U.K. Outlaws Denial of Service Attacks 239
gnaremooz writes "A U.K. law has been passed that makes it an offense to launch denial-of-service attacks. The penalties for violating the new statues are stiff, with sentences increased from 5 to 10 years. The five year penalty was from the 1990 "Computer Misuse Act", which was enacted before the Internet became widespread. The idea of stiffer penalties for DoS attacks are probably something we can all get behind, but the language of the law is frustratingly vague." From the article: "Among the provisions of the Police and Justice Bill 2006, which gained Royal Assent on Wednesday, is a clause that makes it an offense to impair the operation of any computer system. Other clauses prohibit preventing or hindering access to a program or data held on a computer, or impairing the operation of any program or data held on a computer."
Another law (Score:5, Insightful)
Another law with good intent.
Another set of wording so vague it's no use against those it's meant to stop.
Another set of abuses waiting to happen.
Re: (Score:3, Insightful)
Re:Another law (Score:4, Insightful)
One : You let a politician write the law with words and vague ideas everyone can understand, including politicians and judges. It doesn t satisfy experts, but at least politicians understand what are they voting for. Once the vague law is voted, judges can make their own decision by referring to the spirit of the law rather than the word of the law.
Second : You let experts write the law, only people with a lot of knowledge in the field will understand what it means, but that will still be up to the politicians to vote them. How do you expect them to vote well if they have no idea what is this all about ? How do you expect judges to use a law they dont understand ?
Moreover, how do you choose your expert for let's say... a law about DRM ? Do you ask a guy from the RIAA/the majors (i m sure they ve got a bunch of qualified engineers and scientists working on DRM) or Richard Stallman to write it ?
Re: (Score:2)
The same way they always do, listen to what the lobbyist tells them it means, and vote the way the lobbyist tells them to vote after the bribes
Re: (Score:2)
Re: (Score:2)
Re: (Score:2, Insightful)
Re:Another law (Score:5, Insightful)
Laws are very crude tools... it is like doing brain surgery with hammers. This law was probably make with plenty of input from domain experts. Laws can be tricky enough when you are dealing with crimes like murder, rape, mugging, etc. But when you want a single code of rules to be used to micromanage the legality of acts of a highly technical nature outside the understand of the general voting public, and that are constantly changing, this is going to be the best you do. You create laws that are so overly vauge that the police have huge leeway to go after whoever they want on their own discretion, because you know that there is no way you can have hearings, discussions, commiteee meetings, and create a sensible set of rules in the time frame that things will keep up with technology. I am not saying I agree, but the people who make the laws trust the discrection of police and government officials more than they trust the general public to do OK without regulation.
Most people would rather deal with shitty laws, than leave things alone. I can't say I agree with that idea, but if YOU don't, then you are most certainly far outside the mainstream.
Re:Another law (Score:5, Funny)
Why does it have to be either-or?
Re:Another law (Score:4, Funny)
No more unplugging the microwave.
Re: (Score:3, Insightful)
People who kill people can get less time than that...c'mon, let the penalty fit the crime, this isn't even close. A bit of computer mischief can get you locked up in prison for 5-10 years?!?!?
The world has gone crazy....
Re: (Score:2, Funny)
And those that paid were then subsequently threatened by smaller gangs for smaller amounts of money to prevent smaller DoS attacks (down to $0.02 to prevent a DoS attack from an 8088 PC hooked up on a 300 baud modem).
Re: (Score:2)
Ah yes, but, here you have moved from DoS...to other crimes such as racketeering, possibly blackmail, or protection schemes.
Here DoS would be the tool, but, not the serious part of the crime.
Re: (Score:2)
That's what this will do, let the judges have discretion over individual cases and sentencing freedom in order to make the punishment fit the crime, whilst sill imposing an upper limit. 10 years is only the absolute maximum penalty they are permittted to impose under law; that doesn't mean that every wannabe hacker who brings Geocities down for 5 minutes is going to spend 10 years in jail.
Re: (Score:2)
Ok...then 5 years seems to be the minimum.
Again, people who do SERIOUS crimes that physically hurt and disable peo
Re: (Score:2)
Re: (Score:2)
No, 5 years was the old maximum, there is no minimum.
