Not logged in | Login

Gregarius

Feeds

837 items (710 unread) in 16 feeds

IGF

IGFWatch news (12 unread)
IGP Blog (70 unread)
Singh-a-Blog (18 unread)
CircleID (464 unread)
Internet Pro Radio | icann.Blog (5 unread)
ICANNWatch (10 unread)
the i-witnesses (4 unread)
InternetYouth.net Blogs
Veni Markovski - The Blog (15 unread)
IGF Feedback Forum on UserVoice (13 unread)
Internet's Governance (32 unread)
Guysoft's Weblog (12 unread)
Core Internet Values (3 unread)
An Introduction to Internet Governance (4th edition) (15 unread)
ISOC's blog on IGF (30 unread)
internet :: ecosystem (7 unread)

Unread items (100)

Skip to page: 1 2 3 ... 8

CircleID

So/Lo/Mo for Business

Posted: May 19th, 2012, 1:53am WST by Erin Bush

Lest you think the social + local + mobile (So/Lo/Mo) trend is just a fad, last week, Pew Internet released a new report that found that 18 percent of smartphone owners use a geosocial service to check in and share their location with friends. The report also found that 74 percent of smartphone owners get real-time location-based information on their phones — up from 55 percent last May.

Add to these impressive stats the finding from earlier this year that 61 percent of smartphone users search for local business information on-the-go with their mobile devices and you have quite the compelling reason to make sure your local business listings are up to snuff — in both geosocial services and in local search.

Here is a great infographic created by the teams at Localeze, 15miles and comScore featuring some mind-blowing mobile usage stats. You can also download the 5th Annual 15miles/Localeze Local Search Usage Study Conducted by comScore, which was released February 2012, for more information on the importance of So/Lo/Mo for businesses.
2012 Local Search Usage Study – The annual Local Search Usage Study, done in partnership by 15miles and Localeze (conducted by comScore) is a measurement of consumers' search behaviors and how such behaviors affect media-usage trends. (Click to Enlarge)
Written by Erin Bush, Managing Editor at Neustar
Follow CircleID on Twitter
More under: Mobile, Web
Geneva Discussion to Include India's Proposal for Government Control of Internet

Posted: May 18th, 2012, 5:37am WST by CircleID Reporter

Shalini Singh reporting in the Hindu: "The raging controversy over possible excessive state regulation of the internet based on the IT Rules 2011 is now likely to be dwarfed by discussions in Geneva later this week over India's proposal to the United Nations General Assembly, for government control of the Internet… In its proposal submitted to the General Assembly in New York on October 26, 2011, India has argued for a radical shift from the present model of multi-stakeholder led decision-making, to a purely government-run multilateral body..."
Follow CircleID on Twitter
More under: ICANN, Internet Governance

IGP Blog

Public interest groups demand a role in telecom treaty negotiations

Posted: May 18th, 2012, 2:33am WST by Milton Mueller
Thirty-one academics, freedom of expression groups, and civil society organizations – including IGP – have sent a letter to the International Telecommunication Union asking it to open up the preparatory process for the World Conference on International Telecommunications (WCIT). The WCIT is negotiating a revision of the International Telecommunication Regulations (ITRs); that process will culminate in a December meeting in Dubai. The full text of the letter and its expanding list of endorsers can be read here. A Spanish-language version can be read here.

The civil society groups are asking the ITU to:
- Allow sharing of WCIT documents and all preparatory materials, including proposed revisions to the International Telecommunication Regulations (ITRs);
- Open the preparatory process to meaningful participation by civil society in its own right
- Facilitate remote participation in the meeting
- Ask its Member States to open up processes at the national level to solicit public input on the proposed ITR amendments
The interaction between civil society groups and the ITU closely resembles the controversy over the so-called Anti-Counterfeiting Trade Agreement (ACTA). The ACTA treaty was negotiated in secret so that its provisions could reflect the concerns of special interest groups, namely the copyright and intellectual property lobby. The closed process, however, gave the resulting treaty a lack of legitimacy, and that lack of legitimacy led to organnized opposition, the suspension of its ratification in Europe and resistance elsewhere.

There is an important difference between the WCIT and ACTA negotiations, however. In ACTA, the US government and a major segment of the business community (the IPR interests) did not want civil society involved. Indeed, the same pattern is being repeated in negotiating the Trans-Pacific Partnership, another closed negotiating process that sacrifices consumer and exporters’ interests in expanding trade on the altar of intellectual property monopolies.

In the case of WCIT, both the US government and most Internet industry interests want academics and civil society involved. They want their help fending off more control by intergovernmental institutions. Indeed, the U.S. is repeatedly touting “multi-stakeholderism” as the principle underlying its challenge to greater regulation of the Internet by the UN and ITU. But they seem less concerned with the MS principle when copyright, trademark and patent interests are involved. This incident thus demonstrates the inconsistency of US policy regarding global governance institutions. Nevertheless, the reform of the ITU into a more open, accessible process is a worthy goal in and of itself, so allies from industry and government are welcome, whatever their points of departure.

It is unlikely that the ITU will fully accede to the demands put forward in the letter. Speaking at the WSIS Forum in Geneva yesterday, an ITU spokesperson provided rather negative answers to the demand for more openness. According to notes of the meeting, the ITU cannot release documents for free because it conflicts with the ITU business model in which access to documents and participation rights are granted in exchange for membership fees which sustain the organization. He added that the current constitution and legal framework of the ITU doesn’t allow open participation or the release of the documents, and member states have not been willing to change these provisions in the past.

So the civil society letter throws down the gauntlet. Any revision of the ITRs that is produced without the demanded level of transparency and participation is likely to run into the same obstacles as ACTA. Only the obstacles will be much greater, because many industrial and governmental parties who supported (or felt they had to go along with) ACTA would be explicitly opposed to a WCIT-12 revision of the ITRs that had ill effects on the freedom or openness of international telecommunications.

CircleID

DNSChanger Disruption Inevitable, ISPs Urged to Bolster User Support

Posted: May 18th, 2012, 2:28am WST by CircleID Reporter

Up to 100,000 customer modems are at risk of losing their internet connection from July 9 when the FBI disables rogue DNS servers seized late last year. The affected customer modems make up about a third of the 350,000 to 400,000 internet users believed to still have the DNSChanger malware on either their modems or Windows computers.
Read full story: SC Magazine
Follow CircleID on Twitter
More under: Cyberattack, Cybercrime, DNS, DNSSEC, Malware, Security
Case Studies from the UN Broadband Commission

Posted: May 18th, 2012, 1:19am WST by Paul Budde

The Broadband Commission for Digital Development, in partnership with ITU, has released its first country case studies looking in-depth at the state of broadband development in four economies and examining links between broadband and the UN Millennium Development Goals.

The case studies, which cover the Former Yugoslav Republic of Macedonia, Panama, the Philippines, and Romania, look at the effect of broadband connectivity on economic growth and access to basic services like education and health. They offer regulatory guidance and best practices, showcasing success stories and lessons learned.

Romania and TFYR Macedonia both provide strong examples of how adopting pro-ICT policies, establishing effective regulatory frameworks and developing strategic private and public partnerships can play a key role in boosting broadband access, affordability and demand.

A nation with a strong commitment to connectivity as a driver of national growth, TFYR Macedonia already boasts an impressive broadband penetration rate of 32%. Internet access in schools and Wi-Fi-based public Internet access points have been rolled out throughout the country, including remote areas. Schools now offer one Web-enabled computer for every 1.45 children, while university students and academics can freely access knowledge and research resources via the academic network MARnet.

Meanwhile, near-neighbour Romania ranks among the top countries in the world for broadband speed, and scores well for affordability too. The average cost of a baseline monthly broadband subscription represents less than 5% of average monthly income — well within the global targets established by the Broadband Commission last October. Public access is promoted through initiatives like 'Biblionet', which was launched in 2009 and which provides free library-based access through some 795 public libraries equipped with 3,318 computers.

Case studies on Panama and the Philippines, meanwhile, explore the impact of broadband on the economy and on job creation. Both studies evaluate the development of e-applications in the areas of education, public health, media and government services — all of which can help further stimulate broadband adoption.

In Panama, fixed broadband is having a significant economic impact. Analysis of a structural econometric model for the period 2000-2010 indicates that fixed broadband now contributes an annual 0.44% of GDP, with the indirect effects of fixed broadband use estimated to have contributed almost 9.6% of total national economic growth. Accelerating take-up means that this impact has now almost doubled to reach 0.82% of annual GDP, and contributed 11.3% of all economic growth over the decade.

In the Philippines' case study, analysis over the same 10-year period indicates that mobile broadband adoption has contributed an annual 0.32% to GDP, representing 6.9% of total GDP growth for the economy over the past decade. Given the acceleration of mobile broadband penetration since 2005, this impact has also now almost doubled, reaching 0.61% of GDP, representing 7.3% of total economic growth over the decade.

Download the full set of case studies at:
www.broadbandcommission.org/work/documents/case-studies.aspx
Written by Paul Budde, Managing Director of Paul Budde Communication
Follow CircleID on Twitter
More under: Broadband, Mobile

Guysoft's Weblog

SvxlinkWrapper – Wrapper for SvxLink to provide additional functionally such as QSO logging and auto-connect

Posted: May 17th, 2012, 10:44pm WST by GuySoft

Hey all, A short post to announce a small peace of software I released today on github for the ham radio people. I give you SvxlinkWrapper, this wrapper sits on top of Svxlink‘s stdout and stdin and processes it with python. Making it easy to add more advance features to Svxlinik. Since Svxlink is written [...]

CircleID

Rethinking Protection Technologies: A Change Has Occurred

Posted: May 17th, 2012, 6:12am WST by Gunter Ollmann

I ordinarily spend a lot of my time talking about the technical aspects of threat detection and examining the tools and strategies that the bad guys are employing to subvert corporate defenses and breach their objectives, so it was refreshing last week to speak with a large bunch of C-level folks from Fortune-250 companies and to get the opportunity to step-back a little.

Talking technical is easy. Distilling technical detail, complex threats and operation nuances down to something that can be consumed by people whose responsibility for dealing with cybercrime lays three levels below them in their organizational hierarchy is somewhat more difficult. Since so many readers here have strong technical backgrounds and often face the task of educating upwards within their own organizations, I figured I'd share 4 slides from my recent presentation that may be helpful in communicating how the world has changed.

The overall context of the hour long presentation was related to the paradigm change from protection back to detection — given the scope and capabilities of modern organized crime. The following slides came from the first quarter of the hour — setting the scene for how protection technologies have failed and what organizations need to do in light of that failure.

In essence, this slide talks about how that adversary has changed from old. Gone are the days of a single hacker looking to break in to an organization and toast all the systems. Sure, some of these guys still exist, but that's not where the threat lies today by any statistical analysis. Instead, what organizations are facing is a complex ecosystem where expertise is plentiful and available for relatively low prices. Most importantly, the adversary is now a professional in every sense of the word and needs to be respected for such. Failure to do so is at your peril.

While the adversary has changed for the worse, so too has the target. Consumerization of IT and BYOD, while buzzwords in every sense of the word, really are fundamentally changing the threat landscape and the ability of organizations to combat sophisticated threats. Speaking with lots of people charged with defending their corporations from within, they really do feel powerless to combat Mac threats, Android malware, etc. or enforce application and desktop policies (for whatever that means in the world of iPads and App stores).

Everything is playing in to the bad guys hands. The devices their targets are using are varied and widespread, they roam and bridge networks, they have hundreds of applications yet few are patched in a timely manner, and the threat of personal information being leached has ensured that encryption of communications is the norm — too bad that those nosey IT security guys can inspect traffic for malicious attacks.

In essence, the onus of securing the enterprise has slipped from the corporate IT folks and landed firmly in to the hands of their enabled workforce — who happen to be poorly suited to the task.

Oh, and then there's the "Cloud". Not the Cloud supplying cheap processing power and high availability mission-critical applications at a fraction of the cost of legacy systems. Rather the Cloud that is the 2nd millennium USB stick — the mechanism for transporting infected files between one device and the next.

IT security departments have invested millions of dollars in their defense in depth strategies. Multiple layers of "protection" (and expense), overlapping redundancies and a continuous stream of alerts have had debilitating effects on thinly-stretched security teams.

Even if those layers of defense had been working, the "solution" for the bad guys was (and is) to "attack in depth". The tools and techniques they now employ are multi-facetted and their complexity is hidden from the attacker. The hard work of innovation and coding was done by some expert far away, and their expertise (along with dozens of others) has been combined into a single campaign.

Last but not least, I talked about the "marginalization of protection". My objective in this part of the discussion was to point out that trying to protect everything has never worked, and will be even less successful going forward. The consumerization of IT and the diversity of devices out there have also forced organizations (including vendors) into an area in which it is simply uneconomical to try and secure.

While effort still needs to be applied to "protecting" the enterprise, my advice is to consolidate those expensive resources around the most valuable things of the organization and only grow outwards from there if you're successful.

In response, organizations need to assume that they are compromised and will continue to be compromised many times over, and often in many interesting ways. The onus shifts to how an organization can rapidly detect a compromise and how seamless the remediation needs to become.

I used to say that the most economical course of action was to simply reimage the computer when you were able to confirm the compromise. Nowadays that may not be quick enough, nor appropriate. Today you should reimage when your threshold of suspiciousness has been reached and, if you can't reimage (e.g. iPads, etc.), then remotely reset the device to factory defaults and wipe any stored content so it can't re-infect itself.

What about those critical devices — such as the CFO's laptop — which can't be reimaged without a lot of disruption? Let's be clear, just because you detected one piece of malware or remote control agent on the device doesn't mean that it's the only one installed. And if you're thinking you can safely remove everything related to the infection, then you're either ill-informed or it wasn't a threat to begin with.

Frankly, if you have critical devices that cannot be reimaged for any reason at the turn of a hat, then you've got bigger problems with your IT operations than mere breaches by professional criminals, and your organization needs to reevaluate its security operations at a fairly fundamental level. If a device is so critical that it cannot be recovered, it most certainly shouldn't be a roaming laptop, accessible via the Internet, and is operated by personnel with higher than average probabilities of being targeted.
Written by Gunter Ollmann, VP of Research at Damballa
Follow CircleID on Twitter
More under: Cyberattack, Cybercrime, Malware, Security
2011 UDRP Filings Up at WIPO, Down at NAF - And Still Infinitesimal

Posted: May 17th, 2012, 2:47am WST by Philip S Corwin

The World Intellectual Property Organization (WIPO) recently issued a detailed press release regarding Uniform Dispute Resolution Policy (UDRP) cases for which it provided arbitration services in 2011 and, once again, the number of WIPO filings was up. According to WIPO: "In 2011, trademark holders filed a record 2,764 cybersquatting cases covering 4,781 domain names with the WIPO Arbitration and Mediation Center (WIPO Center) under procedures based on the Uniform Domain Name Dispute Resolution Policy (UDRP), an increase of 2.5% and 9.4% over the previous highest levels in 2010 and 2009, respectively."

Yet that's an incomplete picture. At the other major UDRP arbitration provider, the National Arbitration Forum (NAF), 2011 case filings were down 4% in 2011, declining from 2,177 cases in 2010 to 2,082 in 2011. The vast majority of these cases (96.2%) involved gTLDs like .com and .net; cases were concluded an average of 35 days after filing, but some were resolved in as few as 20 days — and 17%, a full one-sixth of filed complaints, were resolved directly by the parties with no need for panel arbitration. (That noteworthy record again raises the question of why a supplemental Uniform Rapid Suspension (URS) process is even needed for new gTLDs, but that's a separate subject.)

So, overall, the WIPO 2.5% increase was balanced out by the NAF 4% decrease and total UDRP filings at the two principal ICANN-accredited arbitration providers were essentially flat in 2011.

The Internet Commerce Association's (ICA's) Code of Conduct condemns intentional cybersquatting, so we are happy to see filings stabilize and would be delighted to see them decline further in the future. But we do think these filing figures need to be calmly placed in the broader context of total domain registrations. And, according to VeriSign's December 2011 Domain Name Industry Brief, domain registrations increased by 8.9 percent in the preceding year.

So, we think it's quite significant that total 2011 UDRP case filings did not increase notwithstanding a near-9% increase in total domain registrations. This marks yet another year in which UDRP filings declined as a percentage of all domain registrations.

While the NAF press release does not include the total number of domains involved in the cases filed with them we can guesstimate that, when we also include the additional second tier UDRP arbitration providers, approximately 9,000 domains were at issue in all 2011 cybersquatting cases filed with all UDRP providers.

That's 9,000 out of a total of about 220 million registered domain names. In other words, for each million domain registrations there are about 41 domains alleged to be cybersquatting in UDRP cases.

We expect that trademark interests will counter that the number of UDRP filings represents just "the tip of the iceberg" of abusive domain registrations, and will also point out that some but not all ccTLDs are subject to UDRP. And we'll concede those points — while also noting that .com and .net registrations totaled 112 million, just over half of all domains, and that these are the gTLDs that attract the most Internet traffic and are therefore most likely to be abused by intentional cybersquatters. So, while UDRP filings are not an exact proxy for the full extent of cybersquatting, they are the best measure we have of instances in which the resulting harm or domain value were judged sufficient by a trademark owner to invest the relatively modest sums of a $1300 filing fee plus associated attorney fees.

We are also well aware of studies — like this from Sophos — indicating that major brand names are subject to significant typosquatting. Despite finding that malware was virtually nonexistent on such websites, that study nonetheless observed that "typosquats are by no means harmless". Yet, other than the 2.7% of typosquatted domains that "fell into the loose category of cybercrime", a significant portion of the remainder of typosquatted websites appear to fall outside the scope of the "bad faith registration and use" standard required for a successful UDRP filing. So it's not just that rights holders have concluded that a particular typosquatted domain isn't worth the monetary cost of filing and pursuing a UDRP — they may have also concluded that they would not prevail. That is, those domains may fall more into the category of annoying nuisance rather than bad faith infringement, and are not generally associated with criminal activities such as phishing or with bad acts such as malware distribution.

Notwithstanding this contextual decline of 2011 UDRP filings, we are quite sympathetic to the costs imposed on brand owners of maintaining portfolios of defensively registered domain names that could be easily cybersquatted if released back for public sale. Reducing this cost is a subject that could certainly be addressed by an open and inclusive UDRP reform process within ICANN — if trademark interests will ever stop working to defer the initiation of such a process.

We'd also point out that if even one-one-hundredth of one percent of all domains registered today were cybersquatting in a manner sufficient to justify a UDRP filing that would currently total about 22,000 domains, and the actual number of UDRP filings last year involved less than half as many domains. In other words, based just on UDRP filings, more than 99.995 percent of all domains are not cybersquatting. That's right, 2011 UDRP filings involved less than one-two-hundredth of one percent of all registered domains. Even if the filed cases understate the incidence of UDRP-violating cybersquatting by a factor of one hundred, the problem would rise to just under one-half of one percent of all domains, with the remaining 99.5 percent being non-infringing.

We note all this not to excuse cybersquatting but to indicate that the problem appears to be small, manageable, and diminishing as a percentage of registered domains year after year based on UDRP filings — and that the UDRP provides a relatively fast and inexpensive alternative to litigation in court. So any trademark interest advocacy for 'rights protections' that are more numerous and stringent than what's already available is not strongly supported by the available evidence.

We'd also note that many ICA member providers of "parking" or other domain monetization services, as well as of secondary domain marketplaces, have established either formal or informal means by which trademark owners can bring alleged infringement claims to their attention and block clearly infringing domains. These services are available at no cost to trademark owners, and should often be their first recourse in advance of filing a UDRP claim.

As for the WIPO press release declaration that, "With the domain name coordinating body, ICANN, allowing for a massive increase in the number of new domains, brand owners' resources will likely be stretched further.", that seems entirely speculative for now — especially since brand owner resources were not stretched further in 2011 with total UDRP filings being flat, and actually declining in the context of an expanding DNS environment. WIPO's statement also ignores the fact that the Trademark Clearinghouse will let trademark owners secure, block, and issue warnings in regard to new gTLD domains in an unprecedented manner to reduce cybersquatting.

So let's wait and see what applications are actually filed for new gTLDs, and then wait to see what registrants they attract and what visitor traffic they generate, and then make a judgment on the impact of new gTLDs on trademark owners that is informed by facts rather than speculation. (We note in passing that NAF's statement makes no similar gloomy predictions regarding cybersquatting at new gTLDs.)

One final thing to remember is that arbitration providers like WIPO can affect the number of UDRP filings by allowing its panelists to alter long-established practices and thereby change UDRP policy in a one-sided manner. For example, recently a WIPO panel ruled that ceat.com must be transferred to CEAT Ltd., an Indian tire company, even though there was scant evidence that the domain had been registered, much less used, in bad faith (See: CEAT Limited, CEAT Mahal, v. Vertical Axis Inc. / Whois Privacy Services Pty Ltd). Another WIPO panel recently ruled in FACI Industries v. BuyDomains.com, Inventory Management that faci.com be transferred to the non-famous metal casting firm of FACI Industries of Bolingbrook, Illinois even though there was ample evidence that the registrant exercised due diligence to avoid infringing the complainant's trademark rights (See: FACI Industries v. BuyDomains.com, Inventory Management). As the dissenting panelist in CEAT stated, "To hold that such a valuable word cannot be used as a domain name simply because "the domain name is a trademark and has no descriptive meaning" is not supported by the Policy and is a very severe restriction on the right to register a domain name that is not contemplated by ICANN in its policies or practices… That is simply a rewriting of the Policy that is entirely unsupported. Clearly, registering a word that both parties say is an acronym and using it for purposes unconnected with the Complainant or its activities does not violate the Complainant's trademark rights or the Policy.”

These rulings open the door to any short domain name that can constitute an acronym for one or multiple organizations being subject to "first to file" UDRP actions encouraged by trademark attorneys. We are already seeing an uptick of new UDRPs related to acronym domains, and if this becomes a flood in the remainder of 2012 — encouraged by the ceat.com and faci.com rulings, which deviate from years of UDRP practice related to acronym domains — does that mean that cybersquatting is up, or that cybersquatting has been unilaterally redefined down by WIPO panelists and that as a result the trademark bar sees a new UDRP opportunity to bring to clients' attention?

These disturbing and controversial acronym domain rulings again illustrate why WIPO and other UDRP providers should reconsider allowing panelists deemed "neutrals' to also serve as advocates for complainants or registrants, given the clear potential for conflicts of interest, and the certain appearance of potential conflicts. It also illustrates that prior decisions should have a more binding precedential effect that they are accorded under the current WIPO Overview. The UDRP process should remain an available remedy for squelching a declining pool of infringing domains, but not permitted to be a mercurial full employment program for creative trademark attorneys.

ICA will continue to press for meaningful UDRP reform, including changes to assure that arbitration "neutrals" do not have inherent conflicts. But for now we are happy to note that total UDRP filings continue to decline as a percentage of all domains and remain a tiny fraction of the overall DNS infrastructure. That's something worth remembering the next time you see allegations that cybersquatting is out of control.

Mr. Corwin serves as Counsel to the Internet Commerce Association
Written by Philip S Corwin, Founding Principal, Virtualaw LLC; Counsel, Internet Commerce Association
Follow CircleID on Twitter
More under: Cybersquatting, Domain Names, ICANN, Internet Governance, Law, Policy & Regulation, Top-Level Domains
Business Case for IPv6 - Part 2

Posted: May 17th, 2012, 12:00am WST by Juha Holkkola

In my previous blog on the topic, I stated that the business case supporting the IPv4 roll-out in the late 90s was the Internet. Although IP depletion will slowly become a reality, the chances are that due to mitigating technologies such as NAT and DNS64, it may take quite a while before organizations in the developed economies will get serious about IPv6.

So where should we look to find a business case for IPv6?

Over the last year or two, the shift towards cloud computing paradigm has started to make some pretty impressive waves. Although still at a relatively early stage, we are seeing both service providers and enterprises coming out with brand new strategies for public and private clouds. Based on the recent developments, we estimate that by 2015, the way in which applications and network services are consumed will be very different from what it is today. The discontinuity here will be just as big as the Internet was some 15 years ago.

As far as the IPv6 business case is concerned, not many people have realized how critical IP addresses and DNS is for the cloud orchestration process. To commission or decommission a virtual machine, one needs to reserve or to free an IP address, preferably within a window of 300 milliseconds. Further, in order for that newly commissioned virtual machine to be easily accessed, a DNS entry is also needed. With Infrastructure 1.0 utilizing IPv4 spaces managed with Excel spreadsheets, the cloud doesn't scale.

To address this issue, anyone serious about cloud computing will have to come to accept that Infrastructure 2.0 is required in order for the cloud computing paradigm to work as intended. If someone is to make a considerable investment in cloud environment, protecting the investment for at least the next 10 years becomes essential. And the way I see it, this is where IPv6 comes in.

In this light, IPv6 can be viewed as a similar enabler to the cloud as IPv4 was for the Internet. From the business perspective, IPv6 enables the cloud to scale into the foreseeable future. Furthermore, by making IPv6 a standard feature in clouds, organizations investing in them can make sure that their basic architecture will stand the test of time, thereby optimizing the cloud ROI.
Written by Juha Holkkola, Managing Director of Nixu Software
Follow CircleID on Twitter
More under: Cloud Computing, Internet Protocol, IP Addressing, IPv6
Cel-e-brate v6, Come On!

Posted: May 16th, 2012, 4:04am WST by Craig Sprosts

With IPv6 World Launch coming up it's worth pausing to consider the collective efforts of the Internet industry in enabling and deploying an essential evolutionary technology at what will become truly massive scale. It's easy to be a detractor and believe there has been little progress — but the Internet hasn't melted down and there is no evidence it is about to. Perhaps the issue is that progress occurred in a different way than was predicted or preferred by the experts. The reality is providers everywhere have developed coping mechanisms for IPv4 exhaustion. Innovation, operational sweat, and perhaps some tough negotiating make it happen. But isn't that the essence of the Internet?

Thought leaders across the industry are focusing on transition topics that matter: from economic lifecycles, security, and business continuity to the promising future of the Internet of Things. This is what drives most of us, and those on the front lines in the IPv6 evolution have every right to rise up and celebrate. It's not only a great technological milestone, but a testament to their collective abilities to work together for the greater good of the connected planet.

Today's Internet is the foundation for everything we do and the IPv6 Internet will be too but unfortunately some things never change. While the majority have been busy working on IPv6 for the greater good, evidence makes clear we're likely to come face to face with a growing number of technologists (aka criminals) with malicious intentions. IPv6 hinders them in some ways, but helps them in others. If you have any doubts, a quick search will show a growing number of software tools intended to break or exploit IPv6. Everything we build offers potential for those who are malicious to use their skills for disruption. Security is a continuum and experience suggests it might be worth some cycles to make sure your IPv6 project does not end up on your CEO's shortlist of things that keep them up at night.

Preparing for the transition requires looking beyond just software support and interoperability testing to identifying strategic partners and understanding the long-term cost of ownership. If IPv6 is important to your future you owe it to your business, investors and customers to make sure you have the best technology but are also on the right path with the best, forward looking partners. It's refreshing to see that on the Internet, as has always been the case, a global initiative can transcend the boundaries of political, social, and economic agendas. Maybe we can all even learn a lesson or two from IPv6 on how to tackle some of the critical long-term social and economic challenges facing the world today.

Want to learn more about the transition to IPv6, join us at our webinar on May 30. Click here.
Written by Craig Sprosts, General Manager of Fixed Broadband Solutions at Nominum
Follow CircleID on Twitter
More under: IP Addressing, IPv6, Security
Hosters: Is Your Platform Being Used to Launch DDoS Attacks?

Posted: May 16th, 2012, 3:12am WST by Miguel Ramos

As anyone who's been in the DDoS attack trenches knows, large multi-gigabit attacks have become more prevalent over the last few years. For many organizations, it's become economically unfeasible to provision enough bandwidth to combat this threat.

How are attackers themselves sourcing so much bandwidth? It's actually easier than you might think. While botnets comprised of malware-infected computers can be used to launch attacks, you don't actually need thousands of devices. In some cases, attackers are infiltrating hosting company resources (shared hosting, virtual private servers, dedicated hosting, etc.), availing themselves of bandwidth by using hacked, stolen and fraudulent accounts.

Let's say that an attacker manages to get his/her hands on 5 hosting accounts with 5 different hosting companies. It's not unusual for these hosting companies to have 1 Gbps+ of connectivity to the Internet. A lot of hosters don't look at their outbound traffic all that closely or have difficulty policing what their customers do. All an attacker needs to do is install a script on each account and he/she has easy access to gigabits of connectivity.

For hosters, finding the trouble spot can be like looking for a needle in a haystack (especially if thousands of accounts share resources). While the offender might be found eventually and the account shut down, the damage has already been done.

What can hosters do to help prevent this or detect this better?

Restrict outbound traffic from your customers by using ACLs (Access Control Lists). For example, there are few reasons your customers will ever need to make port 80 UDP connections to other hosts on the Internet. Put policies in place to block all outbound traffic except to specific, acceptable, understood destinations or ports. If customers have legitimate reasons to make an outbound connection from your infrastructure, they should be able to notify you and justify it (this will affect a only tiny percentage of your base) so you can make the appropriate arrangements. Some hosters do not even accommodate these requests.

Throttle outbound traffic from your customers. Even for legitimate outbound connections, most likely they don't need to take up 500 Mbps of outbound bandwidth. Simply set a lower limit.

Put alarms in place when outbound traffic utilization spikes. If, for example, all of a sudden the amount of data leaving your network increases by 40%, there's probably an issue somewhere and your tech folks should be investigating.

Restricting and monitoring your outbound traffic will probably save you money on bandwidth costs and decrease the amount of abuse reports. Best of all, attackers will realize they're not getting what they want out of your platform. The less you have to worry about, the better, right?
Written by Miguel Ramos, Sr. Product Manager, Neustar Enterprise Services
Follow CircleID on Twitter
More under: Access Providers, Cyberattack, Security
Measuring IPv6 at the Network and the Customer Level

Posted: May 16th, 2012, 2:52am WST by Mirjam Kuehne

George Michaelson, APNIC's Senior Research and Development Scientist recently visited the RIPE NCC to collaborate on various research projects with his RIR colleagues. IPv6 measurements were one of the topics we looked at.

Recent IPv6 statistics from the RIPE NCC show an accelerated uptake of IPv6 in Norway, both in terms of the number of allocated prefixes, and visible announcements in the routing system. This is based on a comparison over time of the amount of IPv6 addresses allocated to each economy, and the amount of visible prefixes per Autonomous System (AS) in the routing tables each day. The graph below shows 50% of ASes in Norway now announce one or more IPv6 prefix.

Some have interpreted this to mean that over 50% of the end users in Norway have now access to IPv6. However, a measurement of end user IPv6 capability by APNIC doesn't necessarily support that, rather, it suggests that end user access to IPv6 remains low in Norway, as in other economies. The graph below shows the percentage of IPv6 preference at the end user level.

Keep in mind that this only includes data until mid-May, hence the drop at the end. For the most up-to-date graph, please visit the APNIC Labs IPv6 Measurements pages.

Are these measurements in conflict?

No, not really. One is a measure of capacity and capability in routing and forwarding, and the other is a measure of end user access. There are many reasons why some routing-active entities don't show up in an end user measurement: the AS may be servicing content delivery and not offering access services, or may be providing transit and data management services for others and have no direct end user traffic.

Perhaps the AS is servicing segments of the user base who only gain access to the global Internet occasionally, or to restricted URLs, or not even the web but only VOIP (which we can't measure in the APNIC technique.)

The difference is not a conflict. It exposes differences in what we see on the Internet and the different conclusions drawn from each.

APNIC's measurement focuses on end user access, and in large part, suggests that there is a continuing problem with end user access to IPv6, even when the AS in question may have associated IPv6 allocations visible in global routing.

In the background article on RIPE Labs you can find much more information, including the methodology and an analysis of the specific situation in Norway and in Japan.
Written by Mirjam Kuehne
Follow CircleID on Twitter
More under: IP Addressing, IPv6
Communications and the London Olympics

Posted: May 14th, 2012, 10:37am WST by Paul Budde
Communications will be one of the most critical areas during the London Olympic Games.

