I merely provide it as an example of how many people think the Beeb's reputation is tainted - contrary to your own belief.

Re:Breaking the law

[commodore64_love]

Yes. We called him "Bush".

Prior to that the most egregious president, who tried to "puppeteer" everything, was FDR. He even went so far as to threaten the Supreme Court with "packing" in order to get his way.

Re:Breaking the law

[Chris Burke]

You forgot to mention that the Ether Bunny isn't real, and it's really the kids' parents who sneak into their rooms and anesthetize them at night, Mr. Spoil Sport.

Re:Breaking the law

[bbasgen]

Even if found to be guilty of civil or criminal wrongdoing, the BBC may have a complete defence because their act was taken as part of a protected form of investigative journalism or alternatively because they are acting as a good Samaritan in the public interest. They seem to be acting with the interest of exposing to the public and documenting a very important situation on the internet

Is this also true for security researchers who publicly expose vulnerabilities? I realize it is a different situation, but there seem to be some analogues. What about hacking into someone's system only in order to inform them of the method of the hack?

Re:Breaking the law

[Cederic]

It serves a very useful purpose: It stops the media thinking that hacking computers can be done legally "in the public interest".

Or do you want Sun reporters remotely hacking your computer to see if they can dig up some dirt on you?

Re:Breaking the law

[Cederic]

I read somewhere (check Google News for source, I can't be arsed) that they paid between £5-6k for the botnet.

A fine use of my fucking tv licence. Time to ring Crimestoppers.

Re:Breaking the law

[Chris Burke]

Is that from that movie where Bruce Willis doesn't realize that he's a zombie?

Re:Breaking the law

[Anonymous Coward]

If this exercise had been done with criminal intent it would be breaking the law.

Ok, so, I don't know much about the laws, but it is illegal, isn't it?

That really depends. Also, just because something is illegal does not make it wrong for everybody to do.

For example:
In the state I live in, (in the US) we have a drinking limit of 21 years. The cops will get "volunteers" usually kids just out of high school that got into some kind of minor trouble, who are 18 or 19 to go into bars & try to buy booze.
Technically, it is not illegal for them to try buying booze as long as they don't pretend to be 21 or older, use fake ID's, etc. and as long as they don't actually possess the booze at any point (possession does break the law). However, in order for the business transaction to be complete (and thus yield a fine to the bar) the product has to "change hands" i.e. become in the "minor's" possession.
When asked how this is not illegal for the buyer, the cops simply respond that it is up to the city attorney to decide which cases to prosecute, and they offer the buyer immunity from prosecution in return for testimony against the bar.

In many states/countries the press are afforded similar consideration.
For example, if there is a mob looting & rioting, and you are with the mob but just watching, not actually participating, you can still be prosecuted along with the rest of the mob. If, however, you have a fancy camera & work for a Press organization (or can prove you do freelance work) chances are pretty good that you either will be excused, or might even be legally protected.

So what this comes down to are the specific laws that govern the BBC. Not only are they press, they have government affiliation. This might cross the line of "responsible" reporting, and it might still be excused by the courts.

On the other hand, I'd much rather see news outlets actually doing investigative journalism, as opposed to most American media outlets who simply bring an "expert" with dubious qualifications on the air to blow a bunch of B.S. up their viewers' asses, getting them all wound up, just so their ratings go up. (I'm looking at you, Fox News)

Re:Breaking the law

[slyrat]

Only kids with lisps

Ah so the Etherbunny only anesthetizes kids that use lots of parenthesis in programming. Makes perfect sense.

Re:Breaking the law

[mcgrew]

Sure he's real, as is the tooth fairy and Santa Claus. My kids knew who they were.

They were me.

Re:Breaking the law

[pbhj]

The Beeb's history and reputation speaks for itself.

Is that the lying to the public, defamation of The Crown, the financial fraud, the overspending on celebrity friends, the use of self owned production companies to fleece the population, the claim to offer alternative viewing and then badly copying the worst of commercial TV ... or something else, maybe the illegal access and use of peoples computers and support of known criminals with license money?

The Beeb had a reputation and has a great history.

Re:Breaking the law

[pbhj]

I don't think this particular case will even see the courts; nor do I think it should.

Why? Because the law should be different for rich media nobs?

Re:Breaking the law

[Nick Ives]

They could've paid me that and I'd have pretended to be a botnet! I could've sent a few thousand spams in a few hours!

Re:Breaking the law

[legirons]

You'll get increasingly strongly-worded letters and then, eventually, a court summons.

What rate of change of word-strength were you seeing? Last I checked, their very first letter was "we will prosecute you and you will be fined GBP1000" in 106-point #FF0000 Impact Bold, and the subsequent letters haven't offered anything more original than repetitions of that.

Re:Breaking the law

[pbhj]

Section 1 of the computer misuse act merely requires you to access a computer without authorisation. They did, 22000 times, hence they are culpable.

Intending to send an email 1(1)(a), without the computer owner knowing 1(1)(b), knowing that one is not authorised 1(1)(c). 3 strikes, go straight to jail, do not pass go.

Care to revise your claim that the parent appears wholly incorrect? I'd say they were spot on. Notice that SS2 (ibid) speaks to intent and gives no disclaimer for those with beneficent ends.

You may like to peruse SS2 and 3; there's a good chance that they're in breach of those also. For example, they used the botnet to DDoS a computer (their own, but nonetheless a computer, SS3(2)(a) doesn't mention ownership).

Nope IANAL but nor am I a stranger to reading and interpreting statute.

---
Computer Misuse Act 1990

http://www.statutelaw.gov.uk/content.aspx?LegType=All+Legislation&title=computer+misuse+act&searchEnacted=0&extentMatchOnly=0&confersPower=0&blanketAmendment=0&sortAlpha=0&TYPE=QS&PageNumber=1&NavFrom=0&parentActiveTextDocId=1353366&ActiveTextDocId=1353370&filesize=1958

SS 1. Unauthorised access to computer material.
- (1) A person is guilty of an offence if -
(a) he causes a computer to perform any function with intent to secure access to any program or data held in any computer;
(b) the access he intends to secure is unauthorised; and
(c) he knows at the time when he causes the computer to perform the function that that is the case.

- (2) The intent a person has to have to commit an offence under this section need not be directed atâ"
(a) any particular program or data;
(b) a program or data of any particular kind; or
(c) a program or data held in any particular computer.

-(3) A person guilty of an offence under this section shall be liable on summary conviction to imprisonment for a term not exceeding six months or to a fine not exceeding level 5 on the standard scale or to both.
---

Re:Breaking the law

[siriuskase]

it's not a tolken ring, that's used to catch hobbits

Re:Breaking the law

[mattpalmer1086]

It is clear, to me at least, that the BBC has committed an offence under section 1(1) of the Computer Misuse Act (unauthorised access), and probably under section 3 as well (unauthorised modification).

Note: I am not a lawyer, but I have studied the CMA during an Information Security Masters degree. I would be very interested to hear why you do *not* think they have committed any offence.

Re:Breaking the law

[Draek]

No, this is like after you go shopping, a neighbor passes by your door and sees you left your keys on the door, picks them up, uses them to enter your house, leaves the key on the table along with a note stating what happened, and left.

That actually happened to my mom once, and first thing she did when she got back home was to go give her thanks to the neighbor, *not* to sue her for trespassing.

Re:Breaking the law

[Savione]

No, it's more like making an analogy that doesn't make any sense, then realizing that it's hilarious anyway !

Hilarious!

Re:Breaking the law

[Anonymous Coward]

this is the ether bunny:

bunny-o-ynnub

Re:Breaking the law

[nametaken]

Please don't feed the trolls.

Re:Breaking the law

[nametaken]

omg.

Re:Breaking the law

[nametaken]

Aw shit, that guy was from the BBC? I guess I should have offered him tea or something.

Re:Breaking the law

[Stuart Gibson]

I thought that they might fall under Section 3 as well, but you need to consider if in doing so the intent was:
(a) to impair the operation of any computer;
(b) to prevent or hinder access to any program or data held in any computer;
or
(c) to impair the operation of any such program or the reliability of any such data.

I suppose you could argue that changing a desktop wallpaper hindered access to the data of whatever your original wallpaper was?

Re:Breaking the law

[FatLittleMonkey]

I thought that they might fall under Section 3 as well, but you need to consider if in doing so the intent was: (a) to impair the operation of any computer; (b) to prevent or hinder access to any program or data held in any computer;

Remember, they not only accessed nearly 22000 computers without permission of the owners, they removed the botnet software. They "impaired", without permission, software operating on another computer, repeated 22000 times.

Oh, I know it's a retarded interpretation. But the 2006 P&J Act contains no "reasonable person" cop-outs. (s36.3.2(b)) "Intent" means "intended to access without authorisation", not "intended to use access for other crimes". It is incorrect to argue, as TFA does, "If this exercise had been done with criminal intent it would be breaking the law," the access was the crime, so too, bizarrely, the removal of botware; acts which they intended.

To Debrain: The point other posters are trying to make is that these illegal-access laws are not being interpreted to allow for good-intent (ie, exposing security flaws), they are being interpreted harshly against individuals, even academics, while softly/not-at-all for companies/organisations. If you did what they did, with exactly the same intent, and were caught, you would likely be punished.

(Usual IANAL crap)

Re:Breaking the law

[Anonymous Coward]

Yes, the intent section was why I only said probably.

Re:Breaking the law

[Anonymous Coward]

I'm not overly familiar with British criminal law

And this is where your problem lies. They have clearly broken the Computer Misuse Act which simply states that it's illegal to gain unauthorised access to a computer. Intent is irrelevant. Maximum sentence is two years in prison. How they accessed the machines is not stated in the article but if any machine I own is affected, I'll press charges.

Re:Breaking the law

[debrain]

Thanks for posting the reference. Now that we have a statute (which I'm confident the GP did not have awareness of), we can get into statutory interpretation, which again goes against certitude. Just a few notes, that I think defence counsel could use to run with this:

First, a purposive perspective. Looking at SS 1. (1): the title is "Unauthorized access to computer material", the key being "material". It implies that the legislature was attempting to stop access to material - data - information. No material (data or information) disclosure was the intent, subject or result of the BBC's actions.

Second, ambiguities in interpretation are typically interpreted against the drafter. Ambiguous or undefined terms include "access", "material", "unauthorized" in this statute-- bear this in mind below.

Third, the statute should be interpreted as a whole. The titles of SS 1, 2, and 3 are:
1 Unauthorised access to computer material
2 Unauthorised access with intent to commit or facilitate commission of further offences
3 Unauthorised modification of computer material
I'd say what you are looking at is an attempt by the legislature to prevent access to private information, to increase culpability for concurrent offences, and prevent modification to private material. This constitutes the essence of the statute, and I'd argue that it's purpose derives from these three titles, and that the BBC has not done anything that is contrary to the purpose of the statute (which mostly flavours the rest of the argument, but can be persuasive in an appellate court)

Fourth, there are the defences I posed (journalistic defences, good Samaritan, public policy).

Fifth, reading "SS 1 (1): (a) he causes a computer to perform any function with intent to secure access to any program or data held in any computer;" -- the botnets already had access to these computers, therefore the BBC did not perform a function with intent to secure access -- they bought access that someone else had already secured.

Sixth, who is to say these botnet computer owners did not willingly participate in the botnet? At some point the owner either intentionally or unintentionally installed botnet software.

Seventh, did the BBC meet the "SS 1 (1) (b) the access he intends to secure is unauthorised;" test. Namely: was it truly unauthorized access if it is not known if the botnet computers were or were not willingly put on the botnet? Alternatively, by being on a botnet is the BBC not implicitly authorizing access? Didn't the BBC have technical authorization to access the botnet? What is "unauthorized"? Who decides that? Go back - ambiguities are resolved against the drafter of the criminal code in most commonwealth countries.

Eighth, the statute does not appear to have the purpose of preventing access to "extra" functions. Your browser changes things in your cache as you browser, it shares private cookies on the internet without your permission, MS Windows performs all sorts of unknown and "unauthorized" things such as automatic updates. Where does one draw the line between those extraneous actions of software on your computer that are essentially harmless, and the malicious invasion of an individual computer's autonomy? I'd say that line is, and was intended to be by the legislature, where private material is accessed in a way that benefits an accused to the detriment of the affected, and that this distinction.

