21st CENTURY DEFENSE INITIATIVE CyBER SECuRITy #1 July 2011 Pirates of the ISPs: Tactics for Turning Online Crooks Into International Pariahs Noah Shachtman 1775 Massachusetts Ave., NW Washington, D.C. 20036 brookings.edu Pirates of the ISPs: Tactics for Turning Online Crooks Into International Pariahs Noah Shachtman CyberSeCurity #1 July 2011 21st CENTURY DEFENSE INITIATIVE Acknowledgements every research paper is a group effort, no mat- My Wired.com colleagues—ryan Singel, kevin ter what it says on the byline. this project relied Poulsen, kim Zetter and David kravets—cover more on outside assistance than most. brookings the cybersecurity beat better than anyone. this Senior fellows Peter Singer and ken lieberthal paper would have been impossible without them, were the ones who convinced me to explore the and without brian krebs, master investigator of broad topic of cybersecurity. the panel they as- the online underworld. sembled gave me new insight with every meeting; my colleague allan friedman was an especially bill Woodcock, rick Wesson, Jeff Cooper, tyler invaluable tutor and remarkably generous with Moore, audrey Plonk, Jim lewis, Dmitri alpero- his time. heather Messera and robert o’brien vitch, Paul Nicholas, Jessica herrera-flannigan, provided important research and logistical sup- Jart armin, richard bejtlich, Steve Schleien, Jona- port. My research assistant, adam rawnsley, was than Zittrain and many, many others steered me tireless in his exploration of the minutiae of ev- away from my worst ideas and towards those few erything from tort law to pirate havens. not-so-bad ones. for that, i am deeply in their debt. brookings recognizes that the value it provides to any supporter is in its absolute commitment to quality, independence and impact. activities supported by its donors reflect this commitment and the analysis and recommendations are not determined by any donation. 21 st C e n t u ry D e f e n s e I n I t I at I v e • J o h n L. t h o r n to n C h I n a C e n t e r at brookiNgS PirateS of the iSP S: t aC t ic s fo r t u r n I n g o n li n e C ro o ks I n to I n t e r n at I o n a L P a r I a h s ii Table of Contents acknowledgements . iii executive Summary . vii introduction . 1 What is Cybercrime? . .5 both Pirates and Privateers online . .7 “Cyberwar” vs. Cybercrime . 9 a Surprising Partner . 12 Cybercrime first; everything else May follow . 14 Who gets Squeezed? . 17 it is up to the iSPs . 20 a “grand bargain” for Security . 22 one Proposal for Pressuring the Criminal ecosystem . 24 Protecting the Victims . 28 Corporate responsibility . 31 Can insurance Curb Crime? . 35 Criminal enterprises, Civil Strategies . 36 Domain Demands . 39 thirteen Steps . 42 about the author . 44 21 st C e n t u ry D e f e n s e I n I t I at I v e • J o h n L. t h o r n to n C h I n a C e n t e r at brookiNgS PirateS of the iSP S: t aC t ic s fo r t u r n I n g o n li n e C ro o ks I n to I n t e r n at I o n a L P a r I a h s iii Executive Summary t the beginning of the 19th century, piracy as harvard’s tyler Moore and others have sug- Awas an ongoing threat and an accepted gested. after all, the internet is not a network of military tactic. by the end of the century, it was governments; it is mostly an amalgam of busi- taboo, occurring solely off the shores of failed nesses that rely almost exclusively on handshake states and minor powers. the practice of hijack- agreements to carry data from one side of the ing did not vanish entirely, of course; it is flourish- planet to another. the vast majority of the inter- ing now on the world’s computer networks, cost- net’s infrastructure is in the hands of these 5,000 ing companies and consumers countless billions or so internet Service Providers (iSPs) and car- of dollars. rier networks, as is the ability to keep crooks off that infrastructure. if this relatively small group Cybercrime today seems like a nearly insoluble can be persuaded to move against online crimi- problem, much like piracy was centuries ago. nals, it will represent an enormous step towards there are steps, however, that can be taken to turning these crooks into global pariahs. curb cybercrime’s growth—and perhaps begin to marginalize the people behind it. Some of the the most productive thing iSPs can do to curb methods used to sideline piracy provide a