Please do not take down the Sality botnet

It was clumsily worded but I think we all know he didn't mean to imply that all of Russia was running botnets; he was alluding to Russian organized crime.

It looks like most people have already responded.

While my comment was poorly worded, statistically the majority of large botnets like Coreflood, Storm, BredoLab, Rustock, Kelihos are of Russian origin. Even the botnet we are discussing was first seen in Russia.

To comment on a couple of your points

2 - With Stuxnet, I think everyone agrees that US/Israel is to blame. The Russian connection is made because aside from the Iranians, the Russians are the only ones that had access to the facility, and they built the place. A Russian spy is a more likely culprit than a US-Iranian scientist double-agent sabotaging his own facility with results that could kill all of his co-workers.

4- No-one is talking under-employed. These criminals make more money than they ever would at any other job selling access to their botnet, advertising, spamming, installing fake virus software, stealing credit cards, etc. etc.

This gives rise to entities like the Russian Business Network (RBN)

Anyway, I meant no offense, if only americans or brits were clever enough to create a similar profile or stereotype, but I think some script kids guessing passwords pales in comparison to outsmarting the worlds largest software vendors and security researchers.

I work in information security, and I can give you a rough breakdown on botnet sites we've run into over the last year. (rough numbers)

25% have been Chinese (or linked to Chinese hackers, but using distributed hosting of hijacked servers around the world)

5% have been US-based.

10% have been Indian.

10% have been "other", including Canada/Mexico/Latin America, Africa, and Western Europe (like the German(?) Conficker worm)

A full 50% have been linked to the Russian Federation (and other former Soviet countries).

Why is this? Everyone has their theories, but mine is the combination of

1. Russia (and Eastern Europe) is a huge area.

2. Russian mafia really ramped up their cybercrime efforts after 1991 when the Soviet Union was retired.

3. Enforcement of cybercrime laws in Russia is lacking in comparison to Western nations, for various reasons.

Many other countries, including the US, have their own hackers and cybercrime groups. China and Russia are much, much more effective, though, and it's fashionable to hate on "commies" in the Western media.

IAAL. You know how lawyers always write "I am not your lawyer. This is not legal advice. Consult a lawyer in your jurisdiction."? That's for several good reasons, partly that we like being special, but also because no one could really answer this without doing legal research in the jurisdiction where the OP was charged. The answer will vary not only from country to country but state to state, and could depend on all kinds of specifics we don't know.

With that said, the law is basically a big virtual machine that runs on metaphors and rhetoric, kind of like the IE6 html engine.[1] So if I don't know the answer, I look for a metaphor where I have a better intuition.

In this case, the post reads kind of like: "hey, we all know that bar across the street is a front for organized crime. The law doesn't allow me to ask you to burn it down. So I'm just going to leave this molotov cocktail I assembled on the street here, and tell you not to burn down that bar across the street, OK? Also I've taken careful steps to conceal my identity. Laters."

So my gut is, yeah, in the hypothetical world where the OP screwed up and a million people lost data on their computers, and the FBI went ahead and tracked the OP down and prosecuted, they would be guilty as heck. This is more than just suggesting that it would be nice if someone did illegal things (which could be problematic itself, if the speaker intended and expected the suggestion to be followed), but actually compiling and providing tools and instructions to make it happen.

But if you understand the situation differently, and can offer a better metaphor where they sound innocent, then the answer could change. For example, how about: "hey, that guy is having a manic episode and about to start juggling chainsaws. The law doesn't allow me to suggest you use this tranq gun and shoot him. So I'll just leave it here." Or how about, "these parents are bringing back childhood diseases that have been gone for decades, because charlatans have scared them into avoiding vaccinations. The law doesn't allow me to suggest you vaccinate the kids yourself, so I'll just leave this vaccination candy here ..." OK, that one's definitely illegal, but interesting to contemplate. It's a fun game.

The thing to be careful about, though, is to disconnect what you want to be true from what is actually true. Like in this case, maybe you want it to be true that the law lets you hack someone's computer to protect them, the same way it (maybe) lets you stun the manic guy. But if you know that part's not true, then don't fudge the metaphor to get to the outcome you want.

And I am not your lawyer, and this is not legal advice, and you should consult a lawyer in your jurisdiction.

--

[1] This sounds bad, but I actually think it's a pretty reasonable way to run a legal system. We define a fair system as one that treats like cases alike and different cases different. So the way to make that happen is either to write code in advance that handles every edge case -- which if you've met human beings is hilariously impossible -- or to analogize every new situation to the ones before, and try to fit it in where it belongs. It's a fun problem.

Of course it isn't, if it was it wouldn't be prejudice.