Ninth, this case probably doesn't meet the de minimus test for harm from a criminal act to justify prosecution (the counter-argument to this is that the BBC has created a bad precedent, opened a floodgate-- counter-counter argument: have they?).

Finally, this is quasi-criminal therefore all of the facts giving rise to criminal act, including the requisite intent at the time, must likely be proven beyond a reasonable doubt.

I'm not suggesting that people can go out and acquire botnets even for what

Re:Breaking the law

[debrain]

See: this post.

Re:Breaking the law

[mattpalmer1086]

Taking some of your points in turn:

First: the CMA is very careful to mention both programs and data in each major section. You cannot assume that the act is only meant to prevent access to private data.

Second: I am not qualified to comment.

Third: Each major section consitutes a separate offence. Again, you cannot assume that access to programs don't count because you happen to interpret the wider goal of the Act to prevent access to private data. The Act says what it says, regardless of the wider intention you read into it.

Fourth: there may be good defences - not qualified to comment.

Fifth: The BBC caused the computer to perform a function without the authorisation of the owner. It is irrelevant that the owner did not create the means for them to do this, or may have been unaware of its existence. This is not a defence.

Sixth: If you publish a service for consumption by others, then it is reasonable for others to consume it, and accessing this service would not be an offence. However, it seems highly unlikely that most of the computers fall into this category.

Seventh: the BBC cannot authorise access to someone else's computer, regardless of whether they are on the botnet themselves. The basic test of authorisation is that if they do not *know* whether they have authorisation to access a given computer, then attempting access is unauthorised. Absence of knowledge does not give you a free pass to attempt access! In other words, it is not a defence to claim you didn't know whether you had authorisation or not, so therefore you assumed you had it! If you don't know - ask.

Eighth: it is not clear what you mean here. You seem to be talking about things your computer does under your control with your authorisation. The Act is focussing on access to other people's machines, not your own. Changes that occur to either your own or other machines due to authorised access are immaterial.

Again, you focus on your interpretation of what you think the Act is trying to achieve (protection of private data), which is immaterial - you need to focus on what the Act says (unauthorised access to programs and data is illegal).

There is no need for criminal intent to commit an offence under CMA section 1. Finally, have a read of section 17 (Interpretation):

17 Interpretation
(1) The following provisions of this section apply for the interpretation of this Act.
(2) A person secures access to any program or data held in a computer if by causing a computer to perform any function he--
(a) alters or erases the program or data;
(b) copies or moves it to any storage medium other than that in which it is held or to a different location in the storage medium in which it is held;
(c) uses it; or
(d) has it output from the computer in which it is held (whether by having it displayed or in any other manner);
and references to access to a program or data (and to an intent to secure such access) shall be read accordingly.

Re:Breaking the law

[debrain]

Interesting points - thanks for following up.

First: the CMA is very careful to mention both programs and data in each major section. You cannot assume that the act is only meant to prevent access to private data.

It is not an assumption, but an interpretation of the provisions of the statute based on the language provided in the header to CMA section 1.

Third: Each major section consitutes a separate offence. Again, you cannot assume that access to programs don't count because you happen to interpret the wider goal of the Act to prevent access to private data. The Act says what it says, regardless of the wider intention you read into it.

You are arguing for what is known as strict interpretation, an archaic and essentially dead method of statutory interpretation. It is not how statutes are interpreted in the modern common law. The modern approach is called "liberal interpretaton" or "purposive interpretation". In England, this principle of statutory interpretation is set out by the House of Lords in Pepper v Hart (1993).

As a general rule, the purpose or perceived intent of the legislature is the law derived from statute. Thus the strict language of the act is relevant, but that is not the end of the story when presenting your argument to a Court (or rendering a decision as a Judge).

Fifth: The BBC caused the computer to perform a function without the authorisation of the owner. It is irrelevant that the owner did not create the means for them to do this, or may have been unaware of its existence. This is not a defence.

Well, go back to your language-is-important argument. The language of CMA 1 is "he causes a computer to perform any function with intent to secure access to any program or data held in any computer"

The access was already secured by a function that predated the BBC's actions- when the botnet took over the computer. That is not what the CMA finds to be an offence under section 1 (which I'm focusing on for expediency). If the BBC installed the botnet, that'd be different. However the botnet was pre-existing.

How did the BBC cause a computer to perform a function to secure access to a program or data to which they were not authorized? A prosecutor must show every element of that question satisfied beyond a reasonable doubt. I'm not confident they could.

Further, the prosecutor would likely have to bring forward victim statements. I can imagine the interviews: "So, I understand you own a computer ... it had a virus ... the BBC took over your computer as part of an investigation and then removed the virus from your computer. How has this affected you?" This practical consideration goes to de minimus - who is the victim and what harm does this punitive legislation seek to prevent?

Sixth: If you publish a service for consumption by others, then it is reasonable for others to consume it, and accessing this service would not be an offence. However, it seems highly unlikely that most of the computers fall into this category.

This goes to complicity and unawareness by owners, an easement around their proprietary interest in their computer, and hence the ability of a prosecutor to successfully argue that the access was indeed unauthorized if it is not dominion over which an owner actually exercised exclusive control (i.e. 1. this wasn't part of the owners' computer for all intents and purposes; and 2. owners didn't have the ability to grant authorization).

Seventh: the BBC cannot authorise access to someone else's computer, regardless of whether they are on the botnet themselves. The basic test of authorisation is that if they do not *know* whether they have authorisation to access a given computer, then attempting access is unauthorised. Absence of knowledge does not give you a free pass to attempt access

Re:Breaking the law

[pbhj]

I'm not going to go into all the problems I see with your assertions, but doesn't Pepper vs Hart merely talk to using the legislative background where the clarity of the statute is lacking. There is no lack of clarity in the CMA unless you attempt to give the words other than everyday meanings (outside of /noscitur a sociis/).

The legislative background, I'd argue, ispreventing unauthorised access to computers, which is exactly what the act speaks to.

You've attempted to apply a narrow or technical interpretation of "authorised" it simply means here did they ask the people who owned the computers if they could use them in the manner in which they were used. Having access to botted computers doesn't make you authorised anymore than having access to lock picks makes you authorised to enter any locked door you choose.

[Debrain:] Well, go back to your language-is-important argument. The language of CMA 1 is "he causes a computer to perform any function with intent to secure access to any program or data held in any computer"

"he causes a computer to secure access to any program [...]in any computer"

They sent email, they have to "secure access" to a sendmail-type program to do that, there's no doubt they contravened this part of the statute if they've reported honestly what they did (and the video of the messages appearing in the hotmail account appears to support that).

If the BBC has a password to a botnet, then there is a prima facie argument that they were authorized. The statute does not say that the authorization need come from an owner.

Excuse me, you don't really think that's the everyday interpretation (literal) of "authorise"? Who else, in your opinion, has the right (other than a court with a warrant) to authorise your access to my property?

You're not presenting a coherent defence IMO.

Re:Breaking the law

[Haeleth]

If it looks like a British government institution, sounds like a British government institution, then it might just be a British government institution.

But the BBC doesn't, so there's no reason to suppose it is.

Seriously, you think the British government would fund Panorama if it had any choice in the matter?

Re:Breaking the law

[debrain]

Thanks for weighing in.

I'm not going to go into all the problems I see with your assertions, but doesn't Pepper vs Hart merely talk to using the legislative background where the clarity of the statute is lacking. There is no lack of clarity in the CMA unless you attempt to give the words other than everyday meanings (outside of /noscitur a sociis/).

I interpret Pepper to stand for the proposition that where the legislation is ambiguous (1) the legislation can be interpreted within the context in which it arose (i.e. by turning to Hansard's transcripts, etc.); and (2) with a view to the purpose of the legislation. This is a typical statement of some of the tools used to resolve ambiguities in purposive/liberal interpretation.

I think there is obvious want for clarity in the CMA.

Good reference to noscitur a sociis.

You've attempted to apply a narrow or technical interpretation of "authorised" it simply means here did they ask the people who owned the computers if they could use them in the manner in which they were used. Having access to botted computers doesn't make you authorised anymore than having access to lock picks makes you authorised to enter any locked door you choose.

The word "unauthorised" is not defined in the statute, as you assert. Foremost, "authorization" is not the same as "permission from someone with proprietary interest". For example, authorization can come from having a password; permission does not. If the legislature had meant permission, they would have said permission (principle of legislative competence). The legislature said authorization, which is in its plain and ordinary meaning includes at least two definitions: 1. Granting of permission; 2. Having access rights (viz. able to authenticate, e.g. username & password). In this case, the latter is preferable for a few reasons, namely:
(i) it's a statute about computers and the common use of the language "authorize" with computers is the latter;
(ii) the statute does not talk about *who* can/should/must authorize; it doesn't mention ownership, property, proprietary interests whatsoever, which leads to absurdities (violation of the golden rule);
(iii) the ambiguity is to be interpreted in favour of the accused (generally, and probably in this case because it is a punitive law).

Excuse me, you don't really think that's the everyday interpretation (literal) of "authorise"? Who else, in your opinion, has the right (other than a court with a warrant) to authorise your access to my property?

As mentioned, what does an exclusive proprietary interest have to do with this statute? That's certainly relevant to tort, and criminal trespass. I don't see how it applies to this statute except to perhaps indicate who may be able to "authorize" access, provided that the definition of authorize is "an owner having given permission" and not the more concise "having access credentials".

I do think you have hit a useful counter-argument to the defence of the narrow interpretation of "authorize", and I think a prosecutor would raise it. It boils down to something like: Is this a statute that bases liability on the definition of authorization as doing something without logging in? If not, then what is the definition of authorize? Who authorizes? Some examples may illuminate- which of these is unauthorized:

- An unknown person portscans your computer.

An owner turns on a web-server on a personal computer. It provides no warning that the public are not authorized to use it.
- It is accessed by someone on the internet accidentally, but they continue to use the web-server intentionally.
- It is accessed by a bot that reads your email address and signs you up for SPAM.
- It is accessed by a bot that attempts to exploit a flaw.
- It is accessed by a bot that installs botnet software on your machine by exploiting a fl

Re:Breaking the law

[pbhj]

You rightly note that "authorise" is not defined, hence it's given it's normally everyday meaning. You attempt to subvert that meaning to be a technical computer related meaning. If the measure is ability to access - which it would need to be for the BBC to be authorised - then any cracker would be authorised and the CMA is useless, that can't be the intention of the draftees.

[Numbers by me]

1. An unknown person portscans your computer.

2. An owner turns on a web-server on a personal computer. It provides no warning that the public are not authorized to use it.
    - It is accessed by someone on the internet accidentally, but they continue to use the web-server intentionally.
    - It is accessed by a bot that reads your email address and signs you up for SPAM.
    - It is accessed by a bot that attempts to exploit a flaw.
    - It is accessed by a bot that installs botnet software on your machine by exploiting a flaw in the web-server.

3. Someone else turns on a web-server on a personal computer. Same scenarios as above.

4. You turn on a web-server on a leased personal computer, where the lease says you will not operate server software. It is accessed, with your permission. (The person who accesses it is culpable)

5. You install beneficial software on a public computer.

6. You install beneficial software on a stranger's computer.

7. You install beneficial software on a friend's computer, because they don't understand the benefit.

1. Intent is important and almost certainly unprovable. If your computer is server and they scan the service ports (of the advertised services) then absolutely no issue. I think that connection to the network authorises probing for services that doesn't inhibit operation - if they then act maliciously the law should cut in.

2. All of the accesses are authorised when the web server is put on the internet provided the person doing it is authorised to use the computer in that way. Signing you up for spam is assisting a crime but not a crime in itself AFAICT. Attempting to crack and cracking are both criminal.

3. Authorised if the person is authorised to do that.

4. The lease removes your authority to install a server, not authorised.

5. What's a public computer - most computers owned by local government, etc., say you may not install software without permission. If you have permission then it's authorised, if not ...

6. Did you ask the stranger? Yes = authorised. No = not authorised.

7. The friend doesn't have to understand to authorise you to do it, if they are not of sound mind or you deceive them then you're not authorised, else you are.

Again the term "authorised" is the standard laymans term.

If I crack your password and so have your user:password pair I still am not authorised to use them. Authority !== ability.

Which EULA do you suppose gave the BBC the right to access, modify data on and execute programs on those computers?

Re:Breaking the law

[mattpalmer1086]

Thanks for responding so comprehensively. Your reasoning appears to be informed by a much greater understanding of the law in general than I possess.

