BBC Accused Of Illegal Botnet Use

BBC’s technology program “Click” purchased a botnet recently as part of an experiment meant to show how botnets can do damage. But by putting money in the hands of hackers, did BBC’s program do more harm than good?

Recently, the team at Click purchased a botnet to demonstrate to viewers the power wielded in the cyber-underworld. The team used the roughly 22,000-machine botnet to spam Hotmail and Gmail accounts they controlled, as well as to launch a distributed denial of service (DDoS) attack against a site owned by security vendor Prevx. The DDoS attack was performed with Prevx’s consent.

According to Click, the team shut down the botnet after their experiment was finished. Though the team said they never accessed information on the compromised PCs, they also claimed they notified the owners of the bots that they were infected. Click did not respond to an inquiry by eWEEK before publication, but those involved appear to have done this by modifying desktop wallpapers with messages to the owners that their computers were infected.

While Click maintains that no laws were broken, opinions on their experiment – which proved something that most people already know – were mixed, to say the least.

“[It’s] not even a gray area, it is flat out unprofessional,” said Gartner analyst John Pescatore. “It is like paying an arsonist to burn down an abandoned building to get good footage of flames. They could have gone to any one of several security vendors who could have demonstrated the severity of the bot problem.”

Click did not say how much money was paid for the botnet, but the story quoted a Jacques Erasmus of Prevx saying this: “computers from the U.S. and the U.K. go for about $350 to $400 (£254-£290) for 1,000 because they’ve got much more financial details, like online banking passwords and credit cards details.”

Leaving aside the financial details, there is an issue of law. While Click stated via a Tweet message that the program proceeded with legal advice, others have questioned this. For example, international law firm Pinsent Masons published an article both calling the experiment illegal and stating that the intent of BBC does not matter – only that unauthorized access occurred.

“A guest who is uninvited remains a trespasser regardless,” said Scott Crawford, an analyst with Enterprise Management Associates. “Would these same individuals have welcomed the BBC forcing its cameras into their homes?”