Necurs ran for the better part of a decade before anyone managed to slow it down.
It was one of the largest spam botnets ever assembled, a network of compromised machines pushing pharmaceutical scams, pump-and-dump stock schemes, fake job offers and ransomware into inboxes around the world. Researchers had mapped it. Enforcement agencies knew what it was. Identification was never the hard part. The architecture was. Necurs was built to regenerate, and every time someone knocked out its command servers, the malware generated a fresh batch of domain names and rebuilt itself somewhere else.
What finally interrupted it was not a raid. It was a lawsuit.
The theory came out of a litigation team working alongside Microsoft’s Digital Crimes Unit, one that included Gabriel Ramsey, then a partner in the litigation and privacy and cybersecurity groups at Crowell & Moring in San Francisco. Rather than treat the botnet strictly as a criminal problem for prosecutors, the team argued it was also a trademark problem. The malware and the spam it generated misused Microsoft’s marks. That handed a federal court something familiar to reason from, and a basis for injunctive relief pointed at the infrastructure itself.
Then came the part that made the case unusual.
Working with partners across multiple foreign jurisdictions, the team moved to take control of more than six million internet addresses that Necurs was algorithmically scheduled to use when it tried to rebuild. Registered in advance. By the plaintiffs. The Daily Journal, which named Ramsey a Top Intellectual Property Lawyer in 2021 and again in 2022, singled out that work when it profiled him.
Why the courtroom, and why the strange remedy
There is a basic problem with damages in a cybercrime case. There is usually nobody to collect from. The defendants are pseudonymous, offshore, judgment-proof, or all three at once. A money award against John Does 1 through 10 is a piece of paper.
Equitable relief works differently. An injunction can be aimed at the thing doing the harm rather than the person doing it, and courts have centuries of practice bending equitable remedies to facts nobody saw coming. That flexibility is the entire argument. It is also the argument Ramsey put in print.
In May 2023, he co-authored a piece in Lawfare with Amy Hogan-Burney, then a general manager in Microsoft’s Digital Crimes Unit. It was a direct response to a 2021 Lawfare essay by two academics who had argued that botnet takedown jurisprudence stretched courts’ equitable powers too far, exposed third parties to risk, and should give way to international governance frameworks instead.
Ramsey and Hogan-Burney pushed back, though not in the way you would expect. They did not claim civil litigation solves cybercrime. Their position was narrower and considerably more honest than that: no single tool solves it, legal or technical, and the global framework the critics preferred does not exist yet. Civil action is imperfect. It is also available right now. And even when a disruption suit fails to permanently dismantle criminal infrastructure, it slows the rebuild and drives up the cost of running the operation.
The argument was never that the courtroom is the answer. It was that the courtroom is a tool that works, and that waiting for a better one is not a strategy.
A practice built on unsettled ground
The Necurs matter was not an outlier in Ramsey’s work. It was the pattern.
Across roughly 24 years as a partner at Orrick, Herrington & Sutcliffe and then Crowell & Moring, his docket kept landing in places where the technology had outrun the statute book. Open-source licensing disputes. Trade secret theft that crossed borders faster than discovery could follow. Data breach enforcement. Internet investigations involving fraud and deceptive activity. Cases about video games, cloud infrastructure, networking protocols and entertainment content, argued in front of judges who often had to be walked through the underlying systems before the legal question even made sense.
That work pulled him outside the courtroom regularly. Ramsey engaged with branches of the United States government and foreign governments on behalf of clients, which is less a litigation skill than an operational one. Cross-border enforcement does not run on briefs. It runs on registrars, hosting providers, agencies and counterparts in a dozen jurisdictions agreeing to move at roughly the same time.
Coordinating that is a project management problem wearing a legal costume.
The through line
Strip out the technical detail and a consistent method shows up in the record.
Start with the harm rather than the doctrine. Find the legal theory that fits the facts instead of forcing the facts into a familiar theory. Accept a partial, imperfect remedy that works today over a comprehensive one that might exist in a decade. Build the coalition needed to make the remedy real, then execute it on a schedule.
That is not a description of a specialist. It is a description of an operator, and it explains why the recognitions Ramsey collected tended to use words like innovative and trailblazer rather than simply experienced. The novelty was rarely in the law itself. It was in noticing that a tool built for one purpose would hold up under a completely different load.
Necurs is the clean example. Trademark law was not written with botnet command and control infrastructure in mind. It worked anyway, because someone looked at a piece of ordinary commercial law and saw a lever.
Gabriel Ramsey spent roughly 24 years as a litigation partner at Orrick, Herrington & Sutcliffe and Crowell & Moring, where his practice focused on technology, intellectual property and cybersecurity. This piece is a retrospective. The matters described are drawn from public reporting, published commentary and court records.
Click Here For The Original Source.