>Again, people who do SERIOUS crimes that physically hurt and disable people...can get less time than 5 years.
Well, yes, of course, if there are sufficient mitigating circumstances. That's the point of having a judge, to make such a decision.
Again, the ten year limit is not a sentencing guideline, it's a limit. Just because a judge has the power to send someone down for ten years, doesn't me
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Something that one person can do to damage the economy is seen as much more dangerous that just simply taking a life (of a probable ne'er-do-well).
Re: (Score:2)
There are lots of ways to bring down a computer system, and most of them haven't been discovered yet. The law needs to be flexible enough to stop all of them, which can't happen if it spells out in precise detail what a DOS attack is.
Hindering Access (Score:5, Insightful)
This is a pretty good description of DRM! So it's illegal now?
Re:Hindering Access (Score:5, Insightful)
Re: (Score:2)
What is ''operation of data''? I don't think we had that in CS.
Apart from that, this applies also to personal firewalls (imparing access to a program, bad), spyware (good), MS windows (well... good
Basically worthless.
Re:Hindering Access (Score:5, Interesting)
What is ''operation of data''? I don't think we had that in CS.
Well, on a unix-like system, the meaning is pretty obvious: Any file permissions other than 777 are now illegal. So to comply, you should run the following commands:
umask 0
find / | xargs chmor ugo+rwx
Also, in any programs that create files, you should change the permission arg to 0777.
Lessee, what have I forgotten?
(I suppose you should also turn off any firewall software you may have running, just to be on the safe side.)
Re: (Score:2)
s/chmor/chmod/
Obviously.
I wonder what typo is in this message.
Re: (Score:2)
Re: (Score:2)
The first 4 lines of my .alias file:
alias a alias a xs cd a mc mv a grpe grep
Re: (Score:3, Insightful)
I wouldn't take this to be not allowing anyone access to the data, and I'm convinced that no judge in the world would interpret it this way. I think that it largely is talking about preventing access from someone who is authorised to access the data. If the FSF is clever here they will bring private prosecutions against the companies who ship DRM trying to get C
Re:Hindering Access (Score:4, Interesting)
Lets just hope you have a good lawyer who can put up a decent argument against a well versed set of 'anti-terror' lawyers, and prey that the judge you speak of owns an iPod. (you might want to hope you don't have the anarchists cookbook on your computer too).
But riddle me this Batman - if you submit a story to Slashdot about a new technology bill making denial of service attacks illegal, and the Governments site referenced in the article gets Slashdotted.... are you, by the new law, responsible?
Re: (Score:2)
I'll bet a lot of
Re: (Score:2)
find / -print0 | xargs -0 chmod ugo+wrx
or simply :
find / -exec chmod ugo+wrx {} \;
Max.
Re: (Score:2)
Re: (Score:2)
Then when I got a Mac, I had to teach myself to think before using xargs, because there's nothing I can do to sanitize the filenames generated by Mac apps, and getting file names quoted correctly
Re: (Score:2)
it talks about an "unauthorised" act carried out with "intent", so if you put Zonealarm on your ex employer's server without their permission and configure it to block all requests from the LAN, then you are in trouble. However, if you put it on your own computer to help prevent attacks, then that is permitted.
Of course, the former would be illegal anyway as an unauthorised modification to your
Re: (Score:2)
You forgot the doozy: Slashdotting.
It is now illegal for /. to write about British computer system as the ensuing reduction of said systems to smoldering piles of rubble by the combined global power of /. constitutes "impair
Re: (Score:2)
Re: (Score:2)
I'd say installing Norton 'security' software on someone's machine could now be illegal too, by this...
I challenge the claim that Norton Internet Security has ever prevented anybody's access to a computer or the data stored on it.
Oh, you mean the legitimate user of the computer. Hum. You got a point there...
Re: (Score:3, Insightful)
No, the law [parliament.uk] states "he does any unauthorised act in relation to a computer" (34.3.1.a).
DRM and Encryption are both authorised act's. And... saying "you" don't authorise DRM on your PC isn't good enough, the UK laws allowing DRM override your own de-authorisation.
