UK Parliament to ban DoS Attacks

Ian Hill writes "It seems that the UK government is not as technologically withdrawn as you may think. This bill is an amendment to the Computer Misuse Act 1990 which bans Denial of Service attacks by name. It states that a person is guilty of an offence if they cause, or intend to cause, 'degradation, failure or other impairment of function of a computerised system.'"

Thank God

[Ashcrow]

Now no one will ever do it!

p2p sharing here I come

[azzy]

I can p2p share as much as I like.. breaching copyright.. and the American's can't get me!!! Yippee!!!!!

First Criminals

[Amazing Quantum Man]

And the first two people charged will be:

Ian Hill and CmdrTaco for causing a slashdotting of the UK Parliament server!

Re:First Criminals

[Anonymous Coward]

if they cause, or intend to cause

You know, the parent poster might be more on par than you think. Since Slashdot has a tendency to push huge amounts of traffic to sites mentioned in articles, could that be taken as a DoS attack? Notice the line above says 'cause or intend to cause', meaning if you cause something like a Denial of Service attack, with or without intent, you could still be prosecuted. Hmmm. This might not be a good thing after all.

Re:First Criminals

[david duncan scott]

Maybe, but I think their intent is the reverse in "cause or intend to cause" -- not "caused without intent", but "intended to cause and were foiled". (Curses!)

Re:First Criminals

[Linux Ate My Dog!]

I would damn well hope so, and it is about time.

The first time a link to my site got posted on Slashdot, the onslaught on the first day and subsequent spreading through blogs and mailing lists got me kicked off my hoster for generating an excess of 30 MB of netrowk traffic in 20 days -- they thought I was trading MP3s or warez. When they found out it was just my page, they still invoked their "upsetting normal working of server" clause and kicked me out on Dec 23d.

I found a new hoster, but this one charges me 6 bucks for any extra MB of traffic over my 2MB. That's just the breaks, the rest of the package is good. Of course, since it is hosted I can't actually do neat tricks like change the webserver to block slashdot referrers or anything, I just have what I have. But I wouldn't get slashdotted asgain, would I?

Of course I would, and without warning or consultation Chris posts the link again on the front page. My billing is monthly, the link was put the last day of the month, so I got the bill for this stunt after one day in the May billing: 54 bucks. June, of course, is yet to come in, and Lord knows what that bill is going to be.

All Slashdot editors know this will happen when they post a link. They know. They have known for years now. When I complained, I got a pointer to their standard policy "We don't warn people", as pointing to some webpage somehow mitigates the slashdot effect or precludes them from responsability for what their site does to websites. Further pressing got a "Change your webserver to deny referrals from slashdot (because you should just anticipate that we will Slashdot you some day, so you should have done this already)" and pointer to their FAQ on why they don't use Google cash: "But it's so hard to use it!"

I don't mind at all if a bill comes along somewhere that points out to editors of popular sites that wield this kind of power that there is no difference between them and a DDoS attack from a web-publishers point of view.

Re:First Criminals

[Alsee]

there is no difference between them and a DDoS attack from a web-publishers point of view.

The difference is that with the slashdot effect the server is saturated by preforming its intended function - showing the information to people who wish to see it, or atleast as many of them as it can manage. When you publish information it is reasonable to assume you want people to see it.

P.S.
6 bucks for any extra MB of traffic
Please tell me that's a typo. $6 per megabyte of data is ludicrous. You need a new host.

P.P.S.
If you don't want so many hits on your webpage perhaps you should drop the "Reload for new image" at the bottom.

-

Re:First Criminals

[Alsee]

I understand your headaches, but I still think it's legitimate web activity. You published to the general public. The people who came to the site all had a legitimate interest in seeing it. The system is functioning as designed, though not quite how you'd like. Most people would consider it a pleasant suprize if their site became "too popular".

Yes, but which people?
If you wish to restrict access to the site, that is up to you - and by extension the host you choose to use.

I think the main problem you are having is with the hosting agreements. There are a lot of places out there with many different plans. Perhaps you can find one that is simply throttled to x meg per day. That way an overload would only disrupt the site for a day or two, and no unexpected bills for excessive usage.

