Panicked teen hanged himself after receiving ransomware scam email

An autistic 17-year-old college student has hanged himself after receiving a ransomware scam. Joseph Edwards was alarmed after receiving an email that falsely claimed he'd been spotted browsing illegal websites and needed to pay £100 (payable in Ukash electronic money) or face being prosecuted. The email pushing the well-known …

[Swarthy]

This is sad.

Sadly, as we can't really get at the culprits, we could try to get education publicly available, and common. What ever happened to the PSAs on (US) TV; or the after-school specials? The acting and dialog were truly dire, but they did address some issues of the time; I could see them being used for things like scam-ware and social media awareness. Just a little blurb in the middle of popular times announcing "The Police will NOT put a pop-up on your computer, that is a scam"*

*The police will kick your door in @ 3AM instead; that is legitimate police work.

[Yet Another Anonymous coward]

Re: This is sad.

Because a public information film would actually concentrate on not-accessing the web sites. Especially since a new UK bill has made an awful lot of soft porn web sites now illegal.

It bombards people with "you wouldn't steal a car" ads on DVDs and dire FBI warnings and official statements how video downloads fund terrorism.

All this makes it rather more likely that if you received an email noting that you had watched copyright content on youtube you would soon feel the long arm of the law.

[Robert Helpmann??]

Re: This is sad.

What ever happened to the PSAs on (US) TV; or the after-school specials?

This would be really nice to see. Perhaps we could start a petition of Disney-ABC to bring back School House Rock. There was, after all, a series of Computer Rock songs as a part of it that addressed basics like hardware and software, and number crunching. Suggested new titles could range from "Malware Blues" to "Fishy Phishing." My favorite would be "What Do We Do With a Spammer?" Fun for the entire family.

Ahhh! Now I have the lyrics of these non-existent songs stuck in my head!

[J__M__M]

Re: This is sad.

No, don't bring back school house rock. They'll screw it up horribly.

[Anonymous Coward]

Sad, and not good enough

"Detective Sergeant Peter Wall said it was very difficult to trace those responsible for the "elaborate" scam"

Well maybe his senior colleagues need to bloody well try harder, instead of wringing their hands and saying "oh what a pity".

I'd accept that DS Wall doesn't have the clout to change the world, but its long overdue that the Plods started taking cyber crime seriously - spam, counterfeit & illegal goods, identity theft, extortion and fraud. It's not as if the state hasn't reserved vast and essentially ungoverned power in terms of communications, not to mention vast leverage over ISPs. Ultimately this would need heavy handed government backing when dealing with recalcitrant East European shit holes, but that's something that (just maybe) the lazy arseholes of Westminster could get off their backsides and support.

[Anonymous Blowhard]

Re: Sad, and not good enough

I don't think that the problem is with "recalcitrant East European shit holes", in fact I'm pretty sure that the police in some of these places would be more than happy to assist the UK police; particularly in those countries that are seeking EU membership. Did anyone even ask them to help?

The problem in this case is that it isn't "terrorists" (real or perceived) and it's not politicians or celebrities, so as far as the UK establishment is concerned it's not important enough to devote resources to identifying the perpetrators.

If they ever do notice this tragic event, the most that Dave and Theresa might do will be to shout about how additional snooping powers might help them "stop this sort of thing".

[Anonymous Coward]

Re: Sad, and not good enough

Completely agree, this is heartbreaking enough to read, I can't imagine what the family is going through. Detective Sergeant Peter Wall does indeed need to pull his finger out, and rapidly - because whilst this isn't murder in the eyes of the law, morally it's as close to it as makes no odds.

[Anonymous Coward]

Re: Sad, and not good enough

They do have the originating IP, so they could try and track that back. Also they have the link to the false police page (probably on a hacked site, but they could at least inform the site-owner and change that page so other people aren't suckered).

[Anonymous Coward]

Re: Sad, and not good enough

"They do have the originating IP, so they could try and track that back."

The IP could have been easily spoofed, but even if not the chances are they'd point to some sucker's domestic PC recruited as part of a botnet, which in turn communicates with a C&C server in another country which may or may not be host to the vermin behind this. I've plenty of sympathy for the DS quoted, because he's technically outgunned, and unsupported by the people who could and should provide him with the resources to track down the perpetrators.

[Yet Another Anonymous coward]

Re: Sad, and not good enough

But presumably the account the money is being sent to isn't quite so easily spoofed.

If it is too difficult to trace where money from scams like this is being sent, then presumably it's also too much effort to trace money being sent to terrorists by the same method?