The industry is working to establish shared access networks — would it not be nice if they did this everywhere, all the time? They are also working very closely with British Olympic Association, London Transport, the broadcasters and content providers.

Mobile coverage will be the biggest shared infrastructure in the world. There are already 80 million mobile devices in the UK, and to this will be added the millions of devices from overseas visitors and athletes. There will be more people taking photos and videos and sending them around the world. And, of course, the same applies to the thousands of professional photographers and journalists attending the Games. The mobile operators have indicated that there may be periods of 'controlled service', particularly in relation to mobile broadband.

There will be two dimensions to this network — one for officials and athletes, and one for the general public. The network will go live on 1 June and will cater for a range of related and other events:
- Olympic Torch Relay, 27 May-27 July;
- Diamond Jubilee, 2 June-5 June;
- Euro 2012, 8 June-1 July (IPTV);
- Farnborough Airshow;
- Olympic Games, starting on 25 July.
- Over 1,000 BT workers have been assigned to the communications activities surrounding the Games.
Next-generation access network rollouts have been accelerated and core network bandwidth has been increased to facilitate the backbone network, as well as increased fibre access to all facilities, venues, etc.

Extra capacity is needed for the BBC iPlayer service, which will drive up telecoms traffic, with each of 24 HD Olympic TV channels using 3Mb/s. Organisations are made aware of the fact that corporate networks could be flooded if people are watching in the office. This will also apply to international links, as overseas viewers could flood these as well.

If an incident occurs that goes viral on YouTube, this could also swamp networks. There have been warnings that the lack of a national high-speed broadband network could see network meltdowns in such circumstances.

It is anticipated that many public websites can expect as much as five times their normal traffic; organisations should be aware of this and take the necessary measures to cope with it.

Another interesting contingency is that call centres are employing extra staff, as it is expected that enquiry call on-hold time will be longer due to foreign languages. Other increases are expected on retailers' card terminals and ATM usage.

Because of increased security awareness there are elaborate security plans in place — to protect not only the people but also all infrastructures, including the existing telecoms infrastructure around the country. Security plans also take into account other 'unpredictables' that can lead to disturbances, such as unforecasted gatherings, cyber attacks, and large increases in free rich content over the networks.

There is a Resilience and Response Group (EC-RRG) operating the National Emergency Alert for Telecommunications (NEAT) coordination points. There are contingency scenarios for engineers, suppliers, colleagues unable to reach site and so on. They also have proactive procedures in place to reduce risks such as internet congestion, the impact on home working, monitoring video-streaming, terrorist/public order incidents.

Some statistics on the Games:
- 5.3 million visitors are expected with half a million extra on Day 8.
- On 9 days there will be more than 1million extra journeys on public transport.
- Greenwich population will be 25% higher on Day 3.
- At the end of an event, 10,000-20,000 people will be exiting individual venues, creating bottlenecks.
During the games, there will be major disruption for London-based workers — there is a four-step approach:
- reduce journey requirements by avoiding planned utility works;
- retime appointments to avoid clashes with busiest times;
- reroute transport and logistics as access roads will be closed;
- review transport types and use alternatives.
For its part, the regulator Ofcom has devised a Spectrum Plan for the Games, which will see the temporary re-allocation of spectrum from public bodies to cater for bandwidth demands. Spectrum from among three separate bands will come from the Ministry of Defence (MOD), the Civil Aviation Authority (CAA) and the Maritime and Coastguard Agency (MCA), while holdings in the 2.5-2.6GHz band have been reserved for the duration of the Games. Ofcom has also conserved spectrum allocated for private mobile radio (PMR), as also spectrum available for DTTV in the 800MHz band which has not yet been sold off. Ofcom is needing all the spare frequencies it can find to cope with the 350 wireless microphones, 75 HD video streams and 780 talkback channels it expects are needed.

It is also expected that there will be greater work and school absenteeism due to large screen displays that are established right around the country. And businesses are adopting greater flexitime procedures and providing facilities in the workplace.

Organisations have also been advised to, where possible, move staff to Disaster Recovery sites and work from there during the Games. Other suggestions include checking standby generator fuel, batteries, firewall resilience, etc. Teleworking is promoted, with companies advised to plan and test the use of technology remotely by home workers.
Written by Paul Budde, Managing Director of Paul Budde Communication
Follow CircleID on Twitter
More under: Access Providers, Broadband, Cyberattack, Mobile, Security, Telecom, Wireless
If You Build It, They Will Come.

Posted: May 11th, 2012, 4:10am WST by Brenden Kuerbis

Only two years after signing the DNS root zone, the powerful lure of a secure global infrastructure for data distribution is starting to reveal itself. It is illustrated clearly by two proposed technical standardizations that seek to leverage secure DNS. To some degree these developments highlight the strength of DNS institutions and how they might fill gaps elsewhere in the Internet's governance. But an increasing reliance upon and concentration of power in the DNS also makes getting its global governance correct even more important.

The first, more widely known, development is the IETF's ongoing DANE effort. The DANE standard proposes to improve the Transport Level Security (TLS) protocol, which is used worldwide to secure communication between applications (e.g., a browser) and host machines (e.g., a website server). DANE enables administrators of domain names to specify TLS cryptographic key material in a resource record stored in a zone file. Using DNSSEC, an application could validate the resource record with the practical result that communication between an application and host machine is probably more secure — a good thing.

Perhaps the most interesting aspect of DANE is that it takes TLS key distribution out of the hands of the browser/certificate authorities and places it with DNS operators. The browser/certificate authority regime has been shown to be susceptible to attack and lacking in clear lines of accountability. In theory, if an administrator puts signed key material in the DNS, an application can validate it starting from the single trust anchor maintained by ICANN. Like DNSSEC, DANE depends on registrars, registries and Internet service providers not tampering with signed data provided by administrators. Pressure to tamper with data could come from numerous sources, e.g., interests in intellectual property protection, advertising, surveillance, etc. At the end of the day, it will be the DNS contractual regime, the laws that govern the involved parties, and the extent to which those institutions are transnationally interoperable that determines how DANE contributes to various global public policy goals like free expression and free trade in information services. Expect the differences between governments, and their response to domestic pressures, to challenge that interoperability.

The second, and in our opinion, more interesting development is the more recently proposed ROVER (Route Origin Verification) effort which seeks to address the problem of misconfigured routing announcements, whether accidental or intentional. Similar to DANE, ROVER proposes to improve the inter-domain routing by creating new resource records published in the secure reverse DNS (i.e., the in-addr.arpa zone). Similar ideas have been proposed previously, but never took hold. The records would allow network operators to indicate whether an IPv4 or IPv6 prefix ought to appear in global routing tables and identify authorized origin Autonomous System Number(s) for that prefix. This is the same data (i.e., Route Origin Announcements) which appears in the Resource Public Key Infrastructure (RPKI) being managed by some RIRs. ROVER would facilitate the comparison of validated records stored in the secure reverse DNS against route announcements being made on the Internet. Discrepancies could be flagged and lead to further action taken by the operator.

Again, the most interesting aspect is the interplay between technology and institutional power. The technical community has been debating the merits of Secure DNS vs. RPKI. The debate occurs in the shadow of the major, ongoing concern for network operators concerning RPKI, i.e., how it could allow certificate authorities (e.g., the RIRs) to impact routing. This concern is further complicated with Border Gateway Protocol Security (BGPSEC), which proposes incorporating cryptographic signing and validation of route announcements directly into the BGP. As an alternative, ROVER suggests leveraging the certified resource allocation data stored in the RPKI (or elsewhere) to create and validate route announcements in the secure reverse DNS. But it allows operators to independently apply that data to routing decisions. If a certificate authority revoked a certificate it would not impact routing unless the operator allowed it to. Less appreciated, however, is that ROVER potentially shifts route announcement data, typically stored in the decentralized Internet Routing Registries (IRRs) now, into the hierarchical secure DNS. Given this, the operation and governance of a few zones, namely .arpa and in-addr.arpa, becomes critical. Those zones are currently managed by ICANN. Its use for routing purposes may raise contention that too much power is centralized with this organization. In theory, as manager of the in-addr zone, ICANN could regulate network operators via contract, similar to the way it does some TLD operators. This will need to be examined more closely.
Written by Brenden Kuerbis, Postdoctoral Researcher at Syracuse University, School of Information Studies
Follow CircleID on Twitter
More under: DNS, DNSSEC, ICANN, Internet Governance, IP Addressing, IPv6, Security
IXPs and CDNs Critical to the Future of Competitive Broadband Internet

Posted: May 11th, 2012, 3:27am WST by Bill St. Arnaud

We continue to see consolidation in the broadband market and various games played by the cablecos and telcos to thwart competition or undermine network neutrality (See links below).

Until regulators create true structural separation between infrastructure and service providers the chances of seeing genuine broadband competition are slim. It is interesting to note telecom regulators in North America have imposed structural separation in the past. In the 1970s when the cable industry was a fledgling startup industry the FCC in the US and the CRTC in Canada passed regulations forbidding telephone companies to acquire and/or compete with cable companies. This enabled the creation of a entirely new business sector — cable television- who now dominates the broadcast and Internet market place. If regulators and governments are interested in stimulating the economy and creating new business opportunities, it is time they study their past successes and breakup up today's oligopolies by imposing structural separation and allow a true competitive market in broadband Internet.

In the mean time the one bright spot in the competitive marketplace is the development of Internet Exchange Points (IXPs) and the collocation of Content Distribution Networks (CDNs). In a recent a talk at RIPE-64 given by Kurtis Lindqvist demonstrated that IXPs will be even more important as broadband speeds increase. With larger and larger data flows the need to interconnect at an IXP to a CDN network or peering network will becoming increasingly important. (See: Kurtis Lindqvist - The History of Peering in Europe and What This Can Teach Us About the Future)

I am very pleased to see that Canadian Internet Registration Authority (CIRA) has taken a very important leadership role in Canada in this regard. (Full disclosure: I am a member of the CIRA board). CIRA has undertaken an active program to help qualified communities, independent ISPs, regional R&E networks and others to deploy IXPs in their community. CIRA's overall goal is to have local members build and operate the IXP, with CIRA bringing technical expertise, stability, back office functions, governance assistance, content providers and, if required, some financial and gear support. Most significantly CIRA will help the IXP provide a variety of DNS hosting services (which can improve responsiveness and reliability for connected users) as well arranging CDN networks to collocate at the facility.

The combination of these services — peering, DNS and CDN — will provide connected independent ISPs, R&E networks, community broadband networks and other organizations the capability to provide services to their targeted communities and provide a modicum of competition to the local incumbent oligopoly. This service by CIRA will be especially important for small business, community and R&E networks as they look to deliver or use cloud services and wireless applications to their local communities. The integration of WiFi with 3G/4G with anytime, anywhere, any device communications for education and research will also be critically dependent on these facilities.

Further reading:
7 ways Comcast is killing the cable killers GigaOm
Keeping the Internet Neutral New York Times
Written by Bill St. Arnaud , Green IT Networking Consultant
Follow CircleID on Twitter
More under: Access Providers, Broadband, Policy & Regulation, Telecom
Canadian Telcos Fast Tracking FttH to Combat Cable Operators

Posted: May 11th, 2012, 12:20am WST by Henry Lancaster

There are a number of stimuli which are pushing Canada's burgeoning FttH market, and the government and telcos alike have made significant steps to improve the reach and capacity of broadband infrastructure. These measures will show real benefits for consumers in recent years.

From the government's side, its Economic Action Plan, launched in 2009 as a response to the global financial crisis, included a pledge to provide $225 million over three years towards its Broadband Canada Program, geared to extending broadband coverage to underserved communities. The initiative called for the government to pay up to 50% of costs incurred by operators upgrading broadband in rural areas. By the end of 2012, the program's 86 or so projects are expected to have delivered broadband to about 214,000 households.

The government also recently proposed reducing barriers to foreign investment in the telecoms sector, enabling foreign companies to hold more than 46.7% stakes in local telcos. As the experiences of the Netherlands' KPN, Austria's MNO Orange and Ireland's Eircom have recently shown, a fresh injection of capital from unexpected quarters — in these cases South America and East Asia — may help to resuscitate flagging telecom markets in the developed West.

Despite these efforts, much more needs to be done in the government's overall appreciation of broadband as an essential infrastructure. Certainly it has invested in e-health initiatives in recent years, following recommendations from agencies such as the Information Highway Advisory Council. This has resulted in some of the more advanced e-health systems in the world. Yet the government does need to grasp that government-initiated trans-sector policies in Canada are also required to push the development of other key services. In this respect, a fibred national network would be a key infrastructure asset allowing businesses, institutions, utilities to thrive from new business models.

From the telcos' side, operators have been stimulated to invest in FttH through the successes of cablecos which have systematically upgraded their networks with DOCSIS3.0 technology. As a result, many cablecos are commonly offering 100Mb/s services or, to a limited extent, 200Mb/s services. DSL cannot hope to compete, and so to prevent customer churn in areas where cablecos also operate, telcos are been forced to step up their game with FttH.

This development has been a long time in coming — while fibre to businesses in metro areas has been common for some time, deployment elsewhere is still in its early stages, with only a limited number of residential communities being connected to networks. And so operators are fast-tracking FttH deployments: Bell Aliant plans to upgrade a third of its footprint by 2014 and to continue so until 90% is connected. Bell Canada and TELUS are expected to have at least 50% of their network upgraded, while SaskTel has an FttH program to 2019.

The momentum is palpable, and for the government's economic recovery program the years to the end of the decade are more promising.
Written by Henry Lancaster, Senior Analysts at Paul Budde Communication
Follow CircleID on Twitter
More under: Broadband, Policy & Regulation, Telecom
"Toll Free" Broadband Service: Double Billing Ripoff Or Better Than Best Efforts Premium Option?

Posted: May 10th, 2012, 7:40am WST by Rob Frieden

Representatives of both AT&T and Verizon have stated that their companies will soon offer "toll free" broadband services. So far they have not provided much detail, but the prospect for customer and content provider surcharges should trigger concern, even outside the context of the network neutrality debate.

First let's consider the frame the carrier reps use: "Toll Free." This is an old school "Bellhead" reference to a pricing strategy where the called party pays instead of the calling party. Lots of commercial ventures have offered consumers Wide Area Telephone Service ("WATS") line access using the 1-800 and now 866, 877 and 888 prefixes. So toll free historically has referred to a pricing arrangement where consumers can avoid having to pay for a long distance telephone call.

The toll free reference may be a red herring here, because it's likely that the arrangement will simply mean consumers will not have minutes of use or downloaded bytes debited against a monthly usage cap. Toll free will mean debit-free to the end user with a surcharge to the content provider.

The proposed arrangement appears to parallel what Amazon has secured for cellular carrier delivery of e-books with two big differences. First Amazon is having delivered content costing $10 or more in a single transaction, while ventures like Netflix may be offered expedited delivery of content costing $8 a month for "unlimited" streaming. Also we should appreciate that when Amazon pays the e-book downloader pays nothing and does not even have to subscribe to cellphone service. In both the wireline and wireless environment where "toll free" data will operate, end users already are subscribing to monthly service: DSL, fiber or a hybrid fiber wireline broadband service, and/or cellphone service. So the value a carrier offers appears to be "better than best efforts" Internet routing of possibly "mission critical" bits coupled with a end user sweetener of not debiting minutes or bytes from a monthly basket.

Is this a fair deal, or double billing? End users will end up paying for such premium service, so it's fair to ask when — if ever — one would want better than best efforts routing when plain vanilla best efforts heretofore has worked just fine. The network neutrality advocates have a legitimate concern that carriers will find a way to degrade service to content providers like Netflix and Google making the premium routing a necessity. Bear in mind that Netflix already pays Content Distribution Networks, such as Level-3, for high quality, "toll-grade" delivery. Recently Comcast demanded a delivery surcharge in light of the higher volume of traffic Level-3 hands off to Comcast for final delivery than the amount Comcast hands off to Level-3 for upstream delivery through the Internet cloud. So is Netflix getting hit up for a double or triple payment: once to Comcast for last mile delivery, twice to Level-3 and other long haul Internet cloud carriers and thrice to Verizon/AT&T? Let's not forget that end users already are paying $30-100 monthly for their wired and wireless broadband connections. Doesn't that broadband subscription entitle subscribers to timely and efficient delivery of any and all traffic without surcharges?
Written by Rob Frieden, Pioneers Chair and Professor of Telecommunications and Law
Follow CircleID on Twitter
More under: Access Providers, Broadband, Mobile, Net Neutrality, Policy & Regulation, Telecom
Carlos Slim Puts Bomb Under European Telecoms Market

Posted: May 9th, 2012, 10:26am WST by Paul Budde

The Mexican telecoms and broadcasting magnate Carlos Slim — the wealthiest man in the world and owner of the business conglomerate Grupo Carso — has put a 28% bid for the Netherlands' incumbent telco KPN on the table. This is a very interesting and significant move. As is often the case, new winners tend to arrive when previous winners become losers, especially when they are becoming weaker and thus easier to attack. The new winners in the 21st century will come from what in the 20th century were called developing countries. In the communications sector in particular we have seen that these countries — be they in Africa, Asia or South America — have seen the most spectacular growth. Because of their very large populations, growth in these markets adds up to very big numbers.

For several years now I've argued that it is only a matter of time before these new telco giants will enter the so-called developed economies. Now is a good time: developed economies are under pressure, there is lots of hardship and a desperate need to save money. Yet at the same time people do not want to give up their gains in lifestyle. Mobile phones are a case in point — survey after survey show that consumers would cut back on meals out and other entertainment rather than reduce expenditure on mobile comms.

One of the reasons for confidence in predictions on 'foreign invasions' is that mobile operators in developing economies are amongst the most profitable in the world, with among the lowest costs to consumers. This is certainly an attractive position from which to start your competition, especially in depressed economies. One of the key reasons why these companies are in such a good position is because of their scale. With mobile rapidly becoming a commodity, and little possibility for mobile operators to increase ARPU, these players have to become far more cost effective, and they will have to grow their subscriber base to 50 million or more.

We believe that, rather than looking at the weakest markets in Europe, Mr Slim is clearly looking at the stronger markets — which nevertheless are also economically depressed — since from such a stronger position he can further extend his business throughout Europe. We believe that he will be aiming at 50 million subscribers in the region, and for that matter, why not 200 million or more? A key asset of Grupo Carso is América Móvil, which now has some 246 million mobile customers across South and Central America, including 67 million in Mexico and almost 62 million in Brazil.

Carlos Slim is also the co-chair of the ITU/UNESCO Broadband Commission for Digital Development which I helped set up and of which he is the special advisor. Mr Slim is a leading force in this Commission and has a very clear and very realistic view on the future of the telecoms industry. He also sees enormous commercial potential in telecoms and is more than happy to 'help out' in markets where players are struggling for growth.

As mentioned before (2008/2009) KPN, like most other telcos, has been struggling with finding its right strategy for the future. The company is missing out on new higher value digital media services and at the same time it needs to continue investing in infrastructure. While looking for those high ROI services it always ends up on the commodity side of the business. As this has now been going on for more than a decade, with falling income from their traditional cash-cows (telephony and basic access) the company is increasingly in need of new cash-flows. Projecting these developments further into the future than has been mentioned above, the only solution in a commodity market is to cut costs and built scale. Our analysis of Mr Slim's move is that this is exactly what is he is setting out to do. The highly fragmented European market has plenty of suffering — or soon to be suffering — telcos, so the time is ripe for massive consolidation.

According to Hendrik Rood from Stratix, by becoming involved in KPN Mr Slim is also laying the foundation for building credibility in this market. Through his involvement in this company he can build the groundwork to move further into Europe. He is well aware of the importance of telcos to the EU and to national governments, and to be seen as a responsible player in the market will help him grow further into it. And — which is also not to be snubbed — KPN still has an admirable ROI.
Written by Paul Budde, Managing Director of Paul Budde Communication
Follow CircleID on Twitter
More under: Mobile, Telecom
Software Defined Networks and Integration of Wifi with 3G/4G for R&E Networks

Posted: May 9th, 2012, 4:18am WST by Bill St. Arnaud

A number of R&E networks such as SURFnet, JANET, AARnet, etc. are actively promoting mobile services and looking at integration of campus Wifi with 3G/4G networks using Eduroam. Mobile wireless services promises to be major service offering for R&E networks as the Internet of Things and Machine to Machine (M2M) becomes increasingly critical for research. Applications such as personal medical devices on (or in) the body, environmental sensors, traffic monitors and even garbage truck tracking will need such networks. As well anytime, anyplace, any device education and research will be increasingly dependent on the integration of campus Wifi, community Wifi and 3G/4G networks. Public content and distribution networks will also be an integral component. And as I have blogged in the past such wireless integration allows the deployment of overlapping Green WiFi nodes — powered by solar panels which will be needed to adapt a warmer climate.

Here is a great article on OpenRadio a project from Stanford that hopes to use OpenFlow to create pools of available broadband from Wi-Fi, cellular and other networks. The project team is working with Texas Instruments to build $300-$500 base stations for the hardware component, while researchers try to build the orchestration software. Hopefully the base stations can be powered by renewable energy. R&E networks and campus IT staff could direct al bandwidth hungry applications to their WiFi networks while using much more expensive 3G/4G for e-mail and text messaging.
Written by Bill St. Arnaud , Green IT Networking Consultant
Follow CircleID on Twitter
More under: Access Providers, Broadband, Mobile, Wireless
A Look at the Rapid Evolution of the World's DNS Infrastructure

Posted: May 9th, 2012, 2:48am WST by CircleID Reporter

A recent report by Pingdom looks at the booming growth of Internet's DNS infrastructure. From the article: "Five years ago there were 123 DNS root server sites (the "backend" of DNS) spread out on the Internet. Today there are more than twice as many, over 300. Five years ago, 46 countries had root servers. Today, 76 have them. In other words, not only has the number of root servers grown tremendously, but their geographical spread has increased as well. This is good news for the overall stability and performance of DNS worldwide."

The report also notes that Europe has overtaken North America as the world region with the most root server sites.

Follow CircleID on Twitter
More under: DNS

IGP Blog

If you build it, they will come.

Posted: May 9th, 2012, 2:22am WST by Brenden Kuerbis

Only two years after signing the DNS root zone, the powerful lure of a secure global infrastructure for data distribution is starting to reveal itself. It is illustrated clearly by two proposed technical standardizations that seek to leverage secure DNS. To some degree these developments highlight the strength of DNS institutions and how they might fill gaps elsewhere in the Internet’s governance. But an increasing reliance upon and concentration of power in the DNS also makes getting its global governance correct even more important.

The first, more widely known, development is the IETF’s ongoing DANE effort. The DANE standard proposes to improve the Transport Level Security (TLS) protocol, which is used worldwide to secure communication between applications (e.g., a browser) and host machines (e.g., a website server). DANE enables administrators of domain names to specify TLS cryptographic key material in a resource record stored in a zone file. Using DNSSEC, an application could validate the resource record with the practical result that communication between an application and host machine is probably more secure – a good thing.

Perhaps the most interesting aspect of DANE is that it takes TLS key distribution out of the hands of the browser/certificate authorities and places it with DNS operators. The browser/certificate authority regime has been shown to be susceptible to attack and lacking in clear lines of accountability. In theory, if an administrator puts signed key material in the DNS, an application can validate it starting from the single trust anchor maintained by ICANN. Like DNSSEC, DANE depends on registrars, registries and Internet service providers not tampering with signed data provided by administrators. Pressure to tamper with data could come from numerous sources, e.g., interests in intellectual property protection, advertising, surveillance, etc. At the end of the day, it will be the DNS contractual regime, the laws that govern the involved parties, and the extent to which those institutions are transnationally interoperable that determines how DANE contributes to various global public policy goals like free expression and free trade in information services. Expect the differences between governments, and their response to domestic pressures, to challenge that interoperability.

The second, and in our opinion, more interesting development is the more recently proposed ROVER (Route Origin Verification) effort which seeks to address the problem of misconfigured routing announcements, whether accidental or intentional. Similar to DANE, ROVER proposes to improve the inter-domain routing by creating new resource records published in the secure reverse DNS (i.e., the in-addr.arpa zone). Similar ideas have been proposed previously, but never took hold. The records would allow network operators to indicate whether an IPv4 or IPv6 prefix ought to appear in global routing tables and identify authorized origin Autonomous System Number(s) for that prefix. This is the same data (i.e., Route Origin Announcements) which appears in the Resource Public Key Infrastructure (RPKI) being managed by some RIRs. ROVER would facilitate the comparison of validated records stored in the secure reverse DNS against route announcements being made on the Internet. Discrepancies could be flagged and lead to further action taken by the operator.

Again, the most interesting aspect is the interplay between technology and institutional power. The technical community has been debating the merits of Secure DNS vs. RPKI. The debate occurs in the shadow of the major, ongoing concern for network operators concerning RPKI, i.e., how it could allow certificate authorities (e.g., the RIRs) to impact routing. This concern is further complicated with Border Gateway Protocol Security (BGPSEC), which proposes incorporating cryptographic signing and validation of route announcements directly into the BGP. As an alternative, ROVER suggests leveraging the certified resource allocation data stored in the RPKI (or elsewhere) to create and validate route announcements in the secure reverse DNS. But it allows operators to independently apply that data to routing decisions. If a certificate authority revoked a certificate it would not impact routing unless an operator allowed it to. Less appreciated, however, is that ROVER potentially shifts route announcement data, typically stored in the decentralized Internet Routing Registries (IRRs) now, into the hierarchical secure DNS. Given this, the operation and governance of a few zones, namely .arpa and in-addr.arpa, becomes critical. Those zones are currently managed by ICANN. Its use for routing purposes may raise contention that too much power is centralized with this organization. In theory, as manager of the in-addr zone, ICANN could regulate network operators via contract, similar to the way it does some TLD operators. This will need to be examined more closely.

CircleID

Gas Pipeline Firms Under Targeted Phishing Attacks

Posted: May 9th, 2012, 12:34am WST by CircleID Reporter

The United States Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) has issued a warning about an active "spear phishing" campaign targeting companies in the natural gas pipeline sector. In an advisory issued last week, ICS-CERT said it has received information about targeted attacks and intrusions into multiple organizations over the past several months.
Follow CircleID on Twitter
More under: Cyberattack, Malware, Security
ICANN Receives Beyond Expected Number of New gTLD Applications

Posted: May 9th, 2012, 12:13am WST by CircleID Reporter

The upcoming expansion of the internet's domain name system could see more than 2,000 new top-level domains come into existence, according to policy overseer ICANN. The organisation revealed at the weekend that it has received 2,091 applications for its controversial new gTLD programme, and could see up to 214 more before it shuts the door to applicants.
Read full story: The Register
Follow CircleID on Twitter
More under: ICANN, Top-Level Domains
Wall Street and Virtual Space Data: Internet Domain Name Index (IDNX) Listed on Bloomberg, Reuters

Posted: May 8th, 2012, 4:47am WST by Thies Lindenthal

The financial industry is all about pinstripe suits, excessive Excel sheets and boring data. Or is it? Financial markets are more colorful than their reputation: take a look at Bloomberg's or Reuters' sites, and you'll see that pork belly is as much an object of investment speculation as coffee, electricity, bananas, hides, or fishmeal. Recently, the universe of data available to financial analysts and investment bankers grew further, with the addition of the Internet Domain Name Index (IDNX) to leading financial data distributors Bloomberg (ticker symbol: IDNX <Index>) and Reuters (ticker symbol: .IDNX).

So what does IDNX tell us?

IDNX is to domain markets what the NASDAQ is to stock markets or the Case-Shiller index to housing wealth: an aggregate indicator of price changes for the market as a whole. IDNX is the first price index for Internet domain names that is based entirely on data from actual domain sales, meaning that subjective evaluation or opinion is not a factor at all. Under the hood, IDNX employs an estimation technique borrowed from Real Estate finance research that has been refined by researchers from the Massachusetts Institute of Technology (MIT).

How do we use IDNX?

Price trends for domain names can be used for trading strategies, personal investment optimization, or insights into the Internet economy in general. Overall, the market for domain names fluctuates in a very similar way to the IT industry, but the correlation between the two is not exact. While IT index heavyweights like the NASDAQ 100 cover the stock performance of the largest IT companies, IDNX has a broader scope. In fact, because IDNX is not based on stock prices but on real trades done by large blue-chip companies, small online marketers, start-ups, and private investors alike, it is a comprehensive fever curve for the well-being of the broader Internet economy.

With IDNX data being distributed through the industry standard data platforms, traders can easily embed this information into trading strategies and investment decision making. In the same way that demand for electricity is linked to economic activity in general, the demand for domains gives insight into the dynamics of Internet-based business across the US and around the world. The virtual economy has made its way onto Wall Street.

Finally, if you're a domain owner, your core source of income is revenue generated from online advertisements. As prices paid for domains represent the discounted future cash flows from owning a domain (assuming textbook-like behavior for buyers and sellers), changes in IDNX can be read as changes in domain owners' expectations as to how much they will earn from online ads. Media executives: why not access your Reuters or Bloomberg terminal, subscribe to IDNX, and know where the future markets are heading?

How does IDNX help investors, domainers, or academics?

IDNX also helps domain investors track their wealth. Almost every company or organization owns at least one primary domain. So do many individuals. A substantial number of them have also been compelled to purchase the name they want from other investors for amounts sometimes reaching 6-digit dollar amounts. With an overall market benchmark like IDNX, it is now easier to appreciate how these intangible assets affect your balance sheet, and to know when to adjust their value according to the general benchmark. Your accountant will ask fewer questions if you can justify a 10% increase on the asset side with data from Bloomberg or Reuters. And for the few dozen investors who own more than 20,000 domains (sometimes up to several hundreds of thousands), a market-wide benchmark is the best indicator of changes in their wealth.

For academic researchers, having domain market data well integrated with thousands of other data sources makes comparisons and deeper analysis convenient and efficient, and on this front, I am curious to see what kind of studies will evolve using IDNX.

How do I start investing?

As of now, it is not possible to invest into the index as such, as there are no investment tools developed that tie into returns linked to changes in the index. However, IDNX can still be used as a tool in itself for financial professionals and domain traders alike. For more information on how IDNX is estimated, please read this research paper. To explore the dynamics of domain prices right now, go to sedo.com/idnx.
Written by Thies Lindenthal, Product Manager for Domain Pricing, Sedo.com
Follow CircleID on Twitter
More under: Domain Names, Top-Level Domains
Business Case for IPv6 - Part 1

Posted: May 7th, 2012, 11:28pm WST by Juha Holkkola

When discussing IPv6, it is easy to forget that we are ultimately talking about an enhanced version of an existing network protocol. Sure, it brings about a number of technical advantages. But when viewed in isolation — without a business case — there really are not that many drivers that would place IPv6 on the agenda of the top decision makers looking after budgets. For IPv6 to gain serious momentum, this has to be changed.

As IPv4 started getting traction during the 90s, there probably were not many organizations out there that were dying to make an investment in IPv4. Rather, the compelling business case they saw related to the Internet, for which IPv4 was the enabler. Twenty or so years down the road, I find it hard to believe that the decision making process in itself would have changed dramatically. Without a powerful trend providing support, the IPv6 train will remain stuck at the station.

A case in point is the service providers in the emerging economies. In our experience, the reason they have been actively experimenting with IPv6 isn't related to technological advantages. Rather, the problem these entities are tackling with IPv6 relates to the amount of available IPv4 space they have at their disposal, and its disparity with the addressable market they are looking at. If the market potential you are looking at is hundreds of millions of subscribers, yet your organization is stuck with a couple of class B networks, you have no choice but to embrace IPv6 if it is to grow to its full potential.

