There, two servers were seized - servers alleged to be "the command and control computers of two Zeus botnets". As you may know, a botnet is a network of computers (usually PCs running Microsoft Windows) that have had vulnerabilities exploited to allow remote attackers to gain control. Once in control the subverted PCs are made part of a network (botnet) that can be used for a variety of illegal purposes, including DDOS attacks, spamming, spreading worms/viruses, and crack/infiltration attempts against other machines. Usually in a botnet each member PC operates independently but periodically checks with controlling servers for new instructions, updated malware, and so on.

So far this is standard security stuff, and Microsoft was working with Kryus tech which, according to a blog entry posted Friday, had reverse-engineered the botnet software to discover where its control hubs lay.

The Copyfight angle appears to be that Microsoft made the assertion (and presumably convinced a judge) that it was entitled to enforcement action against these Zeus botnet servers because one effect of the botnet was to "violate [Microsoft] copyrights and trademarks" by taking over the Windows PC. It's an interesting twist but one I haven't seen before.

I'm a little bit conflicted here - I don't generally think that ends (even good ones like silencing botnets) justify means, including potentially novel expansion of copyright and trademark enforcement. Looking back in history (e.g. see this story from Sept 2011) it appears that Microsoft has used other means in the past to move against botnets. So this may be a new tactic in their ongoing fight, or it may be just new-to-me. Does anyone know if this is truly a novel application of the law?

(Update: the Microsoft Digital Crimes Unit blog entry from yesterday has a bit more detail but does not touch on the copyright/trademark aspects of the RICO case.)