Panel: From Takedown to Touchpoint: An Inside Look at the Data-sharing Pipeline in the Victim ...

Panel: From Takedown to Touchpoint: An Inside Look at the Data-sharing Pipeline in the Victim ...

Speakers: Tod Eberle (The Shadowserver Foundation); Adam Diament (Special Agent, Defense Criminal Investigative Service (DCIS)); Stu W (NCSC); Stewart Garrick (Shadowserver); Chris Butera (CISA)

Conference: FIRSTCON

YouTube: https://www.youtube.com/watch?v=rsX939MzWmY

Overview

This panel discussion, "From Takedown to Touchpoint," delves into the often-unseen mechanisms by which data from law enforcement disruption operations is shared to facilitate victim notification. Moderated by Tod Eberle of The Shadowserver Foundation, the discussion features representatives from key organizations involved in this critical pipeline: Adam Diament from the Defense Criminal Investigative Service (DCIS) and FBI, Stu W from the UK National Cyber Security Centre (NCSC), Stewart Garrick from Shadowserver, and Chris Butera from the Cybersecurity and Infrastructure Security Agency (CISA). The core problem addressed is the lack of a formalized, efficient structure for law enforcement to fulfill its obligation of notifying victims after a cybercrime takedown.

The talk aims to demystify this complex process, illustrating how data flows from a law enforcement operation, through intermediary non-profit organizations like Shadowserver, and eventually reaches national CERTs and end-users. The panelists provide invaluable insights into their respective roles, operational challenges, and successful strategies for victim notification and risk reduction. For national CERTs and cybersecurity professionals in attendance, the session offers practical tips and actionable ideas, drawing on the experiences of leading agencies like the NCSC and CISA in developing effective early warning and cyber hygiene services.

The importance of this discussion cannot be overstated. As cybercrime operations become increasingly sophisticated and transnational, effective victim notification is paramount not only for individual recovery but also for strengthening global cybersecurity resilience. By illuminating the existing, albeit often informal, data-sharing pipelines and highlighting best practices, the panel underscores the necessity of robust collaboration between law enforcement, non-profits, and national cybersecurity agencies to protect a vast and diverse victim base.

Background

▶ Watch: Panel Introduction: The Data-Sharing Pipeline (0:00)

The genesis of this discussion stems from a recognized gap in the cybersecurity ecosystem: while law enforcement agencies regularly conduct disruption and takedown operations against criminal cyber infrastructure, the subsequent process of notifying affected victims often lacks a structured and efficient pipeline. Law enforcement has a clear obligation to inform victims, yet the practicalities of identifying and reaching potentially millions of compromised individuals or organizations across diverse jurisdictions present significant challenges.

Cybercrime, by its very nature, transcends national borders. Criminal actors leverage servers, domains, and compromised devices globally, making investigations and takedowns inherently international endeavors. This complexity means that victim data, when recovered, can reside in various legal jurisdictions, each with its own laws regarding data access and sharing. Furthermore, the sheer volume of data, coupled with the need for timely and actionable notifications, necessitates specialized infrastructure and expertise that individual law enforcement agencies may not possess.

Prior to the development of more coordinated efforts, victim notification could be ad-hoc, relying on direct contact or less efficient methods. The emergence of organizations like The Shadowserver Foundation as trusted, non-profit intermediaries has been crucial in bridging this gap. Shadowserver, with its extensive data dissemination capabilities and global reach, has positioned itself as a vital link between law enforcement agencies, which gather raw victim data, and national CERTs or network owners, who are best placed to effectuate localized notifications and mitigation actions. This panel explores how this informal yet increasingly effective pipeline has evolved, using real-world examples like the Socks Escort botnet takedown to illustrate the process and its challenges.