In the more mature industrialized countries, a driver like this does not exist, at least not in the short to mid-term future. Sure, the number of IP devices is on the rise. Yet with stagnating subscriber base, aging population and the proportionally large address spaces that were allocated to these organizations back in the day, it is not as if shortage of IP addresses would be a bottle-neck for the growth of their business. Coupled with private network spaces used by most enterprises, it is hard to find a genuine business case for IPv6 in the form of IP shortage. So perhaps we should be looking elsewhere (to be continued in Part 2).
Written by Juha Holkkola, Managing Director of Nixu Software
Follow CircleID on Twitter
More under: Internet Protocol, IP Addressing, IPv6

internet :: ecosystem

Tainted Route: a parody

Posted: May 7th, 2012, 5:51pm WST by sgdickinson

I'd forgotten I'd written this until I rediscovered it the other day: lyrics for the Internet technical crowd to be sung the tune of Tainted Love. Enjoy! Tainted Route Sometimes my CIDR prefix is preloved, my prefix is misused My packets don't get through to the Internet The routes we share Seem to go nowhere And I've lost my fight To prove the block is mine to route by right (chorus) Once I

CircleID

2100 New gTLD Applications. What Does It Mean?

Posted: May 7th, 2012, 4:18am WST by Antony Van Couvering
Over the course of the last week, ICANN has released several pieces of information that taken together begin to allow us to piece together the overall gTLD landscape. ICANN is releasing partial information, without explanation or context, in dribs and drabs, and rumors are flying that we won't get the "Reveal" (the release of full information on applications and applicants for new gTLDs) until the ICANN meeting in Prague at the end of June.

This partial information and delay from ICANN is creating consternation and confusion among the many applicants and those watching the new gTLD scene. Therefore some analysis, however imperfect, will help. What follows is what we at Minds + Machines consider a likely scenario based on the facts we have, along with some estimates and calculations that we think are reasonable. This is back-of-the-envelope stuff, but it shows how we see the new landscape forming.

First, let's start with what we know for sure:
- There are 1,268 total applicant profiles in ICANN's system (the TAS), each of which allows 1-50 applications
- There were 2,091 applications in the TAS as of April 12, 2012
- There were 214 unpaid applications
Given that the application window was suspended with just twelve hours to go, we believe that anyone who hasn't paid yet isn't going to, and that people who are paying for their applications aren't leaving any unpaid. In other words, we don't think the 214 unpaid applications are ever going to happen, and that there's a rough one-to-one correspondence between unpaid apps and number of applicants with unpaid apps. Therefore there are roughly 200 applicants who are not actually going to submit 214 apps.

This leaves us with about 1,000 bona fide applicants and 2100 applications, or roughly 2 TLDs for every applicant. But we can break down these numbers a little further based on industry information.

Categorizing 2100 new gTLD applications

We can divide up the applicant groups into five buckets:
1. Geographical applicants, applying for cities, states or regions.
2. Applicants applying for a specific individual project: one or in some cases two names.
3. IDN applications, applying for generic names in a non-Latin script.
4. Portfolio applicants, applying for 20 TLDs or more.
5. Brand applicants, applying for their trademarked names.
There will be exceptions to these generalizations, but overall these categories are clear. But how many of each? The breakdown is important, because it will determine how the competition for high-value generic names will play out. We assume that geos, IDNs and brands are going to face little or no competition because of the favorable ICANN rules in (for geos and brands) or language specificity (IDNs). Therefore the contention is most like to occur among and between the smaller applicants and portfolio applicants who are applying for English-language generic-word TLDs. Looking at each category, we can identify some further characteristics:

Geo Domains

We estimate 50 geographic domains. Some of these have been in the news, but many others have not. This category includes US cities such as Las Vegas and NYC to European cities such as London, Paris, Berlin and Madrid, states such as Bavaria and NRW, and Japanese cities such as Tokyo and Osaka, and of course the entire continent of Africa. Altogether we do not predict more than 50 geo domains. We are estimating one application per applicant (for these purposes, we consider the geographic entity to be the applicant, even if the official "applicant" is another entity with a letter of support).

Niche Applicants

These are individual non-IDN applicants, applying for just one or two generic-word names such as .KIWI, .MUSIC, .HIV and .RADIO. We estimate that these probably represent another 100 applicants and 150 total applications. This is a very rough estimate based on who has been present at ICANN, or .NXT, or other industry meetings. These applicants will compete with one another and often, but not always with portfolio investors for generic terms — as the projects, such as .HIV, may serve a very specific purpose.

IDNs

IDN applicants, in our calculation, represent another 100+ applicants. We know already of applicants for Russian, Chinese and Arabic strings. While we don't have very good knowledge about these applicants, our cloudy crystal ball says that the number of IDN applications will be around 10% of the total, or 200, and that on average IDN applicants will have 2 applications each. We foresee limited competition between IDNs, and by definition little competition with Latin-characters gTLDs. Note that IDNs could represent brands as well as generic terms and niche products, this is factored into our estimate of 100 applicants, 200 apps.

Portfolio Applicants

Portfolio applicants will be few. With the high cost of applications, there are probably no more than 20 portfolio applicants (such as ourselves) applying for more than 10 TLDs. We will know better when ICANN provides definitive information, but that is our estimate. By estimating 25 apps (on average) per portfolio, we predict a total of 500 applications from portfolio applicants. TLDH is applying for significantly more than the average for its own account; we don't think that ours is the highest number, but we believe it is in the top five.

Brands

Brands will, with some exceptions, apply just for their trademarks. Based on our previous analysis, anything that isn't a geo, niche project, IDN or portfolio app is an english language brand app. This gives us a total of 1,200 brand apps, and 730 brands. This implies about 1.65 applications per brand — which is in the general ballpark of the earlier estimate by Fairwinds of 2.2 applications per brand. Verisign has announced 220 applications, the vast majority of which we assume to be brands, many of them from Melbourne IT. We assume that other major registry service providers, particularly Neustar with their loss-leader $10,000 application consulting fee, but also non-U.S. providers like GMO, will have the rest of the brands.

Note that the biggest variable in our analysis is the number of portfolio applications. The number is not likely to be significantly larger than 500, however, as it would reduce the number of applications per brand below credible levels. For example, if there were 1,000 portfolio apps done by the small number of portfolio players, then it would imply 700 brands with 700 apps — not a likely ratio in our opinion. It seems more likely to us that the number of portfolio apps are in the 300-600 range.

Conclusion

The foregoing gives us the following view:
- Geos: 50 applicants – 50 apps (3%)
- Niche applicants: 100 applicants – 150 apps (7%)
- IDNs: 100 applicants – 200 apps (10%)
- Portfolio: 20 applicants: 500 apps (25%)
- Brands: 730 applicants: 1,200 apps (60%)
Total: 1000 applicants, 2100 apps

We therefore see about 700 applications being likely candidates for contention (niche plus portfolio apps). Some strings (.WEB, .MUSIC) are known to have multiple applicants. Others, such as .KIWI, are likely to face no competition. Overall we think that about two thirds (466) of our 700 of these will end up in contention, and of those 466 about half (233) will have more than two contenders.

So, our very rough back-of-the-envelope calculation says that of the 2100 applications, about 233 will have exactly two parties in contention, and these have a much higher likelihood of being settled without an auction. Another 233 will have more than two contenders, which makes a deal more difficult, but by no means impossible. At the end of the day, then, we estimate that ICANN is going to have about 100-125 auctions.

Batching

A word about batching. This is a very difficult area because ICANN hasn't released much information about how it's going to happen (which by the way makes any "digital archery" service somewhat suspect). ICANN has said they will pay attention to geographic diversity as well as to "skill" in the digital archery game, but they have also said that applications in contention sets will go in the first batch, which would mean that brands, geos, and IDNs would be sparsely represented in the first batch.

But it is also not at all clear to us that the batches cannot be staggered instead of back-to-back; work on a subsequent batch can begin even before the previous one is finished. Concluding that 2000 apps will take until 2014 is by no means a given if ICANN uses their new-found $350 million windfall wisely. The evaluations should go quickly, particularly since the estimate of how long it will take is based on the fiction that evaluators will be looking at 500 unique applications per batch. They won't: there are perhaps 15 qualified registry service providers in the world, and therefore ICANN will not be faced with more than that number of unique tech sections — the great majority of the application — in the submissions they receive. Even though ICANN is headquartered at what has become known as "Marina Delay," it is difficult to imagine that with resources at its disposal, ICANN will not be able evaluate 2000 applications in 12 months.

Summary

Even though information is spotty, there's enough to start understanding what the post-application landscape will look like. The analysis above is our broad prediction.
Written by Antony Van Couvering, CEO of Minds + Machines
Follow CircleID on Twitter
More under: Domain Names, ICANN, Multilinguism, Top-Level Domains
China Passes 1 Billion Mobile Subscribers, Over 400 Million Mobile Web Users

Posted: May 5th, 2012, 4:29am WST by CircleID Reporter

China now has more than 1 billion mobile subscribers (India isn't far behind) — that's more than three times the US. Second, China now has more than 150 million 3G users, as reported by mobiThinking. "These are the sum of subscriber stats from the three main Chinese operators. Third, China has more than 400 million mobile Internet users (i.e. more than there are mobile subscribers in the US), according to Analysys International. Fourth, China is now the largest smartphone market in the world with 22 percent (overtaking the US at 16 percent), according to Canalys."
As of March 2012 the combined total subscribers of the top three Chinese mobile operators — China Mobile, China Unicom, China Telecom — is now 1,012.5 million, according to mobiThinking's arithmetic.
Sources: China Mobile; China Unicom; China Telecom, Via: mobiThinking
Follow CircleID on Twitter
More under: Mobile
FBI Pushing Plans to Force Surveillance Backdoors on Social Networks, VoIP, and Email Providers

Posted: May 5th, 2012, 3:40am WST by CircleID Reporter

Declan McCullagh reporting in CNET: "The FBI is asking Internet companies not to oppose a controversial proposal that would require the firms, including Microsoft, Facebook, Yahoo, and Google, to build in backdoors for government surveillance. In meetings with industry representatives, the White House, and U.S. senators, senior FBI officials argue the dramatic shift in communication from the telephone system to the Internet has made it far more difficult for agents to wiretap Americans suspected of illegal activities..."
Follow CircleID on Twitter
More under: Access Providers, Email, Internet Governance, Policy & Regulation, Privacy, VoIP, Web

Veni Markovski - The Blog

Кибер какво?

Posted: May 5th, 2012, 3:39am WST by Veni Markovski | Вени Марковски

От блога на Ивайло Калфин:

На света има повече от един милиард индийци, китайци, католици, мюсюлмани и…хора, които имат профил във Фейсбук. Цитатът е на директора на Департамента за вътрешна сигурност на САЩ Джейн Хол Лют, агенцията, ангажирана със защитата на американското киберпространство.

Всъщност броят на хората, които са онлайн скоро ще достигне 3 милиарда. Това безспорно е най-големият и най-бързо развиващ се пазар в света. В същото време той е сравнително нов и неособено регулиран, което позволява да се правят бързо пари, но в същото време и да се вършат непознати по размаха си злоупотреби, кражби и измами.

Този вид престъпления стават все по-чести особено в страните с развити комуникации. САЩ и Европа са основните мишени на кибернападения, които имат предимно криминални цели, свързани най-вече с финансови облаги. Техни жертви стават както обикновените граждани, чийто банкови сметки и карти биват източвани, така и цели организации и общности, като Европейският съюз, който стана жертва на най-голямата кражба на въглеродни емисии в историята.

25 години след създаването на интернет, в него няма нито една дейност, при която с информацията да не може да се злоупотреби, и това е неприемливо. Думите отново са на Хол Лют.

Изненадващо голям брой хора не са наясно какво и как се случва в интернет

Те са просто ползватели, които вярват, че щом не плащат сметките си онлайн или не дават номера на кредитната си карта, нищо лошо не може да им се случи.

Всъщност колкото и да са апетитни, тези не са единствените данни, които интересуват хората, стремящи се към незаслужени печалби. Всъщност цената на „една душа” в интернет не е висока. Личните данни на човек струват по-малко от едно евро, тъкмо защото броят на хората, до които могат да се доберат търговците, рекламодателите и кибер престъпниците, е толкова необятен.

Хол Лют е права, когато казва, че няма операция, която да ви гарантира тотална сигурност. Дори самият факт, че сте в интернет ви прави уязвими. Да речем да попаднете в ботнет – това са мрежи от заразени компютри, които се използват от интернет престъпниците за организирани на кибер атаки. В общия случай собствениците на тези компютри дори не подозират, че техните машини служат за генериране на спам или за други злоумишлени действия, насочени към сайтове и информационни мрежи.

Все още почти половината от данните, давани от желаещите да открият страница в петте най-популярни домейна в интернет – .com, .org, .net, .info и .biz, съдържа доказателства за подправена, фалшива или непълна информация, което не позволява на органите на реда да се доберат до киберпрестъпниците.

Хакерите – будни тийнейджъри, които искат да се докажат, прониквайки в най-защитените правителствени и корпоративни сайтове – са от романтичния период на интернет. Сега възможностите им са впрегнати в полза на предприемчиви бизнес компании, на новаторски настроени държавни институции, и най-често на престъпниците. Дори шестгодишните компютърни гении вече работят за някого.

Интернет обаче не е някакво зло,
което трябва да се забрани или да се избягва. Светът вече е толкова зависим от възможностите и връзките, които той създава, че заобикалянето му нито е възможно, нито желано от някого. Практиката обаче показва, че престъпниците, все по-често го използват като средство за печалба. Не че идеологическите и политическите мотиви липсват, но в огромното мнозинство от случаите печалбата е единствена цел.
Какво може да се направи? Най-малкото да се помисли за защита. САЩ са водещи в тази област. Още миналата пролет президентът Обама огласи националната стратегия за борба си кибер престъпленията, където атаките срещу сигурността на мрежите се класифицират наравно с военните нападения и предвиждат същите ответни мерки – военна намеса и икономически санкции срещу извършителите.

В сравнение с Америка Европа е тромава

Някои наричат това европейска демокрация в действие и вслушване в различните гласове. ЕС все още си изяснява дефиниции и правомощия.

Европейските институции се пораздвижиха, след като киберпрестъпници откраднаха конфиденциална информация от Европейската комисия и зачестиха опитите за проникването в институциите. Най-дръзкият и успешен опит за компрометиране на електронните бази на Общността беше кражбата на въглеродни квоти от националните регистри на пет държави в края на 2010 г. Престъплението за около 30 милиона евро все още не е разкрито. Последно се чу, че милионите били проследени в Саудитска Арабия на път за Пакистан, но все още е неясно как точно престъпниците са осъществили безпрецедентния обир, принудил ЕС да промени правилата за търговия с емисии СО2.

Въпреки, че „кибер” влезе в речника на доста политици, все още ЕС няма общ подход за справяне със заплахите към информационните си системи. Последната ревизия на Директивата за критичната инфраструктура не включи информационните системи сред обектите, подлежащи на специална защита. Учението, организирано от Европейската комисия за органите в страните членки, натоварени с борбата с киберпрестъпленията, показа че координация липсва и че в общия случай всяка държава действа по собствен начин, не може да предупреждава за опасности или да помага на останалите за разрешаване на казуси и за справяне с инциденти.

Както често се случва в ЕС страните членки са на различен етап от своето развитие и интересите им не съвпадат

Някои са много напред – Германия, Естония и вече имат идея как да се справят с въпроса, приели са стратегии за справяне с проблема, въвели са законодателство, ангажирали са частния бизнес, чиято е собствеността на мрежите.

Освен бързото развитие на технологиите, сложността при противопоставянето на киберпрестъпленията, произтича и от факта, че държавата има ограничена роля – главно на законодател и регулатор, тъй като 90 на сто от мрежите, производителите на софтуер и услуги, както и доставчиците на интернет, са частни фирми. Това налага активното въвличане на частния сектор във формулирането и намирането на решения, което не винаги е лесно, а понякога не е част от управленската култура.

Добрите примери

Естония – първата държава, паднала жертва на кибератака през 2007 г., е сред локомотивите в Европа. Преди пет години държавните и търговските комуникации са блокирани за часове и държавата е парализирана от атака, чиято цел е именно естонската държава. Днес страната е толкова напред в развитието на интернет, че когато зам.-министърът на отбрана Йонатан Всевиов представя достиженията, трябва да стиснеш очи, за да си представиш. Една четвърт от гласовете на избори се подават онлайн, 99 на сто от банковите преводи се извършват по електронен път, така се плащат данъци (5 минути) и се основават фирми (25 минути).

Страната е изцяло зависима от електронните си комуникации. Естонският случай – първото регистрирано кибернападение срещу суверенна държава – стана повод НАТО да се заинтересува по-сериозно от киберпрестъпленията и да се занимае със защитата на собствените си мрежи и инфраструктура. Но Талин също не стои със скръстени ръце. Най-добрите киберспециалисти са привлечени в доброволческата организация „Лига за киберзащита”, в която работят по сигурността, както на правителствените, така и на частни мрежи.

Държавата е осигурила правната рамка за тяхната рамка, а специалистите са привлечени от предизвикателството и от възможността да общуват помежду си. Доставчиците на интернет са задължени да информират потребителите, когато влизат в страници, които биха могли да ги заразят с вируси и да ги направят уязвими или да ги превърнат в оръжие на престъпниците. Пак доставчиците трябва да предлагат антивирусни програми на потребителите, които все пак решат да не се вслушат в съвета им. Правителството е предоставило собствеността на личната информация, която дават в интернет на потребителите и твърди, че тя е по-добре защитена, отколкото тази, която администрацията ползва, чрез хартиените им досиета.

За Германия сигурността на интернет също е национален въпрос. Датата под стратегията за кибер сигурност е февруари 2011 г. и обхваща въпросите, свързани с защита на критичната инфраструктура и на мрежите, използвани от правителството. Първите партньорства между властите и мрежовите оператори датират от 2007 г. Най-големите специалисти от правителствените организации, академичните кръгове и бизнеса са обединени в консултативен съвет, който обсъжда нови заплахи, оценява възможното им въздействие върху Германия и консултира правителството за позицията, която би трябвало да заеме. За германците ключът към проблема е в международното сътрудничество, в привличането на все повече държави към общи принципи и правила за работа срещу кибер престъпленията като мерки за мирно използване, за почтеност , за надеждност, з задължение за борба с вирусите, за разследване на престъпниците, за изграждане на общи механизми и мрежа за кризисна комуникация във всяка от страните, където 24-часово да можем да се обменя информация, за изграждане на капацитет за противодействие в по слабо развитите европейски страни.

Макар да признава, че интернет засяга начина й на живот, Европа все още не е наясно как да го защити.
Европейската комисия предложи законодателство, което да криминализира ботнетите, планира да отвори център за борба с кибепрестъпленията към „Европол” и да отвори киберчадър над мрежите на евроинституциите. Тези дни беше предложена стратегия за осигуряване на по-безопасно съдържание за децата, които използват интернет през мобилни устройства и следователно извън контрола на техните родители. А до края на годината се обещава и дългоочакваната европейска стратегия за киберсигурност. Надеждите са тя да предостави общ подход за решаването на проблемите със сигурността на интернет в Общността. Според комисарs за вътрешната сигурност Сесилия Малмстрьом стратегията ще отговаря на четири въпроса:

как да се гарантира баланс между сигурността и свободата на изразяване
как да се осъществява обмена на критична информация и да се подобри сигурността на мрежите
как да се стимулира частният бизнес, притежаващ и използващ мрежит,е да подобрява тяхната сигурност, да разработва технологии и софтуер, и как да се подобри координацията между частния сектор и властите
как да се поддържат отношения с международните партньори

Защо е важно ЕС да бъде по-адекватен в киберпространството? Хол Лют казва, че по света има два вида държави – тези, които са били хаквани и такива които не знаят, че са били хаквани.

IGP Blog

Accountability under the Affirmation of Commitments

Posted: May 5th, 2012, 3:18am WST by Milton Mueller

ASO to NRO: we need to be reviewed!

NRO to ASO: don’t worry, I’ll do it

NRO to ITEMS: here’s some money, do a review

ITEMS to ASO: We talked to both heads, here’s your report!

ASO and NRO: We are now reviewing your review report! Here are our comments

ITEMS, NRO and ASO: Splendid! Let’s have tea!

CircleID

Public Private Cooperation: The Zeus Take Down Example

Posted: May 5th, 2012, 12:15am WST by Wout de Natris

Microsoft took down a Zeus botnet recently. Within days it was publicly accosted by Fox-IT's director Ronald Prins for obstructing ongoing investigations and having used Fox-IT's data. This was followed by the accusation that Microsoft obstructs criminal proceedings by divulging online aliases of digital, undercover investigators after a served court order into these e-mail addresses and sharing them online.

On top of all this EU Commissioner Cecilia Malmström announced that cooperation between law enforcement and industry will be forged in the European Cyber Crime Centre as of 2013. Coincidences do not exist. Why?

McColo

When I heard about McColo first, the international spam fighting community of the London Action Plan met at eco in Wiesbaden, Germany. It was not during a presentation at the workshop, mind, no, it sort of syphoned through. Not one of the spam fighters present knew anything about it. This amazed me and also made me feel a little ashamed. How was this possible? Pretty soon the botnet was back online and serving the world its daily ration of spam.

Botnets are vulnerable

What McColo did show the world that its possible to stop bots from spewing spam and malware, as with all things it's possible to go for the root and take it down. Even if the owner(s) are sort of invincible for now.

Several bots were taken down since. Some by Microsoft, some by coordinated police actions. And now both sides are fighting it out in the press, fighting each other instead of focussing on the common enemy: the bots/botherders. But hey, there's a lesson here and stop overlooking it: both are successful!

Lessons from OPTA

In my years at OPTA, the Independent Post and Telecommunication Authority, as spam fighter, I specialised in human relations. Why? We soon found out that visiting a company that is somehow involved in sending spam, could also be the subject of other investigations. So we always checked with colleague organisations. At first they didn't really know who we were, but after a while it became standard practice. Even better, it led to a regular informal meeting on cyber crime of most Dutch organisations involved with online enforcement, which I had the honour to chair for several years. At present, I've been told, relations are even much more formal, copying the ISAC model of information sharing. The best lesson learned here, was that openness comes from both sides, not just one. Let's keep this thought in mind.

Lessons from Microsoft and Fox-IT

What seems clear to me is that a company like Microsoft has tremendous resources that outdo most national police organisations'. These investigative resources should not be lost due to a, it seems like, badly coordinated, but unintentional, action. If the clamour shows something, it is that both sides need to be more open to each other and learn to use respective strengths and avoid weaknesses.

It is not without a good reason that in some countries it is possible to go for private actions in court against spammers and worse. This needs investigation, evidence and resources. Microsoft uses this possibility to go after the biggest spammers.

Unfortunately, uncoordinated a civil (class)action can intrude on or even disrupt criminal or administrative investigations of months or even years of preparation. Leading to the loss of evidence, the warning of criminals and even news reports like the ones at the base of this article. Reports damaging reputations at all sides, whether just or not. While both go for the same target. This solution seems sub-optimal to me. But where can the two meet in a trusted space?

The EU Cyber Crime Centre: trust and coordination

If the European Cyber Crime Centre is to act strongly where cooperation is concerned, it is to make sure that actions and investigations are well coordinated. It has to start with building an environment of trust. Also with industry.

If public and private organisations learn to trust each other and from there to coordinate, they can actually choose which way forward would be the most effective. This means that the EU Centre not only has to coordinate with industry, but that it becomes the centre stage of coordination for all investigations on the Internet. Not only for police, but also spam, malware, privacy and fraud investigations. The question laying at the top of prioritising should be: Who in which country is best equipped to gather evidence? That would truly lead to effective actions.

The EU has a chance to reach this level of effectiveness and so has the US. Will they grab it?

If the world learns to use the powers, knowledge and strengths available, Mrs. Malmström's claim "being among friends and colleagues in this room today I'm hopeful we will win this battle" may well come true. It will take effort, courage and will though.
Written by Wout de Natris, Consultant international cooperation cyber crime + trainer spam enforcement
Follow CircleID on Twitter
More under: Cybercrime, Internet Governance, Law, Malware, Policy & Regulation, Privacy, Security, Spam
Donuts and TAS: What We Really Care About

Posted: May 4th, 2012, 9:56am WST by Paul Stahura

Like everyone else applying for new gTLDs, the Donuts team thought it would now be poring over a list of applicant names and strings, nodding heads and at times raising eyebrows.

The timing didn't work out that way. ICANN did the right thing by closing TAS temporarily in order to understand what it was dealing with. It's easy enough for applicants to get rattled by what they think may have happened — but while Donuts obviously cares about the integrity of TAS, we're less concerned about who saw what and more concerned with moving forward.

Saw our file names? Not a huge deal.

It's not critical if someone saw a Donuts file name or user name. Or even if someone saw ALL our file names and user names. (Naturally, if it turned out to be more than that, like actual content… not ok.) It's extremely unlikely applicants would have the time to change the business plans behind their applications to a degree significant enough to impact Donuts' plans.

We saw one file name.

Donuts saw the same non-Donuts file name (for what appeared to be another applicant's attachment) on two separate occasions while examining our own application. We don't know whose file it is, as the file name had no applicant - or string-specific information. We reported this to ICANN on April 11, the day we encountered it.

We confirm that we could not see the content of the attachment (i.e., the TAS behavior we saw was exactly as ICANN has described it). If ICANN so requests, we are prepared to certify to ICANN that we will not act on what we saw, harmless as it was. We also point out, however, that file name information has no value to us, even if it contained a TLD string. Why? Because Donuts was meticulous in its own string selection — adopting another string at this late date would deviate us from our own plans. Its impracticable to change horses that quickly even if knowledge of some other string were greatly beneficial to us.

Program changes mid-stream would be very disruptive.

Falling into the trap of using this delay to consider Guidebook changes now would be disruptive to everyone — not merely applicants. It's far better to maintain predictability and stability so everyone can correctly plan.

This includes two critical areas: new applications in the re-opening, and Batching/ Digital Archery.

Allowing new application creation when the window reopens = bad idea.

While Donuts does not think file name or user name data is fully actionable by existing applicants, an applicant sharing news about what it did see could invite new applicants. This would obviously be unfair to existing applicants.

When TAS closed there were (i) just 12 hours to go in the process; and (ii) the March 29 $5,000 slot payment deadline had passed. To minimize any exacerbating shenanigans due to this accidental disclosure, ICANN should clearly confirm that no new applications will be allowed. To support this ICANN should also publish the maximum number of possible existing applications as soon as possible (as they have known this information since March 29).

Donuts opinion on Batching and Digital Archery

Digital Archery is a skill test. Creative as it is, and though it will require some up-front learning and testing, it's better than other alternatives. Donuts supports Digital Archery as it is currently described. Attempts to change Digital Archery or any other aspect of batching at this very late stage would create more harm than benefit.

Time is the more critical metric now.

Though we believe file name and user names aren't particularly actionable by current applicants, given the timelines, there IS an issue that risk could be magnified by the passage of time. Any benefit from the information that may have been derived becomes useless once the application window closes.

The better option is to close the window as soon as possible. This minimizes exposure to inappropriate activity and moves the process ahead. Also, all applicants are paying for the current delay with the ramped-up costs of operating their businesses.

Time is a critical element for ICANN as well.

We don't agree that ICANN's reputation has been especially damaged by the TAS situation. Staff took prudent steps to deal with a technical issue, which we all know arise from time to time.

However, open-ended or extensive delays do cause real harm to ICANN's reputation. Donuts is confident in ICANN, but overanalysis and delay degrade confidence in the organization, especially when, at this point, further delay results in only a little reduction in legal liability to ICANN, at best.

ICANN: stand by your commitment to the community. Disclose whatever results of the forensics you've gathered by this Tuesday, May 8. Delay no further. Open and close the five-day window, confirm no new application creations, and conduct the reveal as soon as possible.

Paul Stahura is CEO and co-founder of Donuts Inc., a gTLD applicant.
Written by Paul Stahura, Founder and CEO Donuts Inc
Follow CircleID on Twitter
More under: ICANN, Top-Level Domains
Brand Owners Hold Their Breath With New gTLD  "Reveal Day" Delay

Posted: May 4th, 2012, 4:02am WST by Steve Stolfi

It has been quite a rollercoaster the past couple of weeks with the new gTLD application period ending on April 12th coupled with the suspension of the TLD Application System (TAS) due to a technical glitch. With over 1,200 applicants for new gTLDs confirmed by ICANN in the system, and the possibility of thousands of new gTLD applications to be published on "reveal day" brand owners have been holding their breath on the status of their applications. With the TAS application system still down as of the writing of this article, ICANN has announced that all applicants will be notified by May 5th if their application was affected by the TAS technical glitch. Shortly after the notification process has been completed, ICANN will announce the reopening of TAS and the schedule for the application completion period. This development has raised concerns over the stability of the application system.

The delay has also impacted brand owner's strategy to publically announce their application for a new gTLD. Uncertainty around trademark clearinghouse costs has also made it difficult for brand owners to project the overall costs of the new gTLDS when preparing budgets for 2013 and beyond.

In addition to predicting costs associated with a new gTLD, brand owners are concerned about the stages an application must pass before a final gTLD determination is rendered by ICANN. The stages are Administrative Check, Initial Evaluation, Extended Evaluation, String Contention, Dispute Resolution and Pre-delegation. If no objections or string contentions are filed, a successful application could take as little as 9 months: administrative check (lasting 2 months), initial evaluation (lasting 5 months) followed by pre-delegation (lasting approximately 2 months). If objections are filed, the application process could take as long as one year. Formal objections using pre-established Dispute Resolution Procedures (DRP) may be filed on the grounds of string confusion, legal rights, community and limited public interest. The DRP is in place so that all stakeholders who have an objection to a new gTLD will have several avenues to pursue.

The trademark clearinghouse will also be put in place to protect brands. While the new gTLD trademark clearinghouse is being created to protect brand owners with large trademark portfolios there still has been no announcements on what the costs will be. With so much uncertainty brand owners can only speculate when "reveal" day will be rescheduled, when new gTLDs will go live and when they will be able to protect their valued brands in the trademark clearinghouse. With the INTA annual conference scheduled for next week in Washington D.C., the current state of the new gTLDs and all of the unknowns will be a central discussion point among attendees.
Written by Steve Stolfi, VP of Global Partnerships at CT Corsearch
Follow CircleID on Twitter
More under: ICANN, Top-Level Domains
Are Banks Finally Taking E-Payments Seriously?

Posted: May 4th, 2012, 12:39am WST by Paul Budde

For the first time ever bankers have launched an EFTPOS advertising campaign.

Could this be an indication that they are becoming worried about the competition they are getting from internet companies such as PayPal, Amazon, Google and Apple (iTunes)? The digital economy is growing much faster than the bricks-and-mortar economy and, while EFTPOS is not going away anytime soon, an increasingly large amount of money is now bypassing their systems. At the same time traditional players in this market such as MasterCard and Visa have far more advanced online payments in place than the banks with their EFTPOS system.

Along with the music industry, the retail industry, newspaper publishers, broadcasters and telcos, banks have concentrated on rear-mirror fights, looking backwards in order to try protecting their traditional business rather than embracing the future. This made it possible for others to step into that space and, while it took many years for these new companies to break into the traditional monopolies/oligopolies, in the end the newcomers began to hurt them — and they are now even demolishing whole sections of the established market.

The reason for the banks' procrastination is, of course, that open networks mean more competition and therefore lower margins. By not moving more quickly into these new e-markets and accepting the inevitable changes that the new environment brings with it many of these sectors are suffering a great deal of pain, and have now created such a gap between the leaders in this emerging market and the traditional players is which is increasing rather than decreasing.

As regards banking, consumer-based international money transfers are now largely bypassing the traditional banking system, which charges $25 for a money transfer for transactions often not much larger than the fee. Even within Australia EFTPOS transactions in remote parts of the country could cost $5 or $10.

No wonder customers are seeking alternatives; and while the alternatives are still small in size they are growing exponentially. In some developing countries we see that consumer m-payments are larger than traditional bank payments. Increasingly mobile phones are being used to bypass the banking system and innovative apps are being developed that allow others to process transactions and make payments without using the traditional banking system.

Banks have never taken a leadership role in internet/mobile-based payment systems. They see these developments as a threat to their operations — very much like the reaction of other sectors that used to enjoy a dominant or monopolistic position in the market. Using the latest technologies, services can now often be provided much more easily by others (competitors) and the banks are now becoming concerned about this.

