Internet service providers are today largely immune from liability for their role in the creation and propagation of worms, viruses, and other forms of malicious computer code. In this essay, we question that state of affairs. Our purpose is not to weigh in on the details – for example, whether liability should sound in negligence or strict liability, or whether liability is in this instance best implemented by statute or via gradual common law development. Rather, our aim is to challenge the recent trend in the courts and Congress away from liability and toward complete immunity for Internet service providers. In our view, such immunity is difficult to defend on policy grounds and sharply inconsistent with conventional tort law principles. Internet service providers control the gateway through which Internet pests enter and reenter the public network. Service providers should therefore bear some responsibility not only for stopping malicious code but also for helping to identify those individuals who originate it.