Having said that, I don't necessarily buy into all your arguments. I particularly don't agree that the CMA is only intended to prevent access to private data. I believe it is intended to prevent the misuse of computers, which comprises unauthorised access and changes to programs as well as data. If, as you argue, the Act does not apply to programs as well as data, then we will need more legislation.

Note that the Act does not define what constitutes a computer either. In my MSc this was emphasised as a strength of the Act, as the nature of computers has shifted considerably since the Act was produced, yet it can still be applied to novel devices (e.g. mobile phones) which did not exist at the time the Act was framed.

As far as my reference to a "basic test for authorisation goes", I am afraid I can't point you to any solid legal references. All I can say is discussions on the nature of what constitutes authorisation formed a large part of our studies on the CMA - and it is clearly a grey area.

Re:Breaking the law

[debrain]

Having said that, I don't necessarily buy into all your arguments.

Thank goodness-- healthy skepticism is gold in any constructive legal analysis. (Especially of anything I say!). I don't think a judge would buy all (or even most of) my arguments, either -- but they might only need to buy one of them. Often a Judge will have made up their mind on what is fair - and I think the "colour of right" is on the BBC's side - and then the Judge would look for a legal route to that conclusion - the job of a lawyer is then to give the Judge the legal tools to get there.

Re:Breaking the law

[debrain]

Thanks for following up.

You rightly note that "authorise" is not defined, hence it's given it's normally everyday meaning. You attempt to subvert that meaning to be a technical computer related meaning. If the measure is ability to access - which it would need to be for the BBC to be authorised - then any cracker would be authorised and the CMA is useless, that can't be the intention of the draftees.

I'd speculate that the argument authorise is "given it's normally everyday meaning in the context of the statute in which it is used" is quite likely to fly. For reasons below, it's not relevant (i.e. I discovered a section of the CMA that defines unauthorised).

Portscan

1. Intent is important and almost certainly unprovable. If your computer is server and they scan the service ports (of the advertised services) then absolutely no issue. I think that connection to the network authorises probing for services that doesn't inhibit operation - if they then act maliciously the law should cut in.

I would point out that the BBC didn't act maliciously nor inhibit operation. Why does the BBC's act give rise to liability under the CMA, but a portscan would not?

Does that boil down to: What's the difference between a sendmail-like program doing something without authorization and the TCP stack doing something without authorization? Where's the difference?

Install beneficial software

5. What's a public computer - most computers owned by local government, etc., say you may not install software without permission. If you have permission then it's authorised, if not ...

What if you remove a keylogger from an internet terminal? The keylogger may inhibit your use of the computer, but you don't have the consent of the owner of the internet terminal (and you are certain that owner doesn't know about it). How is that different from the BBC removing software from the internet which inhibits their use of the internet (i.e. botnets target the BBC)?

Again the term "authorised" is the standard laymans term.

I'd argue not, but as you observe this leads to the absurdity:

If I crack your password and so have your user:password pair I still am not authorised to use them. Authority !== ability.

I'd argue that this cracked password scenario is dealt with by criminal trespass laws, not the CMA. That way there is no absurdity: the CMA deals with the specific case where you have committed an offence because one accesses a computer without the proper authentication; criminal trespass gives rise to an offence because one accesses a computer with proper credentials but without the permission of the beneficial owner. They're different, distinguishable, and arguably more coherent when read that way. Otherwise there's some duplication in the law - the law of criminal trespass (i.e. subverting use of a proprietary interest) and the CMA s.1 (i.e. use without proper credentials) do the same thing (even though the CMA is unclear on what 'authorize' means, and - per the principle of statutory interpretation expressio unius est exclusio alterius - it doesn't mean 'permission').

I had a quick look but didn't find criminal trespass in the British statutes, but I'd assume that it would cover the case where someone uses a computer without permission but with the proper authorization (i.e. username+password). Criminal trespass would require a parallel analysis, and there are a long number of defences to criminal trespass that need to be taken into account.

Ha! I just found the definition of unauthorized in the CMA. You may ignore the above arguments on what the definition of "authorize" is, but it is somewhat interesting reasoning so I'm leaving it in. The relevant bit of the statute is:

17. (5) Access of any kind by any person to any program or data held in a computer is unauthorised if--

Re:Breaking the law

[Opportunist]

You should have noticed, all the drivers he installed wanted to sit on the right side of your computer.

Re:Breaking the law

[Samah]

2. What if you don't pay your gas/credit-card/porn-subscription bill? Same story. Does that mean NPower/Barclays/shemaleswithdiseasedsheep.com is affiliated with the government?

Taking bets on how long it takes for someone to register that domain...
kgo!

They paid hackers

[Anonymous Coward]

It seems a bit stupid to pay the hackers, as now they will have more money to set up botnets with. I suppose if they didn't a spammer would have done anyway, at least they have a chance of shutting them down now I guess.

Just wait until a botnet DDOS's Click's website.

It gets better

[blowdart]

Controlling machines without permission? Against the computer misuse act.

They used the botnet to spam two email accounts, one at gmail and one at hotmail. That's against the computer misuse act.

And they changed the wallpaper on the machines on the botnet. Against the computer misuse act.

Their "justification" doesn't fly; not having criminal intent is not a defence against the law.

Re:It gets better

[lee1026]

Actually, intent is often considered in the law. IANAL, but I am assuming their legal department signed off on this.

Re:It gets better

[Spazztastic]

Their "justification" doesn't fly; not having criminal intent is not a defence against the law.

I'm sorry officer! My intent wasn't criminal when I broke into my neighbors house to see their renovation of their living room and watch a few episodes of Desperate Housewives on their HDTV! I was just curious, you see...

Re:It gets better

[Clipless]

But it is all OK because they didn't have any "criminal intent."

I wish I had known that was a valid argument during my little DUI incident.
Live and Learn I guess.

Re:It gets better

[PhilHibbs]

Controlling machines without permission? Against the computer misuse act.

Correct.

They used the botnet to spam two email accounts, one at gmail and one at hotmail. That's against the computer misuse act.

Not if it's their own hotmail and gmail accounts or if they have permission, I can spam myself if I want to, and you could spam me as well if I gave you permission.

Their "justification" doesn't fly; not having criminal intent is not a defence against the law.

Journalists have a high degree of freedom in this respect, there are plenty of cases of journalists smuggling guns past airport or other border security as a demonstration.

Re:It gets better

[Zerth]

And theft of services. If any of those were on metered connections, they could have cost the owner a fair bit of money.

Re:It gets better

[Spatial]

I'd be more interested in hearing about whether you think it was the right thing to do or not, instead of shouting "You broke the rules!" like a child in a schoolyard. If they didn't do any harm it isn't very important that they broke the law. Follow the spirit, not the letter.

Reading the article tells me: They disabled the botnet and told the computer owners afterward, and they advised them on how to secure their gear in future. They performed a DDoS on a site, but with prior agreement from the owner.

That's thousands of people who probably learned a valuable lesson. Better to learn that way than to have their credit card details stolen, or their bandwidth used in a malicious DDoS. Given the incredible amount of PCs that are compromised in general, this would seem inevitable without some education to prevent it.

Of course you can make a good argument that it was unethical to invade their PCs, but don't just dismiss the benefits of this out of hand. It's boring, and not really insightful at all.

Re:It gets better

[Anonymous Coward]

"Little DUI" HA! Screw that! Drunk drivers should be publicly castrated. And disemboweled if they hurt anybody else. Goddamn people!

Re:It gets better

[Anonymous Coward]

So you'd rather people remained blindly unaware of security issues on their machines? I hardly expect that a typical Slashdot user would be able to break down the advice they've given as plainly and simply without resorting to a healthy degree of smugness and zealotry. If the BBC managed to obtain crack cocaine/firearms from a public figure, would you be as quick to denounce their actions?

Posted AC for blatantly obvious reasons.

Re:It gets better

[ais523]

Given that the BBC has a program which, amongst other things, steals things from people then gives them back again (and then gets permission to show the resulting film on TV), I suspect if they were going to get in trouble for this sort of thing they would have done long ago.

Re:It gets better

[N1AK]

They disabled the botnet and told the computer owners afterward

They also bought the botnet (or so it seems). I would like to keep Heroin off the streets, it doesn't mean I want the BBC to start buying it off dealers and throwing it away.

My view and some analysis of the Computer Misuse Act

Re:It gets better

[geekboy642]

Don't mind the inevitable AC trashing you'll get for that remark. MADD has pretty well succeeded in brainwashing the common sense out of an entire generation.

Re:It gets better

[aetherworld]

So they pay their fines and promise never to do it again. Still, I liked the demonstration. It's good for educating the not so technically inclined people among us.

Seeing someone else changing things on your computer, even if it's just the wallpaper is pretty scary for many people. More so than hearing anonymous reports about botnets and how their computer could be infected too. If you actually see it happen, you're more likely to be more cautious in the future.

Re:It gets better

[qwertphobia]

I like your summary. And it brings to my mind that the Boston Tea Party was illegal too. Where would the United States be today if the colonists just said to themselves "well, that's against the rules, comrade".

Re:It gets better

[stupid_is]

They used the botnet to spam two email accounts, one at gmail and one at hotmail. That's against the computer misuse act.

Not if it's their own hotmail and gmail accounts or if they have permission, I can spam myself if I want to, and you could spam me as well if I gave you permission.

Their "justification" doesn't fly; not having criminal intent is not a defence against the law.

Journalists have a high degree of freedom in this respect, there are plenty of cases of journalists smuggling guns past airport or other border security as a demonstration.

But is it legal for you to "break-in" to someone else's computer and use that to spam yourself? I agree that if you use your own resources to spam yourself, you should be in the clear - but Auntie clearly used other folks resources without their consent to do the self-spamming.

As to your journo example for smuggling guns - I suspect they only smuggle look-a-like props, and not the real deal. Carrying offensive weapons like that is surely a no-no.

I do think they've done something constructive in alerting the compromised computers owners that they need to upgrade their OS to be more secure - but I think the BBC has broken the law in doing so, and might get a right spanking for their trouble.

Re:It gets better

[SydShamino]

Hmm, what's the relative cost of using the zombies for a day, then disabling them and alerting the owners, or letting the zombies remaining in the botnet for the next few years?

Re:It gets better

[ArcadiaAlex]

There has to be some misuse there that spamming "yourself" is breaking when it is an online email account? I havn't checked but what about I would have thought there is something in the agreements that you "check" when you start an account? After all it is using gmail and hotmail's resources (bandwidth, disk space etc) for purposfully receiving spam, which you could argue is verging on a DDOS attack on their servers. (ok the scale may be different but if it wasn't the BBC I expect gmail and hotmail would close those mailboxes pretty quickly if they where filled with thousands of emails in a matter of minutes.

Re:It gets better

[Opportunist]

Intent is actually the only difference between murder and manslaughter. I don't know about your country, but mine makes a HUGE difference. Murder is a life sentence (no other options). Manslaughter can be anywhere between 10 and 20 years. If you manage to get the judge to believe you didn't even intend to harm the person but he just happened to fall onto your knife when you just threatened him, three years might even be enough.

Re:It gets better

[Opportunist]

Umm... the spam, in this case, went to a mail server that they didn't control. IF it was their own mail server, no questions asked. But they only "own" (keep your lawyers at bay, I know, I know...) the mail addresses used. Not the server. Technically, they caused undue stress to the server, willingly and knowingly. And probably without consent of the mail server's owner.

I'd have used my own mail server for such an experiment. Not only for this reason, but also to make sure that overzealous automatic spamfilters (e.g. those that check MX records and such by default) don't toss my spam out. It's less of an eye opener when people see everything you spammed with lands in the spambin anyway.

Re:It gets better

[mcgrew]

I don't have criminal intent when I hit my bong, either.

Re:It gets better

[LingNoi]

Not if it's their own hotmail and gmail accounts or if they have permission, I can spam myself if I want to, and you could spam me as well if I gave you permission.

No you can't. I'm pretty sure Google and Microsoft wouldn't be happy with you spamming their servers. It might be going to your gmail or hotmail account however your permission means squat unless you're sending the mail to your own mail server.

In fact I'm sure DDOSing Google and Microsoft servers with spam is against the law by itself.

Re:It gets better

[PhilHibbs]

So is there a limit to the number of emails that I am allowed to send to my gmail account?

