BBC Program Purchases Botnet, Touches Off Ethical Debate

Via eWeek.com -

BBC's technology program "Click" purchased a botnet recently as part of an experiment meant to show how botnets can do damage. But by putting money in the hands of hackers, did BBC's program do more harm than good?

The minds behind BBC’s television program "Click" have inadvertently thrust themselves into an ethical quagmire.

Recently, the team at Click purchased a botnet to demonstrate to viewers the power wielded in the cyber-underworld. The team used the roughly 22,000-machine botnet to spam Hotmail and Gmail accounts they controlled, as well as to launch a distributed denial of service (DDoS) attack against a site owned by security vendor Prevx. The DDoS attack was performed with Prevx's consent.

According to Click, the team shut down the botnet after their experiment was finished. Though the team said they never accessed information on the compromised PCs, they also claimed they notified the owners of the bots that they were infected. Click did not respond to an inquiry by eWEEK before publication, but those involved appear to have done this by modifying desktop wallpapers with messages to the owners that their computers were infected.

While Click maintains that no laws were broken, opinions on their experiment – which proved something that most people already know – were mixed, to say the least.

“[It’s] not even a gray area, it is flat out unprofessional,” said Gartner analyst John Pescatore. “It is like paying an arsonist to burn down an abandoned building to get good footage of flames. They could have gone to any one of several security vendors who could have demonstrated the severity of the bot problem.”

Click did not say how much money was paid for the botnet, but the story quoted a Jacques Erasmus of Prevx saying this: “computers from the U.S. and the U.K. go for about $350 to $400 (£254-£290) for 1,000 because they've got much more financial details, like online banking passwords and credit cards details.”

Leaving aside the financial details, there is an issue of law. While Click stated via a Tweet message that the program proceeded with legal advice, others have questioned this. For example, international law firm Pinsent Masons published an article both calling the experiment illegal and stating that the intent of BBC does not matter – only that unauthorized access occurred.

“A guest who is uninvited remains a trespasser regardless,” said Scott Crawford, an analyst with Enterprise Management Associates. “Would these same individuals have welcomed the BBC forcing its cameras into their homes?"

--------------------------

Very unprofessional indeed...and perhaps illegal...as none of the owners of the zombies [bot computers] granted permission for BBC to be on their computer...thus they gained unauthorized access to 22,000 international machines. Some of these machines may be owned by corporations or governments...making the issue even more serious.

Just because someone has already broken into my house [by breaking the door]...and stole my TV...doesn't mean you can come in, digg around and leave a sign.

Cue Drama Button...