-

Re:First Criminals

[Linux Ate My Dog!]

You are not the Internet Community. The Internet Community I know was about sharing links, about sharing resources in a new structure, of saying you attach your subnet to me and then you can route my mail through you and isn't this WWW thing cool? The Internet Community I know was about taking care of information, of wanting it to be free and to be accessible. If anything, bandwidth and bottleneck issues have been researched by the Internet Community for years -- that's exactly what P2P is all about.

You are that new Internet Community that thinks that just because the word 'Internet' is involved, all notions of reality, responsability, or reasonable, have been thrown out the window. Well, to that I say 'Bullshit', and if you don't get it, the law will, as is evidenced by the bill being discussed in the UK.

As I explained, as a user of a standard webhoster these things are not within my control. You are just blaming the victim because it is easier for you. The Internet luminaries I know would die of shame if their networks were causing their downstream users crashing problems, or throughput problems, or service problems. You are just another version of "gimmie, gimmie, gimmie".

Be reasonable. That is all I ask. The existance of the slashdot effect for the last couple of years now should be a very big pointer that something very unreasonable is happening. It's making content inaccessible while nominally trying to get people to see it. I am sorry, am I the only one that sees the utter, utter, utter ridiculousness of that notion?

Copied straight from the Slashdot FAQ:

[Glytch]

(Link here, [slashdot.org] but I imagine you're too lazy to click, so here's a copy:)

Slashdot should cache pages to prevent the Slashdot Effect!

Sure, it's a great idea, but it has a lot of implications. For example, commercial sites rely on their banner ads to generate revenue. If I cache one of their pages, this will mess with their statistics, and mess with their banner ads. In other words, this will piss them off.

Of course, most of the time, the commercial sites that actually have income from banner ads easily withstand the Slashdot Effect. So perhaps we could draw the line at sites that don't have ads. They are, after all, much more likely to buckle under the pressure of all those unexpected hits. But what happens if I cache the site, and they update themselves? Once again, I'm transmitting data that I shouldn't be, only this time my cache is out of date!

I could try asking permission, but do you want to wait 6 hours for a cool breaking story while we wait for permission to link someone?

So the quick answer is: "Sure, caching would be neat." It would make things a lot easier when servers go down, but it's a complicated issue that would need to be thought through in great detail before being implemented.

Re:First Criminals

[DNS-and-BIND]

This is a real issue. I was involved in a court case recently, where an email server had fallen down after receiving a mere 14,000 emails. The mail server (a 4x450 CPU Sun E4500) had really bad mail processing software. The cluebies who set it up caused sendmail to spawn a shell process and a SQL script for *each incoming email*. That's right, two expensive processes just to get one email injected into the database. Needless to say, after the first 500 mails or so, the system load was above 100 and the machine was not doing anything but processing mail (needless to say, it was an "all-in-one" server, that had Oracle, apache web interface, OAS, DNS running). The FBI prosecuted the guy for "executing a remote command to do damage" and "unauthorized access".

Was he wrong? All he did was send some email. It's not his fault the machine fell down, it was an unscalable design.

Re:First Criminals

[loraksus]

what the fuck was he doing sending 14000+ emails?

Re:First Criminals

[tomhudson]

It states that a person is guilty of an offence if they cause, or intend to cause, 'degradation, failure or other impairment of function of a computerised system.'"

So this means that Microsoft can be charged for upgrades that don't work properly, etc.!!!!

Works for me!

Re:First Criminals

[ScottKin]

If the upgrades don't work it's not Microsoft's fault - the more likely scenario is that you have a perfectly-good OS from Microsoft that has been tainted by crappy 3rd-party programs, shareware, hacked/cracked warez and who-knows-what-else installed on your system.

It's something I like to call "Responsible Computing"

ScottKin

Re:First Criminals

[Yottabyte84]

Windows works fine untill you try to observe it working, at which point it shits itself.

Re:First Criminals; This is *NOT* funny

[lingqi]

Read the damn file! it reads:

A person is guilty of the offence in subsection (1)(a) even if the act was not intended to cause such an effect, provided that a reasonable person could have anticipated that the act would have caused such an effect.

this means no more posting of links on slashdot linking to UK sites lest Taco becomes an international criminal.

somebody in UK, please write your queen about this.

