Aussie Gov't Decides ISPs Aren't Responsible For Infected Computers 129
c0lo writes "In a sudden outburst of common sense, the Australian senate decided that it is not the government's responsibility to force ISPs to disconnect infected computers from the Internet. Peter Coroneos, chief of the Internet Industry Association, used a car analogy that actually makes sense: 'It would be like forcing car manufacturers to take responsibility for bad drivers.'"
Not that great of a car analogy... (Score:5, Informative)
It would be more like the government requiring car manufacturers to do something about car theft, since an 'infected computer' is essentially out of the user's control. And yes, the Australian government DOES require all cars to have an immobiliser.
Comment removed (Score:4, Insightful)
Re: (Score:2)
While we're at it, can we ban all mouthbreathers from consuming oxygen until they've gone through a rigorous training exercise for how to properly consume air?
("hmm, about 90 minutes should be sufficient ... .wait, no, no! I've got a headcold!")
Snark aside, "walking is a right" and yet where I live there are *months* where sidewalks on major streets are piled with icy road-plowing debris until nobody can reasonably walk them. This drops my enthusiasm for treating driving licenses and hypotheticals like yo
Perhaps once, soon not... (Score:2, Interesting)
> but once they know about it they have multiple ways of fixing the situation and then they are indeed fully in control.
Unfortunately, the fact is that as time goes on, there are more and more components in computers which themselves are programmable (with microcode, for example) yet not easily "format-able" like the magnetic media of a hard disk. Hiding malware in these devices is a hot topic of current research (BIOS-level rootkits, WiFi adapters hosting malware), and could easily become reality for a
Re: (Score:2)
No, it's total rubbish. The car manufacturer does not have any way of knowing whether the person who owns the car is a good driver or not; there is no way they could take responsibility for it even if they wanted to. ISPs, on the other hand, do have complete visibility of all traffic to and from their customers' computers, and could easily identify certain types of infection if they had the necessary permission to inspect that traffic.
Re: (Score:2)
I think the original analogy is very poor, personally. It implies that the responsibility shouldn't lay with the ISPs by comparing them with manufacturers of vehicles. ISPs are much more like the people who manage and regulate the roads and toll booths. Unlike card manufacturers with bad drivers, ISPs actually in an ideal position to effectively address the problems of infected computers. In addition, they provide the resources (which belong to the ISPs) that an infected computer requires in order to be
Re: (Score:1)
it's more like failing a driving test and the government allowing people to use roads if they are bad drivers.
you can use a car off road if you like.
cars are more like computers in the case, and the internet the road.
The government is responsible for licensing people to drive cars on the road.
Re: (Score:3, Insightful)
The government however is *not* responsible for licensing people to communicate with each other over the internet.
And it should not be.
the day you need a liscence to have the privaliage of talking to other people is the day that free speach is well and truely dead and burried.
Re: (Score:2)
Um, it would probably be more like how everyone wants everyone else to use public transit.
How many people actually produce vs. consume on the internet anyway? Most people are just passengers.
Re: (Score:2)
What are you talking about?
Pretty much everyone produces emails, facebook updates and innane comments.
And anyone using the net produces packets as a matter of course.
Re: (Score:2)
Hey, most passengers have destinations too. And law enforcement can give the drivers citations for any passengers not wearing their safety belts.
All I'm really trying to do is help take this not-that-great-of-a-car-analogy as far as it can go before it sputters out in a cloud of hydrocarbons :P
Re: (Score:1)
but they could require people to have their computers checked for viruses if they are causing a problem.
like an MOT test on a car.
alternatively you could sit a test and DIY.
or the OS could be certified.
Re: (Score:1)
phone equipment (at least in the UK) has to be licensed.
so the government already does it.
Re:Not that great of a car analogy... (Score:4, Informative)
And yes, the Australian government DOES require all cars to have an immobiliser.
My 1982 VH Holden commodore would beg to differ. Maybe you meant all new cars?
Re: (Score:2)
My bad, it might be the WA govt. Requires it to be fitted if you sell the car too IIRC.
Re: (Score:2)
It only needs an immobilizer if it's less than 30 years old. I know this because I recently bought an HZ with no immobilizer.
Re: (Score:2)
I could mod you down but then you wouldn't know why! /earth/ are you talking about? No, just no.