(Like the money that I'm supposed to send to fund terrorism everytime I watch a pirate VHS)

[Mark 85]

Re: Sad, and not good enough

I've plenty of sympathy for the DS quoted, because he's technically outgunned, and unsupported by the people who could and should provide him with the resources to track down the perpetrators.

Which leads us back to the GCHQ, NSA, etc... they all lay claim that their job is to protect us via their surveillance from external threats on the interwebs. I would think that these agencies could shut down the C&C sites, block malware, and even 419 spam. I think a case could be made that if they're capable of this, then their surveillance slurps would be smaller and allow actual analysis instead of after-the-fact "oh... yeah.. we had them in our sights but hadn't got to processing things yet.".

Wishful thinking on my part.

[Wzrd1]

Re: Sad, and not good enough

"The IP could have been easily spoofed..."

Not really. IP spoofing works for something like UDP, but remember, SMTP is a two way communication process. Responses have to be received from server messages. Spoofing would prevent those server messages from being received.

There are some ways around that, but they're not very reliable.

[Anonymous Coward]

Re: Sad, and not good enough

GCHQ want all this extra security put in place, OK I'll bite and go along, IF they use it to help catch scum that push ransomware instead of trying scare people with the paedo-bogeyman, tell us something useful that will done with the surveillance they want put in place.

[Roo]

Re: Sad, and not good enough

"Well maybe his senior colleagues need to bloody well try harder, instead of wringing their hands and saying "oh what a pity"."

The fact that a detective can trot out this bullshit, yet we see plods track down folks who crack US Navy boxes with default passwords without breaking a sweat tells exactly how much his senior colleagues care about ordinary citizens.

[Mark 65]

Re: Sad, and not good enough

GCHQ with their complete data trawling would know where it came from. Even if it came via a bot net they'd know seeing the recent data drop about how they can easily takeover and run botnets. They're missing a positive PR angle here.

[J__M__M]

Re: Sad, and not good enough

You want local police to spend time chasing down spammers? That's insane.

[Adrian 4]

Re: Sad, and not good enough

Yes. Yes, I do.

They do a lot more harm than terrorists, or badly parked motorists.

[Anonymous Coward]

Frankly its disgusting the police are allowed to just drop this like they have, claiming ignorance.

Do your god-damn jobs, you have extradition in place with most of the world, go track them, catch them and lock them up!

This stuff makes me angry!

Meanwhile, the bbc just locked up your gran for failiure to pay the license fee even though she doesnt own a tele.

[Steven Jones]

Privacy and policing

Given the number of people who appear to object in principle to the whole idea of any state surveillance capability on use of the Internet (evidenced by the number of comments on this site, others, Twitter, mainstream media any time these issues come up), then it's pretty near impossible to track down the source of these scams, at least without a huge amount of technical and manpower resources, and even then it's doubtful.

These objections are based on the whole issue of traceability, privacy and (I often suspect), a good deal of egotistically driven paranoia. Unfortunately those very same measures which make it virtually impossible for the state to snoop on your activities also makes it easier for scumbags to prey on the vulnerable.

So, decide what you want. It's simply not possible to have an Internet landscape where you have effective policing and complete protection of personal privacy. You can have untraceable electronic transactions and currency. You can have unbreakable encryption, Internet anonymity and the like. But you can't have that with tracking down Internet crooks. Something has to give.

[Anonymous Coward]

Re: Privacy and policing

"You can have unbreakable encryption, Internet anonymity and the like. But you can't have that with tracking down Internet crooks. Something has to give."

You, sir, have missed the point. Most of us don't object to state surveillance. We object to state surveillance without oversight, and without a judge's warrant.

[Steven Jones]

Re: Privacy and policing

You might, but many object in principle to the retention of logs, backdoors into encryption and much else, even with judicial oversight. We have developed such systems over hundred years for physical records, yet virtual ones are considered sacrosanct by many.

I still see from the reaction to my comment that some are still unwilling to accept the logical consequences of opposition to record keeping, even with judicial oversight.

So for those that promote untraceable financial transaction systems, be aware that this is the enabler and motivation for crimes such as this. Be careful for what you wish, because it may be granted, because everything has consequences to consider.

[MacGyver]

Re: Privacy and policing

"for those that promote untraceable financial transaction systems, be aware that this is the enabler"

That right there.

Where did the popup come from? Irrelevant. (it's not the computer of the bank account holder, and in the end after trace after trace, it may have simply come from some random WEP secured wifi anyway)

The only reason this persists is that at some point a government or police department can't gain access to the bank account holder. Period. The end.

