![The Courts The Courts](http://a.fsdn.com/sd/topics/court_64.png)
![Government Government](http://a.fsdn.com/sd/topics/government_64.png)
![The Internet The Internet](http://a.fsdn.com/sd/topics/internet_64.png)
![News News](http://a.fsdn.com/sd/topics/news_64.png)
British Teen Cleared in "E-mail Bomb" Case 155
legaleagll writes "According to this article , a British Judge has ruled that a teen who sent approximately 5,000,000 e-mails to his former employer was not in violation of the U.K.'s Computer Misuse Act. It appears that the Computer Misuse Act is a bit outdated being that it was created 15 years ago when a number, perhaps most, of the current methods for misuse of computers were not contemplated."
'editors' heh (Score:3, Informative)
Re:'editors' heh (Score:2, Funny)
Re:'editors' heh (Score:5, Funny)
Oh wait that's still backwards. *shakes fist* damn editors!
Re:'editors' heh (Score:1, Insightful)
How the fuck does this have anything to do with "my rights online?"
Unless you think I have an inalienable right to be an assclown, in which case, HAND.
Re:'editors' heh (Score:2)
Re:'editors' heh (Score:2)
It shows you have no right (in the UK) not to be mail bombed.
Re:'editors' heh (Score:1)
Re:'editors' heh (Score:3, Funny)
We all know that "5 million" equals "3,000,000".
If they meant "5,000,000" they would have written "5 mebimillion".
Re:'editors' heh (Score:4, Informative)
That said, that was fine when this was a hobbyist site; it's somewhat irksome now that it's a commercial venture. Not that I pay anything for it, other than the time spent frequenting and contributing of course...
Re:being that (Score:3, Funny)
Re:being that (Score:3, Funny)
Re:being that (Score:1)
Moral of the Story (Score:3, Funny)
Re:Moral of the Story (Score:2, Funny)
Re:Moral of the Story (Score:2)
Re:being that (Score:2)
e-mail bomb? (Score:5, Funny)
This is most likely what he said while rubbing his peach-fuzz moustache (nothing to twirl evilly quite yet.)
Pros and Cons of a good piece of legislation (Score:5, Insightful)
Re:Pros and Cons of a good piece of legislation (Score:4, Insightful)
Thus, the Second Amendment allows citizens to bear arms so that they are never helpless before the government, but more current legislation is designed to keep criminals from using guns to harm citizens (no concealed weapons in certain locales, background checks, etc.)
Re:Pros and Cons of a good piece of legislation (Score:1)
Re:Pros and Cons of a good piece of legislation (Score:2)
That's why crime has gone up and up and up in the UK since firearms were banned... oh wait, no it hasn't.
Re:Pros and Cons of a good piece of legislation (Score:2)
Here is what you can do: (Score:2)
There is very little technology specific language in it, and it was written many, many years ago. We look to revise it at a certain interval, and always come to the conclusion that it still stands and applies as well as it did when it was written. The student judicial system and technology advise
Re:Pros and Cons of a good piece of legislation (Score:3, Insightful)
Really, it should be extremely difficult to pass a new law, and it should be clear that there is a solid need for it. Yes, that means the first people who commit crimes using new technology in new ways may not be prosecuted (note that I'm not talking about
Re:Pros and Cons of a good piece of legislation (Score:2, Insightful)
Re:Pros and Cons of a good piece of legislation (Score:3, Insightful)
Simple you provide a set of guidelines, perhaps backed up by examples, that define misuse. For instance phrase it thus:
It would be quite easy to prove that sending 3,000,000 emails to your ex-employer, especially in a short span of time, would fall foul of that law. Yes, you have to prove intent but you would have to do that anyway. Accidents wouldn't fall foul of this law but a clause for n
Re:Pros and Cons of a good piece of legislation (Score:3, Funny)
The cops had to individually read out each phone call from the itemized list they had been given saying something like "on 12th september 1985 did you make a call to 555 5555" and he had to answer yes or no. It took them 10 hours of interview to get through the list.
