Blog The Future of the Internet — And How to Stop It

A close look at SOPA

December 2nd, 2011 | by jz | Published in Future of the Internet | 4 Comments

A Close Look at SOPA

Jonathan Zittrain, Kendra Albert and Alicia Solow-Niederman

This document is a guide to the Stop Online Piracy Act as proposed in the United States House of Representatives. Stop Online Piracy Act (SOPA), H.R. 3261, 112th Cong. (2011). It represents our notes as we sought to understand exactly what it does and how it does it — along with our corresponding sense for why its principal mechanisms make for poor law. Our aim is for this analysis to be useful to anyone wanting to understand the Act — whatever his or her point of view may be on technology or intellectual property policy.

According to its advocates, SOPA will strengthen copyright in the United States by establishing a number of public and private tools to hinder infringement by international “rogue” sites previously unreachable by U.S. law. The Act also includes a number of independent provisions targeting the sale and dissemination of prescription drugs and military materials and equipment.

1. Copyright enforcement against websites, foreign & domestic.

The bulk of SOPA is a set of public and private mechanisms intended to give American copyright holders tools to combat offshore infringers. The Attorney General’s office, when armed with a court order (the granting of which doesn’t appear to have a standard beyond the Act’s definitions – the court “may” grant an order when requested Id., at § 102(c)), will be able to demand the elimination of access and funding to infringing sites on behalf of copyright holders. When acting alone, copyright holders can use these mechanisms to cut off funding.

Public Remedies (H.R. 3261, 112th Cong. § 102 (2011).)

SOPA gives tools to the U.S. Attorney General to combat “foreign infringing sites.” Id., at § 102. The definition of this term is unusual; a site with a domain name registered outside the U.S. (e.g. through a non-U.S. domain name registrar) seems to count as “foreign,” even if it’s run by an American company and hosted on U.S. soil. Id., at § 101(5)-101(8). As an initial matter, the site must be “U.S. directed,” although virtually all sites not actively blocking U.S. IPs would fall under this category. See id. at § 102(a)(1). Infringement does not need to be direct, and instead may be imputed on sites that merely “facilitat[e] the commission” of copyright infringement . Id. at § 102(a). The order can ask the operator of the targeted site to “cease and desist from undertaking any further activity as a foreign infringing site.” Id. at § 102(b)(5), and then the Attorney General can send additional copies of the order to “similarly situated entities” with permission of the Court – that is, others can fall under the Court’s power without previously having been given notice of a proceeding against them. Id. at § 102(c)(1).

But these provisions are likely not the real force of the law, as fully overseas infringing sites may try to ignore a U.S. court order. The law’s real force is focused domestically. Once a foreign infringing site has been made the subject of a court order, the Attorney General may apply the court order not only at the site but at American companies that occupy the space between the infringing site and an American end user’s browser- specifically, service providers, search engines, payment network providers, and advertising networks. Id. at § 102(c)(2). The court order may require these entities to take all “technically feasible and reasonable measures” to prevent access or payments to foreign infringing sites. Id. Those intermediaries would, it appears, not have been given notice or otherwise involved in the proceeding by which the Attorney General obtained the original order that would then bind them.

There are a number of specifics mentioned in the bill as “technically feasible and reasonable measures.” H.R. 3261 at § 102(c). For service providers ¹, this includes “measures designed to prevent the domain name of the foreign infringing site (or portion thereof) from resolving to that domain name’s IP address” Id. at § 102(c)(2)(A)(i). DNS blocking is one of the techniques that China uses to prevent access to dissident websites, and has serious technical ramifications. Sandia National Laboratories publisheda letter, after being asked for comment, characterizing the proposed DNS filtering as “whack-a-mole.” ISOC also released a paper detailing how DNS blocking would undermine the Internet architecture. Under a SOPA-based order, Internet search engines are to prevent an allegedly infringing site from being served to users as a direct hypertext link. Id. at § 102(c)(2)(B). Payment providers (like MasterCard or PayPal) must stop completing payment to the payment account used by the site. Id. at § 102(c)(2)(C). Finally, advertisers must complete three separate actions: cut off any ads that they were serving to the site, cut off any advertisements for the site served on other websites, and finally, cut off payments stemming from advertisements. Id. at § 102(c)(2)(D).

SOPA critics point to the vagueness of the phrase “technically feasible and reasonable measures” when questioning the burden the Act will place on intermediaries. An elephant in the room is whether this requirement would necessitate active monitoring of all content to prevent access to previously-noticed infringing sites and/or content. It is notable that payment providers and advertising companies alone are explicitly exempt from having a “duty to monitor” future infringing activity. H.R. 3261 at 102(c)(2)(D)(ii). The Act is silent on whether service providers and search engines have a duty to monitor, which, by implication, may be said (and surely would be argued) to render such a duty.

SOPA encourages such a broad reading by granting immunity to parties who act to limit access to copyrighted materials and by reserving the possibility of litigation for parties that fail to act. See id. at § 102(c)(5)(A). The Attorney General may bring an action for injunctive relief – essentially a further court order – against third parties for not complying with the first court order. Id. at § 102(c)(4)(A)(i). Injunctive relief may also be sought against any entity that provides a product or service designed (or marketed) to circumvent the procedures proposed under SOPA. Relief is to be limited to injunctive mechanisms, and SOPA by itself does not appear to impute infringement on a non-complying service provider, search engine, or payment network. Still, when faced with immunity for action or litigation against the Justice Department for inaction, it is plausible that technology companies would be highly motivated to overcensor. Worse, the kinds of circumvention tools supported within human rights communities and by the U.S. government as part of its Internet freedom initiatives against authoritarian censorship are precisely the tools targeted for elimination under SOPA.

The overwhelming controversy regarding SOPA’s public remedies (that is, those initiated by the Attorney General rather than a private party) regards the provision allowing a court to order a service provider–essentially an unwitting middleman–to take all “technically feasible and reasonable measures” to block an infringing site. Id. at § 103. The Act’s most fervent critics often point to this element when stating that SOPA has the potential to kill the Internet as we know it, placing the fate of interoperability in the hands of technically unsophisticated judges. Only slightly less fervent critics note that this provision would align federal Internet policy with China and like-minded regimes. While the current statute is limited to copyright infringement, the concern is that it establishes an architecture for widespread – indeed, nationwide – technical implementations of censorship.^[2]

Private Remedies (H.R. 3261, 112th Cong. § 103 (2011))

SOPA further provides what it calls a “Market-Based System to…Protect U.S. Property.” H.R. 3261 at § 103. This “market-based system” is a private mechanism by which an IP holder can pressure payment network providers and Internet advertising services to cease all transactions with “sites dedicated to theft of U.S. property.” See id.

This private remedy does not use the “foreign infringing sites” terminology from the public mechanism. Id. at § 102(a). Here the ultimate infringers are described as sites “dedicated to theft of U.S. property.” Id. at § 103. The statutory definition goes beyond what the label colloquially suggests. For example, a site may be branded as “dedicated to theft of U.S. property” if it simply “is taking, or has taken, deliberate actions to avoid confirming a high probability” of the use of the site for copyright infringement. Id. at § 103(a)(ii).
An American copyright holder can therefore approach a payment processor or advertising network and demand that it do whatever is technically feasible and reasonable to prevent sites it deems “dedicated to theft of U.S. property.” Id. at § 103. Unlike in the public remedy, the copyright holder can only seek to cut off payments from payment providers and advertisers. Id.

The threshold for a private corporation giving such a notice is presumably lower than the court order standard in the public remedy. As such, this is arguably SOPA’s most powerful element and one positioned to be applied in a particularly overbroad way. Under the Digital Millennium Copyright Act of 1998, which has an analogous private system of notice-and-takedown, there are countless well-intentioned actors, yet some rightsholders have nonetheless overreached (both intentionally and unintentionally). Under SOPA, payment and advertising companies will have a tremendous incentive to cooperate with a stream of private requests for reasons such as the inconvenience of or inability to evaluate the rightsholder’s claims. Unlike the public remedy, the private remedy allows the alleged infringer to provide counter notification to the third party,³ after which the third party can presumably decide whether or not to comply. H.R. 3261 at § 103(b)(5).

It is important to note that SOPA provides a cause of action, including attorney’s fees, for parties damaged by a knowing, material misrepresentation made in conjunction with the private enforcement mechanisms’ notice and counter-notice provision. Still, the third party must comply within five calendar days from the initial notice. Id. at § 103(b). The turnaround time, taking into account legal advice and the alleged infringer’s counter-notice, is extremely tight. Any intellectual property counsel can attest that those limits will be difficult to navigate, especially without exempting holidays and weekends, which turn out to be when such notices are often sent.

As with the public remedy, the payment and advertising companies are immune from liability if they cut off funding to a site or entity in accordance with SOPA. Should a payment or advertising company not comply, the rightsholder may then seek injunctive relief against the non-complying third party. H.R. 3261, 112th Cong. § 103(c) (2011).

