EH-Net

Hi,

I thought I would float the idea, see if anyone was interested. This wouldn't be anything special, just a few people working together to remove some of the cyber threats that are out there.

At the very least we would be able to learn off each other, sharpen our skills and gain some experience of working in a team.

I really haven’t put much planning into this at all; I'm thinking we would probably just communicate through IM and Email. Build a website to allow people to post website they think could be a risk/have had bad experience with in the past. We would identify, investigate and attempt to take it offline.

I don't know what people's thoughts on this are?

I look forward to hearing people’s opinions.

Rather than speculate on what you've just said, I think you need to provide a solid "business plan" before getting anywhere.

Most people are going to jump on you and ask "what does 'attempt to take it offline' mean."

There are most likely well-established groups and organizations out there aligned with the same intentions you have that could benefit from additional help, rather than you trying to start your own.

Hi BillV,

Thanks for commenting.

Yeah I thought that might happen but as I said in my first post its nothing special, nothing serious at the moment. I don't think that creating a business plan at this stage is a good idea. Actually no, I do see how it would be a good idea but I don't think that at this stage of the project it would be more beneficial than drumming up support and interest before I invest a quite serious amount of time in writing up a business plan.

I'm just looking to get a group of passionate people together and see what we can accomplish.

Thanks,

Tayler.

Well, that response in itself may be likely to stir up some conversation ;)

A business plan is fundamental to success. It serves not only as a way to measure your accomplishments but also as a recruitment and investment tool.

At the very least, you're going to need to elaborate a little further on what exactly it is you want to do. After reviewing your first post, I'd expect the reader to be left wondering on several of the topics...

- How are you going to market your site? How do you plan to drive enough traffic to it to even make it worthwhile? How do you intend to compete with similar groups (e.g. IC3, WiredSafety)?

- What type of bad/risk sites? Sites promoting hacking? Sites promoting other illegal activity? What happens when someone provides a link to a child porn site? The second you, or any of your investigators, access it and download the images you have committed a felony.

- How do you intend to bring it offline? Do you intend to have legal counsel available?

Please understand I'm not trying to bring you down or discourage you from following through with something that you want to do. I'm all for the general idea and concept of being against cybercrime. This is just a small list of things to consider.

Welcome to the site too, btw :)

It's certainly a noble initiative TH2010!

I suppose that, what you mean, is a not an 'anti-cybercrime unit' as much as a 'group of security enthousiasts that cooperate and exchange information'.
In that case, I do believe you have come to a group of peeps that already do that, i.e. EHN ;)

If you do actually mean more grandiose idea's, you can start it in whatever fashion you can think of, and I'll cheer you on :) However, if you want such a group to 'survive', there isn't really a way around the advice BillV has given already. Otherwise the possible members will just turn more their time to groups that already exist, imo. And a group like that without a structure, plan, or anything, won't be able to do that much against cybercrime, I suppose.

As a disclaimer: I'm a newbie, so what do I know. Just trying to insert a different perspective ;)

Welcome.

Today you did not get some people to join your couse, but you got some ideas of what to do just to begin (that is a good help)

I don't understand where you are coming from with the business plan angle. I never said anything about a business plan not being a good idea full stop, just at this stage of the project. However if you want to talk business let’s talk business.
True, a business plan is important for the success of a business, but not necessary. That however makes no difference because before a business plan is written up, market research would be carried out. This is done to find out if people would by the product or use the service but in my case they would be trying to find out if their business model is even viable.  Typically questionnaires would be written up and people of interest would be contacted, like for instance visiting a forum full of potential employees and posting the idea to gage people’s reactions.

Even if I had produced a business plan for this project before visiting the site. I would 100% not post it online for everyone to see. 99% of business owners require a non-disclosure to be signed before giving their very detailed private document about their business away.

I stressed in my first post that this is just an idea of a possible project. Nowhere did I say that it was a business idea.

As far as elaborating on the plan, I would be happy to answer any questions.

How am I going to market my website? I actually own a couple of websites at the moment so the website side of things won’t be a problem. I would more than likely use a little AdWords and produce some adverts having them placed on strategic websites that would see the adverts getting a high rate of clicks. With the right marketing and SEO traffic would build over time. Maybe competing with the other groups is the wrong way to go about it. From what I can tell about WiredSafety, they are just an advisory service with no information security team working with them, so that would be an area to look at.

