21st CENTURY DEFENSE INITIATIVE
CYBER SECURITY #1 July 2011
Pirates of the ISPs: Tactics for Turning Online Crooks Into International Pariahs
Noah Shachtman 1775 Massachusetts Ave., NW Washington, D.C. 20036 brookings.edu Pirates of the ISPs: Tactics for Turning Online Crooks Into International Pariahs
Noah Shachtman
Cybersecurity #1 July 2011
21st CENTURY DEFENSE INITIATIVE Acknowledgements
Every research paper is a group effort, no mat- My Wired.com colleagues—Ryan Singel, Kevin ter what it says on the byline. This project relied Poulsen, Kim Zetter and David Kravets—cover more on outside assistance than most. Brookings the cybersecurity beat better than anyone. This Senior Fellows Peter Singer and Ken Lieberthal paper would have been impossible without them, were the ones who convinced me to explore the and without Brian Krebs, master investigator of broad topic of cybersecurity. The panel they as- the online underworld. sembled gave me new insight with every meeting; my colleague Allan Friedman was an especially Bill Woodcock, Rick Wesson, Jeff Cooper, Tyler invaluable tutor and remarkably generous with Moore, Audrey Plonk, Jim Lewis, Dmitri Alpero- his time. Heather Messera and Robert O’Brien vitch, Paul Nicholas, Jessica Herrera-Flannigan, provided important research and logistical sup- Jart Armin, Richard Bejtlich, Steve Schleien, Jona- port. My research assistant, Adam Rawnsley, was than Zittrain and many, many others steered me tireless in his exploration of the minutiae of ev- away from my worst ideas and towards those few erything from tort law to pirate havens. not-so-bad ones. For that, I am deeply in their debt.
Brookings recognizes that the value it provides to any supporter is in its absolute commitment to quality, independence and impact. Activities supported by its donors reflect this commitment and the analysis and recommendations are not determined by any donation.
21 st C e n t u ry D e f e n s e I n i t i at i v e • J o h n L. T h o r n to n C h i n a C e n t e r at Brookings Pirates of the ISP s: T ac t ic s fo r T u r n i n g O n li n e C ro o ks i n to I n t e r n at i o n a l P a r i a h s ii Table of Contents
Acknowledgements ...... iii
Executive Summary ...... vii
Introduction 1
What is Cybercrime? 5
Both Pirates and Privateers Online 7
“Cyberwar” vs. Cybercrime ...... 9
A Surprising Partner 12
Cybercrime First; Everything Else May Follow ...... 14
Who Gets Squeezed? ...... 17
It Is Up to the ISPs ...... 20
A “Grand Bargain” for Security 22
One Proposal for Pressuring the Criminal Ecosystem ...... 24
Protecting the Victims 28
Corporate Responsibility ...... 31
Can Insurance Curb Crime? 35
Criminal Enterprises, Civil Strategies ...... 36
Domain Demands 39
Thirteen Steps ...... 42
About the Author ...... 44
21 st C e n t u ry D e f e n s e I n i t i at i v e • J o h n L. T h o r n to n C h i n a C e n t e r at Brookings Pirates of the ISP s: T ac t ic s fo r T u r n i n g O n li n e C ro o ks i n to I n t e r n at i o n a l P a r i a h s iii Executive Summary
t the beginning of the 19th century, piracy as Harvard’s Tyler Moore and others have sug- Awas an ongoing threat and an accepted gested. After all, the Internet is not a network of military tactic. By the end of the century, it was governments; it is mostly an amalgam of busi- taboo, occurring solely off the shores of failed nesses that rely almost exclusively on handshake states and minor powers. The practice of hijack- agreements to carry data from one side of the ing did not vanish entirely, of course; it is flourish- planet to another. The vast majority of the Inter- ing now on the world’s computer networks, cost- net’s infrastructure is in the hands of these 5,000 ing companies and consumers countless billions or so Internet Service Providers (ISPs) and car- of dollars. rier networks, as is the ability to keep crooks off that infrastructure. If this relatively small group Cybercrime today seems like a nearly insoluble can be persuaded to move against online crimi- problem, much like piracy was centuries ago. nals, it will represent an enormous step towards There are steps, however, that can be taken to turning these crooks into global pariahs. curb cybercrime’s growth—and perhaps begin to marginalize the people behind it. Some of the The most productive thing ISPs can do to curb methods used to sideline piracy provide a useful, crime is put pressure on the companies that sup- if incomplete, template for how to get it done. port and abet these underground enterprises. Shutting down the markets for stolen treasure Currently, registration companies sell criminals cut off the pirates’ financial lifeblood; similar their domain names, like “thief.com.” Hosting pushes could be made against the companies firms provide the server space andI nternet Proto- that support online criminals. Piracy was eventu- col addresses needed to make malicious content ally brought to heel when nations took responsi- online accessible. But without ISPs, no business, bility for what went on within its borders. Based straight or crooked, gets online. A simple statistic on this precedent, cybercrime will only begin to underscores the ISPs’ role as a critical intermedi- be curbed when greater authority—and account- ary: just 10 ISPs account for around 30 percent ability—is exercised over the networks that form of all the spam-spewing machines on the planet. the sea on which these modern pirates sail. ISPs are well aware of which hosting companies, In this new campaign, however, private companies, for example, are the most friendly to criminals; not governments, will have to play the central role, lists of these firms are published constantly. But,
21 st C e n t u ry D e f e n s e I n i t i at i v e • J o h n L. T h o r n to n C h i n a C e n t e r at Brookings Pirates of the ISP s: T ac t ic s fo r T u r n i n g O n li n e C ro o ks i n to I n t e r n at i o n a l P a r i a h s iv currently, ISPs have little motivation to cut these Government can alter that equation by expand- criminal havens off from the rest of the Internet. ing the requirements to report data breaches. It There is no penalty for allowing illicit traffic to could require its contractors to purchase network transit over their networks. If anything, there is a security insurance, forcing companies to take strong incentive for maintaining business-as-usu- these breaches more seriously. And it can pour al: the hosting company that caters to crooks also new resources into and craft new strategies for has legitimate customers, and both pay for Inter- disrupting criminals’ support networks. net access. So ISPs often turn a blind eye, even though the worst criminal havens are well-known. These steps will serve as important signals that America will no longer tolerate thieves and con That is where government could help. It could artists operating on its networks. After all, 20 of introduce new mechanisms to hold hosting com- the 50 most crime-friendly hosts in the world are panies liable for the damage done by their crimi- American, according to the security researchers nal clientele. It could allow ISPs to be held liable at HostExploit. for their criminal hosts. It could encourage and As the United States gets serious in curbing these regulate ISPs to share more information on the criminals, it can ask more from—and work more threats they find. closely with—other countries. China, for instance, sees itself as the world’s biggest victim of cyber- Government could also encourage more private crime, even as it remains a hotbed for illicit activ- businesses to come clean when they are victim- ity. Not coincidentally, China is also only partially ized. Today, just three in ten organizations sur- connected to the global community of ISPs. Dia- veyed by the security firm McAfee report all of logues to bring the Chinese closer into the fold their data breaches. That not only obscures the will not only make it easier to marginalize cyber- true scope of cybercrime; it prevents criminals criminals; it will build momentum for broader ne- and criminal trends from being caught earlier. gotiations on all sorts of Internet security issues.
21 st C e n t u ry D e f e n s e I n i t i at i v e • J o h n L. T h o r n to n C h i n a C e n t e r at Brookings Pirates of the ISP s: T ac t ic s fo r T u r n i n g O n li n e C ro o ks i n to I n t e r n at i o n a l P a r i a h s v Introduction
n May 22, 2009, nine pirates armed with rock- Convention on the Law of the Sea, “every State” Oet-propelled grenades began to chase the is authorized to “seize a pirate ship… arrest the cargo ship Maersk Virginia as it steamed through persons and seize the property on board.”3 Pi- the Gulf of Aden. The container vessel sped up racy still continues, of course, but the sea-borne to 21 knots, took evasive maneuvers, and let out hijackers are forced to operate from the shores a distress signal.1 Among the first to respond to of the world’s failed states, and are pursued by the hulking, 950 foot-long American hauler: An every major power on the planet. Not even ter- Iranian warship, volunteering its help. The pirates rorists are treated as such international pariahs. were run off before the offer could be accepted, but it wouldn’t be the last time that putative en- It is a particularly striking turn of events given emies teamed up to stop the pirates off the Horn piracy’s long history. For centuries, state-sanc- of Africa.2 The Chinese Navy escorted Taiwanese tioned pirates, or privateers, were accepted aug- vessels and Indian sailors freed their Pakistani mentations to traditional military forces. In the counterparts after storming a pirate mothership war against Spain, England’s Queen Elizabeth I through the same treacherous waters. turned to privateers with a commission to plunder both hostile ships and enemy-held towns. Ameri- It is a sign of just how taboo piracy has become. can rebels in the Revolutionary War recruited Somali pirates have been captured by sailors 792 privateers who captured or destroyed 600 from Sweden, South Korea and Russia, and ships, and took 16,000 prisoners.4 During the War charged in courts from New York to Mombassa to of 1812, the American privateer fleet had more Kuala Lumpur. According to the United Nations than 517 ships—compared to the U.S. Navy’s 23.5
1 Maersk Line Limited, “Maersk Virginia Approached By Pirates In The Gulf Of Aden,”
21 st C e n t u ry D e f e n s e I n i t i at i v e • J o h n L. T h o r n to n C h i n a C e n t e r at Brookings Pirates of the ISP s: T ac t ic s fo r T u r n i n g O n li n e C ro o ks i n to I n t e r n at i o n a l P a r i a h s 1 As the 19th century wore on, however, piracy and As pervasive as cybercrime seems to be, how- privateering not only fell out favor as a military ever, there are steps that can be taken to curb tactic, it became taboo. London dismantled the its growth—and perhaps begin to sideline cyber- markets for pirate booty. The Americans and the crime, much as piracy was made unacceptable French launched attacks on the corsairs of the in a previous era. Some of the methods used to southern Mediterranean. marginalize piracy provide a useful, if incomplete, template for how to stop cybercrime. As Janice Thompson recounts in her seminal Mer- cenaries, Pirates, and Sovereigns, hijackers (and Shutting down the markets for stolen treasure their state-approved counterparts) became mar- cut off the pirates’ financial lifeblood; similar ginalized as nations asserted greater control pushes could be made against the companies over their borders and established a monopoly that support the online criminals. Piracy was on violence. In 1856, 42 nations agreed to the eventually brought to heel when nations as- Declaration of Paris, which abolished privateer- sumed responsibility for what went on within ing. The United States did not sign the document, their borders. Cybercrime will only begin to be but five years later, with America embroiled in curbed when greater authority and accountabil- its Civil War, President Abraham Lincoln refused ity are exercised over the networks that form the to recruit the plunderers-for-hire—and blasted sea on which these modern pirates sail. the Confederates as immoral for doing so them- selves.6 Two generations earlier, employing these In this new push, however, it is private companies, hijackers had been a cornerstone of American not governments that will have to play the cen- naval strategy. By the 1860s, it was something tral role. After all, the Internet is not a network of civilized governments simply did not do. governments. It is an array of businesses, mostly Internet Service Providers (ISPs) and network The hijacking of money and goods has hardly carriers that rely almost exclusively on hand- stopped, but, aside from the Gulf of Aden, crimi- shake agreements to carry data from one side of nals have largely left the high seas. Today, they the planet to another.8 The vast majority of the roam our computer networks. Last year, online Internet’s infrastructure is in the hands of these thieves, extortionists, scammers and industrial 5,039 ISP and carrier networks as is the exper- spies cost businesses an estimated $43.5 billion tise to secure that infrastructure. in the United Kingdom alone, according to Brit- ish government estimates.7 Cybercrime is noto- This also places Internet Service Providers in a riously difficult to measure; assessments of the unique position to help corral cybercrime, as Ty- Internet’s underground economy are guesses, ler Moore and Ross Anderson have observed.9 at best. But if those British figures are even re- Domain registrars can sell you a website name. motely accurate, firms worldwide could be facing So-called “hosting” companies can provide the the equivalent of hundreds of billions of dollars in server space and Internet Protocol addresses losses every year. needed to make your content online accessible.