Issues Common to Both Public and Private Remedies

Industry lobbyists and other supporters argue that SOPA is designed specifically to combat “foreign rogue sites.” The image they draw is of brazenly obviously illegal sharing and downloading, such as the Pirate Bay and its brethren. Yet “foreign infringing sites” and sites “dedicated to the theft of U.S. property” could include almost any website registered outside of the United States that allows user-generated content. Requiring American third parties to take all “technically feasible and reasonable” efforts to block such sites, prospectively in some cases, is equally vague. If this legislation were only aimed at the Pirate Bays of the world, the language could and would be much tighter. In many instances, statutory language is vague for a reason: to afford maximum leverage by one party intent on invoking a law over whoever is subject to the law.

Immunity for Voluntary Action

Even without instigation by the Attorney General or rightsholders, alleged infringers may find their sites blocked and their funding cut off without any sort of due process. SOPA grants payment providers, Internet search engines, advertising services, service providers, and domain name registries immunity from suit for voluntarily acting in a manner consistent with the public and private mechanisms against a site that they “reasonably believe” is a foreign infringing site or dedicated to the theft of US property. H.R. 3261 at § 104. Even with no copyright holder notifying them that their rights are being violated, all of these actors can take down or stop serving revenue to sites, as long as they are consistent with terms of use. Id.

Likewise, payment providers, Internet search engines, advertising services, service providers, and domain name registries are also not liable for taking action against sites they believe are “endangering public health.” Id. at § 105.

2. “Notorious foreign infringers” and U.S. investors ((H.R. 3261, 112th Cong. § 107 (2011).)

The U.S. IP Enforcement Coordinator, along with various agency heads, will identify “notorious foreign infringers” who are causing “significant harm to holders of IP rights in the US”, soliciting suggestions from the public and rights holders. Id. at § 107(a)(1). This information will be made into a report to Congress, which will examine and analyze various methods of combating IP rights violations, including and up to prohibiting such sites from raising capital in the United States. Id. at § 107(b)(5). While SOPA does not directly prohibit such investment, the spectre of such a ban may lead to a chill in investor confidence in countless internet startups, even those that may only distantly be thought of as enabling copyright infringement, such as social networks or content creation platforms.

3. Amendments to existing criminal copyright laws

Criminal penalties for streaming. (H.R. 3261, 112th Cong. § 201 (2011).).

While most of SOPA’s IP treatment revolves around the third-party-based enforcement mechanisms outlined above, the Act also does refine a number of existing IP laws. Most notable among the many changes, SOPA calls for the criminalization of public performance copyright infringement. H.R. 3261 at § 201. This provision is specifically targeted at digital streaming and provides criminal penalties for streaming copyrighted material with ten or more views and a retail value of $2,500. Id. at § 201(b). This sweeping and vague change could categorize millions of Americans as criminals. Prosecutorial discretion thus determines whether these long prison terms are applied fairly. The colorful advocacy at http://freebieber.org/ is, at its core, pointing out the implications of this inexplicably broad provision: the videos that teenage Justin Bieber posted of himself singing songs by his favorite artists do indeed appear to qualify as felonies under the Act. This is a particular irony, since those videos launched Bieber’s career as a musician – exactly the people the Act is intended to protect.

Additional criminal penalties (H.R. 3261, 112th Cong. § 202-203 (2011).).

SOPA amends 18 U.S.C. § 2320 to add the importation, export, or participation in the manufacture of counterfeit drugs to the list of criminal activities. Id. at § 202(1)(a)(iii). It also increases the penalties for the production or distribution of counterfeit products that result in serious bodily harms from twenty years to life in prison. Id. at § 202(2)(a). SOPA further increases the penalties for manufacturing or distributing counterfeit goods to the military (or in a way that may harm national security). Id. at § 202(3).

SOPA also amends 18 U.S.C. § 1831(a) to increase penalties for individuals or organizations committing economic espionage. Id. at § 203.

4. Protecting IP rights abroad

In what would potentially be a significant increase in the United States diplomatic corps and its activities, SOPA requires the Secretary of State and of Commerce to ensure diplomatic missions or embassies have “adequate resources” to pursue “aggressive support of enforcement action against violations of intellectual property.” H.R. 3261 at § 205. It would further require the diplomatic corps to make best efforts to see that foreign countries honor existing intellectual property treaties. Id. at § 205(a)(2).
Under SOPA, special intellectual property attachés hired by the Director of the Patent and Trademark Office will work from within embassies or diplomatic missions to advance United States intellectual property policy goals in general and specifically to reduce intellectual property infringement. Id. at § 205(b).

Conclusion

Others have weighed in on why SOPA makes for poor public policy and is an ill-considered technical intervention. In this paper we’ve hewed closely to simply reviewing it as legal doctrine. On those terms, its vague language and undue granting of law-like powers to private parties without sufficient public protections make it worthy of a firm “no” vote. SOPA is both overly strong and overly broad; overly strong in the collection of remedies provided, and overly broad for the problems it is attempting to take on.

Jonathan Zittrain is a member of the boards of the Electronic Frontier Foundation and the Internet Society. Both organizations have weighed in on this bill. However, the opinions expressed above are his (and our) own.

Notes:
1 “As used in subsection (a), the term “service provider” means an entity offering the transmission, routing, or providing of connections for digital online communications, between or among points specified by a user, of material of the user’s choosing, without modification to the content of the material as sent or received.” 17 U.S.C. § 512(k).

2 The United States may have already crossed that threshold with our government’s actions regarding Wikileaks.

3 As with the DMCA, counter-notice requires the alleged infringer to consent to U.S. jurisdiction in the matter.

The PC is dead. Why no angry nerds?

November 30th, 2011 | by jz | Published in Future of the Internet, Generativity | 32 Comments

From Technology Review:

The Personal Computer Is Dead

Power is fast shifting from end users and software developers to operating system vendors.

By Jonathan Zittrain

The PC is dead. Rising numbers of mobile, lightweight, cloud-centric devices don’t merely represent a change in form factor. Rather, we’re seeing an unprecedented shift of power from end users and software developers on the one hand, to operating system vendors on the other—and even those who keep their PCs are being swept along. This is a little for the better, and much for the worse.

The transformation is one from product to service. The platforms we used to purchase every few years—like operating systems—have become ongoing relationships with vendors, both for end users and software developers. I wrote about this impending shift, driven by a desire for better security and more convenience, in my 2008 book The Future of the Internet—and How to Stop It.

For decades we’ve enjoyed a simple way for people to create software and share or sell it to others. People bought general-purpose computers—PCs, including those that say Mac. Those computers came with operating systems that took care of the basics. Anyone could write and run software for an operating system, and up popped an endless assortment of spreadsheets, word processors, instant messengers, Web browsers, e-mail, and games. That software ranged from the sublime to the ridiculous to the dangerous—and there was no referee except the user’s good taste and sense, with a little help from nearby nerds or antivirus software. (This worked so long as the antivirus software was not itself malware, a phenomenon that turned out to be distressingly common.)

Choosing an OS used to mean taking a bit of a plunge: since software was anchored to it, a choice of, say, Windows over Mac meant a long-term choice between different available software collections. Even if a software developer offered versions of its wares for each OS, switching from one OS to another typically meant having to buy that software all over again.

That was one reason we ended up with a single dominant OS for over two decades. People had Windows, which made software developers want to write for Windows, which made more people want to buy Windows, which made it even more appealing to software developers, and so on. In the 1990s, both the U.S. and European governments went after Microsoft in a legendary and yet, today, easily forgettable antitrust battle. Their main complaint? That Microsoft had put a thumb on the scale in competition between its own Internet Explorer browser and its primary competitor, Netscape Navigator. Microsoft did this by telling PC makers that they had to ensure that Internet Explorer was ready and waiting on the user’s Windows desktop when the user unpacked the computer and set it up, whether the PC makers wanted to or not. Netscape could still be prebundled with Windows, as far as Microsoft was concerned. Years of litigation and oceans of legal documents can thus be boiled down into an essential original sin: an OS maker had unduly favored its own applications.

When the iPhone came out in 2007, its design was far more restrictive. No outside code at all was allowed on the phone; all the software on it was Apple’s. What made this unremarkable—and unobjectionable—was that it was a phone, not a computer, and most competing phones were equally locked down. We counted on computers to be open platforms—hard to think of them any other way—and understood phones as appliances, more akin to radios, TVs, and coffee machines.

Then, in 2008, Apple announced a software development kit for the iPhone. Third-party developers would be welcome to write software for the phone, in just the way they’d done for years with Windows and Mac OS. With one epic exception: users could install software on a phone only if it was offered through Apple’s iPhone App Store. Developers were to be accredited by Apple, and then each individual app was to be vetted, at first under standards that could be inferred only through what made it through and what didn’t. For example, apps that emulated or even improved on Apple’s own apps weren’t allowed.

The original sin behind the Microsoft case was made much worse. The issue wasn’t whether it would be possible to buy an iPhone without Apple’s Safari browser. It was that no other browserwould be permitted—or, if permitted, it would be only through Apple’s ongoing sufferance. And every app sold for the iPhone would have 30 percent of its price (and later, that of its “in-app purchases”) go to Apple. Famously proprietary Microsoft never dared to extract a tax on every piece of software written by others for Windows—perhaps because, in the absence of consistent Internet access in the 1990s through which to manage purchases and licenses, there’d be no realistic way to make it happen.

Fast forward 15 years, and that’s just what Apple did with its iOS App Store.