Re:It gets better

[Nick Ives]

No judge in the land would actually sentence them for this. Assuming a jury actually found the reporter guilty (the judge would be forced to direct them to return a guilty verdict because this is clearly against the law - the jury can do wtf they want) then he'd get a tiny suspended sentence. I doubt the CPS would even want anything to do with it in the first place.

Re:It gets better

[LingNoi]

There's a difference between educating people and using their machines to send spam to Google and Microsoft servers.

What if these people had bandwidth limits as some connections in England do. Now you've stolen part of their bandwidth.

According to another slashdotter they changed the background screens. Now you've changed data on another persons computer and that's illegal by itself. How can you be sure that your changes didn't screw up the system? Someone could have been working on something important and you've screwed it up.

Yes, this could have happened anyway however just because people do crime in the world doesn't give the BBC the right to do it too without consequences.

If the BBC managed to obtain crack cocaine/firearms from a public figure, would you be as quick to denounce their actions?

What has that got to do with anything? Between what actually happened and your made up scenario they're not even remotely similar.

The BBC not only obtained a botnet they USED it on PUBLIC property.

For your scenario to make any sense the BBC would have to go on a gun rampage killing spree.

They could have easily setup a botnet on ten of their own machines with their own private mail server and kept it all internal however they decided to break the law instead.

Re:It gets better

[stupid_is]

oh, I agree indeedy. But it was still a tad naughty. I wonder why they didn't instead run that bit of code that is available that would turn off and patch a rather large botnet that exists (I forget the details, but the link has been posted in /. a few times in the not too distant past) - would've been a much better result for the internet, and just as shady

Re:It gets better

[NatasRevol]

Because driving drunk is ok??

Re:It gets better

[iainl]

Not if it's their own hotmail and gmail accounts or if they have permission, I can spam myself if I want to, and you could spam me as well if I gave you permission.

I'm not so sure; wouldn't you need permission from Microsoft/Google as well? It's their servers that are taking the hit.

Re:It gets better

[TheRaven64]

What if these people had bandwidth limits as some connections in England do. Now you've stolen part of their bandwidth.

A number of not-very-technical people I know (in the UK) now use mobile broadband for their Internet connections. These have quite low bandwidth caps, and a few charge a lot if you go over them. I wonder if the BBC took this into account.

It's also worth noting that, once a machine has been compromised, the only way to be sure that the infection has been removed is to put the hard disk in another machine and scan every file to remove any rootkits and other malware that may have been left behind. I presume the BBC are willing to pay for this service to be performed on every machine they infected?

Re:It gets better

[mapkinase]

They broke the law like Banksy does.

Re:It gets better

[ArcadiaAlex]

maybe I think this from the gmail EULA covers it:

http://www.google.com/accounts/TOS?hl=en

5.4 You agree that you will not engage in any activity that interferes with or disrupts the Services (or the servers and networks which are connected to the Services).

Re:It gets better

[geekboy642]

No, because there's a world of difference between having a few drinks, and driving drunk. Someone who's drank a responsible amount and then drove will have the same level of impairment as someone driving with a cellphone, OR someone who's overtired, OR someone chatting with their friend in the passenger seat.

Learn to perspective.

Re:It gets better

[PhilHibbs]

Spamming isn't a DDOS attack on the mail server. That would be counter-productive, if your customers can't read about your $afe 0nline ph@rmacy, then you aren't going to sell much ci@1is. You could consider it a DDOS attack on the recipient, as their mailbox might get so full of spam that they can't find their real emails, but that doesn't concern MS or Google in this case.

Re:It gets better

[NatasRevol]

I'm sorry, but what have you been drinking? Methanol?

They're all dangerous ways of driving. Period.

That doesn't mean they're ok!

And a DUI is not a few drinks. Heck, I once told an office that I had a beer & a half. Got a ticket, but no DUI. They know the difference.

You "learn to perspective". And not to tilt at your own windmills.

Re:It gets better

[Zerth]

So like:

"Sure, officer, I had sex with her while she was passed out, but I dropped her off at the hospital afterwards! If I'd left her at the party, everyone would have had a go. See, it was all for an article on the dangers of binge drinking, so it's okay!"

or

"Well, yes, I was growing pot in that empty house for a piece on drug-squatters, but I had the electric company shut off the power after I grew just one plant, so I saved the owner tons of money."

Somehow I don't think those would fly.

Re:It gets better

[I'm not really here]

FYI: If you have permission, by definition, it's not SPAM.

Re:It gets better

[Anonymous Coward]

They spammed gmail and hotmail. Sure they could probably take it at this point, but I really dont see either consenting.

On top of that, whos paying for the bandwidth used? When these customers exceed their bandwidth cap and get a huge bill, is the BBC ready to foot it + pay for the trouble of getting it resolved?

People rarely learn, that goes doubly so when they are infuriated about their computer being compromised.

Re:It gets better

[ShaunC]

Because driving drunk is ok??

No one's making that argument; the objection is to how "drunk" is defined in many states now (mostly thanks to MADD).

Re:It gets better

[Hatta]

If they didn't do any harm it isn't very important that they broke the law.

Tell that to the thousands of pot smokers arrested every year.

Re:It gets better

[Anonymous Coward]

What do you mean "didn't do any harm?" They used something that may or may not have been precious to the people they appropriated it from: cycles and memory, and they defaced surfaces belonging to those people.

Those cycles cost power to perform, as does changing the background, and indeed writing the zombie software to disk does as well. Perhaps not much individually, but I'll bet it's non-trivial in aggregate, not even counting machines that had to thrash because they were low on physical memory to begin with.

And frankly, I'm not sure sure about this "trivial amount of harm" test, either. If punch you, giving you a very small bruise, am I not still guilty of battery?

Re:It gets better

[geekboy642]

So...
You'll be marching in the streets to arrest, jail, and ruin the lives of sleepy drivers and cellphone users now? Sponsored any adverts calling people with backseat drivers murderers recently? Or, as I rather suspect, are you not even bothering with any attempt to be consistent and non-hypocritical?

Re:It gets better

[Cederic]

I do not want media organisations thinking it's acceptable to hack computers while pursuing a story.

Re:It gets better

[NatasRevol]

So, just because only one dangerous way of driving is legislated, you want it removed? Just not following your logic.

Ever had a family member killed by a sleepy driver on a cell phone?
I bet you'd want legislation for them then too.

And, no I haven't, but I can put myself in their place. As well as in the sleepy driver. I've been a sleepy driver on a cell phone.

It's still dangerous, regardless of whether or not it's legislated.

I just don't know what the hell you're ranting at.

Re:It gets better

[NatasRevol]

Have you ever blown 0.08? You're drunk.

http://en.wikipedia.org/wiki/Blood_alcohol_content#Effects_at_different_levels

I could care less about MADD. I'll just pay attention to the science of alcohol ingestion and how it relates to driving 1000+ pound vehicle at 55 mph. And at 0.08, it's not a good relationship.

Re:It gets better

[pbhj]

They used the botnet to spam two email accounts, one at gmail and one at hotmail. That's against the computer misuse act.

Not if it's their own hotmail and gmail accounts or if they have permission, I can spam myself if I want to, and you could spam me as well if I gave you permission.

Well it's use of unauthorised computers for further unauthorised activity (unless they asked MS and Google first) which I think puts them in breach of SS(1) and (2) of the Computer Misuse Act.

Hotmail and Gmail both have bandwidth and hosting charges, by grabbing lots of bandwidth they [the Beeb] are impairing the working of the email servers. That's an offence, when you're using an illegal botnet it's also illegal.

Re:It gets better

[pbhj]

The problem you have is that the law is supposed to apply equally to everyone. This means that anyone now can crack peoples computer and run them as a botnet provided they claim their intent was not to damage those computers (only DDoS some others) just funk around with desktop backgrounds and such and finally to let the owners know.

Robbing banks to give the money to the poor is still not a valid legal defence AFAICT. (though it appears the opposite, robbing the poor ..., is allowed, but I digress!)

Re:It gets better

[Petrushka]

I'd be more interested in hearing about whether you think it was the right thing to do or not, instead of shouting "You broke the rules!" like a child in a schoolyard. If they didn't do any harm it isn't very important that they broke the law. Follow the spirit, not the letter.

Now, you know it's not as simple as that, I'm sure. Surely you can see that the resentment springing up here -- and, no doubt, in at least some of the British media in the coming days -- is resentment over the fact that if a private citizen had done exactly the same things, with exactly the same intent, with exactly the same precautions, they would be looking at decades in prison and perhaps extradition to a country that practises torture. While if the BBC does it, they get off scot-free.

I'm personally undecided as to whether they were doing the right thing. It's certainly arguable that a body that can do a public service like this and get off scot-free should be permitted to do so. But at the same time the resentment is wholly justified, and it's important enough to feel a lot of resentment over. I think you shouldn't dismiss it out of hand either.

Re:It gets better

[PhilHibbs]

Well it's use of unauthorised computers for further unauthorised activity (unless they asked MS and Google first)...

As I've already said, you might be right on the first point but not the second, I don't need to ask Google or Microsoft's permission to send as many emails as I want to my own Gmail or Hotmail account.

Re:It gets better

[pbhj]

That's like saying you don't need their permission to visit someone's webpage as often as you like .. if you like a few thousands times a second from a botnet then it's a DDoS and you surely do need permission.

If you look at the preview vid they say they set it up so each bot sent an email 500 times to each account (with some throttling, but nonetheless). That's 11,000,000 different emails. A large quantity of emails is /likely to impair/ the operation of the computers and that would make this a CMA Section 3 violation.

As the breach of Section 1 is so clear I'd expect prosecution would be instructed to follow that and ignore the other charges. (ha like it will ever go to court).

Re:It gets better

[nametaken]

I've been asking this question on /. for some time now. Why don't people do this more often, stealing and disabling botnets?

Re:It gets better

[Anonymous Coward]

Not if it's their own hotmail and gmail accounts or if they have permission

I'm pretty sure the BBC own neither service. It's got nothing to do with the account and everything to do with the servers.

Journalists have a high degree of freedom in this respect, there are plenty of cases of journalists smuggling guns past airport or other border security as a demonstration.

And there have been instances of journalists being charged for research which involved them downloading paedophilic imagery. I'd provide a citation but enh, my hearsay is as good as your's.

Re:It gets better

[PhilHibbs]

(ha like it will ever go to court).

It shouldn't go to court, it's a legitimate journalistic investigation. Ever heard of "chilling effect"? I'm astonished at the number of people in this forum advocating dragging journalists into court.

Re:It gets better

[pbhj]

What's this got to do with free speech. The BBC were perfectly capable of doing a show about illegal botnets without buying and using one.

A legitimate journalistic investigation into a crime doesn't require the journalist to perform the crime, nor to support others in doing so. That's not reporting on crime, that is being a criminal in order to give yourself something to report on.

Personally I believe in one law for all HM subjects; journalists included.

Other benefits

[JaimeZX]

I heard the BBC virus also installed a photo of David Attenborough in a bikini as the user's wallpaper and also informed the British government if it found any pictures of knives, guns, or pointed sticks.

Re:Other benefits

[Canazza]

Am I the only one who heard 'pointed sticks' being read out as if it were that Monty Python Banana self-defence sketch?

Not against the law???

[RingDev]

If this exercise had been done with criminal intent it would be breaking the law.

So if I install software on your machine that you paid for, consume the bandwidth that you are paying for, burn extra electricity that is paid for by you, all with out ever even letting you know about it, so long as I'm doing it for finding a cure for cancer, it's perfectly legal?

What if I use that bot net to distribute the load of rendering animated gaping anal gay midget porn movies? It's not a crime to render animated gaping anal gay midget porn movies, so I have no criminal intent, so it must be legal, right?

-Rick

Re:Not against the law???

[Spatial]

It probably is illegal, this is the UK we're talking about. Midgets could be construed as children!

Re:Not against the law???

[Anonymous Coward]

What if I use that bot net to distribute the load of rendering animated gaping anal gay midget porn movies? It's not a crime to render animated gaping anal gay midget porn movies, so I have no criminal intent, so it must be legal, right?

-Rick

Hmmmm. Is there a copy of that available or is it still rendering?

Re:Not against the law???

[Anonymous Coward]

Extreme porn law? They have laws against looking at porn while bungee jumping? That's madness!

Re:Not against the law???

[bickerdyke]

So.. if I smash a window to pull your unconscious body out of your burning house, that should be illegal just cause I should have ASKED you first?

