• Home
  • About
  • Blog
  • News
  • Events
  • Media
  • Video
  • Glossary
  • Contact
  • Download
  • RSS

The Future of the ‘iPatriot Act’

July 14th, 2008  |  by bballou  |  Published in Future of the Internet  |  12 Comments

Larry Lessig’s generous review of the Future of the Internet makes an interesting point:

“Whether a single event, or a coordinated event, whether intentional, or accidental, it is simply a matter of time before a catastrophic network event happens. And when it happens — think of it as a kind of i9/11 event, but the bad guys are not Al-Qaeda — will we be prepared for the inevitable iPatriot Act response? Are we better prepared than civil libertarians were when we were hit with the USA Patriot Act? Have we even framed the right debate?”

First, will there be an ‘i9/11′, and second, will it prompt an ‘iPatriot Act’? The actual chances of a catastrophic network failure are pretty slim. But were one to occur, it would probably look a lot like the attacks on the DNS root servers in 2007. Here’s what happened:

The 13 Domain Name System (DNS) root servers record who controls the Top-Level Domains (‘.com’, ‘.edu’, ‘.uk’, and so forth) and where. This file of information is quite small, and very few computers actually have to call upon the root servers to find the sites they’re looking for. But without them, the single Internet we’re used to would fracture, and computers would have no easy, reliable way to find the IP addresses they’re looking for.

On February 6, 2007, hackers issued a Distributed Denial of Service (DDoS) attack on the root servers, sending gigabytes of useless requests every minute in order to overload the roots and prevent them from responding to genuine Internet traffic. Such an attack was made possible only by harnessing the power of hundreds or thousands of ‘zombie’ computers infected with malicious bots.

The 2007 DDoS attack failed, however. Because the malicious network traffic was relatively easy to distinguish from genuine network traffic, and because most of the DNS root servers were able to distribute the requests over hundreds of component computers, only two of the 13 servers (each themselves made of dozens of computers) were affected. And this was the most successful such attack against the network. In order to noticeably disable network traffic, hackers would have to (in theory at least) destroy all thirteen servers.

All of this is to say that a catastrophic network failure, while possible, is unlikely. But that’s not to say there won’t be an ‘iPatriot Act’. In fact, we’re already seeing its development in agencies and hearings across the country, as regulators push policies that discourage open, generative products and encourage closed, tethered ones.

Take, for example, the Department of Homeland Security’s list of ‘best practices’ for software developers. Among the suggestions:

Don’t trust users: “Developers should assume that the environment in which their system resides is insecure. Trust, whether it is in external systems, code, people, etc., should always be closely held and never loosely given.”
Secure the end-points: “Attackers are more likely to attack a weak spot in a software system than to penetrate a heavily fortified component. For example, some cryptographic algorithms can take many years to break, so attackers are not likely to attack encrypted information communicated in a network. Instead, the endpoints of communication (e.g., servers) may be much easier to attack.”

In themselves these are not bad pieces of advice. But within DHS’s broader vision of online security, they indicate that the government considers safe technologies to be tethered technologies, and vice versa.

Take as further examples any of the current IP-enforcement laws working their way through Congress. H.R. 4279 would create an IP czar at the Department of Justice; S. 522 would create an entire ‘Intellectual Property Enforcement Network’; and S. 2317 would allow the Department of Justice to sue copyright infringers in civil as well as criminal court.

What’s interesting about these bills is that more often than not, Intellectual Property protection is packaged as consumer protection. In fact, just last month the Senate held a hearing entitled “Protecting Consumers by Protecting Intellectual Property”, in which witnesses and legislators advocated for the very bills discussed above.

What all of this amounts to is that agencies and officials are pushing increasingly closed systems of code and increasingly strict Intellectual Property regulations. Both of these encourage increasingly tethered appliances. We don’t need a catastrophic network failure to have an ‘iPatriot Act’: such an act is already in the works.

Responses

Feed
  1. James Morris says:

    July 18th, 2008 at 4:37 pm (#)

    I agree with you optimism about the basic networks robustness in principle. It’s more like the highway system than a tall building.