In 2008, there were reasons to think that this situation wasn’t as worrisome as Microsoft’s behavior in the browser wars. First, Apple’s market share for mobile phones was nowhere near Microsoft’s dominance in PC operating systems. Second, if the completely locked-down iPhone of 2007 (and its many counterparts) was okay, how could it be wrong to have one that was partially open to outside developers? Third, while Apple rejected plenty of apps for any reason—some developers were fearful enough of the ax that they confessed to being afraid to speak ill of Apple on the record—in practice, there were tons of apps let through; hundreds of thousands, in fact. Finally, Apple’s restrictiveness had at least some good reason behind it independent of Apple’s desire for control: rising amounts of malware meant that the PC landscape was shifting from anarchy to chaos. The wrong keystroke or mouse click on a PC could compromise all its contents to a faraway virus writer. Apple was determined not to have that happen with the iPhone.

By late 2008, there was even more reason to relax: the ribbon was cut on Google’s Android Marketplace, creating competition for the iPhone with a model of third-party app development that was a little less paranoid. Developers still registered in order to offer software through the Marketplace, but once they registered, they could put software up immediately, without review by Google. There was still a 30 percent tax on sales, and line-crossing apps could be retroactively pulled from the Marketplace. But there was and is a big safety valve: developers can simply give or sell their wares directly to Android handset owners without using the Marketplace at all. If they didn’t like the Marketplace’s policies, it didn’t mean they had to forgo ever reaching Android users. Today, Android’s market share is substantially higher than the iPhone’s. (To be sure, that market share is inverted in the tablet space; currently 97 percent of tablet Web traffic is accounted for by iPads. But as new tablets are introduced all the time—the flavor of the month just switched to Kindle Fire, an Android-based device—one might look at the space and see what antitrust experts call a “contestable” market, which is the kind you want to have if you’re going to suffer market dominance by one product in the first place. The king can be pushed down the hill.)

With all of these beneficial developments and responses between 2007 and 2011, then, why should we be worried at all?

The most important reasons have to do with the snowballing replicability of the iPhone framework. The App Store model has boomeranged back to the PC. There’s now an App Store for the Mac to match that of the iPhone and iPad, and it carries the same battery of restrictions. Some restrictions, accepted as normal in the context of a mobile phone, seem more unfamiliar in the PC landscape.

For example, software for the Mac App Store is not permitted to make the Mac environment look different than it does out of the box. (Ironic for a company with a former motto importuning people to think different.) Developers can’t add an icon for their app to the desktop or the dock without user permission, an amazing echo of what landed Microsoft in such hot water. (Though with Microsoft, the problem was prohibiting the removal of the IE icon—Microsoft didn’t try to prevent the addition of other software icons, whether installed by the PC maker or the user.) Developers can’t duplicate functionality already on offer in the Store. They can’t license their work as Free Software, because those license terms conflict with Apple’s.

The content restrictions are unexplored territory. At the height of Windows’s market dominance, Microsoft had no role in determining what software would and wouldn’t run on its machines, much less whether the content inside that software was to be allowed to see the light of screen. Pulitzer Prize-winning editorial cartoonist Mark Fiore found his iPhone app rejected because it contained “content that ridicules public figures.” Fiore was well-known enough that the rejection raised eyebrows, and Apple later reversed its decision. But the fact that apps must routinely face approval masks how extraordinary the situation is: tech companies are in the business of approving, one by one, the text, images, and sounds that we are permitted to find and experience on our most common portals to the networked world. Why would we possibly want this to be how the world of ideas works, and why would we think that merely having competing tech companies—each of which is empowered to censor—solves the problem?

This is especially troubling as governments have come to realize that this framework makes their own censorship vastly easier: what used to be a Sisyphean struggle to stanch the distribution of books, tracts, and then websites is becoming a few takedown notices to a handful of digital gatekeepers. Suddenly, objectionable content can be made to disappear by pressuring a technology company in the middle. When Exodus International—”[m]obilizing the body of Christ to minister grace and truth to a world impacted by homosexuality”—released an app that, among other things, inveighed against homosexuality, opponents not only rated it poorly (one-star reviews were running two-to-one against five-star reviews) but also petitionedApple to remove the app. Apple did.

To be sure, the Mac App Store, unlike its iPhone and iPad counterpart, is not the only way to get software (and content) onto a Mac. You can, for now, still install software on a Mac without using the App Store. And even on the more locked-down iPhone and iPad, there’s always the browser: Apple may monitor apps’ content—and therefore be seen as taking responsibility for it—but no one seems to think that Apple should be in the business of restricting what websites Safari users can visit. Question to those who stand behind the anti-Exodus petition: would you also favor a petition demanding that Apple prevent iPhone and iPad users from getting to Exodus’s website on Safari? If not, what’s different, since Apple could trivially program Safari to implement such restrictions? Does it make sense that South Park episodes are downloadable through iTunes, but the South Park app containing the same content was banned from the App Store?

Given that outside apps can still run on a Mac and on Android, it’s worth asking what makes the Stores and Marketplaces so dominant—compelling enough that developers are willing to run the gauntlet of approval and take a 30 percent hit on revenue instead of simply selling their apps directly. The iPhone restricts outside code, but developers could still, in many cases, manage to offer functionality through a website accessible through the Safari browser. Few developers do, and there’s work to be done to ferret out what separates the rule from the exception. The Financial Times is one content provider that pulled its app from the [iOS] App Store to avoid sharing customer data and profits with Apple, but it doesn’t have much company.

The answer may lie in seemingly trivial places. Even one or two extra clicks can dissuade a user from consummating what he or she meant to do—a lesson emphasized in the Microsoft case, where the ready availability of IE on the desktop was seen as a signal advantage over users’ having to download and install Netscape. The default is all-powerful, a notion confirmed by the value of deals to designate what search engine a browser will use when first installed. Such deals provided 97 percent of Firefox-maker Mozilla’s revenue in 2010—$121 million. The safety valve of “off-road” apps seems less helpful when people are steered so effortlessly to Stores and Marketplaces for their apps.

Security is also a factor—consumers are willing to consign control over their code to OS vendors when they see so much malware out in the wild. There are a variety of approaches to dealing with the security problem, some of which include a phenomenon called sandboxing—running software in a protected environment. Sandboxing is soon to be required of Mac App Store apps. More information on sandboxing, and a discussion of its pros and cons, can be found here.

The fact is that today’s developers are writing code with the notion not just of consumer acceptance, but also vendor acceptance. If a coder has something cool to show off, she’ll want it in the Android Marketplace and the iOS App Store; neither is a substitute for the other. Both put the coder into a long-term relationship with the OS vendor. The user gets put in the same situation: if I switch from iPhone to Android, I can’t take my apps with me, and vice versa. And as content gets funneled through apps, it may mean I can’t take my content, either—or, if I can, it’s only because there’s yet another gatekeeper like Amazon running an app on more than one platform, aggregating content. The potentially suffocating relationship with Apple or Google or Microsoft is freed only by a new suitor like Amazon, which is structurally positioned to do the same thing.

A flowering of innovation and communication was ignited by the rise of the PC and the Web and their generative characteristics. Software was installed one machine at a time, a relationship among myriad software makers and users. Sites could appear anywhere on the Web, a relationship among myriad webmasters and surfers. Now activity is clumping around a handful of portals: two or three OS makers that are in a position to manage all apps (and content within them) in an ongoing way, and a diminishing set of cloud hosting providers like Amazon that can provide the denial-of-service resistant places to put up a website or blog.

Both software developers and users should demand more. Developers should look for ways to reach their users unimpeded, through still-open platforms, or through pressure on the terms imposed by the closed ones. And users should be ready to try “off-roading” with the platforms that still allow it—hewing to the original spirit of the PC, perhaps amplified by systems that let apps have a trial run on a device without being given the keys to the kingdom. If we allow ourselves to be lulled into satisfaction with walled gardens, we’ll miss out on innovations to which the gardeners object, and we’ll set ourselves up for censorship of code and content that was previously impossible. We need some angry nerds.

The Sandbox and the Playground: Changing Rules for Software and Developers

November 29th, 2011 | by Kendra Albert | Published in Future of the Internet | 8 Comments

Update on 2/23/2011: Apple has pushed back its deadline for OSX sandboxing to June 1st, 2012. The deadline was originally November, 2011, but was pushed to March 1st in early November. Although Apple claimed that this change was to give developers time to integrate new permissions from an update, it does follow the announcement of Gatekeeper, which might be a partial substitute for sandboxing.

During the 1990s, PCs ran whatever software was installed on them. Users bought software (not yet called apps) from physical stores or got a copy from their friends. They stuck the CD in the drive, and went through the installation process, or dragged the application to their application folder. The code was “signed” by the developer (by being from a box), or not at all. The operating system didn’t stop and ask “are you sure,” no one typed in a root password, and the applications were limited only by what their programmers had decided when coding. Those were the days of the playground, not the sandbox.

The playground had problems. Software with malicious code or bugs could hijack your PC. Other users could tamper with your files. So sandboxing (although not known yet by that name) was born. Starting as far back as creating separate user directories, to as recent a development as cloud data storage, steps have been taken to make the user’s personal data and computing cycles safely under lock and key – sometimes with the key held by the user, and other times by the operating system maker. When Windows Vista was released in 2009, it tried to solve this problem with “allow” dialogs, which would pop up when an application tried to take actions without the user’s permission. This solution was mostly considered an annoyance, not a feature, as the parameters that caused a dialog were broad and users just clicked through to allow instinctually. Mac OSX’s requests for passwords before installing applications are just another step down this road – meant to put users in control of their own computing destinies, and less dependent on the good will of developers.

