The Voice of the eCommerce Industry

Nothing Nice on This List -- Introducing iAWFUL, a NetChoice Initiative

Some of the biggest threats to the Internet have always come from well-meaning lawmakers looking to "fix" it. And lately, there’s been a whole lot of fixin’ efforts going on.

At NetChoice, we've always been committed to challenging legislation that threatens our vibrant industry. Today more than ever, we need a more unified and systemic approach to combat bad legislation.

That's why we've created iAWFUL, the Internet Advocates Watchlist for Ugly Laws. 

iAWFUL identifies America's 10 worst legislative and regulatory proposals targeted at the Internet. Through iAWFUL, NetChoice will urge citizens to join the fight to defeat bills and proposals that threaten the future of ecommerce and online communication. The list will be continually updated to reflect the most immediate dangers, based on regulatory severity and likelihood of passage.

While misguided Internet legislation is nothing new, the threat that such legislation poses has increased dramatically. The latest breed of legislative proposals are among the most restrictive we've ever seen; they can crop up anywhere, as state lawmakers increasingly take the lead; and they threaten an Internet that increasingly lies at the heart of global commerce and communications.

State-based legislative efforts account for the majority of entries on iAWFUL, a stark indication of the growing push in statehouses to regulate and tax nearly every aspect of online behavior.

Topping the inaugural iAWFUL list is New Jersey's Social Networking Bill (A 3757), which would require the operators of social networking sites to aggressively police their users. In addition to stifling the free exchange of information and communication on social networking sites, the proposed bill would impose a massive burden -- particularly on smaller, upcoming services that lack the resources to take on such an unnecessary and invasive task.

We encourage anybody who cares about the Internet, really to head on over to the iAWFUL site, check the full list, suggest laws that should be included, and join the fight to uphold innovation and Internet freedom. 

Raising the Bar for New Internet Domains

Running an Internet domain is a little like generating nuclear power: do it right, and you safely provide an important resource to a grateful community; do it wrong, and...well, let's just say you don't want to do it wrong.
 
That may explain why business leaders are so concerned about the latest iteration of ICANN's plan to create potentially hundreds of new Internet domains.

I did my best to highlight those concerns when I spoke before the ICANN Board at the public forum here in Mexico City Thursday. Operators of new top-level domains will have a leading role in protecting consumers from fraud and phishing scams. In addition they must prevent abusive registrations intended to extort money out of brand owners. Defending against so-called "cybersquatting" already costs companies millions of dollars annually. The introduction of an unprecedented number of domains could increase those costs exponentially, if it isn't handled carefully.

But in the draft "guidebook" for potential new domain operators, the standard for preventing abusive registrations is currently set dangerously low. Applicants can get a passing score by simply describing what -- if anything -- they intend to do to prevent abusive registrations.

That's it. There's no requirement that applicants even have a plan and the expertise to make it work. From a business perspective, that simply isn't good enough.

As I told the board, ICANN must "raise the bar" for new domain applicants. Put simply, applicants should not be able to get a passing score unless they have adopted industry best practices for protection of consumers. There is no silver bullet to address the problem, but there are known methods that, used in concert, can protect consumers and brand-holders alike. It is ICANN's responsibility to require applicants to implement real protections for consumers and global brands.

And abusive registrations are just the tip of the iceberg as far as challenges that will face new registry operators. As cyber-crime grows in scope and complexity, some ICANN board members have expressed open concern that smaller, less experienced registry operators will not be able to keep pace with the rising tide of increasingly sophisticated attacks that they will face.

An improperly secured registry could become not just a victim of electronic attacks, but an unwitting tool for cyber-criminals. We all want this new domain experiment to work, because the alternative is frankly terrifying. The first, and most important step will be to set a high bar for those seeking to operate these critical global resources.

How to avoid being cut by a Broken Bottle

Early this month, sixty thousand Australians received notice that their credit card details and account passwords may have been exposed in a security breach at Bottle Domains, an Australian domain registrar.

Receipt of this disturbing news likely started a chain of events in thousands of households and businesses: a scramble to check your credit card statements, a flurry of worried phone calls, filing paperwork to deny unauthorised charges, and then updating all your other auto-pay vendors when a shiny new credit card arrives in the post.

Moreover, many of those affected – and those who read about it in the news – will think twice before giving their credit card number to online merchants. After all, the Bottle Domains incident is another example of credit card data being lost or stolen from businesses – both online and offline.

Fortunately, consumers have alternative payment options that don’t involve sharing credit card details.  When customers in Australia pay by PayPal, POLi, or Paymate (full disclosure: all 3 are NetChoice members), they know that their credit card information is never shared with merchants.  That’s one reason these payment systems are a safer way to do e-commerce, relative to credit cards and bank transfers.

