IGF-USA workshop on e-crime and malicious conduct in the DNS: Let the punishment fit the e-Crime

A person walks into a bank with a gun. The town falls silent, the cops circle the bank with their own guns drawn and a silent standoff punctuated by bull-horn-augmented persuasions ensues. Once apprehended, that person subsequently faces criminal charges and most likely, imprisonment. The same consequences must be paid by criminals who carry out e-crimes like phishing and the creation of malware. That is the view of Rodney Joffe, senior vice president and chief technologist for Neustar.

Joffe was part of a 9-person panel discussing E-crimes: Fraud and Abuse in the domain name system at IGF-USA in Washington, D.C., Oct. 2, 2009.

Greg Aaron, key account management and domain security for Afilias, said malware is the most prevalent and dangerous problem on the Internet. Another problem, though it may also be a blessing, is that no one owns the Internet, which means that no one is in charge.

Criminals always seem a step ahead, said Alexa Raad, CEO of Public Interest Registry and board chair of the Registry Internet Safety Group (RISG). Everyone should stop looking after just his or her piece of the pie, Raad said, and instead focus on taking responsibility for other sections.

More inventive forms of fraud are being unleashed on the Web, particularly against social networks, Fred Felman said. Felman is the chief marketing officer for MarkMonitor.

Malicious behavior is an abuse of trust, said John Berryhill, intellectual property attorney. Trust in one another is not a transitive property.

-Ashley Barnas, http://www.imaginingtheinternet.org

IGF-USA panel on critical Internet resources: Evolution of the Internet’s technical foundations

The 2009 IGF-USA session description of this panel is: “Critical Internet Resources (CIR) and the evolution of the Internet’s technical foundations are a central theme of Internet governance debates. Three foundational technological changes – IPv6 (the ‘new’ version of the protocol for the Internet); secure DNS (domain name system security) and secure routing – will underpin the dialogue between key experts from the Internet community, business and government. The successful implementation of these technologies can expand and improve the security of the Internet’s core infrastructures, but deployment raises significant challenges for Internet infrastructure providers and policy makers, and has implications for governance arrangements.”

Brenden Kuerbis, operations director for the Internet Governance Project, based at Syracuse University, served as moderator for a panel that included Alain Durand, director and IPv6 architect, office of the CTO of Comcast; David Conrad, VP for research and IANA Strategy for the Internet Corporation for Assigned Names and Numbers (ICANN); Fiona Alexander, associate administrator, National Telecommunications and Information Administration, U.S. Department of Commerce; and Stephen Ryan, general counsel for the American Registry for Internet Numbers (ARIN).

Kuerbis noted that documents drawn up during the World Summits on the Information Society suggest that critical Internet resources should be managed through global agreements.

“In the third year of IGF, control of CIR was raised forcefully by a member of the Chinese delegation,” Kuerbis said.

Going forward, the management of critical Internet resources is likely to become more contentious.  – Brenden Kuerbis

He noted the implementation of IPv6 and attempts to introduce more security will complicate the management of CIR.

David Conrad said there are critical Internet resources at all layers of the Internet infrastructure. Not all are being discussed at IGF. “You need electricity, you need IP addresses, routing infrastructure, ports,” he said. “In my experience in the IGF context the focus has only been on a select set of resources – those that are involved in what ICANN does. Electricity is more important than whether or not you can get a domain name. There is a focus on the developed world.”

He added that DNS security and routing are important topics that once again tend to have the policy dialogue centered around ICANN. “It is a place where most of the decisions are made around critical Internet resources – it is a community, just like the RIRs are communities that develop policies in a community-driven, bottom-up process. I encourage you to participate in these meetings.”

Stephen Ryan of ARIN discussed the Regional Internet Registries and their role in CIR. There are five recognized registries located in regions around the world. They were established in the 1990s. He said each “develops policies in its own regions regarding Internet numbering and associated issues.” The leaders of the five registries also meet to set common global policies. The boards are voluntary, and anyone is invited to participate in the process of governing the RIRs. These organizations provide Whois service and assign and give out numbers – IP addresses.