6 William Morrison Robinson, Jr. The Confederate Privateers. (Yale University Press, New Haven, CT, 1928), pg. 14. 7 Michel Holden, “Cyber crime costs UK $43.5 billion a year: study,” Reuters, 2/17/2011,
21 st C e n t u ry D e f e n s e I n i t i at i v e • J o h n L. T h o r n to n C h i n a C e n t e r at Brookings Pirates of the ISP s: T ac t ic s fo r T u r n i n g O n li n e C ro o ks i n to I n t e r n at i o n a l P a r i a h s 2 But without ISPs, no business, straight or crooked, funds to help ISPs with the disinfection of their gets online. A simple statistic underscores the customers’ machines, as Moore has suggested.11 ISP’s role as a critical intermediary. According to research conducted for the Organization for Government could also encourage more private Economic Development and Cooperation, just 10 businesses to come clean when they are victim- ISPs out of the 5,000+ worldwide account for ized. When online crooks strike, the overwhelm- around 30 percent of all the spam-spewing ma- ing majority of companies stay quiet, fearing that chines on the planet.10 such announcements could reveal a competitive weakness or invite more attacks. Just three in Therefore, the first—and probably most impor- ten organizations surveyed by the security firm tant—step in creating a global taboo against McAfee report all of their data breaches.12 Hiding online crooks is to persuade Internet Service cyberattacks not only obscures the true scope Providers to turn against these scam artists and of cybercrime, it prevents criminals and criminal thieves and the companies that support them. trends from being caught earlier.
Currently, the ISPs do not have much motivation The flip side to the information issue is account- to take action. There is no penalty for allowing ability. Currently, no one but the cybercriminal criminal traffic to transit over their networks. Nor himself bears any responsibility for the spread is there much of a reward for throttling the host- of online crime. Software companies are not ing firms that give criminals the infrastructure accountable when they ship out buggy code to control their “botnets”—legions of hijacked that criminals exploit. Registration firms are not computers. If anything, there is a strong incen- responsible when they sell crooks the “badguy. tive for maintaining business-as-usual practices: com” domain from which they will do business. ISPs have traditionally shied away from policing Hosting companies are not accountable when the content on their networks. Besides, a hosting they give criminals the server space to house company that caters to crooks also has legitimate their scams. ISPs are not responsible when they customers, and both pay for access to the Inter- connect those criminally-connected hosts to the net. As a result, ISPs often turn a blind eye, even rest of the Internet. Private companies shoulder though the worst criminal havens are well-known. no responsibility when their machines are in- fected and used to pull off crimes.13 No wonder a That is where government could help. It could in- “see no evil” attitude is so prevalent; fingers are troduce new mechanisms to hold hosting compa- always pointed in the other direction. nies liable for the damages done by their criminal clientele. It could allow ISPs to be held liable for The federal government can alter that equation their criminal hosts. It could encourage ISPs to in one of several ways. It could expand today’s re- share more information on the criminal threats quirements to report data breaches. It could re- they find. Government could even provide public quire its contractors to purchase network security
10 Michel van Eeten, Johannes M. Bauerb, et, al., “The Role of Internet Service Providers in Botnet Mitigation An Empirical Analysis Based on Spam Data,” Organization for Economic Development and Cooperation, Directorate for Science, Technology and Industry, May, 2010,
21 st C e n t u ry D e f e n s e I n i t i at i v e • J o h n L. T h o r n to n C h i n a C e n t e r at Brookings Pirates of the ISP s: T ac t ic s fo r T u r n i n g O n li n e C ro o ks i n to I n t e r n at i o n a l P a r i a h s 3 insurance, forcing companies to take breaches And as the United States gets more serious in more seriously. It could assign indirect liability curbing these criminals, it can ask more from— for online thievery and scams, just like credit card and work more closely with—other countries. To- companies are held indirectly liable for online day, China and Russia are only partially connected gambling. And it could pour new resources into to the global community of ISPs. Cooperation on disrupting criminals’ support networks. cybercrime investigations is an ad hoc, largely dis- jointed affair, especially between Washington, Mos- All of these steps will serve as important signals cow and Beijing. That coordination has to improve, that America will no longer tolerate thieves and if there is to be a chance of seriously slowing online con artists emanating from its networks. After crime’s rapid rise. There does not need to be an all, the United States is, by some measures, the equivalent of 1856’s global privateer ban to make world’s largest exporter of online crime. Amer- an impact. As history shows, bi- and multilateral ica has three times more spam havens than agreements in the 17th and 18th centuries affirmed China,14 and more than twenty times the number the principles of open trade over the open seas. of fake banks, ersatz social networks and other None of these documents explicitly abolished pi- so-called “phishing” sites.15 America cannot rea- racy; nor were they universally accepted, but they sonably demand that other countries get their paved the way toward a global code of conduct houses in order until we show a willingness to that eventually turned pirates into international do the same. pariahs, pursued by all the world’s major powers.
14 Spamhaus, “The World’s Worst Spam Producing Countries,” accessed 5/8/2011,
21 st C e n t u ry D e f e n s e I n i t i at i v e • J o h n L. T h o r n to n C h i n a C e n t e r at Brookings Pirates of the ISP s: T ac t ic s fo r T u r n i n g O n li n e C ro o ks i n to I n t e r n at i o n a l P a r i a h s 4 What is Cybercrime?
nline crime has been notoriously tricky to de- intelligence preparation of the battlefield is Ofine. Draw too wide a definition—as a recent mostly up to the person who pulled off the break- Russia-U.S. bilateral group did—and the calcula- in. It’s largely a matter of intent. tion of drug profits on Google Documents is sud- denly labeled a cybercrime. After all, that is a use For years, “hacking” was synonymous with feloni- of “cyberspace for criminal purposes as defined ous behavior and illicit network penetration. This by national or international law.”16 Make the defi- is no longer the case. Yes, there are groups like nition too narrow—like one UN panel, which fo- Anonymous and Lulzsec that embrace the original cused on “electronic operations that targets the hacker ethos—free information, technical prow- security of computer systems”—and you exclude ess, and fun at the expense of the clueless—and all the online crimes that rely on trickery instead yes, these groups can inflict harm on the organiza- of technical ability. For instance, one late 2010 tions they target. But for the most part, the hack- con job that fooled executives at the Conde Nast er community and the cybercrime underground publishing company into wiring $8 million to on- have parted ways. Advanced technical skills are line scammers’ accounts.17 not necessarily required to pull off modern cyber- crimes. Hardware and software makers that want Complicating matters further is the fact that, on to discover security flaws in their products—or the Internet, it is not always easy to tell a crook discover new uses for these systems—often invite from a spy or a soldier. All three can use the hackers to pull apart their wares. iRobot’s Roomba same flaw in Internet Explorer to gain access to autonomous vacuum cleaner and Microsoft’s Ki- a computer. All three can use the same kind of nect gaming controller are just two of many exam- software to scan for network holes. Whether the ples.18 This does not mean that these hackers are result of that intrusion is a crime, espionage or criminals, and they should not be treated as such.
16 Karl Frederick Rauscher and Valery Yaschenko, “Russia-U.S. Bilateral on Cybersecurity Critical Terminology Foundations,” pg. 27, 4/2010,
21 st C e n t u ry D e f e n s e I n i t i at i v e • J o h n L. T h o r n to n C h i n a C e n t e r at Brookings Pirates of the ISP s: T ac t ic s fo r T u r n i n g O n li n e C ro o ks i n to I n t e r n at i o n a l P a r i a h s 5 For the purposes of this paper, a cybercrime oc- businesses between March 2010 and April 2011.19 curs when computers, networks and software are Some of it is highly targeted and clever; for in- used to engage in criminal activity, and the victim stance, the “spear phishing” scams that appear of that crime is targeted through these electronic to come from the victim’s friends or corporate means. customers. That is how Condé Nast managed to lose $8 million, almost in an instant. That includes a wide swath of illicit activity. There are fake banking and social networking sites, A deeper infrastructure supports all of these designed to fool people into giving up their ac- activities, no matter what the complexity. Reg- count numbers; a type of activity called “phish- istration companies give phishers their realistic- ing.” There are chains of infected computers— sounding website domains. Hosting firms sell the “botnets”—used to pump out mass e-mail come- server space and provide the Internet Protocol ons, among other criminal acts. Malicious soft- (IP) addresses that the botnet lord, the spam- ware (“malware”) is often used to take control of mer, and the spear-phisher all need to make their a machine and steal the information inside. There wares online-accessible. ISPs are the gatekeep- are the online equivalents of cat burglars, sneak- ers to the broader Internet. Without these com- ing into corporate networks to pilfer company panies, none of these online crooks would be able secrets. And there are shakedown artists who to practice their trade. threaten web businesses with a flood of junk traf- fic if they do not comply with extortion demands. This means that as vast and as complex as these criminal networks have become, there are nodes The vast majority of online crime is relatively un- where they are vulnerable. There are places sophisticated but brutally effective. Simple soft- where they can be pressured to stop their activ- ware makes identity theft almost idiot-proof; it ity or face prosecution. was used to make off with $11 million from twenty
19 Internet Crime Complaint Center, “Fraud Alert Involving Unauthorized Wire Transfers to China,” 4/26/2011,
21 st C e n t u ry D e f e n s e I n i t i at i v e • J o h n L. T h o r n to n C h i n a C e n t e r at Brookings Pirates of the ISP s: T ac t ic s fo r T u r n i n g O n li n e C ro o ks i n to I n t e r n at i o n a l P a r i a h s 6 Both Pirates and Privateers Online
hese criminal tactics can be used separately make Night Dragon a sophisticated criminal caper? Tor in combination, by skilled crooks or by neo- An act of industrial espionage? A government- phytes. In an echo of the pirate heyday, there sanctioned operation? All of the above? If anyone are signs that governments may be encourag- knows for sure, they are not saying so in the open. ing these crooks—and sharing technologies with them. In other words, there are both online pri- In public, U.S. officials do not usually identify spe- vateers and online pirates roaming the criminal cific network breaches as state-sponsored. Pri- underground. And, as previously discussed, it’s vately, however, those officials say that it’s no acci- often hard to tell which is which. dent that a worm used by Russian cybercriminals resulted in the biggest penetration of Defense De- In 2009, for instance, someone slipped into the partment networks ever.21 They do not believe the extranets of leading American energy companies, apparent ties between a criminal-friendly hosting stole executives’ credentials, and used those pass- company in St. Petersburg and the local security words to exfiltrate billions of dollars’ worth of infor- services are coincidental.22 Nor do they believe mation on oil deposits. The tools used to pull off the Beijing’s protestations that that the Chinese gov- so-called “Night Dragon” break-ins were advertised ernment had nothing to do with so-called “Auro- on Chinese websites. The person who provided the ra” series of attacks, which targeted Google and hosting services for the caper was based in Shan- at least 33 other companies in 2010. Joel Brenner, dong Province (although the servers themselves the former counterintelligence chief at the Office were on American soil). The people scouring the of the Director of National Intelligence, says that energy company networks “operated on a strict incident is just one example of many instances weekdays, nine-to-five Beijing time-zone sched- of China’s “heavy-handed use of state espionage ule,” according to a McAfee researcher.20 Does that against economic targets.”23
20 Nathan Hodge and Adam Entous, “Oil Firms Hit by Hackers From China, Report Says,” Wall Street Journal, 2/10/2011,
21 st C e n t u ry D e f e n s e I n i t i at i v e • J o h n L. T h o r n to n C h i n a C e n t e r at Brookings Pirates of the ISP s: T ac t ic s fo r T u r n i n g O n li n e C ro o ks i n to I n t e r n at i o n a l P a r i a h s 7 “I believe we are suffering what is probably the biggest transfer of wealth through theft and pi- racy in the history of mankind,” Senator Sheldon Whitehouse, who chaired a classified task force on the subject, told his colleagues in 2010.24
24 Congressional Record: July 27, 2010, Page S6265-S6266,
21 st C e n t u ry D e f e n s e I n i t i at i v e • J o h n L. T h o r n to n C h i n a C e n t e r at Brookings Pirates of the ISP s: T ac t ic s fo r T u r n i n g O n li n e C ro o ks i n to I n t e r n at i o n a l P a r i a h s 8 “Cyberwar” vs. Cybercrime
hile online crime—both simple and sophis- some of these alarmists stand to make money by Wticated, both government-connected and responding to this crisis. not—continues to rise, cybersecurity talk in Wash- ington and in the popular press is dominated by The cyberwar crowd has powerful allies in Ameri- dire predictions of a catastrophic cyber attack: an can defense policy circles. There, the Internet is online “bolt from the blue” which sends networks sometimes presented as simply another “warfight- crashing. Current and former top government offi- ing domain”—like the air or the sea, but made of cials claim that the United States is just a few clicks 1s and 0s. Alternatively, the network of networks is away from an electronic takedown of the banking viewed as a place to continue nuclear arms strat- system, the power grid or the Pentagon’s com- egy. Both of those constructs may feel comfortably mand-and-control networks. “The United States is familiar to policymakers, but neither one comes fighting a cyber-war today, and we are losing,” re- close to describing the network security challenge. tired Adm. Mike McConnell, the former director of the National Security Agency, declared last year.25 Unlike nuclear weapons—held by just a few states, and technically difficult to obtain—digital The references to “cyber 9/11s”26 and electronic attack tools can be possessed by anyone from “Pearl Harbors”27 are constant, and the scare-talk criminal gangs to superpowers. Attackers (and is echoed by an array of network security consul- defenders) can leap across national boundaries tants. Events as trivial as the defacement of gov- with a speed that would violate the laws of phys- ernment websites—the digital equivalent of graf- ics on the sea or in the air. Furthrmore, they can fiti—are billed as the opening blasts of electronic keep their identities largely hidden, even as they Armageddon. Perhaps it’s only coincidental that hop from place to place.
