pete Posted March 13, 2009 Posted March 13, 2009 To demonstrate how botnets work, the bbc used 22,000 compromised computers in their own botnet for their "Click" program. They claim they didn't break the law because they didn't do anything naughty with the botnet. BBC Site: BBC NEWS | Programmes | Click | BBC team exposes cyber crime risk Graham "CakeMonster" Cluely comments: Did BBC break the law by using a botnet to send spam? | Graham Cluley's blog Securiteam blog that brough it to my attention: SecuriTeam Blogs » It’s fun being other people
kmount Posted March 13, 2009 Posted March 13, 2009 Short sighted of them to say they didn't do anything wrong because they didn't do anything naughty but tbh, I think it's a powerful idea that they've brought to the surface. My concern is how they were able to then contact individual people to advise them of the infection; did the ISPs cough up personal details because it was the BBC, or have the BBC merely advised ISPs through their abuse@ chains?
localzuk Posted March 13, 2009 Posted March 13, 2009 This was blatantly illegal. There is no arguing about intent, as they are using the wrong idea of intent. The knowledge that gaining access to other computers is illegal was there, therefore they have mens rea. Just because the outcome wasn't one with damages being seen by the victims doesn't mean it is not illegal. Look at it this way, they utilised power, processing time, and bandwidth that is the sole possession of the victims. That victim paid for the power to run the computer, paid for the broadband, and may have a cap, so some of their bandwidth will now have been used up, and the processing time will have added wear to their equipment. If I went into a store and stole a chocolate bar, ate it and then went back in and said 'see, this is where your security is lacking, it would make it no less of a crime!
AngryTechnician Posted March 13, 2009 Posted March 13, 2009 (edited) Computer Misuse Act 1990 1 Unauthorised access to computer material (1) A person is guilty of an offence if— he causes a computer to perform any function with intent to secure access to any program or data held in any computer; the access he intends to secure is unauthorised; and he knows at the time when he causes the computer to perform the function that that is the case. Seems pretty clear to me. Doesn't matter what you do with it, the fact it was unauthorised makes them guilty of an offence. If they had done something naughty with their access, that would in fact be a more serious offence under the part of the law immediately following the part quoted above ("unauthorised access with intent to commit or facilitate commission of further offences"). Where there would be wiggle room would be whether it is in the public interest to pursue a conviction, but I don't think there is any doubt over whether a offence was committed. Edited March 13, 2009 by AngryTechnician Spelling
tech_guy Posted March 13, 2009 Posted March 13, 2009 Yeah I read this yesterday and was gobsmacked to say the least. The BBC did something very naughty and it will be interesting to see if any criminal proceedings are brought.
RabbieBurns Posted March 13, 2009 Posted March 13, 2009 BBC programme broke law with botnets, says lawyer | OUT-LAW.COM
zag Posted March 13, 2009 Posted March 13, 2009 Great to see the BBC investigating issues like this, really brings it to the wider audience.
pete Posted March 13, 2009 Author Posted March 13, 2009 I personally hope they throw the book at the whole production team and anyone involved. There's no compelling reason why the bbc couldn't set up 50 vms, desktops or whatever to demonstrate this using their own legally-owned hardware. Instead they tried to be cute and should be jailed. Bunch of idiots.
maniac Posted March 13, 2009 Posted March 13, 2009 My concern is how they were able to then contact individual people to advise them of the infection; did the ISPs cough up personal details because it was the BBC, or have the BBC merely advised ISPs through their abuse@ chains? From the sophos site . . Furthermore, at the end of this next excerpt you'll see that the BBC "warned" the users that their computers were part of a botnet. They did this by changing the desktop wallpaper of affected computers owned by innocent third parties to display a message from BBC Click. That's how. Worrying yes, surprising no and I'm not really worried myself, as I take all precautions against this sort of thing. It doesn't really change anything except make people more aware of the issue, which is being done even more effectively now because of these news articles. Looks like mission accomplished to me, even if they may have broken the law to do it. Mike.
jamesb Posted March 13, 2009 Posted March 13, 2009 Short sighted of them to say they didn't do anything wrong because they didn't do anything naughty but tbh, I think it's a powerful idea that they've brought to the surface. My concern is how they were able to then contact individual people to advise them of the infection; did the ISPs cough up personal details because it was the BBC, or have the BBC merely advised ISPs through their abuse@ chains? I believe they changed the desktop backgrounds on the computers. Illegal in its own right.
