To implement effective security, the entities best equipped to do so, the Internet service providers, must take the lead. They are technically savvy organizations with the ability (more or less) to protect users and detect abusers; they have a direct (though impersonal) relationship with their users; and they compete for users’ business, so that, unlike governments, they will suffer if they perform badly.