StopBadware Blog

As we worked on our Best Practices for Web Hosting Providers, a common refrain we heard was, “What about best practices for reporting badware URLs?” So, we pulled together another great working group and started figuring out what elements make a report of a badware URL most likely to get the URL cleaned up or taken down. After several virtual meetings, we have a draft to share with you for your feedback.

Download the draft as a Word doc (.docx) or as a PDF.

We welcome any feedback you have on this draft. In particular, we’re interested in thoughts on the following:

1. Are there better ways to identify the proper targets of the reports than those outlined in Practice 2?
2. Are there other critical pieces of information that could be included in the list in Practice 3?
3. Do you have suggestions for other escalation parties and/or guidance in Practice 5?
4. Are the sample notifications in the appendix easy enough to follow? Is there anything you would change about the format?
5. Should we also recommend an XML data format for reporting? If so, should it be based on an existing standard like IODEF, the Malware Metadata Exchange Format, the Mail Abuse Reporting Format, or something similar? Which one, and how would you recommend simplifying otherwise complex formats for the relatively simple job of reporting malware URLs for takedown/cleanup?

We would appreciate your feedback here in the comments or via email to contact\at\stopbadware\dot\org by Friday, September 16.

When we at StopBadware released our best practices for web hosting providers back in March, we wanted to lay out a framework that helps providers address badware reports responsively and comprehensively while retaining the flexibility they need to function as businesses in a competitive market. Legal liability is a major concern for any business, and since addressing badware issues is often a tense and trying process, we wanted to determine the state of the law governing providers’ liability for hosting malicious content on their networks. How would adopting the Best Practices affect a provider’s legal risk? We consulted the Cyberlaw Clinic at the Berkman Center for Internet & Society for guidance.

We’re pleased to shed some light on the issue in our new white paper, Web Hosting Provider Liability for Malicious Content, which we are releasing today as a complement to our Best Practices. The paper confronts three major issues:

• Are providers generally liable for hosting badware?
• Do providers become liable for hosting badware when they receive a badware report?
• Can providers become liable when responding to a badware report?

The white paper is based on general principles of U.S. federal case law and is, of course, offered as an informational resource only. You can read the paper here (PDF).