Immobiliser for all cars? What on
Re: (Score:1)
Re: (Score:1)
And yes, the Australian government DOES require all cars to have an immobiliser.
It does? Since when? Can you cite a reference? Being an AU resident who owns a new car and has been head-to-toe over every inch including playing with it's various CANBus devices on both networks and tweaked a few firmwares here and there, I have to say I haven't seen hide nor hair of an immobilizer yet. There was a jack for an OnStar unit, but it was never installed from the factory as this service isn't really used here...
Re: (Score:2)
Ultimately the government made this decision not only because it was the only real right decision as you've pointed out but it's the only real practical decision. How can an ISP tell the difference between a botnet and home email server without doing some kind of snooping that they are currently very reluctant to do.
Better off the block
Re: (Score:1, Insightful)
Bartkid sez,
I have always taken the view that the manufacturers of computers, because they do not sell pre-installed firewall and anti-virus software are just like a car manufacturer selling vehicles without brakes.
So, when my dad who knows nothing about this stuff, bought his computer, it was immediately infected.
So, when the computer became very useless, he took it back to the shop. Only then did he get sold the software to protect him. Thanks; sheesh.
A commenter further down draws an analogy to medical
Re: (Score:2)
Re: (Score:2)
It is to make the keys expensive? I know when my father went to replace his keys, they wanted $50 for the key and $50 for the remote.
Backing off inappropriately (Score:5, Insightful)
'It would be like forcing car manufacturers to take responsibility for bad drivers.'"
No. it would be like making the DMV take responsibility for bad drivers on the highway, because the DMV issues the papers required for drivers to use the road.
The thing comparable "forcing car manufacturers to take responsibility", would be trying to force Dell, HP to take responsibility.
It should probably be noted that car manufacturers can be responsible for drivers going around in defective cars that have a high tendency to malfunction causing an accident unless the driver is an expert professional driver.
So it could make sense to hold Microsoft responsible for an OS with a horrible security record
Re: (Score:2, Interesting)
then you would have to let them bundle in an AV product and let all of the 3rd party security vendor's go out of business. One could even argue windows is not so much inherently defective, after all, they have a security alert telling you to have an AV, firewall and account control, and if you don't patch, well, the car company doesn't drive to your house to do repairs, you have to take the vehicle in for service when you get a note, MS sends you a note about a free patch, it's up to you to install it. Yo
Re: (Score:1)
I agree in part. The problem is not casting blame ("How did we get into this mess?") but finding a cure ("How do we get out of this mess?"). We want the most efficient way to eliminate viruses, both for end-users good and for the good of the net as a whole. Getting ISPs to cut off users is likely to produce a large amount of argument and start the process of disinfecting the users machine with a seriously negative attitude, which will be very counterproductive when dealing with someone who is, by definition
Re: (Score:2)
More correctly, it would be more like forcing toll road operators to take responsibility for preventing the use of a car in a crime.
Re:Backing off inappropriately (Score:5, Insightful)
More correctly, it would be more like forcing toll road operators to take responsibility for preventing the use of a car in a crime.
No, it's like forcing hookers to refuse service to customers with visible signs of infection.
Sorry, but the car analogies were getting on my nerves.
Re: (Score:3, Funny)
Re: (Score:3, Funny)
Re: (Score:3, Informative)
I would compare it to forcing garages to take unroadworthy cars off the road - regardless of who is at fault, the car is a hazard to other road users.
Many parts of the world already have something like this - the UK has the MOT test, for instance. Annual test for vehicles over 3 years old, if your car fails you can't drive it. (Fairly meaningless test because it just proves your car was OK when it was in the garage. If something then falls off 100 yards down the road, that's the driver's problem.)
Re: (Score:3, Informative)
That's just it - the MOT test is enforced by the Ministry of Transport. If the analogy applied, it would be like requiring you to take your 3 year old computer into a Ministry of Communications approved Geek Squad office for approval to connect to the internet. Fortunately we don't have to pay for an internet licence/registration yet, but now that the idea has come into my head it's only a matter of time...
Re: (Score:2)
One difference is that my car is portable. I could take my laptop into an office, theoretically, but the desktops would be a pain, and would interrupt connectivity. Further, cars tend to work the same, but computers can have seriously different operating systems. Would they be competent to examine my dual-boot Ubuntu/W7 laptop?
