Pointer, Public Policy issue - from Bill Stearns

Too good to miss...

If you're not reading http://isc.sans.org/diary.html , you should be every
day. It is posted blog style and archived, so the page I see now may be
different when you view it later. The linked pdf has the message. Here
is Bill's posting from the sans site:

Office of Cyber Public Health?
Published: 2007-06-14,
Last Updated: 2007-06-14 05:02:03 UTC
by William Stearns (Version: 1)

Joe St. Sauver, security and spam researcher at the University of
Oregon, points out that botnets are a symptom; the cause is infected
systems. We can't clean up the bots without cleaning up the infected
systems first.

His paper for the Anti-Phishing Working Group is here
http://www.uoregon.edu/~joe/ecrime-summit/ecrime-summit.pdf

As you read it, ask yourself these questions. If you think his proposal
wouldn't work, what would you recommend instead? Would your proposal be
more likely to succeed? Why?

-- Bill

jayjwa wrote:

[...]

> The hardest part of a solution like this would likely be attaching a cost
> to the abuse. Maybe it needs to a sue-able offense? Maybe there needs to
> be a few basic laws created, or old ones updated for the Internet of
> today? I'm not sure; but I garantee that it's better and less restrictive
> than turning the whole thing over to the government.

The bulk of what I trimmed is a good and intelligent suggestion. The
problem is that there is no tasked group to pursue and implement punitive
sanctions against abusers, just as there is apparently no organized
consensus of the need to do so.

While we lived long before without internet, it has quickly become an
indispensable part of essential infrastructure. I do share your aversion
to total government control. Development of consensus alternatives needs
community discussion and involvement.

Those who think this need not be a personal concern to them are in denial.
Thanks for your intelligent consideration and thanks for writing. I will
continue to try to read and answer as I am able, should you or others
continue the discussion.

To those whose own news servers do not carry the original messages in this
thread, I would suggest google groups (groups.google.com).