Slashdot Log In
U.K. Outlaws Denial of Service Attacks
Posted by
Zonk
on Sat Nov 11, 2006 06:34 AM
from the keep-it-in-your-toolbox dept.
from the keep-it-in-your-toolbox dept.
gnaremooz writes "A U.K. law has been passed that makes it an offense to launch denial-of-service attacks. The penalties for violating the new statues are stiff, with sentences increased from 5 to 10 years. The five year penalty was from the 1990 "Computer Misuse Act", which was enacted before the Internet became widespread. The idea of stiffer penalties for DoS attacks are probably something we can all get behind, but the language of the law is frustratingly vague." From the article: "Among the provisions of the Police and Justice Bill 2006, which gained Royal Assent on Wednesday, is a clause that makes it an offense to impair the operation of any computer system. Other clauses prohibit preventing or hindering access to a program or data held on a computer, or impairing the operation of any program or data held on a computer."
Related Stories
[+]
Sweden to Make Denial of Service Attacks Illegal 108 comments
paulraps writes "Sweden is to pass legislation making Denial of Service attacks illegal. The offense will carry a maximum jail term of two years, and is thought to be a direct response to the attack which crashed the Swedish police's web site last summer. Nobody was charged for that, but the fact that it came shortly after a raid on the Pirate Bay's servers was thought by many to be not entirely coincidental. Sweden's move follows the UK, which is even tougher on web attackers — there the sentence can be over five years in prison."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Another law (Score:5, Insightful)
Another law with good intent.
Another set of wording so vague it's no use against those it's meant to stop.
Another set of abuses waiting to happen.
Re: (Score:3, Insightful)
Re:Another law (Score:4, Insightful)
One : You let a politician write the law with words and vague ideas everyone can understand, including politicians and judges. It doesn t satisfy experts, but at least politicians understand what are they voting for. Once the vague law is voted, judges can make their own decision by referring to the spirit of the law rather than the word of the law.
Second : You let experts write the law, only people with a lot of knowledge in the field will understand what it means, but that will still be up to the politicians to vote them. How do you expect them to vote well if they have no idea what is this all about ? How do you expect judges to use a law they dont understand ?
Moreover, how do you choose your expert for let's say... a law about DRM ? Do you ask a guy from the RIAA/the majors (i m sure they ve got a bunch of qualified engineers and scientists working on DRM) or Richard Stallman to write it ?
Parent
Re:Another law (Score:5, Insightful)
Laws are very crude tools... it is like doing brain surgery with hammers. This law was probably make with plenty of input from domain experts. Laws can be tricky enough when you are dealing with crimes like murder, rape, mugging, etc. But when you want a single code of rules to be used to micromanage the legality of acts of a highly technical nature outside the understand of the general voting public, and that are constantly changing, this is going to be the best you do. You create laws that are so overly vauge that the police have huge leeway to go after whoever they want on their own discretion, because you know that there is no way you can have hearings, discussions, commiteee meetings, and create a sensible set of rules in the time frame that things will keep up with technology. I am not saying I agree, but the people who make the laws trust the discrection of police and government officials more than they trust the general public to do OK without regulation.
Most people would rather deal with shitty laws, than leave things alone. I can't say I agree with that idea, but if YOU don't, then you are most certainly far outside the mainstream.
Parent
Re:Another law (Score:5, Funny)
Why does it have to be either-or?
Parent
Re:Another law (Score:4, Funny)
No more unplugging the microwave.
Parent
Re: (Score:3, Insightful)
People who kill people can get less time than that...c'mon, let the penalty fit the crime, this isn't even close. A bit of computer mischief can get you locked up in prison for 5-10 years?!?!?
The world has gone crazy....
Hindering Access (Score:5, Insightful)
This is a pretty good description of DRM! So it's illegal now?
Re:Hindering Access (Score:5, Insightful)
Parent
Re: (Score:2)
What is ''operation of data''? I don't think we had that in CS.
Apart from that, this applies also to personal firewalls (imparing access to a program, bad), spyware (good), MS windows (well... good
Basically worthless.
Re:Hindering Access (Score:5, Interesting)
What is ''operation of data''? I don't think we had that in CS.
Well, on a unix-like system, the meaning is pretty obvious: Any file permissions other than 777 are now illegal. So to comply, you should run the following commands:
umask 0
find / | xargs chmor ugo+rwx
Also, in any programs that create files, you should change the permission arg to 0777.
Lessee, what have I forgotten?
(I suppose you should also turn off any firewall software you may have running, just to be on the safe side.)
Parent
Re: (Score:2)
s/chmor/chmod/
Obviously.
I wonder what typo is in this message.
Re: (Score:3, Insightful)
I wouldn't take this to be not allowing anyone access to the data, and I'm convinced that no judge in the world would interpret it this way. I think that it largely is talking about preventing access from someone who is authorised to access the data. If the FSF is clever here they will bring private prosecutions against the companies who ship DRM trying to get C
Re:Hindering Access (Score:4, Interesting)
Lets just hope you have a good lawyer who can put up a decent argument against a well versed set of 'anti-terror' lawyers, and prey that the judge you speak of owns an iPod. (you might want to hope you don't have the anarchists cookbook on your computer too).
