Botnets, which are computers controlled by malicious hackers, currently represent the most serious threat to the digital ecosystem, providing the infrastructure to commit bank fraud, distributed denial of service attacks (DDoS), or click fraud. During the past few years, two main approaches have been used to fight botnets : First, police organizations have arrested high profile hackers and dismantled their command and control systems. Second, some countries, more precisely Japan, South Korea, Australia, the Netherlands and Germany have encouraged public-private partnerships involving Internet service providers and anti-virus companies. Inspired by regulatory principles, these initiatives seek to identify infected computers, notify their owners and help them clean their machines. This article compares these two approaches (criminalization vs. regulation) by trying to establish their respective effectiveness with respect to securing the digital ecosystem.