With encryption in general though, if you had a falling out with your employer and you encrypted his drive, then you would be guilty. Encrypting your own drive though is certainly lega
Re: (Score:2)
So I, as the owner of the computer system, am not authorized to determine what can and can't operate on my hardware? I am not qualified to say what constitutes "proper operation" of my own equipment and determine if some software is detrimental to that operation?
Sounds like a decent legal argument in the making.
=Smidge= (Also not a la
Re: (Score:2)
The law in general allows DRM, this overrides your personal desires. I believe that you, as an individual or a business cannot make up your own rules on what is and isn't authorised if it goes against commonly accepted practices.
Scarily if you read the law you will see that *anyone* who knowingly attempts to subvert the lawful operation of any computer program (say DRM/WGA) is causing an of
If Slashdotting is outlawed (Score:5, Funny)
Re: (Score:2)
Good intentions (Score:4, Insightful)
Re: (Score:2)
Very vague. (Score:5, Funny)
That really is rather vague. My family are able to "impair the operation of any computer system" just by being left alone with it for 10 minutes.
Jail Microsoft? (Score:4, Interesting)
Re: (Score:2)
Re: (Score:2)
And that is part of why you have a corporation, to sheild you from things like that. THe corp gets fined, you dont have to goto jail .
Re: (Score:2)
Phone DOS (Score:2)
Excellent...
Cutting off nose to spite face much? (Score:4, Insightful)
First of all, economically that's a moronic decision. Jail costs the state between 20-30 thousand dollars a year depending on where it is. Unless someone is DDosing Amazon, and here's where the vague wording of the law is an important shortfall, we're spending hundreds of thousands of dollars punishing someone who did perhaps a few thousand dollars worth of damage. That's bad economics, and I'm sure that money could be better used say, feeding the starving or allowing someone to go to college who otherwise wouldn't be able to.
Second of all, the kind of person you're going to be able to catch is not the person you want to throw in jail. We already have laws to punish people who run large botnets, and moreover by and large experienced blackhats won't be caught because they administrate their nets from countries ending in -stan. So the people who this legislation will put in jail will by and large be stupid college kids and people making a bad, poorly thought out decision as evidenced by the fact that they're using their home computer. These people need to be slapped with a big fine to they smarten them up, and then allowed to contribute to society.
This should be a poster case of a crime that should not carry criminal penalty.
Re: (Score:2)
Also note that people are automatically released half way through a sentence on licence anyway. So assume that some kid gets caught for this and its his first time and he was just messing about with little mallice involved he'd probably a suspended sentence tops (whi
Re: (Score:2, Insightful)
>> we're spending hundreds of thousands of dollars punishing someone who did perhaps a few thousand dollars worth of damage
2. Your argument is completely nonsensical. Catching and punishing criminals is always more expensive than the simple monetary value of their potential damage. However if we used that argument we wouldn't bother to lock up murderers for life. The value in locking up c
Re: (Score:2)
I just had the same discussion with my girlfriend. The sentencing is ridiculously thought out, although I can see the idea of a longer (one or two years)jail sentence for a repeat or premeditated offender. Someone doing a DOS as part of a business strategy for example.
I'm probably a bit stiffer about it than you though. I don't think it's a bad idea to make it a criminal offense. I think ranging from a stiff fine to maybe a few days or weeks in jail might be a good idea, to make the activity something k
Access Denied (Score:2, Interesting)
Mustn't impede criminals, must we? (Score:2, Insightful)
Or to load the ladvampire [aa419.org] to use up the daily file transfer allowances on 419er's fraudulent "banks"....
Re: (Score:2)
Full text of the act (Score:5, Interesting)
"Making, supplying or obtaining articles for use in offence under section 1 or 3
(1) A person is guilty of an offence if he makes, adapts, supplies or offers to supply any article--
(a) knowing that it is designed or adapted for use in the course of or in connection with an offence under section 1 or 3; or
(b) intending it to be used to commit, or to assist in the commission of, an offence under section 1 or 3."