    After 9/11 I began musing that the most vulnerable targets are ones with high potential energy and/or low entropy, e.g. sky scrapers and jet fuel. The internet, after all, was conceived as a thing that could survive attacks. The giant server farms might not be a good idea…

  2. The Future of Internet Security « Blurring Borders says:

    July 19th, 2008 at 6:23 pm (#)

    [...] this over-regulation has already started to take place, but it could certainly get worse. To help flesh out some of the important ideas about the future [...]

  3. nail says:

    August 8th, 2008 at 12:20 am (#)

    You can slap it around, spit on it, call it names, try to regulate it– it’s iNevitable. Not like a bad novel. No climax… just TIA.

  4. Alex Jones’ Prison Planet.com The Future of the ‘iPatriot Act’ says:

    August 8th, 2008 at 4:52 am (#)

    [...] Future of the Internet Friday, Aug 8, 2008 [...]

  5. phree says:

    August 8th, 2008 at 8:35 am (#)

    There is no need to pass an iPatriot Act though the bills above do tighten down the surveillance conduits and make it easier for the government to block critical domains and enforce the DMCA. The Patriot Act, Homeland Security and DMCA all contain very onerous surveillance provisions that allow any investigator to tap into your computer via the internet IP on your machine. I am a Ph.D. working on describing data-mining and surveillance technologies. My research reveals that the deal was done in the Homeland Security Act. The pieces of legislation above just close the door for any last minute challenges.

  6. Cory says:

    August 8th, 2008 at 10:25 am (#)

    The elite are scrambling to patch the hole that is the internet. The emergent abilities of a global network — and, more specifically, of a public with access to that network — were not foreseen. We have them at a rare and vital moment of weakness; one in which their usual and known formulas have failed.

    But we must move fast.

    They are very adept at maintaining power, and the time will not last. We must be diligent, and move fast while we can.

  7. Patriot Act, The Future and Death of The Internet, etc. « THE “G” BLOG @WordPress.com says:

    August 9th, 2008 at 11:07 am (#)

    [...] Future of the Internet Friday, Aug 8, [...]

  8. Law Professor: There’s going to be an Internet 9/11 « noworldsystem.com says:

    August 10th, 2008 at 8:07 am (#)

    [...] The Future of the ‘iPatriot Act’http://futureoftheinternet.org/the-future-of-the-ipatriot-act [...]

  9. Chris Grey says:

    August 15th, 2008 at 5:21 pm (#)

    I like how they only mention (.com, .edu, and .uk). Not (.net, or .org), and H.R. 4279 would create an IP czar at the DOJ? A czar?! This is ridiculous. The totalitarianism of this reeks, and that’s the pungent smell of evil.

  10. Blurring Borders » Blog Archive » The Future of Internet Security says:

    October 14th, 2008 at 3:20 pm (#)

    [...] this over-regulation has already started to take place, but it could certainly get worse. To help flesh out some of the important ideas about the future [...]

  11. The Future of the ‘iPatriot Act’ « DC: Freedom & Linux says:

    January 8th, 2009 at 1:42 pm (#)

    [...] Future of the Internet Friday, Aug 8, 2008 [...]

  12. Free Culture: An Essay on the Internet, Copyright and Creativity – Part 4 « Dead Wild Roses says:

    June 29th, 2009 at 12:12 pm (#)

    [...] Zittrain.  “The Future of the Internet and how to Stop it.”  Last Updated July 14, 2008.  http://futureoftheinternet.org/the-future-of-the-ipatriot-act (Accessed: August 10, [...]

Blog

  • FOI Topics and Links of the Week
  • The Extraordinaries Haiti Earthquake Support Center. A followup post on the Extraordinaries’ efforts to use ubiquitous human computing to help find missing people after the Haiti earthquake — a positive vision inspired by JZ’s nightmare scenario of crowdsourced secret police work. Did they succeed? “Yes and no”—but, as they detail, there’s obvious potential for future disaster relief.