We hope that Australian authorities and the .au registry operator auDA are asking serious questions of other registrars, and requiring them to improve their data security practices. And while they’re at it, auDA should ask its registrars to offer these safer payment methods from now on.

While troubling revelations about credit card leaks is bad news, it is also an opportunity for action to start adopting smarter and safer payment methods.

Steve DelBianco

Safer payments will help worriers to open wallets online

This week, NetChoice put out an advisory reminding Australian consumers how to shop safely online this Christmas. . Most of it would be familiar to seasoned online shoppers who know how to avoid and manage the risks of online commerce. The same could be said for a large share of six million Australian online shoppers.

It would be easy to say 'no worries' about consumer concerns over online safety. After all, e-commerce has been growing every year. But the sad fact is that millions of Australian consumers with internet access still don't buy online. In light of the bargains to be had, are they mad or savvy?

Neither, I suggest. They are just risk-adverse and a little intimidated by media reports about online fraud or identity theft. Many more of them would be buying online if they knew a bit more about managing their credit card information.

The online community must do more to allay worries and increase awareness. We have to listen to the worriers, and knock over the impediments to digital confidence.

That's why the NetChoice advisory included a list of best practices for making online payments. We are encouraging merchants to offer payment options that reduce consumer risks by shielding credit card details from the merchant. PayMate, PayPal, and POLi all offer that kind of protection, and more methods are on the way.

Please add your voice to our campaign. Come and join us.

Happy Christmas from the NetChoice team.

Keeping ICANN Focused on the Job Ahead

Picture this: Your child struggles academically. He is always sleep-deprived and barely gets his assignments in on time. He's going into a new semester facing his toughest course-load yet ... and he asks you if he should take a 20-hour-per-week after-school job.

Would you even hesitate before you rejected the idea?

Well that's the situation facing the Internet Corporation for Assigned Names and Numbers (ICANN). The body that oversees the Internet's Domain Name System faces the biggest challenges in its 10-year history. ICANN plans to review applications of hundreds of new Internet domains next year; it continues a massive project to "improve institutional confidence"; and it plans to sever its legacy ties with the U.S. Government.

And now ICANN wants to wade into uncharted territory, taking the technical lead on a critical Internet security issue.

The U.S. Commerce Department recently asked for public comments about who and how to do DNSSEC, a technology that will play a critical role in the broad global effort to increase the security and stability of the Internet.

As NetChoice wrote earlier this year in "Hardening the Security Stack", DNSSEC has significant limitations, and must be part of a much larger security effort that involves stakeholders at every level of the security "stack." Still, there is broad agreement that it's time to implement DNSSEC, starting with the root zone.

In my comments to the Commerce Department's National Telecommunications and Information Administration (NTIA), I left the arcane technical implementation questions to the hardworking technologists who have been developing DNSSEC for more than a decade.

Instead, I focused on whether ICANN should be the one that implements DNSSEC at the root, when a) there are other viable options, and b) ICANN is already clearly overburdened with its current slate of obligations and challenges.

The strain on ICANN is clear to anyone involved with Internet governance. Deadlines are routinely delayed, documentation arrives late, and constituency groups grow increasingly restive that their issues are not being adequately addressed. Meanwhile, outside forces, including an increasingly hostile International Telecommunications Union (ITU) threaten to destabilize ICANN from the outside.

ICANN will face enough difficulty just surmounting the challenges it MUST face. The organization should be discouraged from tackling new challenges and assuming new risks at this volatile time in its history.

It Takes a Stack to Stop an Attack

Yesterday at an event on Capitol Hill, I had the opportunity to formally release a paper I co-wrote with my colleague Braden Cox called "Hardening the Security Stack." Joining me on the panel were VeriSign Chief Technology Officer Ken Silva, and Michael Kaiser, the Executive Director of the National Cyber Security Alliance (NCSA), which co-hosted the event.

The "stack" is a common sense concept, but one that seems to get lost in the rhetoric about Internet security. The idea is that there is no monolithic thing called "Internet security," nor any monolithic entity that can single-handedly provide it. Internet security relies an interdependent network of tools, technologies and behaviors; and succeeds or fails based on the efforts of a wide range of stakeholders, from infrastructure providers at the core of the Internet, to end users at the edge.

Those stakeholders make up the security "stack."

It sounds simple enough, but when policymakers and members of the high-tech community get it in their heads that one tool -- or one stakeholder group -- has the silver bullet to solve all of our Internet security woes, it can lead to some unfortunate outcomes.

