How is Microsoft able to pinpoint the botnet owners? Are they doing it simply by identifying the infected computers through their own antivirus (or some code in

How is Microsoft able to pinpoint the botnet owners? Are they doing it simply by identifying the infected computers through their own antivirus (or some code in Windows), and then working their way backwards, or do they just get a tip from the NSA, and then get to reap the positive PR for it? (as thanks for helping them in other matters). It reminds me of the Google identifying owners of child porn a bit. Both stories have a little creepy side to it, as they might unveil these companies have some capabilities to track you that we weren't aware of.