When your IP is found to have been part of a botnet, I think ISPs should just limit you to like 20Mbps for at least a year, so you think twice about buying that 10$ wifi baby monitor next time.
When you get caught speeding on the road or being a nuisance otherwise you can and will get punished by the courts, including temporary restrictions on your driver license. When you money mule for others, even if you don't know that you actually fell victim to a scam, you get punished as well. When you litter in Singapore, you can get ordered to work community service.
I see no issue in handing out similar punishments in the digital space. The Internet is a shared medium, everyone who connects to it has a responsibility to not be a nuisance to others.
On the road you could have killed someone. Your 20$ baby monitor bought from an authorized store you know... whatever happens, it's not gonna kill anyone very directly ...
The main ingredient of crime is intent, whatever you say. A smaller ingredient can be recklessness, but maybe it's the ISPs sending all those millions of empty packets to a single server that should start feeling some heat ?
> Your 20$ baby monitor bought from an authorized store you know... whatever happens, it's not gonna kill anyone very directly ...
Yeah, not kill, but participating in a DDoS against a heavily frequented commercial site that makes hundreds of thousands of dollars of revenue a minute, that's still some substantial damage.
In the end it should boil down to the ability of holding the seller of the product with security issues accountable for the damages, and the seller in turn can hold the manufacturer accountable. Maybe that will lead to some substantial change.
> Yeah, not kill, but participating in a DDoS against a heavily frequented commercial site that makes hundreds of thousands of dollars of revenue a minute, that's still some substantial damage.
It sounds like that hypothetical site has an interest in not going down if a random baby monitor sends traffic their way.
Also, to underline how silly and poorly thought through your idea is, are you aware that there are nearly 200 countries out there, each of them with many people with their own internet connections? Or are you expecting DDoS botnets to be comprised exclusively of devices in your jurisdiction?
You are ignoring the fact that the criminal in question bought a baby monitor. that is the full extent of their crime.
A person who buy all reason has absolutely no idea how any of this shit works. If you wanna go after somebody go after the manufacturer of said baby monitor.
A person who buys a Tesla has no idea how any of it works, but if someone breaks into that car and drives it (non-autonomously) into pedestrians how would I be held liable for that? I wouldn't be and shouldn't be. The person who broke into the car and drove it would be, the difference here is that the perpetrator is harder to catch so people look to blame something else.
At the end of the day it is very difficult to impose security management across consumers. You cannot expect the average consumer to pen test their home network and have active vulnerability scanning software to mitigate potential vulnerabilities that result in Botnets.
It is difficult to hold people liable when someone else misappropriates their assets in a way that was not its original intended purpose. When its difficult to capture the perpetrator people start to blame everything else, that doesn't mean we should just shift liability to the buyer who is just simply an easier target to place the blame on than a random unidentified person in another country.
That may sound like a solution but its not the right one. Now someone has the ability to misappropriate your assets from the other side of the world and you become charged with the crime, when all you did was buy a new Samsung TV. Heck knowing that, maybe someone would target you knowing full well you'd be in trouble for it.
Bit of a silly take, the difference is that you're the only one control of that car, whereas the item you bought off of Amazon could be controlled by someone else.
If someone broke into my car and drove it into a wall, I highly doubt I'd be found at fault. If someone broke into my IoT device and used it in an attack I highly doubt I should be found at fault.
At the end of the day it is very difficult to impose security management across consumers. You cannot expect the average consumer to pen test their home network and have active vulnerability scanning software to mitigate potential vulnerabilities that result in Botnets.
It is difficult to hold people liable when someone else misappropriates their assets in a way that was not its original intended purpose. When its difficult to capture the perpetrator people start to blame everything else, that doesn't mean we should just shift liability to the buyer who is just simply an easier target to place the blame on than a random unidentified person in another country.
That may sound like a solution but its not the right one. Now someone has the ability to misappropriate your assets from the other side of the world and you become charged with the crime, when all you did was buy a new Samsung TV. Heck knowing that, maybe someone would target you knowing full well you'd be in trouble for it.
> When your IP is found to have been part of a botnet, I think ISPs should just limit you to like 20Mbps for at least a year, so you think twice about buying that 10$ wifi baby monitor next time.
You're talking as if people can't just get another account or change ISPs.
Also, it seems you're mainly interested in gratuitously punish people who are powerless about issues instead of thinking about very basic approaches such as rate-limiting policies.
Okay and when your brand new Samsung TV is used in a botnet you should have your internet limited to 20Mbps as well? It's not just $10 pieces of crap of Amazon that fall victim to Botnet's.
If that could make people think about it, I'd be all for it. But the people buying that junk are absolutely clueless, and would remain so even after the punishment was well-underway.
Obviously they are - everyone's clueless about everything except the one thing they know about. I imagine for the clothes you're wearing you're clueless about the conditions of the people who made them.
There is no way for an ISP to differentiate between an infected router or IoT device and an infected PC due to the user's own neglegence.
If laws like the Cyber Recillience Act have been put into effect long enough for us to see a significant improvement in device security, then we can softly begin to rule out that cause and focus on the user.
We are not there yet, because (imo) devices are still not properly secured enough for us to go straight to blaming the user.