Re:First Criminals; This is *NOT* funny

[antientropic]

Read on:

the act is without authorisation if the person doing it [...] does not have the permission of the owner

If you operate a public webserver you implicitly authorise Internet users to connect to it. A slashdotting is just a group of people doing something that has been authorised by the operator of the server, even if it is a very large group of people.

Re:First Criminals; This is *NOT* funny

[peddrenth]

"somebody in UK, please write your queen about this"

Concerted attempts have been made to wield the clue-stick in the direction of parliament, however, they're still thick as pigshit when it comes to computers:

The bill, as it stands, would outlaw everything which causes somebody else's computer to slow down without the owner's permission. Read the bill if you think I'm exaggerating.

That means, anytime you use a computer for anything, you are to some extent a criminal if this gets passed. Again, our MPs need some computer experience, p.d.q. if they think this is a good solution to d.o.s.!

(p.s. side issue, but if a program of yours is insecure (even with GPL's disclaimed liability) and your program causes someone else's computer to slow down, or to divert any resources away from its normal functioning, you'll have broken the law if this piece of legislation gets passed. Software liability by the back door?)

Re:First Criminals; This is *NOT* funny

[mpe]

Concerted attempts have been made to wield the clue-stick in the direction of parliament, however, they're still thick as pigshit when it comes to computers:

Maybe, since they obviously have some spare time on their hands, could hold a competition with the US Congress to find the least clueful legislator :)

The bill, as it stands, would outlaw everything which causes somebody else's computer to slow down without the owner's permission. Read the bill if you think I'm exaggerating.

It also appears to be utterly redundant, since the kind of things it seaks to outlaw are already illegal.

Re:First Criminals; This is *NOT* funny

[FyRE666]

"somebody in UK, please write your queen about this"

Didn't you know? We all know her here in the UK - I'll pass on your message next time I drop by for tea and scones...

Re:First Criminals; This is *NOT* funny

[drinkypoo]

this means no more posting of links on slashdot linking to UK sites lest Taco becomes an international criminal.

bzzt. They're just posting a link; Of course, if you deep link, that could be illegal in some countries. Stupid countries. You follow the link. It's like the difference between rioting, and inciting a riot; inciting a riot is illegal, but unless they make inciting a DoS illegal, the slashdot effect isn't covered.

Re:hmm...

[Dwonis]

That's "onymous"

Wrong.

[r_j_prahad]

It'll be Rep. Howard Berman of California and Hilary Rosen of the RIAA.

Ha anyone told Rep. Howard Berman ?

[drew_kime]

I wonder if this will get passed before this [slashdot.org].

Re:Ha anyone told Rep. Howard Berman ?

[DeltaSigma]

One must wonder if this would make effective grounds for a citizen of the U.K. to sue any copyright holder's carrying out a DoS attack on them under the respective acts. Or would that stop short merely giving a P2P server based in the U.K. grounds to sue?

Man, we really need more lawyers on slashdot. People can complain about the slime they'd bring with them but we've already got so many trolls one would hardly notice the difference...

Criminal Law not Civil Law

[Martin Spamer]

The Computer Misuse act is criminal law not civil law anybody breaking goes to Prison.

irony

[s20451]

So we slashdotted them with a link. How ironic. Can I rat out Taco for a reduced sentence?

Slashdot Banned From posting Links to UK?

[EastCoastSurfer]

Wouldn't the slashdot effect be a way of degrading network performance?

Degridation, impairment..

[AntiTuX]

Like installing windows?
(HA HA HA HA!! I Made a Funny!!!)

Re:Degridation, impairment..

[High Jumbllama]

Yeah, it might have been flamebait, but it is still funny.

Dos'ers should have

[Tri0de]

a hard drive tied to each testicle and tossed in the Thames. Or sat the very least a nice little midnoght visit from the SAS, and some 'questioning'.

Re:Dos'ers should have

[arivanov]

It is easier to organise in the US then in the UK.