On smartphones, things have gone a different way. We take for granted that applications haven’t been able to access all the features of the phone. Android users view a permissions screen that tells them exactly what to expect from an application – whether it can take photos with the camera, keep the phone from sleeping or access GPS. Apple screens its applications on the way into the iOS App Store, making clear what parts of the phone they can get to, and limits users to apps from the store. All of the app’s files are required to stay in their own little corner of the file system. This process of requiring developers to encapsulate their applications within one folder – and to clear with someone for access to things outside – restricts the potential for harm. This is one version of the phenomenon known as sandboxing. Sandboxing, on the most basic level, is a security measure used to run code that’s not trusted. Rather than allowing software or applications to play freely across the machine, sandboxes restrict them to very specific resources, mitigating the damage they can do.

For years, it’s been a standard on mobile platforms and web applets. For example, the Bejeweled game that you’re playing in one of your Chrome tabs doesn’t have any way of accessing the Word document you are supposed to be working on. In fact, your Chrome tabs can’t even access each other, preventing badly coded webpages from crashing your entire browser. These apps can play in their own sandboxes – but not all over your phone or PC. The same wouldn’t be true for Bejeweled if it were a regular PC app – it’d be free to rummage through everything on the hard drive, surveilling, modifying or deleting at will. Knowing that, it’s a marvel that serious viruses didn’t appear sooner and more often.

For phones and web applets, sandboxing is ideal. After all, even you, the user, don’t interact with the underlying file structure of your iPhone or Android device (without jailbreaking), and you certainly wouldn’t want to open an online game and have it be able to make changes to your Word document. Sandboxing has serious security advantages – if programs have to lay out in advance what kind of access they get to a device, and are limited to only specific actions, an app that “goes rogue” or is compromised by malware can no longer cause the same harm to the rest of the user’s data. Similarly, a piece of compromised software can’t run processes in the background that it wouldn’t be able to run anyway – limiting potential damage.

Sandboxing usually also includes signed code, or code that is cryptographically linked to a specific developer license. Not only do Apple and Google know exactly what parts of your phone the code can access, they also know which developer produced the code. Apple’s signature program is run through its developer program, which is tied to a yearly fee, where as Google’s requires some information from the developer, but not a specific license as such.

Enter the Mac App Store

So as things stood previously, most PCs had some steps towards protection against rogue software, but hadn’t taken the sandboxing route. Browsers and smartphones sandbox processes, but different smartphone platforms have different ways of involving the user. Apple’s iOS doesn’t involve the user, and all permissions are handled at the App Store level. Android apps can either be downloaded from the Android Market or from third parties directly. In both cases, a list of permissions are visible to the user and the applicatiosn are sandobxed where they are still sandboxed.

In early November, Apple announced to developers that it was pushing back its deadline for Mac Store Apps to implement sandboxing to March 1st, 2012. This makes the Mac App Store platform much like the Android Market – users have the option to install applications from elsewhere, but all applications that go through the market must be sandboxed. Although the requirements were supposed to take effect earlier this week, the pushed-back date reflects some of the serious problems MacOS developers were running into in making their applications compatible with Apple’s new rules.

Apple’s change marks a huge departure from the way development and code has operated in the past. As discussed above, software on the PC of the past had access to a playground, controlled only by the user’s discretion. Although Apple’s new OSX Lion has supported sandboxing since its release, Apple is using its distribution platform to require that apps follow their new security rules. The App Store push will certainly increase the amount of applications secured.

Although there may be net gains for users who are concerned about the security of applications downloaded from the Internet, there is the potential to limit the types of applications that companies will bother trying to distribute. Programs as widely used as antivirus software and backup utilities are not distributable through the App Store platform, due to the rule against root access, and in the larger scheme of things, Apple’s concerns about security. This means no Norton Anti-Virus, no Dropbox and no MacZip. At this time, distribution outside the store is not problematic; in fact, most large-scale developers seem to not be early adopters. However, as customers become more comfortable with the App Store process, that might change.

OSX Sandboxing in Depth

The sandboxing requirements make applications downloaded through the Mac App Store limited to a very specific set of actions. Ars Technica offered an in-depth discussion of OSX Lion’s sandboxing procedures in its review of the platform, and here are the basics

To play outside the sandbox, applications need “entitlements” that represent permission to access outside tools. Entitlements can include taking photos with the camera, responding to mouse gestures or creating network connections. Lion has about thirty built-in entitlements for applications to request, created and managed by Apple.

When submitting their software to the app store, developers lay out each process that an application might run, and then explain the privileges each one might have. For example, an application like QuickTime decodes video, runs audio, and accesses closed captions from a folder at the same time. Each of those different tasks is split into a sub-process with a different set of permissions – laid out by the developer before submission to the App Store. So the video decoding sub-process of Quicktime has access to the user’s screen and graphics card, but not audio settings. The audio sub-process doesn’t have access to the video card. These divisions keep the software from using system resources without permission. Unlike platforms like Android, users won’t see these processes or entitlement – they’re just for the purpose of Apple approving the software.

Users do have special powers for sandboxed applications – any action that is specifically initiated by a user doesn’t need to be okayed by Apple in advance. They can initiate special, non-entitled actions, like opening a list of recent files or saving documents elsewhere in the file system. Apps can build in these requests without asking for entitlements for them, knowing that the user is going to activate and oversee the process.

Concerns from Developers

Pushback from the development community has come from many fronts. Some developers, such as Recent Redux creator Tim Schroeder, feel that the entitlements that the apps can have do not represent the full spectrum of developers’ needs. There are two very specific use cases that are no longer possible for App Store apps – using AppleScript and file system management

Most users probably don’t interact with AppleScript on a regular basis, but it allows for many of the processes that make software work. Notification systems like Growl, which standardizes user notifications across multiple applications use AppleScript, as do hundreds of apps that allow for better music management in iTunes. On its most basic level, AppleScript is a tool developers use to exchange information between applications, and can produce Apple Events, which make programs take actions. It can run repetitive tasks, print from one application to another, or open applications. However, it also can automate file transfers or photo editing – and will no longer be usable by sandboxed applications. Instead, AppleScript will theoretically be replaced by APIs (application programming interfaces) that allow developers (and Apple) to have better control over application interaction.

Matthias Gansrigler, a developer responsible for applications including ScreenFloat and Yoink, explains how sandboxing could, without a new API, destroy one of his existing pieces of software. GimmeSomeTune (GST) downloads lyrics and album covers, as well as displaying iTunes info in a customizable window. To do those things, GST depends on a connection to iTunes via AppleScript – it extracts information about songs that are playing and uses it to download lyrics and cover art back to iTunes. Without an API, and with Apple eventually sandboxing iTunes, GimmeSomeTune will no longer be able to access the song titles it needs. Gansrigler notes that Apple has not sandboxed iTunes yet, but with it on the horizon, he’s stopping development on the software now.

File system management is the second big field that developers are concerned about. There are many existing systems used by corporations or developers that support version control or sorting of code – and they work in the background in the file system without the user’s consent. Similarly, SSH clients or FTP apps can no longer show real time file trees – which means that all moving of files or downloads must go through the open dialog. To paraphrase an Apple ad, there’s no entitlement for that.

And to make things worse, some of the entitlements are currently temporary, leading developers to be concerned that their software might break after said entitlements are revoked. Apple has promised to provide APIs to replace the temporary entitlements, but it’s not clear when those will be available. In the mean time, developers are in a terrible state of flux – trying to decide whether to continue to put time into applications that may not be able to exist by March.

Independent of the concerns about APIs and entitlements is the uncomfortable truth of the App Store as a completely new way for developers to interact with customers. Although in previous years an OS upgrade or an update could break software, those were rare to the extreme. If an application worked on a computer, it would continue to work. Now, Apple’s role in the development process means that developers have to actively coordinate with Apple to keep their software from breaking – and a slight change in the entitlement system could destroy all of the tethered software. Apple had made itself a controlling party in the application wars – and the consequences of that are still unknown. This sandbox is under the baleful eye of Apple as playground monitor. Given Apple’s willingness to ban security researchers like Charlie Miller from developer programs for publishing security holes, this increased control might not be the security boon anyone hoped for. As if that wasn’t enough, flaws in the sandboxing system have already been reported.

Trading Generativity for Security

Sandboxing represents a true security/generativity trade off. As Jonathan Zittrain said in Chapter 7 of The Future of the Internet and How to Stop It, “Most fundamentally, many of the benefits of generativity come precisely thanks to an absence of walls. We want our e-mail programs to have access to any document on our hard drive, so that we can attach it to an e-mail and send it to a friend.” Applications downloaded from the Mac App Store, in contrast to ones from the generative Internet, may not have these capabilities.

