Bot Leg project NWO grant number 628 001

Bot. Leg project, NWO grant number 628. 001. 015 Fighting botnets: lessons from the field of public health, sanitation and epidemiology Dr. Bart van der Sloot B. vdr. Sloot@uvt. nl TILT Tilburg Institute for Law, Technology, and Society

Outline • Metaphor • Prevention strategies • Containment strategies • Lessons TILT Tilburg Institute for Law, Technology, and Society

Metaphor • Because botnets are a relatively new phenomenon, it is not surprising that when describing and interpreting their meaning, many have borrowed terms from other fields. A potent metaphor is that of transmissive and infectious diseases, viruses and contagious outbreaks. Like other malware, botnets have been described as a ‘virus’, and counter-measures involve quarantining a virus. The virus can ‘infect’ a computer and consequently corrupt a computer’s ‘immune system’. That is why authors have called for more ‘cyber hygiene’, disinfection measures, cyber sanitation and the generation of ‘vaccines for malware immunization’. • E. g. J. Wolff, ‘Cybersecurity as Metaphor: Policy and Defense Implications of Computer Security Metaphor’, TPRC Conference Paper, 2014, p. 6. R. Vogt, J. Aycock & M. J. Jacobson, ‘Army of Botnets’, <www. cpsc. ucalgary. ca/~aycock/papers/ndss 07. pdf>. C. Wilson, ‘Botnets, Cybercrime, and Cyberterrorism’, CRS Report for Congres, 2008. • E. g. , Council of Europe, Recommendation R(89) 9 on computer-related crime (Strasbourg 1990), p. 43. <https: //answers. microsoft. com/en-us/protect/forum/mse-protect_scanning/how-to-remove-quarantined-malware-viruses/c 022 fcce-5 f 6 ee 011 -8 dfc-68 b 599 b 31 bf 5>. Y. Carlinet et al. , ‘Analysis of computer infection risk factors based on customer network usage’, <https: //www. researchgate. net/profile/Herve_Debar/publication/4373164_Analysis_of_Computer_Infection_Risk_Factors_Based_on_Cust omer_Network_Usage/links/0 fcfd 5087 b 159210 fe 000000. pdf>. A. Somayaji, S. Hofmeyer & S. Forrest, ‘Principles of a Computer Immune System’, NSPW '97 Proceedings of the 1997 workshop on New security paradigms, 1997. • V. G. Cerf, ‘First, Do No Harm’, Philosophy & Technology, 24, 2011. M. E. O’Connell, ‘Cyber Security without Cyber War’, Journal of Conflict Security Law 17, 2, 2012. D. Dasgupta & M. Rahman, ‘A Framework for Estimating Security Coverage for Cloud Service Insurance’, <https: //pdfs. semanticscholar. org/d 66 d/625085 e 6 e 6 a 4700 c 89135067 b 93274 d 6 f 617. pdf>. • H. Asghari, M. Ciere & M. J. G. van Eeten, ‘Post-Mortem of a Zombie: Conficker Cleanup After Six Years’, <https: //www. usenix. org/conference/usenixsecurity 15/technical-sessions/presentation/asghari>. • M. Jacobson , ‘Vulnerable Progress: The Internet of Things, the Department of Defense and the Dangers of Networked Warfare’, COMP 116: Computer Systems Security, <http: //www. cs. tufts. edu/comp/116/archive/fall 2015/mjacobson. pdf>. • Z. Xu et al. , ‘AUTOVAC: Towards Automatically Extracting System Resource Constraints and Generating Vaccines for Malware Immunization’, <http: //students. cse. tamu. edu/jialong/paper/Autovac_ICDCS 13. pdf>.

Prevention: precautionary measures • Health and safety rules for restaurants, setting rules on food storage and preparation, medical facilities, requiring medical personnel to wear protective clothing and setting clear rules on hygiene, and the sex-industry, for example obliging the use of a condom. • People known to carry certain infectious diseases can be obliged to take additional precautionary measures to avoid contamination. For example, a physician with AIDS may be required not perform certain invasive procedures or to double-glove as extra means of protection. Benefits: Downsides: Effecitive Black market General awareness Market inequality Weaker groups protected Individual freedom is restricted

Prevention: mandatory testing • A second strategy is mandatory testing. Such testing programs may be applied to specific individuals, to risk-groups or to the population at large. Benefits: Downsides: More public awareness Effectiveness questioned: primarily installed to reassure the public. Early intervention Proportionality and subsidiarity questioned, especially general screening programs. Few opposition, except where groupbased screening leads to stigmatization. People tested may be anxious for no reason, and false positives may be the result of overly broad testing.