Remember the first e-cash systems were being tested by the banks in the 1980s. The testing is still going on and hundreds of pilots and projects later they have not developed a good alternative. PayPal was the one that stepped in. iTunes now has something like 250 million customers — more than most, if not all, of the banks. Amazon is another global financial giant.

And so the competition is not coming from other banks — they are all involved in the battles aimed at protecting the past. Competition is coming from outside.

Imagine the potential power of a Google, Facebook or Apple moving more deeply into transactions and e-cash innovations!
Written by Paul Budde, Managing Director of Paul Budde Communication
Follow CircleID on Twitter
More under: Mobile, Web
Spam from Mobile Networks? Who Woulda Thought…

Posted: May 3rd, 2012, 4:55am WST by Bruce Van Nice

Mobile networks aren't usually thought of as sources of spam, but a quick look at some of the resources that track spam reveals they actually are. This is counter intuitive at first glance because when most people think of mobile they think of smartphones, and those aren't known to be sources of spam (at least not yet). What's really going on is PCs connected to mobile networks with air cards, or tethered with a smartphone where it's permissible, are the culprits. Bot infected PCs aren't at all uncommon, and of course bots don't especially care if they're using a costly mobile data service to send their spam.

This problem is serious enough that some mobile networks regularly hit blocklists. These operators have a few issues. First off, their customers may discover their mail service doesn't work reliably when organizations using the blocklist refuse all mail from the infected network. Second, and more important, spam is useless and the wireless spectrum and bandwidth it consumes has to be considered wasted. Mobile operators might be tempted to think the bandwidth isn't really wasted, because their subscribers are paying for it as part of their data plan. But there is an obvious customer satisfaction issue with this argument — it's always contentious when a subscriber exceeds the limit on their data plan and has to pay a significant premium for additional bandwidth. And it's important to remember most end users are completely unaware their machine(s) are infected so they have no idea bandwidth they are paying for is even being used.

Mobile operators have rightfully prided themselves on the security of their networks. But the presence of infected PCs and other devices connected to mobile networks, and openness of current-generation smartphones introduce new exposures to spam and other exploits that pervade fixed broadband networks. There's a great opportunity to change this dynamic and turn a negative into a positive. There are now simple ways to manage bots and the problems they create — sending spam, stealing personal information and more. The DNS can easily be employed to disrupt communication channels between infected PCs and the control systems bots rely on to send their instructions — effectively preventing spam from being sent. MX queries from infected hosts can also be blocked to prevent spam from being sent; or redirected to special mail gateways where the messages can be handled according to operator policies. These techniques don't introduce any latency, overhead or new equipment in the network.

This solution is a win-win for network operators and their customers. Precious mobile resources aren't wasted and customers aren't unknowingly paying to send useless spam. Because the solution is based in the network end users don't have to manage anything — another big plus given the increasing frustration end users have about administering their own security.

Recently the FCC and some of the largest US service providers agreed to a voluntary code of conduct to minimize cyber threats. Join Nominum's webinar on May 10 as guest presenter, Peter Coroneos, the former CEO of the Internet Association of Australia will talk about his experience and best practices in implementing a similar code in Australia.
Written by Bruce Van Nice, Director of Product Marketing at Nominum
Follow CircleID on Twitter
More under: Access Providers, DNS, Malware, Mobile, Security, Spam
UK ISPs Ordered to Block Pirate Bay

Posted: May 3rd, 2012, 4:35am WST by CircleID Reporter

Britain's High Court — not the highest, but well up the ladder — has officially ordered Internet service providers to block Sweden-based file-sharing site The Pirate Bay. That means top British ISPs must shut off access to the site as soon as possible. ISPs Everything Everywhere, O2, Sky, TalkTalk and Virgin Media have said they will, while a sixth, BT, has asked for a few weeks to mull over whether it will comply or not. The Pirate Bay hosts "torrent" files that let users connect with each other to download or share information — in principle, a legitimate activity.
Read full story: Time
Follow CircleID on Twitter
More under: Access Providers, Censorship, Internet Governance, Policy & Regulation
ICANN Board Meetings Should be Webcast Live

Posted: May 2nd, 2012, 8:11am WST by Philip S Corwin

ICANN has just announced that, starting with the June meeting in Prague, the ICANN Board will no longer meet and cast votes on the final day of its three annual public meetings. We think this is an ill-advised step backwards from ICANN's commitment to transparency and the accountability that accompanies it. We also believe that ICANN should have told "the community" it was considering this major change and asked for public comment before making such a decision.

Just because all the ICANN meetings we have attended since ICA's formation ended with a Board meeting doesn't mean that particular scheduling is sacrosanct. But we think it's very beneficial for the global Internet community that ICANN serves to be able to view its decision-making process — and that it's a big plus for ICANN's credibility and reputation to open that process to public view. Those of us who regularly attend ICANN meetings have some opportunity to mingle and converse with Board members. But that's quite different than being able to observe their group interaction, especially when there's a tough vote on a controversial issue. Last year, it was beneficial for all that the Board debate and vote on .XXX in San Francisco, and on launching the new gTLD program in Singapore, were done in the light of day and before a live audience. As Board members stated their positions on the vote before them they knew their arguments were being weighed not just by fellow Board members but by the public at large. The sharp open exchanges enhanced the legitimacy of the resulting vote.

We also think this decision is particularly ill-timed, given that ICANN has just embarked upon the most ambitious and risk-prone program in its history — the near-simultaneous launch of thousands of new gTLDs. Given that even the application period has been marred by the TAS shutdown, any Board action taken to deal with that glitch or any additional new gTLD problems or issues should be discussed in full public view.

ICANN's stated rationale for the decision to go opaque is "We believe that the removal of the Friday public Board meeting and its replacement with two Board community sessions will improve the effectiveness of both the Board and the staff and increase the time that the Board has to interact with the community." We enjoy our interaction with the Board, but we don't see how voting in private increases the Board's effectiveness — and it certainly runs counter to ICANN's stated commitment to transparency.

Nowadays any public policy body that makes its decisions behind closed doors is going to be perceived as having something to hide. Here's a thought experiment: Controversial as they were, imagine if the Board votes on .XXX and new gTLDs had been made out of public view and announced after the fact. Would ICANN have been more or less effective today as a result?

In reacting to this news release it struck us that, just as we've taken it for granted that every ICANN meeting ends with an open Board session, we've also accepted that the majority of Board meetings take place in private and are underreported. Indeed, the only Board meetings for which transcripts are ever released are those that have already taken place in public. All the rest are reported, tardily, only by dry minutes that convey very little of what actually took place (see: ICANN Board Meetings). This is in stark contrast to every ICANN constituency and working group, which release mp3 audio recordings within hours after each meeting — so why should the transparency that permeates ICANN stop at the Boardroom door? In 2012, in the age of Web 2.0, this does not strike us as acceptable — especially for the technical coordinator of the DNS charged with serving the global public interest.

There's a lot of U.S. DNA in the DNS. ICANN was created by the U.S. government and is a California non-profit corporation. Even though the U.S. has officially terminated direct oversight, the technical foundation for ICANN's DNS policy decisions is the IANA contract currently being re-considered by the U. S. Department of Commerce. Sessions of the U.S. House and Senate, and virtually every hearing and markup of every Congressional committee, are now Webcast in real time and then archived for future viewing.

ICANN should do no less. Every official ICANN Board meeting should be webcast in real time. When the Board is meeting telephonically then the Web audiocast should be available simultaneously. And all should be archived for future access and review. Only limited redactions should be made, such as when the Board is discussing internal personnel matters or when the proprietary and confidential information of a contracted party might be revealed, and then only if a rationale is provided. ICANN's continued authority ultimately rests upon the consent of the networked, and in 2012 the networked expect open access to information about vital decisions with broad repercussions. And, as Supreme Court Justice Louis Brandeis once observed, sunlight is the best disinfectant.

We still think that ICANN should reconsider its decision to end open physical Board meetings. But, regardless of whether it reverses course, all future Board meetings should be open virtually.

It's past time for the public body that manages the global DNS to start using the tools of Web 2.0 to achieve complete transparency of process and decision-making. The global Internet community that ICANN serves should expect nothing less.

Mr. Corwin serves as Counsel to the Internet Commerce Association. This article was origionally posted on its website.
Written by Philip S Corwin, Founding Principal, Virtualaw LLC; Counsel, Internet Commerce Association
Follow CircleID on Twitter
More under: ICANN, Internet Governance, Top-Level Domains
Update on IPv6 Address Distribution in the RIPE NCC Service Region

Posted: May 1st, 2012, 11:50pm WST by Mirjam Kuehne

At the recent RIPE Meeting we presented some IPv6 address distribution statistics that we would like to share with a wider audience. In the article below, you can find recent statistics on IPv6 allocations and assignments.

The first image shows the number of IPv6 allocations the RIPE NCC made to LIRs in each quarter, starting in 2008. (Note that the RIPE NCC started allocating IPv6 address space from 1999. For a long-term overview of IPv6 allocations, please see the earlier article on CircleID: A Look at IPv6 Allocations Since 1999.) Each year is depicted in a different colour, the last one showing the number of allocations made in Q3 2012. The Y-axis shows the number of IPv6 allocations form 0 to 500.
Figure 1: Number of IPv6 allocations made by the RIPE NCC per quarter
We saw quite an increase in the number of IPv6 allocations in the last quarter of 2010 and the first two quarters of 2011. IANA handed out its last IPv4 address blocks to the Regional Internet Registries (RIRs) in February 2011 and this seemed to have encouraged many LIRs to request IPv6 address space. After Q2 2011, the number of allocations decreased again, but it is still higher than it was before Q4 2010.

In the next image, you can see the number of IPv6 provider independent (PI) assignments the RIPE NCC made since 2009 (when the RIPE NCC started to assign IPv6 PI addresses). Again, each year is depicted in a different colour, the last one showing the number of allocations made in Q3 2012. The Y-axis shows the number of IPv6 assignments form 0 to 140.
Figure 2: Number of IPv6 PI assignments made by the RIPE NCC per quarter
You can see the same peak as in Figure 1, but after a small drop in Q3 2011, the numbers are now increasing again.

For more information, please refer to the background article on RIPE Labs: Update on IPv6 Address Distribution. This article details what affect the removal of the requirement to be multihomed had on the number of assignments and the relationship between the age of an LIR and the number of IPv6 addresses they have received.
Written by Mirjam Kuehne
Follow CircleID on Twitter
More under: IPv6, Regional Registries
7 Reasons Why R&E Networks and Universities Are Critical to Future of Broadband

Posted: May 1st, 2012, 4:28am WST by Bill St. Arnaud

There has been considerable discussion about the future of broadband in terms of infrastructure i.e. fiber, wireless, community owned etc. However, there has been little discussion, to borrow a phrase from Internet 2, on Net+ broadband services. It is in the Net+ services where I think R&E networks can play a critical in helping communities and small commercial ISPs deploy advanced services and applications that will provide new business models to underwrite the costs of next generation broadband.

The next generation broadband I believe will look like architecture of existing R&E networks, rather than the monolithic walled gardens of the telcos/cablecos. Partnering in next generation broadband is also in line with the core missions of R&E networks, schools, libraries and universities in terms of the future of data intensive researcher from thousands of distributed sensors and delivering research and education to any device, any time, anyplace. The fundamental factor driving a new vision of next generation broadband is the fact that Net+ services, such as clouds and content distribution, are localizing traffic (i.e over 90% of Internet traffic will appear to be locally sourced — even though actual sites they may be accessing are 1000s kms away). I believe widespread application of Net+ services will also create a whole new innovation and economic eco-system much in the same way R&E networks enabled the original Internet. See my paper on "Personal Perspective on Future of R&E networks”. A great example of this thinking is the recent announcement of ESPN (the major US sports network) to partner with Internet 2. See also how clouds and Net+ services are enabling an entire new innovation ecosystem and thousands of new startups.

The 7 important areas where R&E networks can play an important role in advancing and support community broadband are as follows:

1. Encouraging universities, colleges, schools and libraries to be anchor institutions in a distributed broadband network architecture. This does NOT mean that R&E networks will provide basic Internet to homes or commercial enterprises, but these anchor institutions and R&E networks can host a number of Net+ services to interconnect to service providers, critical to the community such as distributed content caching, integrated 4G/Wifi nodes and local peering. This will also allow these institutions to deliver their services to the community via any device, anyplace, any time. See: New OTI Whitepaper, "Universities and R&E networks as Hubs for Next-Generation Networks”.

2. Developing Open Content Distribution Networks to integrate Net+ cloud and content services into one seamless service offering. See: "Why R&E Networks Should Be Aware of the CDN Interconnect Initiative (CDNI)”. See also: Google and Akamai developing new caching technology and protocols to speed up Internet over 3G/4G networks.

3. Building enterprise centric integrated WifI/4G networks, versus telco/cableco attempt to make public Wifi become part of walled garden cell phone network. See: Wi-Fi offloading: Who controls your handset? and JANET, AARnet and SURFnet initiatives.

4. Building community IXPs or TXPs, local peering and open collaborative exchanges (OXPs). See: a great presentation at RIPE 64 on the demand for local IXPs being driven by higher access speeds. Also a new SURFnet concept of building open collaborative exchanges using SURFconext to provide seamless access to a variety of content and cloud services.

5. Extending Software Defined Networks to the last mile. See: How Software Defined Networks can solve consumers' broadband woes. Also note: Reverse Passive Optical Networks (RPON).

6. Deploying zero carbon Green IT networks. There are many companies that are building Wifi/4G technology that is entirely solar or wind powered. See: Green Wifi. Community anchor institutions should not incur additional energy costs in delivering services to the community.

7. Developing Net+ middleware and applications. For example see: Research IT as a Service.
Written by Bill St. Arnaud , Green IT Networking Consultant
Follow CircleID on Twitter
More under: Access Providers, Broadband, Cloud Computing, Wireless
The Dangers of Asking for Social Network Passwords

Posted: May 1st, 2012, 2:58am WST by Steven Bellovin

In the last year or so, there's been a lot of controversy about some employers demanding social network passwords from employees or applicants. There's even been a bill introduced in Congress to bar the practice. The focus has been the privacy violation implied by such demands: "the legislation could .. protect the privacy of citizens”; "the bill is a win for businesses, schools, and privacy”; etc. Even the author, Rep. Eliot Engel (D-NY), said "this is a matter of personal privacy”. All that is true, but they understate the problem; it's far worse than that, for a number of reasons.

The first issue is that a password gives the holder write access, not just read access, to the account. An employer may perceive some reason for wanting to see what's on someone's Facebook page; however, the password lets them change privacy settings, create new content, etc. This is particularly serious in adversarial settings like divorce cases, where one party may be trying to impeach the other's credibility and suitability as a parent. The judge in the that case did

try to limit the privacy invasiveness of his order by telling theparties not to prank each other.

"Neither party shall visit the website of the other's social network and post messages purporting to be the other," he included in the order.

I'm glad that Judge Shluger realized that aspect, but as I explain below, there are other ills.

The second issue is that people reuse passwords. Yes, the standard advice is to avoid doing so; most people don't follow that advice because they can't remember ℵ0 different passwords for their ℵ0 different web logins. This means that a social network password is often an email password, a bank account password, a work password, and more. Knowing someone's Facebook password probably gives you access to many other sites.

Even if passwords aren't directly reused, there's another problem: logins for social network sites are often used as credentials for other sites. Google is an official provider for NSTIC, the National Strategy for Trusted Identities in Cyberspace. Facebook is pushing its Facebook Connect service. Microsoft Live accounts can be used for access to some medical records. In other words, if you're logged in to one of these sites, you automatically have the credentials to reach many other sites, including some with very sensitive information. Facebook puts it this way:

Facebook helps you simplify and enhance user registration and sign-in by using Facebook as your login system. Users no longer need to fill in yet another registration form or remember another username and password to use your site. As long as the user is signed into Facebook, they are automatically signed into your site as well. Using Facebook for login provides you with all the information you need to create a social, personalized experience from the moment the user visits your site in their browser.

There are privacy issues there, too (Facebook knows everywhere else you visit), but there's a serious security problem if a Facebook password is ever disclosed to someone else: that person can also be "automatically signed into [the] site as well."

This is the crux of my concern: knowledge of a social network password lets you in to many other accounts, both directly and indirectly. I strongly suspect that few employers with such policies — more precisely, few of the executives who promulgated the policies at these companies — realize the danger. I also suspect that their attorneys do not realize the technical risks, either. However, it seems very likely that there are some people charged with executing the policies (especially folks in the IT department) who do understand it. There is thus a tremendous liability risk, one that few companies would willingly undertake: that corporate policies have exposed people to serious risks. Is this a chance worth taking?
Written by Steven Bellovin, Professor of Computer Science at Columbia University
Follow CircleID on Twitter
More under: Privacy, Security
Spam Levels Still Lower a Year After Rustock

Posted: April 30th, 2012, 12:34pm WST by Terry Zink
Arstechnica wrote an article recently entitled Spam levels still low a year after Rustock botnet takedown. From the article:

In March 2011, a Microsoft-led team targeted and decapitated the Rustock botnet, and a dramatic decrease in spam traffic was noticed almost immediately. It turns out that a full year later, spammers have not been able to fill the gaping hole left by Rustock's absence.

Just before the Rustock takedown, "spam levels were around the 150 billion mark daily," security vendor Commtouch said in a new analysis. "Spam levels dropped immediately after that takedown and have continued to decrease ever since. In the first quarter of 2012, an average of 94 billion spam emails were sent per day… There is no sign of a return to pre-Rustock spam levels."

Rustock was responsible for sending 30 billion spam e-mails a day, and thus its takedown alone can't account for the entire drop in spam volume. Commtouch said the sustained improvement was a combination of multiple botnet takedowns, as well as "increased prosecution of spammers and the source industries such as fake pharmaceuticals and replicas."

The article is more detailed that numerous things have contributed to the decline in spam since then. However, the article misrepresents Rustock's effect on the spam levels. It's completely true that Rustock was the largest botnet and sent the most spam (by total individual spam connections). However, spam was falling even before that:

You can see starting in May 2010, spam hit a peak and has been declining ever since. Taking out Rustock no doubt accelerated that but that alone was not responsible for the decline in spam.

Commtouch's report warns that abuse is still with us: botnets are growing and spammers are finding new ways to infect computers. The problem has not gone away.

So what's going on?
- Email spam is definitely on the decline. However, the spam has morphed from bucket loads of generic (no pun intended) spam to more targeted attacks. We still see things like pharmaceuticals, fake degrees, and the like, but not as much.
- Malicious, targeted spam is on the rise. Because of the very successes at taking down botnets and disrupting spammers, spammers have gotten smaller in order to avoid detection. They're tired of attracting the attention of anti-spammers who have gotten their act together. They've also started making more targeted spam campaigns that are designed to infect users' computers rather than try to sell them something. The result is spam that is more difficult to detect and more difficult to catch.
- Snowshoe spammers are filling the gap. Snowshoe spam is spam that looks quasi-legitimate, kind of like a newsletter, but is spam because of the techniques that the senders are using to evade detection. They sell free iPads, iPods, TV tuner cards, secret shoppers, and other useless things. These spammers send mail in fewer numbers but it's just as annoying.
- Other avenues are more popular. When email was new and popular and the main way to communicate (1996 – 2009), spammers targeted it. Now, more and more people are using mobile phones and social networks to communicate. Spammers have followed them. They are still interested in selling fake pharmaceuticals to end users, but now they are creating fake accounts on Facebook, Pinterest and Twitter instead of sending spam over SMTP. Spammers are only reacting to societal trends.
That is what accounts for the decline in spam since the Rustock takedown, and it's corresponding lack of re-emergence since then.
Written by Terry Zink, Program Manager
Follow CircleID on Twitter
More under: Spam
Who is Keeping TAS Down?

Posted: April 28th, 2012, 3:14am WST by Stéphane Van Gelder

Today, Friday April 27, ICANN had promised an update on the problems that led to its TLD Registration System (TAS) being taken offline on April 12.

As the working day ends in Europe, that update has yet to come. Even if it does, I would not expect anything more concrete than the "we are still working on the issue, thanks for your patience" message of recent days.

So what's really going on here? Does anyone at ICANN seriously expect us to believe that the tech team is "still reviewing the TAS data and checking the integrity of each and every application"?

TAS is a purpose-built system designed to allow users to input data in simple text format. It doesn't really do much more. It's not rocket science. It's far simpler than the systems that control, say, air traffic in the US. Yet if those systems went offline (and I understand there are frequent problems with what is basically an ad-hoc mix of antiques), you can bet it wouldn't take much more than a few hours to get them back up. No-one would expect the US to grind to a halt for a month because its air traffic computer experts are taking their time "carefully reviewing all the data"…

So who can we blame? The obvious candidate is ICANN CEO Rod Beckstrom. But can this really be his doing? Although he is no doubt bitter about the Board not renewing his employment contract beyond July, I just do not see him scuppering the ship this badly.

True, some of his recent comments have felt a little too anti-ICANN to me. His speech at the Costa Rica meeting opening ceremony against industry knowledge on the Board for example. And if anything, the TAS glitch only serves to highlight the need for a balanced Board, with both non-industry and industry experts.

I mean, who isn't thankful that we have Steve Crocker as ICANN Chair at the moment? Having one of the creators of the Internet at the helm is reassuring at the best of times. Right now, it feels like a godsend. And the Board Vice Chair Bruce Tonkin, a domain industry insider, has proven invaluable over the years as an anchor for a Board that didn't always have the full facts on domain name practices.

Right now, because of this problem, I actually wish we had more industry insiders and computer experts on the Board to act as counterweights to an existing ICANN management that is clearly letting this problem go on too long. And making it harder and harder for anyone to believe the official ICANN line on TAS.

If something else really is happening here, then the real question we should all be asking ourselves is not "when will TAS go back up?", but "who is keeping TAS down?"

That is a question I'd like to ask Beckstrom. He's been unusually quiet since the start of this debacle, but I just cannot see how he can avoid speaking publicly on this for much longer. Until he does, all we have is conjecture. The US government, Doctor Evil, extremely well organised lobbyists, little green men...? At this point, I think I'd actually prefer it to be the Martians' fault. Because if TAS really is being held up this long to do some data checking, then I fear ICANN may never be taken seriously again.
Written by Stéphane Van Gelder, General manager of INDOM
Follow CircleID on Twitter
More under: ICANN, Internet Governance, Top-Level Domains

internet :: ecosystem

Gender equality and Internet governance

Posted: April 27th, 2012, 9:41am WST by sgdickinson

The recent publication of the 2012 Internet Governance Forum (IGF) Multistakeholder Advisory Group (MAG) initially got me cranky to see that the RIRs are represented on the MAG by three middle-aged white men. Yes, one of those middle-aged white men is based in Dubai, and was born in the Middle East, and so speaks Arabic. Yes, another of those middle-aged white men is from South America and speaks

CircleID

Open Systems Lead to 'Economies of Scope'

Posted: April 27th, 2012, 3:23am WST by Paul Budde

The 'economies of scope' is an appealing concept implying that if we share knowledge in an open way we can create new, healthy economies that do not just depend on 'scale'.

As we have seen, over the last decade in particular, some of the companies that are trying to achieve exponential growth can endanger the economy and society in general — the global financial crisis surrounding the large financial institutions, the scandals around News Corp, the political lobbying (bullying) by the super rich and the destruction of the environment by some developers. And there are plenty more examples also in the telecoms industries, as well as looming problems associated with building scale by the large new internet media companies in relation to privacy and security.

By creating flatter, more cooperative and transparent peer-to-peer systems we can significantly increase the level of innovation, and we will be able to maintain healthy economies and societies without the negative effect of the exponential growth needed for economies of scale. Populations or systems growing progressively by higher amounts is an illustration of the problem of exponential growth.

On the other hand, sharing models are far more sustainable for the future. In situations where resources are becoming scarce and economies of scale are reaching their limit, we need to change tactics and be more innovative within the existing resources; and that is where the advantages of the concept of economies of scope kicks in.

It is also interesting to consider what happens in times of exponential growth — and the last 50 years has surely been such a period. When do you notice that exponential growth is leading to sustainability problems? Not at the start, when the effects of exponential growth are relatively small — but later, when a doubling of growth suddenly makes an enormous impact. When I was born there were 2.5 billion people in the world. Now there are 7 billion. And if I were to reach 100 years of age there could be 9 billion.

The impact of the type of growth that has occurred in the last half century is only now starting to kick in and we are noticing the negative effects of this in many aspects of our societies and economies. So we obviously need to change the ways in which we manage our affairs. It is beginning to become clear that planet earth is not necessarily infinite.

I have been a long-term advocate of what is called the trans-sector approach. Led from the top, by political and business leaders, silos need to be demolished to create flatter structures where people can much easier share information in a horizontal way — and thus build scope — and try to find solutions and new opportunities through collaboration between sectors.

Within ICT infrastructure datacentres, broadband, cloud computing and social media are all elements of such a new structure. Key, of course, is an open flow of information between the people involved. Rather than monopolising innovations, ideas, thoughts, etc, we should open them up and allow others to participate in their development. This will produce results far more quickly than when developments are monopolised, or when penalties are attached to collaboration and sharing (intellectual property rights). We do recognise such rights but better structures need to de be developed to ensure that such rights don't stop innovation and sustainable developments.

Developments in the pharmaceutical industry, for instance, clearly show the limitations of the patent monopolies that exist today. This is now hampering the growth of the industry, since far more niche products and far quicker innovations are needed to cope with the wellbeing of 7 billion people.

On the other hand, we have seen the outer-galaxy research from NASA, based on shared citizen e- science. Over two million people became involved in this project — staring at the universe from their computers — and this enormously increased the capacity of research within this organisation. Universities, R&D;companies and a large number of NGOs have developed their own peer-to-peer projects with great success — in data capacity, sharing and analysing; medical research; education; agricultural developments and so on. These projects are also of great importance to the developing countries — India in particular, but China, Brazil, Kenya and others are also heavily involved in collaborative projects.

In the developing world there is already more of a sharing culture, which makes these peer-to-peer networks a natural way of making progress within these societies.

BuddeComm (my company) also uses these peer-to-peer knowledge-sharing concepts in some of the work in which we are involved. The Digital Economy Work Group that we set up to develop the trans-sector concept with the NBN in Australia, Smart Grid Australia — bringing together the energy ecosystem, and the reports that we wrote for the Obama Government and the United Nations were all based on this concept.

In all of these situations it is obvious that no individual — no matter how knowledgeable he or she is — will be able to address some of the complex issues that our societies are facing. However, together, we can address these issues — what one person does not know, somebody else in that peer-to-peer community will.

Another interesting development in this context is that of 'OpenFlow'. This open source system allows for the development of software-defined networks. It creates virtual networks that are ideal for collaboration and at the same time it considerably reduces the cost of infrastructure. Google recently re-engineered its network based on 'OpenFlow'. The company actively canvasses others to participate in 'OpenFlow' as it recognises that it can benefit from such collaboration.

Facebook is another company that abandoned the traditional proprietary-based approach and embraced open source structures — having figured out that by opening up its network and encouraging the industry to actively participate in this process it can far more easily tap into new developments. Interestingly, a large number of the equipment modules needed in these open networks are produced in China — on a cheap utility basis — bypassing the traditional proprietary vendors — who, by the way, are also looking at these new opportunities.

There is no doubt that the future development of our societies and economies will have to be based on models framed around the economies of scope.

At the same time the policies and governance needed on national and international levels need to be changed as well. As becomes clear from the political upheaval around the globe, the old way of organising societies around political (politicised) groups no longer works — nor does populist opposition. Voters are becoming disengaged.. It will be essential for politicians to open up their systems and structures and get the people, rather than the parties, involved in the decision-making processes.

While national politics might still be carried out within an oppositional framework, the rest of society understands that collaboration is needed to move ahead. Simple populist solutions based on the premise that 'they are wrong and only we are right' are not going to solve the complexities of modern societies and modern economies.
Written by Paul Budde, Managing Director of Paul Budde Communication
Follow CircleID on Twitter
More under: Broadband, Internet Governance, Law, Policy & Regulation, Web
Leveraging DNS for Subscriber Loyalty

Posted: April 27th, 2012, 1:08am WST by Keith Oborn

There has been a lot of talk about how the DNS can provide network-based security, and how DNS is in the best position to detect malware traffic before it does any harm. But what does this mean for end users? How does it make their online lives easier and more secure?

DNS servers that are aware of sites that host malware, perform phishing activities (harvesting bank details, for instance) and other nefarious misbehaviors, can prevent end users from ever going to those sites. Remember, most of the time end users don't deliberately visit dubious sites; they do so accidentally. Either because they mistyped the name of a site or they clicked on a malicious link on a web page. In all these cases, an intelligent DNS server can simply redirect end users to pages that inform them that the site they tried to visit is potentially harmful.

Why is this better than using one of the traditional security software packages? Well, first off, end users didn't have to download and install anything. They don't have to worry about keeping the software and site lists up to date, and there's nothing slowing their PCs down. Even better, in most cases all the devices in a home use the same "Security Aware" DNS server, so they're all protected — even the games console in the teenager's bedroom. Traditional security software packages don't reach many of these things.

However, there are other ways malware can creep into the home — a laptop gets infected while on the road, someone is a bit incautious with a USB stick, and so on.

The purpose of malware is either to intercept data and observe the activities on PCs where it's installed, or to use a PC's resources to spread and provide a "botnet" for attacks on other parties on the Internet. In all cases, malware needs to communicate with a central point at some stage (called "command and control") to upload captured data, spread itself, or get instructions for the next attack. It uses the DNS to do this, so the DNS server will know where it intends to go before it actually goes there!

This means DNS servers can do several things to help: for known malware, they can block access to botnet command and control systems, thereby preventing the malware from doing any work. If the malware spreads itself by email (or if its job in life is to generate spam), the DNS server can detect the high rate of DNS "MX" (mail) queries, and in many cases recognize a pattern, and even prevent emails from being sent.

When a PC is discovered to be infected with malware, the DNS server can redirect all queries from the infected PC, to a warning web page with sources to disinfection software and other services.

DNS servers with fine-grained reporting capabilities can even be used to create web-based reports showing end users, for instance, the "bad" sites they've been protected from. These kinds of systems can be extended to allow individual users to add their own entries to the lists of "bad" sites, basically giving them their own personalized security service — the DNS server responds to their queries (and only his) according to their security lists and preferences.

All of this means ISPs can improve the user's experience, customer relations, potentially generate extra revenue and reduce churn. With a platform-based approach, it can be done incrementally aligned with other business initiatives.
Written by Keith Oborn, Sr. Infrastructure Architect at Nominum
Follow CircleID on Twitter
More under: Access Providers, DNS, Email, Malware, Security
UN Moves on Internet Governance: Latest Dispatch

Posted: April 27th, 2012, 12:42am WST by Gregory Francis

Some unsettling plans declared themselves at the International Telecommunication Union (ITU) this week as countries prepared for the up-coming treaty-making jamboree called the World Conference on International Telecommunications (WCIT). This community will now have to decide what it does about them.

Re-Writing Yesterday

It was significant to the CircleID community that the ITU's top dog — the Secretary General — appeared in person before the assembled countries with a reassurance: the broad and unusual WCIT treaty negotiation, though it may treat many issues, would not take up Internet governance. This was a welcome thought that one European delegation wanted to capture: could the Sec Gen's comments, they asked, be referenced in the document being prepared for the treaty conference?

What followed, in that opaque way in which UN bodies deal with issues of substance, was a debate on whether the WCIT group should make reference to such a palliative statement. Did the Sec Gen mean what he said? Who was empowered to decide? European delegations offered that he must mean it (he had said it, and they had no reason to doubt his sincerity) so there should be no harm in citing that important baseline. But some governments rejected the idea, and from significant countries too: Indonesia, Russia, among others. They made it clear that they wanted the WCIT to have scope for regulating the Internet.

It took a plain-spoken Swede to summarize the impasse: if the Secretary General of the ITU did mean what he said about the treaty not dealing with Internet governance, then there was no issue with noting the fact.

If, as some countries seemed to imply, this was not the Secretary General's view — and that Internet Governance should be addressed in the new treaty — that was even more significant.