There was some discussion of the fact that IPv4 addresses are being depleted. This was anticipated years ago, and IPv6 is being adopted. “What’s our biggest challenge in regard to critical Internet resources?” he asked. “The numbers resources and the switch to IPv6. The fixed number of IPv4 numbers the free pool of remaining IPv4 resources is small.

Clearly we’re going to have to run IPv4 and IPv6 systems in tandem and that’s going to cause problems. Not many people in America understand IP numbers and that their modems won’t work.  – Stephen Ryan

He closed by smiling and saying, “Buy Cisco stock, that’s a tip.”

Alain Durand of Comcast spoke as a panel member who could speak to the CIR concerns of large technology companies.

We are trying to actively participate. The bottom-up policy process has been successful. It has been flexible enough to meet all of our demands and we would like it to go on.  – Alain Durand

The depletion of IPv4 addresses is of concern, he said. “If you are a large service provider with many customers and you are growing you are going to be impacted more than individual users,” he said. “We have been concerned about imbalances between the RIRs in the world and that is why we have been participating in RIPE discussions, LACNIC discussions and participated in this process as a member of the community.”

Fiona Alexander of NTIA agreed that too much of the discussion of the World Summit on the Information Society text is absorbed by “people’s preoccupation with the domain name system.”

“The network is so decentralized,” she said in reference to the global Internet and the people engaged in working toward its evolution, “but the one organizing group everyone recognizes tends to be ICANN. When you read the WSIS text it explicitly says there are things beyond domain names. We should look at other things as a national priority and as we go into the global discussion of critical Internet resources.”

She said people in government are recognizing they need to understand the layers of architecture to understand its evolution and address needs.

“As the discussion is progressing in our own government about issues related to Internet or telecommunications you really have to understand the network architecture to make smart policy.

You have to more and more understand the different layers of this network. Governments are listening they are interested in these issues.  – Fiona Alexander

She added that governments know the uptake of IPv6 is important. “This is on the agenda of governments,” she said. “Our own government is struggling with this. We are working closely with NIST as we look at these issues – it helps that we are both in the Department of Commerce. It’s one of the things we are looking at as we assess the transitions that are fundamental to the network.”

-Janna Anderson, http://www.imaginingtheinternet.org

CONCLUSIONS: ‘What We Don’t Know About the Future of the Internet’ Rainie and morning plenary respondents finish the session

The panelists answered questions about finding ways to satisfy desires of people to share freely but somehow pay an appropriate price for the information they gain. “Most in my generation won’t want to pay for things because they are used to things being free,” Gyllenhaal said. “Young people will pay for things we use. I guarantee young people would pay for Facebook. It has become that important for us.”

Andrew McLaughlin came into this discussion in support of the principles many, including Chris Anderson (author of “Free: The Future of a Radical Price” and originator of the “Long Tail” idea in Internet economics), have brought to the forefront of the discussion of Internet economics. “Free doesn’t really mean ‘free,’” he said. “We have lots of media now that is free to the end-consumer in exchange for attention or something that benefits someone else. There will be things you are asked to pay for and things that third parties are asked to pay for.” He added it is important to find ways to properly “vindicate intellectual property rights” online and also address privacy, anonymity and authentication in the right way. “I find the ‘free’ debate to be kind of dissatisfying,” he said. “Free to the end-user still leaves you a broad way to pay for things.”

Lee McKnight noted that the issue is complicated. “It’s not just an issue of free and for-pay, there are barter arrangements that come into play as Internet governance has been progressing in these historic days,” he said. “Economic and competition policy will come to the fore… This is a ripe area for policy analysis and discussion at IGF in Egypt and over time as we continue to grapple over challenges.”

Rainie was asked about education and the Internet as an audience member noted how far behind education is in implementing the advantages of the Internet. “Participation matters,” he noted, saying it has been shown that students enjoy the ways in which they can be more active participants in their education when they can go online in classrooms.