Scam websites are estimated to cost UK consumers £3.5bn per year so it's a good place to start .I think that focusing solely on scam websites would be the best idea. Obviously if we did receive a link for a child porn website we would send the link onto the appropriate authorities. This removes the risk for the team while still doing something about the website.

How do you intend to bring it offline? That is where the skills of the team come in and would probably differ from case to case. Legal counsel would defiantly be something to think about for the future, yes.

Yeah, I understand. I am always up for a good debate.

Cool down, nobody wants to shutdown, they gave just what the thought.

Hi Anquilas,

Thanks for your input.

Yeah, thats exactly what I'm thinking. However a more close and personal team compared to everyone on this website, if you know what I mean?

At first we would start out as exactly that, a group of security enthousiasts with an aim to do what we can to reduce the threat of scam websites. As time moves on so would the team. Maybe going non-profit and start paying a wage to the members, get some offices, I don't know but I do know that you have got to start somewhere.

Thanks again.

Tayler

Project, business, whatever. You need to have clearly defined goals for it to succeed, and that's the point I was trying to make.

http://www.sba.gov/smallbusinessplanner/index.html

Now that we know you can google 'business plan' and read Wikipedia (did you miss the 'external' plan part?), I'll hold back for now while waiting on you to provide clear and concise goals/action items/etc. for your project.

In order to recruit/interest people, you have to have some sort of plan - bottom line.

I'd still like to know what this means:


Give us some examples.

And also


Questions come after a detailed plan is presented.

Real mature!

Don't get upset and all defensive. I was just trying to have a decent discussion.

You’re obviously a little immature to have an adult conversation with so I will take by conversation elsewhere, thanks for the entertainment though!

BW

Tayler Hughes

Good luck to you.

And just for the record, if my intentions were to act defensive and immature or set out to stifle your creativity, or attempt to shatter your dreams my responses would have been a little different...

I probably would have pointed you to more links about business plans and when to create one or general entrepreneurship websites that explain how to start and run a business (http://www.ukbusinessforums.co.uk/forums/archive/index.php/t-147605.html).

Or may have asked how some of your other (http://britishgovernment.thetechsmiths.co.uk/?cat=1) different, yet similar, projects (http://forum.codecall.net/introductions/11108-hey-17year-old-starting-out-programming.html) have went?

But feel free to carry on with your personal attacks. I'm sure your future business partners won't mind.

lol

TH2010,

Bill is a well respected member of this organization.  He has helped countless newbies and experienced information security professionals over the years.   He gave you solid advice.   

You have a decent idea on your hands, but that's not enough, as was proven in the dot com bust.   You need to have a good project plan, and yes a business plan as well.   Even if your project is non-profit, it will still be a business.   It will cost money.   Too many good ideas fail because they get executed very poorly. 

TH2010...

I can understand how people's comments can sometimes be misconstrued and taken negatively.  BillV was trying to point you in a very reasonable direction.  Please understand his motives, and continue the discussion, if you truly have interest in the areas you brought up.

We're not here to slam you, etc.  Remember, you did ask for advice and thoughts, and BillV's were exactly that.

Geez, give the guy a break.  Business plan?  All he/she needs is curiosity and passion.  The rest will follow.  GL TH

It was a legitimate question/suggestion/piece of advice.  If this person wants others to join some sort of venture then a business plan is paramount.

Welcome to the forums by the way!

I'd say that the 700K+ hits for: "importance of a business plan" as opposed to the 8 hits for "business plan not needed" or 9 hits for "business plan unnecessary" on Google pretty much sums it up.

What you, and the OP, missed is that the words business plan were placed in quotes for a reason. I wasn't indicating he needed an official, all-out legitimate business plan on which to base his venture. I was simply indicating that his post (please re-read the first one) did not provide any relevant details to interest anyone in joining. There was no plan presented and definitely not enough information. Then it was emphasized as a project. Well, a project has to have goals and a way of getting to them. It'd be beneficial to look up the definition of a project or research project management in this case.