And so your example _might_ even be legal, if you can give a *really* good reason for not asking first. And it should be one why you couldn't have asked, and not why you didnt want to.

Re:Not against the law???

[RingDev]

So.. if I smash a window to pull your unconscious body out of your burning house, that should be illegal just cause I should have ASKED you first?

Poor analogy.

This would be more akin to noticing that your door was unlocked, entering your house, helping themselves to the fridge, prank calling their friends, then waking you up and letting you know that your door was unlocked.

-Rick

Re:Not against the law???

[InsertWittyNameHere]

They probably had a download on BBC's website that had a EULA that laid out what was going on but of course NO ONE read it. So technically the user would have consented to being a part of this botnet.

Of course the article doesn't mention the details, so who knows.

Re:Not against the law???

[fulldecent]

Once you buy access to the botnet, you can use it for whatever you want!

Re:Not against the law???

[Nick Ives]

That episode of Brass Eye isn't illegal though. If it were it would never have been broadcast.

OT: Chris Morris is a hero of mine. He made a radio comedy show called "Blue Jam" for Radio 2 and at the end of the last episode of the first season he included a cut-up he made of the Archbishop of Canterbury's speech at Diana's funeral. It praised the death of Mother Teresa, made him say the royal family had AIDS and were gang-banging Trevor Rees-Jones.

It mysteriously faded out before finishing to be replaced with the start of the first episode to fill the rest of the slot. There are various explanations given ranging from him being told he wasn't allowed to broadcast it and swapping the tapes at the last minute anyway to him deliberately handing in his on-air masters at the last min so he had to be censored in real-time.

They still let him make two more glorious series though.

Re:Not against the law???

[bickerdyke]

Poor analogy.

Na. just even worse than the one before.

Re:Not against the law???

[Anonymous Coward]

So if I install software on your machine that you paid for

They didn't install any software.

consume the bandwidth that you are paying for

Show me proof that those connections are metered.

burn extra electricity that is paid for by you,

The electricity was already in use, or else the computer would not have been on in the first place.

all with out ever even letting you know about it,

They DID tell the people about it.

so long as I'm doing it for finding a cure for cancer

That makes no sense at all in the context of the story.

it's perfectly legal?

That depends on who you are, who you work for, and what country you & the target systems are located in and/or passing through. In some cases, yes it's illegal, in others no it's not.

What if I use that bot net to distribute the load of rendering animated gaping anal gay midget porn movies? It's not a crime to render animated gaping anal gay midget porn movies, so I have no criminal intent, so it must be legal, right?

Again, that depends on a lot of things. In most places it would be illegal to distribute such porn, since you never verified the age of the person who might receive it. There are other complications as well.

But thanks for playing.

Re:Not against the law???

[nametaken]

What if I use that bot net to distribute the load of rendering animated gaping anal gay midget porn movies?

Then you have my permission. I GOTTA see that episode.

Agreed. Mod parent up.

[mmell]

I've been on the bad side of this one - a lack of criminal intent does not mitigate or extenuate criminal action. Their guilt is quite plain (having been admitted, even published by the BBC itself). Now, their lack of criminal intent does have a bearing on sentencing. Inasmuch as the BBC did not wilfully cause damage or fiscal loss to anybody (except, potentially, themselves?), the sentence should be something on the light side, perhaps even suspended; but the matter of their guilt is simple black-letter law.

I CHALLENGE THE BBC TO DO THIS TO U.S. COMPUTERS.

[Anonymous Coward]

Wow. I can't believe this. In the U.S. what the BBC did is a criminal act. Even if they did not have criminal intent.

Under U.S. law what the BBC did would be as if a criminal entered or broke into a house but did not steal or destroy anything.

I challenge the BBC to do the same thing to computers on U.S. soil. The BBC perpetrators would be extradited so fast they would not know what hit them.

Illegal and unethical to boot!

[unsupported]

This is both highly illegal and unethical. Illegal in that they accessed the PCs without the owners permission, they sent spam, and changed the settings on the computer.

Unethical even if their motive was not to do criminal intent.

It is like creating a "white worm" to patch servers from an unpatched vulnerability.

Re:Illegal and unethical to boot!

[Anonymous Coward]

They didn't send spam, they sent email to their own email addresses. How can that possibly be spam?

Re:Illegal and unethical to boot!

[PhilHibbs]

Journalists have a much higher degree of discretion when following legitimate investigations.

Re:Illegal and unethical to boot!

[je ne sais quoi]

Meh. I'm not too concerned: the BBC creating a botnet is like the BBC going out and speeding or driving aggressively during rush hour. Sure, it's illegal and unsafe, but when everybody is doing so why single out the BBC for their activity? In fact, maybe if the BBC can demonstrate just how trivially easy it is to create and use a botnet, people will wake up and start taking security more seriously because them doing it calls attention to the problem. Actually if everyone did this and started creating their own botnets, sure it might bring down the internet for awhile, at least those machines that are pwned, but you can bet that software and router companies would start patching their software more quickly and more efficiently. In any case, how do you know that the BBC didn't infect their own computers?

But never mind me...all you people on the righteous indignation bandwagon just mod me troll already and be done with it. Grab your pitchforks! Burn down the BBC! They're breaking the law!

Re:Illegal and unethical to boot!

[Anonymous Coward]

why dont i just saw your arms off...
so you cant write stupid shit like this and people notice that stupid shit is something they should try to avoid!
But never mind me...all you people on the righteous indignation bandwagon just mod me troll already and be done with it.

Re:Illegal and unethical to boot!

[Draek]

Illegal in that they accessed the PCs without the owners permission, they sent spam, and changed the settings on the computer.

"Changed the settings on the computer" sounds a lot more awful than "changed the wallpaper", doesn't it? plus, sending 'spam' is perfectly legal as long as you have the authorization of all those to whom you send it to, and considering that they sent it to their own email addresses, I think that's likely the case.

Further, I don't think that either "white worms" nor accessing other people's PCs with the sole purpose of letting them know their computers are insecure is something unethical. In both cases, the benefits to society at large are bigger for committing the act than for not doing so, as far as I can see.

Re:Illegal and unethical to boot!

[LingNoi]

Again, it's not their servers. They registered a gmail and hotmail email account. That doesn't make it theirs to send thousands to spam mail to.

Re:Illegal and unethical to boot!

[pbhj]

Sure, it's illegal and unsafe, but when everybody is doing so why single out the BBC for their activity?

So your saying you'd like to be killed in a road accident and you don't care if the driver of the car that smashes into you is being paid to do it by the BBC. Think you've lost me there.

Re:Illegal and unethical to boot!

[Anonymous Coward]

citation please

Re:Illegal and unethical to boot!

[idlemachine]

Journalists have a much higher degree of discretion when following legitimate investigations.

To what extent? Could a journalist kill the Queen to demonstrate a flaw in her security? Set up a child slavery ring to show how viable it is? At what point does this excuse actually stop being valid?

Forget being a corrupt law enforcement official, clearly journalism is the way to go!

Re:Illegal and unethical to boot!

[PhilHibbs]

Could a journalist kill the Queen to demonstrate a flaw in her security?

Sure, why not? Sheesh. *Plonk*

Re:Illegal and unethical to boot!

[idlemachine]

Ah, so it's only what is "obvious" to you, I gather?

Well argued...that sound effect for a non-existent killfile sure put me in my place.

armchair lawyers

[Anonymous Coward]

Ah, time to bring out the armchair lawyers. Nevermind that the BBC has its own legal team that reviewed this activity before it happened. I'm sure all of you know better. Especially all you Americans who are well-versed in British law.

Re:armchair lawyers

[xorsyst]

Feel free to read the law first. It's actually quite readable, even to non-lawyers. It looks like they might have some wiggle room with clause (3)(2) to me.

Re:armchair lawyers

[mapinguari]

(2) For the purposes of subsection (1)(b) above the requisite intent is an intent to cause a modification of the contents of any computer and by so doing--
(a) to impair the operation of any computer;
(b) to prevent or hinder access to any program or data held in any computer; or
(c) to impair the operation of any such program or the reliability of any such data

Obviously, they impaired the operation and reliability of the botnet software by uninstalling it.

Re:armchair lawyers

[ddrichardson]

Can you clarify why (3)(2) gives them wiggle room:

"A person is guilty of an offence if at the time when he does the act he has the requisite intent and the requisite knowledge to cause a modification of the contents of any computer and by so doing impair the operation of any such program or the reliability of any such data."

IANAL but that seems pretty watertight and section 17 paragraph 18 is also pretty succinct:

"(8) Such a modification is unauthorised if-- (a) the person whose act causes it is not himself entitled to determine whether the modification should be made; and (b) he does not have consent to the modification from any person who is so entitled. "

Re:armchair lawyers

[xorsyst]

I did put might in italics ;) It could reasonably be argued that their actions did not demonstrably impair the operation of the bot computers. It's not much wiggle room, but they do have good lawyers (I expect).

Re:armchair lawyers

[pbhj]

The [major] sections 1, 2, 3 refer to 3 separate offences. They hit all 3 of section 1 (= SS1), they probably hit all necessary parts of SS2 as they then used the unauthorised access to do stuff to those computers and to DDoS a computer (with authorisation, but nonetheless "a computer" under SS3(2)(a) which puts them on slightly dodgy ground there too!).

Section 3 does speak of intent and so they're most likely clear there. So only 44000 offences (at 6mo each?). Possible as others said they hit computers in other countries too - the researchers could be extradited to the states!

(I expect they'll get a slapped wrist and a huge disparity of justice will occur with the next well publicised breach of the Computer Misuse Act.)

I'm sure some were in the US

[JeanBaptiste]

if you go randomly grab 22,000 computers for your botnet, it's far more likely than not that some would be in the US. Even if they only targeted BBC registered users or something (didn't read TFA), there'd still be overseas users and such, some in the US. Not that I'm an expert, but I don't think they could reliably get computers from only inside GB.

Re:I'm sure some were in the US

[Timothy Brownawell]

I don't think they could reliably get computers from only inside GB.

Should be fairly simple with a decent GeoIP database.

Re:I'm sure some were in the US

[mjjw]

The BBC has a GeoIP database which they use to determine whether or not you are eligible to use services such as iPlayer. Whether or not they checked if the computers were in the UK I do not know, but they certainly could have done.

Re:I'm sure some were in the US

[sopssa]

Theres ofcourse errors in GeoIP databases. Surely some would had fit into the 20 000 computers they got.

Re:I'm sure some were in the US

[Draek]

I'm sure there are a few, but none on the UK. Why? simple, ISPs are given entire IP ranges to distribute among their clients, so for there to be an error you'd have to have an internet connection through an ISP belonging to another country, and the ocean makes that a bit impractical for the UK. So if there's any errors, they should be found on the borders of Germany and France, for instance, or Spain and Portugal, not the UK and certainly not between the UK and the US.

Re:I'm sure some were in the US

[Anonymous Coward]

We do have a land border with Ireland.

Just saying.

In Other news...

[Anonymous Coward]

In other news, A DDOS Brought CNN down for two hours today, BBC was found responding "I wonder who had the opportunity for that" CNN was only to respond "Those limey brits"

In other news...

[Dishwasha]

the notorious underground computer hacking group self-labeled /. deploys over 30,000 Anonymous Cowards to take down the BBC news website by maliciously posting a link to this news article.

Was linux involved?

[yossarianuk]

How many of the botnet'd machines were running linux ?

Re:Was linux involved?

[stonedcat]

I'd be willing to bet the number you seek is zero.

Re:Was linux involved?

[Anonymous Coward]

Rhetoric, learn to use it, to love it, to hate it.

Re:Was linux involved?

[Anonymous Coward]

That was a woosh you just heard. It went right by without you noticing.

Don't focus on the legality

[Reality Master 201]

Everyone's going on about how it's actually illegal and the intent doesn't matter (I don't know either way - it is Britain and maybe things work differently there).

What about the fact that some guys from the BBC were able to gain control of 20k infected machines on the web just for the purposes of doing a story? To me, the implications of that are far worse than any possible criminality.

Re:Don't focus on the legality

[Anonymous Coward]

What, you didn't know security sucked?

You don't even need to be tech savvy to do it -- I could give you several places you can literally just buy a botnet. And I'm sure lots of other folks here could too.

If it exists, you can buy it online.

