Stillborn Thoughts

News, Issues, and Analysis on the intersection of Law and the Internet

Saturday, January 07, 2006

Article: Excellent Contribution to the debate over Network Neutrality


Living in Tahoe City, without direct access to internet and/or television, my ability to blog has been somewhat comprimised. Regardless, I plan on being able to make it out fairly regularly to one of the few wireless cafes that Tahoe has to offer, fueling my technological analysis, commentary, and ranting with Alpen Organics Coffee.

So basically, I'll post something every week, although it might be a bit scatterbrained and caffeine influenced.

This week's article comes from Jonathan Zittrain of Oxford University and Harvard's Berkman Center. The article is from Legal Affairs (and freely available online), entitled "Without a Net." There's been a lot on network neutrality lately, and the obvious question is why anyone should be subjected to yet another academic libertarian warning of the coming war between a glorious free market virtual world where children and animals frolick happily, and a walled garden approach which essential renders any experimental or creative attempts null, hailing a new apocalyptic era of fire, brimestone, and DRM.

The reason Zittrain's article is not only relevant, but necessary, is that he takes into account the problems inherent with a pure nuetrality approach:
"the problem with end-to-end neutrality on a consumer Internet is that it places too much responsibility on the people least equipped to safeguard our informational grid: PC users. Mainstream users are not well positioned to painstakingly tweak and maintain their own machines against attack, nor are the tools available to them adequate to the task. People can load up on as much antivirus software as they want, but such software does little before a security flaw is uncovered. It offers no protection when a PC user runs a new program that turns out to be malware, or if one of the many always-running "automatic update" agents for various pieces of PC software should be compromised, allowing a hacker to signal all PCs configured for these updates that they should, say, erase their own hard drives."
One of my favorite quotes is from a video from the hacker Blueberry of condemned.org.... i forgot exactly where I saw it (some video of an anti-child pornography conference)... but she essential said that "if we [the online community] don't regulate the virtual world, someone else will." Zittrain appears to concur with such a sentiment in pointing out that the burden CANNOT be left on the consumer-and it also exposes the shortcomings of a network where all the intelligence is in the 'ends.' He continues:
"End-to-end neutrality should be but an ingredient in a new "generativity principle," a rule of thumb that asks that modifications to the PC/Internet grid be made where they will do the least harm to its generative possibilities. Under this principle, it may be more sensible to try to screen out major viruses through ISP-operated network gateways (violating end-to-end neutrality) than through constantly updated PCs, or to ask ISPs to rapidly quarantine machines that have clearly become zombies, operating outside the control of their users."
This level of control given to ISP's may seem sacriledge to the disciples of end-to-end technology, but I have seen no better solution to some of the problems that a "free" internet creates. Without any hierarchy of control, or even centralized power, the ability to swiftly ward off the spread of worms, DDoS attacks, or any number of nasties is comprimised.

Zittrain also is the first I've seen to apply the sort of zoning philosophy which is intregal to many plans to seperate content out (think ICANN's .xxx domain) at the "end" level of the network. He argues that one possible way to protect the system while maintaining neutrality would be to create a "green" zone where a computer would only have acccess to protected applications and systems (certified or licensed by private entities) and a "red" zone where everything on the net would be available. He doesn't explain how to create a network of compatible licenses/certificates that would work together, but the idea is a promising one. That would at the very least provide a firebreak between the protected and unprotected parts of the network.

Finally, Zittrain writes with an appropriate level of urgency. Collaboration needs to happen, and it needs to happen soon, as companies are creating their own controls that regulate content and access.

