Botnet Bust in Canada

Good news on the botnet-busting front comes to us from Canada! Yesterday 17 people ages 17-26 were arrested on charges stemming from alleged botnet-related activities, which resulted in $45 Million in damages.

Evidently, this is the first time that a hacking network has been dismantled in Canada (and the first time I recall hearing that a female was busted in connection with botnet activities). Over the course of the two years that this network was under investigation, the network took control of up to a million computers. When you figure the number of computers hijacked, the amount of the damages, and the number of people they were able to connect with this crime, this is a very impressive win for the Quebec police.

The maximum sentence for the charges is 10 years in jail – it will be interesting to see how much jail time this could mean for the people who’re found guilty. When the 15-year-old Canadian who called himself “Mafiaboy” was arrested for DDoS attacks against several major websites in 2000, he was sentenced to only 8 months in jail. He was also found to have caused millions of dollars worth of damage in the attacks. The people charged as part of this hacking network may have begun their criminal activities at the same age as Mafiaboy, as the initial investigation into this network goes back to summer of 2006. However, it seems that the trend has been towards longer sentences for people convicted of cybercrime, so it may be that they will not get off as light as Mafiaboy did.

The two primary differences that will figure into the sentencing, as I see it, are that the hacking network did this as a money-making enterprise, and that this was done over a long span of time. Arguably, Mafiaboy’s actions could be explained away as a moment of youthful indiscretion. These people allegedly profited from these crimes over the course of two years.

This makes me wonder how much of the total damage amount they actually took home, versus the cost of cleaning up infected machines, the cost of down-time and lost productivity. I doubt sincerely that these kids’ friends and family wouldn’t have noticed an influx of almost $3 million a piece in such a short span of time.

All in all, this is an impressive step in the direction of making legal action a real deterrent for kids who would consider taking up cybercrime.