It wasn’t Russia, or China, or any other nation-state. The motive wasn’t political. The IoT-based Mirai botnet was created by three young American men as a tool for crippling Minecraft servers and related services.

Of course, once Mirai’s authors realized the unprecedented power of their creation, they started using it for other things: as a tool for gaining customers for an anti-DDoS service; to kick Brian Krebs’ web site off the Internet as revenge for outing the authors of vDOS; and later as a lucrative click fraud engine.

Last week, in a courtroom in Alaska, Mirai’s creators all pleaded guilty to charges related to Mirai, including conspiracy to violate the Computer Fraud and Abuse Act (CFAA). FBI agents had tracked the botnet’s activities to the trio.

While I’m happy that these assholes have been caught, and are likely to spend significant time behind bars, Mirai is a sobering reminder of the fragility of the Internet. The earliest version of the Internet was ARPANET, which was literally designed to withstand nuclear attack. But even nukes can’t compare with the power of smart, young people with plenty of spare time. Not long after the Internet was born, a college student named Robert Morris brought the nascent network to its knees with a simple software worm.

Meanwhile, because the Mirai authors shared the botnet’s source code (in a futile attempt to confuse investigators), Mirai clones are popping up regularly, and doing a lot of damage.

Still, it’s encouraging to see that the FBI and other agencies are getting better at tracking the perpetrators of these malicious schemes. Other recent arrests include the person behind an attack on Deutsche Telekom that used a Mirai variant; and the operator of the Kelihos botnet. Hopefully these arrests will provide a sufficient deterrent for those similarly inclined.