McLaughlin chimed in. “The federal government is a disaster when it comes to using these new tools,” he said, noting that it blocks employees’ use of social networks.

“I hope that people less freaked out by these networks and systems will start running things,” he said, adding that every government employee should have a home page offering information they want to share and affording them the ability to collaborate with others in government. “That would drive a culture change that would be unstoppable,” he said, “and you would get the efficient task-oriented government we are trying to achieve.”

-Janna Anderson, http://www.imaginingtheinternet.org

Response from Marc Rotenberg, EPIC, to Lee Rainie’s ‘What We Don’t Know About the Future of the Internet’

Marc Rotenberg of the Electronic Privacy Information Center noted that he began working more than 15 years ago through a group called The Public Voice to promote positive decisions about the Internet – before the WSIS and IGF processes began – in order to get civil society involved in global decisions. “We felt it was important to have the voice of civil society in these discussions,” he said.

He joked that Lee Rainie’s talk was an unusual thing to see in Washington, D.C., because he admitted to the things he didn’t know about. Then he got serious. “Lee’s survey is particularly helpful, because it helps us understand both what we know about the Internet, people using the Internet, where the gaps – for example – exist in access to broadband –  and then on some of the more difficult questions, really what we don’t know yet. These are questions we need to ask and look more closely at, and that’s enormously helpful.” he said. “I am very glad Lee used the ‘P word,’ which is not ‘privacy,’ it is ‘paradox.’ Because, increasingly, as we look at issues related to Internet policy we see a lot of paradox.”

He noted the conflicting desires people have to share things while also maintaining privacy online. “Try to friend your kids on Facebook,” he joked, “and you will get an instant lesson on the ongoing value of privacy.

Even though people put out all of this personal information, they still feel that they want to exercise some control over it. They don’t have a view that, ‘Oh, gee, I’m a data exhibitionist – everyone come and take a look.’ Their view is much more like, ‘Here’s a photo of my friend from the party last week, you four guys gotta check this out.’ It’s this desire to want to exercise some control over digital identity that is actually framing many of the big debates that are happening today in the online world.  – Marc Rotenberg

He said when young people formed a protest group to dispute changes in Facebook’s terms of service it was a sign of their conflicted feelings. “To me, that was entirely a debate about privacy,” he said. “I don’t mean to go all Habermas on you, but this ability to negotiate public and private spaces is an essential part of the human condition and we’ve been doing it forever, from the village to the city to new communication networks to online communities  and I don’t think anything there has changed. I just think you’re seeing it presented in a new way.”

He said transparency of government should be accompanied by government respect for individuals’ privacy. “A second paradox is the relationship between privacy and transparency,” he noted, saying that governments should be making their work more transparent.

There’s no contradiction whatsoever between saying a government should be open and accountable for what it does and it still has to respect the privacy of the personal information it collects about its citizens about the information it collects about citizens. That’s one of the big challenges we face in the information age – not letting the desire to ensure that the accountability for decision-makers – which is critical for democratic institutions – become an excuse to reveal the private facts of individuals, which really don’t relate to the activities of government.  – Marc Rotenberg

He noted that there is a convergence of all of these concerns that leads to a need for a declaration of rights. “There has to be a discussion about a bill of rights for Internet users – we have to begin the discussion about protecting the fundamental rights and freedoms of people who go online,” he concluded. “It’s a overdue debate.”

-Janna Anderson, http://www.imaginingtheinternet.org

Response from Randy Gyllenhaal, Elon University, to Lee Rainie’s ‘What We Don’t Know About the Future of the Internet’

Randy Gyllenhaal, the panel respondent representing young people, is a member of the documentary journalism crew reporting at IGF-USA for Imagining the Internet. He supplied the transcript of his contribution:

I’m no expert on the ins-and-outs of Internet politics, but I do fully understand my generation’s infatuation with being connected.