When it got down to it there wasn't a suitable law in statue and they could only charge him with "Theft of Electricity" and he ended up with a minor fine.
Re:Pros and Cons of a good piece of legislation (Score:2)
After I quit from a job, due to my salary being 3 months in arrears, I took the company to court to recover the money owed. To counterattack they tried to think of claims to make against me, like $100,000 in losses because I had left unexpectedly. Another was that I had used their Internet (dial up) access after I quit, which was true for a few days till
Re:Pros and Cons of a good piece of legislation (Score:3, Insightful)
There are many such laws. For example, criminal damage. If you infringe on another's property rights by physically damaging his/her property (b
Re:Pros and Cons of a good piece of legislation (Score:2)
Re:Pros and Cons of a good piece of legislation (Score:2)
One word: Mischeif (Score:2)
Re:Pros and Cons of a good piece of legislation (Score:2)
You could just as easily say:
"A person may not purposely hinder the rights of another to use their property and must not purposely attempt to harm or destroy another's property."
You need to be more specific if you want to distinguish crimes using technology from other property crimes. New laws must do more than simply restate old laws with different words. T
Time for a new server. (Score:4, Insightful)
Re:Time for a new server. (Score:2)
Erm, i'd severely doubt that, let me email 5,000,000 messages in 5 minutes and see if your server/network dies.
Re:Time for a new server. (Score:4, Insightful)
Re:Time for a new server. (Score:2)
Immense disk swapping ensues. System load increases.
Server 'crashes' (becomes so unusable as to be unresponsive even to administrative use, much less queueing or sending mail anymore).
Re:Time for a new server. (Score:3, Informative)
The default configuration of sendmail and many other common MTAs is to delay and stop accepting email to prevent exactly that.
Re:Time for a new server. (Score:2)
Re:Time for a new server. (Score:3, Informative)
And a thrashing server is not a crashed server by any means. If it's running a decent operating system (most UNIX-like systems, for instance), it should be working just fine within a short amount of time. Yes, it may not be the most responsive system for a little while, but it sure hasn't crashed.
Re:Time for a new server. (Score:3, Informative)
And then it spawns more and more processes to process the mail, eating up ram, at which point any other services on the box may be overloaded and deprived of resources.
No, the mail server is a dedicated box, and thee are limits to how many processes it will spawn. What it will do is queue a bunch of messages and work through the backlog. I can build a $3k box (plus the cost of a storage array if needed) that will handle a 20Mbit stream of mail all day long. This isn't rocket science.
Re:Time for a new server. (Score:2)
Perhaps this should start out as "no my mail server is a dedicated box..."?
See, there are other people in the world than yourself. And, while it's not hard to put together a Linux/sendmail ser
Re:Time for a new server. (Score:3, Informative)
See, there are other people in the world than yourself. And, while it's not hard to put together a Linux/sendmail server that can handle a 20 Mb stream, building one that also runs, oh, say, a web server, WebDAV, SQL, and a few other services useful to a small business may lead you to places where it's not true anymore.
Anybody that runs production hardware like that deserves what they get. There are serious security problems with running all-in-one solutions; if your needs are really so small, get a site
Re:Time for a new server. (Score:5, Insightful)
My "not credible" numbers are very typical for scenarios I work in. In this world of small enterprises, it's very normal to run an entire business with just a single server. Bitch all you want to about whatever security issues, I sure have.
Small business owners tend to have a case of megalomania. If they can pet the box, they "own" it. Thus, they'll spend $2,000 on a server rather than $25/mo on a managed solution because they can pet the box, even as they explain about the increased downtime because they don't have a dedicated admin, like their ISP.
Just because it's not true in your world, doesn't mean it isn't true!
Re:Time for a new server. (Score:1)
Actually what I think the proper terminology is: "No, MOST mail servers run on a dedicated box!" For this we k
Re:Time for a new server. (Score:2)
sure... we call these people "victims"
Re:Time for a new server. (Score:2)
Small business owners tend to have a case of megalomania. If they can pet the box, they "own" it. Thus, they'll spend $2,000 on a server rather than $25/mo on a managed solution because they can pet the box, even as they explain about the increased downtime because they don't have a dedicated admin, like their ISP.