Sandboxing can prevent some damage from an app bound and determined to wreak havoc, but sandboxing is a phenomenon independent of the App Store: Mac OS could implement it with or without Apple screening the software up front. Certainly, not all software that runs on Mac OSX is downloaded through the app store. But as The Unofficial Apple Weblog (TUAW) put it , “There’s also the fact that any discussion that begins with ‘The Mac App Store isn’t the only way to get apps on a Mac’ inevitably ends with the ominous pronouncement ‘yet.’”

Furthermore, there are issues on the development side of generativity. It seems unlikely that developers who are concerned about the market share will develop two versions of the app – (one that’s sandbox safe for the App Store and one that includes extra features that won’t work in a sandbox). As a result, sandboxing might dumb down the feature set available to even those who choose to grab their applications from the Internet. Once programmers are playing in the sandbox, there’s little reason to develop for playground-level access again. Reactions have been slow but scared – app-makers are uncertain as to what a sandboxed future means for their applications and for their distribution.

Even in the short term, where both the App Store and regular distribution methods co-exist, Apple’s sandboxing requirements are a big deal. The uncertainty about the existence of longstanding Mac programming methods like AppleScript and Apple Events, combined with the fact that no one is sure exactly how much business the App Store will do means that the impact is totally unknown. It seems unlikely that Windows 8 or other OSs will follow suit, given that Microsoft hasn’t been pursuing the same sort of distributional model, but the new tethered nature of these applications is a significant change from the way PCs have previously operated. The only thing that’s sure is that Apple would like the future of the Mac platform to be a sandboxed one, and consumers and developers will have to adapt.

12/7/11: Edited to incorporate corrections from the comments re: Android code signing and permissions.

An interview with John Batelle on The Future of the Internet

August 15th, 2011 | by jz | Published in Future of the Internet | Click to comment

John Battelle asked me a few Qs about my thinking on the themes in The Future of the Internet in the three years since the book came out (four since it was drafted!). John’s review is available on his blog, and I’ve reproduce the core of it here:

JBAT:

- You wrote the Future of the Internet three years ago. It warned of a lack of awareness with regard to what we’re building, and the consequences of that lack of attention. it also warned of data silos and early lockdown. Three years later, how are we doing? Are things better, worse, the same?

And a follow up. On a scale of one to ten, where one is “actively helping” and ten is “pretty much evil,” how do the following companies rate in terms of the debate you frame in the book?

- Google (you can break this down into Android, Search, Apps, etc)

- Facebook (which was really not at full scale when you published)

- Apple

- Twitter

- Microsoft (again break it down if you wish)

Thanks!

JONATHAN ZITTRAIN:

Sorry this took me so long! I got a little carried away in answering –

- You wrote the Future of the Internet three years ago. It warned of a lack of awareness with regard to what we’re building, and the consequences of that lack of attention. it also warned of data silos and early lockdown. Three years later, how are we doing? Are things better, worse, the same?

It’s the best of times and the worst of times: the digital world offers us more every day, while we continue to set ourselves up for levels of surveillance and control that will be hard to escape as they gel.

That’s because the plus is also the minus: more and more of our activities are mediated by gatekeepers who make life easier, but who also can watch what we do and set boundaries on it — either for their own purposes, or under pressure from government authorities.

On the book’s specific predictions, Apple’s ethos remains a terrific bellwether. The iPhone — released in ’07 — has proved not only a runaway success, but the principles of its iOS have infused themselves across the spectrum. There’s less reason than ever to need a traditional PC, and by that I mean one that lets you run whatever code you want. OS X Lion points the way to a much more controlled PC zone, anyway, as it more and more funnels its software through a single company’s app store rather than from anywhere. I’d be surprised if Microsoft weren’t thinking along similar lines for Windows.

Google has offered a counterpoint, since the Android platform, while including an app store, allows outside code to be run. In part that’s because Google’s play is through the cloud. Google seeks to make our key apps based somewhere within the google.com archipelago, and to offer infrastructure that outside apps can’t resist, such a easy APIs to geographic mapping or user location. It’s important to realize that a cloud-based setup like Google Docs or APIs, or Facebook’s platform offer control similar to that of a managed device like an iPhone or a Kindle. All represent the movement of technology from product to service. Providers of a product have little to say about it after it changes hands. Providers of services are different: they don’t go away, and a choice of one over another can have lingering implications for months and even years.

At the time of the book’s drafting, the alternatives seemed stark: the “sterile” iPhone that ran only Apple’s software on the one hand, and the chaotic PC that ran anything ending in .exe on the other. The iPhone’s openness to outside code beginning in ’08 changed all that. It became what I call “contingently generative” — it runs outside code after approval (and then until it doesn’t). The upside is that the vast creativity of outside coders has led to a software renaissance on mobile devices, including iPhones, from the sublime to the ridiculous. And Apple’s gatekeeping has seemed to be with a light touch; apps not allowed in the store pale in comparison to the torrents of stuff let through. But that masks entire categories of applications that aren’t allowed — namely anything disruptive to Apple’s business model or that of its partners or regulators. No p2p, no alternate email clients, browsers with limited functionality.

More important, the ability to limit code is what makes for the ability to control content. More and more we see content, whether a book, or a magazine subscription, represented in and through an app. It’s sheer genius for a platform maker to demand a cut of in-app purchases. Can you imagine if, back in the day, the only browser allowed on Windows was IE, and further, all commerce conducted through that browser — say, buying a book through Amazon — constituted an “in-app purchase” for which Microsoft was due 30%?

A natural question is why competition isn’t the answer here — or at least reason to not worry about the question. If people thought the iPhone made for a bad deal, why would they want one? The reason they want one is the same thing that made the Mac so appealing when it first came on the scene: it was elegant and intuitive and it just worked. No blue screen of death. Consistency across apps. And, as viruses and worms naturally were designed for the most common platform, Windows, those 5% with Macs weren’t worth the trouble of corrupting.

We’ve seen a new generation of Mac malware as its numbers grow, and in the meantime a first defense is that of curation: the app store provides a rough filter for bad code, and accountability against its makers if something goes wrong even after it’s been approved. So that’s why the market likes these architectures. I’ll bet few Android users actually go “off-roading” with apps not obtained through the official Android app channels. But the fact that they can provides a key safety valve: if Google were to try the same deal as Apple with content providers for in-app content, the content providers could always offer their wares directly to Android users. I’m worried that a piece of malware could emerge on Android that would cause the safety valve of outside code to be changed, either formally by Google, or in practice as people become unwilling to drive outside the lanes.

So how about competition between platforms? Doesn’t that keep each competitor honest, even if all the platforms are curated? I suppose: the way that Prodigy and CompuServe and AOL competed with one another to offer different services as each chased subscribers. (Remember the day when AOL members couldn’t email CompuServe users and vice versa?) That was competition of a sort, but the Internet and the Web put them all to shame — even as the Internet arose from no business plan at all.

Here’s another way to think about it. Suppose you were going buy a new house. There are lots of choices. It’s just that each house is “curated” by its seller. Once you move in, that seller will get to say what furnishings can go in, and collects 30% of the purchase price of whatever you buy for the house. That seller has every reason to want to have a reputation for being generous about what goes in — but it still doesn’t feel very free when, two years after you’re living in the house, a particular coffee table or paint color is denied. There is competition in this situation — just not the full freedom that we rightly associate with inhabiting our dwellings. A small percentage of people might elect to join gated communities with strict rules about what can go inside and outside each house — but most people don’t want to have to consult their condo association by-laws before making choices that affect only themselves.

FOI Topics and Links of the Week

June 6th, 2011 | by Jennifer | Published in Android, censorship, cybersecurity, filtering, Future of the Internet, Generativity, iphone, privacy | Click to comment

IR-transmitted metadata. Last week, Apple filed for a patent on an iOS camera that can detect infrared in addition to visible light. If a user aims the camera at an object that is sending out additional information about that object in the IR band, the camera transmits that information to the device, and potentially also to the user. This technology could be used to disable the camera at classified government outposts; automatically blur out copyrighted background or foreground images (or, for regimes not squeamish about censorship, disfavored images); provide an automated tour of a city or museum, instead of using traditional visible signs and placards; or even transmit personal requests: “Please don’t photograph my house.” “Please don’t post pictures of my eight-year-old on public sites.” The IR metadata could also be recorded so that it would persist each time the image was transmitted across the internet.

Google wrestles with the generative trade-off. Security experts have found another set of malicious apps in the Android Market and discovered that Google Docs regularly hosts phishing sites.

Falun Gong sues Cisco for facilitating official Chinese repression. Members of Falun Gong have sued tech giant Cisco in a U.S. court, alleging that the company customized its technology to meet government tracking and censorship needs and helped design China’s Golden Shield, the country’s infamous online censorship and surveillance firewall. The group also claims that Cisco marketed its technology as a tool to target government dissidents.

Hargreaves Review published. The review evaluates the fitness of the UK’s intellectual property regime for an internet age. It finds that IP laws put in place several hundred years ago are now stifling modern innovation and goes on to make ten specific recommendations for IP law reform to correct the problem. These recommendations include approaches to clearing patent thickets; dealing with orphan works; and transitioning to evidence-based, rather than lobby-based, IP policy; as well as rejection of a US-like fair use limitation.

