Cybercrime costs the global economy an estimated $600 billion a year and can only grow as the number of connected devices – approximately sixteen billion today – is expected to double in the next five years.

According to a new Council on Foreign Relations report co-authored by Global Resilience Institute Senior Research Scientist Robert Knake, much of that loss is tied to botnets. Botnets – devices and computers infected with malware – can be used to spread spam, enable phishing attacks, steal passwords, and ultimately have the power to bring down entire networks.

“Even if only the tiniest fraction of these [connected devices] are infected with botnets, malicious actors will have enormous disruptive potential at their disposal,” the study states. According to the Knake and co-author Jason Healey, Senior Research Scholar at Columbia University, as much as 30% of all internet traffic may be from botnets, most of which could be attributable to distributed denial of service (DDoS) attacks.

“The threat from botnets to the health of the internet and the modern, digital economy that relies on it only continues to grow,” argue Healey and Knake. “Absent sustained, organized efforts to combat [them], botnets and the malicious actors that control them will take an ever-increasing chunk of the value created by the internet and the systems connected to it.”

In stressing “an ambitious goal of zero botnets,” the authors also provide policy recommendations for countries, ISPs, and device manufacturers.

The Council Special Report, Zero Botnets: Building a Global Effort to Clean Up the Internet Environment, can be downloaded in full by clicking here.

“Cyberspace increasingly resembles nothing so much as the old American Wild West, with no real sheriff and with botnets as the outlaws with guns. Botnets, or groups of computers infected with malicious software that are controlled as a single network, enable much of the internet’s cybercrime. They do so by allowing those who control the network to harness supercomputing-level power for nefarious purposes. Botnets are used to spread spam, send phishing emails, guess passwords, break encryption, and launch distributed denial of service attacks. Despite high-profile efforts to eliminate botnets, their number has continued to increase. As Jason Healey and Robert K. Knake argue in this new Council Special Report, the conventional wisdom that botnets are a problem to be managed aims too low. Botnets can cause serious harm by allowing foreign governments to stifle free speech abroad and enabling them to shut down countries’ domestic networks or even the internet globally. Additionally, the economic harm botnets cause is likely to increase significantly over time as the number of internet-connected devices surges. Thus, policymakers should increase their ambition and seek to rid the world of botnets.”
– Richard N. Haass, President Council on Foreign Relations, November 2018

Editor’s Note: A Global Resilience Institute-funded seed grant project is exploring the development of a resilient Internet-of-Things (IoT). The project views the emerging IoT as a socio-technical system: a set of technologies and practices that are embedded within larger economic, legal, political institutions. It convenes an interdisciplinary team of Northeastern faculty and researchers to investigate the ways in which resilient practices can be encouraged through technical innovation and institutional design. CLICK HERE to learn more.

Robert Knake is the Senior Research Scientist in Cybersecurity and Resilience at the Global Resilience Institute and the Whitney Shepardson Senior Fellow at the Council on Foreign Relations. His work focuses on Internet governance, public-private partnerships, and cyber conflict and his expertise includes developing presidential policy. He is currently engaged on a multi-year project to examine the creation of a Critical Infrastructure Network that would move control system operations off of the public Internet — CInet.