From the youngest age, we have understood what it means to be plugged in. We have grown up right alongside the Internet, more than any other generation… Instant messenger was introduce in middle school, MySpace came about in high school, YouTube and Facebook just in time for college…

I remember my first e-mail address, my first screen name, my first MySpace and my 4th MySpace.

But something Mr. Rainie said made me think… when Generation Y comes to power, how will we look at issues like copyright and information ownership?

As the Internet evolves and matures, we must evolve and mature with it – not something you’d expect to hear from a young person.  – Randy Gyllenhaal

It’s been ingrained in our heads that the Internet is free. Napster taught us that music can be free, CNN.com taught us that news can be free – we’ve never had to pick up a newspaper in our lives.

Even TV can be free… yesterday I told my roommate to watch the new episode of “House” on Hulu… he said he didn’t want to sit through 30 seconds of ads…and would watch it on Ninjavideo…a site that streams TV and movies illegally. 30 seconds, that’s how A-D-D we are… it’s too much to bear.

My generation must grow up, and start taking responsibility for such a powerful tool that is the Internet. Nothing is free. The current model is not sustainable. Maybe I understand this more because I plan on going into journalism…but I hope others my age feel this way as well.  – Gyllenhaal

We want more Internet. We want cloud computing, we want mobile everything, we want it now, we want it fast, and we want it free. But in the future, it can’t be free, can it?

Young people are totally in favor of expanding the Internet and creating more outlets for information. I just wonder if we’re willing to pay for it.

– http://www.imaginingtheinternet.org

Freedom of expression in a Web 2.0 world; Future is not all positive – new tools have limited impact where controls are in place

The Internet Governance Forum-USA workshop on “The Freedom of Expression in a Web 2.0 World,” was built to assess the whole idea of Web 2.0, and the tangent that the panel took grew increasingly bleak in outlining the limitations of new Internet technologies. They said Web 2.0 isn’t all roses. It’s not a park that simultaneously serves as a playground and the ultimate conduit of democracy, it won’t single-handedly save the world and it won’t always be used to better the lives of citizens in the U.S. or abroad.

Rebecca MacKinnon, a co-founder of Global Voices, assistant professor at the University of Hong Kong and previous CNN bureau chief in Beijing, was particularly stern in extinguishing the optimism that emerged during the summer as a result of the contested Iranian election and the subsequent temporary uprising that was partially fed by social media, especially Twitter.

“There’s a naivete that capitalism plus Internet plus Twitter equals democratization,” MacKinnon said, later adding that democracy isn’t inherently going to spread just by handing software to dissidents.

MacKinnon’s extensive experiences with the Chinese government’s attitude toward the Internet provided a stark paralell to the stated goals of President Barack Obama’s administration, voiced at the IGF by Miriam Nisbet, the first director of the Office of Governmental Information Services.

“It’s rather extraordinary that he spent the first full day in office by issuing memoranda…dealing with the openness of government,” Nisbet said. She next quoted Obama: “All agencies should use modern technology to inform citizens about what is known and done by their government.”

While the stated aim of the U.S. government is to utilize Web 2.0 to open up the government for its citizens, MacKinnon was quick to point out that the Chinese model, which is being increasingly adopted by similarly authoritarian regimes, is built more upon the idea of modern technology helping the government inform itself about its citizens, opening them up to the keen eyes of governmental watchdogs.

In some cases, these crackdowns can be justified. Ambassador David Gross, now a partner at Wiley Rein LLP, leveraged his 25 years of experience in politics and ICTs in the discussion. He told of his experience in trying to encourage a policy of liberalized Internet use to a Tunisian deputy foreign minister. The minister justified his country’s forced limitations on online expression as an extension of the government’s responsibility to protect its people by maintaining social cohesion in a country built up of incredibly factitious factions perfectly willing to fight each other, fights that the Tunisian government asserts would be stoked by open Internet communication.