Key Findings

▶ Watch: Shadowserver's Critical Role in Takedown Support (8:10)

The panel revealed several critical findings regarding the victim notification pipeline in cybercrime takedowns:

1. The Indispensable Role of Non-Profit Intermediaries: Organizations like Shadowserver are fundamental to the global data-sharing pipeline. Their non-profit status fosters trust with law enforcement, enabling them to receive sensitive victim data that might otherwise be difficult to share due to legal or political constraints. Shadowserver's existing infrastructure, capable of disseminating information to 175 countries and network owners covering over 50% of IPv4 space, makes it uniquely positioned to scale victim notifications.
2. Effectiveness of Early Warning Systems: National CERTs, such as the UK NCSC and CISA, have developed highly effective early warning systems and cyber hygiene programs that leverage data from Shadowserver and other sources. The NCSC's Early Warning tool, for instance, processes 16 data feeds, with Shadowserver data comprising 60% of its repository and generating over 90% of its alerts to customers. CISA, in the first nine months of its fiscal year, delivered 4,300 notifications, including 2,300 targeted notifications for compromise and 400 administrative subpoenas to resolve IP ownership.
3. Challenges in IP Ownership and Notification Legitimacy: A recurring challenge for CERTs is identifying the ultimate owner behind an IP address to deliver notifications. This often requires specialized legal tools (like CISA's administrative subpoena authority) or reliance on organizations signing up for services and providing their IP ranges (like NCSC's Early Warning). Additionally, cold-calling victims as a government agency to notify them of a compromise often faces skepticism regarding legitimacy, requiring creative verification methods.
4. Value of Collaborative Partnerships: The success of these operations hinges on multi-agency and public-private collaboration. Adam Diament highlighted joint investigations with the FBI and IRS-CI, as well as foreign partners like the Dutch national police, France OFFAC, and the Austrian federal police. CISA's Joint Cyber Defense Collaborative (JCDC) and NCSC's Industry 100 (I 100) scheme exemplify successful models for integrating federal, intelligence, international, and industry partners to build a unified threat landscape and share real-time information.
5. Innovative Data Sharing Models: A pilot program between NCSC and Shadowserver demonstrates a promising model for enhanced international data sharing. By allowing the NCSC to share the extended IP space of UK-based companies (including their international holdings) with Shadowserver, these companies receive more comprehensive and timely notifications, covering their entire global footprint rather than just their in-country assets. This approach overcomes traditional geographical limitations in victim notification.

Technical Deep Dive

▶ Watch: UK NCSC's Early Warning System Explained (12:00)

The data-sharing pipeline discussed involves a multi-stage process, integrating diverse technical capabilities and legal frameworks from law enforcement, non-profits, and national cybersecurity agencies.

Law Enforcement Operations (DCIS/FBI/International Partners):

Adam Diament detailed the initial stages of a takedown, using the Socks Escort residential proxy network as a prime example. This malicious service, operational since 2009, utilized a botnet to compromise residential routers and Linux-based Internet of Things (IoT) devices, enabling attackers to launch financial fraud and other attacks appearing to originate from legitimate home networks.

Investigations begin with ground-level efforts, such as door-to-door inquiries to obtain consent from local victims whose routers were compromised. This is a challenging process due to trust issues. Concurrently, law enforcement utilizes US legal process—including subpoenas, court orders, and search warrants—to target US-based command and control (C2) servers and other criminal infrastructure, gathering historical infection data. For infrastructure located overseas, cooperation with foreign partners (e.g., Dutch national police, France OFFAC, Austrian federal police) is essential, navigating different legal authorities.

Disruption operations involve seizing servers and, critically, seizing malicious domains using seizure warrants. Many domain registrars are US-based, facilitating this process. Once domains are seized, traffic is redirected from the malicious C2 infrastructure to Shadowserver's name servers. This technique, known as sinkholing, allows Shadowserver to collect valuable data on active victim IPs attempting to connect to the defunct C2, providing a real-time snapshot of the botnet's reach.

