BBC Illegally accesses 22,000 computers, claims "wasn't illegal".

[KarlGoddard]

Maybe ITV could run with the story on national news. Or get Trevor MacDonald to introduce and conclude a special programme presented entirely by Jonathan Maitland

 

I bet Rory Cellan Jones doesn't tweet about it though:D

[CHR1S]

I don't think you could because smashing a window to put a fire out is not the same as taking advantage of a computer to do illegal tasks. Otherwise we'd be saying stealing a car is OK if the door was unlocked, tripping someone over because their shoe lace was undone etc.

 

I am supportive of spreading the word, but it's not as though BBC Crimewatch go out and beat up old people in their homes to show their case; they use real world examples and mock ups (the mock ups being outlined earlier in VMs).

 

I think your point is more valid, that its still wrong, but surely the analogy would be more like, opening the unlocked car door to set the alarm off (I know its not quite like that coz the alarm would be off) but we could do this all day.

 

If my network was insecure, I would prefer a person to use the exploit to notify me so I can correct it before a more unscrupulous person used it for their own gain. Is it a case of moral justification? Or shoud it all be wrong?

[AngryTechnician]

For me the issue is not whether they were justified or not in doing what they did, but that they are saying it was not illegal, and will presumably say the same when the full program is broadcast on Sunday.

 

This is simply and unequivocally incorrect; the BBC are telling people something is legal when it isn't. That's bad reporting, and bad reporting of the law can have much bigger consequences than what they did for their programme.

 

Consider this hypothetical situation:

 

"We went out at 2am and drove our Vauxhall Astra at 130mph on an empty road in the middle of nowhere. If this was done on a busy street, it would be breaking the law, but our purpose was to demonstrate the power of this car in the hands of criminals."

 

Over the following week, more than a dozen Vauxhall Astra drivers across the country get arrested doing 120mph at 2am because they wanted to see for themselves, and the BBC said it wasn't illegal. They are subsequently given automatic driving bans for exceeding 100mph on a public road.

 

Unfair comparison or not?

[Michael]

I don't actually understand the purpose of this exercise and there are plenty of websites with accurate descriptions of what a botnet is and how it works. We don't need a real life demonstration.

 

It's nice to see the BBC putting the license fees to good use. Just another reason why it should be abolished in my opinion.

 

It's just as bad as someone saying "I created a virus to infect thousands of machines, just to see what happens, or get a reaction"

[kmount]

I think your point is more valid, that its still wrong, but surely the analogy would be more like, opening the unlocked car door to set the alarm off (I know its not quite like that coz the alarm would be off) but we could do this all day.

 

If my network was insecure, I would prefer a person to use the exploit to notify me so I can correct it before a more unscrupulous person used it for their own gain. Is it a case of moral justification? Or shoud it all be wrong?

 

I think we're both on the same train of thought, and I respect and take your opinion as you did mine.

[KarlGoddard]

I don't actually understand the purpose of this exercise and there are plenty of websites with accurate descriptions of what a botnet is and how it works. We don't need a real life demonstration.

 

It's nice to see the BBC putting the license fees to good use. Just another reason why it should be abolished in my opinion.

 

It's just as bad as someone saying "I created a virus to infect thousands of machines, just to see what happens, or get a reaction"

 

exactly!

 

There is no legitimate justification for what they did. It was just reckless, sensationalist 'journalism'.

[cjohnsonuk]

With Gary McKinnon fighting to avoid extradition to the states for cracking/hacking the Pentagon and NASA (IIRC) then you would have thought that the seriousness of this type of offense would be pretty high up in their consciousnesses!

He made no changes at all (allegedly) and faces life in jail.

 

How did the BBC know that their bots wouldn't get installed on a PC in a bank or a military establishemnt or a hospital? What if the desktop screen change crashed a PC running someones life support? (it was targetted at MS Windows so this might be possible! ;0) What about the hours spent tracing the perpetrator and undoing the changes. If it took 1 minute to undo each change thats still 15 days of technician time working flat out or 45 working days. If 10% of users placed a call out for tech support at a cost of £50 for the call out and fix that's £110k of additional call outs placed!

 

Somewhere deep inside me I really want to see what would happen if one of the PCs infected was a military PC and that the code they used had a bug in it that opened up a back door for the original writer of the code to gain access. I'm presuming here that they used a script kiddie kit rather than writing their own from scratch? Why create your own bot net when you can get a script kiddie to do the distribution and take the rap for it and then you just exploit a bug you put in the script to give you access to the existing infected machines....

[mac_shinobi]

This was blatantly illegal. There is no arguing about intent, as they are using the wrong idea of intent. The knowledge that gaining access to other computers is illegal was there, therefore they have mens rea.

 

Just because the outcome wasn't one with damages being seen by the victims doesn't mean it is not illegal.

 

Look at it this way, they utilised power, processing time, and bandwidth that is the sole possession of the victims. That victim paid for the power to run the computer, paid for the broadband, and may have a cap, so some of their bandwidth will now have been used up, and the processing time will have added wear to their equipment.

 

If I went into a store and stole a chocolate bar, ate it and then went back in and said 'see, this is where your security is lacking, it would make it no less of a crime!

 

Totally agree and with regards to having someone do this and be shown that my security lacked I would much rather just be told and if I did not believe them then to have them show me the security flaw / risk and then be told / shown how to resolve it

[srochford]

I'm not really going to defend the BBC's action but given the seriousness of the problems caused by botnets, do you not think that news organisations should be making massive efforts to educate the general public about the risks to which they are exposed?