Re:Don't focus on the legality

[Reality Master 201]

Yes, that was actually my point. The legality of the matter is rather secondary, in terms of importance, to the fact that getting a botnet is so easy to do.

Re:Don't focus on the legality

[Anonymous Coward]

agreed.. people here might know this, but this kind of story has value in educating the general public.

Skewed views of the law

[grayn0de]

Way to go, BBC. You have moved past bringing the populace breaking news stories to creating them! I am looking forward to the next headline, regarding this. I think we all agree that gaining unauthorized access to another computer is, not only unethical, but illegal. I am surprised, being that this article is on slashdot, now, that the BBC is not already feeling the ramifications of its actions. I highly doubt they asked everyone in those chat rooms: "Hi, we are from the BBC, we would like to pwn your computer in the name of exposing cyber security risks. Is this okay, with you? Great, Thanks!"

Re:Skewed views of the law

[dave420]

Get a grip.

Good to know!

[Exitar]

"If this exercise had been done with criminal intent it would be breaking the law."

So, if I run over a pedestrian with my car while absentminded I obviously have no criminal intent so I'm not breaking the law?

Re:Good to know!

[Zerth]

No, that would be reckless endangerment.

You have to do it deliberately for a news piece on elderly drivers and why they can't miss a farmers market.

Re:Good to know!

[Hatta]

So, if I run over a pedestrian with my car while absentminded I obviously have no criminal intent so I'm not breaking the law?

Only if you do so for "educational purposes".

Re:Good to know!

[Anonymous Coward]

Slow down, are you saying that someone who accidentally hits a pedestrian should get the same punishment as someone who intentionally hits them? I'm glad you don't write the laws.

British computers only?

[dazedNconfuzed]

You SURE only British law applies? As noted in another post, when you start hijacking 22,000 computers on the Internet, most likely SOME of those will be in the USA (or other countries where such activity IS illegal). You sure those BBC lawyers know enough about technology to be sure that the activity was limited to British computers, and this did not actually risk becoming an international incident?

Re:British computers only?

[Phyvo]

The article mentions that US/UK computers are more expensive and that they used a "low value" botnet. So it's possible that they simply used computers from elsewhere in the world, where they don't have that type of law that could be applied internationally.

Re:British computers only?

[Hittis]

Either way. I just filed a complaint with the BBC asking them to investigate this matter.

I'm in the process of filing a report with Swedish authorities to investigate this further.

Some information missing from the summary

[ais523]

Once the BBC had finished with their botnet, they changed the desktop background of all the infected computers to tell people what had happened and link them to this webpage, which contains some information on how to secure Windows. Then, they uninstalled the botnet software.

Re:Some information missing from the summary

[Yacoby]

Computer Misuse Act (1990) forbids the unauthorized modification of computer material. How is changing the desktop not modification of computer material?

Re:Some information missing from the summary

[Realzneo]

Your link is wrong, according to the screenshot in the video, the correct one is:
http://www.bbc.co.uk/click/infection

Re:Some information missing from the summary

[Ant P.]

How is Windows Genuine Advantage not illegal?

Re:Some information missing from the summary

[Barny]

EULA :)

Re:Some information missing from the summary

[ais523]

Yours redirects to mine. So my link wasn't wrong, but neither is yours.

Re:Some information missing from the summary

[Realzneo]

Thats weird. Your link give me
http://news.bbc.co.uk/2/hi/programmes/click_online/7932816.stm
with the headline: "BBC team exposes cyber crime risk"

while my link give me
http://news.bbc.co.uk/2/hi/programmes/click_online/7884387.stm
with the headline: "How to protect yourself online"

When will people learn.

[Anonymous Coward]

In other news, 22,000 PC users are stupid Windows users.

Re:I CHALLENGE THE BBC TO DO THIS TO U.S. COMPUTER

[mjjw]

The BBC perpetrators would be extradited so fast they would not know what hit them.

Sadly true as we have a very one-sided treaty regarding extradition.

May I know your address?

[mmell]

I'd like to drop by your home and have a look at your taste in furniture, preferrably when you aren't around (after all, you could interfere with my ability to form an accurate impression and we wouldn't want that now, would we?).

What? That jewelery in my pocket? Oh, my - I was looking at it and forgot to put it back. No intent to steal, no harm no foul.

There's a reason they call them laws. Otherwise, we'd call them "suggestions".

Re:May I know your address?

[Spatial]

Why, are you going to perform a denial of furniture attack on my neighbours?

Theft from my house is making the analogy inaccurate. They didn't take anything but a minor amount of transfer bandwidth. That's about as serious as stealing the oxygen in my house by breathing.

The analogy would be closer if you simply got into my house without telling me (causing no damage), performed some pre-arranged DDoS with a security company who agreed to it previously, and then vacated, leaving everything as it was before you arrived. After leaving, you then proceed to tell me why you did it, how you did it and how to stop you doing it again. Later you tell the world about such things through a respected news service, in a report about the insecurity of houses like mine and the people who exploit them for profit to the detriment of others.

In that case, I wouldn't like it much but I wouldn't want to sue you or anything either. It would be embarrassing and annoying. I'd probably become quite conscious about the crappy security of my house and fix it up.

Re:May I know your address?

[Draek]

There's a reason convictions are made by judges instead of mathematicians. The whole purpose of the legal system is to give some 'wiggle room' so that it's the spirit, and not merely the letter of the law that's being followed.

And this being the BBC, one of the most highly regarded broadcasters in the world, plus the fact that the DDoS attacks were made with permission from the attacked website and that they advised afterwards to the botnet members on how to secure their computers gives them a *lot* of leverage. You, on the other hand, with a simple "oh I forgot to put it back" probably wouldn't be so lucky.

Re:May I know your address?

[spacefiddle]

Ah. Yes. Quite.

Your Honor, my client is wearing a Saville Row suit and is a Respected Member of the Business Community. As a highly-paid journalist, it's important he avoid reporting on things that annoy the powerful, and concentrate on making us more attractive to advertisers, capitalize on buzzwords, and get us publicity.

On the other hand, that scruffy bastard over there has a snarky T-shirt on, keeps saying something about the safety of our information that i don't understand, and frankly, Your Honor, I Just Don't Like His Attitude.

Clearly, Your Honor, my client should be paid for his time wasted here in court today. Fry the scruffy bastard. See you and the missus for tea on Thursday, wot?

Re:May I know your address?

[Anonymous Coward]

The computers were already broken into!

The 'bought' the net. Used the net in the SAME way the people who sold it were using it.

This is more akin to receiving stolen goods off the back of some truck.

What they did was basically this. Changed the background of the computer screen and sent a few k worth of packets from the computer. This is akin to coming in the house making a local phone call. Then putting a GIANT sticky note on the fridge that says 'hey lock your back door and here is a list of locksmiths in the area that will help you out. Oh and btw people have been doing this for years here.'

Would I be cool with someone doing this? No. I would be flaming mad. But I would damn well make sure it didnt happen again.

Did they break the law? Probably. But if I was them I would gladly pay the fine.

There are honest people out there. There are dishonest people out there. Locks keep the honest people that way. Sometimes they keep the dishonest ones out.

Re:May I know your address?

[Draek]

WTF!? are you seriously arguing that reporting on the sorry state of computer security is "avoid reporting on things that annoy the powerful", and that information is in any way *safe* in computers that can be hacked en masse through fucking chat networks!?

You either commented on the wrong thread, or you're smoking some pretty heavy stuff.

Re:May I know your address?

[spacefiddle]

Yeah, fair enough, sorry, i knew i shoulda been less snarky and more specific.

As i think others have mentioned, tho, botnets are in even the non-technical media pretty regularly - this is not a new, unproven, cutting-edge investigation. This is "we have conclusively and dramatically (and illegally) proven that water is wet! Go us!"

Botnets, zombies, ebil lone hackers sitting at an unknown console commanding a vast army... this is strong movie-like imagery, and the media and public eat it up. Where's the reporting on coporate security policies and their enforcement, or lack thereof? Why don't they submit some "honeyed" made up personal info to a site that claims not to sell it, then see how fast it spreads...?

There's stuff that actually needs investigating. Badly. And it could be done quite well. New to the reporter != news.

Breaking or bending the law to demonstrate a known is not as justified, imho, as truly going out on a limb to try and uncover something new.

Aside from that, i still maintain my horror at your implication that the BBC is more allowed to break the law than any other given lawbreaker, because they are such great successful guys with brand recognition...

Re:May I know your address?

[Draek]

I'll start with the last part: no, the BBC isn't "more allowed" to break the law because they have brand recognition, they are allowed to break the law because they did it in the name of journalism and made sure nobody got hurt (and no, the electricity argument is bollocks and everyone knows it). Same reason I defended the guy a while back that was thrown in jail in the US for correctly guessing some big wig's password was, in fact, "password".

Further, this *is* old news for us, tech guys but if it was truly common knowledge getting 22.000 computers in a botnet would be *way* harder than it apparently is. And much like speeding and traffic accidents, until it stops being so fucking common it deserves to be in the news IMHO. Plus, we know that at least a good percentage of those 22.000 computers will have some security now, these kind of things serve as a good scare for the average people.

As for your reporting suggestions, I'd send them to the BBC as commentary for this news, they're actually quite good. Perhaps they'll consider them, perhaps they won't, but I think you have a better shot with them than with Fox News ;)

criminal intent???

[Anonymous Coward]

If this exercise had been done with criminal intent it would be breaking the law.

lolwut. actually, in the United States, it is totally illegal, both at the federal level (18 USC 1030) and every single state. I'm sure it's just as illegal in England. Sony didn't have criminal intent when it distributed rootkits. I would like to see the BBC sued by 22,000 people.

It is illegal

[furby076]

Actually, hijacking any computer - even if you didn't do anything bad and were trying to demonstrate a security flaw - is illegal. There have been other cases in our past where someone wanted to show the flaws in security...all to end up getting arrested.

Ex Msoft at the top of BBC technology

[hughbar]

This more childish attention seeking from the BBC. They're losing audience share even in my demographic (50ish, middle class) who used to be their cheerleaders. I noticed that the operating system word was not mentioned throughout the whole of this childish and possibly illegal prank. Perhaps that's because Eric Huggers (and lately a lot of his Msoft minions) are now at the top of BBC technology. As for Spencer Kelly of Click (which is a product placement program rather than a serious one) he's admitted publically that he doesn't know much about computers: http://news.bbc.co.uk/1/low/programmes/click_online/meet_the_team/default.stm It's sad to see a great institution brought so low and we still have to pay for these tossers (to use the technical word).

Deserves punishment

[AdmV0rl0n]

The BBC has done this to highlight an issue.

The problem with this, is everyone who needs to know already know's it's an issue. Those who did not know, will still be none the wiser, and will shruug their shoulders, try to do what the BBC says - 'secure' the computer, and in a few months any instructions laid out will be stale, broken, old, or incomplete.

Lagality
To my mind, its clearly illegal. But being illegal and being punished, are two very distant worlds. For years now, entire governments, corporate entities, criminals, and everyone else has run round committing this 'crime', and it's never been dealt with. The massive waves of Malware and spyware, often being shipped by companies that exist openly are simply a symptom of a system that has failed.

I can probably count on one hand the times that in raw clear daylight, entities are tackled and dealt with criminally in this subject. Wether it be Sony installing a root-kit, or the BBC doing this, it's become an everyday crime. Your computer is not as some claim, akin to a house with no lock, its clearly your land, and stepping on it is 'tresspassing' and doing something you should not be.

Its probably far too late now, the horse has gone, but companies that breach the law to this extent should be prosecuted and made to answer for this.

My problem with the BBC is that by making this nonsense - they have once again, invited kiddies to the underground, and created a level of encouragement. After all, the kids will say, if the BBC can do it and not be criminalised, so can I.

It's really time that companies that are like the BBC, legit, and when they do things like this, that they be prosecuted to the full extent of the law. That applies to Sony and it's root kit and others. We need to get back to the basis in law that someone else's computer is not yours, and if you decide to screw with it, you face criminal charges.

Further, it would be very interesting to see what the BBC IT structure and management make of this, and wether they would be happy were it someone else hacking and using their systems and networks.

Re:Deserves punishment

[u38cg]

I imagine there will be internal fallout at the BBC over this, but traditionally courts have given bona fide journalists quite wide latitude in cases like this.

Real world analogy: if a reporter went and lived with a group of squatters for a few days would we consider him guilty of trespass? I agree the offence is more egregious but given the level of harm actually done (and which would have been done anyway) I can't see the courts getting their knickers in a twist over it.

