Is catch-and-release of botnets ethical?
In very interested in the debate over demarcation point between response activities of network security operations (a world I know very well), law enforcement/cybercrime investigation/prevention/prosecution (a world I know well enough from a network operation perspective), and military action to protect national security or critical infrastructure.
Many of the botnets in play today have national security implications, and certainly have direct law enforcement and network security impact. At what point does the line get crossed?
Recent news on the hijack, study, and ultimate "release" of Mebroot by University of California at Santa Barbara researchers raises this debate yet again. It is clear that there are ethical concerns with taking any form of action to shut down a botnet after infiltrating it. That would often require criminal behaviour, and hence not really fitting for the "good guys". However, I can't really consider the release of a botnet like Mebroot without some sort of action directly leading to its dismantlement to be ethical either.
Researchers Hijack Mebroot Botnet, Study Drive-By Downloads - "TechReviewAl writes"Researchers at the University of California at Santa Barbara hijacked the Mebroot botnet for about a month and used it to study drive-by downloading. The researchers managed to intercept Mebroot communications by reverse-engineering the algorithm used to select domains to connect to. Mebroot infects legitimate websites and uses them to redirect users to malicious sites that attempt to install malware on a victim's machine...." [Team Cymru Internet Security News]
Researchers or network security ops people taking down a botnet after infiltrating it is legally risky at best. Law enforcement, on the other hand, could and SHOULD be able to do something. If it isn't possible to prosecute those behind a botnet like Mebroot, surely mandates to protect against and prevent crime should come into effect. And if not law enforcement, what about a cybersecurity wing of armed forces?
I've yet to see a satisfactory analysis of this question, in any jurisdiction.
- Chris's blog
- Login or register to post comments

