CRTC outlines framework to block botnets from internet traffic

In a Thursday decision, the CRTC announced it was implementing regulations to control botnets that threaten Canadians’ internet security. It established the guiding principles for the framework and required a detailed set of recommendations from the CRTC Interconnection Steering Committee (CISC) within nine months. The process began in January 2021 when the commission solicited comments from stakeholders on limiting botnet access to internet networks. Interventions flooded in, from telecoms, from banks, from government agencies, from lobby groups and from individuals. The regulator also requested information from telecom service providers (TSPs) BCE Inc.; Bragg Communications Inc.’s Eastlink; Cogeco Communications Inc.; Distributel Communications Ltd.; Rogers Communications Inc.; Saskatchewan Telecommunications Holding Corp.; Shaw Communications Inc.; Telus Corp.; TekSavvy Solutions Inc.; Quebecor Inc., parent of Videotron; and Xplornet Communications Inc. The majority of intervenors agreed that botnets are a cyber security issue but disagreed about how prevalent the problem is. SaskTel aligned with a group of banks led by CIBC who argued that botnets account for 20 to 30 per cent of all internet traffic. Bell, Rogers and Telus disputed that. Their own data was unavailable to the commission but the big three telecoms used Xplornet’s minuscule numbers – 0.0002 per cent of network traffic – to argue that regulation was unnecessary. They pointed out that TSPs are already sharing botnet and malware indicators of compromise (IOCs) through the Canadian Security Telecommunications Advisory Committee’s (CSTAC) sub-working groups. The big three continued to make that case when they filed replies to the original interventions. The CRTC did not buy the telecoms’ argument. “The commission recognizes that malicious websites accessed by Canadians as a percentage of total websites visited may be low in absolute terms,” the decision stated. “However, since visiting a single malicious domain is sufficient to advance a device infection or result in credential theft, the commission considers that even the relatively small ratio detected by TSPs is significant.” Among those advocating for regulatory oversight were the Communications Security Establishment (CSE) and the RCMP; the banks; the Canadian Internet Regulatory Association (CIRA); the Public Interest Advocacy Centre (PIAC); and telecoms SaskTel, Shaw, TekSavvy and Videotron. "As true believers in the free and open internet, we recognize that blocking is a difficult issue. That said, we see first-hand that malicious activity such as botnets create real threats to the internet’s infrastructure,” CIRA president and CEO Byron Holland said in a Thursday release. “We support the CRTC’s decision to develop a framework for botnet blocking in order to ensure Canadians can leverage a safe and trusted internet for their social, economic and cultural development.” The CSE maintained that outright blocking would result in fewer incidents and compromises from known threats. TekSavvy said it was initially opposed to regulation but changed its mind when it read the requests for information (RFIs) from other TSPs. The RFIs showed that companies are already dealing with botnets and malware. TekSavvy called for a lightweight incentives-based approach to regulating botnets. The commission decided regulations are needed because current TSP practices are diverse and opaque and because there is confusion among TSPs as to whether there is legal basis for blocking botnets. In its intervention, the Internet Society had posited that regulation would interfere with net neutrality. The regulator dismissed that argument. The CRTC admitted that while CSTAC policies are “valuable”, they do not provide set standards. The regulator could not assess the effectiveness of botnet blocking software given the lack of metrics for tracking the results of TSP activity. Several intervenors argued against a one-size-fits-all approach to regulation. The commission suggested a framework of minimum standards. While these would apply only to Canadian carriers, it added that non-carrier TSPs should be encouraged to adopt a similar system. The CRTC sought guidance on how to decide what should be blocked. Various parties were suggested as gatekeepers including CIRA, CSTAC and the commission itself. There was also a proposal that a new organization could be set up. CIRA cannot scale its systems to handle more traffic, the regulator found. Rogers is industry co-chair of CSTAC, leading to doubts about its neutrality, and CSTAC only represents a dozen TSPs. The commission stated it does not have the expertise to administer a botnet-blocking framework. Establishing a new group would be time-consuming, costly and unduly burdensome. The CRTC instead directed CISC to prepare a report on preferred options. The report is due in nine months. CISC will consider who will accredit third party blocklists, what will be the criteria for that accreditation, how can the public provide false positive complaints, and any other practical considerations. The regulator rejected opt-in or opt-out approaches to blocking, favouring a default mechanism. Opt-in and opt-out would increase costs to TSPs, it said. The commission worried about over-blocking and false positives. They are inevitable, the decision stated, but procedures can be taken which facilitate progress. These include vetting IOCs prior to their inclusion on a blocklist, receiving and investigating false positive complaints from the public, updating the blocklist regularly and ensuring that TSPs log their effective blocking of IOCs and verify their blocking systems work. A centralized blocklist would lessen the chances of over-blocking and false positives, the regulator asserted. –Reporting by Paul Park at ppark@thewirereport.ca and editing by Jenna Cocullo at jcocullo@thewirereport.ca.

CRTC outlines framework to block botnets from internet traffic

News | 06/23/2022 5:48 pm EDT

To keep reading, get a free trial.

Already a Subscriber?

Related Stories

CRTC wants info on TSP’s botnet blocking efforts

News | 06/29/2021 3:21 pm EDT

Telecoms emphasize concerns, support for CRTC’s botnet blocking proposal

News | 05/06/2021 7:19 pm EDT

|

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us