I agree with the commenter above that the only real way to combat this is with education. Educate people that the police will never "bill" you with Bitcoin or Paypal and the problem goes away. I mean really educate, not some PSA played 3 times at 23:56 in the middle of the night in-between infomercials, but in the paper, on the local movie theater ads before the movies, and billboards.

[phil dude]

Re: Privacy and policing

although that is the subtlety lost on all gov's, they just what to snoop.

The thing about these scams is that there are SO many of them, one must ask the question if there is a technological way of reducing them.

I use SpamAssassin (as does Oxford) and it has been a while before a scam actually made it to my inbox not marked "Junk".

This is a sad story, because of the futile nature of the crime. Manslaughter? Any legal folks know how this could be classified? Didn't the DOJ hound someone else to suicide?

P.

[fruitoftheloon]

@Steven: Re: Privacy and policing

Steven,

so it is not possible to ever catch bad guys unless we record everything that everyone does?

My derriere matey, it would help if the Police actual got off there arses, found some help and did some f'ing Policing...

I sincerely hope that you are not in the service of Her Majesty's Constabulary, if you are I suspect crime would be very high on your beat...

Wake up please...

[Mark 85]

Do your god-damn jobs, you have extradition in place with most of the world, go track them, catch them and lock them up!

The big problem here is the same we see in the States with ID theft, etc. Money. It costs money to fly the plods to pick up the perp and fly them back. It takes resources on the local side where the bad guys live to find them and arrest them and then hold until the extradition papers, etc. and the transporting cops show up. No one wants to spend the money. For most internet crimes like this, the penalty is a slap on the wrist and those running things want a bigger bang for the buck.. like a high-profile felony case.

[Paratrooping Parrot]

This is what really infuriates me about the police and other law enforcement people. Unless someone is famous or rich, they will not bother checking to see who is causing all these scams. Many people who are uneducated about computers are being scammed and embarrassed and the only reply from the police is: "Sorry folks, no can do." Whereas if it was a high ranking politician who had been scammed, the FBI is used in the United States.

[Martin]

How to spoil a good comment.

Meanwhile, the bbc just locked up your gran for failiure to pay the license fee even though she doesnt own a tele.

It's an excellent comment, but completely undermined by this ridiculous piece of exaggeration at the end. I want to upvote you for the comment, but downvote you for this.

[Anonymous Coward]

Re: How to spoil a good comment.

yes it was a silly exaggeration - but not too far as you'd know if you'd ever been hounded by these people.

My point was - do something that barely constitutes a crime and you have a whole company / department chasing you.

Do something like this and we give up at the first hurdle.

[Rob 44]

Re: How to spoil a good comment.

Its not an exaggeration: http://www.belfasttelegraph.co.uk/news/local-national/northern-ireland/woman-pensioner-jailed-for-not-paying-tv-licence-ridiculous-cost-of-jailing-fine-dodgers-in-northern-ireland-29221028.html

['s water music]

Re: How to spoil a good comment.

Its not an exaggeration:

claiming that the bbc just locked up your gran for failiure to pay the license fee even though she doesnt own a tele is not an exaggeration because someone else over 60 was imprisoned for failing to pay a court imposed fine is not a good argument. Note that my point is not that prison for fine defaulters is a good thing. It is that category errors in support of specious statements are a bad thing

[MrZoolook]

Re: How to spoil a good comment.

"Its not an exaggeration: http://www.belfasttelegraph.co.uk/news/local-national/northern-ireland/woman-pensioner-jailed-for-not-paying-tv-licence-ridiculous-cost-of-jailing-fine-dodgers-in-northern-ireland-29221028.html"

Nothing there about anyone WITHOUT a television being jailed for TV license evasion, pensioner or otherwise.

[codejunky]

Wait a minute

I thought all this fancy spying without court oversight would enable them to hunt terrorists and anyone who dare fart in their computer chair. So where is this all powerful might that seems to be turned on everyone? Or does it only have its uses against journalists and opposition?

It is a shame the lad didnt think he could turn to anyone (as a part of his disability or his social surroundings). Instead of seeking criminals in every action a computer can sift through maybe more emphasis should be put on helping each other.

[Graham Marsden]

Re: Wait a minute

Well obviously the Security Services just need *MORE* snooping powers...

[Roo]

Re: Wait a minute

"Well obviously the Security Services just need *MORE* snooping powers..."

Tell that to McKinnon et al.

[Graham Marsden]

@Roo - Re: Wait a minute

I think your Irony Detector isn't working...

[Roo]

Re: @Roo - Wait a minute

"I think your Irony Detector isn't working..."

