Hacker News Reader

Comment by stcredzero | Hacker News Reader

We've been dealing with DDOS attacks affecting mainstream citizens and businesses of 1st world countries for about a decade now. Why isn't there law enforcement dedicated to catching people who do this? We're at a point where CEOs of companies can engage in such behavior and the companies can stay in business.

If there is someone reading this who works with a US congressman or senator, this may be a chance to introduce legislation that can make a positive impact, make it easier to establish Internet-facing companies, and instead of eliciting dismay from the community of technical people, gain their gratitude instead.

View on HN

It's already illegal -- what law would you have them pass? Also, my assumption is that most DDoS ransom demands are coming from overseas.

Making it a civil infraction to be running a computer used in such a thing might help.

The idea being you would sue individual owners of botnet-infected computers? Not so sure about that.

The idea being they could be ticketed for using their hardware unsafely on public infrastructure, much like a speeding ticket - but I'd suggest lower amounts corresponding to the lower risk to lives.

Unlike speeders, I assume they are mostly unwitting and unwilling participants in the attack. Seems a bit unfair. Why not also sue Adobe for allowing the zero-day that led to the PC getting infected and added to a botnet?

"Unlike speeders, I assume they are mostly unwitting and unwilling participants in the attack."

If you don't check your vehicle and something falls off of it, you're responsible. For that matter, if you do check your vehicle and something falls off of it, you're responsible. You don't have to have "wittingly" or "willingly" done something for a ticket - negligence (even minor) is plenty. You're responsible for hardware you deploy.

Edited to add: Also, plenty of speeding tickets are given to people who never said to themselves "I'm going to speed," but simply neglected to pay enough attention to either posted limits or their speedometer. I know that's been the case with the couple of speeding tickets I've received. So I'm not really sure it's "unlike speeders" at all.

"Why not also sue Adobe for allowing the zero-day that led to the PC getting infected and added to a botnet?"

In general, I don't think it makes sense for liability to start with the vendors because the risks and downside is determined primarily by the particular deployment. I've no problem with allowing the companies to offer indemnification for tickets caused by their failures, and if we went that route that's something users should demand (... while still allowing people to publish GPL software for those willing to accept the responsibility, without taking a huge financial risk).

I get what you're saying, I just don't really think it's a good idea and I definitely don't think it will work. You would need a massive number of people to suddenly start caring about network/PC security AND you would need them to have the ability to actually do something about it AND it does nothing for anyone not under US law.

"You would need a massive number of people to suddenly start caring about network/PC security"

"You can get a ticket" seems to get people to care, up to a point.

"you would need them to have the ability to actually do something about it"

Certainly the case. I lean toward "change the incentives and the market will provide", but this could be better fleshed out.

"it does nothing for anyone not under US law."

It does plenty for people not under US law - they won't be DDoSed from as many bots in the US.

It doesn't do as much about people under jurisdictions not covered, but:

1) A lot of the software that is developed is developed with the US in mind as a market, especially those things that are sufficiently common to really let malware spread by targeting a couple exploits. Making that software more secure might decrease the rate of infections abroad.

2) Other jurisdictions might very well follow suit - particularly with international pressure.

It's already illegal -- what law would you have them pass?

Laws enacting agencies' active enforcement of those laws.

Setting law enforcement priorities is typically an Executive Branch function, no? I guess Congress could earmark money specifically to fighting DDoS-based crime.

Congress could earmark money specifically to fighting DDoS-based crime.

This. It would need the resources of a small agency all by itself.

Turn the appeal to fear that causes extortion to work back on itself: Make paying extortionists cause the payer to be an accessory. Allow future victims of the same extortionist to collect joint-and-several civil damages from the collaborator.

Yes, and then NSA will say "Sure, we'll protect you. You just have to give us access and control to your whole network and servers, because that's the only way to 'properly protect you'. Deal?"

This is exactly what these agencies want. To give up on your responsibility for the security of your users, so they can take over. If your company does that, please tell me now so I know to avoid it forever.

The solution is to better design anti-DDoS systems, not to let the government "handle it".

The NSA has nothing to do with the parent's proposal. Your entire reply is a non-sequitur.

Actualy, the NSA - just like the CIA, is known to carry out false flag acttacks to achieve a certain outcome. This point should not be overlooked.

In this case Meetup is a perfect NSA 'false-flag' target because it's not a financial institution (NSA ally), and yet is used by millions of people. Thus millions of people starting to ask if GCHQ/NSA will keep them 'safe' online.

username oddly relevant

The FBI is responsible for "cyber" crimes.

http://en.wikipedia.org/wiki/Einstein_(US-CERT_program)#Eins...

Reply on news.ycombinator.com