Re:Agreed. Mod parent up.

[Anonymous Coward]

But, my armchair lawyer friend (and the five million others who will pipe up), the CPS must decide that it is in the "public interest" to prosecute.

This little get-out clause is both used for good - not trying to punish someone who has assisted their terminally ill partner with suicide when they had made a living will years before and were still mentally competent, say - and for bad - such as not pursuing corrupt police officers.

What?!? They destroyed it?

[rnddev]

They are apparently oblivious to the fact that DDOSing a site also means saturating the connection of the PCs involved in the attack which could have a critical function within a business. Do they even know the way that the backdoor application works? Is it possible that it is spreading through local shares and otherwise wrecking havoc on some network by propagating through some unpatched exploit?

"Click has now destroyed its botnet, and no longer controls any hijacked machines."
This quote worries me as they don't seem to understand what they're doing. Did they click a button that said "destroy botnet"? By destroy, do they mean wipe out some critical files?

Re:What?!? They destroyed it?

[rednuhter]

they disabled the botnet clients on the a machines they had access to.
And changed the wallpaper to a message informing the user as to the investigation.

Re:What?!? They destroyed it?

[Anonymous Coward]

Naw, it just overwrote the master boot record and flashed the bios with zeros. Nothing important.

Robbing a bank..

[Anonymous Coward]

I'm gonna rob a bank... but I have no criminal intent. I just want everyone to see how insecure our banks really are. (and get a kick out of it)

Re:I CHALLENGE THE BBC TO DO THIS TO U.S. COMPUTER

[bickerdyke]

Oh stop that egocentric rant!

Different countries have different laws. Cope with that!

Screenshot

[xororand]

Here's a slightly blurry screenshot of the wallpaper: http://www.heise.de/bilder/134489/0/1

Re:Screenshot

[FatLittleMonkey]

"As part of a BBC investigation into illegal computer software... We have disabled this illegal mechanism... But we want to let you know what we have discovered so that you can take precautions to minimise the risk of future infections and clean your machine... For more details and advice, visit our website..."

Given those bogus "FREE VIRUS SCAN: Click here to scan your computer for viruses!!!1!" banner-ads, and how effective they apparently are at getting idiot-clicks, I wonder how long it will take for botnet operators to use this tactic to get people to voluntarily hand over even more control/info/money to mal-sites. "Botnet.ru has cleansed your computer as part of our investigation, go to our site for instructions on how to permanently protect your computer for a small one-time fee."

I for one welcome our new BBC overlords

[Anonymous Coward]

Meet the new overlord. Same as the old overlord. Yeeeeeaaaahhhh!!

Clarification

[awpoopy]

Let me fix that for you:
"[The BBC] managed to acquire its own low-value botnet http://news.bbc.co.uk/1/hi/programmes/click_online/7932816.stm the name given to a network of hijacked MICROSOFT Windows computers - after visiting chatrooms on the internet. The programme did not access any personal information on the infected MICROSOFT Windows PCs. If this exercise had been done with criminal intent it would be breaking the law. But our purpose was to demonstrate botnets' collective power when in the hands of criminals." The BBC performed a controlled DDoS attack, "then ordered its slave MICROSOFT Windows PCs to bombard its target site with requests for access to make it inaccessible."
Now it's been edited to show the facts.

Re:Clarification

[Anonymous Coward]

Lets leave linux unpatched for a year and then release "news" stories about how so many linux boxes got 0wnd. Yes?

Y'all better hope Windows doesnt drop market share. Once they loose their monopoly status, and nobody is watching them y'all better be ready for some big asswhooping.

Ofcource Linux is such a huge success. 15 years toiling with buggy code and still 1% market share. Maybe its like a homeless guy getting a dollar note. Sure its not significant, but to the smelly hippies even 1% means a lot. Yes !! lets declare linsux a suxxess.

Maybe MS needs to throw some cash at y'all like they did with Apache. Hell IBM invested $1 billion and still nobody wants linsux smelly crapware. WHat does that tell you? hahaha

Year of the linux desktop indeed....

Re:Clarification

[Zoxed]

As I normally do I wrote a comment to the BBC on the article pointing out that they omitted to mention that only Windows PCs have this problem: but as yet no reply and no update :-(

(I always used point this out when they report on the latest malware problem: but recently (last year or so) they seem to have got the message and do refer to Windows PCs, not PCs in general (I imagine I am not the only one who points this out to them !)).

Re:I CHALLENGE THE BBC TO DO THIS TO U.S. COMPUTER

[Carewolf]

I don't think entering a home through an open door and looking around is not a crime, only breaking-and-entering or refusing to leave are crimes. Maybe it is just that way in the US?

The BBC Already did it

[Anonymous Coward]

Beat The Burglar

Re:The BBC Already did it

[Raenex]

From your link:

"The concept for "Beat The Burglar" is that an ex-burglar (Mike Fraser) attempts to break into the houses of volunteers" (emphasis mine).

Re:The BBC Already did it

[ais523]

Beat the Burglar might only have targeted volunteers, but the more recent The Real Hustle didn't. (In one episode they went and fraudulently tricked a locksmith into opening someone else's house, then went in and installed secret cameras and stole things from it. Presumably according to BBC reasoning that's OK because they gave the things back and got permission to show the footage.)

Re:The BBC Already did it

[unlametheweak]

Beat the Burglar might only have targeted volunteers, but the more recent The Real Hustle didn't.

Some other example scams I've found out about:

* A deposit is taken on a car multiple times from different people who turn up to buy it.
        * A computer keyboard is replaced with one containing a key logger and bank details are obtained
        * A skimmer device is placed on a cashpoint with a pinhole camera inside it, recording the information on the user's cards magnetic strip along with their PIN; the data is then put on the magnetic strip of an e-top up card which is used to withdraw money from the victim's account
        * The Black money scam at a market stall
        * A fake hollow cash point is installed on a busy street, in which one of the hustlers hides and records the information on the user's cards magnetic strip along with their PIN number obtained from the user typing on the keypad.

(Ref. Wikipedia)

It figures that in Britain such things are not prosecuted under the law, but are taken as entertainment. If what you and the Wikipedia article state (or imply) as true (that people are unwilling and unwitting victims of unlawful acts by the British Broadcasting Corporation), then it would appear that Britains have been completely brainwashed into believing that having no rights or privacy and that being victimized by a non-government agency that is government funded is OK and par for the course. Scary!

Re:The BBC Already did it

[ais523]

It's a case of giving the money back and then hoping nobody prosecutes, as far as I can tell; not malicious, but still highly dubious and probably illegal. There will likely be a real scandal the first time they can't track down someone they've defrauded to give the money back...

Re:The BBC Already did it

[Kugrian]

Could make a good defense.

"I'm sorry your honor, but I was trying to get a job at the beeb."

Re:Agreed. Mod parent up.

[adamchou]

the BBC did not wilfully cause damage or fiscal loss

I'd bet gmail and hotmail would beg to differ with that one. It might not be much, but it definitely cost them to receive the spam that they sent.

Re:Breaking the law.....and in other news.

[Anonymous Coward]

"I doubt anything will come of it though"

In the UK the punishment does not seem tailored to fit the crime. It seems tailored to fit the offender. So I agree with you.

http://news.bbc.co.uk/1/hi/england/south_yorkshire/7939988.stm

Great news for white hat hackers in GB!

[MobyDisk]

If this exercise had been done with criminal intent it would be breaking the law.

I am so glad to know that if you hack into computers, but do it with good intentions, that it is not illegal. That's wonderful for all the white hats who have been accused of breaking-in for merely notifying people of vulnerabilities, or those who have written proof-of-concepts to kick-start lazy corporations into implementing real security measures. Fortunately, they will now all be released from jail and their reputations returned to them.

Or am I misunderstanding? Is it okay to do so long as you work for the BBC?

Gary McKinnon

[SomethingOrOther]

Better yet
When the BBC "harmlessly" pokes at 22,000 poorly secured boxen (presumably in the UK and overseas) "without criminal intent" its OK.

When Gary MacKinnon "harmlessly" pokes at a handful of poorly secured overseas boxen HAVING BROKEN NO LAW IN THE UK and also "without criminal intent" he gets extradited and faces 70 years in jail.

Double standards. No?

Re:Agreed. Mod parent up.

[Anonymous Coward]

Kudos... very good point indeed.

Illegal

[Anonymous Coward]

It has been proven in (United States) courts that even spouses are committing a chargeable act by logging into their significant other's computer without permission. I realize this was the BBC, but if they did this to even one of the computers in the USA then they are in trouble.

What OS did this low-value botnet run on

[rs232]

'Variants of Conficker use a variety of methods to spread, including exploiting the MS08-067 vulnerability in the Microsoft Windows server service patched by Redmond in October'

BBC Hacking?

[One Brave Prune]

I wonder if they are going to copyright the name "88(" next.

EtherBunny

[Amazing Quantum Man]

<KIDS-JOKE>
Knock-Knock.
Who's there?
Ether
Ether who?
Ether Bunny!

Knock-Knock.
Who's there?
Nutter
Nutter who?
Nutter Ether Bunny!

Knock-Knock.
Who's there?
Cargo
Cargo who?
Cargo "Beep Beep" and run over all the Ether Bunnies!

Knock-Knock.
Who's there?
Boo
Boo who?
Don't cry. All the Ether Bunnies be back next year.
</KIDS-JOKE>

Unbelievable

[ppentz]

Ugh, I can't stand the attitude here. Botnets are a HUGE problem. People need to know if their PCs are hijacked and they need to be fixed. If my PC is hijacked, I want to know about it. Now. When someone's PC is used in a DDOS attack, isn't that illegal activity? I've always heard that ignorance of the law is not an excuse, so if someone is not aware their PC is being used illegally, their PC is still being used for illegal purposes ... should they be held accountable? If there is an activity that is *questionably* legal but can potentially help with the Botnet problem, I'm all for it.

Re:Unbelievable

[Antique Geekmeister]

It's also potentially massively, massively destructive. Look at the history of the Morris Worm to see how a 'benign' worm, designed to report on security vulnerabilities, can do massive damage worldwide.

Re:Unbelievable

[7 digits]

Yep. The overall attitude in that article have a tremendously high suckage ratio.

10 years ago, slashdot was full of discussion about using virus to remove malware, and is now filled with wannabe lawyers whining as soon as someone does anything remotely constructive, with sentences like:

"How is changing the desktop not modification of computer material?"

"I am surprised, [...] that the BBC is not already feeling the ramifications of its actions"

"[...] this [...] actually risk becoming an international incident?"

"This is both highly illegal and unethical"

"Regardless of intent it is illegal"

bla-bla. All modded +5. Depressing.

And of course, journalists always had to do borderline legal (or plain illegal) stuff to do their job. So, of course, their lawyers said it was fine. Because it is.

Re:Unbelievable

[pbhj]

So you'd let anyone have a botnet provided they're going to tell in the end?

If you use my comp for a DDoS attack it's like you using my car for a drive-by shooting. You're using it. Not me. It's not an offence to own a car and leave it unlocked. It's not an offence to own a computer and leave it unsecured.

Re:Unbelievable

[idlemachine]

Child slavery is a HUGE problem. Maybe the BBC should demonstrate how easily they can establish a slavery ring next. Because clearly demonstrating the problem is far more important than legal & ethical behaviour...

Re:Agreed. Mod parent up.

[s0litaire]

I wondered why gmail was down again, second time in 2 weeks... Google needs to beef up it's servers :)

Re:Agreed. Mod parent up.

[orielbean]

Prosecutorial discretion would likely keep this as a non-issue in the interests of furthering public education.

Re:Agreed. Mod parent up.

[kabocox]

I've been on the bad side of this one - a lack of criminal intent does not mitigate or extenuate criminal action. Their guilt is quite plain (having been admitted, even published by the BBC itself). Now, their lack of criminal intent does have a bearing on sentencing. Inasmuch as the BBC did not wilfully cause damage or fiscal loss to anybody (except, potentially, themselves?), the sentence should be something on the light side, perhaps even suspended; but the matter of their guilt is simple black-letter law.

These guys need to be chucked in jail ASAP. Why? They wonder why their youth has no respect for the law. It's because things like this are allowed to slide. Nailing these folks will make more of the knife youth pay attention to the system than almost anything else the government could easily do.