It's working fine, I was embellishing your post. :)

[Graham 24]

Re: Wait a minute

I thought all this fancy spying without court oversight would enable them to hunt terrorists and anyone who dare fart in their computer chair"

It probably does, but just as likely is that intercept data would not be used for a case like this, since it exposes the true depth of the state's capabilities. Even if the content isn't captured, I would imagine that source IP and mail headers have been, especially for a foreign-originated email.

[skeptical i]

Much condolence to the family.

Losing a child has to be tough, but to lose one for such a bull$hit reason ... I just can't imagine. I'm so sorry.

[Old Handle]

Regarding the policing aspect

What I don't understand is how these crooks can get away with using services like Ukash and GreenDot. Normally governments make a big freaking deal about preventing money laundering. I find it hard to believe that these payment methods are allowed to exist if governments can't track where the money goes.

[Anonymous Coward]

Re: Regarding the policing aspect

Any criticism of these currencies or Bitcoin results in a flurry of downvotes on El Reg. One obvious problem is that while on the one hand governments and central banks would like to shut them all down, conventional banks are thinking about how they can profit from them and the security agencies are thinking about how to use them to pay their spies untraceably.

My grandfather's equivalent of a credit/debit card was a small leather bag the size of a finger full of gold sovereigns; another untraceable currency. In an emergency it could be concealed quite effectively but it held the equivalent of several thousand pounds at today's prices. Untraceable cryptocurrencies that can be transferred electronically are a whole order of magnitude more useful.

[John G Imrie]

Things the Police should do

1) Close down the web site.

2) Track back the email

3) Treat this crime as seriously as murder.

[Gannon (J.) Dick]

Re: Things the Police should do

3) Treat this crime as murder really is: not random, haphazard nor unavoidable, but always tragic.

FIFY

[Khaptain]

Devils advocate

Ok, I will play the devils advocate after being appaulled at some of the comments.

This guy had autism problems, the article does not state how serious those problems were. I can only presume from the poorly reported article that his autism was sufficiently severe that he was a very fragile person.

I personally think that many of the above comments are nothing more than Daily mail readers comments. A psychologist would be forced to admit that a severe autism sufferer is someone in an extremly delicate position and as such requires only the slightest of reasons in order to be pushed over the edge.

By reading the above comments, most notably the one that states that this should be treated as murder, I am forced to realise how many people have succumbed to the principals of the 'Nanny State".

I wonder how many hyprocrits there are in the above El Reg tards, how many of you are happy to support the "Je Suis Charlie" meme and at the same time are capable of condemning these spammers/malware authors as murderes.. Seriously to demand that someone be condemned for murder because of a pathetic email/ransomware email is far more pathetic.

Yes, I agree that malware authors should be punished for the crap that they make people endure but to go the point of putting them on trial for murder is like going back to the "Hunt the Witch" years.

The honest truth of the matter is that this was someone that was already on the edge, was extremely fragile and unfortunately not in a position to handle a given situation.

El Reg has pushed out an 'extremely poor' article using the lame excuse of cause and effect in order to rattle the 'sympathy' vote rather than treating the far more serious issue of autism.

I couldn't give a shit about the downvotes as anyone that does is merely showing his complete lack of desire to understand a problem and providing possible solutions but whi i happy to instead add themselves to the Daily Fail consensus.

Very few if any of the comments actually mentioned this guys illness, instead they chose to play the "I am deeply astounded card"...

This is one of those days when I realise that is actually possible to sink lower than Rupert Murdoch.

[Anonymous Coward]

Re: Devils advocate

I don't know your nationality but there is a principle of English law that says "you take your victim as you find him." If you thump an elderly man mistaking him for a fellow thug, your mistake does not get you off if he dies.

US law doesn't apply here, except when an idiot manages to penetrate their insecure servers and someone wants to swing a big dick - sorry, stick - pour décourager les autres.

Pour moi, je ne suis pas Charlie - I think it is possible simultaneously to believe that people who think guns constitute an argument should die by their own creed, and that Charlie Hebdo could have made every point it wanted to against fundamentalist Islam without any pictures whatsoever of Mohammed, and that gratuitous insults are not arguments either. But I do believe that if these people are ever caught, every offence in the book they have committed should be used against them, from impersonating a police officer to assault (which in this country can consist of threats without physical violence). And if they have money, the civil courts should be used to take it off them in compensation. Make the crime not worth the effort.

[Will Godfrey]

Re: Devils advocate

Yes, I downvoted you. You accuse others of exactly the same thing you are doing yourself.

[DocJames]

Re: Devils advocate

"I can only presume... his autism was sufficiently severe that he was a very fragile person."