cjohnsonuk Posted March 13, 2009 Posted March 13, 2009 If the tech team at the BBC are naive enough to believe that gaining unauthorised access to a computer is legal then both they, the legal team that should have advised them and the management that should have ensured that the legal team advised them should be hung out to dry. What message does this send out? Can you imagine: "BBC reporters steal cars from public car parks and car showrooms to highlight poor security in todays car design" , "But its OK to do that as it was all in the name of public interest and the cars were returned to the public car parks a month later." or worse "The cars were returned to the owners who were identified when a government department gave out the contact details of the registered drivers to a BBC researcher" Not that I ever did respect their technical know how but really puts a nail in the coffin. I don't know whether I'm just getting old and grumpy but I'm finding more and more BBC (and other news) reports are often going for a story rather than news and are presenting the facts in a biassed or inaccurate way that influences society. E.g. There was a report on yesterday about someone who had committed a crime. "the man, who has recently suffered from XYZ disease, did crime ABC" Where's the relevance in stating his recent ailment? Is that an excuse? Should we feel sympathy that he had a runny nose? Take another example : the recent snow. "It was chaos". No it wasn't, it was a minor inconvenience. People incapable of driving in snow went out ill prepared. Snow chains cost £50. I got places where 4x4s couldn't go in a lowly 2WD hatchback. If you can't afford them stay at home. Or stick to gritted roads. Or get a lift from someone who can drive in snow. There really was no excuse for 90% of the driver who got stuck. And the weather... Rain is always described as "miserable". The weather has no emotion. They are brainwashing us to associate anything that isn't sunny with unhappiness. If it rains put a coat on not a sad face! No wonder there is so much depressiosn in the country! Pheww. That feels a lot better. ChrisJ 1
kmount Posted March 13, 2009 Posted March 13, 2009 I believe they changed the desktop backgrounds on the computers. Illegal in its own right. LMFAO. So.. "Hai, we're from the BBC, you're infected, nip to PC World and get your PC sorted out".. Seriously, that's just ridiculous.
ZeroHour Posted March 13, 2009 Posted March 13, 2009 Was Jonathon Ross involved? If he was it'll be Ok Imagine the background they would have set it he was
pete Posted March 13, 2009 Author Posted March 13, 2009 LMFAO. So.. "Hai, we're from the BBC, you're infected, nip to PC World and get your PC sorted out".. Seriously, that's just ridiculous. That's the best bit, from a POV. 1) Anyone around the world who had their computer accessed by the bbc has evidence that they were the perpetrator. Cue hilarious international legal beagling. 2) Any botnet herder worth his salt is going to ensure he takes advantage of bbc click branding: "Hi, we're from bbc click and you're infected, just click here to fix the problem".........
pscott Posted March 13, 2009 Posted March 13, 2009 This is not anywhere near as bad as newspaper reporter's carrying knives thrugh airports to show bad security
kmount Posted March 13, 2009 Posted March 13, 2009 That's the best bit, from a POV. 1) Anyone around the world who had their computer accessed by the bbc has evidence that they were the perpetrator. Cue hilarious international legal beagling. 2) Any botnet herder worth his salt is going to ensure he takes advantage of bbc click branding: "Hi, we're from bbc click and you're infected, just click here to fix the problem"......... Wouldn't it be ironic if they had connected to hosts in Turkey, China, Russia etc? I can see why they did it to highlight the dangers but like said before they could have done it in a less ... stupid ... way.
zag Posted March 13, 2009 Posted March 13, 2009 This is not anywhere near as bad as newspaper reporter's carrying knives thrugh airports to show bad security Exactly.
mpe Posted March 13, 2009 Posted March 13, 2009 To demonstrate how botnets work, the bbc used 22,000 compromised computers in their own botnet for their "Click" program. They claim they didn't break the law because they didn't do anything naughty with the botnet. The only way they chould have not broken the law would have been to have prior approval from all of the computer owners. Even with this their spamming and dDOS activities could well be questionable if they affected any third parties. e.g. if an ISP was hosting the email accounts they used. Presumably everyone involved with also be defending Gary McKinnon (and demanding that he be paid compensation for his ordeal).
mrcrazy04 Posted March 13, 2009 Posted March 13, 2009 (edited) I believe they changed the desktop backgrounds on the computers. Illegal in its own right. Yeah, that takes it into Section 3 of the Computer Misuse Act, which has bigger penalties. Edited March 13, 2009 by mrcrazy04 Referenced the wrong section of the law
CHR1S Posted March 13, 2009 Posted March 13, 2009 How else would you enlighten the masses to the problem then? To put it how I see it, its like breaking someones window to put out a fire inside their home. Yes its illegal but I would rather have to replace a window than my whole house. Can you apply that logic to this situation?
webman Posted March 13, 2009 Posted March 13, 2009 Maybe ITV could run with the story on national news. Or get Trevor MacDonald to introduce and conclude a special programme presented entirely by Jonathan Maitland
kmount Posted March 13, 2009 Posted March 13, 2009 How else would you enlighten the masses to the problem then? To put it how I see it, its like breaking someones window to put out a fire inside their home. Yes its illegal but I would rather have to replace a window than my whole house. Can you apply that logic to this situation? I don't think you could because smashing a window to put a fire out is not the same as taking advantage of a computer to do illegal tasks. Otherwise we'd be saying stealing a car is OK if the door was unlocked, tripping someone over because their shoe lace was undone etc. I am supportive of spreading the word, but it's not as though BBC Crimewatch go out and beat up old people in their homes to show their case; they use real world examples and mock ups (the mock ups being outlined earlier in VMs).
brookesandrew Posted March 13, 2009 Posted March 13, 2009 I just hope several of those people whose computers were accessed and had the wallpaper changed actually report the crime and the BBC production team get "done". Just so ITV or maybe the BBC can do a follow up to the programme reporting how good the computer misuse laws are, lol. I just hate the present attitude of journalist which seems to be: "i'm a journalist, as long as I write a related story I can break any law and get away with it".
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now