Were you expecting sympathy? Anyway, My $2k pricetag was for a low-end server. If we're going to self host (instead of using a managed host for the web side of things like any smart businessper
Re:Time for a new server. (Score:2)
It's hard to think of something nicer than an ongoing service contract that requires a few hours per month reviewing log files, while the customer is blissfully happy because they just don't have to worry about things anymore
Re:Time for a new server. (Score:1)
Erm, i'd severely doubt that, let me email 5,000,000 messages in 5 minutes and see if your server/network dies.
Dude, if you can get a server/network which lets you email 5,000,000 messages in 5 minutes then I am pretty sure he can get a server/network to handle them.
Re:Time for a new server. (Score:2)
Umm, no. I don't see anything about methods in TFA, but wouldn't you launch the attack from multiple IPs across multiple address blocks. Like, you know, a "distributed" DOS?
Only one outcome to that scenario...
Re:Time for a new server. (Score:2)
Re:Time for a new server. (Score:3, Interesting)
Re:Time for a new server. (Score:1)
Proof... (Score:5, Insightful)
Really quite a predicament when too fast means you get poorly written laws, and too slow means the bad guys can work "legally" for a while...
Re:Proof... (Score:3, Interesting)
If 1000 people camped out in the middle of a public road in front of the entrance to a company, would they be breaking a crime by not allowing people to enter/exit? In essence, they would be executing a "denial of service" attack to the companies road.
Or what if a few 18-wheelers decided to park in the middle of an interstate to block it. This is also a DOS attack.
What if 1 million people concertedly & simultaneously dialed 911 for "testing pur
Re:Proof... (Score:2)
If 1000 people camped out in the middle of a public road in front of the entrance to a company, would they be breaking a crime by not allowing people to enter/exit? In essence, they would be executing a "denial of service" attack to the companies road.
Yes, they are comitting a crime. Such protests do take place occasionally, and there's always video footage of the police dragging protesters off to the cells, because you are not allowed to block a road or an entrance
Re:Proof... (Score:2)
The minimum time it takes for a law to pass takes precisely as long as it takes for something to blow up. You want a law passed all you need to do is connect it to some explosion and it will be in tomorrow.
Re:Proof... (Score:2)
Your Rights Online? (Score:4, Interesting)
Re:Your Rights Online? (Score:2, Insightful)
If this guy would be punished for annoying people by sending 3 millions E-Mails, it would set precedent to punish spammers.
It would seriously harm advertising industry, if spam would be banned. No responsible jugde would allow this to happen.
Re:Your Rights Online? (Score:2)
how so??? I don't get spam from reputable companies anyway... all my spam comes from some tossers in Florida trying to get me to buy Medz, or replica watches, or get a degree for no work... no reputable businesses there.
Re:Your Rights Online? (Score:2)
That is not the judge's choice. He only interprets laws, he cannot invent it. You are thinking of America, I think?
Re:Your Rights Online? (Score:2, Insightful)
Getting on trains, if you're Brazilian.
Re:Your Rights Online? (Score:2)
Re:Your Rights Online? (Score:2)
The Computer Misuse Act 1990 [opsi.gov.uk] created three offences: unauthorised access to computer material, unauthorised access with intent to commit or facilitate commission of further offences, and unauthorised modification of computer material. In this case, the judge ruled that a DoS isn't an unauthorised modification because the modification to the server caused by each individual email was authorised. Earlier
revenge (Score:4, Funny)
So let's see.. (Score:5, Funny)
Re:So let's see.. (Score:1)
spam (Score:1, Insightful)
Re:spam (Score:3, Informative)
Re:spam (Score:3, Interesting)
Congrats (Score:4, Funny)
Or maybe sign him up for a few catalogs.