But riddle me this Batman - if you submit a story to Slashdot about a new technology bill making denial of service attacks illegal, and the Governments site referenced in the article gets Slashdotted.... are you, by the new law, responsible?
Parent
Re: (Score:2)
Re: (Score:3, Insightful)
No, the law [parliament.uk] states "he does any unauthorised act in relation to a computer" (34.3.1.a).
DRM and Encryption are both authorised act's. And... saying "you" don't authorise DRM on your PC isn't good enough, the UK laws allowing DRM override your own de-authorisation.
With encryption in general though, if you had a falling out with your employer and you encrypted his drive, then you would be guilty. Encrypting your own drive though is certainly lega
Re: (Score:2)
So I, as the owner of the computer system, am not authorized to determine what can and can't operate on my hardware? I am not qualified to say what constitutes "proper operation" of my own equipment and determine if some software is detrimental to that operation?
Sounds like a decent legal argument in the making.
=Smidge= (Also not a la
Re: (Score:2)
The law in general allows DRM, this overrides your personal desires. I believe that you, as an individual or a business cannot make up your own rules on what is and isn't authorised if it goes against commonly accepted practices.
Scarily if you read the law you will see that *anyone* who knowingly attempts to subvert the lawful operation of any computer program (say DRM/WGA) is causing an of
If Slashdotting is outlawed (Score:5, Funny)
Re: (Score:2)
Good intentions (Score:4, Insightful)
Very vague. (Score:5, Funny)
That really is rather vague. My family are able to "impair the operation of any computer system" just by being left alone with it for 10 minutes.
Jail Microsoft? (Score:4, Interesting)
Re: (Score:2)
Phone DOS (Score:2)
Excellent...
Cutting off nose to spite face much? (Score:4, Insightful)
First of all, economically that's a moronic decision. Jail costs the state between 20-30 thousand dollars a year depending on where it is. Unless someone is DDosing Amazon, and here's where the vague wording of the law is an important shortfall, we're spending hundreds of thousands of dollars punishing someone who did perhaps a few thousand dollars worth of damage. That's bad economics, and I'm sure that money could be better used say, feeding the starving or allowing someone to go to college who otherwise wouldn't be able to.
Second of all, the kind of person you're going to be able to catch is not the person you want to throw in jail. We already have laws to punish people who run large botnets, and moreover by and large experienced blackhats won't be caught because they administrate their nets from countries ending in -stan. So the people who this legislation will put in jail will by and large be stupid college kids and people making a bad, poorly thought out decision as evidenced by the fact that they're using their home computer. These people need to be slapped with a big fine to they smarten them up, and then allowed to contribute to society.
This should be a poster case of a crime that should not carry criminal penalty.
Re: (Score:2)
Also note that people are automatically released half way through a sentence on licence anyway. So assume that some kid gets caught for this and its his first time and he was just messing about with little mallice involved he'd probably a suspended sentence tops (whi
Re: (Score:2, Insightful)
>> we're spending hundreds of thousands of dollars punishing someone who did perhaps a few thousand dollars worth of damage
2. Your argument is completely nonsensical. Catching and punishing criminals is always more expensive than the simple monetary value of their potential damage. However if we used that argument we wouldn't bother to lock up murderers for life. The value in locking up c
Access Denied (Score:2, Interesting)
Mustn't impede criminals, must we? (Score:2, Insightful)
Or to load the ladvampire [aa419.org] to use up the daily file transfer allowances on 419er's fraudulent "banks"....
Full text of the act (Score:5, Interesting)
"Making, supplying or obtaining articles for use in offence under section 1 or 3
(1) A person is guilty of an offence if he makes, adapts, supplies or offers to supply any article--
(a) knowing that it is designed or adapted for use in the course of or in connection with an offence under section 1 or 3; or
(b) intending it to be used to commit, or to assist in the commission of, an offence under section 1 or 3."
I'm now a criminal. Joe Blackhat won't care; he'll still get hold of the 'articles', but now my website which tries to teach people about responsible use of such 'articles' now makes me liable for up to 2 years in jail, plus a fine. I hate the law.
Now I don't have to know what the tools will be used for, just that they can be used for wrongdoing.
Re: (Score:2)
I had to go and read the text of the act. You're right. We're all fucked.
I have in my pocket right now about a bootable linux distribution on a USB key. Lets hope to hell a lawyer can convince the jury that the Infosec tools on it are designed for authorised detection of vulnerabilities and not for illicit use.
Impair, you say? (Score:2)
Re:Impair, you say? (Score:4, Insightful)
Maybe. But more likely it means you can be prosecuted for installing a browser. The only purpose of a browser is to use the bandwidth and cpu time of some other computer. That obviously interferes with anything running on that computer, impairing it for all other users.