Yet managed to go to a mainstream school. Unlikely to be "very fragile".

"nothing more than Daily mail readers comments" - your post is a classic example of Poe's law. The phrasing of your comments following this line makes me suspicous...

[Khaptain]

Re: Devils advocate

"I can only presume... his autism was sufficiently severe that he was a very fragile person."

Yet managed to go to a mainstream school. Unlikely to be "very fragile".

If the Autusim was not severe, then why bother mentioning it in the article.

If this person was not 'fragile', as you infer, then I do not understand how the email/ransomware email had such a devastating effect. Many people receive these damned emails but most people will not commit suicide because of it.

[DocJames]

Re: Devils advocate

Autism can be thought of as a lack of theory of mind. This means that they cannot understand other people as having independent minds, or the emotional responses from others. This means they seem to lack empathy. They also struggle with understanding lies/untruths, and take the world as it appears. This means that intimate relationships are challenging (if you don't understand white lies and emotional context, responding to "does my bum look big in this?" is impossible).

With this understanding, can you can see why someone with autism who receives an email saying his sexual predilections are going to be publicly announced might respond in the way he did?

Wikipedia has a bit on theory of mind and "The curious incident of the dog in the night time" by Mark Haddon is excellent at helping understand the thoughts of those with autism. You could also look at http://www.autism.com/understanding_theoryofmind

NB: good for you for demanding answers from me, rather than standard internet behaviour of retreating into a slanging match. It's encouraged me to answer :-)

[Khaptain]

Re: Devils advocate

"With this understanding, can you can see why someone with autism who receives an email saying his sexual predilections are going to be publicly announced might respond in the way he did?"

Yes, I can easilly understand the predicament but I would suggest that the email was merely the heat at the end of a very short fuse, sooner or later the bomb was going to go off.

What I think many people fail to see is that the email in question was never intended to cause anything other than personal embarassment, and like most spam messages, was decided to catch maybe 1 in 1000000 people.

In my personal opinion, this guy was one of those "extremely" out on the edge, extreme cases that no amount of protection will ever cover. If it wasn't this email, or an image, or a particular sound then it could have been any of a thousand other reasons that would have pushed him over the edge. We here about teenage suicide for far less serious issues than this.

Like most people, I too have days when certain things get me down, upset or damned angry and I am incapable of predicting the how, why or when they will happen. I will never be able to fully protect myself from all and any future threats, unfortunately this guy's limits were a lot lower than most of us and we will never be able to detect or protect fully for such cases.

If we lived in a world where we understood more about these things and took action against them then we would probably inadventantly create people with even lower levels of tolerence.. Nature has an almost uncanny capacity for adjusting /re-adjusting to our contexts.

[DocJames]

Re: Devils advocate

Well, to continue your analogy, the heat still needed to be applied to the fuse. Just because it lit more easily than expected is not a defence. See Arunat the less' explanation beneath your first post.

You don't need new laws, or a big change in society, or adjusting our tolerance. You don't need "protection", whatever that means. It just requires application of current laws. In essence, this man was driven to suicide as a result of some people's attempt to extort money. I think that requires prosecution*. You are welcome to disagree, but I think you're wrong.

*probably not for murder - they didn't actually act to kill him. And prosecution doesn't mean they're guilty, just the Crown think that they are and have a case to answer.

[DanceMan]

White collar crime

Part of this issue is the plod reluctance to pursue white collar crime. Big news item here in Vancouver yesterday was victims of a rental scam (showing suites they do not own and scamming deposits from prospective tenants) trapping a miscreant and holding him for police. Plod would not come in advance until "a crime had been committed" and even now, the crim, who carried several different ID's, has been released and may not face charges. No question most white collar crimes are difficult and time consuming to investigate sufficiently to prosecute. It's so much simpler to nab a thief, or set up a radar trap (apparently in that case the "crime not yet committed" does not apply) but we are leaving a whole class of societal victims unprotected.

[ukgnome]

This is tragic

in no way is this meant callous, but all the demands for the police to do more should stop and think.

Maybe if there was some sort of charter that monitors internet activity and was able to assist police better in catching these bastards.

[Cynicalmark]

Impotent plods

When they want tax payments they always are able to track the money across the globe. Come on Mr. plod - use what brains you have and recruit hackers to find these scumbags. I think you would be surprised how many will rise to the task to bring these unscrupulous aholes to book

[John Savard]

New Laws are Needed

Under current law, I don't think the people responsible for this ransomware, if they were ever brought to justice, could be charged with murder. That should be changed. People who drive others to suicide through harassment and similar actions should pay the just price for what they have done.