Working Group 7: Botnet Remediation

1. Working Group 7: Botnet Remediation March 6, 2013 Michael O’Reirdan (M3AAWG) - Chair Peter Fonash (DHS) – Vice-Chair

2. WG 7 Objectives Working Group 7 – Botnet Remediation  Description: This Working Group will review the efforts undertaken within the international community, such as the Australian Internet Industry Code of Practice, and among domestic stakeholder groups, such as IETF and the Messaging Anti-Abuse Working Group, for applicability to U.S. ISPs.  Building on the work of CSRIC II Working Group 8 ISP Network Protection Practices, the Botnet Remediation Working Group shall propose a set of agreed-upon voluntary practices that would constitute the framework for an opt-in implementation model for ISPs. The Working Group will propose a method for ISPs to express their intent to op-into the framework proposed by the Working Group. The Working Group will also identify potential ISP implementation obstacles to the newly drafted Botnet Remediation business practices and identify steps the FCC can take that may help overcome these obstacles. Finally, the Working Group shall identify performance metrics to evaluate the effectiveness of the ISP Botnet Remediation Business Practices at curbing the spread of botnet infections.

3. WG 7 Members 3

4. March 2012 Deliverable U.S. Anti-Bot Code of Conduct (ABCs) for Internet Service Providers (ISPs) completed • ISPs representing 94% of the U.S. residential subscriber market are either currently participating, or have agreed to participate, in the Code

5. March 2013 Deliverable Final Report: U.S. Anti-Bot Code of Conduct (ABCs) for Internet Service Providers (ISPs) - Barrier and Metric Considerations

6. Barriers to ISP Participation • Technology Barriers • Barriers where current technical solutions insufficient to tackle botnet threat • Consumer/Market Barriers • Barriers from implementation solutions viewed by customers as ineffective • Operational Barriers • Barriers that could negatively impact organization’s primary mission and resources • Financial Barriers • Barriers resulting from inability to quantify costs/benefits of participation • Legal/Policy Barriers • Barriers associated with legal and/or policy constraints

7. Barriers Guide (Appendix 3) • Provides ISPs guidance on Code implementation activities • Guidance grouped according to • End-User Education • Detection • End-User Notification • Remediation • Collaboration • And further sub-divided by • Technology Barriers • Consumer and Market Barriers • Operational Barriers • Financial Barriers • Legal/Regulatory/Policy Barriers

8. Bot Metrics Guide (Appendix 4) • Expected Audience • What is and is not a “bot” • Counting botted “things” • Questions about “bots” • Statistical questions on botnet measurements • ISPs as a potential source of botnet data • Sinkholing, DNS-based methods, direct data collection and simulations • Recommendations

9. March 2013 Deliverable cont. • Metrics Glossary – Appendix 5 • Related Industry Security and Metrics Activity – Appendix 6 • M3AAWG Bot Pilot Phase 1 Metrics • Japan’s Cyber Clean Center Metrics • Australia’s iCode Metrics • Germany Anti-Botnet Initiative Metrics • Ireland’s Anti-Botnet Initiative Metrics • Finland’s Anti-Botnet Initiative Metrics • Shadowserver Foundation Metrics • Spamhaus CBL Metrics

10. Conclusions • WG7 delivered the U.S. Anti-Bot Code of Conduct for ISPs • WG7 identified potential ISP implementation barriers • WG7 identified steps FCC can take to help overcome barriers • WG7 identified challenges to obtaining Code effectiveness metrics at the present time • The Code, along with the Barriers and Metrics Guides, will require periodic updates from Code participants • There is a need to: • Address the bot problem with an Internet ecosystem multi-stakeholder approach • Continue to focus on bot reduction and mitigation to reduce the spread of bot infections

11. Recommendations • FCC, working in partnership with other federal government agencies and industry: • Facilitate ISP awareness of Code Barriers Guide and encourage ISPs to use Barriers Guide as a resource in planning and evaluating Code participation • Facilitate creation of case studies on bot mitigation activities to examine metrics created around particular bot remediation efforts, a good example being the recent Georgia Tech DNSChanger study presented at M3AAWG • Leverage industry-sponsored pilot programs to examine the collection and sharing of metrics around particular bot efforts • Facilitate research in bot metric development • Establish a vehicle, such as a workshop or webcast, to fosterongoing dialogue around these issues • Include international participants

12. Call to Action OS Vendors App Dev. AV Vendors Int’l Partners Web Hosts Content Providers Research Inst. ISPs Platform Vendors Gov’t D/As Privacy Advocates Enterprises End Users Critical Infra. e-Commerce Orgs. Regulators • WG7 believes the voluntary approach recommended will lead to further recommendations on Internet ecosystem multi-stakeholder approaches to best contain the spread of bot infections • WG7 further believes by expeditiously taking voluntary action on the recommendations, the FCC will significantly contribute to, and facilitate development and implementation of, voluntary practices that can be followed by the Internet ecosystem multi-stakeholders to combat the spread of bot infections 12