25 Mike McConnell, “Emerging Risks: How to Win the Cyber-War We’re Now Losing,” 2/2/2011,
21 st C e n t u ry D e f e n s e I n i t i at i v e • J o h n L. T h o r n to n C h i n a C e n t e r at Brookings Pirates of the ISP s: T ac t ic s fo r T u r n i n g O n li n e C ro o ks i n to I n t e r n at i o n a l P a r i a h s 9 The emergence of network attack and defense as necessarily take technical skill to create malware an element of war presents enormous strategic anymore. For $1,500 or less, a novice thief can concerns for the United States. The Pentagon’s buy a copy of the Zeus or SpyEye crimeware kits. information security is spotty, as demonstrated Either one will help the thief build a “Trojan”—a by the relatively-simple worm that infected hun- program that sneaks nefarious code onto a vic- dreds of thousands of Defense Department com- tim’s computer. With a few mouse-clicks, the thief puters, (or the 18 months it took to clean those can configure what he wants his malware to do, machines up).28 Responsibilities in the event of which banking sites he wants to monitor, what a major strike on American networks are un- information he wants to grab, and how to send clear29—a critical issue, given the vulnerabili- that information back to him.32 The interface to ties in the power grid highlighted by the Stuxnet do it all is simple and if the thief gets stuck, the worm. No one is sure where in cyberspace the crimeware firms have reputations for fast, help- “red lines” lie that would prompt a retaliatory ful customer service. attack; nor is it apparent what form that retali- ation would take. Informal discussions are begin- Crooks are paid as little as $.75 to install mali- ning to address these topics. But at the moment, cious software on an individual’s machine—that there are no official dialogues on these matters is how simple it has become.33 Victims do not even between the two of the most likely network com- have to click to get infected; they just visit their batants—the United States and China. favorite website, and malicious code embedded in the advertisement does the rest. Often, the The issue of network war presents a serious con- victim’s computer is chained together with tens cern for the future. Meanwhile, the slow, rising of thousands of other infected machines to form tide of criminal activity is draining untold billions “botnets.” These arrays can then be rented for as from the legitimate global economy right now. little as $8.94 per hour,34 allowing scammers and In 2009 and 2010, seven million U.S. consumers spammers to cheaply spew out millions of elec- admitted to being tricked out of their personal tronic come-ons. information by online scam artists. Cybercrime losses reported to the FBI doubled from 2008 to Forget “Pearl Harbor”; if we are not careful, 2009, to $559.7 million.30 the Internet could become the equivalent of the South Bronx, circa 1989—a place of such Last year, the security firm McAfee detected rampant criminality that no one wants to live an average of 60,000 new malicious software or do business there. As New Yorkers learned variants each day.31 That is because it does not during those years, criminal acts, if sufficiently
28 Noah Shachtman, “Insiders Doubt 2008 Pentagon Hack Was Foreign Spy Attack,” Danger Room, 8/25/2010,
21 st C e n t u ry D e f e n s e I n i t i at i v e • J o h n L. T h o r n to n C h i n a C e n t e r at Brookings Pirates of the ISP s: T ac t ic s fo r T u r n i n g O n li n e C ro o ks i n to I n t e r n at i o n a l P a r i a h s 10 widespread, add up to an atmosphere of lawless- does not mean the issue can be pushed to the ness that only encourages more criminality.35 To- margins. There is a long history of policymak- day we are seeing a replay of that famous “bro- ers ignoring immediate-but-unconventional chal- ken windows” thesis—this time on our networks lenges in favor of familiar and theoretical ones. It instead of on our streets. rarely ends well.
Online crime might not be in the Washington comfort zone, as strategic arms are, but that
35 George L. Kelling and James Q. Wilson, “Broken Windows: The Police and Neighborhood Safety,” The Atlantic, 3/1982,
21 st C e n t u ry D e f e n s e I n i t i at i v e • J o h n L. T h o r n to n C h i n a C e n t e r at Brookings Pirates of the ISP s: T ac t ic s fo r T u r n i n g O n li n e C ro o ks i n to I n t e r n at i o n a l P a r i a h s 11 A Surprising Partner
s cybercrime becomes increasingly more is actually an improvement over recent years. In Acommon, there is a growing constituency on 2009, the rate of infection was nearly 60 percent, both sides of the Pacific that is capable of work- and rate of account theft was almost one in three.38 ing together against online crime syndicates. De- spite all the network break-ins which seem to have The “country’s aggressive cyber offense abroad,” their origins in China—and despite the Beijing gov- the security website ThreatPost notes, “is in ernment’s alleged connections to some of these stark contrast to an almost total lack of basic cy- heists—the Chinese appear to be just as spooked ber defense at home.” Beijing may sponsor on- about their online vulnerabilities as we are. Accord- line privateers, but it has also become easy prey ing to one local report, “nearly all internal networks to networked pirates. China’s heavy reliance on used by Chinese firms have been attacked at least unlicensed Windows software means that their once during the past year, and hackers managed to operating systems do not receive regular secu- take control of at least 85 percent of them.”36 rity patches; their reluctance to embrace open source software means that “they do not benefit In 2010, more than 45 percent of Chinese Internet from the whole community of people who are users complained of viruses or Trojans on their crawling over those platforms and patching bugs computers, according to a recent study from the and looking for holes,” top security researcher China Internet Network Information Center, which Dillon Beresford observes.39 reports to the Ministry of Industry and Information Technology. Nearly 22 percent reported that their The sense of vulnerability is palpable. Beijing’s accounts or password had been stolen.37And that network security officials have taken to publicly
36 China.org.cn, “ Net security proves difficult task,” 3/12/2011,
21 st C e n t u ry D e f e n s e I n i t i at i v e • J o h n L. T h o r n to n C h i n a C e n t e r at Brookings Pirates of the ISP s: T ac t ic s fo r T u r n i n g O n li n e C ro o ks i n to I n t e r n at i o n a l P a r i a h s 12 calling China the “biggest victim” of cybercrime.40 You do not have to take Jian wholly at his word— Others—like Gu Jian of the Ministry of Public Se- or pretend he speaks for the entire Chinese gov- curity’s Network Security Protection Service— ernment—to see the possibilities for Sino-Amer- are asking for “closer, more effective cooperative ican cooperation against a common threat. Or to relations with other countries in fighting against note that there is a somewhat similar alignment cross-border cybercrime.” In a speech last No- of interests in the Gulf of Aden, where Chinese vember, Jian pleaded for the United States and and American warships are also looking to keep China to cooperate more closely on criminal in- commerce flowing. vestigations, and establish “rapid coordination mechanisms” to resolve cases more smoothly.41
40 People’s Daily Online, “China ‘biggest victim’ of cyberattacks,” 1/25/10,
21 st C e n t u ry D e f e n s e I n i t i at i v e • J o h n L. T h o r n to n C h i n a C e n t e r at Brookings Pirates of the ISP s: T ac t ic s fo r T u r n i n g O n li n e C ro o ks i n to I n t e r n at i o n a l P a r i a h s 13 Cybercrime First; Everything Else May Follow
he United States and China do not see eye-to- can be taxing. But it should not be as hard as it Teye on a variety of topics. Yet the two sides is. “The current cooperation between countries is cooperate on a whole range of issues—terrorism, abnormally inefficient,” Jian notes. Talks around child pornography and, yes, piracy. Even potential- cybercrime should begin right away, to begin to ly combustible topics like intellectual property are resolve these issues. sometimes tackled together through organizations like the “Joint Liaison Group for Law Enforcement RECOMMENDATION 1: BEGIN U.S.-CHINA Cooperation,” led by the U.S. Departments of State TALKS, CENTERED AROUND CYBERCRIME and Justice and China’s Ministry of Public Security. It’s not just the most pressing issue; it’s the one This group has driven several U.S.-Chinese coop- with the most common ground. erative investigations that have recovered millions of dollars in goods.42 It’s a lesson that governments As an early topic, Jian suggests establishing do not have to agree on all things before they start guidelines for “cases of double criminality”—ac- cooperating on some things. tivities which are illegal both in America and Chi- na. It’s a good suggestion; clarifying exactly Of course, there are all kinds of unique obstacles which acts are legal and which ones are not for to collaborating on cybercrime. The Chinese both countries could go a long way toward easing and American visions for the Internet are fun- Sino-American tensions and marginalizing online damentally different—one favors state control crooks. Once those guidelines are set, the United of networks, the other leaves them in the hands States and China can move to tighten bilateral as- of private industry. The laws are different, espe- sistance agreements to collect evidence and run cially the laws surrounding political speech and joint investigations on double-criminal cases. obscenity. Setting up working protocols between two countries, each with a dozen or more depart- A recent U.S.-China bilateral suggests a joint ments overseeing online commerce and crime, push against spam as a way to both build trust
42 House Committee on Oversight and Government Reform, Subcomittee on Government Management, Organization, and Procurement, “Testimony of Deputy Assistant Attorney General Jason M. Weinstein on protecting intellectual property rights,” 12/9/2009,
21 st C e n t u ry D e f e n s e I n i t i at i v e • J o h n L. T h o r n to n C h i n a C e n t e r at Brookings Pirates of the ISP s: T ac t ic s fo r T u r n i n g O n li n e C ro o ks i n to I n t e r n at i o n a l P a r i a h s 14 and curb a global problem.43 Eventually, China Here’s why: it is not uncommon today for a net- might even be persuaded to join the so-called work security team at a big U.S. company to spend “Budapest Convention” on cybercrime, which 80 percent of its time on rudimentary, if perva- asks signatories, each in their own way, to take sive, criminal infiltrations—the online pirates, if action against everything from network break-ins you will. Slowing these break-ins could free up to online fraud to child pornography.44 those teams to concentrate on the higher-end, possibly state-sponsored swath of cybercrime: Now this probably will not lead to investigations the online privateers. What is more, sophisticated into China’s alleged army of online privateers— criminals often use simple tools in order to hide its state-sponsored thieves and hijackers. But themselves in the swarm of everyday infiltra- there are still benefits to working with Beijing to tions. If there were fewer of these run-of-the-mill clamp down on the online pirates who are steal- attacks, the online privateer might have a harder ing from everyone. It helps U.S. consumers and time keeping his identity cloaked.45 businesses. And a dialogue on crime could begin to ease tensions over all sorts of Internet issues. In the 19th century, a global agreement to ban privateering set the stage for a dramatic reduc- Such talks could establish the terms and working tion in piracy on the high seas. This time around, groups needed for more strategic topics. They the practice might work in reverse: focus on the could clarify the lines between online criminality average, independent cybercrooks first, and then and state-sponsored network breaches. And they tackle the ones who are state-sponsored. could build momentum for military-to-military dialogues. In other words, cybercrime is the “low- RECOMMENDATION 2: DRAW THE hanging fruit” that might set the table for an en- CHINESE INTO THE LARGER COMMUNITY tire diplomatic meal. OF ISPs AND NETWORK CARRIERS. It should speed the resolution of major network The Russian, American and Chinese govern- issues—and encourage China to become a more ments have widely different stances on whether responsible actor on the global network stage. network exploits can or should be used as tools of war. But robberies, break-ins and con games The most fruitful conversations will not neces- —those are different. There is no public constitu- sarily be government-to-government—or, at ency for cybercrime. least, they will not end up that way. As mentioned above, the Internet is really a collection of a few The Chinese (and others) may be accused of em- thousand networks, almost all of which are in pri- ploying the unsavory to carry out strategic-level vate hands. Most of the people who provide ac- intellectual property theft. The Russians could be cess to those networks are in regular touch about masking the signal of espionage with the noise common threats and technical issues. Today, Chi- of crooks. That only adds to the urgency of com- na’s Computer Emergency Response Team and ing to a better understanding on crime. Stripping its ISPs are nothing but e-mail addresses to the away the cybercrooks could expose the online wider Internet community. There is no one per- spy—and perhaps undermine his actions as well. son who consistently answers that address or
43 Karl Rauscher and Yonglin Zhou, “Fighting Spam to Build Trust,” East-West Institute., 5/27/2011,
21 st C e n t u ry D e f e n s e I n i t i at i v e • J o h n L. T h o r n to n C h i n a C e n t e r at Brookings Pirates of the ISP s: T ac t ic s fo r T u r n i n g O n li n e C ro o ks i n to I n t e r n at i o n a l P a r i a h s 15 returns messages with any sort of predictability. the ability of the entire ecosystem to push out There is no one with whom a working relation- the worst-of-the-worst criminal actors—to get ship can be established. In a network of networks rid of the crooks who are preying on both Chi- that relies almost exclusively on informal agree- nese and American networks. So the first goal of ments and good faith, this situation is less than any talks should be to encourage China to have a optimal. It not only keeps China at the edges of consistent presence in the global community that the global network ecosystem, it severely limits makes the Internet work.