Shadowserver's Role as an Intermediary:

Stewart Garrick and Stu W explained Shadowserver's unique position. As a non-profit, it acts as a trusted conduit, receiving high-value data from law enforcement without commercial interests. Its infrastructure is designed to disseminate information efficiently to 175 countries and network owners covering over 50% of the global IPv4 space.

For domain takedowns, Shadowserver created the Registrar of Last Resort, an ICANN-accredited non-profit registrar that provides legal and technical advice to law enforcement on domain seizure best practices. Beyond live sinkhole data, Shadowserver also receives historic infection data (e.g., criminal backend databases with compromised IPs, timestamps, passwords) which are not continuous feeds. For these, Shadowserver issues Special Reports—one-off, ad-hoc data sets deemed high-value and time-sensitive. These reports are pushed through the same pipelines to national CERTs, clearly marked for priority processing. Shadowserver also maintains a public dashboard (dashboard.shadowserver.org), providing aggregated, anonymized statistics on botnet takedowns and other global cybersecurity events, offering transparency and demonstrating the impact of these operations over time.

National CERTs: UK NCSC and CISA:

UK NCSC's Early Warning System:

Stu W described the NCSC's Early Warning tool, a national-scale, free, and automated malicious cyber activity notification service. Its architecture is built on Arctic Hub, a platform developed by Arctic Security. The system ingests 16 data feeds, with Shadowserver contributing significantly (60% of data volume, 90% of alerts). Arctic Hub manages data schema, normalizes diverse data formats, and enables filtering to reduce noise and ensure notifications are actionable. IP matching is performed against internet-facing IP ranges provided by the approximately 16,000 organizations signed up for the service.

The Early Warning system delivers three main product types:

1. Instant notifications: Alerts on malware presence or communication with sinkholes.
2. Network abuse event notifications: Informs organizations if their network is scanning the internet or brute-forcing other infrastructure.
3. Vulnerability and exposed services reports: Details identified vulnerabilities and exposed services.

Notifications are typically batched and sent weekly on Monday mornings to avoid alert fatigue, though critical vulnerabilities (e.g., from CISA's KEV list) trigger near real-time alerts within 30 minutes.

CISA's Cyber Hygiene and Notification Services:

Chris Butera outlined CISA's mandate to protect US critical infrastructure and federal civilian government networks, distinguishing its asset response mission from law enforcement's threat response. CISA operates under Presidential Policy Directive 41 and benefits from the Cyber Information Sharing Act of 2015, which provides liability protection for entities sharing defensive measures and indicators of compromise. CISA aggregates data from its Joint Cyber Defense Collaborative (JCDC) partners, commercial sources, and Shadowserver.

CISA's services include:

• Cyber Hygiene program: Continuous active scanning for over 10,000 US organizations, providing regular vulnerability reports with prioritization guidance.
• Notification Lines:
• Administrative subpoena authority: Used to resolve IP addresses to critical infrastructure owners when direct contact information is unavailable. CISA has issued 400 such subpoenas, with 4,000 specifically focused on removing industrial control systems (ICS) from direct internet exposure.
• Install Base program: Collaborates with ICS manufacturers to notify their customers about exposed systems or critical vulnerabilities.
• Known Exploited Vulnerability (KEV) catalog: Notifications are issued when KEVs are detected in an organization's infrastructure.
• Targeted notifications: For confirmed or highly likely compromises (2,300 in 9 months).
• Pre-ransomware notifications: Timely, often out-of-band (e.g., phone calls), due to the assumption that the network may already be compromised and email monitored.
• Telco provider notification letters: CISA provides templated letters to telecom providers to send to their customers regarding potential issues.

CISA is also exploring new initiatives, including using AI for victim identification and advocating for hardware/software producers to publish open EOX files to track and notify about end-of-support (EOS) hardware and software exposed on the internet, which are inherently indefensible.