Facebook users benefit from a Web of Trust. Clicking a link on your Facebook page that the crowdsourced Web of Trust service has identified as spammy or malicious will now bring up a warning that you may want to avoid the suspect site (and also check out Wikipedia entries on malware and phishing).

iFlowReader closes. Independent iOS e-book retailer iFlowReader shut down at the end of May. According to the company, Apple’s new e-book seller rules made it impossible to turn a profit. (The rules require sellers to give Apple a 30% cut of sales while at the same time limiting the seller to only a 30% commission, so the seller gets the commission from the publisher but then owes it all to Apple.) Company execs expressed frustration that, in their view, Apple maintained complete control over its platform and felt free to change the rules on developers, even after they, relying on the old rules, had been induced to make significant investments.

TiVo and EchoStar settle. The case involving a judicial order to EchoStar to send a remote signal disabling its customers’ DVRs ended in a whimper last month when the parties settled after the Federal Circuit held that EchoStar had waived its arguments that the disablement provision was vague and overbroad. EchoStar had asserted that it legally should not have been forced to disable the DVR boxes because it implemented a design-around instead so that the boxes no longer infringed TiVo’s patents. But the court didn’t reach the merits of this argument, since it held that the time to raise such issues was before the district court found EchoStar in contempt. So while we know that the Federal Circuit doesn’t have a problem with trial courts issuing a disablement provision to remedy patent infringement, we still don’t know whether the infringing party could avoid disabling its users’ products by pushing an update that replaced the infringing technology with a non-infringing alternative.

—Jennifer Halbleib

FOI Topics and Links of the Week

May 5th, 2011 | by Jennifer | Published in Android, cybersecurity, Future of the Internet, Generativity, iphone, news, privacy | 2 Comments

Smartphone tracking data. Two researchers reported last month that Apple has been storing time-stamped location information on users’ iOS devices since June. An unencrypted file with these data is saved onto a user’s computer each time she syncs her device with it, as well. Apple appears to have good reasons for collecting the location information, but mistakenly stored data long-term on the device and collected it even after users turned off all location services. The company says that a fix is on the way. Google’s Android phones collect similar location information, although tracking is opt-in, difficult to use to trace a particular person, and can be disabled by the user. Both companies are being sued.

The U.S. government uses a PC control switch? The U.S. federal government obtained a temporary restraining order in April that allowed it to send to private computers unwittingly part of a massive criminal botnet a command that disabled the malware. In the past, the government has cut off or seized the command-and-control servers and computers that run a botnet, but here – without notice, because federal agents were still trying to collect the IP addresses of infected computers – the government issued a command to personal computers owned by innocent targets of the Coreflood botnet. Arguably, since Coreflood steals private data and loots victims’ bank accounts instead of just generating huge amounts of spam, the government had sufficient justification to order citizens’ (and non-citizens?) computers to kill the program. But in addition to concern that the command itself might unintentionally damage some private machines, such a path may be quite slippery. After all, prevention may be cheaper than disease; why shouldn’t the government push security software to all personal computers? And why shouldn’t it monitor citizens’ online activity to make sure they aren’t downloading programs from malicious sites? Nonetheless, how different is the command in this case from required residential building and health standards or mandatory vaccinations for schoolchildren? The government regulates personal safety in the real world when it implicates the broader public good, why shouldn’t it do the same online? And in the end, an individual can avoid running the command on his computer (and dodge the botnet risk, too) by simply disconnecting from the Internet. Of course, that makes the computer slightly less useful. The phenomenon is reminiscent of this Wired accoun t from 2003, though note the reporter’s credibility appears to be in question. (!)

Google’s questionable Grooveshark takedown. Last week, the Electronic Freedom Foundation criticized Google for removing the popular music service Grooveshark’s app from the Android Market. Google has said that it was responding to an RIAA complaint but has not explained the basis of that complaint. The company did not require notice before the takedown as provided for by the Digital Millennium Copyright Act. If the complaint was grounded in copyright, EFF noted that Google’s actions departed from its longstanding position of requiring such valid notice before takedown. Because the move coincided with Google’s testimony before the Senate Judiciary Committee, EFF speculated that it was designed to mollify any Congressional skepticism that Google was not committed to copyright enforcement. Note that apps can still be added to a phone without having to go through the Android Market.

More consumers demanding iPads in place of laptop PCs. Last quarter, Apple’s profits exceeded Microsoft’s for the first time since 1991. Overall PC sales declined 2%, consumer PCs dropped 8%, and netbooks – the inexpensive and mobile generative PCs most similar tablets like the tethered iPad – fell 40%.

Translating iOS to WP7. Meanwhile, Microsoft is contesting Apple’s dominance of the tethered device market. Microsoft now offers a tool that helps developers convert their iOS apps to Windows Phone 7 apps. It maps the WP7 application programming interface – the set of definitions and rules an app uses to communicate with the phone’s operating system – onto the iOS API, making it easier for developers to port their apps to WP7, giving Windows Phone 7 users access to more apps, and allowing Microsoft to compete with Apple in app marketplace size and range sooner.

And a related discussion of generative PCs and tethered devices including thoughts on JZ’s thesis in the book, as well as a take on his concerns about crowdsourced work.

—Jennifer Halbleib

Why buy a PC when you can rent an un-PC?

May 2nd, 2011 | by jz | Published in Future of the Internet | 5 Comments

Rumor — and that’s all it is — is that Google will announce a $10/month Chrome OS laptop rental. That such a rumor could be credible, whether or not it actually bears out, is a testament to how much our IT ecosystem has evolved in just the past few years. I’ve long been concerned about the death of the PC, whether through the “appliancization” of our endpoint devices like smartphones or through increasing reliance on what’s now known as the Cloud: running our apps, and keeping our data, online instead of on devices that we own.

A rented laptop only makes sense when there’s nothing that will end up on the unit that would make it difficult to lose or trade in. And that’s the promise of Chrome OS and the cloud: the keyboard and screen are generic; everything interesting happens online, either on the public Web or behind the gates of a user’s various online accounts — Gmail, Facebook, etc.

There’s nothing inherently wrong with that, just as there was no inherent ethical case to a decision between an old-fashioned answering machine (keeping your phone messages at home) and voicemail (keeping them … in the cloud). (Remember when people called each other and left messages?)

The reason I’ve singled out the PC’s future is because it’s a bellwether for how much we get to control the code we run and the data we accrete. In the good old days we effectively bought software (its own claim to being merely licensed notwithstanding) and stored our data in our plain view. So long as we didn’t lose or munge our laptops we knew where our data was — and wasn’t.

As abundant, saturating network connectivity makes it more sensible to store stuff on others’ faraway servers, it’s all the more important that we establish technical and legal architectures to preserve our primacy in choosing what code to run and what data to associate with ourselves. I have some thoughts on how to do that here and here.

Update [11 May 2011]: The rumors appear to be true.

(Western) Internet Censorship Providers

April 25th, 2011 | by Jennifer | Published in filtering, opennet initiative | 2 Comments

Last month the OpenNet Initiative published a report that shines light on one of the more sensitive business practices of Western Internet security and filtering companies. These companies – including McAfee (an Intel subsidiary), Websense, and Netsweeper – promote their filtering technologies in the West as tools for parents and schools trying to shield children from online pornography and employers looking to maintain a professional work environment. But they also appear to make their software and URL categorization services available to state-run ISPs and telecoms in Middle Eastern and North African countries, such as Bahrain, UAE, Qatar, Oman, Saudi Arabia, Kuwait, Yemen, Sudan, and Tunisia. These ISPs and telecoms, and the governments behind them, use the software to filter out Internet content that they don’t want their citizens to see.

What content? Well, depending on the Western software company, any of the millions to billions of websites that the company has categorized. And the categories, of which multiple companies boast that they have more than 90, range from porn and violence, to dating and filesharing, to politics, religion, and even anonymizers. All the repressive regime has to do is to buy the software, pay the Western company to maintain the database of categorized websites, click the check boxes next to the categories of sites that it doesn’t want its people to access, and viola, the Western company has commercialized censorship. As the report puts it, “This is not simply a case of a general purpose, neutral tool being used for an end not contemplated by its maker. The filtering products of today engage in regular communications with their makers, updating lists of millions of websites to block across dozens of content categories, including political opposition and human rights.”

The report illustrates how the categorized lists these companies maintain tend to be overinclusive – after all, a governmental customer is unlikely to care if more speech is censored than necessary as long as nothing that it doesn’t want its citizens to see gets through. Furthermore, to give a repressive state the flexibility it needs to oppress effectively, most Western companies also allow their governmental customers to create user-defined lists of sites to filter, in case there is additional content that the government wants to block. Finally, some combination of the Western companies and the governments who use their products has recently moved to obscure attribution of filtering to these products, so citizens – and groups like the OpenNet Initiative – have a hard time determining who is allowing their government to censor the Internet.

It doesn’t have to work this way. Western companies don’t have to sell their filtering tools to repressive regimes – or any government or state-run ISP. They could limit customers to individuals and private employers. Moreover, they don’t need to maintain lists of categorized sites at all. And even if they want to keep lists of violent or pornographic sites for legitimate users, classifications such as “politics,” “religion,” and “privacy” are inexplicable unless the Western company is actively trying to help its governmental customers muzzle speech, and inexcusable then. Therefore, at a minimum, the Western companies could get rid of many of their categories.