Rat them up to the NKVD^WHomeland Security. Works great on spammers (espcecially of the "all capitals nigerian bulshit" or other scam varieties). All you need to do is express your suspicion that the scam money is used to finance terrorism. After that you will never hear from that spammer again once they have disappeared "in and night and fog" to GULAG^WGuantanamo Bay for questioning with no legal representation.

Unfortunately the Yard in the UK systematically drops the ball on these. I wish it did not. And I wish it did what you suggest.

Degredation of a computer system?

[restauff]

Every time I download a big movie or file from a fast server, I cause degredation to my connection, and so my computer system. How does one define at what point it is intentional, and at what point serious damage is done to the system?

Re:Degredation of a computer system?

[Boss, Pointy Haired]

In the same way that me bumping into you in a crowded street by accident does not constitute an assault, whereas me hitting you does.

How hard I hit you is kind of irrelevant, but is of course a factor in assigning punishment.

Re:Degredation of a computer system?

[Dwonis]

Doesn't the UK still have "common law" that would cover stuff like this?

Re:Degredation of a computer system?

[Ooblek]

Doing so in the act of self-gratification probably doesn't apply.

Re:Degredation of a computer system?

[SirSlud]

Probably when it can be proven that the act was to intentionally degrade service, not to download a file.

Re:Degredation of a computer system?

[Have Blue]

If the system cannot recover without human intervention (whether that intervention is by reconfiguration, rebooting, or the script kiddie clicking the "stop ddos" button).

UK vs US?

[dillon_rinker]

So when the RIAA kills a file-sharing server in Scotland because US law specifically permits it, and when they are indicted because UK law specifically outlaws it, whose national sovereignty will be degraded?

Re:UK vs US?

[huh_]

So when the RIAA kills a file-sharing server in Scotland because US law specifically permits it, and when they are indicted because UK law specifically outlaws it, whose national sovereignty will be degraded?

Thats a stupid question. US law prevails over all others.

Re:UK vs US?

[Martin Spamer]

So when the RIAA kills a file-sharing server in Scotland because US law specifically permits it

Decriminalisation in not the same as specifically permiting something.

whose national sovereignty will be degraded?

Neither, since crime would be committed in the UK and the USA/UK have a extradiction treaty. The the Individual would be etradited, tried and imprisoned in the UK.

Though the idea of sticking one on the RIAA (or MPA) is appealing. This is not really a good idea. It would be the geek on trial not the people that gave the orders. I'm not so keen on my taxes being used to finance a nice break at some home counties open prison.

Re:UK vs US?

[csmiller]

Except you can only get extradited if the crime you commited *is* a crime in the country you are being extradited from, and you will not be punished more severly in the extraditing country. (Or at least extradition can not be refused in these cases, given reasonable evidence)
For example, most of the EU refuses to extradite suspected murders to the US, unless the US says it will not seek the death sentance. (It is a condition of EU membership to renounce the death penalty)
Simce crashing a P2P server is not a crime in the US, then the US authorites can (and probably will) refuse the extradition.

Re:UK vs US?

[Catroaster]

The case would be heard in a British court (probably the High Court for an offence of that magnitude), and the RIAA could not claim the US law as a defence. The person who committed the act would probably be extradited to Britain to face trial under the terms of the extradition treaty.

Catroaster.

Re:Scotland has it's own legal system

[dillon_rinker]

Q: What's the difference between being British and being English?
A: Ask the Scots...

=)

This is definately not legal, even in the US
True...for now. A recent /. article discussed the RIAA's attempts to make it legal to DoS a P2P server that was illegally distributing copyrighted content. I was obliquely referring to this.

So does this mean the RIAA can be nailed?

[PeterMiller]

It's ironic that this story [slashdot.org] was just posted earlier. Quick, move all your P2P servers to the UK, you'll be safe from the RIAA!

Re:So does this mean the RIAA can be nailed?

[Per Wigren]

...P2P servers...

Duh...

RIAA and MPAA exempted?

[gmhowell]

Are the RIAA and MPAA exempted from this law?

Just curious.

(-1 Redundant)

[gmhowell]

Yeah, yeah. Was too slow on the uptake.

Re:(-2)

[Cryptnotic]

You too are being a dumbass.