21 st C e n t u ry D e f e n s e I n i t i at i v e • J o h n L. T h o r n to n C h i n a C e n t e r at Brookings Pirates of the ISP s: T ac t ic s fo r T u r n i n g O n li n e C ro o ks i n to I n t e r n at i o n a l P a r i a h s 16 Who Gets Squeezed?
ast July, former National Security Agency Di- different states, lease server space in a dozen Lrector Michael Hayden mused about one ne- others, and form alliances with cybercrooks-for- gotiating strategy with a country like China or hire elsewhere makes it tough to tell where the Russia. He suggested punishing the states that criminals are really coming from; countries could harbor online crooks. “Since… it’s difficult to get blamed for attacks over which they have very prove state sponsorship, one of the thoughts … little sway. is to just be uninterested in that distinction and to actually hold states responsible for that activ- RECOMMENDATION 3: AVOID NATIONAL ity emanating from their cyberspace,” Hayden RETALIATION AS A CYBERCRIME told the Black Hat hacker conference.46 Others in SOLUTION. U.S. policymaking circles have floated the idea of It is too blunt an instrument for the nuanced slowing down or cutting off Internet traffic from, issue of cybersecurity; besides, many of the say, China, if their online crooks and spies will not worst criminals set up shop in the United States. leave us alone. Lt. Commander Matthew Sklerov, writing in Military Law Review, counsels the Unit- The Internet is mostly a collection of business- ed Sates to “hold sanctuary states responsible for es, not a collection of governments. For all its violating their duty to prevent cyberattacks.”47 flaws, this is a system that fundamentally works —witness the relentless double-digit annualized This may be too literal an interpretation of the growth of the Internet. Inserting additional na- anti-piracy precedent. The business ties between tional controls into this arrangement is some- America and China are so strong these days that thing to be resisted, not embraced. a national-scale Internet block would punish both of our economies. (Besides, a blockade is an act of But if a country-wide block is too blunt an instru- war.) The ability to route traffic through a dozen ment to be useful, there are more precise tools
46 Kim Zetter, “Former NSA Director: Countries Spewing Cyberattacks Should Be Held Responsible,” Threat Level, 7/29/2010,
21 st C e n t u ry D e f e n s e I n i t i at i v e • J o h n L. T h o r n to n C h i n a C e n t e r at Brookings Pirates of the ISP s: T ac t ic s fo r T u r n i n g O n li n e C ro o ks i n to I n t e r n at i o n a l P a r i a h s 17 that could be employed. A relative handful of funnel money to the spammers, for instance, and firms provide the infrastructure for a huge swath you very well may undercut the spammers’ rea- of the cybercriminals worldwide. The networks son for sending out bulk e-mail in the first place. of just 50 ISPs account for around half of all in- The criminal cannot commit his crimes without fected machines worldwide, according to a study these business partners. Therefore, “affecting (or prepared for the Organization for Economic Co- threatening to affect) those relationships can in- operation and Development.48 A tiny portion of fluence the behaviors of an actor; and it should be the world’s registrars regularly service criminal generally applicable to forestalling a wide range clientele. Just three firms process 95 percent of of potential threats,” writes SAIC’s Jeff Cooper.51 the credit card transactions for the drugs and herbal remedies advertised by spammers.49 A That might seem like a relatively straightforward small minority of hosting companies caters to proposition. Internet providers merely have to be crooks. When one particularly noxious hosting convinced to pull the plug on their most felonious company—McColo Corp. of San Jose, California hosting customers. Most of the big “tier 1” net- —was taken down, the volume of spam world- works already forbid spam, computer takeovers, wide dropped by 70 percent.50 and other criminal activities in their user agree- ments. They are well within their rights to discon- These companies are in business with, and ac- nect those crooked hosts. cessories to, criminal enterprises. And, unlike the criminals themselves—who hide behind dispos- But the ISPs rarely exercise those rights. Mc- able e-mail addresses, anonymously-registered Colo was only “depeered” by its ISPs after the domains and encrypted communications—it’s no journalist Brian Krebs and others spent months mystery who these firms are. The independent assembling data that finally persuaded the pro- research group HostExploit, for example, pub- viders to disconnect the crime den.52 Limestone lishes a quarterly list of the worst-of-the-worst Networks out of Dallas, Texas spent four years on hosting companies and networks. HostExploit’s list of the world’s 50 most criminal- friendly hosting companies (out of more than 47,000).53 Until recently, Limestone hosted the RECOMMENDATION 4: LEAN ON THE command-and-control servers for Coreflood, one CRIMINAL SUPPORT NETWORKS. of the oldest and biggest botnets of all time. Yet Online crooks depend on these businesses. no action has been taken against Limestone, de- That makes them nodes of pressure and of spite the associations.54 vulnerability.
In the 17th century, the town of Port Royal, Jamai- So any pressure is better applied not on nation- ca became an infamous pirate paradise. There, hi- states, but on this larger ecosystem that abets jacked goods were sold, crews recruited and raids criminality. Blacklist the payment companies that launched along the trade routes. Governments
48 Van Eeten, et. al. 49 Kirill Levchenko, Andreas Pitsillidis, Neha Chachra, et. al., “Click Trajectories: End-to-End Analysis of the Spam Value Chain,” IEEE Symposium on Security and Privacy, May, 2011,
21 st C e n t u ry D e f e n s e I n i t i at i v e • J o h n L. T h o r n to n C h i n a C e n t e r at Brookings Pirates of the ISP s: T ac t ic s fo r T u r n i n g O n li n e C ro o ks i n to I n t e r n at i o n a l P a r i a h s 18 not only knew what was happening there—they al was brought down by an earthquake. We will turned a blind eye to the hijackers and their ha- not be so lucky with its online analogues. The rest ven. It is easy to imagine an outfit like McColo as of the Internet community will have to do the job. the 21st Century equivalent. Eventually, Port Roy-
21 st C e n t u ry D e f e n s e I n i t i at i v e • J o h n L. T h o r n to n C h i n a C e n t e r at Brookings Pirates of the ISP s: T ac t ic s fo r T u r n i n g O n li n e C ro o ks i n to I n t e r n at i o n a l P a r i a h s 19 It is Up to the ISPs
nfortunately, some of the companies best po- When ISPs’ direct financial interests are at risk, Usitioned to interrupt the cybercriminal ecoys- however, they have proven to be more than will- tems are the ones with the least incentive to do so. ing to filter, block, or redirect traffic. And the in- formation about threats flows freely.A ll of this is There is a long-standing aversion in the ISPs to po- done regularly to defend against Distributed De- licing the content that travels on their networks. nial of Service (DDOS) attacks. In a DDOS, com- Besides, there is not much of a direct economic promised computers are used to overload servers benefit for an ISP to turn aggressive against cy- with so many requests for information that the bercrooks. Even crime-ridden hosting companies machines collapse. DDOSs can generate enor- have legitimate customers, too, and all of those mous amounts of traffic—as much as 50 gigabits downstream customers—illicit and not—ultimate- per second. The traffic is not only expensive for ly pay for the Internet access that the ISP pro- an ISP to haul—the capacity to handle that much vides. If an ISP gets overly aggressive with those data on a monthly basis might cost $50,000 on customers, its bottom line could suffer quickly. the open market—it can also threaten the con- nectivity of a whole range of ISP customers while What is more, while the ISP may have a criminal en- a particular victim gets pounded. So ISPs have terprise based on its network, the victims of those to pay for maintaining excess bandwidth in case crooks may be on some other network, or in an- they get hit. other country, so there is no real harm to the ISP.55 Many large ISPs—and many Internet Exchange Along with that economic disincentive, there is Points, which provide even higher-level connectivi- also an information gap. ISPs are disinclined to ty—have joined together in a group to limit attacks look for individual infections on their network; like these. When a DDOS grows into something the investigations can be intrusive, and the clean- substantial, the group members distribute lists of ups costs high. This means the true costs of the Internet Protocol addresses to block and digital overall cybercrime problem remain hidden—and filters to keep the traffic out. They even, in rare the pressure to act against the problem is eased. cases, turn the traffic back on a repeat attacker.
55 Moore (2010)
21 st C e n t u ry D e f e n s e I n i t i at i v e • J o h n L. T h o r n to n C h i n a C e n t e r at Brookings Pirates of the ISP s: T ac t ic s fo r T u r n i n g O n li n e C ro o ks i n to I n t e r n at i o n a l P a r i a h s 20 This is all made easier because there is no need So the question is how do you motivate ISPs to to examine the content of that traffic—just the work like this to stop other kinds of online crime? data’s flow—and because the ISPs hosting at- How do you give these companies some sort of fi- tacker and victim alike have to bear the costs of nancial incentive for rooting out botnets and the that excess bandwidth. Even so, the results are like? Finally, how do you encourage ISPs to begin startling: A serious attack is mitigated two to five to share data on these threats with one another? times per day.56
RECOMMENDATION 5: MOTIVATE ISPs TO PRESSURE THE CRIMINAL ECOSYSTEM. They are perfectly placed to interrupt illicit traffic.
