The Allied Request to Disable a Botnet Node
A national CERT learns that a botnet is using compromised routers inside its territory to attack a partner country's banks. The partner country requests that the CERT 'take down' the routers - meaning remotely disable them - without notifying the device owners, many of whom are small businesses and one of which is a hospital's outpatient clinic. The CERT's legal authority permits defensive monitoring and coordination with owners but is silent on remote disabling of third-party devices. The botnet operator appears to be a criminal group, not a state. The partner country is a close ally and the attacks are causing real financial harm. The CERT director must decide within 48 hours, before the next attack wave.
1. Should the CERT remotely disable the routers? Analyze under international norms and domestic authority.
Read the worked answer
The CERT should not unilaterally disable third-party devices on this authority.
Domestic authority: The mandate permits monitoring and owner coordination, not remote disabling. Silence is not permission. Acting beyond mandate creates legal exposure and sets a precedent the CERT may not want.
International norms: The widely endorsed peacetime norms of responsible state behavior call on states to not knowingly allow their territory to be used for internationally wrongful acts and to cooperate with affected states. That supports action - but the norms also counsel against measures that damage critical infrastructure. Disabling a hospital clinic's router without notice risks exactly that harm. The botnet being criminal rather than state-run matters: this is a law-enforcement and cooperation problem, not a self-defense or countermeasures scenario against a state.
Proportionality and due process: The harm to innocent owners (a clinic losing connectivity) is foreseeable and avoidable.
2. What alternative course of action satisfies the ally and the CERT's obligations?
Read the worked answer
A cooperative, owner-centered response:
- Notify and assist owners: Contact device owners, prioritizing the clinic, with remediation instructions and, where feasible, consent-based cleanup.
- Sinkhole or block command-and-control at the CERT's own infrastructure - a defensive measure within mandate that degrades the botnet without touching third-party devices.
- Coordinate with the ally: Share indicators, provide a timeline, and explain the legal constraint. Allies generally accept a lawful, effective alternative over a legally dubious quick fix.
- Engage law enforcement across borders for the criminal actor.
- Escalate for authority if disabling is deemed necessary - seek an explicit legal basis and a process for critical-infrastructure exceptions, rather than stretching the mandate.
The judgment: 'the ally asked and the harm is real' does not create authority. The CERT's credibility - and the norm of not damaging others' systems - is preserved by finding the effective lawful path, not the fastest one.