Re:Congrats (Score:1)
Re:Congrats (Score:2, Funny)
slashdotted (Score:1, Funny)
yes, i'm feeling like slashdotting my employer's website.
Obviously, we need to run a test (Score:4, Funny)
Vengeance (Score:2)
bad PR (Score:2)
These were some nice days for the execs Blackberry (Score:2, Funny)
Just imagine that
Perhaps his exec forced him to do that?
computer misuse act does NOT need updating (Score:5, Insightful)
Denial of service is probably very difficult to encode in a similar fashion, since I do not see what *criminal* offence it would equate to.
In this particular care, there is no essential difference between sending a million emails and sending a million letters by post - both would swamp the service, but equally both are simply making use of the (e)mailing infrastructure as it was designed. (Yes I know letters cost more. That's irrelevant - they require more effort to deliver, and are priced accordingly).
Taking a different example, such as opening thousands of connections to a server with intent to deprive others' of access to it, I still can't see what equivalent physical world *criminal* offence has been committed. In this case an analogy requires many people, but what difference is it if a thousand people stand on the pavement outside a shop entrance effectively preventing other shoppers from entering, due to weight of numbers? Sure, the police can ask people to move on, which is the same as closing those open connections, no?
Since most electronic systems only enact operations which have equivalents in the physical world, I do not see how it would be right to create a law which makes the electronic equivalent illegal, when the physical original is not. This use of legislation creates the likes of the DMCA.
The Computer Misuse Act is a rare example of a really *good* law which is (1) broad enough to capture most offenders (2) easily tested for applicabilty i.e. not complicated with exceptions, extensions, etc and (3) not so vague that it is open to abuse.
Re:computer misuse act does NOT need updating (Score:2)
Re:computer misuse act does NOT need updating (Score:1)
From TFA:
The CMA, which was introduced in 1990, does not specifically include a denial-of-service attack as a criminal offense, something some members of the U.K. parliament want changed. However, it does explicitly outlaw the "unauthorized access" and "
Re:computer misuse act does NOT need updating (Score:4, Insightful)
You wouldn't get very far with this argument. Anything placed on a website is published. Anything published is public, therefore access is de facto authorised.
Now obviously you can put access controls on a website. But then you've taken a step to define authorised access. If you give someone a username and password, you've granted access. If someone obtains a username or password without permission, that's unauthorised. If someone bypasses this access control (and this bypass would probably have to be non-trivial; so if for example someone could cut and paste a URL which went directly to the material without being prompted, this would not apply) then it is unauthorised.
I personally think that "computer material" was a bad choice of phrase, and that "computer system(s)" is more appropriate. I cannot think of a way in which access controls could be devised which would NOT involve the owner of a computer system defining (at least implicitly) "authorised access". I'd make the assumption that in giving permission to put computer material on a computer system the owner of the material has agreed with the owner of the system on what arrangements are made for authorised access.
If my reading is correct it means a court gets to decide what is or is not authorised based on the circumstances, which is the Right Way IMO. Putting every conceivable situation in the Act would either be draconian or prone to loopholes as previously unconsidered situations arise.
Please give post your e-mail address so I can send details of the criminal suit against you 5 million times.
You're joking, of course. I suspect you could be charged with harassment (though maybe not criminally) and I would seek an injunction to stop you. Furthermore, the fact that you have made a threat which you are capable of carrying out might be common assault (which is a criminal offence).
Re:computer misuse act does NOT need updating (Score:2)
Some things I would like to take issue with, though.
You're making spurious claims entirely unsupported by the law in question. Again, to quote from the law in question;
I think you're misreading this. The intention as far as I can see is to prevent a defence of exemption. That is, to make the act of breaking in an offence (irrespective of target).
From wh
Re:computer misuse act does NOT need updating (Score:2)
No it would not. If the owner of the priveleged data put it on an unsecured website that is their problem, just as if they printed it and left it in public view on their front desk.
The offence was committed when the website owner obtained the data without authorisation from the data owner (and assumes they used a computer to do so).
