U.K. Outlaws Denial of Service Attacks 239
gnaremooz writes "A U.K. law has been passed that makes it an offense to launch denial-of-service attacks. The penalties for violating the new statues are stiff, with sentences increased from 5 to 10 years. The five year penalty was from the 1990 "Computer Misuse Act", which was enacted before the Internet became widespread. The idea of stiffer penalties for DoS attacks are probably something we can all get behind, but the language of the law is frustratingly vague." From the article: "Among the provisions of the Police and Justice Bill 2006, which gained Royal Assent on Wednesday, is a clause that makes it an offense to impair the operation of any computer system. Other clauses prohibit preventing or hindering access to a program or data held on a computer, or impairing the operation of any program or data held on a computer."
Another law (Score:5, Insightful)
Another law with good intent.
Another set of wording so vague it's no use against those it's meant to stop.
Another set of abuses waiting to happen.
Hindering Access (Score:5, Insightful)
This is a pretty good description of DRM! So it's illegal now?
Good intentions (Score:4, Insightful)
Re:Where is the real damage (Score:5, Insightful)
I don't think anyone here denies that it is important if websites go down. It can cot businesses millions if their website is not available to customers. If DDOSing hurts business, then why should it not be a civil issue? Let the civil jurisdiction deal with it, because it certainly isn't something that is worthy of jail time.
Stupid idea (Score:1, Insightful)
If this is going to be a criminal case, a year in jail in addition to computer-banishment would be proficient. One, it prevents the person from repeating the crime. Two, it's going to be unpleasant for someone to spend a year in jail, not to be confused with prison, for something as physically harmless as denial of service attacks.
However, if a denial of service attack affects a medical institution or is against the government, then it needs to be a crime.
Cutting off nose to spite face much? (Score:4, Insightful)
First of all, economically that's a moronic decision. Jail costs the state between 20-30 thousand dollars a year depending on where it is. Unless someone is DDosing Amazon, and here's where the vague wording of the law is an important shortfall, we're spending hundreds of thousands of dollars punishing someone who did perhaps a few thousand dollars worth of damage. That's bad economics, and I'm sure that money could be better used say, feeding the starving or allowing someone to go to college who otherwise wouldn't be able to.
Second of all, the kind of person you're going to be able to catch is not the person you want to throw in jail. We already have laws to punish people who run large botnets, and moreover by and large experienced blackhats won't be caught because they administrate their nets from countries ending in -stan. So the people who this legislation will put in jail will by and large be stupid college kids and people making a bad, poorly thought out decision as evidenced by the fact that they're using their home computer. These people need to be slapped with a big fine to they smarten them up, and then allowed to contribute to society.
This should be a poster case of a crime that should not carry criminal penalty.
Mustn't impede criminals, must we? (Score:2, Insightful)
Or to load the ladvampire [aa419.org] to use up the daily file transfer allowances on 419er's fraudulent "banks"....
Re:Another law (Score:3, Insightful)
Re:Hindering Access (Score:5, Insightful)
Oh well, try getting them to act (Score:5, Insightful)
What's the point in making the term of sentance tougher, if there aren't any resources to investigate online crime in many UK forces?
Re:Hindering Access (Score:3, Insightful)
DRM and Encryption are both authorised act's. And... saying "you" don't authorise DRM on your PC isn't good enough, the UK laws allowing DRM override your own de-authorisation.
With encryption in general though, if you had a falling out with your employer and you encrypted his drive, then you would be guilty. Encrypting your own drive though is certainly legal and allowed. (Mind you in the UK you are required to hand over your keys to the police if lawfully requested).
IANAL.
What about encryption? (Score:2, Insightful)
Also I totally agree with the earlier statement on REAL damage. Say a company's website is down and they sell things online. Someone who was really intent on buying something from that website will wait until its back up. Someone who was just shopping around will likely continue to do so, and the casual websurfer would pass it by, perhaps trying again later. They're really not LOSING any business, they're merely delaying it till later. How many individuals'/organisations' business would they honestly lose? There's no way of knowing, so they just pull a number out of their ass and say "This much!" and expect to be rewarded that amount, plus legal expenses of course.