Cool I can sue microsoft

[linzeal]

"'degradation, failure or other impairment of function of a computerised system"

Seriously when will software vendors and hardware vendors that sell thei products (not cue cat or linux) be responsible in part for system instabilities?

slashdotted

[Jacer]

I don't think that counts, because we don't have any malicious intent. We just want to read the news which they have chosen to make available, so what if a bunch of people want to do it at once, with or without slashdot's help. But if some vengeful geek were to post a my website hosted on my cable modem in an effort to kill my connection, then I might get pissy.

Re:slashdotted

[jeffy124]

prior to slashdot's existance, the phrase "flash crowd" was used.

It was the title of a sci-fi short story years ago, in an age where teleportation exists and some major event occurs, causing people from all over teleport themselves to the event, causing a large crowd to appear, only to disappear after the event was over.

In the computing sense, it referred to legit cases of denial-of-service. For example, a "flash crowd" occured on 9/11 when MSNBC.com, CNN.com, etc, were all overloaded with connections from people seeking info on what was going on.

Re:slashdotted

[Graspee_Leemoor]

FYI the author was Larry Niven.

graspee

Blast it all

[The_Shadows]

> It states that a person is guilty of an offence if they cause, or intend to cause, 'degradation, failure or other impairment of function of a computerised system.'"

If they changed the wording just a little bit it would make Spammers face charges.

Of course, the whole impairment bit would make Microsoft criminals too. You know, I mean more so. Actually, isn't Windows XP designed to impair system preformance, forcing a hardware upgrade? Hmmmm....

Later.

Re:Blast it all

[Martin Spamer]

If they changed the wording just a little bit it would make Spammers face charges.

Unsolicited Bulk Email is almost certainly illegal (though untested) under the Section 1 of the Computer Misuse Act 1990 if sending or receipt of UCE is against your AUP/TOS. Any unauthorised access to a computer is illegal under the Computer Misuse Act Section 1.

The problem is enforcement, the Police seem to have neither the inclination nor ability to enforce it.

---
1.--(1) A person is guilty of an offence if--
(a) he causes a computer to perform any function with intent to secure access to any program or data held in any computer;
(b) the access he intends to secure is unauthorised; and
(c) he knows at the time when he causes the computer to perform the function that is the case.
(2) The intent a person has to have to commit an offence under this section need not be directed at--
(a) any particular program or data;
(b) a program or data of any particular kind; or
(c) a program or data held in any particular computer.
(3) A person guilty of an offence under this section shall be liable on summary conviction to imprisonment for a term not exceeding six months or to a fine not exceeding level 5 on the standard scale or to both.
---

http://www.hmso.gov.uk/acts/acts1990/Ukpga_19900 01 8_en_1.htm

And what about unwanted DoS?

[SavingPrivateNawak]

For instance, if I send an email with my beta 133t mailer program to a buggy server (let's say a Lotus server) that crashes upon receiving my mail, am I liable for the DoS that other users will perceive?

So, which will it be?

[peterdaly]

All in one day, one county considering making DOS's legal (for P2P networks), one county trying to ban the practice.

Interesting.

-Pete

Ugly Site

[alta]

I think the house of Lords gets the prize for worlds ugliest govenment website. Maybe I should say that cause there are some other pretty ugly sites out there!

Re:Ugly Site

[GigsVT]

That way it matches the women. Hey at least the brits are coordinated.

The obvious solution

[peterdaly]

I guess the US p2p users will have to setup anonymous reflectors in the UK. Ya gotta love the global age we live in!

-Pete

English Law

[Jucius Maximus]

In other news, it is still legal in Chechire (Chester) England to shoot, with a crossbow, any Welsh person, as long as you do it inside the city walls after 11 PM.

(don't ask me for a reference, I found it on a 'Stupid Laws' page that has subsequently shut down)

Re:English Law

[nicklott]

In case anyone cares: it's here [dumblaws.com]

Re:English Law

[Cryptnotic]

Is it legal to do it to an ex-girlfriend?

silly

[tps12]

DOSing is just another (admittedly mean) use for the computer. The fact that TCP/IP is built in a way that allows DOS attacks is no reason to try to control what free citizens do with their legally obtained computers.

Re:silly

[DarkMan]

Apply your argument to fire arms.

