On Saturday, a BBC Click television programme will show how botnets -- networks of compromised PCs -- are used to send spam and attack web sites. What has raised eyebrows is that the BBC bought its own botnet to do the job. You can pick them up cheap in internet chatrooms, though one security consultant reckons "the BBC got scammed on their way to expose the scammers by overpaying them".
The BBC posted two short excerpts from the programme on its website, with the headlines Cyber crime risk exposed (on BBC News) and BBC team exposes cyber crime risk.
Security expert Graham Cluley from Sophos, a UK-based antivirus company, pointed out on his blog that: "The Computer Misuse Act makes it an offence in the United Kingdom to access another person's computer, or alter data on their computer, without the owner's permission." He says:
Sure, a TV report like this can raise awareness of the serious problem of computers being controlled by hackers. But is it appropriate for a broadcaster to use innocent people's computers without their permission for the purposes of their experiment?
Out-Law.com duly asked a lawyer -- Struan Roberrtson, a technology lawyer with Pinsent Masons -- who also happens to be editor of Pinsent Masons' Out-Law.com. He confirmed that the BBC "appears to have broken the Computer Misuse Act," adding: "It does not matter that the emails were sent to the BBC's own accounts and criminal intent is not necessary to establish an offence of unauthorised access to a computer."
The maximum penalty for the offence is two years' imprisonment, but Roberrtson does not expect a prosecution "because the BBC's actions probably caused no harm. On the contrary, it probably did prompt many people to improve their security," he said.
The BBC said that, following its demonstration, it warned users that their PCs had been compromised, and it had closed down the botnet.
If the users pay attention and secure their PCs, they should be better off than if the BBC had not become involved.
Cluley says that his company has often been approached to help with similar demos and has always refused for ethical reasons: "Even if the BBC felt the impact would be minimal - it doesn't make it right."
Most visitors who voted in a straw poll at Cluley's site appear to agree: at the time of writing, 17% had voted "No, it's against the law" and 50% "No, it sets a dangerous precedent".
[Update] The BBC responded that there was "a powerful public interest in demonstrating the ease with which such malware can be obtained and used," and that it would encourage people to defend their PCs from such attacks. Also: "The BBC has strict editorial guidelines for this type of investigation, which were followed to the letter."
"Bots" -- robot PCs controlled remotely by hackers -- are a huge problem on the internet. Botnets are assembled and run by commercial -- though illegal -- operations on a professional basis: some will even give you service level agreements. Huge botnets are used to send billions of spam emails that create costs for everyone else. And as BBC Click also demonstrated, they can be used to swamp sites with traffic so that they stop working.
But security companies are not able to rescue and clean up these compromised PCs -- potentially to the benefit of their owners, as well as everyone else -- because of the legal and ethical issues.
After all, if you let people remove the Trojans that connect PCs to botnets, why not let them remove, for example, copyright music and movies, or pornography? Where does it stop?