Re: (Score:2)
Oh, I don't argue that it would be a good idea to implement something along those lines. For one, a faulty/infected computer doesn't kill people, whereas a faulty car certainly could. Analogies break down when you go into details.
If it were to happen though, I can't imagine the inspection shops would be staffed by anyone other than computer techs who can demonstrate their competence and be able to understand quirky setups such as yours. I don't know about elsewhere, but in Australia, the mechanic doing the
Re: (Score:1)
Re: (Score:2)
So it could make sense to hold Microsoft responsible for an OS with a horrible security record
And Linux, and Mac. They are all just as insecure with a bad user behind the keyboard. Windows has these problems because it is popular, when it is Mac, or Linux that is popular, it will shift.
Re: (Score:1)
Linux and Mac are different, their authors could claim them more secure due to administrative controls being more tightly locked down by default, and fewer privileged system services running by default, that can be accessed by untrusted applications, smaller attack surface.
Microsoft could claim Windows is 'more secure' because there are more users, therefore more vulnerabilities discovered.
Linux distro makers could claim Linux is more secure, because it is open source, and more people are looking at t
Re: (Score:2)
Evidence? In order to install a program in Linux, Mac, and with Windows Vista and above, you need privilege escalation. In all of these OSes, the privilege escalation window is generally the same.
In Mac, it says this program requires privilege escalation to do "something" please enter your password
In Windows Vista and above, it says this "program" is trying to do something, please click yes or no
In Linux (Ubuntu in this case, as it is the only one I have seen which actually offers a prompt) it says, pleas
Re: (Score:2)
To address the rest of your post which I didn't actually read till just now. It is common industry knowledge that Windows is the largest attack vector merely because it is the most common OS out there. You can feel free to Google it and come up with the studies. As far as the compromised machines, that is mostly due to people refusing to upgrade from XP and earlier OSes, as the problems that caused the exploits are no longer present on newer OS releases, much as if you still had a Linux install from 2002
Re: (Score:3, Funny)
Re: (Score:3, Insightful)
That is what you get these days with the balance of power being held by the Greens and independents. It used to be that the independents and small parties would come up with the looney ideas, but more and more we are seeing the big parties filling that role. EG. The Internet Filter aka The Great Firewall of Australia.
Re: (Score:2)
Obviously, there's nothing that can't be blamed on the Greens and Independents. Major party comes up with a stupid idea? It must be the fault of the smaller parties for holding the balance of power!
Re: (Score:2)
Obviously, there's nothing that can't be blamed on the Greens and Independents. Major party comes up with a stupid idea? It must be the fault of the smaller parties for holding the balance of power!
Huh? I can't tell if you are being funny or are sarcastically saying that I am blaming the Greens and independents for the faults of the major parties. My contention was that it is the small group of non-mainstream politicians who are keeping the bastards honest.
Re: (Score:2)
That is what you get these days with the balance of power being held by the Greens and independents. It used to be that the independents and small parties would come up with the looney ideas, but more and more we are seeing the big parties filling that role. EG. The Internet Filter aka The Great Firewall of Australia.
IIRC internet filtering came from an Independent, and without a doubt the only reason either major party continues to give it lip service is to buy the votes of independents on other issues.
Re: (Score:2)
IIRC internet filtering came from an Independent, and without a doubt the only reason either major party continues to give it lip service is to buy the votes of independents on other issues.
You mean Senator Brian Harradine? Yes, he was definitely in favour of it. However, he left the senate in 2005, a year before Labor committed itself to the ISP level filtering. That 2006 version did have an opt-out clause, so it wasn't mandatory.
The Family First party have had a policy of mandatory filtering for a long time. But they didn't introduce the currently proposed system. Their representative, Senator Fielding, has been voted out now anyway.
It wasn't until 2008 that Labor remove the opt-out ability
To extend the metaphor... (Score:2)
To extend the metaphor to include iCode, then I guess car manufacturers will be working to help bad drivers and quarantine some of them if needed.
Bad analogy (Score:2)
Better would be to say road operators had to remove reckless drivers. Which is arguable more sensible.
Re: (Score:2)
Better would be to say road operators had to remove reckless drivers. Which is arguable more sensible.
