Gabriel M. Ramsey

For Ramsey, it's like a game of hide and seek when he's pursuing the evil botnets.

As sci-fi as that sounds, the reality is that botnets are causing a lot of havoc in cyberland.

They are networks of compromised computers used by criminals to carry out malicious conduct, Ramsey said.

In March 2011, he orchestrated an elaborate enforcement effort to dismantle the so-called "Rustock" botnet, among one of the largest of its kind. Microsoft v. John Does 1-11, 2:11-CV-00222-JLR (W.D. Wash., 2011).

It was comprised of more than 1 million compromised computers and was capable of sending 30 billion to 40 billion spam email messages per day, he said.

After it was finally dismantled, there was a sustained 30 percent drop in global spam email volumes for several months, Ramsey said. In the weeks following the takedown, he added, U.S. spam levels were reported to have dropped 70 percent.

Ramsey secured a temporary restraining order and preliminary injunction to simultaneously turn off 276 U.S. based IP addresses and 30,000 U.S.-based Internet domains.

"If it all didn't happen within minutes of each other," he said, "defendants would have been able to regain control."

Notices must be sent to every email address or domain taken down, Ramsey said.

While some defendants are identified, and served in other countries, he said, "Typically they don't respond. We don't know their identifies. We give them every chance to show up in court and say, 'Turn my botnet back on,' but they don't."

Coordinating all of these takedowns globally is a major challenge, Ramsey said, and his team provided the expertise, from international treaties and technical expertise, to following the "money trail."

This is going on all over the world," Ramsey said. "So you have to be able to cut through the complications of international borders and the anonymity provided by the Internet."

-PAT BRODERICK

<!-- Gabriel M. Ramsey -->