Schneier on Security

Clive Robinson • March 9, 2011 7:53 AM

It is not the first time someone has thought about such behaviour in one way or another.

Some years ago in the UK a consultant who had supplied a bespoke program to a client put a simple “stop working afcter Xdate unless Ytrue” in case the client decided to not pay (which based on previous behaviour was quite likley).

Well the client did not pay, so the programer never set Y to true and after day X the program duly stopped working.

Now the client instead of paying screamed blue murder and the programer was prosecuted and found guilty by the judge under the UK’s Computer Missuse Act.

Apparently it is ok for a company to effectivly steal from you by not paying as this is a mear “tort” or civil offense for which there is a legal remedyl (no matter how expensive or ineffective it is). Where as simply putting an end date in your program (without making it explicit in the contract) to stop the person who has effectivly stolen your work from using it, is not a civil offense but a criminal offense and of you go to jail (at the expense of the taxpayer).

Clive Robinson • March 9, 2011 9:39 AM

@ john,

“However, I don’t see how Clive’s case is valid: the guy wasn’t paid, so he repossessed the goods sold but not paid for”.

Saddly not true in the way you think.

Section 3 of the CMUA1990 deals with unautherised access to data etc and is very very broadly scoped (way to broadly for many people as well as the later 3a update which is even worse)

Anyway the bare bones (you can search on the Internet for more info)

Alfred Whittaker MD of AAS Managment systems was found guilty at Scunthorpe Magistrates Court under section 3 of the Computer missues act when it was shown he had put a time lock into software supplied to Protech Formulations. Mr Whittaker was given a conditional discharge (which is effectivly the minimum sentance that the Magistrates could give).

The case all hung on the fact that Mr Whittaker admitted what he had done but could not show (for obvious reasons) that Protech had agreed to the software modification (time lock) that subsiquently denied Protech Formulations access to “their data” thus his actions where “unautherised” and fell within the scope of section three.

Protech Formulation’s unsuported claim was that the reason they had not paid was that the software did not “perform”.

Acording to some people he would not have been guilty if the software had been licenced as opposed to sold, or if he had put an enforcable cease to use clause in the contract of sale thus Protech could not have claimed they where unaware and thus the “crown” could not have claimed unautherised.

It caused quite a bit of concern at the time because if you think about it nearly all software is “unautherised” unless the software source is included in the contract….

Clive Robinson • March 10, 2011 12:53 AM

@ w

“You lot go back a long way”

Yup, in my case even further than Bruce (but don’t tell him that, he’s of an age when men get touchy about such things, I know I did 😉

@ Richard Steven Hack,

“REAL”shareware” back in the day rarely crippled or caused the program to stop working.”

I remember the change do you remember “nagware” as it became called.

Then there was “adware” now it’s all “malware”…

Here’s a thought for you, “how much did your first computer cost you?”

Not in dollars but as a percentage of the gross average income at the time?

My first computers I built myself and they were compleatly self designed and not cheap to put it mildly, to save cost I designed a “1 bit wide” CPU using NAND gates and D type latches and a couple of 8bit shift registers. The ROM of the state machine was two 0.1″ copper strip matrix boards (Veroboard) programed by soldering in 1N4148 signal diodes. The “input device” was a rotary telephone dial (pulse) and six push buttons, the output a hacked up neon “nixi tube” display from a broken frequency counter the number of times I got a belt of the display power supply I cant remember but it was a lot. The hight of it’s hardware acheivment was to multiply two nine bit numbers using a Nand gate as a one bit multipler and 4bit counters as the adders. It’s height of software acheivment was to play a few simple tunes and act as an octal calculator, due to lack of mind boggalingly expensive memory.

The first “proper CPU chip” kit I bought was the SC/MP 1 (effectionatly called “the scamp” or “scampie”) and the memory was measured in bits not bytes and not even close to a kilobit, it was a great deal of money at the time.

The first fully built computer I bought (and still own) cost the equivalent of a quater of a years money or about one fifteenth the cost of a house, and even then I got discount because the company I bought it from I worked for part time repairing both mechanical terminals and the new fangaled VDU’s…

The first “proffesional mainframe” I worked on was designed (supposadly) in the UK and had an operating system called “george” I still have part of it’s ‘core store’ around somewhere with tiny almost to small to see ferrite rings with the matrix and sense wires in different colour 40AWG enamaled copper wire. We used to have an “officialy sanctioned” AM radio to aid in program debugging and the mag tape decs had huge five foot high 18inch wide inch thick machined aluminium plates onto which the capstans motors belt drives heads and amps were built. The whole thing was a scrap merchants dream especialy as there must have been getting on for a pound or two of gold in it.