EU proposal would task ISPs with blocking infected addresses

A paper will be published later this year with far-ranging recommendations for reducing cybercrime in Europe, including a statutory scale of damages against ISPs that do not respond promptly to requests to shut out compromised machines.

A subset of the paper, entitled "Security Economics and European Policy," was presented by one of its four authors, Tyler Moore, a researcher and Ph.D student at the University of Cambridge. Other authors included Ross Anderson and Richard Clayton, also of the University of Cambridge; and Rainer Bohme, TU Dresden.

The group offered a set of 15 recommendations, including a cybercrime equivalent to NATO, and improvements to security, as well as more publicity about security breaches.

The paper (PDF available here) is a follow-up to meetings in April and last fall by the Council of Europe, which called for ISPs to share information and respond to government data requests more quickly, and similar requests from the European Union.

"People who leave infected machines attached to the network, so that they can send spam, host phishing websites and distribute illegal content, are polluting the digital environment," the report's authors wrote, "and the options available are broadly similar to those with which governments fight environmental pollution (a tax on pollution, a cap-and-trade system, or private action). Rather than a heavyweight central scheme, we think that civil liability might be tried first."

EuroISPA, a pan-European association of nine European ISP associations that is composed of about 1,000 ISPs, is generally supportive of improving security but is unsure or even against some of the specific proposals made by the Council of Europe, as a recent review indicates (PDF available here). EuroISPA includes ISPs from Austria, Belgium, Czechoslovakia, Finland, France, Germany, Ireland, Italy, and the UK.

Many countries have agreed to support the Council of Europe's Conventions on Cybercrime, but a number of others -- including some thought to be harboring botnet herders and other criminals using technology for extortion and denial of service attacks --- have not yet agreed to it. These countries include Andorra, Azerbaijan, Georgia, Liechtenstein, Monaco, Russia, San Marino, and Turkey.

A number of European countries and organizations have faced cyberattacks in the past year or so, including Estonia, and gambling operations threatened with takedowns just before major sporting events.

The "Security Economics" paper as presented did not go into a great deal of detail about how the proposals would be implemented, such as how a machine would be blocked or what recourse an innocent person with a hijacked machine might have.