    Amazon Cracks Open the Kindle. Amazon is opening the Kindle to outside developers who can market their products in what sounds exactly like an App Store, down to the 70-30 revenue split and and light policing of apps. (One difference is that developers have to pay for wireless delivery.) It’s seeming like this is *the* model for the next few years. Speaking of which…

    Computers Should Be More Like Toasters. The sale of the Apple Tablet could mark an important moment for generativity. Computers have been shrinking and phones have been growing—but the critical difference has been that anyone could still code for a computer, until now. The Tablet looks more like a computer than a phone, but will Apple will prescreen apps they way it does for the iPhone? Farhad Manjoo thinks that would be a good thing, but there are clear generativity costs.

    The Splinternet means the end of the Web’s golden age. Josh Bernoff points out that, as we switch to appliancized computers and smart devices instead of PCs, the web becomes a “splinternet.” Websites show up and operate differently on each device. He thinks about how to handle this from a business and marketing perspective, advising: “Here’s what not to do: panic and try to unify things again. The shattering cannot be undone.”

    Technology Changes “Outstrip” Netbooks. Meanwhile, the BBC considers the convergence among netbooks, smartphones, and tablet notebooks, and who the short- and long-term winners are likely to be.

    Apple censors Dalai Lama iPhone Apps in China. An interesting look at how censorship works on iPhones in China. (The story was written pre-Google announcement, so some portions are out of date.) Apple, complying with local law, appears to be removing apps related to the Dalai Lama in the Chinese App Store, and a search for Falun Gong apps freezes the search page. On the other hand, it’s possible to access YouTube through an iPhone app, which isn’t always possible on a PC.

    And in the crystal ball dep’t — from JZ’s book:

    Imagine entering a café in Paris with one’s personal digital assistant or mobile phone, and being able to query: “Is there anyone on my buddy list within 100 yards? Are any of the ten closest friends of my ten closest friends within 100 yards?” Although this may sound fanciful, it could quickly become mainstream. With reputation systems already advising us on what to buy, why not have them also help us make the first cut on whom to meet, to date, to befriend? These are not difficult services to offer, and there are precursors today.

    As usual, there’s an app for that… the “datecheck” app allows you to enter a name, phone number, or email address, and get information on your date. The categories are “sleaze detector” (check of criminal convictions & sex offenses), “$$$” (home ownership, etc), “interests” (gleaned from social networks), “living situation” (who they live with), and “compatibility”—although unfortunately, the “compatibility” check is still just a check of astrological signs. Now all they need is friends’ feedback rankings.

    —By Elisabeth Oppenheimer

  • Life in a clickshop
  • In talks about ubicomp, JZ gives an example of a worst-case scenario involving ubicomp platforms. He imagines that the Iranian government could use Amazon Mechanical Turk to identify dissidents, simply by posting pictures of protestors and ID-card pictures of the adults in the country, then asking Turkers to match protestor pictures to ID-card pictures. Voila—and the Turkers wouldn’t necessarily have to know what they were doing. In the department of amazingly cool ideas, though, the folks at the Extraordinaries reflected on the Iran example and then turned it around. After the earthquake in Haiti, they posted news wire pictures of people in Haiti (with crowdsourced help), asked others to post pictures of missing relatives, and finally asked volunteers to try to match the two up. This is v 1.0 of what could be a terrific and widely-used technology after natural disasters, allowing people at home to do more than just donate money.

    As we keep thinking about ubicomp and the potential upsides and downsides, it’ll be important to keep in mind that it’s a tool—a largely undeveloped one as yet—with much room to develop in both directions. In that spirit, I wanted to comment on this piece from Technology Review that casts a skeptical eye on Prof. Zittrain’s recent column in Newsweek on cloud labor (also known as ubiquitous human computing). The Newsweek editors gave the piece the ominous headline “Work the New Digital Sweatshops,” and Tech Review bloggers question whether that’s really a fair description of the Mechanical Turk platform. I’m not sure there’s a real disagreement here—the Newsweek headline overstated the content of the piece. Much of the point, as I read it, was just that cloudwork practices are so new, dynamic, and varied that it’s hard to know what the good and bad effects will turn out to be. As they point out, this could be a boon for workers here in the US who want flexibility and autonomy, as well as creating new kinds of opportunities for workers abroad. A few specific points are worth thinking about, though.