Re:I CHALLENGE THE BBC TO DO THIS TO U.S. COMPUTER

[LingNoi]

Since they were sending spam to Google and Microsoft servers they most likely are breaking US law and can be extradited. Perhaps you should inform US police to look into it.

Okay, let's try again.

[mmell]

If the law is not applied uniformly and evenly to all, it is no longer law - it becomes rules - as in, one set of rules for you, one set of rules for me.

Guilt is not a variable. The law in most places accomodates this by permitting sentence flexibility at judgement. I.e., BBC may never pay one pence in damages nor suffer any legal sanctions because they didn't do anything wrong, but they are still guilty of a violation of law.

In this instance, a sentence of zero punishment may make sense, but that does not change the fact that the BBC knowingly and intentionally did something they knew to be illegal. They intentionally broke the law, and then boasted about it.

That's the problem with analogies - they break down sooner or later. Fine. I'll drop the analogy. Question for you - did the BBC break the law? Never mind if punishment is in order, did they break the law?

If not, I want their set of rules instead of mine. I've got a few people who need an appointment with a clue-by-four.

Re:Okay, let's try again.

[Spatial]

If the law is not applied uniformly and evenly to all, it is no longer law - it becomes rules - as in, one set of rules for you, one set of rules for me. Guilt is not a variable. The law in most places accomodates this by permitting sentence flexibility at judgement. I.e., BBC may never pay one pence in damages nor suffer any legal sanctions because they didn't do anything wrong, but they are still guilty of a violation of law.

If that's the point you were making before then we're in agreement. I don't dispute this condition, the law should apply to everyone equally. I didn't mean my posts to look like I'm saying, "Nah the law doesn't apply to these guys," - I'm not - but rather that it shouldn't be the sole focus in consideration of the story.

In this instance, a sentence of zero punishment may make sense, but that does not change the fact that the BBC knowingly and intentionally did something they knew to be illegal. They intentionally broke the law, and then boasted about it. [...] Question for you - did the BBC break the law? Never mind if punishment is in order, did they break the law?

I honestly don't know about that. People here are quick to say they're in violation of such-and-such, but laws have non-intuitive exceptions and conditions and that's why we have lawyers. They aren't lawyers so I'll take those accusations with a grain of salt.

As for whether it was intentional if they did: someone else posted a quote further down showing that they got legal advice beforehand. Surely they were told it wasn't illegal since that's what the article repeats. As a result I don't think it was intentional. They probably said what they did so it would look 'edgy', as opposed to boasting.

Unlawful acts

[Locke2005]

If this exercise had been done with criminal intent it would be breaking the law.

"Your honor, I just pointed the gun in a random direction and pulled the trigger. If this exercise had been done with criminal intent it would be breaking the law. But since I had no intention of actually shooting someone, only demonstrating what can happen when a gun goes off, I consider this perfectly legal! And please, give my condolences to their next of kin."

I'm sorry, but intent can never be proved in court. Penalties need to be assessed based on outcomes, not intent. Accidentally kill somebody with your car, and you go to jail for involuntary manslaughter, even if your intentions were perfectly innocent. And this wasn't an "accident", it was a deliberate violation of computer security and privacy laws. If a news reporter sells drugs to school kids to prove how easy it is to do, he's still gonna go to jail!

Re:Unlawful acts

[denzacar]

Accidentally kill somebody with your car, and you go to jail for involuntary manslaughter, even if your intentions were perfectly innocent.

Ummm... no.

It has to be proven that it is YOUR fault.
If your breaks just die on you and you fail to stop your vehicle due to a manufacturing error, or you skid off the road due to a oil stain or ice on the said road - that is not your fault.
On the other hand, if it can be proven that you go around claiming that you refuse to maintain your vehicle (change oil, breaks, do check-ups...) because it is a part of a global conspiracy to sell you things - you probably have another thing coming.

If a news reporter sells drugs to school kids to prove how easy it is to do, he's still gonna go to jail!

If a news reporter sells packets of sugar or oregano to kids there is nothing to base the charge on.
Also, if a reporter contacts the law enforcement prior to the act, and does it under the supervision of the said law enforcement, reporter would not be criminally charged any more than an police officer would be if he/she did it as a part of a under-cover operation.

Re:Unlawful acts

[Locke2005]

If a news reporter sells packets of sugar or oregano to kids there is nothing to base the charge on. I don't know... if I was the kids, I'd be tempted to file fraud charges against the reporter! Am I the only one out there that calls the cops when somebody sells me some bogus drugs?!?

Re:Unlawful acts

[Locke2005]

It has to be proven that it is YOUR fault. Not in Oregon. Under House Bill 3314, if your car comes into contact with a bicycle, it is automatically assumed to be your fault.

Re:Unlawful acts

[denzacar]

Not in Oregon.

Well... Oregon law-givers also found it prudent to legislate and penalize carrying a child on an external part of the vehicle, such as hood, fender or a running board.

www.dumblaws.com/law/1416
811.205 Carrying minor on external part of vehicle;
penalty

Full text of the Law
811.205 Carrying child on external part of vehicle; penalty.

(1) A person commits the offense of carrying a child on an external part of a motor vehicle if the person carries any child upon the hood, fender, running board or other external part of any motor vehicle that is upon a highway.

(2) The offense described in this section, carrying a child on an external part of a motor vehicle, is a Class B traffic violation.

[1983 c.338 604; 1995 c.383 53]

Re:Unlawful acts

[Ant P.]

If you're seriously comparing this to murdering someone... as opposed to, say, shooting them with a water pistol, you are seriously fucked in the head.

Don't be daft.

[Anonymous Coward]

I'm modifying your data! I'm in your web cache right now!!!!

Arrest me!

Be pedantic all you want. Welchia aside, we should honor the gray wizard(s) they let the mundanes know what's going on.

UK Law

[Kryptic Knight]

Police and Justice Act (2006)

Go read it and then wonder how the BBC can seriously think that they are immune to section 36,3.6

BBC

[Anonymous Coward]

To be honest, I wouldn't be surprised if the bbc were in the business of distributing genuine malware.

Important to remember that they still have those disgusting phone lines ripping off the consumers that pay for their champagne parties; it wasn't too long ago that they were found to be behaving in a thieving manner with respect to these "competitions."

The license fee is daylight robbery when you consider the drivel they put out. The Brand/Ross business just added insult to injury - anyone with half a brain can see that they're rotten to the core.

Mod parent up - The BBC Already did it

[Acer500]

Lol I had to look it up. Sadly it seems that they didn't use the format as they should.

I'd like to see them try to break into my father's house, though (I hope he didn't set up anything lethal :) )

Re:Agreed. Mod parent up.

[sjames]

Interestingly, if a 13 year old did exactly the same thing just to see if he could, HE would likely see prosecution (if it's anything like in the U.S.) even though arguably his culpability should be LESS because he lacks the maturity to fully appreciate the serious nature of the act and the potential for things to go very badly.

Done without criminal intent? So what?

[nurb432]

Umm no, its still illegal unless the laws have changed. Doesn't matter what your intent was.

That argument didn't work for Kevin, it shouldn't work for the BBC either.

I think it's part of the MSIE EULA

[Cajun Hell]

Even if your intentions are good, I DO NOT WANT you using my computer or making changes to it without my permissions.

"By running MSIE, you agree..."

Seriously, how many years of experience do people have to have with a piece of bad software, before they take responsibility for what they know that it does?

Re:Now this... BBC acted illegally.

[pbhj]

Yeah they paid £6k of public money to known criminals and knowingly broke the law for the sake of some sensationalist journalism .. what's not to like?

So the researchers at the BBC are allowed to break the law (and spend public money doing it) but other people who're "investigating" computers that don't belong to them get extradited? [ http://news.zdnet.co.uk/security/0,1000000189,39619206,00.htm ]

I'm not saying McKinnon is blameless incidentally.

I don't care who's cracking someone's computer or controlling a botnet, it's wrong and they should be punished for it.

Not always true actually

[snowwrestler]

a lack of criminal intent does not mitigate or extenuate criminal action.

Not always true. For many actions intent does in fact matter in whether it is considered a crime (for example in the U.S., showing someone a gun). However you are correct that some crimes are simply a matter of action regardless of intent, and in those cases intent can mitigate the punishment. I don't know how the U.K. treats this sort of computer crime but I would not just assume that it is a strict liability.

This post explains the concept in far greater detail than I could have.

So they're ok if I hack their website / networks?

[thetoadwarrior]

I don't want to harm the BBC. I'm just teaching myself stuff.

Not spam

[snowwrestler]

By definition, e-mail you send to yourself is not spam. (Unless you have multiple personalities maybe.)

Wiggle room

[snowwrestler]

The wiggle room is in bold:

"A person is guilty of an offence if at the time when he does the act he has the requisite intent and the requisite knowledge to cause a modification of the contents of any computer and by so doing impair the operation of any such program or the reliability of any such data."

So you would need to prove that not only did the BBC access the botnet, but also that they did so with the intent to wreck software or data on those computers. It might be tough to prove as the BBC could argue that their intent was a non-destructive demonstration in the service of the public good. I think that is a common argument for journalists.

They send the f.... bailifs.

[jotaeleemeese]

Got it?

After a court find you liable according to the law of the land. And imprison you for breaking it.

Just try stoping any debts you have and you will be in deep doo-doo, but that does not mean that your creditor is in a dark alliance with the government.

Re:They send the f.... bailifs.

[commodore64_love]

>>>After a court find you liable according to the law of the land.

Uh... you really haven't answered my question. A credit card does not have the power to force me to pay some arbitrary fee on a device (like my chair, for example). Where does the BBC's power to charge fees on TVs and PCs come from?

And as for bias...

[jotaeleemeese]

The relentless pressure from the government, to the point that has forced out general directors, tells us that the BBC is applying journalistic pressure where it is hurting.

Both Conservative and Labour government and parties have complained at one time or another of bias from the BBC.

Well, if everybody says that that means the BBC is hunky dory.

Unfortunately he has got a point.

[jotaeleemeese]

An UK based hacker that broke into US's government computers is close to be extradited to the US and to face the music of the insane laws over there.

Unethical?

[jotaeleemeese]

So raising the alarm is unethical?

Gee, glad to know. Death to all whistle-blowers.

Re:Agreed. Mod parent up.

[Cederic]

It is not in the public interest to have media organisations misusing computers belonging to other people in order to pursue a story.

Admittedly Crimestoppers refused to take the details and told me to ring the police, who have left me on hold for ages.

By Neruos

[Anonymous Coward]

When a big corporation or government does it: It's a lesson.
When a person does it: It's a crime.

Botnets: a cheap legal alternative to server farms

[holizz]

Instead of buying or renting a server farm (or using cloud-computing services), why not buy a botnet or build your own?

Re:Agreed. Mod parent up.

[Simetrical]

I've been on the bad side of this one - a lack of criminal intent does not mitigate or extenuate criminal action. Their guilt is quite plain (having been admitted, even published by the BBC itself). Now, their lack of criminal intent does have a bearing on sentencing. Inasmuch as the BBC did not wilfully cause damage or fiscal loss to anybody (except, potentially, themselves?), the sentence should be something on the light side, perhaps even suspended; but the matter of their guilt is simple black-letter law.

Unless they're not prosecuted. Prosecutors are not obliged to file charges if they don't feel it would be the best use of their limited resources.

So...

[Anonymous Coward]

This is what my fucking license fee is being spent on these days.

Re:So...

[Anonymous Coward]

I know!

Pretty cool eh?

A tax by any other name... still smells like shit

[Anonymous Coward]

"it's raised independently of the government and is specifically not a tax"

If it's not a tax, then this is an optional licence fee? What would happen to someone who doesn't pay?

Anonymous Coward.

[Anonymous Coward]

Could that be that BBC infected their own PCs for this "experiment"? Last time I checked the company had 25K employees. Most of them, I am sure, are givem company's hardware...

Re:Botnets: a cheap legal alternative to server fa

[iiiears]

"Tragedy of the commons" - Someone paid for the intermediate bandwidth everyone paid with time because traffic slowed. Network neutrality indeed...

Did they break the law?

[CrazyCanucklehead]

The question is, did they break the law? http://research.zscaler.com/2009/03/botnets-for-everybody.html

Still Illegal?

[anotherslashfan]

Maybe it's a unique law over the pond, but I thought in the states this "demonstration" by the BBC would still be considered illegal?