Regardless, I clearly stated there was no plan and not enough information presented for anyone to base a decision on whether to help with his project. I asked for clarification on several topics, to which he stated he'd answer any questions, yet he didn't really provide any sort of response.

The topic is pretty much dead at this point and no real point to discuss it further unless the OP decides to return with more information.

I was almost interested when I saw the subject line.  I haven't been around all that much, but I have run other types of forums and when you are a newbie on the forum, you really need to watch how you behave.  Seems the BillV offered his recommendations.  You (OP) could have simply noted and watched the forum for other suggestions. 

Frankly it sounds like you want to start a cyber-vigilante group.  My concern with this would be what happens when you happen across a would be scammer site that may be watched by a legitimate group and you can end up getting into a sticky situation. 

Or do you want to start a hacker-space?  Like others have said there are probably a number of groups doing similar things.  Why reinvent the wheel?  As for the "business plan"  well it doesn't hurt.  Every club out there has a mission that is stated.  This allows the group to keep focused and know the direction they want to go.  It also allows them to build on that mission and develop more complex goals.

Besides there is a big enough group here, I'm sure someone has something going on that they wouldn't mind some additional assistance.

hmm...not sure if i want to get into this, but i'd like to give some advice on how to put this idea into further development, not about the idea in general.

first of all, if you want this to become succesfull you have to put something in writing. this can be (here comes the dangerous word) a businessplan, or just a mission/vision that you want to pursue. either way YOU are the one that will have to invest time/money first before it will accomplish anything. Nothing comes just like that. once you get this clear you can start by investing money (if needed). you can get help any time, even by free will!

The next step if you want to go further with this idea i think it will be wisely to have someone who knows the law (prefferably very well). because this is more on the line then pentesting, you better have a good lawyer and a solid knowledge of the law yourself, before attempting to approach the line.

My personal opinion is that it is hard to get such a project rolling, cause of the nature of it. i support it fully because there is too much illegal stuff out there that cant be anything done about, but again, my vision on this is that we have to start at the top (by modify the law to make it more transparent about computer crime) and then start by cleaning up the mess...

last but not least i support your entheusiastic view and wish you all the best if you want to proceed with this idea and turn it into a running project.

I have read the post and its comments with much interest.

BillV is correct you need a blueprint before embarking on a 'project' involving more than one person. It is the foundation of any good 'team' and that is what was intended… or am I missing the fact that this was a post to propose a team of sorts? How else would you get everyone on the same page and facing the same direction so to speak? The old saying, 'Failing to plan is planning to fail' rings true and I have personally seen it in many projects IT and other that I have been involved in.

I commend the OP on his passion for the subject but believe he should take heed of some good advice and not take comments so personally. It was a good idea... so let’s hear your plan? I doubt anyone wanted a dissertation and presentation just some bullet points of what your goals, objectives and strategy was and how you saw this coming together.

last one.... sham.

And what do you think will happen when you interfere with an ongoing criminal investigation?

This idea has been floated around from time to time and is nothing new. There have been many individuals who've had nice theories about eliminating threats but are too often blinded to see bigger pictures. For instance... You stumble upon say a site filled with despicable child porn, your initial instincts after wanting to physically hurt the owners is to remove the site... Do you remove it? How? Hack into it? DoS it? By hacking into the site, you're no better than any other malicious hacker period. DoS'ing? Same.

Not only are you no better, but you could be setting yourself up for tampering with an investigation by a law enforcement agency. You don't and can't know whether or not the site is under surveillance. You can't and won't know - unless they arrest you - that you potentially crippled the work of investigators who may have been close to legally arresting a website owner/operator and or closing down a website.

Take a step away from the technological aspects of this for a moment... Place this into another situation: "Hi, I've seen many people get mugged on the street and I was wondering if someone would like to join my group of vigilantes. We decided that we are the judge jury and executioner. Wanna join?

Forget about business plans as there would be little viability in it. There may be a personal moral redemptional reward for you, but at the end of the day you're looking for trouble on both sides of the law. To repeat, you could be jeopardizing an investigation and secondly, if you think some of these spammers and kiddie porn peddlers are Jack-in-the-Box do-nothing'ers, don't think for a minute that some organized crime boss making millions off of spam, etc., won't stop to harm you if found. They will NOT hesitate to pay someone to off you for peanuts.