Lawful Detection, Investigation, and Prosecution of Botnet-related Crime

僵尸网络是实施网络犯罪的一种非常有用的工具：几个被恶意软件感染的IT系统(僵尸)在指挥和控制基础设施的控制下连接到网络(僵尸网络)；然后该网络可能被用来实施进一步的犯罪。虽然IT系统感染恶意软件往往已经是一种犯罪，但检测僵尸网络以及起诉与僵尸网络相关的犯罪并防止(进一步)损害对执法当局来说是一个严重的挑战。这项研究项目的总体目标是确定和发展法律和IT框架，以促进执法当局和网络运营商之间的互动，以促进检测、调查和起诉僵尸网络相关犯罪。对于刑事和安全法子项目，主要研究问题是刑法和警察法在打击僵尸网络相关犯罪方面的互动，网络运营商等私人实体是否以及在多大程度上可能参与，以及所谓的安全法如何在这一领域出现。为了解决这些研究问题，将分析主要的刑法、刑事诉讼和警察法对执法当局与私人实体之间互动的要求和限制，并充分考虑宪法和欧洲框架。数据保护子项目分析网络提供商可以为基于异常的入侵检测系统收集多少数据，而不违反保护个人身份信息的规定。特别是，研究将侧重于分析(自然人)使用网络所产生的域名系统请求的局限性。此外，我们将调查如何按照数据保护的技术和法律框架实施僵尸网络的跨网络和跨域协作入侵检测，特别是使用基于异常的检测，以及当局--如BSI--可以发挥什么作用。

Botnets are a highly useful tool for committing cyber crime offences: several IT systems infected by malware (bots) are connected to a network (botnet) under the control of a command-and-control infrastructure; this network may then be used to commit further crimes. Although the infection of an IT system with malware is oftentimes already a crime, the detection of botnets as well as the prosecution of botnet-related crimes and the prevention of (further) damages is a serious challenge for law enforcement authorities. The overarching goal of this research project is to determine and evolve the legal and IT framework for the interaction between law enforcement authorities and network operators in the furtherance of detecting, investigating and prosecuting botnet-related crime.For the sub-project on criminal and security law, the main research questions are the interaction between criminal law and police law in addressing botnet-related crime, whether and to what extent private entities such as network operators may be involved, and how the so-called security law is emerging in this area. To address these research questions, the major criminal law, criminal procedure, and police law requirements and limitations on interactions between law enforcement authorities and private entities will be analyzed, taking full account of the constitutional and European framework.The sub-project on data protection analyzes how much data may be gathered by a network provider for anomaly-based intrusion detection systems, without violating provisions on the protection of personally identifying information. In particular, research will focus on limitations to analyzing DNS requests stemming from the use of the network by (natural) persons. Additionally, we will investigate how cross-network and cross-domain collaborative intrusion detection of botnets, in particular using anomaly-based detection, may be implemented in conformity with technical and legal frameworks of data protection, and what role authorities – such as the BSI – may play.