Bandwidth bandit loses business

By PETER GRIFFIN

Net4U's days as an up and coming internet provider are numbered as damning evidence emerges that the Hamilton start-up has been stealing internet bandwidth from large suppliers to prop up its business.

An investigation is underway into the cyber-activities of Net4U and its founder, 17-year-old Sahil Gupta, with his admission that the company had been covertly "leeching" bandwidth capacity from Attica - a now defunct subsidiary of internet provider and tolls operator CallPlus.

"Dude, we were leeching 512Kbps international off [Attica]. You know how much it costs? ... $2000 a month," Gupta boasted in a recording of a conversation obtained by the Herald.

He goes on to say that Net4U services, including his dial-up and server co-location customers, his "home link" and his "KaZaA" - a reference to the peer to peer file-sharing network - were all operated with stolen bandwidth for a "six-month" period.

In addition, Gupta said he was supplying an internet cafe in Dunedin, and two in Hamilton, including Netstation.

Sahil's father, Shashi Gupta, a senior lecturer at Waikato Technical Institute, and the owner of the Netstation net cafe, said he had no idea what Net4U was doing.

CallPlus is considering laying a criminal complaint againt Net4U and is in discussions with the police.

Net4U may also have bought itself an even bigger fight, this time with Telecom. "He is signing up Jetstream Starter customers on the Jetstream realm, which enabled the Jetstart customer to connect to and utilise the Jetstream bandwidth without Telecom knowing," a source close to Net4U told the Herald. "He was leeching Telecom bandwidth."

Telecom has begun an investigation into the claims, but spokesman John Goulter said it would be difficult to tell exactly what Net4U had been doing.

Many had questioned Net4U's ability to offer Jetstream Starter at the low price of $24.95 with unlimited data transfers for so long. Net4U put its price up to the $29.95 industry standard only last month. Most internet providers make just $3 to $5 a Jetstream customer at the higher price. Gupta would not discuss the claims.

But confronted with the information about Attica, Gupta told the Herald that he had seen Attica's server listed on an open proxy server list on the internet. Instead of contacting Callplus, Net4U decided to freeload on its bandwidth connection.

"This is ancient news. It went on for about a month and a half ... late last year. It was an open proxy server. It's meant for public use, isn't it?"

Net4U gained access to Attica through an open proxy server - which allows free access from across the internet without authentication. Open proxies are key targets for hackers and spammers because, when used as a base for launching attacks, they make the origin of the attacks hard to trace.

An oversight left Attica with a major hole in its network security, giving Net4U a direct tap to a 512Kbps capacity international bandwidth link - for free.

CallPlus picked up the exploit three weeks ago as part of a regular audit of its cache servers. The server was taken down and reconfigured.

CallPlus operations manager Dean Sutcliffe said it was difficult to tell how long Net4U had been feeding off the company. The server had been left wide open during nine months of restructuring at CallPlus.

"In the restructuring we've actually moved a number of staff on and its possible one of them failed to identify it," said Sutcliffe.

Net4U had admitted the bandwidth leeching to Attica and apologised, clearing the way for Attica to lodge a criminal complaint.

Gupta formed Net4U in late 2000, with older brother Anshul acting as company director. He started out in the computer industry at the age of 12, buying old Pentium 100 Machines at auction, adding components and reselling the machines privately.

Sutcliffe believed that what Net4U had done broke existing laws.

"Whether it's bandwidth, oil, gas, whatever, effectively what's taken place is theft.'

One internet provider the Herald spoke to said a 512Kbps (kilobits per second) international bandwidth connection would cost it $2700 including GST per month. '

As news of Net4U's actions spread last week, customers and business partners scrambled to distance themselves from the ailing company.

One "virtual" internet provider, which put its dial-up and Jetstream capacity needs through Net4U, had already jumped ship.

"His whole organisation is built on a scam. The way he handles his customers, he shouldn't be in business," said a source from the company.

Two customers said they were considering pursuing Net4U in the Small Claims Court for amounts of money they were owed.

Walker Wireless managing director Bob Smith said he was reviewing the company's relationship with Net4U, a "minor customer".

The story so far

* Hamilton internet provider Net4U has admitted leeching international bandwidth from Callplus without authorisation.

* Net4U accessed CallPlus' network through an open proxy server for a period that may have lasted up to six months, worth up to $12,000.

* CallPlus is now considering legal action and is in discussions with the police.

* Further claims have Net4U leeching bandwidth from Telecom to supply its Jetstream Starter customer base.

* Net4U is losing business partners and customers as news of its activities spreads through the industry.

Through a legal loophole

With no legislation covering the theft of internet bandwidth, pursuing a criminal conviction for Net4U may be difficult, says IT law specialist Chris Patterson.

The outdated Crimes Act (1961) draws a distinction between "tangible" and "intangible" goods and services and generally does not apply to the latter.

The Telecommunications Act does not cover bandwidth theft.

But Patterson says the Crimes Act was amended to close a loophole that meant the law did not apply to the theft of electricity, an intangible asset.

In 1999, an Appeal Court case of R v Wilkinson threw out a theft conviction involving a convoluted electronic transfer of funds. Theft did not apply because nothing physical had been stolen.

The loophole for this type of transfer is being remedied in the Crimes Amendment Bill with a better definition of "property".

Patterson adds that CallPlus could take a civil case against Net4U for electronic trespass, and seek damages. Auction website TradeMe threatened similar action last week against Tradewise, which was accessing TradeMe's website to gather content.

A case of unjust enrichment could also be pursued, says Patterson, with Callplus claiming Net4U profited from access to a resource it had no rights to.

Any civil case would be expensive, making the pursuit of a criminal case more attractive to CallPlus.

The Crimes Amendment Bill (No 6) is before Parliament awaiting amendments relating to computer crimes.