4 ms·

It's already illegal -- what law would you have them pass? Also, my assumption is that most DDoS ransom demands are coming from overseas.

by eli 13y ago

dllthomas 13y ago
Making it a civil infraction to be running a computer used in such a thing might help.
- eli 13y ago
  The idea being you would sue individual owners of botnet-infected computers? Not so sure about that.
  - dllthomas 13y ago
    The idea being they could be ticketed for using their hardware unsafely on public infrastructure, much like a speeding ticket - but I'd suggest lower amounts corresponding to the lower risk to lives.
    - eli 13y ago
      Unlike speeders, I assume they are mostly unwitting and unwilling participants in the attack. Seems a bit unfair. Why not also sue Adobe for allowing the zero-day that led to the PC getting infected and added to a botnet?
      - dllthomas 13y ago
        "Unlike speeders, I assume they are mostly unwitting and unwilling participants in the attack." If you don't check your vehicle and something falls off of it, you're responsible. For that matter, if you do check your vehicle and something falls off of it, you're responsible. You don't have to have "wittingly" or "willingly" done something for a ticket - negligence (even minor) is plenty. You're responsible for hardware you deploy. Edited to add: Also, plenty of speeding tickets are given to people who never said to themselves "I'm going to speed," but simply neglected to pay enough attention to either posted limits or their speedometer. I know that's been the case with the couple of speeding tickets I've received. So I'm not really sure it's "unlike speeders" at all. "Why not also sue Adobe for allowing the zero-day that led to the PC getting infected and added to a botnet?" In general, I don't think it makes sense for liability to start with the vendors because the risks and downside is determined primarily by the particular deployment. I've no problem with allowing the companies to offer indemnification for tickets caused by their failures, and if we went that route that's something users should demand (... while still allowing people to publish GPL software for those willing to accept the responsibility, without taking a huge financial risk).
        eli 13y ago
        I get what you're saying, I just don't really think it's a good idea and I definitely don't think it will work. You would need a massive number of people to suddenly start caring about network/PC security AND you would need them to have the ability to actually do something about it AND it does nothing for anyone not under US law.
        dllthomas 13y ago
        "You would need a massive number of people to suddenly start caring about network/PC security" "You can get a ticket" seems to get people to care, up to a point. "you would need them to have the ability to actually do something about it" Certainly the case. I lean toward "change the incentives and the market will provide", but this could be better fleshed out. "it does nothing for anyone not under US law." It does plenty for people not under US law - they won't be DDoSed from as many bots in the US. It doesn't do as much about people under jurisdictions not covered, but: 1) A lot of the software that is developed is developed with the US in mind as a market, especially those things that are sufficiently common to really let malware spread by targeting a couple exploits. Making that software more secure might decrease the rate of infections abroad. 2) Other jurisdictions might very well follow suit - particularly with international pressure.
stcredzero 13y ago
It's already illegal -- what law would you have them pass? Laws enacting agencies' active enforcement of those laws.
- eli 13y ago
  Setting law enforcement priorities is typically an Executive Branch function, no? I guess Congress could earmark money specifically to fighting DDoS-based crime.
  - stcredzero 13y ago
    Congress could earmark money specifically to fighting DDoS-based crime. This. It would need the resources of a small agency all by itself.
bcoates 13y ago
Turn the appeal to fear that causes extortion to work back on itself: Make paying extortionists cause the payer to be an accessory. Allow future victims of the same extortionist to collect joint-and-several civil damages from the collaborator.

It's already illegal -- what law would you have them pass? Also, my assumption is that most DDoS ransom demands are coming from overseas.

by eli 13y ago

It's already illegal -- what law would you have them pass? Also, my assumption is that most DDoS ransom demands are coming from overseas.

dllthomas 13y ago

Making it a civil infraction to be running a computer used in such a thing might help.

eli 13y ago
The idea being you would sue individual owners of botnet-infected computers? Not so sure about that.
- dllthomas 13y ago
  The idea being they could be ticketed for using their hardware unsafely on public infrastructure, much like a speeding ticket - but I'd suggest lower amounts corresponding to the lower risk to lives.
  - eli 13y ago
    Unlike speeders, I assume they are mostly unwitting and unwilling participants in the attack. Seems a bit unfair. Why not also sue Adobe for allowing the zero-day that led to the PC getting infected and added to a botnet?
    - dllthomas 13y ago
      "Unlike speeders, I assume they are mostly unwitting and unwilling participants in the attack." If you don't check your vehicle and something falls off of it, you're responsible. For that matter, if you do check your vehicle and something falls off of it, you're responsible. You don't have to have "wittingly" or "willingly" done something for a ticket - negligence (even minor) is plenty. You're responsible for hardware you deploy. Edited to add: Also, plenty of speeding tickets are given to people who never said to themselves "I'm going to speed," but simply neglected to pay enough attention to either posted limits or their speedometer. I know that's been the case with the couple of speeding tickets I've received. So I'm not really sure it's "unlike speeders" at all. "Why not also sue Adobe for allowing the zero-day that led to the PC getting infected and added to a botnet?" In general, I don't think it makes sense for liability to start with the vendors because the risks and downside is determined primarily by the particular deployment. I've no problem with allowing the companies to offer indemnification for tickets caused by their failures, and if we went that route that's something users should demand (... while still allowing people to publish GPL software for those willing to accept the responsibility, without taking a huge financial risk).
      - eli 13y ago
        I get what you're saying, I just don't really think it's a good idea and I definitely don't think it will work. You would need a massive number of people to suddenly start caring about network/PC security AND you would need them to have the ability to actually do something about it AND it does nothing for anyone not under US law.
        dllthomas 13y ago
        "You would need a massive number of people to suddenly start caring about network/PC security" "You can get a ticket" seems to get people to care, up to a point. "you would need them to have the ability to actually do something about it" Certainly the case. I lean toward "change the incentives and the market will provide", but this could be better fleshed out. "it does nothing for anyone not under US law." It does plenty for people not under US law - they won't be DDoSed from as many bots in the US. It doesn't do as much about people under jurisdictions not covered, but: 1) A lot of the software that is developed is developed with the US in mind as a market, especially those things that are sufficiently common to really let malware spread by targeting a couple exploits. Making that software more secure might decrease the rate of infections abroad. 2) Other jurisdictions might very well follow suit - particularly with international pressure.

stcredzero 13y ago

It's already illegal -- what law would you have them pass? Laws enacting agencies' active enforcement of those laws.

eli 13y ago
Setting law enforcement priorities is typically an Executive Branch function, no? I guess Congress could earmark money specifically to fighting DDoS-based crime.
- stcredzero 13y ago
  Congress could earmark money specifically to fighting DDoS-based crime. This. It would need the resources of a small agency all by itself.

bcoates 13y ago

Turn the appeal to fear that causes extortion to work back on itself: Make paying extortionists cause the payer to be an accessory. Allow future victims of the same extortionist to collect joint-and-several civil damages from the collaborator.