Take the Hint

The meeting failed to decide on how to interpret the Secretary General, but for seasoned observers, and now for you, the debate had been joined and the prognosis is this:

Internet governance is something that some big countries want to address in a treaty to be drafted in December. The big hitters of the Internet Community thin on the ground at the ITU this week, will want to prepare themselves, and not just by huddling in London, Ottawa, or Washington, DC, but by taking the conversation well beyond the G8. When this negotiation comes around, if there is not a compelling case for a shared Internet governed by a multi-stakeholder environment, the hitherto silent majority of governments may be too easily swayed. Relying on reflexes that incline to Mitterrand more than von Mises, voices that today are still wan will be amplified to an irresistible chorus. It's a shared resource, they will sing to one another.

Why should the Internet, much like radiofrequencies, SDRs, Antarctica, or even whales, not be governed by a permanent and formal intergovernmental structure? We have until December to answer.
Written by Gregory Francis, Managing Director at Access Partnership
Follow CircleID on Twitter
More under: Internet Governance
Sprint Fights for Mobile Market Relevance: First Quarter Earnings Positive

Posted: April 27th, 2012, 12:18am WST by Leonard Grace

Sprint's vision along with determined action says everything. They are fighting for mobile market relevance, thumbing their noses at detractors, moving beyond being relegated to a distant 3rd ranked carrier in a fast growing market. It's acquisition of the iPhone and agreement to spend $15.5 Billion over four years for the privilege has investors squawking bankruptcy sooner rather than later. First quarter earnings reveal that Dan Hesse's decision to purchase iPhones back in October 2011 is paying off in solid contracts. It beat both Verizon and AT&T in new mobile connections during the period.

Sprint Beats AT&T and Verizon in New Connections

As both Verizon and AT&T see declines in new connections, Sprint is growing at a good clip activating 263,000 new contract customers during the period, while Verizon added 240,000, and AT&T connected 7,000 in 1st Quarter 2012. We all understand that both the top carriers have had iPhone access for quite some time signaling the saturation of their markets. Sprint, on the other hand has a tremendous upside in sales potential with its controversial decision to gamble access to the most popular Smartphone ever. That decision is going as planned which may surpass all expectations down the road. See (Sprint Loss Widens on Nextel, iPhone lifts sales)

Unlimited Data Plans Offset Slower Speeds

Although Sprint is slower in speeds compared to Verizon and AT&T, it could offset the difference in continuing to offer unlimited data plans. How important is speed compared to plans that automatically drop your speed if set limits are reached? It might not make that much difference if customers know access is unlimited and are comfortable knowing what their speeds will be at all times. Most carriers throttle customers who go over contacted data plans, which have garnered prominent attention from news organizations. Sprint is the only major carrier which has stuck with eedsunlimited data plans in contrary to its larger competitors. See (Sprint: iPhone Decision Paying Off Despite Quarterly Loss)

"Sprint posted easily the most impressive (quarter) in U.S. telecom" Kevin Smithen, an analyst at Macquarie Securities

Shutdown of Nextel / Aggressive Network Upgrades

Sprint's Nextel network, which will be shutdown later this year, hurt earnings substantially for 1st quarter 2012. Since 2005 Sprint has been struggling with running two disparate networks and is moving to eliminate Nextel, which has lost customers regularly, and use the defunct radio frequencies in upgrading to a 4G (4th Generation) wireless broadband network using the standard LTE technology in its markets. This will position the carrier for improved growth and performance in its networks for a long-term outlook.

Sprint Beats Analyst Predictions on Long-Term Strategy

Outperforming analyst predictions Sprint posted revenues at $8.73 Billion compared to the $8.71 Billion investors had hoped for the carrier. This clearly indicates Sprint, headed by Dan Hesse is on the right track to turn the financial corner based on long-term strategy. While the stock is at $2.43 today, measures put in place by the mobile carrier will disconnect it from non-performers referenced by Nextel's demise and Clearwire's network being regulated to pre-paid accounts only. This restructuring will take time but will make for a much better performing company in the long-term. Kudos for Dan Hesse for looking past the obvious and positioning his company in a win-win position going forward. See (Sprint to Boost Mobile)
Written by Leonard Grace, Founder & Editor - Broadband Convergent
Follow CircleID on Twitter
More under: Broadband, Mobile, Telecom, Wireless
Multistakeholder Advisory Group of the Internet Governance Forum Has Been Renewed

Posted: April 26th, 2012, 3:24pm WST by CircleID Reporter

The United Nations has announced that the membership of the Multistakeholder Advisory Group of the Internet Governance Forum has been renewed.

A total of 56 members, 33 among them new, have been appointed. The Advisory Group members are from all stakeholder groups and all regions, representing Governments, the private sector, civil society, academia and technical communities.

All Advisory Group members serve in their personal capacity, but are expected to have extensive linkages with their respective stakeholder groups. The main task of the Advisory Group is to provide advice on the preparations for the next meeting of the Internet Governance Forum, which will be held in Baku, Azerbaijan, from 6 to 9 November 2012.
Follow CircleID on Twitter
More under: Internet Governance

IGP Blog

MacKinnon’s Consent of the Networked: A call for political innovation

Posted: April 26th, 2012, 5:40am WST by Milton Mueller

The best summary of Rebecca MacKinnon’s book Consent of the Networked is its subtitle: “The worldwide struggle for Internet freedom.” This is a comprehensive, spirited, and rich journalistic account of the way the use of the Internet and its supply industries intersect with classic civil and political rights. Importantly, it is informed by a realization that this encounter is generating a transnational movement for human rights in the new spaces forged by the Internet protocols. MacKinnon says that we need to figure out how to make the Lockean, proto-democratic idea of “the consent of the governed” apply to cyberspace. In a stirring sentence near the end of the book, she claims that “Netizens, companies and governments all face an urgent moral imperative to innovate politically – in the broadest sense of the word – on a scale that matches the dramatic technical innovations of the past several decades.” But it is a plea, not a recipe.

MacKinnon succeeds in putting most aspects of this struggle into a coherent perspective (the one exception is the international relations/cyber-war angle). She discusses the gigantic spaces for social interaction created by Facebook and Google and shows how a thriving public sphere on a business platform tailored to sell advertising creates wrenching issues regarding traditional understandings of democratic rights. She describes the “digital Bonapartism” of Russia and the “networked authoritarianism” of China, but does not overlook the “democratic censorship” European countries are implementing to filter or repress Internet-based communications. She covers the copyright wars and their ability to block or restrict internet content, touches on net neutrality, and produces very interesting insights into the political vagaries of Washington’s “Internet freedom” programs. She correctly includes ICANN, the World Summit on the Information Society (WSIS) and the Internet Governance Forum (IGF) in this narrative, affording a cameo role to the Noncommercial Stakeholders Group and its battle for adequate civil society representation in ICANN.

There are very few people who could pull this off other than Rebecca MacKinnon. Though she is a U.S. citizen and is well-connected to the hegemonic policy networks based there, she is a “rooted cosmopolitan” – Sidney Tarrow’s term for someone situated in a particular society but with far-ranging transnational relational links to many others. MacKinnon spent a significant part of her career in China as a CNN reporter and speaks and reads Mandarin. Through the incredibly valuable resource Global Voices, which she helped to build, she has gained awareness of and contacts to bloggers and activist networks in the Middle East, Africa and parts of Asia other than China. She provides exposure to the highly diverse people engaged in the struggle with a journalist’s sense of concreteness. She also has ties to (mostly US) private industry through her role in establishing the Global Network Initiative (GNI), an attempt to extract ethical commitments from major private Internet companies to avoid or minimize collaborating with repressive governments.

One might be tempted to call this a manifesto for the Internet freedom movement, but it isn’t, really. It is more like a supportive documentation of that movement’s problems and activities, and an expression of its current identity, tacitly guided by an intuitive sense of its ideological common denominators. Manifesto implies some new “ism” with a unique, well-defined political program and strategy. Consent of the Networked doesn’t do that. Although it engages with some big ideas, such as the nature of democracy in global cyberspace, the relationship between private and public authority, and the role of corporate social responsibility in the information industries, anyone looking for startling new ways of thinking about those problems or innovative proposals to solve them will not find them. Instead, MacKinnon makes it clear to us that those problems are there and concretizes them. As noted above, it calls for political innovations, it does not propose them.

There are some analytical insights here, but her discussions tend to reflect the sometimes-unsettling ambiguities that characterize the digital rights movement. Chief among these is an unclear stance toward private business and governmental power. A lot of the media coverage and sound bites associated with this work play on the characterization of the Internet giants as the “new sovereigns,” as “Googledom” and “Facebookistan.” MacKinnon, however, is experienced and smart enough to recognize, repeatedly, that governmental power is also a threat to Internet freedom, and thus she cannot and does not offer any simple nostrums about how policy makers should do this or that to respond to this putative sovereignty. She also recognizes that the ability of these new multinational businesses to connect with Internet users in ways that are not approved by governments and challenge their power can be liberating.

Her conclusions from the Wikileaks incident are typical:

We have a problem: the political discourse in the US and in many other democracies now depends increasingly on privately owned and operated digital intermediaries. Whether unpopular, controversial, and contested speech has the right to exist on these platforms is left up to unelected corporate executives, who are under no legal obligation to justify their decisions. The response to Wikileaks’ release of classified cables is a troubling example of private companies’ unaccountable power over citizens’ political speech, and of how governments can manipulate that power in informal and thus unaccountable ways.

This is a good example of the book’s strengths and limitations. Yes, the response to Wikileaks was disturbing in many ways. But a diagnosis that echoes the standard 20^th century-vintage dichotomy between public (elected, accountable) and private (self-interested, unaccountable) misses the mark somewhat. First, public expression in modern, free societies has almost always depended heavily on private intermediaries, whether we are talking about printed newspapers, renting speaking halls or telephone companies. And is the problem really that the corporate executives are “unelected?” Constitutional guarantees in liberal democracies typically don’t allow publicly elected officials to suppress certain kinds of expression. But when we stop governments from intervening, either because it is undesirable or because it is impractical, it is all but inevitable that the ordering gap will be filled by the policies of the private actors.

If the problem is that the policies developed by the operators of these platforms are oriented more toward commercialization and profit maximization than by democratic ideals then yes, of course, that leads them to behave in ways that many activists consider suboptimal or even harmful. But remove the commercial incentive to develop and build these platforms and it’s likely that you eliminate, or grossly stunt the development of, the platforms themselves.

This is not an easy problem. It goes to the heart of what liberal democracy means in a globalizing information space.

Take this line of thinking even deeper. If Facebook and Google are “sovereigns” then should digital rights advocates demand that they develop democratic elections, representational mechanisms and legislative processes, mirroring the evolution of governments? MacKinnon herself says no (p. 244) Are there better ways to secure the consent of the networked in these times? If one proposes instead state regulation of these entities, one is thrown back to the twin problems already facing the internet: 1) the problem of too many jurisdictions, with different and sometimes conflicting laws, fragmenting what should by right be a globally integrated public sphere, and 2) the risk of authoritarian or repressive regulation by nondemocratic states.

MacKinnon is actually quite pragmatic and centrist in her approach to these problems, recognizing their complexity and calling for new approaches. She places a lot of emphasis on the ethical obligations of corporations – and of consumers and their shareholders as well – to deal with these problems as they arise. This is quite consistent with her democratic worldview, which emphasizes a mobilized “netizenry” and the importance of transparency, and ongoing vigilance and agitation. She calls for “new mechanisms and strategies for collective bargaining by netizens with corporations. On that we can agree.

CircleID

Internet Governance: Coin of the New Realm

Posted: April 26th, 2012, 5:09am WST by Daniel Berninger

The Aspen Institute released the IDEA Common Statement and Principles as a do no harm Hippocratic Oath for Internet governance. The Aspen report describes the present moment as an inflection point for "the most robust medium of information exchange in history". Reed Hundt outlined the risks associated with Internet governance changes favored by China and a group of developing nations through the ITU. Michael Joseph Gross frames this same ITU dispute as World War 3.0 in the May 2012 issue of Vanity Fair. The collision between the borderless Internet and national borders may prove World War 3.0 a literal description of the forces in play. The Aspen report argues governance represents the coin of this new realm.

A world where the availability of connectivity shapes prosperity does not follow the same contours and constraints as the present Haves and Have-Nots economic pyramid. This makes Aspen's do no harm principles problematic for those benefiting from the economic status quo. The frictionless nature of the Internet creates an existential threat to the relevance of borders and by extension the wealth of gatekeepers. The enormous stakes promise a Darwinian survival of the fittest battle between champions of connectivity and disconnectivity splitting the world between these doctrines. The resulting stalemate may prove unresolvable until one side or the other wins economic hegemony as in the case of the Cold War.

The cost of moving a bit (1 or 0) from A to B or average-bit-cost (ABC) benefits from the same Moore's Law of transistor density driving processing power, memory, storage, and even megapixels. In 1980, AT&T charged $0.43 per minute for a "long distance" connection between 300 baud modems connecting computers in Los Angeles and New York. The present reflects the benefits of the 100 fold per decade reduction in ABC enabled by Moore's Law. The assault on physical borders will continue to escalate with another 10,000 fold ABC reduction due by 2040. The profound nature of the conflict reflects the fact coercion and communication anchor two ends of the human interaction spectrum.

Borders will remain important everywhere there exists a threat of coercion, but borders represent mere means to the end of prosperity. The motivations listed in the preamble of the US Constitution "… establish Justice, insure domestic Tranquility, provide for the common defence, promote the general Welfare,..." represent universal aspirations. The Internet governance debates provide an opportunity to test connectivity as a more potent source of prosperity than the delegation of power to the gatekeepers of national borders. The momentum presently favors the new Internet majority living in the developing world as well as China, Russia, India, and Brazil. The Internet freedom champions in America and Europe devolved into financial turmoil during the same period over the last decade China cut the GDP gap with the US from 8:1 to 2:1.

Internet partisans can point to the military cost of sustaining borders, abuses of power by gatekeepers, and uneven access to the resulting benefits. It nonetheless remains an open question how many of the 2 billion people already connected will step up to defend the benefits of the Internet. Threats to the Internet include both excessive and insufficient regulation. History shows borderless anarchy yields a downward spiral into horror conceding the landscape to strongman governance. The promise of the Internet as an engine of innovation seems unlikely to survive the interventionist regulatory model associated telephone networks championed by the ITU.

Internet governance decisions may reorder the world order as much as the world wars in the last century. Expanding connectivity creates wealth for the same reasons as borders by facilitating cooperation in pursuit of a common goal. The extent of cooperation reflects the extent communication tools replicate the experience of connecting in-person. Continuous improvement promises to make communication tools entirely substitutable for meeting in-person over time, but this does not preclude a painful transition. The 250 million lives lost to border disputes in the last century makes defending the promise of the Internet an urgent matter for this century.
Written by Daniel Berninger, Technology Analyst
Follow CircleID on Twitter
More under: Access Providers, Broadband, Internet Governance, Policy & Regulation, Telecom
Africa Infrastructure Growth Supporting ccTLDs and New gTLD Growth

Posted: April 26th, 2012, 12:00am WST by Mohamed EL Bashir

African Undersea Cables – 2014 (Click to Enlarge)This month, France Telecom's Lower Indian Ocean Network 2 "LION2" fiber optic cable has been put in service, bringing the total number of cables in East Africa to four. In South Africa it is expecting West Africa Cable System to go live next month.

This huge growth in fiber optic cables connecting Africa means that bandwidth costs can go further down but there are many questions for internet service providers, regulators and policy makers on how to ensure the new connectivity/bandwidth can lead to development of online services, ecommerce and other services that rely on good internet connectivity like eLearning and eHealth .

For instance, lower bandwidth costs have allowed internet users to grow from 14 million to 17 million in Kenya in the last quarter of 2011. This has been propelled by mobile internet subscribers but cost is an underlying factor. The same applies to other parts of Africa, in Senegal the number of Internet subscribers grew phenomenally in 2011. There is currently more than twice the number of Internet subscribers than a year ago, this growth was driven by factors like new 3G licenses, the release of cheaper internet services and low cost smartphones.

One of the more notable results of the lower connectivity costs has been the growth of Internet Exchange Points, which allowed more ISPs to exchange content locally without going through international transit providers. The ccTLD registries have also been able to connect directly at the exchange points, improving accessibility to their TLDs.

In a recent study titled "Assessment of the impact of Internet Exchange Points – Empirical study of Kenya and Nigeria" conducted by Analysys Mason and commissioned by the Internet Society, it was revealed that uses of the Internet Exchange Point "KIXP" helped in increase service delivery for .ke which resulted in domain name registration growth.

Most of the African ccTLD has few thousands of domain name registrations and there are many other challenges facing African ccTLD uptake — like registration cost, restricted policies and lack of automation. But a good infrastructure, fair competition and increased Internet capacity means that more people can get online, buy domain names, set up websites and online business. Two of the Africa's shining examples are Kenya ccTLD .ke with about 22,000 domains and South Africa .ZA is leading Africa's name space with over 700,000 domains under .za.

dotAFRICA, Africa's new gTLD project will also benefit from the growth of Africa's infrastructure and internet users huge growth. Due to nature of Africa internet issues the project will contribute to the development of Africa's Internet ecosystem through the establishment of dot Africa Foundation, more efforts directed to ccTLDs, registrars and Internet content services development in Africa.

Resources:
1. Africa's current Sea Cables
2. ISOC's Assessment of the impact of Internet Exchange Points – empirical study of Kenya and Nigeria
3. Senegal's telecommunications regulator, ARTP, recently published an annual report for 2011.
Written by Mohamed EL Bashir, Internet Infrastructure Management and Governance Expert
Follow CircleID on Twitter
More under: Access Providers, Broadband, Domain Names, Registry Services, Telecom, Top-Level Domains
New TLDs: Disruptive Marketing 21st Century Style

Posted: April 25th, 2012, 6:20am WST by Thom Kennon

Traditionally, top-level domains (TLDs) have been almost exclusively marketed by registries through their registrar channel. In a never-ending cycle of driving and sustaining sales, registries often resort to discounting and "promotional pricing." The competition for prime shelf space for a TLD is fierce, with sales and distribution largely controlled by the channel. Premium positioning is almost impossible. In this chaotic and cluttered channel, it's not surprising that TLDs have traditionally been less than successful in defining their brand and delivering a unique value story for their product. Registrars often treat TLDs like interchangeable commodities, and too often registrants are never even exposed to a TLD's direct message or value proposition, never mind their brand's story.

With the coming new TLDs, marketplace dynamics are about to become significantly disrupted. In a world where brands are the TLDs and digital communities become their own registries, the traditional definition of a registry no longer applies. For the first time, TLDs will become branded entities and in some cases rich global community destination points. Will registries vie with each other for placement in an ever crowded shelf, thereby ceding more control to the registrars? Some certainly will, but not all. Many registries know already, or soon will realize, that the costs will be high and the ROI unpredictable,

More innovative TLDs will take over the job of targeting potential registrants and delivering a precise marketing and branding message to stimulate sales. In other words, they will employ a "pull" versus "push" marketing methodology. For TLDs whose target registrants are well defined, or who already have a relationship with their market as a business or a brand, this will be much easier. And it will be more cost effective than those who do not. I also suspect that vertically integrated TLDs won't be the only registries that will be assuming a central role in the direct marketing of their product. In any case, the role of the registrar as the control point for marketing to the registrants will most certainly diminish.

This represents a fundamental change to the ecosystem and business of the Internet. The implications for registries, registrars and registrants are potentially profound. Absent a viable crystal ball, none of us enjoys a clear understanding of how all of this will shape up and shake out. What seems clear however, as we await ICANN's publishing of the initial TLD applicant roll call, is that the marketing of all TLDs will soon be changing forever. The new TLDs will, of necessity, require a new and qualitatively different brand marketing communications machine. They come to the market fresh, without any historic inclination towards relying on the registrar channel for driving awareness, sales and retention for their TLD product. Some will spend considerable efforts to establish a direct go-to-market strategy for their products. For the first time — outside the occasional big-splash campaigns sponsored by the mega registrars — prospective registrants and end-users will be targeted with rich, direct marketing in order to drive targeted sales, encourage retention, create content and increase traffic.

I'm excited by the possibilities in this new world of re-intermediated TLDs. I also believe the new marketing rules ushered in with the new TLDs will also open the door for existing ccTLDs and other niche TLDs to finally begin taking their story directly to the registrant marketplace, where the getting and keeping of customers will be heating up soon.
Written by Thom Kennon, EVP Digital Brand Strategies at Architelos
Follow CircleID on Twitter
More under: Registry Services, ICANN, Top-Level Domains, Web
Google Launches Storage Service, "Drive"

Posted: April 25th, 2012, 3:16am WST by CircleID Reporter

Google today launched a long-rumored "Drive” service to allow users store photos, videos, and other digital files in its massive data centers. Available immediately, first five gigabytes of storage per account of Google Drive is free and additional storage will be sold for prices starting at $2.49 per month for 25 gigabytes.

"Drive is also an open platform, so we’re working with many third-party developers so you can do things like send faxes, edit videos and create website mockups directly from Drive," said Google in its announcement today.
Follow CircleID on Twitter
More under: Cloud Computing, Data Center
Names of the Inaugural Internet Hall of Fame Inductees Announced

Posted: April 24th, 2012, 5:31am WST by CircleID Reporter

The names of the inaugural Internet Hall of Fame inductees were announced today at the Internet Society’s Global INET 2012 conference in Geneva, Switzerland.

Internet pioneers and luminaries from around the world have gathered at the conference to mark the Internet Society’s 20th anniversary, and attend an Awards Gala to honor 2012 inductees:

Pioneers Circle – Recognizing individuals who were instrumental in the early design and development of the Internet: Paul Baran, Vint Cerf, Danny Cohen, Steve Crocker, Donald Davies, Elizabeth Feinler, Charles Herzfeld, Robert Kahn, Peter Kirstein, Leonard Kleinrock, John Klensin, Jon Postel, Louis Pouzin, and Lawrence Roberts.

Innovators – Recognizing individuals who made outstanding technological, commercial, or policy advances and helped to expand the Internet's reach: Mitchell Baker, Tim Berners-Lee, Robert Cailliau, Van Jacobson, Lawrence Landweber, Paul Mockapetris, Craig Newmark, Raymond Tomlinson, Linus Torvalds, and Philip Zimmermann.

Global Connectors – Recognizing individuals from around the world who have made significant contributions to the global growth and use of the Internet: Randy Bush, Kilnam Chon, Al Gore, Nancy Hafkin, Geoff Huston, Brewster Kahle, Daniel Karrenberg, Toru Takahashi, and Tan Tin Wee.
Follow CircleID on Twitter
More under: Web
Iran Investigating Suspected Cyberattack on Its Main Oil Export Terminal

Posted: April 24th, 2012, 5:02am WST by CircleID Reporter

A virus was detected inside the control systems of Kharg Island — which handles the vast majority of Iran's crude oil exports — but the terminal remained operational, a source at the National Iranian Oil Company (NIOC) said. The virus, which is likely to draw comparisons with the Stuxnet computer worm which reportedly affected Iranian nuclear facilities in 2009-10, struck late on Sunday. It hit the internet and communications systems of Iran's Oil Ministry and of its national oil company.
Read full story: Reuters
Follow CircleID on Twitter
More under: Cyberattack, Security
Getting On Board With DNSSEC - A Personal Recount

Posted: April 24th, 2012, 12:13am WST by Ralf Weber
I first became familiar with DNSSEC around 2002 when it was a feature of the Bind9 server, which I was using to setup a new authoritative DNS platform for customers of the ISP I was working for. I looked at it briefly, decided it was too complex and not worth investigating. A couple of years later a domain of a customer got poisoned in another ISPs network. And while the DNS service we provided was working properly, the customers impression was we hadn't protected them.

That incident made me rethink my opinion on DNSSEC which could have prevented the cache poisoning. Even a couple of years later DNSSEC was still extremely complex, but I was able to educate myself and managed to setup a signed domain; and using their key as trust anchor, did secure resolution. The whole process was a lot different from the DNS administration we used to have: setup a server, load a zone, and forget about it. Here's what I had to do:
- Generate keys (best practice is to have at least two)
- Sign zones
The real work comes from housekeeping, because in cryptography everything has a limited lifetime. The biggest challenge is a lot of stuff has to be done repeatedly:
- Whenever something changed zones it had to be re-signed
- After some time keys expire, so new keys must be generated
- Zones then had to be re-signed
- Transition the zone from using one key to the other key
The last topic alone fills half of the DNSSEC operational RFC which in the most current version is 67 pages long. Also note, this did not cover the effort to manage trust anchors for caching servers, which is substantial when you don't have a signed root. So deploying DNSSEC was possible, but it was a long way from being usable even for an experienced DNS admin.

To make DNSSEC easier there were two main problems that had to be solved:

Most people are aware DNS is a hierarchical system so cryptographically protecting DNS data introduces significant complexity. With DNSSEC, signatures have to start at the root, and then propagate down to the TLD and so on. It has always been possible to deploy DNSSEC without a signed root but everyone quickly figured out it was very cumbersome for operators of recursive name servers. This is a major reason why DNSSEC wasn't adopted earlier. It was most definitely lacking "ease of use"!

DNS admins and customers/users care about DNS data, they are not interested in the actual wire representation and signatures. Yet all the tools (if you could call them that!) required them to understand everything.

The first problem was solved on the 15th of July 2010 with the root being signed. Today 77 TLDs are signed and delegated from the root including the biggest gTLD and ccTLD (.com and .de respectively).

The second problem was actually solved even earlier. While working at an ISP I concluded DNSSEC could do some good things, but it needed work. Based on a lot of detailed discussions and feedback a group of engineers at Nominum came up with a great solution. I first got access to it in 2009 and was pleasantly surprised to see it removed all the configuration complexity (I'll cover the details in another blog post) Full disclosure: I joined the company about a year later.

With major hurdles for DNSSEC deployment removed, there is no reason not to start deploying it now. Of course rollouts have to be planned, but if you start to setup DNSSEC for your test/lab environment you'll see how easy it is with the right tools.
Written by Ralf Weber, Senior Infrastructure Architect at Nominum
Follow CircleID on Twitter
More under: DNS, DNSSEC, Security
ICANN - Time to Act!

Posted: April 23rd, 2012, 1:53am WST by Stéphane Van Gelder

At the start of the TAS outage, I said ICANN had a great opportunity to get its crisis management right by communicating properly.

Now, nearly two weeks after the application window was supposed to close, ICANN has clearly done just that. We've had update messages every day and even a video of Security Chief Jeff Moss in which he provides an in-depth view of the way his team is handling the glitch. ICANN's latest communication initiative is a "TAS interruption FAQ” where it is confirmed that the April 30 "reveal day" will be postponed (the first time ICANN has officially recognized that it will not be able to publish the list of TLDs applied for in this first round at the end of the month of April as initially planned).

But clearly, communication isn't the only parameter in crisis management. At some point, you also need to act. So with ICANN refusing to commit to any TAS restart date, instead promising to "provide an update on the timing of the reopening no later than Friday, 27 April", perhaps more crisis management advice is needed…

What could that advice be? To carefully weigh the pros of checking every detail of the TAS data with the cons of looking rather inept by allowing the outage to continue. Seasoned ICANN watchers are appalled by the continued delay, but at least they are used to such things and therefore probably more tolerant of ICANN's capacity for missing deadlines and getting mired in its own processes than a new category of ICANN community member: the applicants and observers that the new gTLD program has brought into the ICANN universe.

ICANN has never been particularly mindful of its crowd of usual suspects, but it should definitely be wary of this new category that it has itself created through the new gTLD program and its desire to "change the Internet forever".

Because these people live in the real world, where missing deadlines by a month is science fiction, and where 70 million dollar organisations take hours to solve problems, not weeks. When you charge people $185,000 for the right to submit an application, you need to be able to show them that you are able to handle pressure and act fast.

So my advice to ICANN now: get your skates on! A typically British expression with a clear meaning: restart TAS. Stop faffing about trying to verify every single bit of applicant data that may have been impacted by the glitch. Your updates keep on telling us how no data was corrupted and no sensitive data from one applicant was even visible by another. So do a 180 degree shift in your current crisis management.

ICANN's next update (wishful thinking: tomorrow?) should be: "in the interest of getting the new gTLD program back on track, we've decided to restart TAS now."

But deciding that would require strong leadership. Like a CEO able and willing to take the risk of restarting the system before the full data analysis is complete. A CEO that would understand that this risk needs to be weighed against the damage that not restarting TAS is doing to ICANN's global image. Unfortunately, since the crisis began, the current ICANN CEO has gone AWOL…
Written by Stéphane Van Gelder, General manager of INDOM
Follow CircleID on Twitter
More under: ICANN, Internet Governance, Top-Level Domains
EFF: U.S. Cybersecurity Strategy Likely to Have Serious Implications for Canadians

Posted: April 20th, 2012, 4:46am WST by CircleID Reporter

EFF and several other civil society organizations have declared a 'Stop Cyber Spying Week' in protest of several controversial U.S. cybersecurity legislative proposals, including the bill currently before Congress and the Senate called CISPA. From the EFF statement:

[T]he U.S. cybersecurity strategy envisions a voluntary cooperative regime where Internet companies are given broad-ranging immunities to surveil Internet users and downstream online services. This amounts to an erosion of personal privacy safeguards currently in place. Under this regime, an online company need only to assert a vague 'cybersecurity objective' and it will have carte blanche to bypass domestic laws and protections against privacy invasion.

This legislation is likely to have direct implications for Canadians. Canada and the United States have agreed to a joint 'Beyond the Borders Initiative' aimed at establishing a 'secure perimeter' around the two countries.
Follow CircleID on Twitter
More under: Access Providers, Internet Governance, Policy & Regulation, Privacy
A Quick Primer on Internet Peering and Settlements

Posted: April 20th, 2012, 3:59am WST by Geoff Huston

The business world today features many complex global service activities which involve multiple interconnected service providers. Customers normally expect to execute a single paid transaction with one service provider, but many service providers may assist in the delivery of the service. These contributory service providers seek compensation for their efforts from the initial provider. However, within a system of interdependent providers a service provider may undertake both roles of primary and contributory provider, depending on the context of each individual customer transaction. In a system where there are many mutual service provision transactions it is common to see the use of a balance of services used in place of individual transaction payments between providers, and the use of inter-provider financial settlements as a means of reconciling residual imbalances in the accounting of such mutual service provision tasks. In this article I'd like to describe how this has been applied to the Internet, and look at the Internet's approach to interconnection and financial settlements.

For example, airlines these days have codeshare agreements where a customer may purchase a ticket from one airline where the flight is operated by another airline. Given that one provider has received the revenue for the service and another provider has incurred the costs of providing the service, there is a need to pass some form of payment from one provider to the other. Rather than undertaking a separate inter-provider financial transaction for each codeshare journey, airlines can use a more efficient arrangement that uses inter-provider settlements. Each airline retains the original ticket sales revenue, and accumulates amounts in credit and debit from the execution of the codeshare flights between providers. They then settle any residual imbalance in the mutual service account with single financial transaction at the end of each settlement period.

The Internet operates in a similar fashion: its services are provided by some 40,000 constituent network service providers that must not only interconnect with one another, but also execute a set of inter-provider arrangements that ensures that each service provider is duly compensated for their respective efforts in providing end-to-end services to the network's clients.

The Telephony Model

To look at the Internet interconnection and settlement structure, it is useful to look at its immediate predecessor, the inter-provider financial settlements within the telephony domain.

The retail model for telephony is, for the most part, a model that appears to have been borrowed from the postal service, where the caller pays its local carrier for the entire cost of the call, while the called party pays nothing to receive the call. When both the caller and the called party are connected to the same carrier then this is quite straight forward: the carrier charges the caller for the entire cost of the call. When we take the same model and apply it to international phone calls, then the common intent is to preserve the same simple retail model: the caller pays the cost of the call. Given that this now involves the telephone carriers undertaking mutual service provision activities, the arrangement that the telephone industry came up to redress any residual imbalances in mutual service provision with was the concept of inter-carrier call accounting financial settlements.

