About that “proposal for the UN to control the Internet”…

There’s a kerfuffle ongoing about whether the UN is trying to take over the Internet. The problem proposal:

“31B 3A.2 Member States shall have equal rights to manage the Internet, including in regard to the allotment, assignment and reclamation of Internet numbering, naming, addressing and identification resources and to support for the operation and development of basic Internet infrastructure.”

What nobody seems to be talking about is why this proposal has been brought forward. Let me remind those with short memories.

Earlier this year, the US government declared that it owned all international (.com/.net/.org) domain registrations, no matter what country they were registered in. A lot of people seem to think that that’s an uncontroversial fact, and that the 3-letter TLDs were always intended to be US-owned. This is simply not true, so let’s go back into history a bit.

If you read RFC 1591, it is clearly stated — by Jon Postel no less — that .com, .edu, .net and .org were created as “World Wide Generic Domains”, as opposed to the “United States Only Generic Domains” of .gov and .mil. Remember that Postel ran the Internet’s root domain name servers from the creation of the DNS until the late 90s. If there’s anyone who knew how DNS was supposed to be organized, it was him.

In the late 1990s, Postel announced that he wanted to found a Geneva-based, non-government, worldwide organization called the Council of Registrars — CORE — to manage the Internet’s domains. It would be staffed by representatives from all the national DNS root maintainers and domain registrars. The US government, on the other hand, wanted all domains to continue to be owned and run by Network Solutions.

In 1998, Postel asked the root nameserver maintainers to switch the definitive root for the world wide domains from Network Solutions (owned at the time by government defense contractor SAIC) to the non-government IANA. Postel was quickly threatened by the White House, and backed down.

In response to Postel’s attempt to let the Internet control itself, the US government set up ICANN and put Postel in charge. ICANN was to be the democratic organization which came up with policies for Internet naming. The actual servers would all continue to belong to Network Solutions, who would implement ICANN’s proposals — or not.

Jon Postel died a few months later, from unexpected complications following heart surgery.

ICANN quickly became controversial, announcing new policies for resolving arguments over domain name ownership, known as the “Uniform Dispute Resolution Policy”. This policy is biased in favor of corporate interests; if you own a domain and a corporation claims it as a trademark, you have to prove good faith, prove it’s not confusingly similar to the trademark, and prove you have a legitimate interest in the domain — or else it’s simply given to the corporation.

Next, ICANN abandoned plans for elections, becoming an undemocratic unelected quango. It’s now largely seen as a way for the Department of Commerce to set rules for the Internet without having them subject to judicial review.

For a while the DNS wars carried on quietly, on technical mailing lists, away from the gaze of average Internet users. However, in 2011 the US government proposed SOPA, the “Stop Online Piracy Act”. One of the controversial provisions of the act was that the US government would be given a “global Internet kill switch”, with the ability to turn off any Internet domain that was deemed to infringe US laws. SOPA caused massive outcry, and was dropped by politicians. Internet activists congratulated themselves on a job well done.

And then the US government went ahead and used the kill switch anyway.

In March 2012, sports betting site bodog.com was shut down by US authorities. It was a completely legal web site, registered in Canada and owned and run by a Canadian company. However, the US government instructed Verisign (the current owner of Network Solutions) to make the DNS root name servers lie about the site’s IP address. They did so, and the site became unreachable by customers around the world.

The message to foreign companies and governments is stark: the global Internet domains all belong to the US government, to do with as it wishes, regardless of jurisdiction or national laws. And technically speaking, there’s nothing to stop the US government from seizing control of even more domains. It’s a declaration of trade war.

The US government doesn’t like your political position? They can simply declare your organization a sponsor of terrorism, and turn off your web sites. A US corporation gets a major legal judgement in its favor in the US, but not elsewhere in the world? The Department of Commerce can just tell Verisign to turn off the web sites of the defendant anyway.

This is what has countries like Russia up in arms and demanding worldwide control of the Internet, rather than having it controlled by the US government and its puppet organizations ICANN and Verisign.

The world’s other governments are approaching the ITU to try and achieve their goal because the ITU is one of the few worldwide standards organizations that works. The US has made it quite clear that it doesn’t consider itself bound by anything the UN decides. The ITU, however, controls the phone systems, which the US government has (so far) been unwilling to unilaterally mess with.

The big disappointment for me is that most of the media coverage is presenting this battle as Internet self-governance versus “UN controlled Internet”. Even respected names like Vint Cerf are dishonestly claiming that the ITU proposals would “centralize decision-making power”. He writes that the ITU would create “significant barriers to civil society participation”, completely ignoring that ICANN is unelected and we already have no participation in or right of review over US government decisions imposed by Verisign.

Let’s be clear about this: Internet self-governance died in 1998. This battle is about the US government having sole centralized control of the Internet, or worldwide governments controlling it jointly.

I do not say that because I favor the ITU proposals. One government dictator who has already abused his power, or many government dictators who might abuse theirs? Both those options on the table suck. My position is that we need to push for a third option, a return to how things were supposed to be when people like Jon Postel built the Internet.