Furthermore, countries are working towards applying local laws to internet governance, threatening the universal aspect of the net by bogging it down in potentially devastating bids for sovereignty. In the same article of Legal Affairs, Jack Goldsmith and Timothy Wu, the latter a professor at Columbia Law school and the former from Harvard Law School, write in "Digital Borders",
"Far from flattening the world, the Internet is in many ways conforming to local conditions. The result is an Internet that is increasingly separated by walls of law, language, and filters. This bordered Internet reflects top-down pressures from governments like France that are imposing national laws on the Internet within their borders. But it also reflects bottom-up pressures from individuals in different places who demand an Internet that corresponds to their preferences, and from the web page operators and other content providers who shape their Internet experience to satisfy these demands."
These issues are already coming to a hilt- as I've mentioned before, lawsuits of this sort are already taking place (one example is the France Nazi issue that the article mentions, another is the libel lawsuit against Lance Armstrong brought in Italy against something published in France). Perhaps "zoning" can occur across international borders as well- creating a zone which is subject to national law, and another that is subject to international law. Actually, now that I think of it, that idea seems kind of stupid, given all of the rules and regulations that would have to go into such a system... but then again, with no promising alternative, something has to give, and without a system in place, that something will be the benefits derived from a neutral internet.

1 Comments:

  • At 8:24 AM, Blogger chector1020 said…

    in response to mason:

    first off, thanks for the contribution... i started blogging with the hope of creating some sort of discourse...

    So your primary argument is that a) the solution of a certification system lacks solvency, and b) anti-viral software works.

    In terms of the "situation in which the anti-viral HQ is somehow compromised and all the client systems that it serves becomes compromised" I don't believe that it would be a major coup... Zittrain's article mentioned the Jan. 2003 Sapphire/Slammer worm that infected 90 percent of the servers that it targeted within 10 minutes, the Aug. 2003 'sobig' virus to propagate itself to becoming 70 percent of worldwide email traffic within 5 days, and most frightening a May 2004 "version of the Sasser worm" that "infected more than half a million computers in three days."

    How is this different from having constantly-updated antiviral software? Three main ways: 1) antiviral software ISN'T constantly-updated, in general its retroactive, and kinda slow... certificates and licenses allow a more proactive solution by taking place through "ranking" code by security 2) antiviral takes place at the "end"- the individual users, it would be far more effective to take action at the ISP level- for example if a new virus/worm/whatever does get released, and my antivirus software doesn't work on it (which is likely)... then we need some force to STOP that worm before it spreads, a task best served by ceding some control to a centralized force 3) a network can be set up in an insecure manner even if a computer is relatively secure- for example if the Sony rootkit was installed on an admin PC (before antiviral software took notice) it could cloak malicious files on ALL computers on that network... there's often no firebreak between computers.

    Is an ad-hoc form of licensing or certificates a perfect system? Absolutely not... but it at least creates a structure where harm can be limited, banking on antivirus updates doesn't. The point I'm making is that NEITHER antivirus sofware NOR a group of experts has magical precognition, but at least the latter can create an overall system that reacts in a more timely, secure manner.

    Finally, about the "Mac is God" solution: Macs, and linux, are far superior operating systems than windows... but they aren't infallible, and in part, their success has been due to the targeting of Windows over Mac by hackers (also in part, Windows seems to care more about sinking deep claws into your computer than security, making its code overly complicated and vulnerable).

    Also, Mac's have been attacked by viruses (well, that actually depends on the definition of virus)...

    Opener: http://www.zdnet.com.au/news/security/0,2000061744,39164062,00.htm
    and a more general article on why mac's are vulnerable:
    http://www.macobserver.com/editorial/2002/09/18.1.shtml

    ...although I'm certaintly glad YOUR system has evidentally stayed secure. And open source? Wait just a second... earlier you were questioning how in the world a group of "trusted" individuals could help our poor helpless systems become more secure but then you advocate a system based on... ummm, well, a group of "trusted" individuals that continually build an OS system??!!!

    Most of the lawyers I mention- Lawrence Lessig, Pamela Samuelson, Tim Wu, Jonathan Zittrain... happen to be the same people that started and fund groups like the Digital Commons, the Electronic Frontier Foundation, EPIC, and a host of other non-profits that work to protect our civil liberties and rights when it comes to technology. So when they talk about net neutrality and why it might not work in terms of pure neutrality, i tend to listen.

     

Post a Comment

<< Home