Now say the victim is an individual in their home. Can they claim damages under this law? Most likely not since they're not "losing" anything (in a business sense), other than access to a service they've paid for. Sure you can ring up your provider and complain but they'll probably blame it on you and tell you its your computer being full of spyware and viruses and you should reinstall Windows. If you tell them you run *nix they'll probably say I'm sorry that's not supported we can't help you. Big firms (*cough* BT *cough) are all too happy to blame the customer first.
So what this boils down to is that we've now got yet another lovely new law that's beneficial to big business and no one else. Oh happy day!
Cam
Re:Impair, you say? (Score:4, Insightful)
Maybe. But more likely it means you can be prosecuted for installing a browser. The only purpose of a browser is to use the bandwidth and cpu time of some other computer. That obviously interferes with anything running on that computer, impairing it for all other users.
Re:Cutting off nose to spite face much? (Score:2, Insightful)
>> we're spending hundreds of thousands of dollars punishing someone who did perhaps a few thousand dollars worth of damage
2. Your argument is completely nonsensical. Catching and punishing criminals is always more expensive than the simple monetary value of their potential damage. However if we used that argument we wouldn't bother to lock up murderers for life. The value in locking up criminals is not monetary value but in the stabality of society.
Re:Where is the real damage (Score:2, Insightful)
The problem with tagging some sites is that they can get millions of hits per day. Down time can cost a helluva lot. It would be more like vandalising voting booths on election day; Lots and lots of people would be inconvenienced.
Re:One law for the rich ... (Score:2, Insightful)
Why wouldn't do you think the law would protect you? If someone did DoS your broadband, then yes, they could be charged as a criminal. I don't know how else it could be.
Re:Hindering Access (Score:3, Insightful)
I wouldn't take this to be not allowing anyone access to the data, and I'm convinced that no judge in the world would interpret it this way. I think that it largely is talking about preventing access from someone who is authorised to access the data. If the FSF is clever here they will bring private prosecutions against the companies who ship DRM trying to get CEOs put in prison over this - because I think that this is within what the law meant far more than what your line of arguement here is... With any new law of course this will need to be argued out, and it might get into the House of Lords if it really can't be settled (which at least would give us clarity on the matter). I wish Labour wouldn't bring in so many new laws each year that not even the lawyers can keep up with them
Re:Another law (Score:4, Insightful)
One : You let a politician write the law with words and vague ideas everyone can understand, including politicians and judges. It doesn t satisfy experts, but at least politicians understand what are they voting for. Once the vague law is voted, judges can make their own decision by referring to the spirit of the law rather than the word of the law.
Second : You let experts write the law, only people with a lot of knowledge in the field will understand what it means, but that will still be up to the politicians to vote them. How do you expect them to vote well if they have no idea what is this all about ? How do you expect judges to use a law they dont understand ?
Moreover, how do you choose your expert for let's say... a law about DRM ? Do you ask a guy from the RIAA/the majors (i m sure they ve got a bunch of qualified engineers and scientists working on DRM) or Richard Stallman to write it ?
Re:Punish The Malicious, Spare The Ignorant Innoce (Score:3, Insightful)
It's like having a car: You are liable for the damage caused by the car independent of who drives it. If it is stolen or hijacked, you are still liable. Therefore your are required to have an insurance that can cover the damage, there are safety requirements for the vehicle, and you are responsible to see that your car meet these requirements. If you are not professional you go to the mechanic and have it done. And even if everything is OK, and your car is stolen and involved in an accident, you are liable, your insurance will cover damage, and if the thief is caught the insurance company will seek to get the thief to pay up.
The same should go for the Internet: Once you're on the public network you are liable for any damage caused. If we hold people liable they will make sure that their systems does not inflict any damage, reduce the risk. Currently, people just say:
"Oh sorry, I didn't patch my system, I didn't update my anti-virus and someone broke into my system without my knowledge... but that's not my fault!"
and
"I don't know how to maintain my system, but I just want to use e-mail anyway, so why should I need to care?"