I'm now a criminal. Joe Blackhat won't care; he'll still get hold of the 'articles', but now my website which tries to teach people about responsible use of such 'articles' now makes me liable for up to 2 years in jail, plus a fine. I hate the law.
Now I don't have to know what the tools will be used for, just that they can be used for wrongdoing.
Re: (Score:2)
I had to go and read the text of the act. You're right. We're all fucked.
I have in my pocket right now about a bootable linux distribution on a USB key. Lets hope to hell a lawyer can convince the jury that the Infosec tools on it are designed for authorised detection of vulnerabilities and not for illicit use.
Re: (Score:2)
So if you don't
Re: (Score:2)
The articles have to be -designed- for the purpose of "any unauthorised act in relation to a computer", not -supplied- for that purpose. There's a massive difference.
Re: (Score:2)
1) you don't have to be the author, just a supplier
2) you don't have to know what it's going to be used for, just that it can be used for offences:
you said "If you create a tool that could be used to facilitate one, then you would not be covered"
our survey said "A person is guilty of an offence if he makes, adapts, supplies or offers to supply any article a) knowing that it is designed or adapted for use in the course of or in connection with an offence"
***you don't need to know what the
Re: (Score:2)
Re: (Score:2)
Toolmaking??????? Re:Full text of the act (Score:2)
Impair, you say? (Score:2)
Re:Impair, you say? (Score:4, Insightful)
Maybe. But more likely it means you can be prosecuted for installing a browser. The only purpose of a browser is to use the bandwidth and cpu time of some other computer. That obviously interferes with anything running on that computer, impairing it for all other users.
What is happening to free speech in Europe? (Score:2)
violating statues (Score:2, Funny)
5-10 years for violating statues!
I'll never be-cone a statue ever again.
http://news.bbc.co.uk/1/hi/scotland/4264683.stm [bbc.co.uk]
how far can this be stretched? (Score:2)
Well - DRM restricts or impairs access to data held on a computer... especially when it's added to a file that wasn't previously encrypted (aka Zune file sharing). Hmmm....
MadCow
UK DMCA? (Score:3, Informative)
Here is the amended law [parliament.uk] which certainly mentions not accessing a computer you don't have rights to touch (33) and the D.O.S. clause (34).
Specifically stated (and both need to be true) is "he does any unauthorised act in relation to a computer" and "he has the requisite intent and the requisite knowledge."
Requisite intent as far as 34.3.2.b would be D.O.S. or hacking and Requisite knowledge is defined at 34.3.4 as doing something you know is not allowed, that is, it's not an accidental D.O.S..
But.... Section 34.3.2.c could very well be taken as the UK's version of the DMCA. "If you attempt to defeat the lawful operation of a (DRM/WGA/SerialNumberCheck) program or provide tools (35.3a) to do such an act you face 10 years in goal".
IANAL
Re: (Score:2)
I know playing in goal isn't as exciting as playing outfield, but that's certainly an unusual punishment.
Oh well, try getting them to act (Score:5, Insightful)
What's the point in making the term of sentance tougher, if there aren't any resources to investigate online crime in many UK forces?
Re: (Score:2)
What about encryption? (Score:2, Insightful)
Also I totally agree with the earlier statement on REAL damage. Say a company's website is down and they sell things online. Someone who was really intent on buying something from that website will wait until its back up. Someone who was just shopping around will likely continue to do so, and the casual websurfer would pass it by, perhaps trying again later. They're really not LO
Re: (Score:2)
In the UK, Australia and New Zealand at least you are required under law to hand over your keys of you are directed to. Not doing so carries a very stiff penalty, many time more than you would get by releasing the terrorist plot in the encrypted store.
Steganography (such as truecrypt) used with care can help you get past this law, but most people are just not qualified to run s
You just know... (Score:2)
Outlaws (Score:2)
Won't somebody PLEASE think of the children!?
This covers a lot of ground (Score:2)
Two words: Windows XP.
Could be useful against spyware too (Score:2)
being a mailsystem admin ... (Score:2)
but sometimes when these images sit in the queue because an upstream system cannot receive them yet, the
so vague.. also the same with web servers... if people are getting images off
A DWIM law (Score:2)
When these laws bring about
I for one... (Score:2)
The stage is being set... our laws will be used against us by the machines!
