Security experts blast BBC over botnet stunt

The BBC's actions have been condemned on legal and ethical grounds

Security firms around the world have criticised the BBC over its conduct in a recent episode of the programme Click.

The episode involved BBC reporters enlisting the help of third-party security experts to conduct an investigative report on building a botnet. The team was able to purchase a network of 22,000 controlled systems which were used to send emails and perform a denial-of-service attack on a test web site.

The BBC later dismantled the botnet and informed the owners of the compromised systems, but the story drew criticism from security experts. Sophos senior security consultant Graham Cluley condemned the attacks as a breach of the Computer Misuse Act.

In the days following the report, it has become apparent that Cluley is far from alone in his condemnation.

"The BBC simply didn't need to go as far as it did to demonstrate the cyber criminal possibilities of a botnet," argued Paul Ducklin, head of technology for Sophos' Asia-Pacific branch, in a blog post.

"The demonstration it filmed could easily, more scientifically, probably more effectively, and definitely more quickly, easily and safely, have been done in a research laboratory."

A Sophos web site poll found that 56 per cent of visitors felt that the action was wrong on either legal or ethical grounds, while only 33 per cent felt that the awareness raised by the report justified the BBC's actions.

Researchers and executives from other security firms, such as McAfee, F- Secure and Sunbelt Software, are throwing their support behind Sophos.

"You just don’t get involved, because it's wrong and there are too many unintended consequences that can occur," wrote Sunbelt chief executive Alex Eckelberry in a blog post.

"To have a TV show use a botnet to 'prove a point' is beyond the pale, particularly since the point could have easily been proven in other ways."