BBC's technology program "Click" purchased a botnet recently as part of an experiment meant to show how botnets can do damage. But by putting money in the hands of hackers, did BBC's program do more harm than good?
The minds behind BBC's television program "Click" have inadvertently thrust themselves into an ethical quagmire.
Recently, the team at Click purchased a botnet
to demonstrate to viewers the power wielded in the cyber-underworld
The team used the roughly 22,000-machine botnet to spam Hotmail
and Gmail accounts they controlled, as well as to launch a distributed
denial of service (DDoS) attack against a site owned by security vendor
Prevx. The DDoS attack was performed with Prevx's consent.
According to Click, the team shut down the botnet after their
experiment was finished. Though the team said they never accessed
information on the compromised PCs, they also claimed they
notified the owners of the bots that they were infected. Click did not
respond to an inquiry by eWEEK before publication, but those
involved appear to have done this by modifying desktop
wallpapers with messages to the owners that their computers
While Click maintains that no laws were broken, opinions on their
experiment - which proved something that most people already know -
were mixed, to say the least.
"[It's] not even a gray area, it is flat out unprofessional," said
Gartner analyst John Pescatore. "It is like paying an arsonist to burn
down an abandoned building to get good footage of flames. They could
have gone to any one of several security vendors who could have
demonstrated the severity of the bot problem."
Click did not say how much money was paid for the botnet, but the
story quoted a Jacques Erasmus of Prevx saying this: "computers from
the U.S. and the U.K. go for about $350 to $400 (???254-???290) for 1,000
because they've got much more financial details, like online banking
passwords and credit cards details."
Leaving aside the financial details, there is an issue of law. While Click stated via a Tweet message
that the program proceeded with legal advice, others have questioned this. For example, international law firm Pinsent Masons
an article both calling the experiment illegal and
stating that the intent of BBC does not matter - only that
unauthorized access occurred.
"A guest who is uninvited remains a trespasser regardless," said
Scott Crawford, an analyst with Enterprise Management Associates.
"Would these same individuals have welcomed the BBC forcing its cameras
into their homes?"