Notice that the NYT article by Vint Cerf doesn’t even mention Postel. History is being quietly rewritten here. We’re being told that the US government always controlled the entire Internet domain name system, and that that’s how it was meant to be. Inconvenient facts to the contrary are quietly ignored, and we are presented with a false dichotomy for Internet governance. Don’t fall for it.

Explaining SOPA

A lot of people are concerned about SOPA, the Stop Online Piracy Act. There are plenty of pages that say that it will destroy the Internet, but very few that explain clearly exactly why. It has also become clear that the politicians writing the law have no idea how the Internet actually works. So here is my attempt to explain it all.

Let me start by explaining DNS, using a situation that doesn’t involve computers, that hopefully anyone can understand.

Imagine a server on the Internet as being like an office building in 1973. No computers. No mobile phones. Just an office building with an expensive business phone line, internal phones connected by wires, and a receptionist with switchboard and a single phone line connected to the outside world.

The server has an IP address. That’s like the office building’s telephone number.

The web sites on that server are like the people who work in the office building. So talking to John Smith is like reading John Smith’s web site.

Now, when your web browser connects to John Smith’s web site, it looks up the IP address of the site, connects to the web host, and requests John Smith’s web site via HTTP. The request is then routed to the appropriate page.

That sounded complicated, so let’s translate it into our telephone analogy:

When you want to talk to John Smith, you look up the phone number of the building he works in, call that number, and ask to talk to John Smith, and you’re put through to him.

Note that unrelated people can work in the same office with the same phone number used to contact them. This is just like the Internet, where there can be multiple unrelated web sites on the same server at the same IP address. What about the different pages of a web site? Well, those are like talking to the owner of the web site about different topics.

OK. Next problem: DNS is distributed. How do we explain that?

Well, at work in 1973, when I want to know somebody’s telephone number, I look in my address book. If it’s not there, I look the number up in the company telephone directory, and make a copy in my address book so I’ll find it quicker next time. If the number isn’t in the company directory, I get the big telephone directory from the phone company, and look in that. If it isn’t there, I call directory assistance, and they look in the really big master telephone directory that has every number in the country. And so on.

DNS is like that. If your computer knows the IP address of a web site because it has used it recently, it just goes ahead and connects, makes the call. Otherwise, it asks your ISP if they have the IP address. If they don’t, your request for the IP address gets forwarded up to a higher level server, until we get to the so-called root servers, which are like the phone companies’ multi-volume master directories.

There are a few technical details not addressed by this analogy, but it’s close enough to explain basically how the system works.

So, now we can talk about the proposed SOPA legislation, the Stop Online Piracy Act.

The basic idea of SOPA is that if someone is accused of copyright violation, all the ISPs in America are required to block access to that person’s web site.

Put like that, it might sound quite reasonable. That’s probably how music and film industry lobbyists explain it to politicians. The problems become clear when you rephrase it for 1973 technology.

People are taping LPs, and giving tapes to friends who call them up on the phone and ask for a copy. So, if someone is accused of taping LPs, we will cut off the phones of the business he works at and remove his name from the phone directory.

Hopefully if you think about that for a moment, some obvious problems spring to mind. I’m going to talk about a few of them.

The first problem is that word “accused”. SOPA does not require any independent investigation. It does not require a lawsuit, or a trial, let alone a conviction. All that’s needed is for Polymer Records to accuse John Smith of taping their albums.

You might think that record companies can be trusted. Well, you might think that if you aren’t a musician, anyway. If you do, I’d suggest reading about some of the abuse of the Digital Millennium Copyright Act, DMCA. Just this last week, Universal Music Group have been issuing takedowns on YouTube for video recordings they don’t own the rights to. You might think it would never happen to you, but if you’ve ever uploaded a video of your kids singing Happy Birthday, well, that’s actionable copyright violation. The owners of The Birthday Song, Warner Brothers, collect about $2 million per year from demanding payment from people who sing it.

The second problem is this: Even if the record company is right, what about all the other people who work in the same office building? How are they going to do their work and earn a living?

A single IP address can host literally thousands of web sites, owned by people who are total strangers to each other. Blocking an IP address takes all those sites offline.

That’s not the only weapon against the Internet authorized by SOPA, though. It also allows for DNS-level blocking. That is, rather than taking out every single web site hosted at a particular IP address, it just takes out every page hosted at the same domain. Going back to our telephone analogy, when John Smith is accused of copying LPs, his name is struck from the telephone directory.

Our analogy fails somewhat here. On the Internet, a single name like Flickr or YouTube can represent tens of thousands of people. So the problem of ‘collateral damage’ isn’t eliminated, only reduced.

But the analogy does make clear a more constitutional issue: In what way is it any of the government’s business what the phone company prints in the telephone directory? If I want to run a telephone directory business with ads for dodgy massage parlors, it’s none of the government’s business. Or in Internet terms, if I choose to publish the information that happyendings.com is at IP address 2001:db8:0:1 then the First Amendment requires that I be free to do so.