56 Private interview, 4/21/2011
21 st C e n t u ry D e f e n s e I n i t i at i v e • J o h n L. T h o r n to n C h i n a C e n t e r at Brookings Pirates of the ISP s: T ac t ic s fo r T u r n i n g O n li n e C ro o ks i n to I n t e r n at i o n a l P a r i a h s 21 A “Grand Bargain” For Security
ne method is simply to fine theI SP that does Moore proposes a clean-up fund, jointly backed Onot immediately disinfect the machines on its by the government and the major software com- network. In a report for the European Commission, panies. Which firm pays depends on which pro- Anderson et al. suggest that the provider get hit gram was used to compromise the machine. The with a “fixed penalty” for “machines that continue government pays for the open source efforts.58 to misbehave after a reasonable duration, say 3 In return, the government gets a more efficient, hours,” after notification of the infection.57 better-connected economy and the software makers avoid any possible lawsuits that the in- It is a crude solution to a problem as wide-ranging fected machines might generate.59 as cybercrime. Some malware is easy to find; some is hard. Some malware is easy to remove; some is Moore casts the fund as part of “grand bargain” not. That undercuts the idea of a one-size-fits-all between software companies, the government, fine for every missed infection.T he proposal also and Internet providers. It involves more than giv- treats the master (the botnet controller) and the ing ISPs a financial incentive to keep their- net slave (the hijacked machine) similarly, when one works clean. It would also hold ISPs liable for dam- is a clearly more damaging entity than the other. ages if they did not disinfect machines quickly. Furthermore, the fixed penalty could be seen as a disincentive for ISPs to share—or even look for— As Douglas Lichtman of the University of Chica- evidence of cybercrimes. Why search if all you’re go notes, it’s not unusual for an offline business going to find is potential fines? to be liable for damage it may not have directly caused. That is particularly true if that company A second method goes in the entirely opposite could’ve done something to deter that bad act.60 direction, subsidizing the ISPs’ disinfections. A retailer can be culpable if its delivery van hits
57 Ross Anderson, Rainer Böhme, Richard Clayton, and Tyler Moore, “Security Economics and European Policy,” 2008,
21 st C e n t u ry D e f e n s e I n i t i at i v e • J o h n L. T h o r n to n C h i n a C e n t e r at Brookings Pirates of the ISP s: T ac t ic s fo r T u r n i n g O n li n e C ro o ks i n to I n t e r n at i o n a l P a r i a h s 22 someone and the company did not properly ser- Harvard’s Jonathan Zittrain notes, today’s com- vice the vehicle. Landlords are deemed account- puting environment is a “generative” one; the able if they do not put locks on their doors and latest programs leverage the code that came be- burglars walk in., Similarly, both Lichtman and fore them. Any sufficiently popular product these Moore argue, ISPs cannot just allow criminal ha- days gives rise to a whole family of new software. vens to linger on their networks. Just look at the hundreds of thousands of pro- grams in the iPhone and Android app stores. Avoiding the liability is seemingly easy under Introducing legal threats into that environment Moore’s plan: just clean up customer machines “would serve only to propel PC lock- down,” sti- as soon as you’re notified of an infection. Moore fling the buzz of generative creativity.63 There is models his plan on the Digital Millennium Copy- universal agreement that software firms ought right Act, which forces providers to comply with to be paying more attention to security as a first copyright holders’ demands to take down any pi- principle as they write their code, but penalizing rated music, movie, software, image or service. them if they leave a buffer overflow is an idea that ought to be considered very cautiously. Moore’s plan represents the most comprehensive attempt yet to get the best-placed parties to curb However, the biggest shortcoming with Moore’s the most prevalent form of online crime. It should “grand bargain” may be that it ignores one of the not be dismissed lightly, but it does have at least most toxic components of the online crime for- three weaknesses. mula: the hosting company supporting a criminal gang. Under Moore’s plan, ISPs are suddenly li- First, its model—the Digital Millennium Copyright able for cleaning up countless millions of infected Act—is notoriously open to abuse. Technology machines—the victims of cybercrime, essentially news service Ars Technica had its Facebook page —while a relatively small number of crooks are removed after a single vague e-mail.61 A speaker allowed to roam free. It is like focusing on exclu- wire company sued a search engine that included sively door-locking, instead of on the robbers its cables in the search results.62 The list is as poised to kick those doors in. Both are important, endless as it is asinine. And no wonder: under but a motivated crook is always going to be able DMCA, anyone can issue a takedown notice, forc- find a way in. ing a company to comply or risk a legal battle. As Moore himself finds in a forthcoming paper, Another potential issue is Moore’s idea that soft- “countermeasures that block malicious tran- ware firms have to fund malware clean-ups or sit traffic appear more effective than ones that face lawsuits of their own. There are real ques- block outgoing traffic... Our results also suggest tions about which companies would be forced to that when only the largest ASes [autonomous participate—beyond the obvious players like Mi- systems—hosts and ISPs] intervene, it is better crosoft and Adobe—and what looming penalties to simply filter out malicious traffic… than to -at will do to innovation in the software sector. As tempt to remediate end-user infections.”64
61 Ken Fisher, “Facebook shoots first, ignores questions later; account lock-out attack works,” Ars Technica, 4/28/2011,
21 st C e n t u ry D e f e n s e I n i t i at i v e • J o h n L. T h o r n to n C h i n a C e n t e r at Brookings Pirates of the ISP s: T ac t ic s fo r T u r n i n g O n li n e C ro o ks i n to I n t e r n at i o n a l P a r i a h s 23 One Proposal for Pressuring the Criminal Ecosystem
hat is why Moore’s model should be turned on methodology would have to conform to a Tits head. The focus ought to be on punishing global consensus about what constituted the businesses at the heart of the cybercriminal criminal behavior. No single government, ecosystem—the hosting companies and the plat- in other words, could brand a particular forms they need to pull off their scams and rob- firm as an outlaw. beries. It is those firms that should be vulnerable to legal action if they continue to support crimi- • Once the roster is published publicly, a nal enterprises. listed company would have fourteen days to either drop their illicit customers or to RECOMMENDATION 6: HOLD THE WORST explain why it does not belong on this roll HOSTING COMPANIES LIABLE FOR THEIR of the worst-of-the-worst. If the company CRIMINAL CLIENTS AND THE WORST ISPs complies (or explains itself sufficiently), LIABLE FOR THEIR CRIMINAL HOSTS. then it is granted safe harbor from any This will provide financial incentives to turn lawsuit that might arise from the harm against the criminals, instead of profiting from generated by the spammers, phishers their traffic. and botnet herders it once helped. • If the hosting company fails to comply, Here’s a sketch of how it might work: however, it becomes subject to a liability lawsuit. The company has already been • First, an outside agency is deputized to warned that it’s facilitating harmful ac- maintain a list of the hosting companies tivities and given a chance to correct its with the closest ties to crime. For the mo- negligent behavior. ment, let us say it is HostExploit’s quar- terly list of the 50 worst. But it could also • If that same company ignores the warn- be maintained by a number of security ings and appears on the worst-of-the- specialists, or a combination of them all. worst list for a second quarter, the firm’s The list would rely on a transparent meth- ISP should also be liable. (Of course, odology, so that everyone involved could the provider should be given at least as see which specific activities were most much time and opportunity to address problematic to the wider community. The the problem.)
21 st C e n t u ry D e f e n s e I n i t i at i v e • J o h n L. T h o r n to n C h i n a C e n t e r at Brookings Pirates of the ISP s: T ac t ic s fo r T u r n i n g O n li n e C ro o ks i n to I n t e r n at i o n a l P a r i a h s 24 Such a system gives ISPs enormous incentives of liability lawsuits could well provide the impetus to disconnect bad hosts, even if it means a tem- for that shift. porary dip in revenue. This plan provides a clear standard for bad behavior, and a clear path for In order for the plan to work, however, it has to be leaving the rogue’s gallery. Most importantly, crystal clear. Companies on the worst-of-the-worst perhaps, it applies pressure on the broader ISP list need to know exactly how they got on the ros- community to weed out the worst-of-the-worst – ter, and exactly what they need to do to get off it. without heavy-handed government intervention. The firms should be given ample time to resolve the issues that got them off the worst-of-the- “In all of the notable eras of piracy,” University of worst roster. Some of the bills making their ways South Carolina historian Donald Puchala writes, through Congress currently do not have those “relationships between pirates and those who protections; anyone can sue anyone at any time, abetted their projects amounted in effect to con- apparently. And that is wrong. As Google General spiracies of greed. The relationships were symbi- Counsel Kent Walker recently told Congress, “Leg- otic: pirates could neither accomplish their ends islation should not include a private right of action nor convert their booty into profits without the that would invite suits by ‘trolls’ to extort settle- aid of their protectors; for their part, the protec- ments from intermediaries or sites who are mak- tors could not so readily and splendidly enrich ing good faith efforts to comply with the law.”67 themselves without the booty brought in by the pirates.” Cities like New York, then a British colo- To avoid that possibility, the illicit activities con- ny, grew fat off of pirate riches.65 tributing to a company’s placement on that roll have to be limited to a few universally recognized One of the turning points in global attitudes to- crimes: theft, fraud, and criminal trespass, for ex- ward piracy occurred when pirates began to ample. Politically inflammatory speech and even threaten the economic interests of the states that copyright infringement have to be left off of the previously sponsored them. The pirates picked list; they are too open to abuse and overly broad fights with allies, hijacked friendly ships, and, as interpretation. a result, made new enemies in cities like London and Paris.66 And when the governments decided Neither the United States, nor any other govern- to definitively retaliate, one of the first steps they ment, should get into the business of picking which took was to shut down the markets for pirate boo- companies are in this rogues’ gallery, but Congress ty. The most effective way to target the hijackers may need to act before a plan like this could be put was through their economic support system. into action internationally. Liability and negligence are generally well-charted territories of the law. We now may be at a point of a similar shift online. The legal maps specifically for hosting companies If ISPs start seeing rogue hosting companies as and ISPs’ liability are less detailed. financial time bombs instead of as paying- cus tomers, it would represent a huge step forward in There have not been many lawsuits against these marginalizing cybercriminals globally. The threat firms for negligence. Exactly who would have the
65 Donald Puchala, “Of Pirates and Terrorists: What Experience and History Teach,” in Contemporary Security Policy, Vol.26, No.1, April 2005, pg. 9. 66 Thomson, pg. 109. 67 Kent Walker, “Testimony before the the House Judiciary Subcommittee on Intellectual Property, Competition, and the Internet,” 4/6/2011,
21 st C e n t u ry D e f e n s e I n i t i at i v e • J o h n L. T h o r n to n C h i n a C e n t e r at Brookings Pirates of the ISP s: T ac t ic s fo r T u r n i n g O n li n e C ro o ks i n to I n t e r n at i o n a l P a r i a h s 25 standing or the incentives to file these suits is space to criminal enterprises a more dangerously murky. The precedents are, at best, confusing. In and costly proposition. Green vs. America Online, the U.S. Court of Ap- peals found that the Internet provider was “statu- Many of these criminally-friendly firms may re- torily immune from liability from causes of action main beyond reach of a lawsuit, based in places arising from third party content.”68 By contrast, in like China and Russia.72 Some of the most venom- Arista Records LLC v. Lime Group LLC, a U.S. Dis- ous cybercrime crews are based in these counties. trict Court found that a peer-to-peer network was Still, the United States is not such a bad place to liable for copyright infringement, because the begin a global push against cybercrime havens. network was aware of widespread infringement Twenty of HostExploit’s 50 worst are American by its users and did not take “meaningful steps” firms; only five are Russian, and three are Chi- to stop it.69 The Digital Millennium Copyright Act nese.73 By some measures, the United States is states that ISPs are liable when they are given no- the planet’s leading home for illicit Internet ac- tice of infringement on their network—but before tivities like spam and phishing, with three times that notification comes, the firms are not liable the spam havens as China and more than twenty at all. Harmonizing these seemingly contradictory times the phishing sites. (Some of the spammers rulings may “require a government mandate to and phishers themselves may be based abroad, work,” Harvard’s Jack Goldsmith notes.70 but they are taking advantage of America’s rela- tively laid-back approach to cybercrime law en- Even with such a mandate in place, this plan will forcement to set up shop here.) not help in all cases. There may not be much to be done, for example, when criminals use otherwise- Even overseas and supposedly-bulletproof hosts legitimate hosting services as a launch pad for are susceptible to pressure. These companies their attacks. Another roadblock: so-called “bul- have limited customer bases, and are prone to letproof hosting” services, which promise to keep extortion schemes from other criminals. The customers’ content online no matter how many firms also have limited ways to get paid for their threats or complaints are received. Those hosts gray market services. Squeeze those moneymen, are even more bulletproof when they are located and the bulletproof hosts become vulnerable.74 overseas. As Kirill Levchenko, with the University of California, San Diego observes, the supply of Besides, more aggressively targeting the crimi- hosting resources is vast, and the costs of switch- nal ecosystem in the United States not only ing providers is low.71 In other words, occasion- helps protect American consumers, it also al- ally punishing a single host from time to time will lows America to lead on a vital issue. History has not work. Instead, the rules of the hosting game shown that when America makes changes to its have to be tweaked, to make the supply of server own laws, countries worldwide often follow suit.
