Spam is silenced, but where are the feds?

25.11.2008

The DOJ and the FBI declined to comment on McColo.

Another problem: The criminals associated with McColo are thought to live in Russia and eastern Europe, where computer crimes are rarely prosecuted. So a successful prosecution would require extradition and that could be very hard to pull off, observers say. "You take down McColo and what you've actually got is one hell of a load for the lawyers at the Department of Justice and very little return, because you've actually got to go outside of the U.S. to pick up the actual culprits," Cox said.

While there's no doubt that the activities associated with McColo are illegal under U.S. law, the idea that you could prosecute an ISP for abetting illegal activity is largely unproven, so any prosecutor that took on this case would be taking a big risk that the case would be tossed out of court.

There is at least one precedent however. On Feb. 14, 2004, the FBI operations at a small Ohio ISP called Creative Internet Techniques in an event the FBI dubbed the Cyber Saint Valentine's Day Massacre. At the time, it was the largest FBI takedown in the organization's history. Nearly 300 servers were seized after Creative Internet, also known as FooNet, was linked to distributed denial of service attacks.

The reason why some security experts have called for a similar takedown at McColo has, in part, to do with the sneaky way that McColo's customers were disrupted. Researchers say that McColo computers weren't actually sending out spam, just running the command and control servers that marshalled an estimated half-million infected botnet computers. These infected machines would take their instructions from servers on McColo's network, but should those computers ever be knocked offline, they were given several other backup Internet domains to check for commands.