The latest example of this has been the recent furor over DNS Security Extensions or "DNSSEC." A worthwhile technology that has been in development for more than a decade, DNSSEC plays an important role in the security stack, helping to prevent the "cache poisoning" that is central to a certain type of Internet exploit.

As we discuss in the paper, DNSSEC is valuable, but is hardly the one-stop-solution to Internet security that its been billed as in some circles. DNSSEC may stop "cache poisoning" but it doesn't do a thing to stop users from turning over information to a fraudulent site that happens to be properly resolved in the DNS.

Which is where the stack comes in. Real cybersecurity demands effort from all layers of the security stack. Even as companies like VeriSign move forward with developing DNSSEC, infrastructure and applications providers need to do their part to safeguard their infrastructure, and individual users must do more to protect the aspects of the network under their control.

For those of you who weren't able to make it, we hope to have a transcript of the event available soon. Ken Silva gave a fascinating and sobering assessment of the attacks pounding the Internet infrastructure every minute of every day. Michael Kaiser added invaluable perspective about the challenges of educating ordinary Internet users about the complicated threats they face in a simple, accessible way.

As more and more allies come to understand the stack, and their critical role in it, hopefully we'll develop a more comprehensive approach to cybersecurity.

Can ICANN Really Do Alchemy?

Media reports might have you believe that ICANN has discovered how to turn lead into gold, with their decision to create lots of new top-level domains (TLDs) for the Internet. But there could be a lot of fool's gold in the ICANN treasure chest, based on concerns and questions I heard at their meeting in Paris last week:

1. Some businesses advocating new TLDs claim they will help to categorize the web, much like bookstores arrange shelves by subject matter. For example, the applicants for a .berlin TLD claim it will help users find websites relating to Berlin. But I have to wonder how that's more useful than using 'berlin' in a conventional web search? The big winner in having millions of new domains is the big search engine that can sort it all out for us.
2. ICANN will entertain objections "relating to morality and public order" regarding the words or phrases proposed for new TLDs. Sounds like a responsible policy, but will paranoid governments use this policy to oppose new TLDs like .freedom or .democracy?
3. If a new TLD would create confusion with existing or similar TLDs, ICANN may deny the application. "Confusingly similar" is a good concept, but isn't something this subjective certain to generate controversy and litigation?
4. ICANN will have to pick winners and losers when multiple contenders want the same TLD. For example, who gets the .apple TLD – Apple computer, Apple records, or the Washington State Apple Growers Co-op?
5. Consumers and brand owners are rightly concerned about fraud and cyber-squatting in new TLDs. Is every new TLD going to generate a gold rush for domains that can be re-sold to global brand owners? Worse still, are cyber criminals going to exploit new TLDs to dupe users into revealing personal data or lure them into online scams?

Applicants for new TLDs will have to run a veritable gauntlet of objections and contentions, which could take many months or even years to complete. At the same time, ICANN doesn't want to keep restive governments waiting on domains that use non-Latin scripts, such as an Arabic and Chinese. So ICANN also approved a fast-track for governments to get country-code domains using non-Latin scripts, but users will be frustrated if this fast-track excludes the global TLDs (.com, .org, .edu ) they're really looking for.

These are legitimate questions and real concerns that ICANN must overcome to launch hundreds of new TLDs. I can already hear critics claiming that ICANN processes are delaying new TLDs and the resulting gold rush for millions of new domains.

Before ICANN and domain speculators catch gold fever over the promise of newly-minted TLDs, they ought to heed an old proverb – all that glitters is not gold.

Posted by Steve DelBianco

In Case You Missed It...

Online discount real estate brokers can now enjoy complete access to the nation’s Multiple Listing Service thanks to an antitrust lawsuit by the Department of Justice. 

The New Hampshire legislature has reached a tentative agreement on the state’s Online Safety Act.

City councilors in Tulsa want to consider new legislation for the secondary ticket market and make it illegal to scalp tickets.

Top Stories

A proposed federal law that would place extensive regulations on technology companies doing business in China and other nations is deemed to be unreasonable "Internet-restricting."

The Justice Department announced to online real estate brokers, and potentially their clients, by forcing new industry policies that give Internet-based agents access to home listings they were previously denied.

Top Stories

Attacking the European Union's Internet backbone is now the preserve of organized crime, not young hackers out to prove a point.

Changes will be made to Canda’s WHOIS system by June 10^th, where new privacy policies will be enacted to protect from roaming eyes. Currently, the system provides the domain owner's name, home address, phone number and e-mail to searchers.