Within the framework of this interconnection model, two national carriers interconnect at an agreed handover point, and, as part of this interconnection, they establish a call minute settlement rate, which is the rate one carrier bills the other for the residual imbalance of terminated calls that originate from the other carrier's network and are passed to the terminating carrier at the handover point for termination in the other carrier's network.

The calling provider receives a payment from the caller for the entire call, and accumulates a debit to the terminating provider for the termination costs of the call. The terminating provider receives no payment from the called party, and accumulates a credit from the calling provider for the same call termination cost. A periodic financial payment from one provider to the other allows the two providers to "settle" the net of these debit and credit accounts, and thereby providing a form of equity of cost distribution in meeting the costs of the calls made between the two providers.

Calls are measured in units of call minutes in the interconnection domain, and the debit and credit accounts are measured in units of call minutes. Where there is equity of call accounting rates between the two providers, the bilateral inter-provider financial settlements are used in accordance with originating call-minute imbalance, in which the provider hosting the greater number of originating call-minutes pays the other party according to a bilaterally negotiated rate per residual call minute imbalance as the mechanism of cost distribution between the two providers.

It's notable that the general bilateral telephony settlement model does not admit multi-party transit arrangements. Such arrangements are handled using further forms of inter-carrier agreements where a carrier may hand-off call requests to a third party carrier at some mutually agreed call minute rate, and similarly a carrier may engage another carrier to act as its call terminating carrier for an agreed share of the call termination settlement fees.

Because the telephony model includes local monopolies there is no inherent market-based capability that prevents a carrier setting its call termination settlement rates to a level that is in excess of its actual call termination costs. The resultant distortions and economic inefficiencies in the inter-carrier domain have acted as a powerful driver behind the increasing interest from some high volume calling party carriers in voice-over-IP (VoIP) solutions that bypass these call accounting settlements. In such situations the originating carrier uses VoIP trunking instead of call handover at the inter carrier interconnection point, and terminates the call request within the terminating carrier's network as a regular internal call. This allows the origination carrier to avoid the call termination settlement rates. The end customer of these VoIP trunk services benefit from a lower priced service offering, with an associated commercial pressure on the terminating carrier to remove the monopoly rental component from its call termination settlement rates. It would be a highly retrograde step to see a new wave of international regulation that entrenches these inefficient distortions of monopoly rentals in the telephone sector by attempting to prevent, by regulation, the use of alternate voice trunking solutions, such as VoIP, in the international telephony domain.

Another by product of this monopoly-based distortion in the inter-carrier settlement rates is the emergence of a lobby group who are current beneficiaries of these arrangements who, perhaps understandably, are highly motivated to see the continuance of these arrangements and the potential extension of these arrangements to encompass the Internet. This contemplated extension of interconnection regulations from telephony into the Internet environment again represents a retrograde step in terms of introducing regulatory distortions and significant inefficiencies into what is at present a functional and efficient Internet interconnection market, as we'll examine in the next section.

Internet Considerations

There are a number of important technical differences that exist between the telephony and Internet models of carrier interconnection. These differences are fundamental, and have confounded all attempts to cleanly map telephony interconnection models into the Internet environment. The most critical of these differences are described as follows:

There is no "call"

Unlike a telephony call, there is no concept of state initiation in an IP network to pass a call request through a network and lock down a network transit path in response to a call response. The network undergoes no state change in response to a packet being passed through the network, and therefore, no means is readily available to the carriage service operator to identify that a call has been initiated, and by which party.

Packets may be dropped

When a packet is passed across an interconnection from one carriage service provider to another, no firm guarantee is given by the second provider that the packet will definitely be delivered to the destination. The second provider, or subsequent providers in the packet's transit path, may drop the packet for quite legitimate reasons, and will remain within the Internet Protocol specification in so doing. Indeed, the TCP protocol uses packet drop as a rate-control signal, necessary for its efficient operation. The broader implication here is that the quality of the packet transit service that one carrier may anticipate from it's adjacent carrier peer when passing packets across an interconnection is inherently undefined.

Packet paths are not necessarily symmetric

The inter-carrier path a packet takes from one client to another is not necessarily the same path that a packet takes in the reverse direction. This path asymmetry means that there is no direct analogy to the virtual circuit model used in telephony. When two clients, A and B, exchange traffic a carrier may only see traffic flowing in the direction from B to A and not see any traffic from A to B. It's not that there is no such traffic, but that the traffic in the opposite direction uses a different inter-carrier transit path through the network. One outcome from this observation is that in a hypothetical case of traffic flow-based inter-carrier service accounting, when a carrier sees just one half of a traffic flow, it's unclear how a carrier can reliably determine whether it should claim a service debit or a credit from its adjacent carriers in passing the traffic towards its intended destination.

There is no network-based resource management regime

In the telephone world the establishment of a virtual circuit to support a voice call can be viewed as an exclusive claim on a unit of capacity in the network that excludes all other potential users of that capacity. However, in the Internet, there is no concept of resource exclusion, in other words, the Internet does not use a network-based management regime to allocate its resources to support individual transactions. The end-to-end architecture of the Internet places the onus of responsibility for resource management and allocation on the collection of end systems that generate traffic at any point in time. In this architecture its conventional to see traffic flows across the network being regulated by the Internet's transport protocol, TCP. Each traffic session is adaptive in such a manner that it will attempt to make the most efficient use of the entire set of network resources, while at the same time attempting to sustain a stable state were each individual traffic flow claims an equal volume of network resources for itself.

Internet Interconnection Arrangements

The retail model used by the Internet is not one of "sender pays," nor one of "receiver pays". The retail service is not one where either the sender or the receiver funds the entire end-to-end transit of a packet through the Internet as part of the retail tariff structure for Internet services. Indeed, given that the end-to-end transmission of a packet is not even an assured outcome in the Internet architecture, such a tariff model would be a mismatch to the nature of the service provided by the underlying IP network. The Internet retail model is one where a customer contracts with a carriage service provider for an access service. This is a customer/provider relationship, where the customer funds its carriage service provider for all packets that are sent or received by the customer.

The translation of this retail service model into the inter-carrier interconnection environment is one that preserves this particular form of customer/provider relationship at the retail edge of the network, translating in into the context of two interconnecting carriers. A carrier that is a customer of another carrier pays for an access service, where the customer carrier funds all traffic to and from its provider (or upstream transit) carrier.

Who is the provider and who is the customer in such an arrangement is not pre-determined by any objective or regulatory determination. It is based on a self-assessment by each carrier as to their own value and the value that the other carrier is bringing to the proposed interconnection.

If one carrier believes that it is bringing greater value to the interconnection then it would naturally only contemplate the interconnection if it were to be the provider and the other carrier to be its customer. If the other carrier reaches a similar conclusion that the other party is providing a greater value to the interconnection than the interconnection would most likely proceed to the next step of negotiation of service terms and conditions between provider and customer that recognizes the extent of the difference in relative value. Sometimes this takes the form of a conventional wholesale relationship, while at other times more creative labels are used for much the same form of customer relationship, such as "paid peering".

If the other carrier reaches the conclusion that it too was bringing a greater value to the interconnection, and it should assume the role of provider in an interconnection, then the mismatch in relative value perceptions would imply that any attempt to execute an interconnection between the two carriers would not be stable. The typical outcome of such a failure to directly interconnect is not necessary one that results in partitioning of the network. A more typical outcome in such a case is that any traffic that is exchanged between customers of the two carriers would be passed through indirect transit arrangements.

There is another possible outcome of this self-assessment of perception of value in an interconnection, where both parties see approximately equal mutual benefit in interconnecting. Here a "Sender Keep All" (SKA) relationship is appropriate, where the parties exchange traffic in both directions but do not exchange any funds in either direction. These SKA arrangements are typically referred to as "peer" relationships.

In all of these relationships, the parties themselves do not have to agree on what that measured value or scope may be in absolute terms. Each party makes an independent assessment of the value of the interconnection, in terms of the perceived size and value it brings to the interconnection and the value of the assets that the other party brings to the interconnection. If both parties reach the conclusion that, in their respective terms, a net balance of value is achieved, then the SKA interconnection is a stable one. If one party believes that it is bringing a greater value to the interconnection than the other then any SKA interconnection would result in leverage of its investment by the smaller party, and an SKA interconnection would be unstable.

These two forms of interconnection, namely a customer/provider relationship and a SKA peer relationship, form the basis of the entire set of connections that collectively support a coherent and fully connected Internet.

An outcome of this interconnection model is that the service providers' options for business optimization includes a strong incentive of increasing the size, scope and efficiency of its service provider operation within the consumer and wholesale market space, so that non-financially settled SKA peering can be negotiated with larger providers, thereby reducing the additional outlays required to purchase upstream transit services to complement these peering connections. This in tern results in an internet which is highly interconnected, which, in turn improves both the performance and operational costs of the service offering, both of which translate to improved consumer offerings in a highly competitive service industry.

A Market-based Approach to Interconnection

In many ways interconnection in the Internet can be seen as the operation of an open market within the broader framework of a generally deregulated industry, where each party brings assets to the interconnection market place and attempts to reach mutually satisfactory arrangements with other actors in the same market. Each party is attempting to reach precisely the same outcome, namely comprehensive connectivity, and to do so in a maximally efficient manner such that it minimizes its expenditure while meeting its requirements for connectivity and capacity.

Over twenty years of experience in operating this market-based framework for Internet connectivity has shown that it is capable of scaling from a few dozen service providers to currently over 40,000 component networks, and at the same time it has proved to be capable of sustaining its objective, namely that of universal connectivity across the entire Internet's interconnection domain. It is also the case that the Internet has been able to achieve this outcome without the imposition of overriding regulatory impost, and with ever increasing price performance service offerings for the end consumer. The evidence from this experience points to a conclusion that this market operates in an efficient manner, and this efficiency directly translates into cost efficiencies in the retail market for Internet services.

The ultimate beneficiary of this form of market-based Internet connection in the Internet is the end consumer, who, for the price of a local access service across the last mile, gains access to the entire world of the Internet.
Written by Geoff Huston, Author & Chief Scientist at APNIC
Follow CircleID on Twitter
More under: Access Providers, Broadband, Policy & Regulation, Telecom, VoIP

IGP Blog

“Feeble” governance? The push to discredit multistakeholder institutions

Posted: April 19th, 2012, 5:52am WST by admin

If you think the United Nations (UN) is about to subordinate Internet freedoms to governments, consider this. Compare the ineffectual and bureaucratic UN, which lacks any real operational leverage over the Internet, to the Washington, DC-based Center for Strategic and International Studies (CSIS). Now, there’s a real threat to bring the states back in.

James Lewis, the CSIS point man for Internet policy and instigator of the Commission on Cybersecurity for the 44th Presidency, is part of an entrenched Washington community devoted to identifying, analyzing, playing up and selling solutions to the US government for threats in foreign policy and military/national security. With the Cold War over and the war on terrorism no longer able to command the same budgetary stimulus, they have turned to cyberspace for fresh blood. They are busily re-framing the Internet’s known civil vulnerabilities into major national security threats. Lewis in particular is on a crusade to convince Washington that what he denigrates as the “90′s approach” to Internet governance was all wrong.

Lewis was at a recent CSIS-sponsored Global Security Forum that explored “the top challenges facing U.S. and global security.” The Forum concluded with a session on Fighting a Cyber War. The basic premise of all the panelists was that the vulnerabilities of military, civilian, and commercial networks to cyber attack should force the US to revise its approach to cyberspace.

As is all too typical of these affairs, the dialogue avoided any analysis or discussion of the actual types of attacks on Internet infrastructure that might constitute a true military threat. The threats were simply assumed to be there and to conform to the Cold War-honed, state-vs.-state mindset that the national security community knows and loves. Panelists from the U.S. Defense Department acknowledged that we have a clear legal process for dealing with cyber-crimes (citing some of the FBI’s recent successes), but claimed that we will need rules for military response when “immediate action” is required. (Sort of like an Internet kill switch, but you can’t really say that anymore.) This prompted Lewis to rant about the Internet’s existing governance institutions:

back in ye olden days of the Clinton administration, when we did the, you know, commercialize-the-Internet things, we had two working groups. We had the commercial working group; that was Ira Magaziner. We had the security working group; that was John Deutch. And …we never talked. And so we have a whole governance structure that grew out of that process that’s incredibly feeble. And you can just make up letters and put them together: WSIS, IGF, whatever you want, ICANN. We have a feeble governance structure that makes it really hard for us to agree on rules for cooperation and security. And that’s what we’re probably going to need to revisit.

As any regular reader of IGP Blog knows, we will be the first to criticize existing Internet institutions for their failings. But to blame them for not facilitating a rapid U.S. military response to hypothetical cyber attacks seems dangerously wrong-headed. And yet, the attack is constant and relentless. It is part of a broader agenda.

One gets the impression that Lewis is dismissing, with a wisecrack about acronyms, the trillions of dollars worth of jobs, innovation, economic growth and trade that has come from those “commercialize-the-Internet things.” Indeed, it is the very success of those institutions in fostering – or at least not getting in the way of – the emergence of a global networked economy and public sphere that has made cyberspace so pervasive. Prior to that, security concerns were minor or hypothetical. Of course as the economic stakes rise, so do security concerns.

But Lewis seems to be suggesting that global Internet governance institutions should have been designed to optimize U.S. military response capabilities in the first place. The problem with that perspective is that military and national power competition is largely a zero sum game among states. Such an approach could only trigger a chain reaction undermining the acceptance of Internet governance institutions and the interoperability of computer systems.

Lewis is certainly correct that we need to pay attention to transnational institutions and their capacity. But he’s short on creative thinking and viable alternatives. When he criticizes existing institutions as “feeble” what exactly does he want? A traditional, treaty-based intergovernmental body? Probably not: the US has made clear it does not wish to cede Internet governance to the ITU or UN. Is he proposing a new US-led club of states, such as NATO or OECD? While a US-friendly, US-dominated body like NATO might be palatable inside the DC beltway, its not clear that forming “alliances” in cyberspace does anything to counter cyber-threats. The Internet and its problems are distributed and global, and many threats are likely to come from territories that are not in the club.

So insofar as CSIS and its ilk actually know where they are leading us, we can only infer where it is. We suggest that we are being led into the following two paths.

1) A more aggressive U.S. unilateral globalism. The reviled SOPA and PIPA laws, in which the U.S. asserted extraterritorial jurisdiction over domains and addresses, is an example of what happens when U.S. politicians respond to demands for “strong action on the Internet” of the type Lewis is promoting. These kinds of laws seize upon US economic dominance of certain aspects of the Internet economy and try to leverage them to global regulatory effect. The Cyber Intelligence Sharing and Protection Act (CISPA) is a similar effort. It tries to facilitate sharing of information about cyber-attacks by allowing private companies to hand over massive amounts of personal information to the U.S. government with no judicial oversight, regardless of where they are located and what law they live under. Those proposed laws were not and are not feeble. But are they any good for us, the people, the denizens of cyberspace? SOPA threatened both the technical security of the global Internet (by undermining secure domain name resolution), and broadcast a powerful message to the rest of the world to avoid U.S. based domain name registries, registrars and hosting services. CISPA threatens users’ personal security and privacy. Both do little or nothing to advance the kind of global cooperation needed to address pressing problems regarding botnets and DDos attacks.

2) Seize control of existing transnational institutions. Try to bend ICANN, ARIN, and perhaps even IETF so that they are more responsive to the security concerns of the US and its allies. But this will mean undermining, if not destroying, the civilian, private sector-based multi-stakeholder features of these institutions. Instead of being bottom up and open, they will have to take policy dictation from the U.S. and perhaps from a strengthened Governmental Advisory Committee (GAC). Instead of relying on networks of cooperative relationships, they will become more hierarchical, top-down and regulatory.

The Internet’s lightweight governance institutions have and continue to serve as points of coordination. But private actors own and operate the Internet’s infrastructure and it is they who must repeatedly deal with the security challenges thrown at it. This is as it should be. Large-scale manmade Denial-of-Service attacks on the DNS root servers are an actual risk identified by the USG, but have been found to be of low likelihood because of the distributed and global nature of the DNS. These structural features allow a myriad of actors to respond to problems as necessary within the boundaries of the law. In many respects, the centralization and militarization sought by the security mavens will make us less secure. We agree with Rebecca MacKinnon that in institutional design it is the consent of the networked that matters most, not the security interests of states.

And yet, as all this goes on there are still people encouraging us to gird our loins against a UN/ITU threat that barely exists and has been repeatedly rebuffed and diminished. It’s time to stop projecting threats to Internet freedom onto symbolic bogeymen like the UN. There are more serious threats right here at home.

Veni Markovski - The Blog

За журналистите и “журналистите”

Posted: April 19th, 2012, 4:39am WST by Veni Markovski | Вени Марковски
Българската полиция и МВР – най-близки до мафията и бандитите?

Posted: April 19th, 2012, 4:30am WST by Veni Markovski | Вени Марковски
Сигурно ще се учудите от такова заглавие, нали?
Но как другояче да тълкуваме непрекъснатите изяви на МВР, министъра на вътрешните работи Цветан Цветанов (известен още като Цвинокио, известен още като Цецо Конецо, Цецо шесте апартамента и Цецо шлифера)?
Ето последния пример, от тази вечер:
Прави ли ви впечатление, че почти всички застреляни или почти всички арестувани са “известни на полицията”, “познати на органите на МВР”, “криминално проявени” и др.п., т.е. – това са хора, с които очевидно – или поне вероятно – МВР се познава*, ДАНС ги кани на кафе, следователите си приказват, прокурорите им честитят рождените дни, а медиите разнасят “подвизите” им?

Изводът се натрапва от само себе си – най-близките до тези бандити са институциите, които трябва да предпазват обществото от техните действия, да ги съдят и наказват.

Тъжен извод, нали?

_________
* – Спомняте си, че преди години Бойко Борисов, като главен секретар на МВР, обясняваше как си говорил приятелски и на “ти” с бандита Шаки, убит малко след този разговор и му казвал “Ела, бе, Шаки, ела да те приберем в ареста, че иначе ще те застрелят”?

CircleID

Driving DNSSEC: The Need for Integration of All the Functions Needed

Posted: April 19th, 2012, 3:50am WST by Bruce Van Nice

DNSSEC continues to gain momentum as network operators and domain owners watch and learn from early adopters. The learning process is made easier by efforts such as the ongoing work conducted by researchers at Sandia labs to methodically identify and categorize the kinds of problems that are occurring.

The early experience has validated the need for integration of all the functions needed for DNSSEC. It's not realistic to expect DNS administrators to pull together all the piece parts that are needed. Automation is also essential, if technically astute organizations are tripped up by mandatory maintenance and intricate processes (like rolling over Key Signing Keys) then others will be too.

Evidence of the value of better tools can be found out in the marketplace. Comcast recently promoted their deployment of DNSSEC across their network of more than 18 million subscribers and signing of more than 5000 domains. They've demonstrated DNSSEC can be deployed at massive scale by taking advantage of better DNS software. Adoption of every new technology accelerates when a major player takes the lead, a large scale deployment validates what is possible and positions DNSSEC at the base of the power curve.

DNSSEC has also been on the agenda at the United States Federal Communications Commission (FCC). In a recent speech Julius Genachowski, Chairman of the FCC, not only urged service providers to take voluntary action to deter the spread of botnets, he also urged them to adopt DNSSEC.

ISPs that adopt DNSSEC, Genachowski said, "can provide a real and tangible benefit to the consumers and businesses that rely on them." He pushed ISPs to implement it "as soon as possible."

Directly from his speech: "If they adopt DNSSEC, ISPs can provide a real and tangible benefit to the consumers and businesses that rely on them. DNSSEC is ready to be implemented. Indeed, at least one major U.S. ISP has already completed implementation of DNSSEC."

As security becomes a part of brand equity, service providers and domain owners everywhere will recognize the value of improving their stature. Leadership on the part of large ISPs demonstrate that with the right tools even complex technologies like DNSSEC can be deployed and deliver real benefits to end users. Better still, security also does not have to exist in isolation but can be part of a larger strategy that incorporates other business enhancing initiatives such as subscriber loyalty and business intelligence.
Written by Bruce Van Nice, Director of Product Marketing at Nominum
Follow CircleID on Twitter
More under: DNS, DNSSEC, Security
Counter-eCrime Operations Summit (APWG) In Prague Next Week

Posted: April 19th, 2012, 12:39am WST by Garth Bruen

The sixth annual Counter-eCrime Operations Summit (CeCOS VI) will engage questions of operational challenges and the development of common resources for the first responders and forensic professionals who protect consumers and enterprises from the ecrime threat every day. This year's meeting will focus on the shifting nature of cybercrime and the attendant challenges of managing that dynamic threatscape. Within that framework, CeCOS VI Prague will review the development of response paradigms and resources for counter-cybercrime managers and forensic professionals in the private and public sectors. Presenters will also be reviewing case studies of national and regional economies under attack, narratives of successful trans-national forensic cooperation, considering models for cooperation against ecrime and examining resources for cybercrime response and forensic enterprises.

This is an important opportunity for stakeholders to meet, define common goals and to plan the harmonization of resources for the global counter-ecrime effort. If you are an information security professional, law enforcement officer, counter-ecrime technology developer, CISO/Security manager, (military or corporate) intelligence officer, policy analyst, technologist, legislator, legislative researcher, industrial standards author, corporate security manager, private investigator or academic/industrial researcher in ecrime you should attend this summit.

The program will be spread across a three-day conference event on April 25, 26 and 27 in Prague, Czech Republic at the Mövenpick Hotel Near the city center. The APWG believes under-appreciated operational issues are important enough to be the focus of a conference dedicated exclusively to them. They're often talked about as sidelights but rarely addressed directly as an organizational imperative for the entire counter-ecrime community. CeCOS VI makes those operational issue the central focus of the program for the benefit of all ecrime fighters.
Written by Garth Bruen, Internet Fraud Analyst and Policy Developer
Follow CircleID on Twitter
More under: Cyberattack, Cybercrime, DNS, DNSSEC, Domain Names, ICANN, Internet Governance, Malware, Policy & Regulation, Privacy, Spam
Matching Apps to Network Access - A Postage and Packaging Problem

Posted: April 18th, 2012, 6:59am WST by Martin Geddes

A number of conversations have recently converged on a single problem: how to match applications to network access. Let's unpeel this issue.

Post and Telegraph 2.0

When I was Chief Analyst at Telco 2.0, we proposed there was a significant untapped market opportunity for network operators to bundle together access with content, applications or services. The revenue opportunity is to charge the providers of those services for delivering fit-for-purpose data at bulk wholesale prices. This is the "postage problem" — who pays for delivery of digital goods and services?

A way of viewing this is "freephone for data", or the equivalent of pre-paid bulk mail in business. It's the bread-and-butter of most distribution businesses, with large enterprises paying to get their goods to customers.

My colleague Dean Bubley has long pointed out a parallel issue, which we can call the "packaging problem". This in a nutshell can be thought of "if a user embeds a YouTube video inside of a Facebook page, which enterprise picks up the tab?". It's hard to allocate traffic to paying parties once it has hit the network.

A physical envelope acts as packaging, and has two functions: keeping what you want sent inside and not spilling out, and keeping things outside from getting in. The same problem exists with networks: how to pay for only the data you should be liable for? You don't want anyone else tunnelling their traffic via your app with you paying the bill.

Postage Problem

When application providers want to pay telcos for sender-pays data, they typically fall into one of two cases: they want premium assured quality service (e.g. home worker telepresence), or they want bulk low-cost low-quality service (e.g. video advert pre-caching).

As Dean has drolly noted on a number of occasions, there are two problems with this: enterprises don't know how to buy it, and telcos don't know sell it. The whole market is based on quantity, not quality.

In fact, it's worse than this. The vendors who sell to telcos don't even know how to make it. What they get telcos to implement is "quality of service", or priority. However, what premium applications need is predictable, assured bounds on loss and delay, particularly infrequent "worst case" which users may perceive as an application failure. The type of quality on sale is next-to-useless, as it still has an unstable and unbounded loss and delay limits. Furthermore, the quality of lower-class traffic tiers has such poor and unstable loss and delay characteristics you can't even begin to sell it.

Think of telcos like factories that take in raw milk. If they try to separate out the cream and whey, you find the cream is still sometimes milky and won't whip, and the whey often goes rotten before it leaves the factory.

Packaging Problem

The other half of the problem is making a strong and secure packaging. Cream, yogurt, cheese, milk and curd all need different packaging. So do the different types of data, and that partly depends on where you need to deliver it.

There is a fundamental shift going on in the industry. We've seen the basic network end-point unit drop in size over the decades: a town had a town crier; then a neighbourhood had a telegraph office; a block a telephone booth; followed by telephones to houses and Internet down to single devices like PCs.

A common pattern is for each new generation to use some elements of the communication solution of the previous generation, before coming up with its own version. So telephones used telegraph wires, before coming up with twisted pairs. PCs used dial-up ISPs before broadband.

The next shift in delivery point is from PCs down to Apps. We're at the phase where PC-level broadband is going to get the "dial-up ISP treatment", and start to be broken down into smaller chunks. Apps are the missing Tyvek envelopes into which to put the data.

The initial need will not, however, be driven by sender-pays data. We will see simpler examples where corporates and schools want to ensure their employees and pupils can use approved apps in approved ways, without the host having to pay for the data costs of every app that crosses into the building.

What next?

Here is my thesis on what happens next.

We will see the beginnings of a solution to the Postage & Packaging problem in the context of enterprise use. Trends like Bring Your Own Device will force enterprises to turn their functions into managed apps.

New business models will start to spring up. For example, a school may charge pupils a fee if they want to use non-educational apps on the school network since that drives a real cost of network upgrade and operation.

Over time, virtualisation technology and on-device management features will make the envelopes more robust. Apps will understand networks better. In parallel, new network enablers will solve more of the 'postage problem' offering a richer set of quantities and qualities than one-size-fits-all best-effort broadband. Aggregators will begin to bridge together the supply and demand sides.

Eventually, the current broadband ISP model may look as antiquated as dial-up ISP is today. The industry will polarise into two extremes: highly-packed experiences, like a ready-made meal. These come as part of a device or an e-commerce service. The other is totally unpackaged 'grow and cook it yourself', just like a home network today doesn't need any kind of service provider.

Neither is intrinsically good or bad, but either way the system we currently think of as 'the Internet' will be tomorrow's cold leftovers.

This article was originally published as a Future of Communications newsletter.
Written by Martin Geddes, Founder, Martin Geddes Consulting Ltd
Follow CircleID on Twitter
More under: Access Providers, Broadband, Telecom, Web
Study Reveals Economic and Societal Benefits of Establishing IXPs in Emerging Markets

Posted: April 18th, 2012, 4:35am WST by CircleID Reporter

The Internet Society today published the results of a study that demonstrates the far-reaching economic and societal benefits of establishing Internet Exchange Points (or IXPs) in emerging markets. The study, commissioned by the Internet Society and conducted by independent strategy and research consultancy, Analysys Mason, examined the critical cost and performance benefits of IXPs in Kenya and Nigeria — two sub-Saharan countries that have been on the leading edge of Internet growth in Africa.

"Many emerging markets do not have well-established IXPs, forcing domestic Internet traffic onto long-distance international links, resulting in significantly higher costs and latency."
Follow CircleID on Twitter
More under: Access Providers, Broadband
Why SOPA Defender Joins Internet Society as Regional Director

Posted: April 18th, 2012, 3:50am WST by CircleID Reporter

Paul Brigner – Appointed Regional Bureau Director, North America at Internet SocietyInternet Society recently announced the appointment of former chief technology officer of Motion Picture Association of America (MPAA). The decision has raised concerns within the Internet community as Paul Brigner had campaigned for SOPA while at MPAA as well as being on record opposing net neutrality while being an official at Verizon.

Cory Doctorow of the Guardian who has been investigating the story says a good case has been made for him being the right man for the job. Doctorow writes:

"I asked Brigner whether his statements about DNS blocking and seizure and net neutrality had been sincere. 'There are certainly a number of statements attributed to me that demonstrate my past thoughts on DNS and other issues,' he answered. 'I would not have stated them if I didn't believe them. But the true nature of my work was focused on trying to build bridges with the technology community and the content community and find solutions to our common problems. As I became more ingrained in the debate, I became more educated on the realities of these issues, and the reality is that a mandated technical solution just isn't a viable option for the future of the internet. When presented with the facts over time, it was clear I had to adjust my thinking.'"
Follow CircleID on Twitter
More under: DNS, DNSSEC, Internet Governance, Net Neutrality, Policy & Regulation
Department of Commerce Begins Re-Solicitation for IANA Contract

Posted: April 18th, 2012, 2:35am WST by CircleID Reporter

In follow up to the cancelation of IANA Contract RFP last month, the United States Department of Commerce (DoC), National Telecommunications and Information Administration (NTIA) have just issued solicitation of the contract. Details in the notice include:

The United States Department of Commerce (DoC), National Telecommunications and Information Administration (NTIA) intends to award a contract to maintain the continuity and stability of services related to certain interdependent Internet technical management functions, known collectively as the Internet Assigned Numbers Authority (IANA). The anticipated period of performance of this contract is October 1, 2012 - September 30, 2015.
Follow CircleID on Twitter
More under: ICANN, Internet Governance, IP Addressing, Policy & Regulation
What Ever Happened to the Closed Local Internet Registries?

Posted: April 17th, 2012, 11:51pm WST by Mirjam Kuehne

Since the establishment of the RIPE NCC, 5,000 Local Internet Registries (LIRs) have closed (see: From 80 to 8,000 - The Growth of the RIPE NCC). We wanted to find out why. Many of them were probably victims of the burst of the dotcom bubble. But how many? And which countries were mostly affected? How many closures were the results of mergers? We've got answers below.

How many LIRs that started up during the dotcom bubble have since closed?

If we define the dotcom bubble as the three years between 1999 and 2002, then 978 of dotcom LIRs have since closed. This accounts for 36% of all closed LIRs. The reason for closure could be anything from not paying invoices, stopping their business, renaming, merging or being taken over (see some more details on reasons for closure below). As you can see in the image below, around 50% of those LIRs were located in the UK, Germany, Russia, Italy and the Netherlands.

What are the reasons for closing an LIR?

It is difficult to reliably determine the reasons why LIRs stop doing business. To get an idea, we looked at a sample of all LIRs that opened in the UK during the dotcom bubble and that have since closed. This might not be a representative sample, but it adds up to 15% of all closed LIRs that opened during the dotcom bubble years. It at least gives an indication of the various reasons why LIRs closed.

In the image below you can see that almost 50% of all closures were caused by non-payment. Nearly one-third of the LIRs that closed, merged with or were taken over by other LIRs. Around 20% of the LIRs closed for other reasons, often because they decided to stop their business.

How long were closed LIRs operational?

We also looked at the time LIRs were operational before they closed. In the image below, you can see that the majority of LIRs were open for less than five years. But there are also a number of LIRs that were in operation for over 15 years. Some of them were probably taken over or merged into other organisations and might still be around in some form. The average time that a now-closed LIR was a member of the RIPE NCC is 4.3 years.

We also looked at those LIRs that opened during the dotcom bubble. Their average life-span was very similar: 4.6 years. That means that the dotcom generation does not behave that different from others; we just saw many more signing up during those days.

For more information and statistics, please refer to the background article on RIPE Labs: Why Do LIRs Close?
Written by Mirjam Kuehne
Follow CircleID on Twitter
More under: Registry Services
DNS Resolution, Browsers & Hope For The Future

Posted: April 17th, 2012, 5:17am WST by Andrew Sullivan
DNS is not something that most people think about when using the Internet. Neither should they have to: the DNS is just part of the infrastructure in the same way that IP addresses are. The only time a user ought to notice the DNS is when it breaks (and it should never break).

If that's true, then we ought to expect any Internet client — including web browsers — to use the very same infrastructure as everything else and for the DNS resolution mechanisms to be the ones offered by the operating system. What makes browsers different?

If we think about the way browsers work, we can see what the difference is.

First, browsers usually have a real human in front of them and people are very sensitive to any delay in getting what they want. In order to reduce such delays, many web browsers want control over the way the DNS is used. A shared facility from the operating system doesn't provide that control.