    They quote John Horton, at Harvard, who put out a HIT (“human intelligence task”) on Amazon Mechanical Turk asking about working conditions, and found that a small majority think AMT requestors treat workers better than most real-world employers. That surprised me—maybe I spend too much time reading Turker messageboards, where the theme is often discontent. I wonder, though, whether many responders use AMT for fun or small income supplements, rather than to earn a living wage, which changes the complexion of the situation. Even if Horton is wholly correct, though, it doesn’t mean requestors can’t improve. For a project I’m doing for JZ’s winter cyberlaw class, we’ve put up some AMT HITs asking about worker satisfaction. We’ve found that people do not like doing search engine optimization or creating spam, and a majority (though not an overwhelming one) likes knowing what the project is for. Disclosure of the company’s identity or the project purpose could become a much stronger norm on AMT, which would help fend off the problems of work alienation and unwittingly doing bad things with the platform, but wouldn’t detract from any of the benefits TR bloggers praise.

    The other major point they make is that this type of work can be good for workers in developing countries. That’s definitely true in some cases (see, for instance, previous blogging about CrowdFlower’s GiveWork program). I certainly don’t have enough background in international development to make an unambiguous statement either way. But surely it’s worrisome that children can be made to do the work as well as adults—there’s just no way of knowing who’s at the other end of the system. Overall, for better or for worse, we live in a society where we’ve decided that paternalistic labor laws play some valuable role. Some of them can be imported into an AMT context—but maybe not internationally—and the technology means that some can’t, even if, like child labor, there’s widespread condemnation. I would agree, and I think JZ would too, that we don’t want regulators charging in with too heavy a hand. But we should be alert to what’s happening on these platforms.

    —By Elisabeth Oppenheimer

  • A quick cosmology question
  • The amazing Hubble telescope has now shown us images of galaxies from 13.2 billion years ago.  That’s because the light comes from 13.2 billion light years away, and took (by definition) that much time to get here:

    “The deeper Hubble looks into space, the farther back in time it looks, because light takes billions of years to cross the observable universe,” the Space Telescope Science Institute said in a statement released Tuesday.

    So that makes sense on one level.  But here’s what I don’t get: the light only took that long to get here if the starting point for it was in fact 13.2 billion light years away.  Since the universe is expanding, if one rewinds time, it shrinks.  Indeed, I thought the Big Bang to mean that at one point the Universe was a singularity, both meaning in a condition for which our laws of physics can’t say anything, and that it was essentially compressed into a single point.

    But if it was compressed into a single point — apparently about 5-600 million years further back from the 13.2 billion we’re now seeing — that means that 14 billion years ago everything was, well, extremely close to everything else.  So unless the universe is expanding faster than the speed of light, how could anything be 13.2 billion light years away from us, 13.2 billion years ago?  Maybe something is that far now, but if so its light would only just be starting its journey to us.  The whole light year calculation presumes that something was that far away from us then – a time when the whole universe was much, much smaller in diameter.  Maybe it has something to do with the universe’s expansion as a matter of dark energy, e.g., the fabric of the universe itself expanding, vs. the expansion found as all the galaxies speed away from one another (countered by the actions of gravity)?  Something to do with the “inflationary period” catapulting everything really far away from everything else in one swoop?

    I’m sure I’m missing something here.  What is it?

  • Google takes on China
  • Google announced today that it would cease (well, phase out) censoring the results in google.cn, the Chinese-language version of its famed search engine.  It’s a pretty stunning move, both in its fact and in its execution.  First, the announcement of “A new approach to China” may appear to have buried the lede.  The lion’s share of the post is devoted to describing a series of coordinated attacks on the accounts of human rights activists, including those who use Google.  It includes a link to the amazing story of GhostNet, discovered by fellow ONI researchers when the Dalai Lama gave them his oddly-acting laptop to examine.

    Companies rarely share information about the cyberattacks they experience — conventional wisdom has it that it makes the company appear vulnerable, and drives customers away.  Here Google is open about the attacks, while of course assuring readers that it had tightened security as a result.  Google then links these attacks to a lessening of enthusiasm for doing business in China.  Eliminating censorship in google.cn is only mentioned after that.