Yup, like in Austria, where they bury blades in the Autobahn exits that slice tires of cars which enter the wrong way. (These drivers are confused rather than reckless, which fits the virus analogy even better.)
Nice! (Score:2)
Now THAT's what I call service. They're even doing the car analogies for us!
Re: (Score:2)
a pity one has to wade through 150 odd posts about the merits of the analogy before reading a single post relevant to the goverment's decision.
I'd moderate the whole thing off-topic but instead perhaps SeñorTaco will create a 'motor cars for nerds' site.
Re: (Score:2)
You didn't really expect anyone on /. to stay on topic, did you?
another better analogy (Score:5, Funny)
No. It would be like forcing toll road operators to refuse access to cars that are actively spraying oil all over the road surface that have been causing accidents.
Re: (Score:2, Funny)
Re: (Score:2)
You should have been modded insightful instead of funny. I had exactly the same reaction.
Like a toll road operator, ISPs would have a security duty, based on visible facts (without actively searching computers, just analysing statistical output traffic patterns). It wouldn't be akin to a penalty, but act like a quarantine for the benefit of the majority.
Re: (Score:2)
>> It would be like forcing car manufacturers to
>> take responsibility for bad drivers.
> No. It would be like forcing toll road operators to
> refuse access to cars that are actively spraying oil
> all over the road surface that have been causing accidents.
No, it would be like forcing Slashdot editors to make sure all Slashdot car analogies, even user posted, make sense.
Re: (Score:2)
'It would be like forcing car manufacturers to take responsibility for bad drivers.'"
No. It would be like forcing toll road operators to refuse access to cars that are actively spraying oil all over the road surface that have been causing accidents.
Are you saying that if someone is actively spraying oil all over the road surface, and they are coming up on a toll bridge...
The standard policy is for the toll booth operator to do... nothing? Not even like... Call the police or fire department... nor passively detain or interfere?
Re: (Score:1)
Re: (Score:2)
If I was driving a car that is spraying oil all over the road, then I would certainly want to be stopped before I ended up having a crash caused by the oil, or before I caused some other driver to crash.
Likewise, if you have a computer that is virus ridden and actively infecting others enough so that an ISP can spot it, it should be locked off from the internet - it saves other computers from getting infected, and also lets the user know he better hurry up and recover what data he can off the thing before i
Not reasonable at all. (Score:2)
More like-- I operate a toll road, now I can ignore the robbers who shoot out tires on that road.
Metaphor (Score:3, Insightful)
It would be like forcing an ISP to take responsibility for a copyright infringer.
Re: (Score:2)
Also, if we give ISPs the authority to quarantine infected computers, what's to stop that power from being subverted by the MAFIAA?
Re: (Score:2)
Not required, just recommended (Score:3, Insightful)
The government shouldn't be requiring ISPs to disconnect infected computers, no. But ISPs still should be disconnecting infected computers. Not computers that don't run the ISP's anti-virus package, not computers that aren't up-to-date on Windows, but computers that're actively showing the tell-tale signatures of known infections (including spewing spam e-mail). If a computer shows up infected, the user should be warned. If the infection isn't removed fairly soon after, the computer should be disconnected until the user contacts the ISP about solutions.
Think of it like a medical quarantine. We don't quarantine you just because you haven't had your shots. But once you're diagnosed with the actual infectious diseases, you're quarantined until either you get medical treatment and are cured, you get over the infectious stage on your own or you die.
Re: (Score:2)
Our ISPs actually already ta
Re: (Score:1)
Re: (Score:2)
Common sense would say no, but the problem is that common sense isn't very common. Likely there'll be no one making judgement calls and a simple computer will be there to decide who gets internet and who doesn't. I'd be much more accepting of the propos
Re: (Score:2)
That's why the warning first: so the user knows there's a problem and can go download updates, get anti-virus software and generally clean things up before getting disconnected. If they don't react, I say disconnect them completely (their modem goes dark, they get no IP connectivity whatsoever, not even to the ISP's Web servers) until they call customer service. Once they've called, had the situation explained and promised to clean things up, CS can reconnect them so they can clean things up. If the problem
Re: (Score:2)
They send you a mail explaining the problem and block most but not all traffic.
You can call their help desk and access a special page with help topics to resolve the problem and in case you need to download patches that's possible through the proxy server.
This approach is helpful to the owner of the infected computer and the internet in general.