Second, native resolver libraries offer programmers a minimal interface called getaddrinfo(), a part of the POSIX standard. This interface blocks: if the application wants to resolve more than one name at a time, it needs to make several separate calls to getaddrinfo(). That technique can cause overloading on upstream resolvers, which might regard the many parallel requests as an attack (and stop responding).

When that happens, it looks (to the user) like the Internet connection is slow or has failed. Moreover, getaddrinfo() does not provide a way to know how long the DNS record is allowed to be cached (the time to live or TTL); so the application can't tell how long it is safe to use the result.

Third, browsers have a security problem that most other systems don't have. Many things that "run in the browser" are actually really separate clients with examples including Adobe's Flash and every Java applet. In order to mitigate some of the inherent problems with this, browsers have adopted a strategy called "pinning" that is very similar to a DNS cache.

As attacks have become more clever, the pinning policies have become more sophisticated. The inevitable effect of pinning is to treat results from the DNS differently than the authoritative DNS server's TTL (even if the TTL were available to the application).

The pressing need

Chromium (the basis for Chrome) now has its own experimental stub resolver inside the browser. The Mozilla project, which produces Firefox, has not gone quite that far yet but the topic comes up from time to time. Yet putting a resolver in every browser, tempting though it might be, is not a good idea. Instead of having one or two well-known but problematic ways to do end-point DNS resolution, stub resolvers inside applications gives us even more. That's more redundant code with subtle incompatibilities and bugs, surprising and inconsistent behavior and features that don't overlap.

DNS resolution is part of the infrastructure and making it part of an application undermines the layered approach that has made networked applications so strong. The need to deliver a robust, cross-platform, reliable system that solves applications' needs is urgent. To their credit, the browser manufacturers know all this. But they have a real problem to solve and quickly.

What is to be done?

A large part of the problem as things stand is that applications — in this case, browsers — can't get the information they need from the operating system facilities and those facilities are inadequate anyway because they block. This doesn't even consider the services and features that could be available if applications could take advantage of knowledge about DNSSEC validation.

Application designers need a stable, high-performance, non-blocking API so that the full richness of DNS data is available to them and under difficult performance constraints. The DNS operating environment has changed over the years and the operating system environment is also diverse. But applications are still stuck with the minimal interface offered by POSIX. That needs to change.

The way forward is for people who know about the DNS, but who are not end-user application developers, to collaborate with those end-user application developers. Together we need to develop a new widely-available, cross-platform API that solves the problems applications have. Performance needs to be tunable by applications so that timeouts do not take a long time (the "happy eyeballs" requirement).

The API needs not to block, so that an application does not have to sit forever waiting for an answer that may never come. All of the data available from deep in the DNS guts needs to be available for the application to use. But this API must not require application designers to become experts in the DNS, how it works, or its arcane formats.

This is a tall order, but it isn't impossible. Most of the Internet today has been built up with many layers, so that applications can do complicated things without understanding all the details. We need to do this again for DNS.

Now is the ideal time to do it. DNSSEC is still in the relatively early days of widespread adoption and standards for building services on top of DNSSEC are just being finalized. Browser makers are starting to run into the limitations of their traditional approaches to many of these issues and so they may be amenable to thinking about better ways of doing things.

Ok, so just do it already.

If the issues are so obvious, what's the problem? There are two.
- The people who work on DNS and the people who work on applications often have very different interests and problems. It is hard to get such people to work together on a problem, not because they disagree but because they talk past one another.
- In order to get something useful, a large amount of work needs to be done. Until all (or at least most) of the important work is complete, the new API will not be useful. That means that early testing and deployment will not happen.
Despite these barriers, we as an industry must find a way to get this work done. The current direction is unsustainable and as the name space expands, it will get worse. We cannot afford to wait or to keep tinkering at the edges.

Skeptics say that it can never happen. The DNS environment is too polluted. Hotels and web cafés and home gateways and a million other devices will continue to interfere in DNS transactions and make deployment impossible. But applications need origin policies actually linked to the domains they are talking to — not to lists of special domains and not to cache times that seem like a good guess, but to the real, verifiable data from the DNS.

Customers demanded Internet access in hotels in the past. If it's important enough, customers will demand reliable Internet access in hotels in the future. We need to make reliability a core value. Since it is now that the root is expanding and now that the attention to web security is more acute than ever, now is the time to strike. We can create a more usable, more sustainable and friendlier system to sit under every other Internet transaction.
Written by Andrew Sullivan, Director of Labs at Dyn
Follow CircleID on Twitter
More under: DNS, DNSSEC, Web

IGP Blog

CFP: Seventh GigaNet Annual Symposium

Posted: April 17th, 2012, 3:10am WST by admin
The Global Internet Governance Academic Network (GigaNet) is seeking submissions of research to be presented at its Seventh Annual Symposium to be held on 5 November 2012, one day before the United Nations Internet Governance Forum (IGF) in Baku, Azerbaijan.

Since 2006, GigaNet has organized an Annual Symposium to showcase research about Internet Governance. The GigaNet scholarly community is interdisciplinary, and includes computer science, law, political science, economics, communications, information studies and others. As in previous years, the symposium will provide room to discuss current and future questions as well as the challenges encountered and results achieved in Global Internet Governance.

GigaNet is interested in receiving abstracts related to the following topics:
- Internet policies on freedom of expression (censorship, kill-switches, filtering, policies that promote free expression, corporate social responsibility)
- Internet freedom and governance in regions in transition (Arab region, etc.)
- From PIPA to ACTA: National and international agreements on online copyright enforcement
- Cyber-security, the state and international relations
- Dataveillance and privacy – the economic perspective
- Global Internet infrastructure policy (net neutrality, peering and interconnection, ASN assignment, routing infrastructure security, etc.)
- Innovative methods for Internet Governance research
- The role of the UN and intergovernmental institutions in global Internet Governance
- Research on the implementation or effects of ICANN’s new gTLD program
- IP addressing: economic and technical challenges of scarcity and governance
- Internet governance and development
Other topics not on the list are welcome as long as they fall within the field of Internet governance studies.

Interested scholars should submit abstracts of research paper no later than 20 May 2012, at the Easy Chair platform: [www.easychair.org] .

The Program Committee members will evaluate the abstracts submitted and decisions will be sent to applicants by email before 15 June 2012.

Accepted papers for oral presentations should be followed by a full research paper to be sent by 30 September 2012.

Please read the complete Call for Papers (Seventh GigaNet Annual Symposium CFP (56)) for submission details.

CircleID

When No Action Is the Wisest Action (ICANN Does Good)

Posted: April 16th, 2012, 11:45pm WST by Milton Mueller

Although ICANN is now getting a lot of ridicule for the "glitch" in its TLD application System, it deserves some praise and respect for the results of its April 10 board meeting. In that meeting, the board showed the involved community — and the rest of the world — that it is no longer going to be stampeded by extra-procedural political pressure to make yet another round of hasty amendments to its new TLD program's policies and procedures. It passed two resolutions which, in effect, did nothing. That is, the resolutions refused to enact any more changes in the Applicant Guidebook. And in this case, nothing was exactly the right thing to do.

The board's April 10, 2012 "Resolution on defensive applications for new TLDs” was a response to trademark holders who had been worked into a lather by opportunistic lobbyists who had told them, without any real basis, that they would be forced to defensively register a new gTLD simply to protect their brand. The resolution's numerous "whereas" clauses patiently explain that "cybersquatting [is] not likely to be a significant issue in the registration of top-level domain names" and that there are many protection mechanisms already embedded in the new gTLD program. It politely suggests that those worried about such things should do their homework and learn about those existing protections.

The second resolution, on the "GNSO Recommendation for Protection of Red Cross and International Olympic Committee Names in New gTLDs," was short and sweet. It acknowledged the receipt of the hastily thrown together and controversial recommendation from the GNSO to enact sweeping new rights to names for two privileged international organizations, the International Olympic Committee and the International Red Cross. And the board simply resolved that "the New gTLD Program Committee chooses to not change the Applicant Guidebook at this time."

This blog covered the clash over the GNSO Recommendation. It noted that industry representatives, in order to appease the Governmental Advisory Committee (GAC) and in complete violation of ICANN's notice and comment procedures, had railroaded through what amounted to new international law regarding name protections. In the process, they ignored objections from other international organizations and complaints from Greek government officials from Olympus. Implementing those recommendations would have opened a Pandora's box. It is excellent that the Noncommercial Stakeholder Group's principled stance against the recommendation, which earned them so much enmity from the other GNSO Council members, was vindicated by the board.

Hopefully, the board is signaling to the US government, to the US Congress, to the US-centered trademark lobbyists and to the GAC that enough is enough. The new gTLD program went through 6 years of policy development, all stakeholders were fully represented in the process, huge and unearned concessions were made to various special interests, and the thing is over and done with. There should be — there will be — no more pandering to last-minute lobbying putsches by special interests.
Written by Milton Mueller, Professor, Syracuse University School of Information Studies
Follow CircleID on Twitter
More under: ICANN, Internet Governance, Policy & Regulation, Top-Level Domains
TAS Outage Shows Tech Errors Can Happen in Any Organization

Posted: April 16th, 2012, 11:44pm WST by Mohamed EL Bashir

Last week, the Internet Corporation for Assigned Names and Numbers (ICANN) was forced to extend the deadline for the new gTLD application to April 20th, after the application system crashed and the technical issue which enabled some applicants to see file names and user names that belonged to other applicants.

The failure of the TLD Application System (TAS) proved that technical challenges affect even the best. Being a technical organization, ICANN is expected to provide a robust system, bearing in mind the high demand of the new gTLDs. ICANN has received over 500 registrations, and the last minute rush must have tested the system to its limits.

The technical community was outraged by the system failure but ICANN took the best option in extending the deadline by a week to April 20th, giving applicants a chance to finalize their application.

The deadline extension due to the TAS crash unfortunately paints the TAS in a negative light. It's fair for the world to expect ICANN systems to be near 100 percent perfect considering that ICANN is the organization that effectively controls the Internet. It's also fair to expect ICANN to ensure the TAS is robust enough to be able to deal with the deadline day pressure. The crash therefore gives an impression that the TAS may not have been robust enough.

ICANN's decision to extend the deadline is reasonable in the circumstances. It would have been very bad for some applicants to miss the deadline simply because the TAS couldn't allow them to do complete the applications on the last day. Our dotAfrica application was finalized before TAS crash but I'm convinced the extension has won ICANN many friends amongst some applicants, albeit they may not openly admit it.

Here is ICANN's last statement on TAS interruption.
Written by Mohamed EL Bashir, Internet Infrastructure Management and Governance Expert
Follow CircleID on Twitter
More under: ICANN, Top-Level Domains
Apple Under Criticism for Back-Pedaling on IPv6 Support

Posted: April 16th, 2012, 5:17am WST by CircleID Reporter

Apple Computer's AirPort Utility, Version 6.0 was criticized this week at the North American IPv6 Summit for no longer being compatible with IPv6. The previous Version, 5.6, offered IPv6 service by default. "Comcast, for example, is urging its subscribers that are interested in using IPv6 not to upgrade to AirPort Utility Version 6.0 if they use the OS X Lion operating system because of incompatibilities with IPv6."
Follow CircleID on Twitter
More under: IPv6

IGP Blog

When no action is the wisest action (ICANN does good)

Posted: April 15th, 2012, 8:02am WST by Milton Mueller

Although ICANN is now getting a lot of ridicule for the “glitch” in its TLD application System, it deserves some praise and respect for the results of its April 10 board meeting. In that meeting, the board showed the involved community – and the rest of the world – that it is no longer going to be stampeded by extra-procedural political pressure to make yet another round of hasty amendments to its new TLD program’s policies and procedures. It passed two resolutions which, in effect, did nothing. That is, the resolutions refused to enact any more changes in the Applicant Guidebook. And in this case, nothing was exactly the right thing to do.

The board’s April 10, 2012 “Resolution on defensive applications for new TLDs” was a response to trademark holders who had been worked into a lather by opportunistic lobbyists who had told them, without any real basis, that they would be forced to defensively register a new gTLD simply to protect their brand. The resolution’s numerous “whereas” clauses patiently explain that “cybersquatting [is] not likely to be a significant issue in the registration of top-level domain names” and that there are many protection mechanisms already embedded in the new gTLD program. It politely suggests that those worried about such things should do their homework and learn about those existing protections.

The second resolution, on the “GNSO Recommendation for Protection of Red Cross and International Olympic Committee Names in New gTLDs,” was short and sweet. It acknowledged the receipt of the hastily thrown together and controversial recommendation from the GNSO to enact sweeping new rights to names for two privileged international organizations, the International Olympic Committee and the International Red Cross. And the board simply resolved that “the New gTLD Program Committee chooses to not change the Applicant Guidebook at this time.”

This blog covered the clash over the GNSO Recommendation. It noted that industry representatives, in order to appease the Governmental Advisory Committee (GAC) and in complete violation of ICANN’s notice and comment procedures, had railroaded through what amounted to new international law regarding name protections. In the process, they ignored objections from other international organizations and complaints from Greek government officials from Olympus. Implementing those recommendations would have opened a Pandora’s box. It is excellent that the Noncommercial Stakeholder Group’s principled stance against the recommendation, which earned them so much enmity from the other GNSO Council members, was vindicated by the board.

Hopefully, the board is signaling to the US government, to the US Congress, to the US-centered trademark lobbyists and to the GAC that enough is enough. The new gTLD program went through 6 years of policy development, all stakeholders were fully represented in the process, huge and unearned concessions were made to various special interests, and the thing is over and done with. There should be – there will be – no more pandering to last-minute lobbying putsches by special interests.

Veni Markovski - The Blog

Свободата в България и по света е под обсада

Posted: April 14th, 2012, 9:46am WST by Veni Markovski | Вени Марковски

Публикувам пълния текст на интервюто, което дадох за вестник “Преса”, излязло на 30.03.2012 г. в печатното издание, стр. 14-15. Б.м.- Вени Марковски.

Интервю на Мариела Балева с председателя на българското „Интернет общество“ за политическите капани, за опасностите над световната мрежа и за слушането „какво каза Брюксел“

Вени Марковски е юрист, председател на „Интернет общество – България“. Един от пионерите на Глобалната мрежа в страната (започнал работа от 1990 г.), журналист, автор на стотици статии в българската и световната преса. Доби популярност с борбата и с успешното съдебно дело срещу кабинета „Костов“ за отмяна лицензирането на Интернет операторите през 1999 г. От 2005 г. живее между САЩ и Европа и работи в областта на киберсигурността и обществената политика в Интернет.

- Как изглежда България от Вашингтон, г-н Марковски? Пък дори погледната от Фейсбук или Туитър?
- На моменти изглежда трагично, на моменти – прекрасно. Ако човек почне да го мъчи носталгията обаче, достатъчно е да прочете някое изказване на произволен наш управляващ политик, за да му мине.

- Влизайки в профила и в блога ви човек разбира, че сте доста по-информиран за ставащото в страната ни. Кое е това, което не ви дава мира и отвъд океана?
- Аз отдавна съм в мир със себе си – сега просто се забавлявам да гледам и да виждам. Хората у нас гледат, но малцина виждат. Дори и тези малцина – виждам! – не могат да го правят винаги и от време на време изпадат в капаните на властимащите.

- Ядосват ли ви политиците – наши и чужди, и за какво?
- Не, нашите не ме ядосват, а ме развеселяват. Същото настроение се получава, ако човек гледа щатската „Фокс нюз“ – празнословие, опаковано в същата форма, в която на българите им се сервират новините: „Ние сме единствените, които ви казват истината, не ги слушайте другите, те ни завиждат“.

- Какво мислите за Стратфор или както още го наричат „частното ЦРУ“, обслужва ли нечии интереси. Между другото, сайтът “Биволъ” ви нарича агент на Стратфор, че имате връзки с тайни служби?
- Не коментирам пасквилите на “Биволъ”. Ако някой от вас, сериозните журналисти, се занимава с ровене и четене на чужда частна кореспонденция, тогава не бих коментирал и това. За мен четенето на чужда поща е нещо, което ми напомня за времената, в които ДС следеше с кого в чужбина, а и защо си кореспондират българите. Не съм работил за Стратфор, така че не са ми известни техните методи на събиране и обработване на информация. Много е смешно да се твърди нещо за мен въз основа на разговори между хора, които не ме познават. Във форумите съм срещал и по-идиотски твърдения от тези, публикувани в “бивол”, така че “журналистите” от този сайт могат да напишат още по-интересна статия, ако само се поровят сами из Интернет, вместо из чуждата поща.

- Евростат ни забъркаха в поредното си гадно изследване – този път са установили, че българите и румънците най-малко в ЕС използват компютър. Съгласен ли сте с това?
- Не съм запознат с това проучване и не мога да го коментирам, но по принцип не споделям мнението, че истината е гадна. Истината е жестока, както е казал поетът. Но на фона на това, че България има най-бързият Интернет в ЕС и един от най-бързите в света, едва ли броят на ползващите компютър трябва да ни впечатлява. По-важно е не колко, а какви хора го ползват.

- И какви хора го ползват?
- За съжаление в Интернет, особено по форумите, се появиха т. нар. Интернет тролове, които използват прийома „ad hominem” (Читателите могат да потърсят подробности за тези две явления в българската Уикипедия) – хора, които се прикриват зад анонимност, но изкарват наяве своята подлостта и понякога меркантилност, пишат срещу други хора, които пък са застанали с името си и са направили някакво твърдение.
Препоръчвам на читателите ви да не обръщат внимание на анонимните коментари по форумите. Препоръчвам на всички да четат това, което пишат сериозните блогъри – хората, които стоят с името си зад публикациите. Има много такива – Иво Инджев, Нели Огнянова, Григор Гачев, Пейо Попов, Боян Юруков, Невена Гюрова, например. Има и няколко анонимни блога, силно критични към властта, които също са забавни и заедно с това много смислени.

- Доколко свободни сме в Интернет? И доколко зависими?
- Свободни сме толкова, колкото можем да си го позволим. Въпросът е има ли граница смелостта ни да търсим свободата на всяка цена. Ако няма такава граница, ако човек защитава позиция, която е вярна и правилна, не може да зависи от нищо.

- След големите протести у нас на 11 февруари срещу АСТА казахте да не се радваме предварително и че АСТА може да бъде вкарана през задния вход. Сериозно ли има възможност това да стане и как?
- Има няколко варианта – най-опасният за момента е, че се подготвят промени в т. нар. регулации в областта на международните далекосъобщения. Не сте ги и чували, нали? Е, това са споразуменията между всички правителства по света за това как, например, да се разплащат телефонните разговори от една в друга държава. В края на годината Международният съюз по далекосъобщенията провежда своята конференция в Дубай, през м. декември, на която може да се вземе решение, например, да има роуминг за Интернет.
Как ви звучи, ако ще трябва да плащате, докато сте в чужбина, за да четете вестниците в България? Темата е много голяма и се надявам, че Уикипедия, Гугъл, а и нашите политици, дай Боже, ще я забележат, защото опасността е днешният Интернет да бъде подменен с междуправителствен, в който водеща ще е сигурността (и дали не най-много тази на управляващите?), а не свободата на гражданите.

- Лесно ли може да бъде убеден един политик, например че АСТА е нещо много хубаво, че е опасно в интернет да няма контрол?
- Лесно е, ако политикът е неграмотен – ако например е учил задочно за даскал по физкултура, няма да разбере нищо по темата. Но това е принципно положение – неграмотните се манипулират по-лесно и това може да обясни защо катастрофата в образованието я извършват целенасочено вече 20 години. У нас специално премиерът доказа, че може да си сменя мнението от сутринта до вечерта и на никой не му прави впечатление, че се върти като фурнаджийска лопата.

- Трудно е да се повярва, че монополите ще оставят нещата просто така? Беше казал, че монополите губят пари, а ние свобода. Бихте ли разшифровали думите си?
- Ако не минат АСТА, СОПА, промените в международните регулации, ние с вас няма да загубим нищо – животът ще е такъв, какъвто си е. Ако минат, ще загубим всичко, защото загубим ли свободата, какво ни остава?

- Всъщност каква е цената на свободата? И тя стока от първа необходимост ли е днес?
- Мнозина у нас са готови да продадат свободата си, защото не са видели особена промяна от времето, когато свободата беше илюзорна до днес, когато е дело на илюзионисти. Днес уж сме свободни да казваме каквото си искаме, т.е. има гласност, но няма чуваемост. Сега думите са загубили стойността си.

- Ако свободата има цена, колко може да струва тя?
- Трудно ми е да говоря за това, защото аз съм се родил във време, в което поне не ми се е налагало да се крия и да говоря за свободата под страха от затвор или концлагер, както е било преди това, а сега живея в страна, в която хората ежедневно се борят за свободата си. За мен свободата е безценна и всеки, който се опита да я оцени по някакъв начин, е обречен рано или късно да стане роб.

- Има ли нещо от което да се откажем в името на свободата и кое е то?
- Вместо отговор, по-добре е да си спомним стиховете на Шандор Петьофи, в които той казва, че има само две неща, които му трябват – любовта и свободата. „Жертвал бих живота безвъзвратно за любов, любовта да дам за свободата съм готов.”

- Между другото някой непрекъснато се опитва да посяга на нашите права и свободи – чрез следене в Интернет, чрез масово подслушване, чрез всякакви форми на насилие. По какъв начин трябва да браним свободата си?
- Свободата в България, а и по света, е под непрекъсната обсада. Не си мислете, че в САЩ нещата са били много по-различни 20 години след основаването на държавата, прокламирала свободата като основна ценност. Робите ги е имало около стотина години след основаването, а жените не са можели да гласуват до 1920 г., да не говорим, че само до преди три години мисълта за чернокож президент сигурно не е минавала през главите на хората. Като сравнява България с някоя друга държава, българинът трябва да знае, че не е достатъчно да се сравнява 2012 г. в България с 2012 г. в САЩ. Ние сме изостанали много от света и трябва да наваксваме много.

- Кои са по-големи манипулатори от европолитиците и от нашите. Защо винаги чакаме да видим какво ще ни каже Брюксел, за да направим нещо?
- И аз това се питам – Бойко Борисов непрекъснато говори за някакъв си Брюксел. Но аз питам: Кой е този Брюксел? Кой го упълномощавал да решава какво да правим ние? А другият „двоен висшист“ на правителството, той пък с неговите „евро-атлантически партньори“? Какви са тези измислени термини, които звучат добре, но са без смисъл? Помислете само – България нормален член ли е на Европейският съюз или е ненормален? Щом политиците ни говорят така: „Брюксел реши“, „евро-атлантическите ни партньори не-знам-си-какво“, значи наистина държавата ни не е нормална и напълно правилно не сме в Шенгенската зона.

- Няколко теми напоследък са особено актуални у нас. Какво мислиш по въпроса за щастливите кокошки? Май яйцата им ни излязоха доста скъпи?
- Мисля, че Щастливия Миро, доколкото разбирам така му е вече прякорът, е най-доволен от това, което се случи. Така де, можеше прякорът му да е друг, далеч по-обиден. Ако трябва да отговоря сериозно – то хората са нещастни, но ето, същият този „лош“ Брюксел, не се е загрижил за тях, а за кокошките. И знаете ли защо? Защото „лошият“ Брюксел знае, че хората трябва да се грижат и за себе си, и за кокошките. Но понеже той е европеец, деликатен, не разбира, че у нас последната грижа на политиците са хората, а първата са кокошките да са щастливи. В казаното от мен има и друг смисъл – нарочно го уточнявам, че да не стане грешка.

- Остава ни да се надяваме Борисов и Дянков да ходят по пазарите по-често, за да падне цената на яйцата?
- Не, остава ни да се надяваме министърът на земеделието и храните да падне, за да не се вдига цената на яйцата. Наистина ли никой не е разбрал, че цената е висока, защото от МЗХ са забранили вноса на яйца от Полша? От същата Полша, от която прочетох, че Щастливия Миро е искал съдействие, звънейки на своя колега, който сигурно го е гледал като империалист – хлебарка: зер, европейските политици могат, за разлика от нашите, да си спомнят какво се е случило вчера.

- На какво ви прилича българската политика днес? Докога ще се объркваме чрез кумирите менте, а кич-идеологиите ще замъгляват съзнанието ни?
Защо да са менте кумирите? Нима Бойко Борисов е менте? Напротив – много типичен представител на Банкя – човек, който е играл футбол и тенис в условията на люта конкуренция. От друга страна, не съм забелязал Цветанов да е станал кумир, така че всичко си е както трябва.
Иначе защо хората се объркват – това го изясни навремето един от фараоните, не си спомням кой. На журналистически въпрос: „Докога ще продължавате да мамите българите?“, той отговори: „Ще ги баламосваме до тогава, докато има балами да се връзват“.

- Каквото и да говорят в парламента, в правителството и т.н. все опират до социализма. Той непрекъснато изниква по всякакъв повод. Кеворкян попита в статия в „Преса“ докога ще ни мъчи този проклетник соца. Докога според вас?
- Още около 83 години – до 2095 г. Не се шегувам. Горе-долу тогава вероятно ще умре последният българин, роден при социализма. Знаем, че навремето Моисей е водил евреите 40 години из пустинята, за да умре и последният, роден в робство. Тогава продължителността на живота е била толкова – 40 години. Сега има доста столетници и макар че социалният и финансовият министър се надпреварват да им понамалят бройката, все пак нашите дядовци и баби не се дават, така че сметката е ясна.

- Във фейсбук сте посочили като любим цитат думите на Васил Левски, казани пред турския съд: „Нашите българи желаят свободата, но приемат я, ако им се поднесе в къщите на тепсия”. От тези думи насам има близо 140 години. Промени ли се с нещо ситуацията?
- Как мислите, променила ли се е?

CircleID

ICANN's New TLD Software Flaw May Have Revealed Rival Bid Detail

Posted: April 14th, 2012, 7:00am WST by CircleID Reporter

The internet naming company ICANN has admitted that rival bidders for highly valuable new internet domains could have seen each others' secret bids because of flaws in its registration software. The company took the system offline on Thursday afternoon, just hours before applications were due to close after being open for more than three months.
Read full story: Guardian Unlimited
Follow CircleID on Twitter
More under: ICANN, Top-Level Domains
After ICANN's TLD Application System Glitch, Communication Is the Key

Posted: April 13th, 2012, 11:59pm WST by Stéphane Van Gelder

There were long faces all over the new gTLD ecosystem yesterday — applicants, consultants and technical operators alike — when ICANN took their Application System (TAS) offline and announced that it would not be brought back up for 5 days.

As a result, the long-anticipated close of the first new gTLD application window was pushed back from April 12 to April 20, 23:59 UTC. You could almost hear the groans of dismay spreading over social cyberspace!

What is going to be interesting to watch now is how ICANN handles itself through this crisis. When the TAS outage was announced, a variety of rumours, from a systems hack to fake glitches so ICANN could rake in an extra week's worth of applicant money, immediately hit the web.

To deal with this, ICANN needs to go into full communication mode! If ICANN is transparent here, then it's just another unfortunate computer glitch. And let's face it, who hasn't had one of those?

Attending an industry event yesterday, I was amazed to hear French registry AFNIC's CEO Mathieu Weill rip ICANN on its inability to keep to its April 12 timeline in a public speech he was giving. This from a man who runs a registry with technical systems that sometimes cause its accredited registrars real headaches… and on who's watch AFNIC has so badly botched its dispute resolution procedure that it was taken to France's (distant) equivalent of the supreme court. As a result, the French government has had to restart a tender process that had seen it award management of Dot FR to AFNIC only two years previously! Ever heard of the parable of the speck and the plank?

What comments like Weill's show is that if ICANN doesn't communicate well on what happened, others will be quick to kick it while its TAS is down.

ICANN may have understood this already. Its COO Akram Atallah posted a note on the ICANN website today to explain that the system had to be taken down because "the TLD application system software that has allowed a limited number of users to view some other users' file names and user names in certain scenarios."

You can imagine the agonising moments in the ICANN office: take the system offline and push back on a date that ICANN itself had set in stone, or risk confidential applicant data leakages. In that light, ICANN's decision to push back on the April 12 date almost starts to look brave.

So the more info ICANN puts out on what happened (why not do daily updates on the ICANN website?), the better its crisis management will be…
Written by Stéphane Van Gelder, General manager of INDOM
Follow CircleID on Twitter
More under: ICANN, Internet Governance, Top-Level Domains
Is the New Top-Level Domains "Technical Issue" a Harbinger of Future gTLD Issues?

Posted: April 13th, 2012, 9:16am WST by Frederick Felman

Does the "technical issue" announced today in ICANN's TLD Application System (TAS) and the subsequent extension of the submission deadline call into question the stability and integrity of the new gTLD program?

This development underscores the notion that ICANN could consider a more metered and staged approach to the introduction of gTLDs in order to guarantee the security and availability of the Internet.

As stated in MarkMonitor's comments on May 10, 2011, and echoed in the comments of many others, "[a] more limited and staged rollout will allow ICANN to assess, and, more importantly, mitigate negative impact of new gTLDs on the security and stability of the Internet, consumers, stakeholders, brand holders, and, for that matter, the Internet as an institution and a critical part of global infrastructure."

Still, there are many details of the new gTLD system to be worked out. In fact, the community has yet to see important details of the program like:

• a provider for the Trademark Clearing House

• a provider and cost structure for Uniform Rapid Suspension System URS

The good news is that there's still an opportunity to re-examine the batching system so as to introduce lower-risk and higher-value new gTLDs and use them as a way to test the waters of these critical systems and programs. This is especially true in the face of criticism of ICANN as in institution.
Written by Frederick Felman, Chief Marketing Officer at MarkMonitor
Follow CircleID on Twitter
More under: ICANN, Policy & Regulation, Top-Level Domains
Mac Hit by Another Wave of Malware… Users in Denial?

Posted: April 13th, 2012, 3:30am WST by Terry Zink

In case you haven't been watching cyber news recently, last week various security researchers published that Macs were infected by the Flashback Trojan and that the total number of infections worldwide was 600,000. This number was published by a couple of blogs.

I debated writing about this topic since we had a previous Mac outbreak last year that initially spiked up, caused Apple to go into denial about the affair before issuing a fix, and then the malware kind of went away. Will this follow the same pattern?

It's not surprising that Apple is in denial about this; they are very tight lipped and reveal very little about their security procedure. To both, them, and their users, the product is perfect. Even in the comments section of the following article, users are skeptical that 1 in 100 Macs are infected; it couldn't really be Macs that are infected, it must be Windows PCs:

Sigh… this 600,000 number is not solid by any stretch and everyone is using it as linkbait all over the Internet.

...

The truth of the matter is no one else has TRULY confirmed this number and it may very well be Windows machines contributing vastly to these numbers.
Their own admission:

"… The difficulty in identifying what kind of machines are connecting to the C&C servers is that when the user agent from the infected computer communicates with the server, it doesn't supply definitive data on the operating system that's installed ... "

The author of this comment obviously has no idea how malware infections are counted. Yes, it is more art than science but a number of 90% or 98% malwares as an estimate does not mean guess. It means that given the total amount of data they have, it probably ranges between 80%-98% Macs. It does not mean that the estimates are off by an order of magnitude and really correspond to Windows machines.

Another comment:

Trojans are NOT viruses! They require a user to be tricked into installing this type of malware onto their own Mac.

This is 2012. A/V companies don't even use the term "virus" anymore, they use the term "malware." There are various types of malware out there and it doesn't matter whether users get infected peer-to-peer, or by drive-by downloads, or some other mechanism.

I personally wouldn't be surprised if the number was far higher or far lower because we are ALL basing these numbers off of ONE company's data set. ONE company's word.

One data set doesn't cut it in the science world. Why are we letting that go in the computer science world right now?

It's worse than that. Not only is it one company's word, it's probably one guy at that company who came up with the number. He probably has some ways of counting everything, shares the number with his managers and with marketing, and that's the number that's reported.

But it's also a reasonable estimate of the total number of infections. Most companies who count data like this have good ways of acquiring it.

No one knowledgeable about the Mac has EVER said that Mac OS X is immune to malware!

No. Most just deny that malware is a problem on the Mac.
Written by Terry Zink, Program Manager
Follow CircleID on Twitter
More under: Malware, Security
ICANN Takes "Fail" To A Whole New Level

Posted: April 13th, 2012, 2:47am WST by Michele Neylon

Today is April 12 2012. It's also meant to be the day that the new TLD application window closes.