Murder is just another admittedly mean) use for the computer. The fact that guns are ilt in a way that allows murder is no reason to try to control what free citizens do with their legally obtained firearms.

Your argument seems to be based on because it is possible, is should be legal - which is anarchy.

Re:oops

[GigsVT]

Man, you're full of shit anyway, there is no obligation to design things to prevent people from comitting crimes with them. Sure, it helps if we can come up with a technological solution rather than a legal one, but that's not always feasible.

The only problem with this law is that it's possibly overbroad, other than that, even as a Libertarian, I don't have a problem with it.

Microsoft would be guilty

[rickthewizkid]

I put Windows on my computer and it "impaired my performance" ... in more ways than one... :)

Seriously, would this law apply only to activities over the Internet, or would it also apply to software vendors as well?

-Rick

This is very good.

[tshak]

This is very good - I mean consider all of the damage that DOS could do to your machine. It's insecure, lacks multitasking, and requires users to configure EMM386 and HIMEM.SYS just to play Doom. Let's just hope that bin Laden doesn't have the technology available to perform a DOS install/attack on all of our machines.

Might have been better kept quiet

[andyh-london]

I noticed this draft a few weeks ago and thought about posting it here. Then I thought it might be better if Microsoft and the like did _not_ here about it until it became law.
As it is they'll try and get it amended so they don't get prosecuted for keeping on changing systems to keep Linux/Unix incompatability.

Andy

Responsibility

[plastic_heaven]

What happens if someone has 'hacked' your machine and used it to cause a DOS attack? Are you going to be held responsible as well?

Fun with the law...

[rocjoe71]

...by the way it sounds, you *could* apply this law against virus writers and maybe even spammers too.

Of course, there's still the "burden-of-proof", even in the case of spammers, but it would be nice to think there's a law that makes them vulnerable.

Re:Fun with the law...

[Moonshadow]

Not a bad idea. I mean, downloading that 4k spam degrades my connection. Granted, not by very much, but it's still degraded.

By this logic, ANY communication over the net could be construed as a violation of this bill. You only have so much bandwidth, and the consumption of it will certainly degrade the connection. This is a very dangerous piece of legislation. It could have its uses, but it could be so broadly interpreted DMCA-style to make any Internet-using person a felon.

On the upside, I'm gonna set up an open relay in the UK and send any spammer that uses it (thereby degrading my connection and system performance) to jail.

Just copyright it.

[High Jumbllama]

Just copyright denial of service attacks. Everyone knows copyright law is more powerful anyway.

No more benchmarking...

[legerde]

Many benchmarks try to a hammer a system to the point where it is unusable..

I guess this really means that the linux VM is performing great now! :)

Fair enough I suppose..

[dunkerz]

.. but surely the House of Lords isn't becoming wise to modern technology? :D

Hmm, slashdot could be liable

[xA40D]

A person is guilty of the offence even if the act was not intended to cause such an effect, provided that a reasonable person could have anticipated that the act would have caused such an effect.

It's not just slashdot that needs to be woried

I work for an ISP. When The Queen Mum died we had so many people dialing in it caused what was, in essence, a denial of service attack. So someone better mention to ER that if she's thinking of snuffing it she'll have to give herself a pardon first.

Who'll do the policing?

[lionchild]

How much bandwidth has to be taken up to determine that one is under a DoS? Who gets to decide? Are there going to be 'net-cops who police this sort of thing and rush out to arrest those? Is this a civial or criminal enactment of laws? Certainly you'd approach each differently.

Re:Who'll do the policing?

[Rob Kaper]

How much bandwidth has to be taken up to determine that one is under a DoS?

A DoS is not about bandwidth, although taking up all bandwidth is a way to cause a Denial of Service. End the word says it all: something is a DoS when there is an attempt to cut a service from legimate use.

Bets... any takers?

[sielwolf]

Anyone want to make a bet on how long it will be before these end users become technological neanderthals when they decide to use this law for Evil instead of Good forcing /. to post a thousand threads and subjecting us to at least three John Katz articles that bear no relevance to the topic?

Wrench?

[reconn]

I'd like to see them handle Wrench [www.tao.ca], when somebody builds it.

