The Voice of the eCommerce Industry

An Important Step for Human Rights and Global IT Expansion

It was extremely gratifying to witness the launch this week of the Global Network Initiative: Protecting and Advancing Freedom of Expression and Privacy and Communications Technologies.

The product of more than two years of study and development by companies and public interest groups, the Initiative offers a set of guiding principles for global IT companies doing business in an increasingly global environment.

Specifically it aims to address the real challenge faced by companies doing business in jurisdictions where local laws may run counter to their own internal commitments to privacy, free speech and other human rights.

It also underscores an important -- if controversial -- point. It is vital for technology companies to engage on the world stage, and to find collaborative ways to do so in ways that uphold and enhance human rights. These principles are a reasoned response to those who say that western companies should simply refuse to do business in jurisdictions that have potentially challenging laws.

At the 2007 world Internet Governance Forum in Brazil, I participated in a panel on this topic and made these points. Although some wanted companies to just ignore foreign governments, most agreed that such an approach would serve neither companies -- which could be kicked-out of nations for refusing to comply with laws -- or users -- who could lose access to critical information technologies.

At the time we argued that addressing this issue would require the combined efforts of companies and the public interest community. This initiative is a critical and significant step in the right direction.

The growth of IT companies throughout the world has been an enormous boon to free speech and human rights. Although these technologies present new challenges, particularly when taken together with widely varying laws, they are doing far more good than harm, everywhere that they are deployed.

Initiatives like this one will help companies to minimize those threats even more as they bring the world-expanding power of technology to the next billion Internet users around the world.

Finally I'd especially like to acknowledge the work done by the Center for Democracy & Technology, which played a key role in the process.

In 2007, I also responded to the allegations that Yahoo had "ignored" human rights in China. The New York Times printed my letter here. 

I stand by that statement. It's encouraging now to see that companies like Yahoo! -- an active participant in the Initiative -- have tools to address these challenging issues constructively, in a way that expands the reach of these technologies.  

It Takes a Stack to Stop an Attack

Yesterday at an event on Capitol Hill, I had the opportunity to formally release a paper I co-wrote with my colleague Braden Cox called "Hardening the Security Stack." Joining me on the panel were VeriSign Chief Technology Officer Ken Silva, and Michael Kaiser, the Executive Director of the National Cyber Security Alliance (NCSA), which co-hosted the event.

The "stack" is a common sense concept, but one that seems to get lost in the rhetoric about Internet security. The idea is that there is no monolithic thing called "Internet security," nor any monolithic entity that can single-handedly provide it. Internet security relies an interdependent network of tools, technologies and behaviors; and succeeds or fails based on the efforts of a wide range of stakeholders, from infrastructure providers at the core of the Internet, to end users at the edge.

Those stakeholders make up the security "stack."

It sounds simple enough, but when policymakers and members of the high-tech community get it in their heads that one tool -- or one stakeholder group -- has the silver bullet to solve all of our Internet security woes, it can lead to some unfortunate outcomes.

The latest example of this has been the recent furor over DNS Security Extensions or "DNSSEC." A worthwhile technology that has been in development for more than a decade, DNSSEC plays an important role in the security stack, helping to prevent the "cache poisoning" that is central to a certain type of Internet exploit.

As we discuss in the paper, DNSSEC is valuable, but is hardly the one-stop-solution to Internet security that its been billed as in some circles. DNSSEC may stop "cache poisoning" but it doesn't do a thing to stop users from turning over information to a fraudulent site that happens to be properly resolved in the DNS.

Which is where the stack comes in. Real cybersecurity demands effort from all layers of the security stack. Even as companies like VeriSign move forward with developing DNSSEC, infrastructure and applications providers need to do their part to safeguard their infrastructure, and individual users must do more to protect the aspects of the network under their control.

For those of you who weren't able to make it, we hope to have a transcript of the event available soon. Ken Silva gave a fascinating and sobering assessment of the attacks pounding the Internet infrastructure every minute of every day. Michael Kaiser added invaluable perspective about the challenges of educating ordinary Internet users about the complicated threats they face in a simple, accessible way.

