ISPs respond to growing pressure

In early September, a federal jury in California levied a total of $32 million in damages from two Internet service providers that knowingly supported websites that were running illegal operations. The jury ruled that two ISPs knew about counterfeit Louis Vuitton goods that were being sold on their customers' sites, but didn't act quickly to deactivate those sites. Legal experts say the case could set an important precedent if companies can prove that an ISP knowingly supports criminal websites -- such as those used to commit fraud or copyright infringement -- but does not take them offline.

And later in September, Eric Davis, the head of Google's Anti-Malvertising team, urged ISPs to look beyond profits and take a more proactive approach to dealing with malware-infested computers on their networks. "The ISPs are in the best position to detected infected machines. They're in the best place to do something about malware.  They already have monitoring systems that could be used to identify signs of malware and botnet activity.   If they see abnormally high e-mail activity, that's most likely spam from a botnet," Davis said.

The ISP industry appears to be responding to the pressure.

In September, the Internet Industry Association of Australia drafted a new code of conduct that suggested ISPs contact, and in some cases disconnect, customers that have malware-infected computers.  The drafted code, which will not be mandatory, suggested ISPs take a four-step approach to protecting customers.

  • Identification of compromised computers
  • Contact affected customer
  • Provision of information and advice to fix the compromised system; and
  • A reporting function for alerting about serious scale threats, such as those, that may threaten national security.
 
In October in the Netherlands, 14 ISPs that comprise 98 percent of the consumer market there launched a joint effort to fight malware-infected computers and botnets. The effort will include:

  • Exchange of relevant information among the cooperating ISPs
  • Quarantine of infected computers
  • Notification of end users by their ISPs

Also in October, Comcast, the largest residential ISP in the U.S., announce the launch of a trial implementation of its new Constant Guard program, which delivers an in-browser notification "Service Notice", that will alert customers whose computers appear to be infected with a bot (or virus) and request that they go to the Anti-Virus Center and follow a set of instructions to assist with removing the bot from their computer and thereby prevent it from spreading to other users.

According to Jerry Upton, executive director of the Messaging Anti-Abuse Working Group, "The new Comcast safeguards are in line with industry best practices to help ISPs assist customers whose machines have been infected with malware.  By deploying the technology to detect bots on their subscribers' computers, Comcast is providing a service to their customers and contributing to safer messaging."

References:

Jury Exacts $32M Penalty From ISPs For Supporting Criminal Websites

Google exec calls for ISPs to get tough on botnets

Dutch ISPs Sign Anti-Botnet Treaty  

ISPs asked to cut off malware-infected PCs  

Comcast Unveils Comprehensive “Constant Guard” Internet Security Program