P2P DoS w/o RIAA.

Could posting to slashdot be illegal?

[ZeroLogic]

Scenario:

I want to DOS someone so I post a story about them to slashdot, the users then overload the server and I have my desired affect. Is what I did illegal? I'm not saying the unwitting users of slashdot have performed any crime, I'm asking if my intent was enough to make it illegal.

The slashdot effect !

[Joel Ironstone]

. . .if they cause, or intend to cause, 'degradation, failure or other impairment of function of a computerised system.'"

Everyday some random Joe Schmoe's sight is degraded and impaired by a barrage of requests from a slashdot article.

Will this create a similar catchnet as......

[VirtualUK]

.....before the computer misuse act, the most common way to prosecute someone for something like that was under an law which related to stealing electricity. Could this law be used to prosecute hackers who it could be claimed have degraded the system's performance merely by logging in, or even portscanning by causing the target machine to do something it wasn't scheduled to do?

SPAM == DOS

[RichMan]

So will SPAM creators be targetable under the provisions? Massive amounts of email can easily be shown to take up CPU memory and processor time as well as all the messages consuming disk space. A small system can easily be overloaded by SPAM, so SPAM is clearly a source of degradation and impairment of function of the computer. Simply filling up an inbox on a system can prevent access to other mail and is demonstratable as denial of service.
SPAM is sent deliberatly with knowledge of the load affects.

Re:SPAM == DOS

[Quimo]

Spam creators would be a target under this technically but then again so would the editors of slashdot.

Section 2 states that they are guilty of a DOS attack if a reasonable person could have anticipated the DOS would result.

Sending huge volumes of email through someone's email server. It sounds reasonable to me that it may degrade performance.

Posting a link on Slashdot and sending hundreds of people to a web site. It sounds reasonable to me that it may degrade performance. The only question is of permission. Is posting a web server on the net giving me an implied permission to link to it.

Hang on

[Rogerborg]

Feel free to mod this as funny or troll, but I am perfectly serious. I like this bill: it's pithy, addresses a real problem, and is neither too narrow nor too broad. However, it occurs to me that the wording could be applied to writing a piece of buggy software.

"A person is guilty of an offence if without authorisation he does any act which causes directly or indirectly a degradation, failure, or other impairment or function of a computerised system or any part thereof. A person is guilty of the offence [...] even if the act was not intended to cause such an effect, provided that a reasonable person could have anticipated that the act would have caused such an effect. [...] the act is without authorisation if the person doing it does not have the permission of the owner [of the relevant computerised system or part thereof]."

So, I write a piece of code with a memory scribbler in it, say passing an unitialised pointer to memcpy(). The "act" is my typing of that specific line of code. Any reasonable person would anticipate that act would cause a degradation or failure on a system. Note: "a" system, not "my" system. I didn't intend it to cause failure, but I should (reasonably) have realised it would. And once I distribute the code, the damage is caused on many systems, none of which are owned by people who gave me permission (explicitely or even implicitely) to perform the "act", i.e. write that scribbler.

I'm certainly stretching a point, but my scenario satisfies the letter (if not the spirit) of the law. There's already a concept of criminal negligence; this would just be a specific case of it. The part that makes me pause is that the offence is caused by the individual coder, not by her employer.

So while this probably will never effect me, it gives me a little more incentive to make sure that I lint every line that I write, and damn the deadline. But hey, on balance that's a good thing, right? ;-)

Re:Hang on

[Huge Pi Removal]

I think the weak link in the chain of your argument is that the end user wouldn't have given you permission to write that scribbler.

As long as you provided the software "as is", the user has *chosen* to run your software, and hence implicitly given you "permission". Now I know that it gets tricky, since one may consider that they only wanted to run the bit of the software that *works*, but if that's the case, well, surely the Flight Sim in MS Word, etc, can count as something that "degrades system performance" (uses up disk space, not the best example but you know what I mean...)?

poorly written law.

[Lumpy]

I cant read it as it is currently having an intentional degradation of access.

