Trend Micro Calls on ISPs to Quarantine Virus Infected Computers

The vice president of online security firm Trend Micro, Rik Ferguson, has warned that “desperate times call for desperate measures” and is calling for broadband ISPs to “quarantine” the computer systems of customers that have been infected with malware (e.g. viruses, Trojans, botnets etc.).

At present many but not all ISPs will already notify and support customers that own infected systems (note: it’s very hard for ISPs to identify such problems), which is often done by looking for abnormal Internet traffic activity (e.g. traffic known to be associated with infected computers). Usually this does not require the ISP to invade your privacy because connections to dangerous servers (e.g. those associated with a virus) and email spam tends to stick out like a sore thumb.

But Ferguson believes that this isn’t always enough and “steps must be taken to bring home to the regular internet user the consequences of their action or their inaction“, not least because many security warnings are often forgotten the day after they’re published or end up being lost in the mass of “notification fatigue” (too many security warnings can be confusing.. albeit somewhat unavoidable).

Rik Ferguson said:

“ISPs on an on-going basis should take advantage of the threat intelligence feeds of the security industry to identify compromised systems connected to their networks. Those systems should be moved to quarantine, the account owners should be contacted and directed to resources which will enable them to clean up and rectify the situation. Until such time as the infection is remediated the computer should be able to access only limited Internet resources. Don’t care will be made to care.

A parallel has long existed in the auto world. Cars are subject to an annual check, if they do not pass this test of their roadworthiness they may not be driven on public rods until remedial works have been carried out because they represent a danger to the driver and to other road users. Desperate times call for desperate measures.”

The idea of putting computers into a quarantine is nothing new but, as Microsoft found out when it proposed something similar a couple of years ago (here and here), there are many potential problems with this approach. For example, modern broadband networks are usually shared between many devices rather than a single computer, with the router governing it all. As a result it would be very difficult to put a specific system on a network into quarantine without potentially impacting other users and even if you did then virus authors would surely adapt.

Similarly there could be conflicts with various laws, such as those designed to protect the individual’s privacy and freedoms. Likewise it would be difficult for ISPs to impose restricted Internet access on an individual connection, and almost impossible to do it for a specific device, without also making it harder for the end-user to find a solution to the problem by going online (i.e. most malware only uses basic Internet access anyway so restricting to the basics might not help).

On top of that ISPs would need to spend more to develop such systems, which is rarely attractive when the problem is ultimately an issue of individual customer responsibility. But once introduced you can bet that Copyright holders and politicians would also find other uses for it, which might push us further down the hill towards mass censorship of the Internet.