There are technical issues too. At the moment, a lot of effort is going into making the Internet more secure by preventing DNS spoofing. Like crooks who put card skimmers on ATMs, DNS spoofers put fake entries in the Internet’s ‘telephone directory’, so that when you think you’re contacting the bank, you’re actually contacting a web server they own. They then collect your username and password, and use those to drain your account.

The solution is called DNSSEC, secure DNS. It uses digital signatures to ensure that only DNS entries signed by your bank will be accepted by your browser. If the signed and verified entry is missing from the directory, your computer goes out and probes servers around the world until it finds one that can provide signed and verified information.

The problem, of course, is that this is utterly incompatible with SOPA. If the government orders that happyendings.com be removed from the Internet, a computer with secure DNS will detect that the “No such web site” reply is not signed by the company that owns the domain. It will try other DNS servers, including those outside the USA and beyond US government control, until it gets a true answer.

So for SOPA’s DNS filtering to work, DNSSEC has to be abandoned or blocked. Which means that online fraudsters will carry on having a free pass to put digital ‘card skimmers’ on your bank’s web site.

Hopefully you’ve followed all that. Please feel free to quote any or all of it in letters to your elected representatives. And now, a little irony to chuckle over.

Earlier this month, a Russian web site compiled a database of around 20% of the IP addresses using BitTorrent file sharing, along with the details of the files they were downloading. Investigation soon revealed something interesting. Someone at Sony Pictures movie studio had downloaded illegal copies of “Conan The Barbarian”, a movie owned by indie studio Lions Gate Entertainment. They had also downloaded Beavis and Butthead, owned by Viacom. Meanwhile, NBC Universal’s IP addresses had downloaded pirate copies of HBO’s “Game of Thrones”, and Fox Entertainment had pirated Paramount’s “Super 8”.

If SOPA were already in effect, Sony, Fox and NBC could have found their corporate web sites forced offline, with no trial, no notice, and no comeback. Do they realize this, or are they counting on the law not being enforced against them?

Quote

Pretending to see the future

…no online database will replace your daily newspaper…no computer network will change the way government works. … Yet Nicholas Negroponte, director of the MIT Media Lab, predicts that we’ll soon buy books and newspapers straight over the Intenet. Uh, sure.”

 

We’re promised instant catalog shopping–just point and click for great deals. We’ll order airline tickets over the network, make restaurant reservations and negotiate sales contracts. Stores will become obselete. So how come my local mall does more business in an afternoon than the entire Internet handles in a month? Even if there were a trustworthy way to send money over the Internet–which there isn’t–the network is missing a most essential ingredient of capitalism: salespeople.”

Clifford Stoll, 1995

MySpace and Facebook and social class

The Guardian:

In recent years networking sites like MySpace and Facebook have seen remarkable growth and become some of the most heavily trafficked destinations on the internet. But Danah Boyd, a researcher at the University of California and internet sociologist, says populations of different networks are now divided on a rough class basis.

Her evidence, collected through a series of interviews with US teenagers using MySpace and Facebook over the past nine months, shows there is a clear gap between the populations of each site.

“MySpace was the cool thing for high school teens and Facebook was the cool thing for college students,” she wrote in a paper available online. “The picture is now being blurred … it seems to primarily have to do with socio-economic class.”Typical Facebook users, she said, “tend to come from families who emphasise education and going to college. They are primarily white, but not exclusively”. MySpace, on the other hand, “is still home for Latino and Hispanic teens, immigrant teens” as well as “other kids who didn’t play into the dominant high school popularity paradigm”.

[…]

“A month ago, the military banned MySpace but not Facebook. This was a very interesting move because there’s a division, even in the military. Soldiers are on MySpace; officers are on Facebook.”

According to Ms Boyd, Facebook is not used by young soldiers, who are generally less well-educated and from poorer backgrounds, and there is an element of social conflict in the ban.

So, MySpace is Facebook for the uneducated?

Good news for slackers

AP reports:

Saying surfing the web is equivalent to reading a newspaper or talking on the phone, an administrative law judge has suggested that only a reprimand is appropriate as punishment for a city worker accused of failing to heed warnings to stay off the Internet.

In his decision, Spooner wrote: “It should be observed that the Internet has become the modern equivalent of a telephone or a daily newspaper, providing a combination of communication and information that most employees use as frequently in their personal lives as for their work.”

He added: “For this reason, city agencies permit workers to use a telephone for personal calls, so long as this does not interfere with their overall work performance. Many agencies apply the same standard to the use of the Internet for personal purposes.”

This is something I’ve been saying for a while in the periodic arguments over whether businesses should try and lock down the Internet to only “approved” sites. Do the same businesses search employees at the door to make sure they don’t bring in newspapers, magazines or mobile phones? Generally not. (If you work for the NSA, your mileage may vary.)

Slacking is a time-honored tradition. If you ban the Internet, people will spend their time talking about last night’s TV, making paper planes, or whatever.

Now, get back to work.