 

Running their own botnet might not be the best idea but setting up a simulation in a studio is pointless - people would look at it and say "that's not real" (because it obviously wouldn't be). This is very real and it might just make a few people think "How do I make my computer secure"

[contink]

Been thinking about this off and on most of the day and I've come to one conclusion.

 

Why is it that it's this flipping simple to access a botnet and then notify the owners of the machines that their machine is compromised and NOBODY HAS DONE IT?

[powdarrmonkey]

Been thinking about this off and on most of the day and I've come to one conclusion.

 

Why is it that it's this flipping simple to access a botnet and then notify the owners of the machines that their machine is compromised and NOBODY HAS DONE IT?

 

....because it's illegal?

[contink]

....because it's illegal?

 

This is what I love about the common sense vs' legal system thing in this country...

 

Why is it sensible to leave all these compromised machines out there and not do a damned thing about it when they will almost certainly be used for illegal acts?

 

It's like saying we know you have a gun and that someone is going to use it to shoot someone but we can't take it from. Even AFTER they've shot someone!

 

Bloody lunacy!

[AngryTechnician]

Why is it that it's this flipping simple to access a botnet and then notify the owners of the machines that their machine is compromised and NOBODY HAS DONE IT?

 

Of course the programme doesn't air until Sunday, but I would imagine they had to pay for access to the botnet. It's not as if the people setting these things up are going to do it for free.

 

If this was indeed the case, it means that licence fee money has now been used to directly fund organised crime.

[torledo]

I'm not really going to defend the BBC's action but given the seriousness of the problems caused by botnets, do you not think that news organisations should be making massive efforts to educate the general public about the risks to which they are exposed?

 

Running their own botnet might not be the best idea but setting up a simulation in a studio is pointless - people would look at it and say "that's not real" (because it obviously wouldn't be). This is very real and it might just make a few people think "How do I make my computer secure"

 

from the article to counter the 'educate the public' or any 'public interest' angle re the bbc's reasoning/justification.

 

but surely there are ways of raising awareness of threats without breaking the law?

 

I'm also glad someone brought gary mckinnon up, as far as i'm aware mckinnon didn't use a network of 22,000 machines to send spam, or go to the lengths the bbc went to in trawling of internet chatrooms to pick up a low-level botnet - didn't mckinnon use a humble dial-up modem ? ....and yet mckinnon faces extradition to the US and a possible jail term.

 

Questions also need to be raised regarding whether any monies were paid to secure this botnet

If our authorities can't protect our own citizens like Mr. Mckinnon from foreign states, then the least they can do is investigate and preferably throw the book at the bbc for being so premeditated in these actions. Otherwise it's double standards surely ?

[torledo]

This is what I love about the common sense vs' legal system thing in this country...

 

Why is it sensible to leave all these compromised machines out there and not do a damned thing about it when they will almost certainly be used for illegal acts?

 

It's like saying we know you have a gun and that someone is going to use it to shoot someone but we can't take it from. Even AFTER they've shot someone!

 

Bloody lunacy!

 

so what do you suggest ? the purchasing of all these botnets so as to protect the public ?

 

isn't that funding illegal activity ? or is it a hmrc/liechtenstein type thing ? the hmrc are/were in the dark about tax activities in the tax haven principality, so when the chances of purchasing STOLEN banks details arise they jump at the chance so as to achieve some 'greater good' and gain better insight inspite of effectively funding a criminal act. that isn't common sense vs legal thing, that's doing something because you can. Institutions like the hmrc and the bbc know they can get away with it citing the reasons mentioned, an individual or a group of committed individuals seeking to achieve similar results might not find such leniency from the long arm of the law. it's not common sense vs legal system, it's a case of two legal systems.....one for the authorities [including the bbc apparently] and it appears another one for the average joe or jane.

 

Clamping down on this type of botnet activity requires international coordination and is probably not at all simple becuase doubtless botnets are springing up all the time. i'm only hazarding a guess as to why, the programme will doubtless tell us a solution, or maybe not.

[tech_guy]

To borrow a line from the Not the Nine O' Clock News' Points of View spoof, "The BBC is a load of crap!".

[NeoPlosive]

I think I'd be pretty if the BBC changed my wallpaper.

 

Can you be charged for the same crime 22,000 times? They'll get away with it anyway.

[RabbieBurns]

I think I'd be pretty if the BBC changed my wallpaper.

 

 

Can you be charged for the same crime 22,000 times? They'll get away with it anyway.

 

sure if you murdered 22000 people you would be charged with murder for each

[Theblacksheep]

Three years for throwing a shoe.

 

infected iraqi gov PC

[torledo]

Three years for throwing a shoe.

 

infected iraqi gov PC

 

i know, can you believe it.

 

and he missed. so it's 3 years for pelting a shoe and missing.

[KarlGoddard]

if someone downloaded 22000 images of child porn just to prove how easy it was to get hold of, would they get away with it?

 

I somehow doubt it

[RabbieBurns]

turns out they paid "thousands" for this botnet... out of our license fee!!

[powdarrmonkey]

turns out they paid "thousands" for this botnet... out of our license fee!!

 

And you're surprised because...?

 

It's not possible to just 'create' a botnet, it had to come from somewhere. Quickest, easiest, most journalistic way: buy one that someone's already got.