Automated legal actions and takedowns like this introduce a lot of risk of collateral damage, but I wonder what the alternatives are? The investigators would l

Automated legal actions and takedowns like this introduce a lot of risk of collateral damage, but I wonder what the alternatives are? The investigators would likely argue that notifying domain holders would reduce the chance that they can take down a botnet's infrastructure successfully, which seems likely. Could there be some maximum time after which the 'rule set' for the auto-takedown code needs to be made open source / public? It must presumably be implemented as software and/or configuration files. That would at least allow for inspection, confirmation and disputes about how it's implemented, and if this was 30 days or so, it shouldn't risk the takedown effort. While top-tier network engineers are developing takedowns like this, presumably they'll do a good job of minimizing false positives - but as this case shows, it's not always going to be perfect - and I worry that if it becomes more common, we'll see sloppier implementations. That could lead to connectivity and access issues for more users (again in an international context). It's great that the situation was resolved in this case but I imagine not all users would be able to raise a complaint at a similar level of technical detail and respectful tone and for it to receive the same amount of attention. Maybe that's untrue - maybe injustices really do get amplified by social media and relying on companies to notice this 'works'. It doesn't sit particularly well with me as a remediation process though, and I'm not sure it scales.