OK, so it’s a deliberately tabloid attention-grabbing headline, but I don’t think they realise what they’re doing with this story.

As an ISP, this disturbs me greatly. We have customers that pay for bandwidth and the BBC are using that bandwidth? And did they bother to consider the fact that DDoS and spam attacks can have an detrimental effect on networks in the middle as well as their “willing” targets. The full BBC article makes it clear they just purchased an existing botnet from someone online, but supply and demand means this will just stimulate the botnet economy. The BBC even report themselves on the link between organised crime and botnet herders – fraud, blackmail, all that sort of thing. This isn’t just scare tactics, it’s part of my day job to deal with the fallout from such things so I’ve seen it first-hand.

And just because they didn’t have “criminal intent” it doesn’t make it legal – they freely admit to multiple violations of the computer misuse act.