68 Green v. America Online (AOL), 318 F. 3d 465 - Court of Appeals, 3rd Circuit, 2003,
21 st C e n t u ry D e f e n s e I n i t i at i v e • J o h n L. T h o r n to n C h i n a C e n t e r at Brookings Pirates of the ISP s: T ac t ic s fo r T u r n i n g O n li n e C ro o ks i n to I n t e r n at i o n a l P a r i a h s 26 “Many international norms began as domestic tions against a state with which the United States norms,” Martha Finnemore, the international re- is at peace.” In the years that followed, 49 other lations theorist, writes.75 A trend started at the countries signed similar prohibitions, setting the beginning of the Republic. The groundbreak- stage for a two century-long decline in merce- ing U.S. Neutrality Act of 1794 forbid American narism and piracy.76 citizens from forming or joining “military expedi-
75 Martha Finnemore and Kathryn Sikkink, “International Norm Dynamics and Political Change,” International Organization, Vol. 52, No. 4, Autumn, 1998, pgs. 887-917. 76 Thomson, pgs. 78-82.
21 st C e n t u ry D e f e n s e I n i t i at i v e • J o h n L. T h o r n to n C h i n a C e n t e r at Brookings Pirates of the ISP s: T ac t ic s fo r T u r n i n g O n li n e C ro o ks i n to I n t e r n at i o n a l P a r i a h s 27 Protecting the Victims
ressuring the criminal support networks alone newly-suspected machines per day. The ISPs then Pwill not be enough to curb cybercrime. More choose to respond in the way they feel is best. In will have to be done to secure the individual us- most cases, they notify customers with a phone ers being targeted by the phishers, the spammers, call or an e-mail. In the more extreme cases, the and the botnet herders. Again, ISPs, who sit be- ISP might confine the customer to a “walled gar- tween those users and the open Internet, will likely den,” in which Internet access is severely limited find themselves with additional responsibilities. until that person cleans up his or her machine.77
There is no public data, yet, on how the iCode pro- RECOMMENDATION 7: ENCOURAGE ISPs gram is doing; it’s only been up and running for a TO NOTIFY CUSTOMERS OF INFECTIONS. few months. But iCode has proven so lightweight, It is easy for the providers to tell which clients and so easy to accept, that all of the country’s ma- have been compromised, and it is better for jor ISPs—covering 90 percent of the market—have everyone if those breaches get fixed. joined in the voluntary effort. Which means that for the first time, the vast majority ofA ustralians will A number of intriguing approaches have been now be notified if their machines get infected. tested and proposed in the last eighteen months to make it as painless as possible for ISPs to guard The program, however, is so lightweight that it against attacks, while still providing some relief may not work as a model for American action. to consumers. One answer is to make it very, very End users are left holding the bag for cleaning cheap. That is the model of a voluntary Australian out their computers, when they may not have program—set up by the local ISP industry itself. done anything to bring about the infection and may not have the skills to get rid of the malware. Under the so-called “iCode” program, the Austra- Meanwhile, the government takes on the job of lian government looks for signs of botnets, and botnet monitor-in-chief. The temptations to turn then hands out what it finds to the ISPs in daily that into a multi-purpose surveillance role might reports. The government finds about 19,000 be too great to ignore. Besides, this practice runs
77 Private interview, 4/18/11.
21 st C e n t u ry D e f e n s e I n i t i at i v e • J o h n L. T h o r n to n C h i n a C e n t e r at Brookings Pirates of the ISP s: T ac t ic s fo r T u r n i n g O n li n e C ro o ks i n to I n t e r n at i o n a l P a r i a h s 28 counter to stated American policy. As President Whichever model is adopted—iCode, Constant Obama said in 2009, “Our pursuit of cybersecuri- Guard or something else—the government ty will not—I repeat, will not—include monitoring should encourage ISPs to start notifying their private sector networks or Internet traffic. We will customers of infections on their machines. If the preserve and protect the personal privacy and service providers agree to do this voluntarily, civil liberties that we cherish as Americans.”78 fine. That would be preferable to some govern- ment mandate. An American ISP, Comcast, is piloting a second ap- proach, with a program called “Constant Guard.” RECOMMENDATION 8: AMEND THE LAWS The security firm Damballa hunts for botnet traf- TO ALLOW ISPs TO SHARE ATTACK DATA. fic, primarily by combing through Domain Name Spotting criminal trends early requires more Server data—the information that translates a information. name (“website.com”) into a series of numbers called an Internet Protocol address. Damballa pro- iCode does have one distinct advantage over vides Comcast with a list of botnet servers, and the American project: it includes all of the major the IP addresses of customers communicating Australian ISPs who get a common, daily-updat- with those servers. Comcast notifies the infected ed data feed. Comcast keeps the ConstantGuard customer, who is then offered a range of security data to itself. With crooks hopping to new do- options, from antivirus software to technician mains, using hosts and deploying new malware support, to clean up the infection remotely.79 seemingly every second, that compartmentaliza- tion impedes efforts to corral online crime. It is As in the Australian case, Constant Guard is too not even possible to get a sense of the true scope new to provide meaningful results; it has only of the cybercrime problem unless all the major been fully up and running since early April. Com- ISPs share what they find. cast sees the security enhancements as a poten- tial competitive advantage in an ISP marketplace At the moment, however, it is unclear if it would that is growing more crowded. Since it requires be legal for the providers to share information. only a few people to operate, Constant Guard was There are antitrust issues to consider when com- fairly cheap to implement. petitors pool information. And while the Electron- ic Communications Privacy Act of 1986 plainly Compared to the Australian plan, there are fewer permits an ISP to monitor communications for civil liberties concerns. Customers can opt out the protection of its own network,80 it’s less obvi- of the program, and Comcast is only looking to ous whether or not the act allows a provider to see if a customer’s machine is reaching out to a share that data with other companies.81 botnet server—not at the actual content of the customer’s communications; the government is Some ISPs get around this barrier by allow- not involved. ing independent security firms like Damballa to
78 Barack Obama, “Remarks By The President On Securing Our Nation’s Cyber Infrastructure,” transcript,
21 st C e n t u ry D e f e n s e I n i t i at i v e • J o h n L. T h o r n to n C h i n a C e n t e r at Brookings Pirates of the ISP s: T ac t ic s fo r T u r n i n g O n li n e C ro o ks i n to I n t e r n at i o n a l P a r i a h s 29 monitor their networks. These firms trade some for ISPs, much in the same way the Year 2000 In- information—like new malware variants—to then formation and Readiness Disclosure Act of 1998 secure the rest of their clients. But the security allowed for the pooling of data about Y2K vulner- firms also keep a great deal of information to abilities.82 ECPA may also need to be amended so themselves. Damballa, for instance, does not tell that these Internet providers can share data on its customers what it is finding on other custom- botnets and other criminal activities directly— er networks, except in the most general way. as long as that data is first anonymized to protect consumers’ personal information, and as long as That is why some have proposed carving out a users can opt out of the project. limited antitrust exemption for security issues
82 Larry Clinton, “Cyber-Insurance Metrics and Impact on Cybersecurity,” White House Cyberspace Policy Review, 3/29/2009,
21 st C e n t u ry D e f e n s e I n i t i at i v e • J o h n L. T h o r n to n C h i n a C e n t e r at Brookings Pirates of the ISP s: T ac t ic s fo r T u r n i n g O n li n e C ro o ks i n to I n t e r n at i o n a l P a r i a h s 30 Corporate Responsibility
he circle of disclosure and accountability goes, and those secrets get spilled—maybe to a Tshould expand far beyond ISPs. Businesses competitor, maybe to another crook. Why take must tend to their corporate networks—and share that risk? what they find—just as ISPs are supposed to take care of theirs. In the 19th century, it was up to the There are liability concerns too. Some security nation-state to clamp down on piracy by establish- consultants say they have offered corporations ing responsibility over their territories. In the 21st lists of infected machines on their networks— century, it is up to government to provide private only to have those lists rejected because the companies with the proper incentives to exercise companies worried that with knowledge came the same type of authority and accountability. culpability for what those computers did.84
But some of the same disincentives that inhibit Hoarding this data ignores one of the biggest se- ISPs’ data-sharing and disinfection hold back curity lessons of the last quarter-century: crimi- these businesses as well. The compromised ma- nal data becomes more powerful as it’s aggregat- chines on a company’s network may be target- ed and analyzed. As police departments learned ing computers at some other corporation; so the during the urban crime reductions of the 1990s real harm is felt elsewhere. And because the true and 2000s, what may appear at first glance to be scope of cybercrime remains a mystery, execu- an isolated break-in at a convenience store can tives have a hard time figuring out how much to turn out to be a part of a city-wide spree. That spend to defend their networks.83 kind of information helps police deploy resources more efficiently, identify suspects faster and put Perhaps more important are the perceived com- felons in jail for longer. petitive concerns. In boardrooms and in corpo- rate IT departments, the flaws (or strengths) of a It is a lesson learned long ago by the big antivirus corporate security system are seen as vital trade firms, like McAfee and Norton. When one secu- secrets. Disclose too many infections, so the logic rity company finds a new malware variant, that
83 Anderson et. al. (2008). 84 Private interview, 3/8/11.
21 st C e n t u ry D e f e n s e I n i t i at i v e • J o h n L. T h o r n to n C h i n a C e n t e r at Brookings Pirates of the ISP s: T ac t ic s fo r T u r n i n g O n li n e C ro o ks i n to I n t e r n at i o n a l P a r i a h s 31 company shares it with the other security ven- into the networks of three of the world’s biggest dors. It is the only way the security companies can energy companies and stole some of their most hope to keep up when there are tens of thousands important proprietary information: the details of of new malware signatures appearing every day. their oil discoveries. The value of that informa- tion is valued in the billions of dollars, but the This also shows that sharing threat information firms did not realize the full extent of what had does not have to be some sort of competitive happened until the FBI informed them at a meet- handicap. After all, if these companies—whose ing in 2009.86 The oil men had not told each other core business is security itself—can manage to about the breaches. pool their data without harming their bottom lines, surely firms in other sectors can manage A few months later, a new round of intrusions be- to do the same. gan, this time targeting the energy companies’ bidding information. By then, several executives Various industries—information technology, at the largest companies had begun sharing net- financial services, and public transit, to name work attack data. They saw that the infiltrators a few—have set up “information sharing and all used the same techniques to gain access to analysis centers” where security specialists are corporate directories, the same software to con- supposed to trade threat data and best practices trol company computers remotely, and the same for network defense. These centers are supposed pathway to send information back to China.87 to share with one another and, eventually, with Within four months, they had the pattern down the government. But the performance of these —and the tactics to counteract it. Many smaller groups is wildly uneven and their proceedings companies, however, were out of the loop. They are often kept private, even classified. did not find out what had happened until McAfee published a research paper—two years after the So for the most part, data-sharing continues attacks had begun.88 to be an ad hoc affair—dependent as much on whom a security officer knows as how important RECOMMENDATION 9: PUSH COMPANIES the information is. Even top criminal researchers TO EXPAND REPORTING at Microsoft—who presumably have more infor- OF NETWORK BREACHES. mation available about more people’s desktops It is good for consumers; it may shame some than anyone—still rely on word-of-mouth infor- firms into shoring up their networks; and it mation and their social networks to learn about provides more data for cybercrime detection. emerging criminal threats.85 A number of proposals are circulating in Con- The consequences of keeping quiet about gress and among policymakers to compel compa- breaches can be devastating. In the fall of 2008, nies to share more about their network breaches for example, online thieves based in China broke and criminal threats.
