Panel: From Takedown to Touchpoint: An Inside Look at the Data-sharing Pipeline in the Victim ...
summary
Describes how law enforcement seizes domains and redirects traffic to sinkhole redirection run on Shadowserver name servers to enumerate live victims, how Shadowserver pushes high‑integrity feeds to 175 countries and into a UK early warning system with 16 feeds and 16,000 orgs subscribed, and how CISA-style programs send 4,300 notifications (including 400 administrative subpoenas and 2,300 targeted alerts) in nine months. Highlights obstacles: cross‑border data ownership, verifying recipients, IP ownership, and a pilot that finds 4,200 exposed tank gauges and removes half.
AI-written summary · about
chapters (15)
- 0:00Data-sharing pipeline intro
- 1:25Law enforcement roles overview
- 3:07Takedown process explained
- 7:26Botnet disruption methods
- 9:12Shadow Server's support role
- 12:28UK NCSC data processing
- 19:51SIZA's data methods
- 25:44Victim ID challenges
- 29:15LE victim notification challenges
- 31:40Shadow Server reports & dashboards
- 34:28Notification legitimacy & future plans
- 36:39UK-NCSC & Shadow Server pilot
- 38:21Securing ICS collaborations
- 39:24Public-private cybersecurity partnerships
- 41:36Q&A
related talks
01h 27mOpen Data (OSINT) and Threat Intelligence Sharing Platforms and Tools
48mThey Hide, We Seek: Leveraging Global Partnerships Against Our Adversaries
41mThe Art of Threat-Informed Sharing: Real-life Use Cases from NSA
01h 00mHack to the Future
40mTotal Security: Investigative Perspectives from Public to Private Sector
01h 27mSecuring at Scale Building Resilient Defences for a Growing Digital World
27mCollect All the Data; Protect All the Things
50mFrom Attribution to Accountability: Upholding International Rules Online