Risks would still exist. Governments could steal the technology, as Iran may have done with McAfee’s SmartFilter. And in certain cases, repressive regimes could adapt free software developed for innocuous purposes to filter their citizens’ Internet. These risks – and others – may be sufficient to counsel against supplying anyone with any tool that can be repurposed for state-level censorship. But at the very least, Western companies shouldn’t be continuously complicit in government Internet censorship by selling repressive regimes the software and regularly providing them with updated lists of sites to filter.

It’s remarkable how brazen these Western filtering companies are. For example, one American company, Websense, has an explicit policy not to facilitate government censorship, except to restrict pornography. But among its nearly one hundred classifications listed in the report are such categories as “Advocacy Groups,” “Traditional Religions,” “Political Organizations,” and “Educational Institutions.” Perhaps Websense can articulate a legitimate reason for these categories, but it seems a stretch to relate them to “Adult Content,” which is a separate category in any case.

Another company, Netsweeper, is apparently perfectly willing exploit the freedom of foreign peoples by selling its software to government-backed ISPs looking to “block inappropriate content to meet government rules and regulations ‘based on social, religious or political ideals.’” Meanwhile, McAfee remains mum on how its relationship with repressive governments plays into its business conduct and ethics policy.

In an online world where we condemn oppression of a single netizen as cyberbullying, what do we call the conduct of Western companies that collude with governments to oppress an entire citizenry? Cyberrepression? And should companies that ostensibly exist largely to give parents the control needed to shield children from harmful Internet content be surprised if the government that created them exerts another form of parental control – the kind that parents use on poorly-behaving children with no self-control – by regulating the companies’ own asocial behavior? After all, if corporations have rights and obligations based on the legal fiction of corporate personhood, then these companies are the all-too-real sociopaths of the corporate world.

Even better, customers in Western countries can send a free-market message to these companies without having to resort to a regulatory intermediary: such duplicitous behavior – marketing software in the West as a tool to empower parents and businesses but in the Middle East and Africa as a tool to enervate a state’s citizenry – isn’t acceptable. We shouldn’t buy software that’s supposed to protect if its maker also sells it as a means to abuse.

—Jennifer Halbleib

FOI Topics and Links of the Week

March 31st, 2011 | by Jennifer | Published in Android, blackberry, Future of the Internet, iphone, kindle | 2 Comments

Amazon strong-arms a third-party Kindle service. Amazon shut down Lendle, a popular Kindle service that allows users to lend their books to strangers, last week because it didn’t “serve the principal purpose of driving sales of products and services on the Amazon site.” Two days later, after customers tweeted their displeasure, Amazon informed Lendle of the specific feature that got the service blocked. That feature, Book Sync, scraped the Amazon site itself to determine which books in a user’s library were lendable (not all are). Lendle removed it and is now back up and running. Axing a company’s service to your platform without notice or an opportunity to address the issue is a severe sanction and may intimidate service providers to comply rather than publicly balking at your demands. Here, Lendle disabled the offending feature without a row. Then again, maybe the company knew all along that Book Sync violated Amazon’s policies. While Lendle could argue that Amazon shouldn’t restrict harmless features of third-party services, flagrantly violating those policies could lead Amazon to boot a service.

While Apple and RIM pull the plug. This week both Apple and RIM removed controversial apps from their official app stores. Apple pulled an iOS app from Exodus International that propounded techniques and resources to treat homosexuality. And after several U.S. senators urged Apple, RIM and Google to remove the PhantomAlert app, which maps locations of nearby DUI checkpoints, from their respective app stores, RIM complied. So far, Apple has not removed PhantomAlert and Google refused to pull the app, saying that the app does not appear to violate Android content policies. Apple’s ultimate decision may shed some light on how it views its role as a benevolent gatekeeper: under what circumstances will Apple feel the need to step in and protect users from apps that are legal and don’t harm the device or expose personal data, but nevertheless contain content that users find offensive or believe is personally harmful? Similarly, should Exodus International come out with Android and BlackBerry apps, it will be interesting to see where RIM draws that line – and whether Google draws it. Of course, even if Google were to remove such apps from its official Market, Android’s open platform means that users could still download them from third-party app stores and sites.

And Google flips the kill switch. While Android owners may download third-party apps from Web sites that are independent of the official Android Marketplace, Google retains the power to reach in and remove apps from the phone without the owner’s permission. It recently did just that with over fifty apps containing code that, apparently as an initial step towards constructing a mobile botnet, rooted users’ phones. In this case, the apps were malicious and free. Google prevented users’ phones from co-option by a botnet and the users weren’t out any money. But by highlighting the precision and efficacy of tethering, Google may have put its remote kill switch on the table as a means for removing any illegal content. TiVo v. EchoStar showed us that some courts are willing to force an infringer to reach in and disable infringing devices that users have already purchased and installed in their homes. Courts may be less inclined to take such action against illegal content on a cell phone if it similarly means basically bricking the device. Cutting off innocent users’ phone service would be a much more disruptive remedy than frying their DVRs. But since Google has just demonstrated that it can excise the offending content specifically, why wouldn’t litigants ask courts for it as a remedy?

In the end, all four platforms decided what exactly their users own. Users buy a device, but what that device actually does is a service controlled by the platform. This service is subject to change at the platform’s discretion if, for example, it harms the device or doesn’t fit the company’s business model – and subject to change if senators, courts, advocacy groups, or anyone else can pressure the platform to take action.

Will the U.S. get an Internet “Kill Switch”?

March 4th, 2011 | by mollysauter | Published in cybersecurity, news | 5 Comments

In the past month we’ve seen two countries try to “turn off” the Internet. On January 27, in Egypt, which had previously known few restrictions on Internet access (though, to be sure, intimidation of bloggers and activists was common), nearly all ISPs stopped delivering bits to their subscribers, even though data transiting Egypt from the outside world kept flowing normally. One Egyptian ISP, Noor, stayed up for a few days amidst speculation that it had been spared because major banks and the Egyptian stock exchange were subscribers; subsequently it went down, too. Internet access was then restored before the Mubarak government fell. In Libya, irregular nationwide outages lasting anywhere from a few minutes to seven hours have been occurring since the February 19.

This is nearly unprecedented; only brief incidents in Nepal and Burma, in 2005 and 2007 respectively, could compare. The events have renewed debate over proposed U.S. legislation that might give the government a similar ability to pull the plug on Internet communications in an emergency.

The bill, introduced in the Senate first last fall and again this spring by Senators Collins and Lieberman, was first titled “Protecting Cyberspace as a National Asset Act of 2010,” and then “Cybersecurity and Internet Freedom Act of 2011.” Many observers have simply called it the “kill switch” bill, suggesting that the bill would give the President authority to shut down the Internet, perhaps in ways just seen in the Middle East. That’s an unfair characterization. But there are other reasons to be skeptical about S.3480.

The bill contains a lot more than just the provision for a so-called “kill switch.” It provides for the establishment of a White House Office of Cyberspace Policy, tasked with oversight over all “instruments of national power relating to ensuring the security and resiliency of cyberspace” and the enforcement of security standards developed by the National Institute of Standards and Technology (NIST) across both public and private sector “critical infrastructure systems.” (NIST is the National Institute of Standards and Technology, an agency at the Department of Commerce tasked with advancing measurement science, standards and technology. Among other things, it houses the atomic clock which keeps the nation’s official time.) It also provides for the establishment of a National Center for Cybersecurity and Communications at the Department of Homeland Security, which would oversee the United States Computer Emergency Response Team, which, as the public/private operational arm of the National Cyber Security Division, acts to disseminate cybersecurity information from the research and government communities to the private sector.

Then there’s the most controversial bit: the bill proposes that, in the event of a “cyber emergency” as declared by the President, the Department of Homeland Security could issue mandatory orders and directives to “critical infrastructure systems”. This has been interpreted as meaning that the goverment could “shut down” the internet within the United States.

Under what circumstances this would be warranted depends largely on interpretation. The bill says a “cyber emergency” is an “actual or imminent action by any individual or entity to exploit a cyber risk in a manner that disrupts, attempts to disrupt, or poses a significant risk of disruption to the operation of the information infrastructure essential to the reliable operation of covered critical infrastructure”. “Critical infrastructure” is in turn defined as those systems whose “disruption or destruction would cause a mass casualty event which includes an extraordinary number of fatalities; severe economic consequences; mass evacuations with a prolonged absence; or severe degradation of national security capabilities, including intelligence and defense functions”.

That all sounds pretty narrow: most Web servers would not qualify as that type of infrastructure–nor would a small ISP. Responding to criticism of the kill switch idea, the Senate has said that the bill is intended to provide a “precise, targeted and focused way for the President to defend our most sensitive infrastructure,” further defining that infrastructure as systems involved in the vital maintenance of the telecommunications networks, electrical grid, water systems and financial systems. Of course, as more systems move to the cloud, there’s a question of whether we will start to find these critical infrastructure systems interwoven with more mundane civilian resources, and what the implications of such mixing would be under this bill.

Putting it all together, this means that a cyber emergency would only to be declared in the event of an imminent risk of massive death and destruction, severe economic damage, mass evacuations or harm to our national security capabilities—the worst of all possible scenarios. But a critical issue is what kind of review there would be of whether a declared emergency really qualifies under the bill. Though there is no direct identification of critical infrastructure beyond those whose disruption would cause scenes from the movie 2012, there is a means in the bill for those designated as critical infrastructure systems to appeal that classification.