85 Private interview, 4/29/11. 86 Mark Clayton, “US oil industry hit by cyberattacks: Was China involved?,” Christian Science Monitor, 1/25/2010,
21 st C e n t u ry D e f e n s e I n i t i at i v e • J o h n L. T h o r n to n C h i n a C e n t e r at Brookings Pirates of the ISP s: T ac t ic s fo r T u r n i n g O n li n e C ro o ks i n to I n t e r n at i o n a l P a r i a h s 32 One idea, as discussed previously, is to carve out when personal data—birthdates, social security antitrust and ECPA exemptions for certain kind numbers, bank account information and the like of security-related information. A second is to re- —have been compromised. As a tool for combat- quire public companies to discuss major network ing identity theft, these laws have shown some breaches in a Form 8-K for the Securities and Ex- success. Sasha Romanosky and his colleagues at change Commission, which advises stockholders Carnegie Mellon University found that, between of unscheduled and material events. Under the 2002 and 2009, the notification laws reduced plan, companies would also inform shareholders identity theft caused by data breaches by an av- about the state of their network security under erage of 6.1 percent.91 the “risks” section of its annual 10-K reports. The White House recently suggested stitching This requirement does not have to involve any the “patchwork” of 47 state data breach laws new laws or regulations; in fact, it is already on the into a single—and expanded—federal one. Under books, Senate Commerce Committee chairman the proposal, a company has 10 days to notify the Sen. Jay Rockefeller believes. “Federal securities federal government about security lapses that law obligates the disclosure of any material net- could lead to the loss of 5,000 or more custom- work breach, including breaches involving sensi- ers’ private information. The firm has 60 days tive corporate information that could be used by to tell individuals about these lapses (unless the an adversary to gain competitive advantage in the firm passes an independent security audit which marketplace, affect corporate earnings, and poten- deems the risk of actual data disclosure to be tially reduce market share,” Rockefeller writes.89 low). If the company complies with the new provi- sion, it is given safe harbor from any harm that There is also a good case for a company to un- comes out of the security flaws.92 dergo an independent information security audit annually, in much the same way it gets a finan- By targeting the breaches that expose personal cial audit today. Under the Sarbanes-Oxley Act of information rather than the data leaks them- 2002, a company’s CEO and CFO have to certify selves, the White House’s proposal could become that they have personally reviewed any financial a new corporate requirement to disclose all sorts reports, and that the reports are accurate.90 A sim- of network security shortcomings. That would ilar statement about network integrity from the certainly benefit consumers, who might be very CEO and the Chief Information Officer would put curious to learn which bank, utility or airline best their personal reputations on the line—increasing secures its network. The bad publicity surround- management pressure to get cybersecurity right. ing the security lapses could cause companies to shore up their networks, but as a tool for catch- A third notion is to build upon the dozens of state ing online criminals earlier, the administration’s laws that oblige firms to notify their customers plan may not be quite right.
89 Sen. John D. Rockefeller IV, letter to Securities and Exchange Commission Chairwoman Mary Schapiro, 5/11/2011,
21 st C e n t u ry D e f e n s e I n i t i at i v e • J o h n L. T h o r n to n C h i n a C e n t e r at Brookings Pirates of the ISP s: T ac t ic s fo r T u r n i n g O n li n e C ro o ks i n to I n t e r n at i o n a l P a r i a h s 33 Under the White House proposals (and the cur- Taking care of your own network is, of course, the rent data breach rules), the information disclosed information security specialist’s first and fore- is internal: which customers had their social se- most job, but hardening defenses alone is not go- curity numbers stolen or their banking pass- ing to keep cybercriminals at bay. Sooner or later, words disclosed. On the other hand, many of the you have to share what you know. Which makes important indicators of a cybercriminal attack disclosing these network breaches—in some are external: the domain names and IP addresses fashion—part of the definition of 21st century used by the crooks, the tools employed to break corporate responsibility. in. If an expanded disclosure law focused on this external information, it might prove to be a bet- ter crime-fighting tool—and companies might be more willing to go along.
21 st C e n t u ry D e f e n s e I n i t i at i v e • J o h n L. T h o r n to n C h i n a C e n t e r at Brookings Pirates of the ISP s: T ac t ic s fo r T u r n i n g O n li n e C ro o ks i n to I n t e r n at i o n a l P a r i a h s 34 Can Insurance Curb Crime?
oday’s personal data notification laws are push- RECOMMENDATION 10: REQUIRE ing more and more companies to purchase T GOVERNMENT CONTRACTORS TO CARRY some kind of insurance to hedge against the po- CYBERSECURITY INSURANCE. tential cost of a big data breach. Cybersecurity in- It builds the market for insurance, which surance policies—all but unheard-of a few years encourages companies to get more serious ago—have grown from a $100 million market in about network protection. 2002 to an estimated $600 million in 2010.93 Another accelerant could come from the federal It is a positive development, writes Larry Clin- government, Clinton writes. Washington could re- ton from the Internet Security Alliance: insurers quire its contractors to have cybersecurity insur- “require a level of security as a precondition of ance coverage. After all, the Federal Acquisition coverage, and companies [that] adop[t] better Regulations already require companies that want security practices often receive lower insurance to do business with the government to have “in- rates. This helps companies to internalize both surance for certain types of perils.” the benefits of good security and the costs of poor security, which in turn leads to greater in- The effects of insurance should not be overstat- vestment and improvements in cybersecurity.”94 ed —health insurance hasn’t exactly encouraged Expanding the notification laws to include other individuals to make better medical decisions, for kinds of network breaches could accelerate the example. But the combination of insurance and market’s growth even further. forced disclosure of network breaches should begin to give businesses some of the financial incentives needed to take greater responsibility for what happens on their networks. Both tactics should be pursued.
93 Hemantha S.B. Herath and Tejaswini C. Herath, “Copula-based actuarial model for pricing cyber-insurance policies,” Insurance Markets and Companies: Analyses and Actuarial Computations, Volume 2, Issue 1, 2011,
21 st C e n t u ry D e f e n s e I n i t i at i v e • J o h n L. T h o r n to n C h i n a C e n t e r at Brookings Pirates of the ISP s: T ac t ic s fo r T u r n i n g O n li n e C ro o ks i n to I n t e r n at i o n a l P a r i a h s 35 Criminal Enterprises, Civil Strategies
he federal government will have to use more to pursue it currently.”96 No government manag- Tthan its purchasing power, of course, in the er is ever going to say he has enough resources. fight against cybercrime.I t is going to need more But in this case, the complaint seems justified. —and better trained—law enforcement profes- sionals. Even more glaring are the gaps in the FBI’s cyber division. Ever since bank robbers began crossing RECOMMENDATION 11: EXPAND AND state lines in automobiles, the Bureau has been IMPROVE TRAINING FOR CYBERCRIME at the forefront of pursuing technology-enabled SPECIALISTS IN LAW ENFORCEMENT. crooks. Today, the Bureau says it has “more than “The FBI is underinvesting in cyberthreats right 1,000 advanced cyber-trained FBI agents, ana- now in the same way that it underinvested in lysts and forensic examiners” in its 56 field offic- counterterrorism in the 1990s.” 95 es, but those specialists are spread thin, accord- ing to an audit from the Department of Justice Of the 440 attorneys in the Justice Department’s Inspector General, and may be misallocated. Criminal Division, for example, only 40 attorneys are specifically tasked with handling computer In fiscal year 2009, the audit says, the FBI only crimes—less than half of the number devoted to used 31 percent of its “cyber agents” to “address organized crime. And those lawyers are also as- criminal-based intrusions.” Forty-one percent signed to handle intellectual property violations. worked on “online child pornography matters,” and As Criminal Division chief Jason Weinstein re- the remainder pursued “national security intru- cently told Congress, “It is really undeniable that sion investigations,” intellectual property disputes, the scope of the problem, which is growing every and “Internet fraud.”97 Child pornography is vile, day, far outpaces the resources that are available of course, and worthy of the FBI’s resources, but
95 Noah Shachtman, “Inside the FBI’s ‘Threat Matrix,’ From Nuclear Urinals to Osama’s USBs,” Danger Room, 5/13/2011,
21 st C e n t u ry D e f e n s e I n i t i at i v e • J o h n L. T h o r n to n C h i n a C e n t e r at Brookings Pirates of the ISP s: T ac t ic s fo r T u r n i n g O n li n e C ro o ks i n to I n t e r n at i o n a l P a r i a h s 36 does it deserve more attention than the count- Some of this can be fixed by tweaking some of less billions being lost to online thieves and scam the relevant laws. For example, the White House artists? More attention than the online attempts recently suggested an expansion of the racke- to compromise national security? teering law to include computer crimes.101
There is also a question about whether agents In the meantime, law enforcement is turning are properly trained. Auditors interviewed 36 cy- more and more to the civil courts to disrupt the ber agents in 10 field offices devoted to national network of businesses upon which the online security investigators. More than a third said they crook relies. In April, for instance, the Justice did not have the training or expertise needed for Department took an unprecedented step for U.S. the job. As National Security Historian Garrett law enforcement. It asked a judge for permission Graff observes, “The FBI is underinvesting in cy- to seize the command-and-control servers of berthreats right now in the same way that it un- the Coreflood botnet, which is blamed for more derinvested in counterterrorism in the 1990s.”98 than a million dollars in wire fraud. The judge ap- proved the request, and the Justice Department RECOMMENDATION 12: PURSUE CIVIL transferred control of Coreflood to the non-profit STRATEGIES TO DISRUPT CRIMINAL Internet Systems Consortium.102 The ISC began NETWORKS. issuing “stop commands” to the millions of com- The crooks move fast – and are often beyond puters running Coreflood’s malicious software, American jurisdiction. Civil courts may be the while the Justice Department e-mailed civil sum- only way to fracture their support system. monses to the “John Does” who previously ran the botnet. Piracy grew from a local nuisance to a genuine threat in distant parts of the world that seemed Such takeovers have happened at least twice immune to traditional law enforcement.99 Today, before.103 Dutch authorities seized the servers of the cybercrime situation feels much the same. the Bredloab botnet in October of 2010, redirect- Online scammers and thieves are so fast-moving, ing infected machines to a web page with instruc- so hard to find and, in many cases, so far beyond tions on how to remove the malicious software.104 American jurisdiction, that assembling tradition- In March 2011, a federal court gave Microsoft per- al criminal cases often will not work. Even when mission to take over the Rustock botnet.105 spectacular arrests are made—like the bust of credit card fraudster and online crime lord Max The early results of the first U.S. government Butler—they seem to do little to slow the expan- takeover of a botnet are promising. The number sion of the larger cybercrime ecosystem.100 of “pings” from infected machines in the United
98 Noah Shachtman, “Inside the FBI’s ‘Threat Matrix,’ From Nuclear Urinals to Osama’s USBs,” Danger Room, 5/13/2011,
21 st C e n t u ry D e f e n s e I n i t i at i v e • J o h n L. T h o r n to n C h i n a C e n t e r at Brookings Pirates of the ISP s: T ac t ic s fo r T u r n i n g O n li n e C ro o ks i n to I n t e r n at i o n a l P a r i a h s 37 States dropped by 90 percent in two weeks.106 Un- Even if the Coreflood hijacking goes off without fortunately, this step does not necessarily mean a hitch, there are legitimate long-term policy the machines are disinfected—the Coreflood concerns if such takeovers become a regular law malware reconstitutes itself every time a ma- enforcement tool. No one would argue that inno- chine restarts. So the FBI is now taking the ad- vative methods are required to smash criminally- ditional step of deleting the program from afar, controlled networks that can reconstitute them- and that is potentially problematic. selves in a flash. (Rustock, for example, survived previous takedown attempts.) You do not need Users have to provide written consent for the to be a civil liberties absolutist, however, to be “uninstall,” alleviating some of the civil liberties uncomfortable with the idea of the government concerns that would ordinarily surround a gov- issuing commands to a citizen’s computer and ernment agency monkeying with thousands and changing the applications inside. Law enforce- thousands of citizens’ computers. Privacy rights ment absolutely needs innovative tactics to go af- groups and security researchers are still worried ter an innovative underground, but it also needs that the untested commands could have unex- to avoid the temptation to go after crooks by set- pected consequences and “blow up” someone’s ting up shop inside the rest of our machines. computer.107 As one security specialist noted, malware can be engineered to erase a machine’s hard drive as soon as it is given a “stop” or “unin- stall” command.108
