Botnet Mitigation and International Law

Advances in technology have outpaced development of laws governing cyberspace, leading, at times, to a wild-west law enforcement regime. And in a world of Botnets — massive armies of unknowingly conscripted systems directed by anonymized ‘botmasters’ — domestic criminal law is no longer a sufficient response to cyberthreats. States now act against a backdrop of international animus over what many nations see as surveillance overreach by the United States and Five Eyes partners who enjoy an overbroad grant of executive discretion, capture data indiscriminately, and operate in relative secrecy. This Note outlines the various technologies employed by outlaw and government actors. It describes how these technologies confound territorial limitations on enforcement jurisdiction in international law. It discusses advances in botnet-disruption methods by private and government actors. It discusses how nations wishing to constrain powerful western intelligence agencies have reached to pre-cyber human rights and privacy law as a response to perceived surveillance overreach. This Note describes how technical elements of recent U.S. Department of Defense anti-botnet efforts, including machine learning, should allay these privacy concerns. It explains that rather than arbitrary and vague legal barriers, nations need laws authorizing good-faith enforcement by cyber-capable states and procedural norms that guide development of technological solutions that operate consistently with universal values. Finally, it outlines promising sources of international law developing around this issue and advocates for development of a mutually recognized state duty to disrupt cybercriminals and expanded cooperation between nations in botnet disruption.