BBC Responds To Allegations About The Legality Of Their Report

A lot of the debate has been about whether we did the right thing digging into the murky world of hackers and organised cybercrime. In seeking to demonstrate the threat, had we put ourselves in the position of those we wanted to expose?

That's always a good question. After all, we could have simply described what we believe happens and given some warning advice, couldn't we? We've done this in the past. So have many others...

But hacking has gone professional. Today, your PC can be doing bad things to other people without you even knowing. It's a major growth area for organised crime: it's global, and very local to all of us who work, communicate, and play on the World Wide Web.

So we felt that there was the strongest public interest in not just describing what malware can do, but actually showing it in action. A real demonstration of the power of today's botnets -- to infect, disrupt, and damage our digital lives -- is the most powerful way to alert our audiences to the dangers that they face. It's a wake-up call to switch on that firewall and improve our security on the Internet.

We think that what we did was a first for broadcast journalism. We were amazed by the ease of use of the botnet, and the power of its disruptive capacity.

Noone watching our programme could learn how to build a botnet or where to go to to buy one. But what is very clear is the level of threat -- especially to home users who don't have the benefit of corporate-level security. (Our guide to PC protection is here.) As the hackers continue their silent running, we thought it was our job to expose the mechanics of their hidden economy. Please watch the full show and see what you think.

Struan Robertson, editor of out-law.com and legal director at solicitors Pinsent Masons, reckons the "powerful public interest" argument is irrelevant in considering whether the BBC acted in violation of U.K. computer misuse law. He told El Reg that BBC Click would do better to apologise than hide behind such shaky defences.

However, another claim could be raised. The BBC agreed to receive the spam, but did Google? What about Microsoft? "...they too might be in a position to bring an action for illegal activity," [Anne P. Mitchell, Esq., the CEO and president of the Institute for Social Internet Public Policy] explained, "...it doesn't matter that the BBC agreed to receive the Spam -- it still could have negatively impacted Google and it almost certainly violated their TOS -- unless they also had the prior consent of Google."

Yet, are the legal issues serious or just passive?

"The legal issues are real, and are potentially serious. The BBC could face criminal prosecution under both state and federal laws, as well as private lawsuits from their ISP (Google) and even any of the upstream providers that had to deal with the botnet traffic; and in theory, from the individual PC owners," she said.

In essence, he was acting in a manner according to his profession. Exactly the same way the BBC was.

"It is my firm belief that the conviction of Daniel Cuthbert will send out a powerful message to those who think hacking is some form of sport, where there is no victim, or indeed crime."

Some Reg readers have reported their concerns about the programme to the Met's Computer Crime Unit, which has said it's not prepared to do anything until a victim makes a complaint.[Emphasis added.] Given that BBC Clickcarefully chose machines outside the U.K. and U.S., this is unlikely to happen.