Re: (Score:2)
Not computers that don't run the ISP's anti-virus package, not computers that aren't up-to-date on Windows, but computers that're actively showing the tell-tale signatures of known infections
For example, computers that run non-approved Operating Systems such as Linux?
Re: (Score:2)
Not computers that don't run the ISP's anti-virus package, not computers that aren't up-to-date on Windows, but computers that're actively showing the tell-tale signatures of known infections
For example, computers that run non-approved Operating Systems such as Linux?
Computers that run "non-approved" Operating Systems such as Linux won't be actively showing the tell-tale signatures of known infections, because almost all malware is for Windows.
And _if_ they have a rootkit running, they should be disconnected, Linux or not.
Re: (Score:2)
Computers that run "non-approved" Operating Systems such as Linux won't be actively showing the tell-tale signatures of known infections,
That doesn't matter to the government inspectors who come to your house to see what OSes you are running.
Re: (Score:1)
Re: (Score:2)
Well, for e-mail almost all ISPs block outbound port 25 except to their mail servers and scan outgoing e-mail for spam the same way they scan incoming, so for e-mail it ought to be fairly trivial to spot the problem. For other stuff, do what my ISP does and routinely scan their network for the open ports and tell-tale traffic signatures of known malware. I've actually gotten calls from the security people at my ISP when they went to scan my IP address and "my router" suddenly stop responding completely (the
Re: (Score:2)
In Australia, we have this lovely organisation called ACMA (Australian Communication and Media Authority). They have a program called AISI (Australian Internet Security Initiative) which sends reports to many Australian ISPs, notifying them of any detected infections. I assume they get their data from honeypots and such, although according to the linked ZDNet article, they're set to receive data from Symantec, McAfee, and other security companies.
So that's how ISPs can determine infected hosts without ins
A telepone analogy would be better (Score:3)
Is a telephone provider responsible for drug dealers, pimps and other assorted crooks, who run their business over the providers' telephone lines?
The telephone provider runs a line to your house. What takes place on the other side of the line, inside your house, they have no control over. The same is true for an ISP. They provide an Internet connection to your home. What you hook up to it, is your responsibility . . . and liability.
Re: (Score:2)
Re: (Score:2)
If a drug dealer, pimp, or other assorted crook was breaking into my house and using my telephone to run their business, I would be very pleased if the telephone company told me about it.
It's more like... (Score:2, Insightful)
The analogies are pointless. It comes down to factors such as feasability, harm done, harm prevented and responsibility. An ISP is capable of disconnecting the computers from the internet. Forcing them to do so would prevent harm. So it comes to whether the cure is worse than the disease.
The ISPs make the perfectly reasonable point that the goals can be achieved by self regulation, and this will be much more flexible. On the whole the ISPs a
a bit shocked by the reaction of the slashdot crow (Score:1, Insightful)
How does the governement decide whether a computer is infected or not?
Does running a P2P program counts as "infected"?
I understand that to decide whether a computer is infected or not, one would have to store and analyze the network traffic with DPI.
Do you also want the government to close their eyes when they see which websites you browse, and the content of your emails? (which is usually not encrypted)
Finally, does "infected computers" include computers from political oponents, like in China?
I actually ha
Re: (Score:2)
I'm guessing all those nice capitalist non-government-affiliated antivirus companies might just have an idea or two about that.
What? Why on earth would it? We're talking about detecting malware, not enforcing copyright law.
DPI would not necessarily be required
Given most of the comments to date.. (Score:1, Offtopic)
..it looks like we desperately need BadAnalogyGuy [slashdot.org]
Fair Enough (Score:2)
Sometimes good news is good.
(I know, profound)
At least I can start drinking Foster's again to pretend to be "outback"!
Also I found a US winning a robot battle against Australia [zdnet.com.au] on the side panel, and robots merit an instant mouse click!
...
On a more enlightened note, I found TFA really shallow and not providing the news in the most ideal way I wanted:
The government accepted response to recommendations that federal, state and territory police forces establish an "e-crime managers group" to improve information-sharing and cross-jurisdiction cooperation, which would fall under the auspices of the Australia and New Zealand Policing Advisory Agency's e-Crime Committee.