106 Kim Zetter, “FBI vs. Coreflood Botnet: Round 1 Goes to the Feds,” Threat Level, 4/26/2011,
21 st C e n t u ry D e f e n s e I n i t i at i v e • J o h n L. T h o r n to n C h i n a C e n t e r at Brookings Pirates of the ISP s: T ac t ic s fo r T u r n i n g O n li n e C ro o ks i n to I n t e r n at i o n a l P a r i a h s 38 Domain Demands
he Internet is designed for anonymous and in their malicious code a series of 25 seemingly- Teasy speech. You do not have to give your real benign domain names—vaccina.medinnovation. name or your address or a social security number org and flu.medicalcarenews.org, and the like. to register a domain name for your website. In All the domains were registered with reputable some cases, you do not even need to pay. Get- firms, under what are believed to be pseudonon- ting a company to host your website on one of its ymous e-mail addresses. Once the Coreflooders machines might be slightly more expensive, but it hijacked a computer, their newly-embedded mal- requires no additional disclosure. ware ordered that machine to make contact with one of the domains and receive orders. These That is a very good thing for democracy advo- domains would, in turn, point back to one of two cates in the Middle East, dissidents in China and Internet Protocol addresses—servers belonging whistleblowers here at home. It also makes on- to established Dallas-based hosting companies. line crime very, very easy—“the seed from which The whereabouts and the identities of the people all criminality grows,” in the words of one veteran behind the bot: unknown. law enforcement professional.109 Phishers, botnet herders and other crooks register all sorts of in- If anything, Coreflood used a relatively straightfor- nocuous-sounding domains as fronts for their fe- ward command-and-control system. It switched do- lonious activities. Then they fool otherwise-legit- mains only once a month, and those domains were imate hosting companies into giving them server embedded into the malware’s code. The so-called space for their bogus online banks and programs “Conficker C” malware generated 50,000 domains that give orders to botnet slaves. a day, seemingly at random.110 Coreflood’s domains only pointed to two IP addresses. Domains belong- Take Coreflood, the massive botnet taken down by ing to so-called “fast flux” botnets like Storm can the FBI in April. Coreflood’s kingpins embedded change IP addresses every few minutes.111
109 Private interview 4/19/11 110 Mark Bowden, “The Enemy Within,” The Atlantic, June, 2010,
21 st C e n t u ry D e f e n s e I n i t i at i v e • J o h n L. T h o r n to n C h i n a C e n t e r at Brookings Pirates of the ISP s: T ac t ic s fo r T u r n i n g O n li n e C ro o ks i n to I n t e r n at i o n a l P a r i a h s 39 Compounding the problem is that many of the supplying a name and address; why should a vir- registrars now give domains away—a lost leader, tual storefront be any different, especially if that to attract hosting business. Crooks then pay for storefront is a criminal enterprise? the server space with a stolen credit card. By the time the hosting company realizes the card is RECOMMENDATION 13: AVOID SCHEMES stolen—usually, it takes 30 days for payments to TO STRIP AWAY INTERNET ANONYMITY; process—the crook is gone. CONTINUE TO PROMOTE FREEDOM OF ONLINE EXPRESSION. The FBI and other law enforcement agencies out- Corralling cybercrime does not mean curbing lined their solution to many of these issues in a our ideals. proposal to the Internet Corporation for Assigned Names and Numbers, the nonprofit company The problem is that the FBI’s proposal may have which oversees registrars and manages IP ad- serious Constitutional issues. The 1st Amend- dresses. The Bureau’s proposal asks, in essence, ment guarantees the right to free speech—and for the layer of anonymity to be stripped away court after court has concluded that this includes from the registration and hosting industries. a right to speak anonymously.113 (After all, some of the Founding Fathers used pseudonyms when The FBI plan calls for registration companies to they wrote the Federalist Papers.) provide authentic contact information. The reg- istrars, in turn, should be obliged to collect—and That right cannot be used as a cover to com- validate—their customers’ real names, e-mail mit crimes.114 Under the FBI’s plan, however, an addresses and credit card numbers. The custom- online publisher could be unmasked with a war- ers can use proxy services to mask their identi- rant. That warrant can be obtained with merely ties, but the proxies would be required to collect a reasonable suspicion of criminal activity. The that information as well. The proxies would then anonymity could even be stripped by a simple ac- have to publish the information, if the customer cusation that he did not comply with a registrar’s is found to be violating the registrar’s “terms of terms of service. It is hard to see how a proposal service, including but not limited to false data, to make anonymity that fragile squares with a fraudulent use, spamming and/or criminal activ- right to speak without revealing your name. ity.” 112 Additionally, if law enforcement agencies suspect that the domain may be used for illicit It is also hard to see how the FBI proposal squares activity, the authorities can use a search warrant with American foreign policy. Access to the Inter- to compel the proxies to hand over their custom- net—and to tools that allow anonymous speech on er information. the Internet—have become a central pillar in the U.S. agenda. Secretary of State Clinton has called In some ways, it is an attractive proposition. for “a global commitment to Internet freedom, to You cannot open a physical storefront without protect human rights online as we do offline.”115
112 ICANN Board, GAC Consultation: Law Enforcement Due Dilligence Recommendation – Due Dilligence and Registrar Accreditation Agreement (Draft), 2/21/2011,
21 st C e n t u ry D e f e n s e I n i t i at i v e • J o h n L. T h o r n to n C h i n a C e n t e r at Brookings Pirates of the ISP s: T ac t ic s fo r T u r n i n g O n li n e C ro o ks i n to I n t e r n at i o n a l P a r i a h s 40 President Obama echoed that sentiment, saying, Friedman’s concept requires customers to pay a “There are certain core values that … we believe bond, or temporary deposit, on top of any fees. are universal: freedom of speech, freedom of ex- “This would raise the cost of registering many pression, people being able to use social network- domains, but impose little long run cost on a ing.”116 Long before Obama took office, America legitimate user. Bad actors could still acquire had already spent tens of millions of dollars build- domains and hold them long enough for the re- ing and distributing tools for anonymous online funded bond, but it would still impose a larger up speech. Tor, the software developed by the U.S. front investment cost,” he writes. “It would also Navy to route Internet traffic through a series of expose the malicious actor to the risk of forfei- encrypted nodes, is one example of many.117 ture, should the domains be recognized as poten- tially malicious during the bond period.”118 Yet the ongoing abuse of the registration and hosting systems could well undermine all other In other words, the Conficker tactic of register- efforts to fight cybercrime. This demands some ing tens of thousands of domains would suddenly sort of change to prevent that abuse. If crooks get much, much more expensive, while legitimate are using stolen credit cards to buy up domains users would get their deposit back after some pe- and server space, perhaps customers paying with riod of time—say six months or a year. credit cards should be forced to wait 30 days until the transactions have been processed. (Domains Would this slow down the most serious criminal could still be reserved instantly, and cash-equiva- enterprises? Not a chance; they already spend lent payments would allow the consumer to start the money to set up their own registration firms. using the services right away.) A few extra dollars per domain is just a rounding error, but even if it simply imposes a small tax Brookings Fellow Allan Friedman suggests that, on online crooks, the proposal has merit—as one at the very least, the costs of abusing the reg- piece in a larger effort designed to push cyber- istration and hosting systems should be raised. criminals to the margins.
116 Spencer Ackerman, “Egypt’s Internet Shutdown Can’t Stop Mass Protests,” Danger Room, 1/28/2011,
21 st C e n t u ry D e f e n s e I n i t i at i v e • J o h n L. T h o r n to n C h i n a C e n t e r at Brookings Pirates of the ISP s: T ac t ic s fo r T u r n i n g O n li n e C ro o ks i n to I n t e r n at i o n a l P a r i a h s 41 Thirteen Steps
nline crime may seem to be an unsolvable the companies that support them—it will be an Oproblem—the consequence of an Internet in enormous step towards turning these crooks into which anonymity is hardwired and jurisdictions global pariahs. are meaningless—but there are steps that can be taken to curb the growth of cybercrime and One method is to hold the most criminally-con- marginalize the people who practice it. nected hosting companies liable for any harm that may arise from activities on its servers, and Furthermore, more, there is a growing sense hold ISPs liable if they continue to do business among the world’s leading countries that the with that hosting firm. rampant spread of online crime has to be met head on. The countries accused of being the big- This would be part of a broader push to elbow out gest homes to cybercriminals—notably the Unit- cybercriminals, while preserving the Internet’s ed States and China—are the ones who feel most essential, freewheeling nature—and maintaining victimized. There is an opportunity for dialogue the American ideals of free speech. Our recom- and cooperation on cybercrime—dialogue and mendations are: cooperation that could build understanding on strategic issues as well. 1. Begin U.S.-China talks focused on cyber- crime. In the end, however, it is companies, not govern- 2. Draw China into the larger community of ments, that will have to play the central role in ISPs and network carriers. the fight against cybercrime. Internet Service 3. Avoid national retaliation as a cyber- Providers, which control access to the broader of crime solution. network of networks, will be particularly essential. 4. Lean on the criminal support networks. It is no secret which companies most consistently 5. Motivate ISPs to pressure the criminal provide server space and other support services ecosystem. to online criminals. The trick is persuading ISPs 6. Hold the worst hosting companies liable to throttle or block that criminal-friendly traffic. for their criminal clients and the worst If this relatively small group of ISPs can be per- ISPs liable for their criminal hosts. suaded to move against online criminals—and
21 st C e n t u ry D e f e n s e I n i t i at i v e • J o h n L. T h o r n to n C h i n a C e n t e r at Brookings Pirates of the ISP s: T ac t ic s fo r T u r n i n g O n li n e C ro o ks i n to I n t e r n at i o n a l P a r i a h s 42 7. Encourage ISPs to notify customers of These steps will not eliminate cybercrime any infections. more than the early moves to shut down the pi- 8. Amend the laws to allow ISPs to share at- rate support networks brought an end to the hi- tack data. jacking. They do not have to. The Internet com- munity has shown a remarkable ability to contin- 9. Push companies to expand reporting of ue expanding, year after year, despite seemingly network breaches. gargantuan obstacles at every turn. Spam was 10. Require government contractors to have supposed to wipe out email; lack of bandwidth cybersecurity insurance. was supposed to slow web sites to a crawl; the 11. Expand and improve training for cyber- dot-com crash was supposed to wipe out the In- crime specialists in law enforcement. ternet’s innovative spirit; flaws in the DNS system were supposed to result in a doomsday attack. At 12. Pursue civil strategies to disrupt criminal every turn, those challenges were eventually met networks. and surpassed. The same could very well be true 13. Avoid schemes to strip away Internet an- of online crime. If the the rise of these criminal onymity; continue to promote freedom enterprises can merely be slowed down, the Inter- of online expression. net, in all its resilience, may take care of the rest.
21 st C e n t u ry D e f e n s e I n i t i at i v e • J o h n L. T h o r n to n C h i n a C e n t e r at Brookings Pirates of the ISP s: T ac t ic s fo r T u r n i n g O n li n e C ro o ks i n to I n t e r n at i o n a l P a r i a h s 43 About the Author
Noah Shachtman is a nonresident fellow inthe of the Atomic Scientists, among others. The Of- Brookings Institution’s 21st Century Defense Ini- fices of the Undersecretary of Defense for Intel- tiative. He is also a contributing editor at Wired ligence, the Undersecretary of Defense for Policy, magazine and editor of the national security blog and the Director of National Intelligence have all Danger Room. Shachtman has reported from Af- asked him to contribute to discussions on cyber- ghanistan, Israel, Iraq, the Pentagon and Los Ala- security, information operations and emerging mos, writing about technology and national se- threats. Shachtman lives in Brooklyn, New York curity for The Wall Street Journal, The New York with his wife, Elizabeth, and their son, Leo. Times Magazine, Foreign Policy, and The Bulletin
21 st C e n t u ry D e f e n s e I n i t i at i v e • J o h n L. T h o r n to n C h i n a C e n t e r at Brookings Pirates of the ISP s: T ac t ic s fo r T u r n i n g O n li n e C ro o ks i n to I n t e r n at i o n a l P a r i a h s 44 21st CENTURY DEFENSE INITIATIVE
CYBER SECURITY #1 July 2011
Pirates of the ISPs: Tactics for Turning Online Crooks Into International Pariahs
Noah Shachtman 1775 Massachusetts Ave., NW Washington, D.C. 20036 brookings.edu