useful, crime is put pressure on the companies that sup- if incomplete, template for how to get it done. port and abet these underground enterprises. Shutting down the markets for stolen treasure Currently, registration companies sell criminals cut off the pirates’ financial lifeblood; similar their domain names, like “thief.com.” hosting pushes could be made against the companies firms provide the server space andi nternet Proto- that support online criminals. Piracy was eventu- col addresses needed to make malicious content ally brought to heel when nations took responsi- online accessible. but without iSPs, no business, bility for what went on within its borders. based straight or crooked, gets online. a simple statistic on this precedent, cybercrime will only begin to underscores the iSPs’ role as a critical intermedi- be curbed when greater authority—and account- ary: just 10 iSPs account for around 30 percent ability—is exercised over the networks that form of all the spam-spewing machines on the planet. the sea on which these modern pirates sail. iSPs are well aware of which hosting companies, in this new campaign, however, private companies, for example, are the most friendly to criminals; not governments, will have to play the central role, lists of these firms are published constantly. but, 21 st C e n t u ry D e f e n s e I n I t I at I v e • J o h n L. t h o r n to n C h I n a C e n t e r at brookiNgS PirateS of the iSP S: t aC t ic s fo r t u r n I n g o n li n e C ro o ks I n to I n t e r n at I o n a L P a r I a h s iv currently, iSPs have little motivation to cut these government can alter that equation by expand- criminal havens off from the rest of the internet. ing the requirements to report data breaches. it there is no penalty for allowing illicit traffic to could require its contractors to purchase network transit over their networks. if anything, there is a security insurance, forcing companies to take strong incentive for maintaining business-as-usu- these breaches more seriously. and it can pour al: the hosting company that caters to crooks also new resources into and craft new strategies for has legitimate customers, and both pay for inter- disrupting criminals’ support networks. net access. So iSPs often turn a blind eye, even though the worst criminal havens are well-known. these steps will serve as important signals that america will no longer tolerate thieves and con that is where government could help. it could artists operating on its networks. after all, 20 of introduce new mechanisms to hold hosting com- the 50 most crime-friendly hosts in the world are panies liable for the damage done by their crimi- american, according to the security researchers nal clientele. it could allow iSPs to be held liable at hostexploit. for their criminal hosts. it could encourage and as the united States gets serious in curbing these regulate iSPs to share more information on the criminals, it can ask more from—and work more threats they find. closely with—other countries. China, for instance, sees itself as the world’s biggest victim of cyber- government could also encourage more private crime, even as it remains a hotbed for illicit activ- businesses to come clean when they are victim- ity. Not coincidentally, China is also only partially ized. today, just three in ten organizations sur- connected to the global community of iSPs. Dia- veyed by the security firm Mcafee report all of logues to bring the Chinese closer into the fold their data breaches. that not only obscures the will not only make it easier to marginalize cyber- true scope of cybercrime; it prevents criminals criminals; it will build momentum for broader ne- and criminal trends from being caught earlier. gotiations on all sorts of internet security issues. 21 st C e n t u ry D e f e n s e I n I t I at I v e • J o h n L. t h o r n to n C h I n a C e n t e r at brookiNgS PirateS of the iSP S: t aC t ic s fo r t u r n I n g o n li n e C ro o ks I n to I n t e r n at I o n a L P a r I a h s v Introduction n May 22, 2009, nine pirates armed with rock- Convention on the law of the Sea, “every State” Oet-propelled grenades began to chase the is authorized to “seize a pirate ship… arrest the cargo ship Maersk Virginia as it steamed through persons and seize the property on board.”3 Pi- the gulf of aden.