Texas's Attorney General encourages the use of child safety flash drives. Parents can load key information about their children, including pictures and friends’ contact information on the drive in case they are to ever go missing.

In Case You Missed It...

Several other states are taking notice of New York's new sales tax law and watching the situation closely. California is one state that is considering similar legislation that would broaden online sales tax requirements.

Please see New York's Ambitious Sales Tax Law--Broader Than Amazon and the Internet?

Senators pressed executives from Yahoo, Google, and Cisco Systems on Tuesday to justify their business practices in China and other Internet-censoring countries.

New Jersey’s Governor signed legislation would allow the state to monitor or restrict Internet access by convicted sex offenders.

The Department of Homeland Security leaked a disturbing experiment video which highlights the need to guard against cyber-security threats  to critical infrastructure like power plants and the telecom system.

Top Stories

China is aggressively honing its ability to shoot down satellites, forcing the U.S. military to paint China as posing a growing threat to the United States and others in space and cyberspace.

Egypt will host the Internet Corporation for Assigned Names and Numbers' (ICANN) 33rd International Public Meeting in November, after Kenya lost the bid on security grounds.

Top Stories

The Missouri State legislature gave final approval to a bill targeting cyber-crimes, making harassment from computers and other electronic devices illegal.

The FBI reports that online fraud is at an all time high which has stolen $239 million from consumers last year.

The US homeland security chief wants to build a system to detect Internet attacks from terrorist hijacking before they occur.

In Case You Missed It...

The Washington Post reports that some fear the updated National Cyber Security Initiative, designed to improve the government's digital defenses and put forth an offensive information warfare doctrine -- is endangering the deterrent value of the project.

The EU's top data protection supervisor said Thursday that Google Inc.'s "Street View" map and imaging feature could pose privacy problems if it launches in Europe, and practices should meet European data retention and privacy rules.

Top Stories

New York Governor David Paterson signed legislation Wednesday, taking another step in policing the Internet with a new law aimed at keeping an eye on what convicted sex offenders do online.

As a result of New York State’s move to collect internet sales tax, Overstock.com has become the first major Internet retailer to cancel its relationship with affiliates in New York.

On July 1, Washington will join 18 other states that require some e-commerce businesses to collect sales tax. About 1,100 online retailers have volunteered to collect taxes, and in return, states such as Washington promise not to sue them for back taxes.

In Case You Missed It...

Educational institutions reportedly account for approximately one of every four data security breaches.

Estonia and six NATO allies sign a deal this week to provide staff and funds for a new research center designed to boost the alliance's defenses against cyber terrorism.

Top Stories

Col. Charles W. Williamson III is proposing that the Air Force build its own zombie network, so it can launch distributed denial of service attacks on foreign enemies.

The board of ICANN will vote in Paris next month on a proposal to severely limit the number of domain names that can be returned without a fee.

In Case You Missed It...

Big businesses need to start planning now to handle changes that will take place when a new version of the Internet's fundamental routing protocol becomes ubiquitous, or risk losing online customers, according to ICANN.

A hacker broke into Chile's government sites mining personal data from six million people which they then posted on two popular servers on the Internet.

Amazon.com has been operating a distribution center in Irving, TX since 2006, giving it a "physical presence" in Texas. The Texas Comptroller's Office is investigating whether the Internet retail behemoth, owes Texas possibly millions of dollars in uncollected internet sales taxes on purchases made by its customers in the state.

Florida Attorney General announced a nationwide partnership requires Facebook to digitally screen profiles, eliminating convicted sex offenders. It also checks that subscriber profiles match personal information, as well as an automatic "pop-up" warning will appear when youngsters try to contact adults.

ICANN chief says business leaders are grossly underestimating their firms' reliance on the internet and the risks of web-based threats.

Wholesale fees for Internet addresses ending in ".org" will increase 10 percent Nov. 9.

Two senior House Judiciary Committee members introduced a bill Thursday that could subject cable and telephone companies to antitrust enforcement if they unfairly handle Internet traffic.

Madonna has become the first artist to officially endorse the secondary ticket market.

Spotlight on Cyber Crime

Incidents of cyber crime can be expected to climb in 2008, the Internet provides criminals a chance to collect substantial financial rewards with a relatively low risk of getting caught and punished. 

In Case You Missed It...

Security Fix is launching a new feature today called Cyber Justice Chronicles, which will periodically provide short snippets of news about individuals who have been arrested or convicted of computer crime offenses.

The New York Times is reporting on Amazon's lawsuit contesting the recently enacted New York state law which requires online retail outlets to collect sales tax on items sold to the state's residents without a physical presence in the state.