If the law does not specifically single out INTENTIONAL DoS attack and list accidental as a hold-harmless then the law is really really bad.

you can instantly DoS any network by plugging a switch into it's self or another switch that is connected back to that one and letting one piece of broadcast traffic flow (create a resonance in essence). and many other accidental things (Oops, I broke a Fiber run in the street with my backhoe.. will I be charged with multiple counts of this offense as I just disrupted many many persons/companies/etc...

if it isnt specific that it only covers INTENTIONAL acts then it needs to be thrown out now.

Re:poorly written law.

[Lumpy]

Ahh but that's the problem... when it comes to laws and lawyers reason is thrown directly out the window, shot and then sacked. reason, logic and truth have no place in the court room. I have seen people sued by a person that robbed them because they stepped on fluffy and broke their arm after breaking and entering. and if the law doesnt specifically mention that it has to be completely intentional so jackass will try and sue/incarcerate some dolt that ran over a fiber node, claiming that their destruction of the fiber node during the car crash constitutes a Denial Of Service attack.

remember, this stuff happens, and it will happen if the law wasnt written to protect the people from the lawyers.

Let's hope they can get some people with this

[colmore]

Man I hate DoS attacks. Hacking is one of those crimes I can't help but quietly cheer. Like graffiti and car chases, I find my self, for no good reason, quietly behind the bad guys. But DoS is the exception. It takes no skill and no talent. It isn't cool, it's just lame.

You hear that, kids? You are *lame*

Dynamic IP address and websites?

[Tenebrious1]

So if you have website connected to your DSL, and the ISP changes the dynamic IP address... your site is down for 20 minutes while it contacts the dynamic dns service with the updated IP. Your site is down, your email is down, they've forced a denial of service on your website.

Does that count? It was intentional. It most certainly caused failure of service to your website. Any reasonable person with the knowlege of how DNS works could tell you a new IP will distrupt traffic. So will ISPs be forced to give out static IP addresses to anyone who asks?

Thank god!

[HowlinMad]

Now that they are banned, they won't happen anymore. Hey look, is that a flying pig?

P2P in UK?

[noxavior]

Well, how about this? This is great news considering that the States want to attack the P2P networks [slashdot.org]. Now the P2P networks will have a place to hide, because it will prove to be challenging to selectively remove the USA users, while avoiding those in the UK.

All in all, great news

Not the UK Government

[RvonG]

The Earl of Northesk [politicallinks.co.uk] who has introduced this Bill is a Conservative peer, and so this is not a Government Bill.
For better or worse it is therefore most unlikely to become law, especially so close to the end of the Parliamentary year. Though if the UK Government notice that there is support for it, they could decide to introduce their own Bill next session, I suppose.

Eh ... no

[00_NOP]

This is not a Government Bill - so has no real chance of getting passed - especially as it has been introduced so late in the session. I don't think it's even had a 2nd Reading debate.

Nice try, guys. But you need to update yourselves on the UK constitution.

legal escalation

[Amoeba]

We propose a law to legalize certain DoS attacks.

They propose a law to make those DoS attacks illegal.

We retaliate with another law to make any laws criminalizing our law that legalizes DoS attacks illegal.

They strike back with a law that makes it illegal to pass laws which make laws that that legalize DoS attacks illegal..

In furious anger and righteous indignation we pass a law tha...

I think I just hurt something in my head.

Re:MS is in trouble

[tomhudson]

Yeah, their products manage to suck and blow at the same time.

Re:What about accidental DOS?

[dunkerz]

The law says that you can be charged if you so much as *anticipate* that using a program will cause a DoS. If it's a total accident, you're fine.

Re:UK to ban RIAA endorsed attacks...

[Tim C]

Not really.

George will talk to Tony, and everything will be smoothed over.

Trust me, the UK parliament is so nearly an American lap dog you'd swear it was wagging at times.

Cheers,

Tim
(UK citizen, born and bred)

Re:they still use DOS in England?

[mr_gerbik]

Holy shit, you made a joke about the difference between DoS (denial of service) and DOS (disk operating system). I've never seen a joke like this on Slashdot!

Holy shit, you made a joke about my joke because you waste 50% of your life reading Slashdot and critiquing jokes.

Keep up the creative and original work!

Keep up the not getting laid and using Slashdot to bump up your self esteem.