However, not everyone in the security research community was happy with how the takedown effort was implemented.
Shortly after the takedown, a security researcher who runs the abuse.ch botnet tracking services estimated that around 1,000 of approximately 4,000 Citadel-related domain names seized by Microsoft during the operation were already under the control of security researchers who were using them to monitor and gather information about the botnets.
Furthermore, he criticized Microsoft for sending configuration files to Citadel-infected computers that were connecting to its sinkhole servers, saying that this action implicitly modifies settings on those computers without their owners' consent. "In most countries, this is violating local law," he said in a blog post on June 7.
"Citadel blocked its victims' ability to access many legitimate anti-virus and anti-malware sites in order to prevent them from being able to remove the malware from their computer," Boscovich said on June 11 in an emailed statement. "In order for victims to clean their computers, the court order from the U.S. District Court for the Western District of North Carolina allowed Microsoft to unblock these sites when computers from around the world checked into the command and control structure for Citadel which is hosted in the U.S."