    Suppose the Chinese government acts as expected and tells Google that it may no longer operate in China.  Google.cn might vanish as a domain name, since it’s hosted under the Chinese country-code TLD of .cn, ultimately controllable by the Chinese government.  But the search engine found there could of course keep operating from a different location, like cn.google.com.  Suppose then that China attempts to filter out traffic to and from that new location — and to and from google.com for good measure, as it has done from time to time, especially before the advent of google.cn and its agreement to censor.  (We’ll be watching for such moves at herdict.org, a site where users can report Web blockages.)

    What next?  My hope, and expectation, is that Google engineers who might have been a bit halfhearted about implementing censorship mandates in google.cn could be full-throttle in coming up with ways for Google to be viewed despite any network interruptions between site and user.  There are lots of unexplored options here.  They’re unexplored not because they’re infeasible, but because most sites would rather not provoke a government that filters.  So they don’t undertake to get information out in ways that might evade blockages.  Here, Google would have nothing more to lose, so could pioneer some new approaches.  Circumvention of filtering (or other blockages, for that matter) tends to happen on the user side of things, seeking out proxies like the Tor network, or anonymizer.com.

    To be sure, many of the larger benefits of operating in China originally cited by Google four years ago — exposing the citizenry to services beyond those locally grown and monitored; engaging them beyond the “China Wide Web” to which some government officials aspire to limit them; and gaining market share that can create momentum and support for later loosening of restrictions — may attenuate.  Google.cn is less known and used than, say, the local Baidu search engine, which boasts about 60% market share.  That share is about to get even bigger.

    But drawing a line is both the right move and a brilliant one.  It helps realign Google’s business with its ethos, and masterfully recasts the firm in a place it will feel more comfortable: supporting the free and open dissemination of information rather than metering it out according to undesirable (and capricious) government standards.

  • Malicious Apps in the Android Market
  • As we knew would happen sooner or later, a dangerous malicious app has apparently made its way into Android’s Market. The app is said to “create[] a shell of mobile banking apps” and collect users’ personal information. It’s been removed; no word on how many users, if any, were actually affected.

    Offhand, I can’t think of an app with comparable problems that has gotten into iPhone’s app store. What will be really interesting about this incident, and the similar ones that are sure to follow, is how users and vendors react. I can imagine this creating hysterical urging for Google to pre-screen all Android apps the way Apple does, but I think that would be premature. Yes, an open Market(s) is going to have more questionable apps, but there are many solutions other than lockdown—a strong user ranking for apps (which already exists), a way to alert people who have already downloaded the app, sandboxing (which admittedly wouldn’t have mattered here), or a quick way to freeze the app while complaints are investigating. They’re only partial solutions, but lockdown is only partial, too.

    Now that the Android OS is really starting to take off, this story is going to be repeated, and we’ll get to see how strongly committed Google is to the principles it built the OS on — and whether there are models out there for vetting third party code that do better than those of the generative PC, but aren’t as restrictive as that of the iPhone.

    —By Elisabeth Oppenheimer

    Update: eWeek reports that Google has removed a number of suspicious apps from its marketplace.  Of course, the more generative structure of the Android market means that “banned” apps can be obtained elsewhere — unlike the iPhone app monopoly enjoyed by Apple, where the iPhone App store is the only point of distribution.  –JZ

About Jonathan Zittrain

jonathan zittrain

Jonathan Zittrain is Professor of Law at Harvard Law School and co-founder of the Berkman Center for Internet and Society at Harvard Law School

RSS Tweets from Z

  • Hosting Cliff Stoll at the Berkman Center tonight http://cyber.law.harvard.edu/events/2010/02/stoll
  • Iranian internet+sms "conveniently" slowing down b4 planned protests: http://bit.ly/9YzC3m
  • RT @ruskin147: http://bit.ly/aLmScH New blog post - Apple - an open and shut case. Linking to the Zittrain piece in FT - and starting in ...
  • iPad: a fight over freedom at Apple's core http://bit.ly/bglwoG

Blog Archives



Creative Commons BY-NC-SA Jonathan Zittrain unless otherwise noted.
Powered by WordPress using Gridline Lite.