Prevention: mandatory vaccination • Besides vaccination programs for children, emergency vaccination and mandatory vaccination for risk-categories exists. Benefits: Downsides: Protecting children Bodily integrity Herd immunity Religious believes Eradicating diseases Opponents of mandatory vaccination of high school girls for the Human Papillomavirus, responsible for cervical cancer, believe it gives children a ‘license’ for sex and that girls are exclusively made responsible for the negative effects of sex.

Prevention: interfere at a pre-birth or DNA level • Specimens may be selected for breeding, choosing those that are more resilient against viruses and other diseases. Common with cattle and plants, but very few mandatory programs exist for humans, although there are countries with mandatory sterilization programs for mentally disabled. • Alternatively, embryo-selection can be used to terminate specimens with certain diseases or defects at an early stage, or the DNA and genetic make-up can be modified and improved of persons, either before or after birth, to cure or prevent diseases. No mandatory regimes exist, although many fear that in time they will. Benefits: Downsides: Eradicating diseases and viruses Individual autonomy and human dignity Precludes human suffering Species becomes more homogeneous, and therewith more vulnerable Consequences of modification cannot be overseen

Containment: mandatory reporting • Informing the state authorities of disease outbreaks is mandatory, inter alia, with respect to virus outbreaks at farms. For humans, mandatory reporting of an HIV infection can be required of those with whom the infected person has had sex or shared a needle. • Medical personnel that is aware of the risk of an outbreak, through the treatment of patients, are placed under a special obligation to break the doctor-patient confidentiality and inform the group at risk or the community at large. Benefits: Downsides: Protection of the interests of third parties Shame and distress for the patient Early treatment Breach of confidence for medical institutions when they report Reduce the risk of further contamination

Containment: mandatory treatment • Besides risk-based, there is information- or intelligence-based testing and treatment, which may be made mandatory when patients resist treatment. Regimes for mandatory treatment have also been proposed with respect to drug-using homeless people, for example making treatment a prerequisite for social welfare. Mandatory treatment is mostly unnecessary as patients want to be treated. Downsides: • Benefits: F. J. Frese, ‘The mental health service consumer's perspective on mandatory treatment’, New Directions for Mental Health Services, 1997. Positive effect on the patient’s quality Effectiveness varies • of life M. Abbott, ‘Homelessness and Substance Abuse: Is Mandatory Treatment the Solution’, Fordham Urban Law Journal 22(1), 1994. S. Patients are no longer a source of Paternalism Macdonald et al. , ‘Drug testing and mandatory treatment for welfare infection recipients’, International Journal of Drug Policy, 12, 3, 2001. U. S. Supreme Court Addington v. Texas, 441 U. S. 418 (1979).

Containment: quarantine • People entering a country can be quarantined • In the combat of Ebola, isolation centers were built in Africa, for example in Sierra Leone and Liberia Benefits: Downsides: Stops the spread of diseases Effectiveness questioned Critiqued not only for being overinclusive, but also for being underinclusive People quarantined not seldom die

Containment: culling • Used with plants and animals, but not with respect to humans Benefits: Downsides: Stops the spread of diseases Specimens die Cost-benefit Subsidiarity

Lessons: differences • By injecting a small fraction of a virus into a human body, its natural defense system can from then onwards detect the virus, make anti-bodies and remove it from the body, while anti-virus software is updated to recognize new malware. • Biological viruses mutate but are mostly relatively stable compared to computer viruses, which can be programmed to mutate in short cycles, or new malware, with new code can relatively easily be created. • Computer viruses serve a human purpose, biological do viruses not. Viruses in the physical realm usually act in a decentralized way – they are not controlled by a herder – while this traditionally has been the case with botnets. • Human hosts will usually show signs of illness in the offline world, while this is not necessarily the case with an infected computer. • In the offline world, the government traditionally takes the lead in public health, while in the digital world, such tools are mostly in the hands of private originations. • In the online world, either a botnet virus or a law enforcement agency can hack a computer and take control over the device, while such is impossible in the offline world. • Although direct or indirect contact is necessary to spread the virus in both the offline and the online world, in the digital realm, physical vicinity is not a prerequisite. • Computers do not bear offspring. • Computers have no emotions (right? ), although they store content with emotional value for humans

Lessons? Prevention Containment Precautionary measures Mandatory testing Preventive measures Mandatory treatment Mandatory vaccination Quarantine Pre-birth intervention Culling