Re:computer misuse act does NOT need updating (Score:2)
Can you explain to me how the law in question in any way suggests that claim?
It establishes intent (or lack thereof) on the part of the person accused. See one of my other replies for details.
If it doesn't, you cannot show intent, as above.
A website is not "public domain" in legal terms, if I publish something on my website, I still hold copyright for it, I'm still liable for it, I still own it.
What's pub
Attack? (Score:2, Insightful)
Re:Attack? (Score:2)
The sending of emails was using the system in the manner for which it was designed. If the system cannot cope, design a better system.
If you send a 30-ton package via airmail and the plane crashed because it was overladen, that's not your fault. The package should have been refused. Similarly, the email system designer should/could have
Why?!?!? (Score:2)
What the f*** was he sending that many emails for in the first place?
Because even if the law that dinged him is outdated, if DOS'ing (or even as simple as making mishchief) _was_ his intent, given the results, criminal activity was present (it seems that he just got charged specifically with the wrong thing).
No case here (Score:2)
Slashdot had better hope so or else they could be eligible for DoS prosecution.
Sorry, but that's a pretty dumb comment... (Score:3, Insightful)
Do you have any idea of the size of the company involved?
For all you know, the company concerned might have no more than a handful of employees, so a mail server capable of handling 5 million emails in a short space of time would be totally inappropriate. Not all computer crime is committed against large organisations that have turnovers that are measured in millions or even billions.
Wasting po
Re:Sorry, but that's a pretty dumb comment... (Score:3, Insightful)
For all you know, the company concerned might have no more than a handful of employees, so a mail server capable of handling 5 million emails in a short space of time would be totally inappropriate.
Let's see - 5M messages at 10k each = 50GB. If it were a small company, they may have only had a 1.5Mb line, so that 50GB would take about 50GB/150K/3600 = 92 hours to complete. Any mail server can handle that, and any competent admin should be able to block the messages within four days!
Of course, a 3rd part
Re:Sorry, but that's a pretty dumb comment... (Score:4, Informative)
Don't assume that everyone has full-time IT professionals to hand. Also, don't assume that the messages were small: they could have been 10KB each, but they could easily have been 2MB each, 2,000 times larger than your guess.
Also remember that the crime in question took place at least two years ago, when internet access would have been slower, disk space would have been more expensive, etc, etc. The average business today has better resources now than would have been available then, at least from a bang-per-buck point of view, if nothing else.
Of course, if you're implementing IT strategy for a large corporation then DOS contingency planning will be part of your job description, but if you're running a small company, one where the guy who looks after the PCs is the same guy who puts out the rubbish at the end of the day, then DOS attacks probably won't be on your radar.
Re:Sorry, but that's a pretty dumb comment... (Score:1)
Thank you! (Score:2)
Re:Sorry, but that's a pretty dumb comment... (Score:2)
Yep, that's probably what did it: 50GB of space for a mailserver a couple of years ago would have been unusual for a small company. Fill the drive, kill the server; do it over a long weekend.
TWW
Re:Sorry, but that's a pretty dumb comment... (Score:3, Informative)
If, on the other hand, they have a 10 megabit line (possibly shared with other companies in the building), it would only take about 4 hours to fill a 20GB hard disk (i.e. overnight -- even for a 60GB drive) -- which isn't
Re:Sorry, but that's a pretty dumb comment... (Score:3, Informative)
When a mail server gets messages faster than it can handle them, the proper thing to do is store the extra messages to a queue and handle them when it has time. When the queue gets full, or the server is getting messages faster than it can put them to the queue, the proper thing to do is to start refusing con
Re:Only 5 million emails and the server crashed? (Score:3, Insightful)
Re:Only 5 million emails and the server crashed? (Score:2, Interesting)
Well we don't know what mail server they were using, but that would be a problem with some popular servers that don't properly keep single copies of messages sent to multiple recipients CoughExchange5.5Cough. When I worked on OpenMail (now Scalix [scalix.com]) this sort of load would have been no problem for a small server with a few thousand users.
It's a question of min