Robert Guerra, the project director on Internet freedom at Freedom House, roped government surveillance into the increasingly mobile nature of Internet access, particularly in least-developed countries, pointing out that cell phones, by their nature and taking the complicity of the telecommunications industry in conceding to governmental interests for granted, are perfect for authoritarian governments to spy on their citizens. By triangulating a phone’s location, or by utilizing its speakers, receivers and text messages, governments can immediately drop in on any sort of communication deemed to be seditious.

It was agreed that while Web 2.0 has made progress, said progress can largely be credited not to the inherent power of the technology of Web 2.0, but of the lagging pace at which most authoritarian governments have approached the technology, falling behind the counter-culture movement in exploiting the Internet for its own aims.

There’s a reason, MacKinnon said, that China is currently offering to build the Internet infrastructure for several authoritarian countries, because China knows exactly how to receive the economic benefits of increasingly widespread Internet access without suffering the open scrutiny of governments and businesses that one would naturally think would result in concert with an expansion of communications technologies.

Ultimately – running counter to the long-winded, expansive rhetoric that often takes place in discussion panels dealing with governmental policy and communicative ideology – the most apt description of the Web 2.0 element of the world came from Bob Boorstin, director of corporate policy communications at Google, and previous chief speechwriter during President Bill Clinton’s administration.

“These are just tools, and they’re nothing more than that,” Boorstin said, indicating that no matter how many bells or whistles, tweets or status updates we may have, the censorship and free expression citizens endure or desire is ultimately up to their own actions and persistence.

-Morgan Little, http://www.imaginingtheinternet.org

Response from Lee McKnight, Wireless Grids, to Lee Rainie’s ‘What We Don’t Know About the Future of the Internet’

Lee McKnight spoke to the conference remotely, by audio. He noted that this week’s announcement about the U.S. government’s recent decision about how it relates to ICANN is extremely important. “It’s impressive to see some things moving at Internet speed,” he said. “I want to highlight that while this is a first meeting of the Internet Governance Forum-USA, it is a historic day both for that and because of the announcement from NTIA and ICANN in relation to internationalization of the oversight of ICANN. It is a particularly poignant time for us to be coming together.”

He asked the audience to think back a few decades to the days when the Internet was not yet an infrastructure used for commerce, politics and general social interaction. “There was at least a glimmer in Vint Cerf’s eye about where things and how things might evolve, and the Internet Society was created,” he recalled. “I have witnessed and have been fortunate to have played a small part in many new organizations that have come along over time.”

He noted that the Caribbean Internet Forum – a multistakeholder group – has been meeting since 2002. “You can learn from them how to grow the US Internet Governance Forum, which has been sort of a late-comer,” he said. “I want to highlight the value and centrality of the multistakeholder model for global governance in general, and how policy can be made in a flexible manner.”

He noted that there are now many advances being made in the development of personal wireless grids.

The future of the Internet is not the Internet as we think of it now. What I mean is that we are focusing now on the network infrastructure level, which is absolutely central and critical, but where people live is in a world of devices, digital machines around them that are on and off the Internet. They are on mobile devices, on TVs, computers, printers, everywhere around them, and this Internet of things – or all those things and the Internet are merging through mobile and wireless connectivity. This new capability of creating essentially a personal cyberstructure, a personal cloud of your machines, your devices, your content, associated with you through your known identity and trust, securely, is something I have been working on for seven or eight years, and it’s still in its mid- to early days.  – Lee McKnight

McKnight shared briefly about his work with the testing and rollout of personal wireless grids. He noted that in the next few years the Wireless Grid Innovation Testbed, or WIDGIT, will release new technologies for trial, first through universities including Virginia Tech and Syracuse and later to end-users.

He said this could alter the horizon for concerns over privacy and other issues.

“This offers a new capability of creating a personal, trusted, community of your own machines, your own devices, your own friends, across mobile and wireless devices,” he said. “As this comes into the marketplace and enhances user experience, I expect some of these trust and identity issues that are so challenging at the scale of the whole Internet will be addressed. In this personal world, this future architecture is not about securing the entire Internet, it’s about trusting your friends and your friends’ machines.”