Demo / Proof of Concept

▶ Watch: Key Challenges: Identifying Victims and Trust (25:30)

While the panel did not feature a live technical demonstration or a real-time proof of concept, the speakers effectively illustrated the data-sharing pipeline through concrete examples of past and ongoing operations. The discussion itself served as a "peel back the curtain" moment, demonstrating the practical application of these processes in real-world scenarios.

Key examples that functioned as de facto proofs of concept include:

• The Socks Escort Takedown: Adam Diament detailed the investigation, domain seizure, and sinkholing operation against the Socks Escort residential proxy network. This operation directly demonstrated how law enforcement identifies, disrupts, and then leverages Shadowserver for victim data collection via sinkholes.
• Automatic Tank Gauge Notifications: Chris Butera highlighted a recent success story where CISA identified 4,200 automatic tank gauges exposed to the internet in the US. Through collaborative notifications, they were able to get half of these critical industrial control systems offline very quickly, demonstrating the tangible impact of their notification programs.
• NCSC's Early Warning System Metrics: Stu W provided compelling statistics, noting that Shadowserver data accounts for 60% of their Early Warning repository and generates over 90% of customer alerts. This quantitative evidence serves as a powerful testament to the system's efficacy and the value of the data pipeline.

These examples, drawn directly from the operational experiences of the panelists, provided clear evidence of how the discussed mechanisms translate into effective cybersecurity outcomes, even without a live technical demonstration.

Defensive Implications

▶ Watch: Future Initiatives & Cross-National Collaboration Models (36:00)

The detailed insights from this panel offer crucial defensive implications for various stakeholders in the cybersecurity landscape:

For Individual Organizations and Network Owners:

1. Enroll in National CERT Services: Organizations should proactively sign up for national early warning systems and cyber hygiene programs offered by their respective national CERTs (e.g., NCSC's Early Warning, CISA's Cyber Hygiene). This requires providing accurate internet-facing IP ranges, ASNs, domain names, and reliable points of contact. This is the most direct way to receive timely notifications of compromise or vulnerabilities affecting their assets.
2. Develop Robust Incident Response Plans: The receipt of a notification, particularly for pre-ransomware or targeted compromises, demands rapid action. Organizations must have established incident response procedures to triage, verify, and respond to alerts from their national CERTs efficiently. This includes processes for out-of-band communication, as threat actors may monitor compromised networks.
3. Address End-of-Support (EOS) Software and Hardware: Chris Butera's emphasis on EOS products highlights a significant vulnerability. Organizations must implement aggressive asset management strategies to identify and retire or upgrade internet-facing systems running unsupported software and hardware. They should also advocate for vendors to publish open EOX files to facilitate better tracking of product lifecycles.
4. Verify Notification Legitimacy: Be prepared for "cold calls" from government agencies or CERTs regarding potential compromises. Establish internal protocols to verify the identity of the notifying entity (e.g., checking official websites, calling a known watch floor number) to avoid mistaking legitimate warnings for social engineering attempts.

For National CERTs / CSIRTs:

1. Establish or Enhance Early Warning Systems: Emulate successful models like NCSC's Early Warning and CISA's Cyber Hygiene. Consider platforms like Arctic Hub for data normalization and management. Prioritize data integrity and actionable intelligence to avoid alert fatigue among constituents.
2. Foster Partnerships with Law Enforcement and Intermediaries: Actively engage with law enforcement agencies (local and international) and non-profit data providers like Shadowserver. Trust relationships are paramount for receiving high-value, sensitive data from takedown operations.
3. Develop IP Ownership Resolution Mechanisms: Address the persistent challenge of identifying asset owners from IP addresses. Explore legal frameworks like CISA's administrative subpoena authority or establish programs that encourage organizations to voluntarily register their IP space. Partner with telecom providers to facilitate customer notifications.
4. Explore International IP Space Sharing: Consider replicating the NCSC-Shadowserver pilot program. By establishing agreements that allow the sharing of extended IP space (including international holdings) with trusted intermediaries, CERTs can ensure their national companies receive comprehensive global coverage for threat notifications.
5. Promote Public-Private Collaboration: Initiatives like CISA's JCDC and NCSC's Industry 100 scheme demonstrate the power of bringing together government, intelligence, and industry expertise. These collaborations build a unified threat picture and accelerate problem-solving.
6. Focus on Critical Sectors: CISA's efforts to remove industrial control systems (ICS) from the internet and partner with manufacturers illustrate a targeted approach to protecting critical infrastructure. CERTs should identify their nation's critical sectors and tailor defensive strategies accordingly.

