Bugbear leads to legal confusion

How would you feel if, languishing in bed with the flu, you got a letter from a solicitor blaming you for giving their client the same bug?

The letter demands that you hand over the names and addresses of everyone you know and, on top of that, they want you to walk down the street shouting 'unclean, unclean'.

No-one would stand for such behaviour in the real world, but in the online world this is just what almost happened to Computeractive reader Steve Hamilton.

Mr Hamilton tells me: "I received an email from a friend and, when I opened it, I found what I thought was a corrupted file.

"It was only after I received a couple of phone calls within a couple of hours from friends that I discovered this email actually contained the Bugbear virus and they had received the bug from me.

"I took appropriate action to clean and reinstall an antivirus solution to protect from further infection."

Mr Hamilton thought this was the last he would hear of the incident. Then he got a call from a company he had emailed some weeks earlier.

"They informed me that the bug was using my email name, but attaching their company name as well to the headers and the footers of the email," he explained.

"This made it look as if I worked for the company and that the company was sending out the virus. I was accused of causing them 'potential harm'."

Mr Hamilton was apologetic but astounded when the company demanded that he create an email apologising for being infected by the bug, stating clearly that he was at fault.

He was ordered to sent this to the company so that it could send it on to its customers. He was also told that he had to email apologies to all his contacts.

"I refused because, while I had a certain empathy with the situation, I felt that such an 'open' email could leave me potentially exposed to all sorts of possible grievances from companies known and unknown," said Mr Hamilton.

He thought his refusal was the end of the matter, until a week later he received a fax and letter from the company's solicitors demanding that he did exactly what the company wanted.

But now he also had to give the company a list of all names in his addresses book. And he was told that, if he didn't comply, the company would sue.

"Surely they have no right to demand of me to send such an email or right of access to my address book?" he asked.

I too thought the demands were out of proportion, so first I checked with antivirus company Sophos to see whether this virus could change the headers and footers on an email.

Carole Theriault, a spokeswoman for Sophos, replied: "The answer is yes. 'Bugbear-A' can spoof the 'From' and 'Reply To' fields in the emails it sends.

"It is a network-aware worm and exploits a security loophole in some versions of Microsoft Outlook."

So next I needed to find out whether Mr Hamilton was legally liable and called Alex Chapman, a solicitor with the Briffa law firm, who specialises in internet related cases.

There is no need to baffle you with legal jargon but, in essence, it does not seem as if this company has much of a case as Mr Hamilton didn't create the virus, or realise when he was first infected. And when he did realise, he took action to stop it spreading.

"I believe that it will be difficult for any party to sustain any argument that Mr Hamilton is liable, whether it is for unlawful interference with business, computer misuse or defamation," said Mr Chapman.

Mr Hamilton has not heard from the company again so hopefully things have died down. But he will contact with me again if they try and take it further.