– Janna Anderson, http://www.imaginingtheinternet.org

Response from Andrew McLaughlin, White House, to Lee Rainie’s ‘What We Don’t Know About the Future of the Internet’

“Let me drill down on one issue,” McLaughlin responded. “I am pleased Lee highlighted these architectural issues because they tend to not get a lot of attention. The Internet we have today started out as a research network that is now being treated – properly so – as critical infrastructure. The basic considerations that led to the construction of the TCP and IP protocols were to solve a set of issues that arise from the kind of shared data from universities. There are a lot of components that were not built in that, as Lee outlined, would potentially be quite useful for some of the activities that we would like to take place on the Internet. We are now confronting some fundamental choices about, for example, authentication on the Internet.”

He noted that if you want to secure routing you want to know the places you do want to get packets from and those from which you don’t want to get packets, “where, for example, malware or virus attacks might be.” Yet in places where authoritarian structures control infrastructure complete authentication of identity behind and origins of information becomes problematic.

One of the great features of the Internet is that is facilitating a profound flourishing of direct citizen-to-citizen speech in places that don’t have much of a tradition of that or have a tradition of centralized control over information. So you would alter that architecture and build in that authentication at great peril.  – Andrew McLaughlin

He noted that one of the best results of the IGF and ICANN processes is the ways in which they illuminate discussions about the architecture, protocols and principles of the Internet to a much wider audience.

“It was not exactly the original intention for ICANN,” he noted, “but it has been the effect. The project of inculcating a way of thinking about problems with the Internet architecture is profoundly important,” he said, noting that you have to know the language of the architecture to operate in today’s political and economic environment. “Without that understanding, you can’t talk intelligently about cybersecurity, how to protect privacy, how to facilitate authenticated business and governmental transactions, and so forth – well, you can talk intelligently about it, but you will be missing something.”

He noted that the efforts of multistakeholder organizations in shaping an understanding and knowledge of information networks and the people building and scaling them is important.

The role of the IGF and the value of the ICANN process extends beyond the agendas that are typically before them.  – McLaughlin

“The reason these issues are conundrums – the security, authentication, privacy, identity issues,” he said, “is that the Internet is a voluntarily interconnected set of networks. There is no central controlling authority; there is no body, no government that can decree what the technical implementations of the network will be. That fact is part of the fundamental strength of the Internet, part of what made it scale so fast, part of what’s made it so powerful, part of what made it facilitate so much speech and free expression in so many surprising ways in every culture around the world.”

He said in this decentralized environment change must now be accomplished “in terms of nudges, in terms of incentives, in terms of persuasion, rather than by decree.” He added that while the Internet architecture at this point may protect the speech of a “dissident in a repressive society or in our own society,” but there are many Internet transactions now threatened by spoofing, DNS attacks and other threats that would not occur if we had a better authentication system.

Understanding how to be precise about those balances and how to get them implemented in a voluntarily interconnected set of networks is a central problem that confronts us over the next few years. From the [Obama] administration’s perspective, the goal of an open Internet that supports free expression, that supports the kind of array, vast wave of human creativity and free expression that we see coursing over the nerves and veins of the Internet every day – maintaining that, accelerating that, enabling that is fundamentally important.  – McLaughlin

He also noted that moving forward in encouraging the principles of open government “will guide the administration’s efforts to make progress on these problems.”

He noted that the Obama administration is working to make more information accessible to everyone.

“We want to be a more open government and free the data,” he said, “to make the government a platform for citizen innovation, citizen activities, new business models, and so forth that ride over the data the government has and the taxpayers pay for. The federal government sits on a staggering amount of data, and it can be incredibly valuable if it’s made public in machine-readable formats and can be remixed and reused and combined with other kinds of data. That’s a fundamental commitment.”

-Janna Anderson, http://www.imaginingtheinternet.org