Making ISPs more proactive is only doable with either heavy restrictions what communication is allowed or heuristics (that fail). That sounds like anyone out of the ordinary (so a majority of this site's users) will get flagged as suspicious. The fun thing is that I've seen both methods already applied and either me or someone I know has been encumbered by them.
There's not a single piece of me that feels that this would somehow end up positive in total.
And everybody on the Internet knows this. When somebody brutes your login page or SSH server, what do you do? Nothing. It should be trivial to report IPs and timestamps back to ISPs. Many ISPs are already required to log connections at some level (destination and port) so this stands to verify the abuse report. Get a number of these shoot through for a single customer (IPs are unimportant at this point), and it's time for a nasty conversation.
The machinery to make this work already exists. It's the ISP that's the problem. Threaten non-compliance of continued abuse (or a lack of reduction in botnet activity, whatever) with disconnection to the parent peer, so the ISP takes it seriously, and we'll see reporting rates rocket.
Monitored at local level (FCC, Ofcom, etc), per existing ISP complaints.
But yeah, no ISP is going to do this without serious threat of action.
I'm sure there is still scope for abuse, but letting ISPs ignore abuse reports isn't working out well for the rest of the internet either.
But yes, maybe attaching some real personal perjury liability —unlike the watered down DMCA abuse liability— might be a good idea. Good network admins know what abuse looks like and have logs to corroborate.
I do see your argument for a slippery slope, but in this case the example given is clearly in the core competency of the company. There's no morals needed; this is how the internet is supposed to work, and you've bypassed that. Kick him out.
We don't think about slippery slopes when a renter starts burning the house down; it's clearly within the homeowners rights to start evicting.
The process of deciding that sort of law would be awful but if everybody focussed on serious and network focussed crime and not protecting Mickey Mouse et al, something good could come from it.
But you are probably right. The US —esp with current leadership— could very easily force protectionist terms on others. Nobody would want to be separated from the US. Switzerland would have no leverage. African countries would have no leverage. The EU and China might have a chance, but the latter especially stands to lose a lot more than it could gain. China still needs access to a global market.
It's definitely has potential to be deeply insidious. But with the value of the network, I'm just surprised people aren't suggesting more things like this.
To be clear, I'm not advocating this. I just see it as an inevitability.
There clearly is appetite at most levels of government for a restricted internet. Obvious crime, paedophilia, terrorism, etc but increasingly, you're seeing direct-to-consumer sites like Alibaba and Wish flogging knock-off crap over borders without paying taxes, without consumer safety checks and often without having license to make and sell that stuff in the first place.
It's not going to be long before somebody legislates that you're only allowed to peer a network if you agree to cut anybody off who enables that, including other peers who ignore abuse across their network. It'll effectively limit what "the internet" is allowed to contain. Essentially embargoing bad actors and those that enable them, and all in a very pro-active way.
It will —and should— put the fear of iJesus into consumer ISPs. They could easily cut off customers with computers operating within botnets, alerting them to infections, etc. At the peril of having your peerings cut off, you'd expect them to be a lot more pro-active too.
I honestly don't how I'd feel about this. It seems safer but if life has taught me anything, that usually just means it's not, and somebody's just quietly getting rich in the corner.