The new draft of the bill– likely responding to public anxiety over kill switches–explicitly forbids a shut down: “neither the President, the Director of the National Center for Cybersecurity and Communications or any officer or employee of the United States Government shall have the authority to shut down the Internet.”

Any emergency measures developed and implemented in the event of a cyber emergency would also expire within thirty days, with the possibility of several thirty day extensions. To be sure though, thirty days is a long while in Internet time, and more than enough time to change, perhaps irreversibly, a company who find itself on the wrong side of the critical infrastructure designation. Most important is to try. It’s also hard to imagine the circumstances under which these provisions would be invoked. By the language of the bill, it would appear to be nothing short of a massive virus–or physical–attack in which ISPs stood idly by as malware spread like. Of course, should that situation arise, it’s not clear that sending in the Marines (figuratively, if not literally), and telling various ISP’s to fix it would make any difference–as if they somehow wouldn’t be trying to do that anyway, and as if the government would have any comparative advantage in understanding the situation than the Internet engineers themselves would have.

Oddly, the U.S. government may already have the authority to shut down the Internet anyway. Section 706 of the Communications of Act of 1934 – written into the Act shortly after the 1941 attacks on Pearl Harbor – provides the President with the ability to shut down “any facility or station for wire communication” or take federal control of such facilities in the event of a “state of war” and for up to six months after the expiration of such a state. Of course, the War Congress of 1941 wasn’t thinking about the Internet at the time, though there is some indication that the Department of Homeland Security believes this provision could apply. In June of 2010, the Department of Homeland security apparently cited Section 706 as “one of the authorities the President would rely on if the nation were under a cyber attack.”

The new bill does not permit such a Federal takeover or shutdown, limits the amount of time a cyber emergency declaration can be in effect, and contains language intended to render the emergency measures as non-disruptive as possible.

Beyond the legalities or politics of drastic action, it’s worth asking whether the type of Internet shutdown seen in Egypt and elsewhere is even possible in the United States. Internet penetration in Egypt is around 15.4%, high for Africa but low compared to the rest of the Middle East; penetration in Libya is around 5% ; in Burma Internet penetration is at less than 1%. They have much smaller populations than the US, in smaller geographic areas. The shuttering of one or two ISPs has a much greater effect in these small markets than it would in the States. It is unlikely that the government could, though social and political pressure not backed up by statute and public accord, cow the hundreds of different ISPs operating in the continental United States to all shut down at once. Someone bent on disrupting Internet access would have to focus on Tier 1 ISPs – those who provide Internet access to other ISPs, and for which a shutdown would have the biggest ramifications. Another potential method for shutdown would be disrupting one or more of the major Internet exchange points or “carrier hotels” that exist around the country. Going after major wireless providers could also have a big impact. However, the likelihood of a complete shutdown remains low: at the point such a measure would be attempted we’d likely have plenty of other problems to raise with such an overreaching government. More important, with Internet access so crucial to the economy and to state and federal governments, a broad-based shutdown would carry incalculable costs. The point at which the Internet is so suffused in a society that a censorious government could consider turning it off is also the point at which the Internet is so suffused in a society that a government would likely not dare turn it off. Egypt and Libya provide new and surprising counter-examples to that hypothesis, but even in Egypt access was restored while the Mubarak government was still in power. And the level of integration of the Internet with layers of the American economy and communications system is an order of magnitude more than in Egypt and certainly Libya.

So, while there is no a kill switch hidden in the bill, it provides for the establishment of two federal bodies responsible for the development and enforcement of certain private and governmental security standards in the area of critical infrastructure systems, and establishes the ability of the government to give mandatory directives and orders to the private operators of critical infrastructure systems in the event of a cyber emergency, which is defined to sound a lot like a real emergency.

That said, is this bill a reasonable reaction to the current state of cybersecurity in this country?

The bill endows NIST with the ability to create security standards, in conjunction with the private sector, which would then be imposed on federal agencies and private operators of critical infrastructure systems. This introduces the potential for mission creep, and moreover, it is simply not known what those standards will be yet. Would such standards include the capacity for deep-packet sniffing, other methods of surveillance or backdoors? Who within NIST and the private sector would have final say in the creation of these standards, their implementation and enforcement? Does the government currently possess the expertise to take on this task to begin with? What actions will the relevant agencies take to ensure they have that experience at the ready when it comes to developing these standards?

When it comes to improving the online security environment in this country, everyone has work to do, including the federal government. Keeping up with patches and updates, changing default usernames and passwords on critical systems and choosing unique, complex passwords that change regularly are just some habits of good security that should be widespread but aren’t. Some parts of this bill, like section 301 which in part provides for the withholding of bonuses to senior agency officials whose agencies aren’t up to snuff, may be a good step towards implementing a functional and habitual security environment at the federal level. Some other sections clearly need more consideration and debate.

That the information security environment in this country and around the world needs work is clear. Whether or not this is the bill that is needed, or even whether the federal government should have a role in regulating civilian, private sector infosec, is less so.

An edited version was published this morning by the MIT Technology Review.

Previously

May 2, 2012

Help pioneer Casebook: The Next Generation

by jz | Read | 1 Comment

We at the H2O project are seeking a full-time Project Manager. H2O is an online platform for textbook development and distribution, currently in a pilot stage. H2O is based on the open source model – instead of locking down materials in formalized textbooks, we believe that course books can be free (as in free speech) [...]

Mar 21, 2012

Meme patrol: “When something online is free, you’re not the customer, you’re the product.”

by jz | Read | 14 Comments

I participated in the Berkman Center’s fascinating HyperPublic symposium in the summer of 2011. When moderating a panel I invoked the aphorism that “When something online is free, you’re not the customer, you’re the product.” It’s a way of encapsulating the idea that online free services usually make money by extracting lots of data from [...]

Feb 17, 2012

OS X Mountain Lion and Gatekeeper

by jz | Read | 4 Comments

This week, Apple announced that it was moving to a new, faster OS X operating system development cycle, starting with the release of Mountain Lion next summer. It previewed a number of features for the OS, and released some parts in beta. Mountain Lion is slated to include a feature called Gatekeeper as part of [...]

Feb 13, 2012

GPS-based Insurance Rates: The Devil is in the (Data) Details

by jz | Read | 3 Comments

A British insurance company called Motaquote has teamed up with TomTom, the GPS manufacturer to offer insurance prices based on data gathered by GPS. Fair Pay Insurance, Motaquote’s new program, is an opt-in insurance pricing scheme where drivers will get a free GPS unit in return for potentially lower (but possibly higher) premiums. The GPS [...]

Jan 27, 2012

Controlling Cyberspace

by Kendra Albert | Read | 8 Comments

This semester, we’re starting an exciting new class, aimed not at lawyers, but undergraduate CS students here at Harvard. It’s called CS42: Controlling Cyberspace – and we’re sharing the syllabus online. Anything big we’re missing?

Jan 27, 2012

Computers Going Wild?

by Kendra Albert | Read | 1 Comment

Computers Gone Wild: Impact and Implications of Developments in Artificial Intelligence on Society was an informal discussion that took place at Harvard Law School on December 8th, 2011. Hosted by Jonathan Zittrain, Marin Soljačić and the Berkman Center for Internet & Society, we brought together eighteen mostly local guests to discuss the ways that AI is changing [...]

A close look at SOPA

A Close Look at SOPA

Jonathan Zittrain, Kendra Albert and Alicia Solow-Niederman

1. Copyright enforcement against websites, foreign & domestic.

Public Remedies (H.R. 3261, 112th Cong. § 102 (2011).)

Private Remedies (H.R. 3261, 112th Cong. § 103 (2011))

Issues Common to Both Public and Private Remedies

Immunity for Voluntary Action

2. “Notorious foreign infringers” and U.S. investors ((H.R. 3261, 112th Cong. § 107 (2011).)

3. Amendments to existing criminal copyright laws

Criminal penalties for streaming. (H.R. 3261, 112th Cong. § 201 (2011).).

Additional criminal penalties (H.R. 3261, 112th Cong. § 202-203 (2011).).

4. Protecting IP rights abroad

Conclusion

Jonathan Zittrain is a member of the boards of the Electronic Frontier Foundation and the Internet Society. Both organizations have weighed in on this bill. However, the opinions expressed above are his (and our) own.

The PC is dead. Why no angry nerds?

The Personal Computer Is Dead

The Sandbox and the Playground: Changing Rules for Software and Developers

An interview with John Batelle on The Future of the Internet

FOI Topics and Links of the Week

FOI Topics and Links of the Week

Why buy a PC when you can rent an un-PC?

(Western) Internet Censorship Providers

FOI Topics and Links of the Week

Will the U.S. get an Internet “Kill Switch”?

Previously

Help pioneer Casebook: The Next Generation

Meme patrol: “When something online is free, you’re not the customer, you’re the product.”

OS X Mountain Lion and Gatekeeper

GPS-based Insurance Rates: The Devil is in the (Data) Details

Controlling Cyberspace

Computers Going Wild?

About Jonathan Zittrain

Tweets from Z

Blog Archives