Where Internet attacks come from

On the eve of a possible “D-Day” for the Conficker worm, there’s new data out from Akamai underlining the point that not all Internet attack traffic originates in Russia or China, despite articles about “GhostNet” and the like. For Q4 2008, Akamai’s data suggest the top originating country for attack traffic was the U.S. (23% of traffic), with China a few percentage points behind (19%). Akamai does note that this represents a shift from previous quarters in 2008, in which the U.S. played second to China or Japan.

What Akamai’s study offers is some perspective and perhaps a question. The figures merely point out that Internet attack traffic is not so much a function of any national characteristic except Internet penetration. To be fair, the study doesn’t show where the constitution of attack traffic may vary across countries – which attacks have tacit state support and which are merely criminal. But that in and of itself raises the question as to whether the greater threat to any single country’s Internet infrastructure, over time, is from other countries (i.e., the “digital Pearl Harbor” scenario) or from the sheer volume of always-active cybercrime. It’s a decent bet to suggest that the recession will give more impetus to the latter.