Parent
What is happening to free speech in Europe? (Score:2)
violating statues (Score:2, Funny)
5-10 years for violating statues!
I'll never be-cone a statue ever again.
http://news.bbc.co.uk/1/hi/scotland/4264683.stm [bbc.co.uk]
how far can this be stretched? (Score:2)
Well - DRM restricts or impairs access to data held on a computer... especially when it's added to a file that wasn't previously encrypted (aka Zune file sharing). Hmmm....
MadCow
UK DMCA? (Score:3, Informative)
Here is the amended law [parliament.uk] which certainly mentions not accessing a computer you don't have rights to touch (33) and the D.O.S. clause (34).
Specifically stated (and both need to be true) is "he does any unauthorised act in relation to a computer" and "he has the requisite intent and the requisite knowledge."
Requisite intent as far as 34.3.2.b would be D.O.S. or hacking and Requisite knowledge is defined at 34.3.4 as doing something you know is not allowed, that is, it's not an accidental D.O.S..
But.... Section 34.3.2.c could very well be taken as the UK's version of the DMCA. "If you attempt to defeat the lawful operation of a (DRM/WGA/SerialNumberCheck) program or provide tools (35.3a) to do such an act you face 10 years in goal".
IANAL
Oh well, try getting them to act (Score:5, Insightful)
What's the point in making the term of sentance tougher, if there aren't any resources to investigate online crime in many UK forces?
What about encryption? (Score:2, Insightful)
Also I totally agree with the earlier statement on REAL damage. Say a company's website is down and they sell things online. Someone who was really intent on buying something from that website will wait until its back up. Someone who was just shopping around will likely continue to do so, and the casual websurfer would pass it by, perhaps trying again later. They're really not LO
Re: (Score:2)
In the UK, Australia and New Zealand at least you are required under law to hand over your keys of you are directed to. Not doing so carries a very stiff penalty, many time more than you would get by releasing the terrorist plot in the encrypted store.
Steganography (such as truecrypt) used with care can help you get past this law, but most people are just not qualified to run s
Just who exactly is gonna get the heat? (Score:4, Interesting)
Who's gonna feel those 5-10 years? As much as I'd love it, it won't be the people dumb enough to not even notice that their connection is at crawling speed because they're infected. That would indeed be the end of the 'net, because people would be scared to go online.
So we're after the guy controling the botnet? HA! Good effing luck! Europol backed and "encouraged" by banks is trying to get a hand on the guys doing phishing trojans. I.e. European persecution organisations with some rather "encouraging" businesses behind them are in vain trying to crack down on some people doing essentially the same a DDOS controller would do.
So why do you think a DDOS blackmailer who's most likely targeting "smaller" companies (read: Normal companies that don't have the executive forces of states at their fingertips) would ever be found out?
In a nutshell, the law is pointless. Unenforceable. Yes, it's forbidden. Yes, it's against the law. Yes, people won't give a fu.., knowing that it's impossible to get caught.
Whether a law is broken does not primarily depend on the sentence tacked to it. It mainly depends on your chances of being caught. If that chance is zero, the sentence could be worse than death and people wouldn't care.
Re:Where is the real damage (Score:5, Insightful)
I don't think anyone here denies that it is important if websites go down. It can cot businesses millions if their website is not available to customers. If DDOSing hurts business, then why should it not be a civil issue? Let the civil jurisdiction deal with it, because it certainly isn't something that is worthy of jail time.
Parent
Re: (Score:2)
deny service to ebay, amazon, or countless other ecomerece sites and your doing them more real financial damage per minute than several tyres and the cost of travel delay to most companies.
this law in my opinion (or at least it's intent as IANAL and haven't read all the legalese) is a valid generalization to protect all, that if enforced correctly should do no harm to anyone causing no harm (unlike various rights infringing DRM and terr
Re: (Score:2)
Re: (Score:2)
Some people pay their entire bill based on traffic.
Now, tell me where the crime is?
Re: (Score:2, Insightful)
I'd have to say the REAL damage is in the bandwidth of the site, the potential loss of customers, etc. Besides, the point is not really about the damage, it's about the intent. The law is designed to discourage the intention to do certain things. The DoS attacks show that you are intending to cause harm. The question isn't so much "Why should it be illegal?", so much as "Why shouldn't it?" It isn't a good thing; It's a manifestation of malicious intent.
Re: (Score:3, Funny)
Re: (Score:2, Insightful)
Why wouldn't do you think the law would protect you? If someone did DoS your broadband, then yes, they could be charged as a criminal. I don't know how else it could be.
Re:Punish The Malicious, Spare The Ignorant Innoce (Score:3, Insightful)
It's like having a car: You are liable for the damage caused by the car independent of who drives it. If it is stolen or hijacked, you are still liable. Therefore your are required to have an insurance that can cover the damage, there are safety requirements fo