Slashdot Mirror
Aussie Gov't Decides ISPs Aren't Responsible For Infected Computers
c0lo writes "In a sudden outburst of common sense, the Australian senate decided that it is not the government's responsibility to force ISPs to disconnect infected computers from the Internet. Peter Coroneos, chief of the Internet Industry Association, used a car analogy that actually makes sense: 'It would be like forcing car manufacturers to take responsibility for bad drivers.'"
It would be more like the government requiring car manufacturers to do something about car theft, since an 'infected computer' is essentially out of the user's control. And yes, the Australian government DOES require all cars to have an immobiliser.
There are 10 kinds of people in this world: those who understand binary, and nine other kinds of people.
'It would be like forcing car manufacturers to take responsibility for bad drivers.'"
No. it would be like making the DMV take responsibility for bad drivers on the highway, because the DMV issues the papers required for drivers to use the road.
The thing comparable "forcing car manufacturers to take responsibility", would be trying to force Dell, HP to take responsibility.
It should probably be noted that car manufacturers can be responsible for drivers going around in defective cars that have a high tendency to malfunction causing an accident unless the driver is an expert professional driver.
So it could make sense to hold Microsoft responsible for an OS with a horrible security record
No. It would be like forcing toll road operators to refuse access to cars that are actively spraying oil all over the road surface that have been causing accidents.
Democracy is a sheep and two wolves deciding what to have for lunch. Freedom is a well armed sheep contesting the issue
The response from the general Australian public: "who are you, and what have you done with our politicians?"
It would be like forcing an ISP to take responsibility for a copyright infringer.
The government shouldn't be requiring ISPs to disconnect infected computers, no. But ISPs still should be disconnecting infected computers. Not computers that don't run the ISP's anti-virus package, not computers that aren't up-to-date on Windows, but computers that're actively showing the tell-tale signatures of known infections (including spewing spam e-mail). If a computer shows up infected, the user should be warned. If the infection isn't removed fairly soon after, the computer should be disconnected until the user contacts the ISP about solutions.
Think of it like a medical quarantine. We don't quarantine you just because you haven't had your shots. But once you're diagnosed with the actual infectious diseases, you're quarantined until either you get medical treatment and are cured, you get over the infectious stage on your own or you die.
Is a telephone provider responsible for drug dealers, pimps and other assorted crooks, who run their business over the providers' telephone lines?
The telephone provider runs a line to your house. What takes place on the other side of the line, inside your house, they have no control over. The same is true for an ISP. They provide an Internet connection to your home. What you hook up to it, is your responsibility . . . and liability.
Schroedinger's Brexit: The UK is both in and out of the EU at the same time!
...ISPs being required to disconnnect infected computers.
The analogies are pointless. It comes down to factors such as feasability, harm done, harm prevented and responsibility. An ISP is capable of disconnecting the computers from the internet. Forcing them to do so would prevent harm. So it comes to whether the cure is worse than the disease.
The ISPs make the perfectly reasonable point that the goals can be achieved by self regulation, and this will be much more flexible. On the whole the ISPs are should be in favour of removing infected computers. They're an expensive annoyance.
That is what you get these days with the balance of power being held by the Greens and independents. It used to be that the independents and small parties would come up with the looney ideas, but more and more we are seeing the big parties filling that role. EG. The Internet Filter aka The Great Firewall of Australia.
It would be more like a robot enter your vehicle through its wide-open windows, jacking into the electric system, manufacturing more robots out of the car material, then sending more robots out to enter other cars with open windows.
Any responsible ISP should be doing this voluntarily anyway. My ISP (Exetel) redirects you to a page telling you that you are infected and telling you how to fix it (and giving links to AV software hosted on their servers). Cars have mandatory yearly inspections or they aren't allowed on the road so Peter Coroneos was just trying to dodge legal liability not talking any kind of sense.
Botnets are a huge organised crime business and any ISP that isn't fighting them is either incompetent or is profiting from botnets (either being paid by the mob or making money selling DDOS protection and the like).
========
CINC, 4th Penguin Legion
Actually, if you're going to stick with cars, it's like a safety and emissions check in realtime. If your car is spewing excessive pollution or presents a hazard to other drivers (critical safety features like turn signals, head lights, tire treads, etc., missing or malfunctioning) they don't let you go around being a hazard on public roads. It makes sense for ISPs, in a uniquely capable position to detect it, to disconnect systems that are spewing malware and presenting a hazard to other computers on the network.
> but once they know about it they have multiple ways of fixing the situation and then they are indeed fully in control.
Unfortunately, the fact is that as time goes on, there are more and more components in computers which themselves are programmable (with microcode, for example) yet not easily "format-able" like the magnetic media of a hard disk. Hiding malware in these devices is a hot topic of current research (BIOS-level rootkits, WiFi adapters hosting malware), and could easily become reality for a capable, targeted attack (look at Stuxnet, for example, but imagine what might have been if the industrial controller had been sophisticated enough to have hosted a multihost malware which could spread itself back to "cleaned-up" computers).
I have the feeling that there will be a large gap (because of fear of loss of IP or control, or DMCA-like laws trying to protect copyright) in the tools hardware manufacturers give consumers to "sanitize" possibly infected hardware, and the ability of black hats to use infected hardware to gain more permanent control over infected computers.
This ruling basically says that tollbooth attendants are not required to stop drunk drivers from driving drunk.
While I would say that this is true, barring any specific law, I also see that such a law would be a good idea. Governments could easily pass a law that required tollbooth operators to refuse to let drunk drivers get on their highway. Such a law would not be a bad law. I see few reasonable objections to it.
As such, I would state that while without a law, ISP's should not be legally required to stop infected computers from using them, it should be quite easy for a government to pass such a law, and that law would be:
a. Reasonable and proper
b. A good idea
excitingthingstodo.blogspot.com