As more and more allies come to understand the stack, and their critical role in it, hopefully we'll develop a more comprehensive approach to cybersecurity.

Financial Failures Spark Phishing Expeditions, and Other CyberSecurity Issues at upcoming NetChoice Event

As if the financial crisis and government bailout isn't already a bit fishy to some taxpayers, now it's the subject of a social engineering phishing exploit. The Federal Trade Commission issued a warning that

Phishers (pronounced “fishers’) may send attention-getting emails that look like they’re coming from the financial institution that recently acquired your bank, savings and loan, or mortgage. Their intent is to collect or capture your personal information, like your credit card numbers, bank account information, Social Security number, passwords, or other sensitive information. Their messages may ask you to “update,” “validate,” or “confirm” your account information.

October is Cyber Security Awareness Month and in celebration NetChoice will hold a lunch event at the Russell Senate Building on Thursday, Oct. 16 from Noon - 1:30pm. Panelists include:

• Ken Silva, Chief Technology Officer, VeriSign
• Michael Kaiser, Executive Director, National Cyber Security Alliance
• Steve DelBianco, Executive Director, NetChoice

If interested, let us know and come on by!

-Braden

We Couldn't Agree More

The Newark Star-Ledger added its opinion to the ongoing debate over the organized retail crime laws currently under consideration in the U.S. Congress. It's encouraging to see more and more respected voices recognize the folly and danger of these proposed laws.

It's also good to see others highlight the offensiveness and insanity of the National Retail Federation's assertion that online selling turns otherwise-good people into addicts and criminals:

The idea that online auctions are insidiously turning masses of law-abiding citizens into crooks is about as valid as the belief that getting the car washed creates harmonic vibrations in the atmosphere that produce rain.

Capturing the Meaning of "Capture" at ICANN

The higher-ups at Internet Corporation for Assigned Names and Numbers(ICANN) were in town on Wednesday, talking up their plan "improve institutional confidence" before they walk away from a key relationship with the U.S. Government in September 2009.

I had a chance to ask them (good account here) how they plan to address a major concern of the business community -- the possibility that an independent ICANN could be "captured" by a foreign government or multi-national bureaucracy.

When ICANN's Joint Project Agreement (JPA) with the U.S. Department of Commerce came up for a mid-term review in 2007, one of the key concerns cited by members of the Internet community was that ICANN could be subject to capture after its traditional relationship with the U.S. Government ends.

ICANN appeared to acknowledge that concern, making "Safeguarding Against Capture" their top agenda item in their plan to improve institutional confidence. But to our chagrin, almost all of the proposals ICANN offered were aimed at preventing internal capture, by parties already involved in the ICANN process.

But what the Internet community was really concerned about was not internal capture, but rather the threat that ICANN would be forcibly taken over by the foreign governments who believe that the Internet's addressing system is too important to leave to the private sector.

ICANN is claiming they have "checked the box" on capture, with a few bureaucratic measures to stop ICANN participants from capturing ICANN’s internal processes. But the real danger to private sector leadership of ICANN comes from EXTERNAL forces eager to usurp ICANN’s role.

With a $60 million budget and control over the Internet DNS, ICANN is a magnet for the United Nations and governments. Last fall we heard the Russian government call for the United Nations to assert control over critical Internet resources. Just goes to show ICANN that all that money and power may not buy friends, but it does invite a better class of enemies.

Many of us believe that the legacy role of US Commerce Department oversight is the main defense against capture by the United Nations and restive governments. But who’s protecting ICANN after it walks away from its partnership agreement with the US next year?

Plenty of governments question whether ICANN is doing enough to stop Internet fraud and abuse, particularly cyber-terrorism like the denial-of-service attacks that crippled Estonia and more recently Georgia? What happens when they decide to take matters into their own hands? Frankly I don't know, and what scares me is that I don't think ICANN does either.

Until somebody gets a handle on it, we may want to put the brakes on ICANN's impending "transition."