Of course, it is not entirely fair just to blame the user. Software vendors disclaim ALL liability, even for errors they have knowledge of. Schneier's dream is to make software vendors liable for their products. I think that unless the public have full access to the code vendors should not be able to disclaim liability. You can't both disclaim liability and impose restrictions on how the product may be used.
If there is product liability, then it is also fair to hold users liable for inappropriate use and abuse caused by their misconfiguration or negligence and liability cannot be passed onto the vendor.
If this means that uncle Bob and aunt Alice can't use the Internet, because they wont accept responsibility for their systems and won't buy insurance against abuse, fine! Cut the connection!
Re:Another law (Score:3, Insightful)
People who kill people can get less time than that...c'mon, let the penalty fit the crime, this isn't even close. A bit of computer mischief can get you locked up in prison for 5-10 years?!?!?
The world has gone crazy....
Re:Another law (Score:5, Insightful)
Laws are very crude tools... it is like doing brain surgery with hammers. This law was probably make with plenty of input from domain experts. Laws can be tricky enough when you are dealing with crimes like murder, rape, mugging, etc. But when you want a single code of rules to be used to micromanage the legality of acts of a highly technical nature outside the understand of the general voting public, and that are constantly changing, this is going to be the best you do. You create laws that are so overly vauge that the police have huge leeway to go after whoever they want on their own discretion, because you know that there is no way you can have hearings, discussions, commiteee meetings, and create a sensible set of rules in the time frame that things will keep up with technology. I am not saying I agree, but the people who make the laws trust the discrection of police and government officials more than they trust the general public to do OK without regulation.
Most people would rather deal with shitty laws, than leave things alone. I can't say I agree with that idea, but if YOU don't, then you are most certainly far outside the mainstream.
Re:Where is the real damage (Score:2, Insightful)
Re:Another law (Score:2, Insightful)
As for choosing experts, you try to get all sides represented, ideally. For a law about DRM, you'd ask major content providers (i.e. the RIAA, the MPAA, etc.) as well a free-speech advocates. Of course, this assumes that you _want_ all sides represented; if you're a policitian who's been bought by a company/industry
Re:Carjacked! (Score:2, Insightful)
"I believe you should only be able to disclaim liability if you also disclaim all rights to control the product - ie. open source."
I agree wholeheartedly with that!
As for defending ignorance, I guess it does come across that way, but there's a subtle difference between defending a person's right to be ignorant and defending ignorance. Ignorance is no excuse for breaking the law, but it isn't, and it shouldn't, be against the law to be running a computer that has been invaded by a malicious user!
I hate to say it, but it's almost exactly like forcing a rape victim to pay a fine for wearing skimpy clothes while walking the streets at night. Is it a stupid thing to do? Sure. Is the person liable for being raped? No! And computer virgins regularly get raped, so to speak.
I certainly DO believe that users should take an active responsibility to learn how to use their computers well. I'm not defending the right to be eternally dumb, but I am saying that the average user shouldn't be penalized for not having above average technical skills, because obviously half the people are always going to be below average in that respect. I believe users should learn, and learning computers should be treated exactly like learning anything else: for example, if you're learning computer science in school, and you don't study, you get a failing grade, yes? But you don't get taken to court and fined for being a poor student. As for penalties, surely a fine counts a financial penalty, no?
I do agree with your point that vendors should assume liability to protect their users. And I do agree that people should be responsible for learning how to use their computers well, including about matters of security. But if we're going to make people pay for not knowing they should have installed Bogosoft's latest virus definitions, or installed Fakeware's latest anti-spyware-botware-nosyware product, I think that's going a bit too far.
I mean, where would this lead to? To use the tortured car analogy, should Uncle Bob and Aunt Alice be forced to complete a written and hands-on computer test before being allowed to use a computer to send an e-mail to Aunt Carol? Not that you are suggesting this, of course, but it doesn't sound that far-fetched when you use the car analogy for liability.
Should users pay internet insurance to their ISPs? I dunno. I think it's crazy, but I'm suddenly envisioning a society where that is the case. O Brave New World! You might be on to something after all.