Just who exactly is gonna get the heat? (Score:4, Interesting)
Who's gonna feel those 5-10 years? As much as I'd love it, it won't be the people dumb enough to not even notice that their connection is at crawling speed because they're infected. That would indeed be the end of the 'net, because people would be scared to go online.
So we're after the guy controling the botnet? HA! Good effing luck! Europol backed and "encouraged" by banks is trying to get a hand on the guys doing phishing trojans. I.e. European persecution organisations with some rather "encouraging" businesses behind them are in vain trying to crack down on some people doing essentially the same a DDOS controller would do.
So why do you think a DDOS blackmailer who's most likely targeting "smaller" companies (read: Normal companies that don't have the executive forces of states at their fingertips) would ever be found out?
In a nutshell, the law is pointless. Unenforceable. Yes, it's forbidden. Yes, it's against the law. Yes, people won't give a fu.., knowing that it's impossible to get caught.
Whether a law is broken does not primarily depend on the sentence tacked to it. It mainly depends on your chances of being caught. If that chance is zero, the sentence could be worse than death and people wouldn't care.
Another law? What a surprise! (Score:2)
Since Labour came to power in 1997, they have passed over 32,000 new statutory instruments [wikipedia.org] with over 114,000 pages of text (=205 copies of war and peace) with the resulting outcome of "creating" over 3,000 new crimes (which works out at about one a day).
Maybe someday we'll get a government who thinks of something other than "Something wrong? Pass a new law." but somehow I doubt it
Re:Where is the real damage (Score:5, Insightful)
I don't think anyone here denies that it is important if websites go down. It can cot businesses millions if their website is not available to customers. If DDOSing hurts business, then why should it not be a civil issue? Let the civil jurisdiction deal with it, because it certainly isn't something that is worthy of jail time.
Re: (Score:2)
Can you give me reasons why it's not "worthy of jail time"? Because it's too easy? I can kill someone easily too by throwing a knife at them. It doesn't mean it's not worthy of jail time.
Someone went out of their way to cause signifigant damage to a business or a person. It's certainly a crime.
Re: (Score:2, Insightful)
Re: (Score:2)
deny service to ebay, amazon, or countless other ecomerece sites and your doing them more real financial damage per minute than several tyres and the cost of travel delay to most companies.
this law in my opinion (or at least it's intent as IANAL and haven't read all the legalese) is a valid generalization to protect all, that if enforced correctly should do no harm to anyone causing no harm (unlike various rights infringing DRM and terr
Re: (Score:2)
Re: (Score:2)
Some people pay their entire bill based on traffic.
Now, tell me where the crime is?
Re: (Score:2, Insightful)
I'd have to say the REAL damage is in the bandwidth of the site, the potential loss of customers, etc. Besides, the point is not really about the damage, it's about the intent. The law is designed to discourage the intention to do certain things. The DoS attacks show that you are intending to cause harm. The question isn't so much "Why should it be illegal?", so much as "Why shouldn't it?" It isn't a good thing; It's a manifestation of malicious intent.
Re: (Score:3, Funny)
Re: (Score:2, Insightful)
Why wouldn't do you think the law would protect you? If someone did DoS your broadband, then yes, they could be charged as a criminal. I don't know how else it could be.
Re:Punish The Malicious, Spare The Ignorant Innoce (Score:3, Insightful)
It's like having a car: You are liable for the damage caused by the car independent of who drives it. If it is stolen or hijacked, you are still liable. Therefore your are required to have an insurance that can cover the damage, there are safety requirements fo
Re: (Score:2)
2) I'll admit that all the 1's are identical, and all the 0's are identical, but sometimes the order is important
The point is that the owner of a device is the only one responsible for that device. If my neighbors pc is hacked and attacks mine, I can't interfere, that would be trespassin
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
So you mean only the rich would get justice? Erm, yeah. That sounds like a great idea for lawyers and criminals, but not for anybody else. Before you say, no-win-no-fee is no substitute for the rule of law. That only works for clear-cut cases with a h