So really our collective "uphill battle of common sense" is really just a temporary mitigation to the common sense necessity. (Don't confuse my comment in not
Gentlemen, start your analogies! (Score:5, Funny)
Good! (Score:2)
Now all someone needs to do is write a virus containing a distributed bit-torrent server that "infects" users machine and there is jack shit they can do the ISP's wont have to be responsible for dealing with it.
Looking at it logically... (Score:2)
1. The Customer's PC is not the property or under control of the ISP
2. The ISP can trivially detect the presence of 'questionable activity' like egress email in the 1000's for a consumer broadband account
3. ISP's can through deep packet inspection (if employed) easily detect the presence of well known computer viruses / exploits both ingress and egress
4. If decided to do so, an ISP can cut off a customer's line or block an IP both automated (based on some pre-defined traffic analysis) or manually due to hum
Re: (Score:2)
Anything that allows *anyone* to inspect my encrypted traffic without a warrant automatically gets my stamp of disapproval.
Re: (Score:2)
Inspection is an interesting question. Assuming nothing is stored, and no encryption is infiltrated, is your data being compromised in any way that a half intelligent switch/router isn't already doing today?
Should be done anyway! (Score:3, Insightful)
Any responsible ISP should be doing this voluntarily anyway. My ISP (Exetel) redirects you to a page telling you that you are infected and telling you how to fix it (and giving links to AV software hosted on their servers). Cars have mandatory yearly inspections or they aren't allowed on the road so Peter Coroneos was just trying to dodge legal liability not talking any kind of sense.
Botnets are a huge organised crime business and any ISP that isn't fighting them is either incompetent or is profiting from botnets (either being paid by the mob or making money selling DDOS protection and the like).
Re: (Score:2)
How would they know you're botnetted? Perhaps you just happen to have a traffic pattern similar to a particular botnet because of a server you're hosting... I'd be annoyed if I was getting redirected on every http request. Either that, or they already have your PC compromised with th
Two faces of OZ! (Score:1, Insightful)
The government doesn,t force ISPs to disconect infected computers, but it will MONITOR all the computers, FILTER available content to users, LOG users access, and RESTRICT access, at its own discretion of course! Good to see its not doing anything to stop viruses, and malware and spam. . . . . .
Safety and Emissions Check (Score:5, Insightful)
Re: (Score:2)
I couldn't agree more. I was going to post a similar response.
Better Analogy... (Score:1)
The state provides us with roads to travel on but also polices those roads and removes people that are hazards to others. The ISP provides roads for our internet traffic and should remove users that are hazards to others (spam, viruses, etc).
Sorry, but if you can't manage your PC then you don't get to play Farmville till you get your shit fixed.
Another view. (Score:2)
It would be like forcing car manufacturers to take responsibility for bad drivers.
No. It would be like forcing gun manufacturers to take responsibility for murderers.
~Loyal
Keep Dreaming (Score:2)
Only geeks support this, because we've been playing with a computer since birth so it wouldn't be a hassle to keep a computer clean. The rest of the world won't be receptive of a blacklist law.
Punishing the victim has never been popular. See how popular TSA is? Whatever the problem is, you start with the criminal. We are far from exhausting all options against spammers. This is purely a zero-cost (to the law makers) law made to fill a resume for re-election. Off the top of my head I can think of all sorts o
Bad analogy (Score:2)
I actually think the car analogy is a poor one. That would imply that car manufacturers, or even the dealers, KNEW about bad drivers, and had a way of disabling their automobiles.
ISP's can tell with a fair degree of certainty that a computer they have connected to the network is spewing either spam, or participating in a known 'botnet. They also have a way to contact the user to tell them that something is happening. Also, having an infected computer isn't usually something the user chooses, and they
Bullcrap (Score:3)
This ruling basically says that tollbooth attendants are not required to stop drunk drivers from driving drunk.
While I would say that this is true, barring any specific law, I also see that such a law would be a good idea. Governments could easily pass a law that required tollbooth operators to refuse to let drunk drivers get on their highway. Such a law would not be a bad law. I see few reasonable objections to it.
As such, I would state that while without a law, ISP's should not be legally required to stop infected computers from using them, it should be quite easy for a government to pass such a law, and that law would be:
a. Reasonable and proper
b. A good idea
To put all the analogies together... (Score:2)
It would be like toll booths taking responsibility for crashes that occur on the toll road.
Re: (Score:1)