Key Takeaways

• Formalized Data-Sharing is Crucial: Effective victim notification post-law enforcement takedowns requires a more formalized and trusted data-sharing pipeline involving law enforcement, non-profit intermediaries, and national CERTs.
• Non-Profit Intermediaries are Indispensable: Organizations like The Shadowserver Foundation play a vital role as trusted, non-profit conduits, enabling law enforcement to share sensitive victim data globally and efficiently through mechanisms like sinkholing and Special Reports.
• Early Warning Systems Drive Risk Reduction: National CERTs' early warning systems (e.g., NCSC's Early Warning, CISA's Cyber Hygiene) are highly effective in delivering timely, actionable threat intelligence, significantly reducing victim dwell time and overall risk. Shadowserver data makes up a substantial portion of these alerts (e.g., 90% of NCSC's alerts).
• Addressing IP Ownership is a Key Challenge: Identifying the ultimate owner behind an IP address for notification remains a significant hurdle, requiring legal authorities (like CISA's administrative subpoenas), voluntary sign-up programs, and partnerships with telecom providers.
• Collaboration is Paramount: Successful cyber defense relies heavily on multi-stakeholder collaboration—between law enforcement agencies, international partners, non-profits, and public-private sector initiatives like CISA's JCDC and NCSC's I 100 scheme.
• Proactive Measures Enhance Resilience: Actively managing and removing end-of-support hardware and software from internet exposure, as well as leveraging innovative data-sharing models like the NCSC-Shadowserver extended IP space pilot, are critical proactive steps for improving national cybersecurity posture.

About the Speaker(s)

The panel comprised a diverse group of experts representing different facets of the cybersecurity ecosystem, from law enforcement to non-profit data sharing and national cybersecurity defense.

• Tod Eberle (The Shadowserver Foundation): As the moderator, Tod guided the discussion, leveraging his expertise from The Shadowserver Foundation, a non-profit organization dedicated to collecting, analyzing, and disseminating threat intelligence to make the internet safer.
• Adam Diament (Special Agent, Defense Criminal Investigative Service (DCIS); Task Force Officer, FBI): Representing the law enforcement perspective, Adam provided insights into the investigative processes, takedown operations (such as the Socks Escort botnet), and the legal frameworks involved in seizing criminal infrastructure and gathering victim data. DCIS investigates crimes impacting the Department of Defense.
• Stu W (NCSC): As a representative from the UK National Cyber Security Centre (NCSC), Stu detailed the agency's role as a national CERT, focusing on their highly successful Early Warning tool and the processes for actioning threat data to raise the cybersecurity floor across UK organizations.
• Stewart Garrick (Shadowserver): Stewart contributed to the discussion by elaborating on Shadowserver's technical capabilities, including its role in supporting law enforcement takedowns, operating the Registrar of Last Resort, issuing Special Reports, and maintaining the public dashboard for aggregated statistics.
• Chris Butera (CISA): From the Cybersecurity and Infrastructure Security Agency (CISA), Chris outlined CISA's mandate to protect US critical infrastructure and federal civilian government networks. He discussed CISA's Cyber Hygiene program, various notification lines, the use of administrative subpoenas, and initiatives like the Joint Cyber Defense Collaborative (JCDC).