Now it's not.

No.

ICANN has spectacularly failed to manage the new TLD process and will miss its own deadline by over a week.

Any prospective new TLD applicant will be greeted with the following message if they try to access the TAS (the online system ICANN provides for submitting new TLD applications):

ICANN's new TLD application system is offline. (Click to Enlarge)In a rather badly worded announcement ICANN states that it's extending the deadline for online applications (the only way to apply) until April 20th at 23:59 UTC.

The announcement was also emailed to existing applicants.

Here's the full text of the announcement:

From: new gTLDs [mailto:do-not-reply@gtld.icann.org]
Sent: 12. april 2012 13:52
Subject: TAS Temporarily Offline

Attention Applicants,

ICANN constantly monitors the performance of the TLD Application System (TAS). Recently, we received a report of unusual behavior with the operation of the TAS system. We then identified a technical issue with the TAS system software.

ICANN is taking the most conservative approach possible to protect all applicants and allow adequate time to resolve the issue. Therefore, TAS will be shut down until Tuesday at 23:59 UTC — unless otherwise notified before that time.

In order to ensure all applicants have sufficient time to complete their applications during the disruption, the application window will remain open until 23:59 UTC on Friday, 20 April 2012.

We apologize for any inconvenience this has caused. If you have any questions, please contact the gTLD Customer Service Center (CSC) via the CSC portal.

If you have any questions, please contact the Customer Service Center here: [newgtlds.icann.org]

Best Regards,
New gTLD Team

What amuses me most is both the email and the announcement are entitled "TAS Temporarily Offline". I run a hosting company and my concept of "temporarily offline" is not offline for 4 days! And this is the same organisation that wants to impose SLAs on both registries and registrars? Seriously?

I previously posted about the "big reveal" and how I thought it would be delayed, as ICANN's track record wasn't exactly stellar.

Guess I've been proven correct!

So what does this mean?

I'm sure some will try to argue that a week's postponement of the deadline isn't that much "in the grand scheme", but others, including myself, would have to wonder about how ICANN invested in systems and infrastructure that were so fragile that they need this much unplanned downtime.

Any takers on my latest crazy prediction that ICANN will announce their new CEO in the next 48 hours to deflect people's attention from this massive screw up?

And for those new TLD applicants who were planning on celebrating the "big reveal" in Vegas, will they be asking for a refund from the hotel?

UPDATE: A couple of applicants have confirmed that the TAS issues were due to its inability to handle certain characters e.g. ">" and "<". So the multi-million dollar new TLD application program was brought to a standstill due to some programmers inability to properly encode and "escape" characters? Seriously?
Written by Michele Neylon, MD of Blacknight Solutions
Follow CircleID on Twitter
More under: ICANN, Top-Level Domains
Software Glitch Causes ICANN to Extend New gTLD Application Deadline

Posted: April 13th, 2012, 12:52am WST by CircleID Reporter

Due to unusual behaviour with the operation of its TLD Application System (TAS), ICANN announced today that it has shut down the system until Tuesday. ICANN has also extended the submission deadline: "In order to ensure all applicants have sufficient time to complete their applications during the disruption, the application window will remain open until 23:59 UTC on Friday, 20 April 2012."

Update: Apr 20, 2012 – ICANN's Vice President and Chief Security Officer Jeff Moss in a video interview describes the glitch that led to ICANN's take down of the application system for new generic top-level domains (gTLDs). Moss describes the glitch, and elaborates on how ICANN technical teams are working to test a fix for the issue that led to a temporary suspension of the application system on 12 April.

Follow CircleID on Twitter
More under: ICANN, Top-Level Domains
The Advanced Persistent Threats (APT) Deception

Posted: April 12th, 2012, 7:35am WST by Gunter Ollmann

Most of the good thrillers I tend to watch have spies and assassins in them for some diabolical reason. In those movies you'll often find their target, the Archduke of Villainess, holed up in some remote local and the spy has to fake an identity in order to penetrate the layers of defense. Almost without exception the spy enters the country using a fake passport; relying upon a passport from any country other than their own.

Like any good story, there's enough truth to the fiction to make it believable. Take the real-life example of the hit squad that carried out the assassination of a Hamas official in Dubai early 2010. That squad (supposedly Israeli) used forged passports from the United Kingdom, Ireland, France and Germany.

So, with that bit of non-fiction in mind, why do so many people automatically assume that cyber-attacks sourced from IP addresses within China are targeted, state-sponsored, attacks? Are people missing the plot? Has the Chinese APT leapfrogged fact and splatted in to the realm of mythology already?

If you're manning a firewall or inspecting IPS log files, you can't have missed noticing that there's a whole bunch of attacks being launched against your organization from devices hosted in China on a continuous basis. A sizable fraction of those attacks would be deemed to be "advanced"; meaning that as long as they're more advanced than the detection technology you're using, they're as advanced as they need to be to get the job done.

Are these the APT's of lore? Are these the same things that government defense departments and contractors quake in their boots? There's a simple way to tell. If what you're observing in your own logs shows the source as being from a Chinese IP address it almost certainly isn't.

Yes, there's a tremendous amount of attack traffic coming from China, but this should really be categorized as the background hum of the modern Internet. China, as the most populous country on the planet, isn't exempt from having more than its fair share of Internet scoundrels, wastrels, hackers and cyber-criminals — spanning the full spectrum of technical capability and motivations. Even then, the traffic originating from China may not be wholly from criminals based there — instead it may also contain attack traffic tunneled through open proxies and bot infected hosts within China by other international cyber-criminals.

When we're talking about cyber-warfare and state-sponsored espionage, we're not talking about a bunch of under-graduate hackers.

Just about every country I can think of with a full-time professional military force has been investing in their cyber capabilities — both defense and attack. While they're not employing the crème de la crème of professional hacking talent, they are professional and have tremendous resources behind them, and they follow a pretty strict and well thought-out doctrine. If you're in the Chinese Army and have been tasked with facilitating a particular espionage campaign or to aid a spy mission, the last thing on earth you're going to do is to launch or control your assets from an IP address that can be easily traced back to China. Anywhere else in the world is good, and an IP address in a country that your foe is already suspicious of (or fully trusting of) is way better.

Don't get me wrong though, I'm not singling out the Chinese for any particular reason other than most readers would be familiar with the hoopla of Chinese APTs in the media. Any marginally competent adversary is going to similarly launch their attacks from a foreign source if they're planning on maintaining deniability should the attack ever be noticed — just like those spy tactic of using foreign passports.

So, if you're so inclined, how are you going to get access to foreign resources that can proxy and mask your attacks? Elementary my dear Watson, there's a market for that. First of all there's a whole bunch of free and commercial anonymizing proxies , routers and VPN's out there — but they may not be stable enough for conducting a prolonged campaign (and besides, they're probably already penetrated by a number of government entities already). Alternatively you could buy access to already compromised systems and hijack them for your own use.

Over the last five years there have been a bunch of boutique threat monitoring and threat feed companies spring up catering almost exclusively to the needs of various national defense departments. While they may offer 0-day vulnerabilities, reliable weaponized exploits and stealthy remote access Trojans, their most valuable offering in the world of state-sponsored espionage is arguably the feed of intelligence harvested from the sinkholes they control. Depending upon the type of sinkhole they're fortunate to be operating, and which botnet or malware campaign that happened to utilize the hijacked domain, they're going to have access to a real-time feed of known victim devices from around the world, copies of all the data leached from the victims by the malware and, in some cases, the ability to remotely control the victim device. Everything a cyber-warfare unit is going to need to hijack and usurp control of a foreign host, and launch their stealthy attack from.

Now, if I was say working within the cyber-warfare team of the French Foreign Legion or perhaps the DGSE (General Directorate for External Security) and interested in gathering secret intelligence about the investment Chinese companies are making in sub-Sahara mineral resources, I'd probably launch my attack from a collection of bot-infected hosts located within US or Australian universities. The security analysts and incident response folks working at those Chinese companies are probably already seeing attack traffic from these sources off-and-on, so my more specialized and targeted attack would unlikely raise suspicion. Should the targeted attack eventually be discovered, the Chinese would simply blame the US and Australian governments — rather than the French.

Having said all that, you've probably seen movies with double-agents in them too. And it's entirely possible that someone hair-brained enough would argue that China launches attacks from their own IP space because everyone knows that you shouldn't, and therefore the assumption needs to be that attacks launched from China are clearly not from the Chinese government — while they are in fact. How very cunning. Now there's a twist for the next spy movie.
Written by Gunter Ollmann, VP of Research at Damballa
Follow CircleID on Twitter
More under: Cyberattack, Security
Neustar Launches KickStart America Campaign with .US Domain

Posted: April 12th, 2012, 4:42am WST by CircleID Reporter

Neustar, Inc. begins a "Kick-start America” campaign for the .US Top-Level Domain. Companies of all sizes — locally-based or doing business in the United States — are encouraged to demonstrate their local presence with "America's Address."

According to the company, extensive research was performed over the past several months into determining who made up the .US target market… "They are the people you interact with every day. At least, we hope you do. They are the small businesses who are the backbone of America. They are the second generation hardware store in Memphis, the florist shop in St. Louis, the cupcake shop in Austin, the accountant in Topeka."
Kick-start America – Neustar relaunches About.us website and starts extensive branding campaign targeted to consumer target market.
Follow CircleID on Twitter
More under: Domain Names, Top-Level Domains
Intune Collapses the OSI Model

Posted: April 12th, 2012, 1:16am WST by Paul Budde

While a great deal of attention has recently been paid to the enormous amount of change that is taking place at the edge of the network with smartphones, tablets, apps, Web2.0 etc, massive changes are also underway on the network side. The current network has been designed over a period of thirty years and it is due for a serious overhaul to keep abreast of changes in the industry in general.

This new environment is loosely termed NGN (next generation networks).

Irish company Intune Networks is at the forefront of these developments. It has been redesigning the seven-layered OSI model, moving away from a centralised structure and collapsing a seven-layered network down to 2.5 layers. In this way it has built a flat and ultrafast network that is managed through standard web services, making the network dynamic and excellent for virtualised service delivery.

In scaled deployment the network will function like the Apple apps community — all users will develop and configure their own services over a bandwidth-on-demand network, with integrated real-time billing and a very high QoE (quality of experience) for video-centric services, irrespective of access type: fibre, WiFi or LTE.

In simple terms, the core architectural difference is that, rather than bringing all traffic to the centre of a network for distribution, Intune keeps the vast majority of traffic processing at the edge of the network. The new network is therefore highly efficient, perfect for heavy bursts of video traffic, and helps carriers to dramatically reduce their CAPEX/OPEX and power footprint.

Intune's lead customers are Verizon and Telefonica. Verizon is by far the most advanced when it comes to understanding all the new video/cloud services that can be delivered with Intune. Commercial labs trials are underway and field trials in New York and Miami will follow in late 2012. The company is also active in Australia with Telstra, where they are moving into the same stage of relationship as Telefonica. Telstra is, of course, spurred on with the NBN developments in this country and is well advanced in technical innovation.

The next frontier is to understand all the application scenarios in relation to content delivery, video-on-demand and distributed management solutions — linked to data centre interconnect solutions.
Written by Paul Budde, Managing Director of Paul Budde Communication
Follow CircleID on Twitter
More under: Broadband, Internet Protocol
BYOD Woes and Worries

Posted: April 10th, 2012, 12:30am WST by Gunter Ollmann
Like the scene of a movie in which a biblical character holds back the mighty sea and is about to release the tide against his foes, BYOD has become a force of nature poised to flood those charged with keeping corporate systems secure.

Despite years of practice hardening systems and enforcing policies that restrict what can and can't be done within the corporate network, businesses are under increasing (if not insurmountable) pressure to allow a diversifying number of personal devices to connect to their networks and be used for business operations. Bring your own device (BYOD) is the most intrusive trend that security teams have had to face for quite some time.

Unlike other business changes over the years that caused security teams to reevaluate their policies (such as allowing remote users to VPN in to the corporate network or enabling webmail facilities for roaming users), BYOD is being driven by all levels of the corporate hierarchy simultaneously. And it's forcing new changes in the way organizations conduct business and seek to secure themselves.

BYOD is directly forcing the hand of security teams; and those that don't (or can't) accommodate the change are in for a very rough ride indeed.

Organizations that have embraced the approach — allowing employees to bring in their personal devices and engage with business systems — appear to have reaped rewards ranging from increased productivity, through to a lowering of capital expenditure within their IT departments. BYOD is affecting all walks of life. For example:
- Out-of-hours system monitoring and alerting through Android applications that can be trivially loaded on to an employee's Smartphone.
- Larger pockets being added to medical staff's lab coats and smocks to accommodate the iPads they're increasingly carrying around.
- Shared use of cloud storage facilities as employees jump back and forth between personal and corporate devices throughout the day.
Not all businesses have embraced a BYOD culture the same way. In the majority of organizations I deal with, the general security strategy is to treat the device as "untrusted" — typically only allowing the user of the device to connect to the Guest or dirty wireless networks and limiting access to those services or business applications that can ordinarily be accessed remotely (e.g. through a VPN). Meanwhile, a handful have gone 'whole hog' as it were, and are doing away with corporate supplied computing devices; instead they're offering to subsidize the employee's purchase and provide a list of "minimum" security standards for the device.

We are in a transitional period with respect to BYOD strategies and there is a lot of experimentation as organizations strive to achieve a new balance between security and convenience. As such, the security posture of an organization needs to take into account the continuous change going on about it. While it's been a common declaration within the security community that you can't protect the end-point from a determined attacker, as device ownership slips from the hands of the corporate entity into the hands of the employee, so too does the onus for protecting it.

For many organizations the frontline in security for the last two decades has been protecting computers with host-based defenses. Sure, there's been investment in perimeter defenses, but the war between the cybercriminals and their prospective victims has been happening with the operating systems, web browsers and applications of the end device. As such, with control of the end-point device slipping out from control and oversight of corporate security teams, an added emphasis is being placed upon two critical security approaches — securing the core (centralized) intellectual property and data of the organization, and rapidly identifying devices that have already been compromised.

Organizations with a mature security strategy flexible enough to accommodate BYOD demands have pursued an approach in which it is assumed that the user's device is likely (if not already) compromised and under control of an external criminal entity. As such, they have myopically focused their attention on securing the servers that really matter to the business and are securing the system and repositories that govern or track the data itself. In parallel, they've deployed systems that alert and identify devices that are acting suspiciously or are positively identified as being usurped by professional crimeware, and take immediate, automatic steps to restrict and cauterize the threat.

BYOD has forced a paradigm change in the way businesses approach and enforce security within their organizations. Security teams within organizations that continue to resist the adoption and use of personal devices (whether they be personal laptops, Smartphones, tablets or X-Box) are fooling themselves if they think they can hold back the tide. Security consolidation and threat alerting are the ropes they need to grasp.
Written by Gunter Ollmann, VP of Research at Damballa
Follow CircleID on Twitter
More under: Security

IGP Blog

The coming trade war in IP address blocks

Posted: April 6th, 2012, 10:23pm WST by Milton Mueller

An important proposal for inter-regional market transfers of IP addresses has been put before RIPE-NCC, the Internet protocol address registry for the European region. The proposal notes that “there is a significant over-supply of IPv4 in North America versus the rest of the world,” and that “in a global economy, membership in any particular RIR should not be a barrier to acquiring IPv4 Addresses when the source is not within the same RIR region.”

The proposal attaches four basic conditions to inter-regional transfers of address resources:
1. The IPv4 addresses will be used for business purposes and will not be sold within 15 months.
2. The IPv4 addresses will be used to meet current and future operational requirements.
3. The IPv4 addresses will be used in conformance with all provisions of EU Directive 2002/58 Article 13 (Anti-Spam).
4. Where the recipient is in another region, the conditions on the recipient as defined in the counterpart RIR’s transfer policy at the time of the transfer will apply.

The last condition shows how much this policy problem starts looking like a classic trade issue. Think of the region where the seller of the IP address block is registered as the “exporter” and the region where the buyer is located as the “importer.” Members of ARIN, where most of the surplus IPv4 is, would benefit by restricting other North American members from exporting IPv4 address blocks to the Asia-Pacific region or Europe because it would lower the price and increase the supply of v4 blocks available in their own region. By knocking out buyer competition from other world regions, buyers in the ARIN region would benefit from a form of protectionism. Also, ARIN as an organization has an incentive to play the protectionist game. By controlling conditions on inter-regional transfers, ARIN maintains exclusivity over the terms and conditions of a large part of the available IPv4 blocks.

So it is a mistake to give the exporting region the power to define the conditions determining who can or cannot receive exported blocks in other regions. What we need is a globally harmonized IPv4 trading policy, one that imposes uniform conditions on all buyers and sellers in all regions. Yet the regionally fragmented RIR system is probably incapable of passing such a policy. As I have argued in a recent paper, the conflicts of interest among the regional organizations and the members in different regions create huge barriers to the kinds of globalized reforms in IP address policy that are needed now.

The fate of the RIPE-NCC interregional transfer proposal (2012-01), therefore, is very much worth watching. If it fails to get anywhere, it confirms the hypothesis that the RIRs are structurally incapable of adapting to the new world of IPv4 scarcity and IPv6 migration.

CircleID

The Empire Fights Back!

Posted: April 6th, 2012, 4:28am WST by Sophia Bekele

U.S. Reps. Introduce Resolution to Bar UN Regulation of Internet

Even as we increasingly discover that every facet of our modern lives now revolve around, and are dependent on the Internet, for which reason its availability, functionality, safety, stability and security are now of great and continuing concern to all of us. These issues have a profound impact on its overall governance.

To most of us, during the past three decades, the Internet has always been available, stable, affordable and open; and it should continue this way even as it is controlled and administered in a secure manner — and we should all have a say on how it should be governed — based on a largely consensus-driven, multi-stakeholder process. The current debate over the architecture of current and future Internet governance would indeed affect how the Internet evolves and shapes up in the coming years. We all have a stake in that expected outcome.

Some governments continue to push for an ITU-led Internet governance model that is subject to the direct oversight of the multilateral United Nations, and its overarching General Assembly of 193 countries and nation-states. The countries pushing for this would like to see an end to the present model that is entirely a U.S.-government led process (overseen by the NTIA of the Department of Commerce) largely pivoted on U.S.-based institutions such as ICANN, IANA, etc. that is considered too 'open' and 'hegemonic' — that is, by viewing the U.S. as a 'global Internet hegemon', and believing rightly or wrongly that its 'governance' or 'dominance' role over the Internet should be severely curtailed.

The argument in support of the status quo is that U.S.-based organizations such as ICANN already try their utmost to serve a global public interest with a Board of Directors and other Policy Advisory Bodies and Councils that are multistakeholder in composition, and having their membership drawn from many countries and different regions of the world, thus giving global citizens an opportunity to participate in global Internet Governance, for example, in the At-Large Advisory Committee (ALAC) and At-Large Organizations.

If the United States House of Representatives is now introducing legislation to bar the UN Regulation of the Internet, then it only implies one thing. The Empire is fighting back!

It is quite apparent that the U.S. would view UN governance of the Internet as 'anathema'. The U.S. invented the Internet and its potential as an America public diplomacy tool has grown over the years, to the chagrin of those countries that are clamouring for U.N. oversight of global Internet Governance. Moreover, the Internet is already viewed as the birthright of every American, and to subject that right to the external oversight of the UN, and the 'regulatory' voices of other countries would be deemed unacceptable by the U.S. Congress. The battle lines are already drawn.

Irrespective of the geo-political calculations that underpin the intricacies of these global affairs issues, I urge we remains fully committed to the multi-stakeholder model of Internet Governance and should continue to rally unconditional support for it. I believe that this is the only guarantee for an open, stable, secure, and scalable Internet that has already evolved and will continue to evolve and expand to meet the diverse needs of a globalized 21st century society, and this paradigm should be preserved and protected and defended.

An open, inclusive, participatory, multi-stakeholder Internet goes beyond ordinary 'Internet governance', and is really about whether people should be free in a global society. It is all about the Universal Right to Freedom, and the UN, the main guarantor of Human and People's Rights, should not be unwittingly used as a tool to rein in that sacrosanct freedom bestowed on people everywhere by a Free Internet in the name of an ITU-led and controlled Internet governance architecture. Is it not ironic that a multi-lateral UN-ITU led Internet governance process is not aimed at guaranteeing a multi-stakeholder Internet?

On one hand this should be worrisome, but on the other hand, is a food for thought as we all try to follow, and formulate our different opinions in this global debate over the governance of a resource that affects all our lives.

During the recent ICANN International Meeting at Costa Rica which I attended, Mr. Hartmut Glaser, the LACNIC representative and Executive Secretary of CGI had remarked in his opening address: "I believe that Internet use should be steered by the principles of freedom of speech, individual privacy, and respect for human rights..." adding that "Internet governance must be transparent, multilateral, and democratic, with the participation of several segments of society preserving and fostering its collective creation nature." Such a resonant view remains highly representative of the opinions of many in the global ICANN Internet Community who remain deeply committed to a multi-stakeholder Internet governance model anchored on a democratic ethos and the core principles of human and societal freedoms.

Finally, if the Internet was built by the tireless efforts of committed mutistakeholders who contributed millions of 'comments' that resulted in the rapid and sustainable development of its core 'RFC' technologies, architecture and standards, then its governance should also remain perpetually multi-stakeholder-based. Anything short of this would go against the very spirit of the Internet.
Written by Sophia Bekele, CEO of DotConnectAfrica
Follow CircleID on Twitter
More under: Censorship, ICANN, Internet Governance, Law, Policy & Regulation, Privacy
Slowly Cracking the DNSSEC Code at ICANN 43

Posted: April 6th, 2012, 2:40am WST by Ram Mohan

As regular readers know, ICANN holds lengthy, in-depth discussions devoted to DNSSEC at each of its three annual meetings. The half-day session held at ICANN 43 in Costa Rica last month was particularly interesting. What became clear is that the industry is quickly moving into the end-user adoption phase of global DNSSEC deployment.

If you're not a regular reader, I should quickly explain that DNSSEC (Domain Name System Security Extensions) is the next-generation protocol that enables domain name registrants to give their users a more secure, trustworthy experience. Using cryptographic signatures, DNSSEC prevents man-in-the-middle spoofing attacks, such as the one illustrated by the Kaminsky Bug in 2008.

During the session, attendees first heard from various domain name registries. Staffan Hagnel from .SE, the pioneering Swedish ccTLD operator, explained how the registry persuaded its customers to adopt DNSSEC en masse by offering discounts to registrars. When .SE offered a 2.5% discount, he said, it had almost no effect. However, when the registry doubled the discount to 5% for any domain that was signed by the end of the year, DNSSEC adoption jumped from 4,000 domains to 172,000, literally overnight. It now plans to offer a 7.5% discount with the goal to get to 350,000 signed domains by the end of 2012.

On the ISP side of the deployment initiative, Costa Rica delegates heard from Comcast, the large American ISP that took the bold decision to make all of its DNS servers validating resolvers. It has found that 1.75% of the top 2,000 domains requested by its customers are DNSSEC-aware (often, these same domains are also IPv6-compatible). The main issue Comcast has faced is a lack of consumer education. As I previously discussed, some Internet users thought Comcast was at fault when NASA.gov fumbled its DNSSEC key rollover in January.

Comcast's temporary solution to this problem is for a standardized "negative trust anchor" that can be placed into validating resolvers. This enables ISPs to create a manually validated exceptions list and avoid cutting off their customers from websites that have accidental DNSSEC issues.

Attendees at ICANN 43 also heard about PayPal's first-hand experience implementing DNSSEC across its 1,100 domain names. PayPal's Bill Smith explained how signing all these zones took lots of planning and preparation, starting with the company's least-used domains and working up to the popular ones. But, he said, that the experience was "not as hard as we might have thought." The roll out took eight months. He said that the next challenge is creating an effective key rollover strategy. If keys are updated too regularly, it could prove a drain on resources; too infrequently, and institutional DNSSEC knowledge could fade.

PayPal's experiences are those of an early adopter. DNSSEC will become easier over time as experience is gained and better tools become available. Several panelists at the Costa Rica session remarked that the new BIND 9.9 name server software has a feature that enables "bump in the wire" DNSSEC signing, potentially simplifying deployment. There are also managed DNS services, such as Afilias' own, which enable one-click DNSSEC deployment and fully outsourced key management.
Written by Ram Mohan, Executive Vice President & CTO, Afilias
Follow CircleID on Twitter
More under: DNS, DNSSEC, ICANN, Security
Bandwidth is Bust - Managing True Fundamental Network Resources, Not Fantasy Ones

Posted: April 6th, 2012, 2:17am WST by Martin Geddes
In a recent article, I shared the idea that there is a new category of network architecture, the Network of Probabilities. This differs from classical circuits (Network of Promises) or best-effort packet data (Network of Possibilities). I personally believe it's the next revolution in telecoms. What's new is that it provides a trading space for allocating contention between flows, and does this with some novel applied mathematics.

A bit like the progression from 2G to 3G to 4G wireless data encoding, better mathematics can squeeze a lot more out of fixed networks. Indeed, we could say there is an equivalent generational progression in multiplexed fixed networks, from TDM to ATM to IP. In this post, I'd like to lead you a little further along my own journey of enlightenment to the fourth generation of fixed networking, called Contention Management. It's feeling lonely out here right now.

The hard thing to do is to let go of your intuitive beliefs about 'bandwidth' in networks. Packet networks do not have 'bandwidth', just like the sun is not made of 'shine'. We mustn't mistake metaphors for reality. Indeed, in order to get more out of networks, we must transcend the approximation of bandwidth-based thinking to network reality, and adopt a more robust model that is inclusive of both quantity and quality effects.

When better bandwidth is bad

Here are three examples of what happens in real networks when you apply naïve bandwidth thinking to packet networks like the Internet.

Example 1: Your network is working fine, has lots of bandwidth available, but the users keep reporting short outages and poor bandwidth. What's going on?

Example 2: Imagine you have a standard 20 Mbit/sec DSL line from a central exchange to your home. One day, your telco comes along and 'upgrades' you. Now you have a 1 Gbit/sec fibre to a street cabinet, and then say 50 Mbit/sec copper onwards to your home. The fibre is fast, and your copper loop is shorter, so bandwidth goes up. But customers are complaining, and you notice that your online gaming has worse performance than before. What's going on?

Example 3: To speed up application performance to your holiday cottage, you bond together two links, say 3G and a satellite link. Bandwidth goes up. When you test what happens to the applications, you find terrible performance problems. What's going on?

Buffers badly batter bandwidth

Let's see what really happens in networks.

The first is a well-known phenomenon called bufferbloat. When networks saturate, it disrupts the control loops that TCP uses to say 'faster!' and 'slower!' to the end points of the flows. This can lead to all the queues filling up, multiple packets getting lost in a row, and sudden collapses in transmission speed that are experienced at transient outages by users. The network recovers, but only slowly. As fast memory has become cheaper, the queues in routers have become longer, driven by the mistaken belief that it is always better to delay a packet than to drop it. This just makes the collapse bigger, and recovery slower. And more bandwidth makes the collapses more sudden.

When the telco upgraded from a single copper loop to fibre plus copper, it inserted an extra queue. This added new delay effects that undid all the benefits of additional bandwidth for delay-sensitive applications. Furthermore, it allowed 'greedy' applications to stuff that queue with pulsed traffic, which raised loss and delay for better-behaved applications. Hence customer experience got worse, despite more 'bandwidth'.

If you take two network links and bond them, you can run into trouble in multiple ways. For a start, you have done nothing to improve the delay characteristics of the new 'synthetic' combined link. If you fire packets randomly down one or the other link, you get order-reversal, which TCP treats as a loss, and slows down. If you send packets from the same flow down the same link, the still self-contend, but the application may face unexpectedly different characteristics for each flow. So the different loss and delay for audio and video of a Skype call may seriously confuse the encoding algorithm. Furthermore, any outage or transient saturation effect, even momentary, may cause odd oscillations in the traffic that create poor user experience.

As you can see, the explanations require looking at the properties of the queues over short time periods; none of the problems were as a result of a lack of bandwidth. These aren't isolated edge cases, as the problems are endemic.

Networks all have failure modes.

The questions are: how big are they? how to manage them? and at what cost?

The three laws of networking

Rather like the laws of thermodynamics, there are three fundamental laws of networks.
- Quality attenuation exists: Statistically-multiplexed networks are systems with three parameters (load, loss and delay) and two degrees of freedom (typically loss and delay, with load being exogenous). A network is a bit like a piston with pressure, volume and temperature. Set any two, and the third is set for you.
- Quality attenuation is conserved: Loss and delay are conserved. In other words, we can't un-delay a queued packet, or un-lose a dropped one. This conservation works in two ways: attenuation is conserved along any one path, and also at any piece of equipment.
- Quality attenuation is tradable: There is a trading space for loss and delay. At every edge node and transmission link they can be exchanged without increasing overall quality attenuation. However, any other form of trading — between different places, or at different times — inevitably does increase it.
These are not opinions, but are provable matters of mathematical fact.

The trouble with telecom

The telecoms industry is in trouble, because it is fighting all three fundamental laws. Needless to say, in a fight between management and mathematics, the latter always wins.
- Telcos have no idea where quality attenuation is happening. They don't look for it, don't model it right when they do, and don't know what to do when they see quality problems. All too often, the prescription is 'more bandwidth'. It's the equivalent of medieval leeches, but attached to your capex budget.
- Telcos try to put quality back into the system when it's already lost. Quality is a bit like darkness or quiet. You can't go out and get a box of dark to make it un-light, or a spray can of quiet for a noisy place. Likewise, you can't put quality back in once you've lost it. Techniques to hide poor quality, like anti-jitter buffers, just raise quality attenuation. Network compression boxes add more queues and quality attenuation. Content delivery networks have unexpected quality side-effects. Application-layer cleverness to adapt to quality issues just sets off oscillations that push networks into overdrive failure modes.
- Telcos trade quality badly. They can't sell quality of service, because they don't know how to make it. Priority is about giving 'more of the bandwidth' to an application, as opposed to trading loss and delay between flows. The problem is, when you use priority, you typically give too much quality attenuation to the prioritised flows. Given the law of conservation, you've got less to give to other flows. What typically happens is that the non-priority flows enter failure modes and collapse easily. So telco QoS doesn't work at any sensible cost.
This is not the network you are looking for

It's worse than you think.

Telcos all over the world are splurging capex on unnecessary network upgrades to paper over what are often quality issues. So the first thing they do is build out fast, fat pipes, and sell them.

And sell them. And sell them. They are then over-selling the capacity, in the mistaken belief that they sell bandwidth. But you run out of quality a long time before you run out of bandwidth. Applications collapse and customers complain — and the network doesn't yet appear to be 'full'. That was never in the business case. Are you sure this is a safe utility stock still?

And when you do try to explicitly package and sell quality, to mitigate the collapse effects, you get an effect called 'quality inversion'. It's cheaper for customers to buy a fatter, faster pipe with lower packet service times than to buy the 'quality-assured' one. That's a by-product of seeing quality through a bandwidth lens, and mispricing it as a result.

Bye-bye to bandwidth

The bandwidth approach has no means for modelling or managing the failure modes of multiplexed networks. Indeed, it takes infinite bandwidth at infinite cost to have no failure modes. The contention model lets you manage the failures, at a finite cost. Sounds like a good alternative, no?

In a world where capex is constrained, and demand is not, we're going to see an inevitable shift towards getting more out of what we have. The financial and network maths tells us we must manage the true fundamental resources of the network, not fantasy ones.

At the end of the day, there's no contention. Bandwidth is bust.

This article was originally published as a Future of Communications newsletter. Martin Geddes and Dean Bubley are also conducting public workshops on Future of Voice and Telco-OTT Services in London on 26th & 27th April and US East Coast in May 14th-15th. Get the free newsletter, and learn more about the workshops at www.futureofcomms.com.
Written by Martin Geddes, Founder, Martin Geddes Consulting Ltd
Follow CircleID on Twitter
More under: Access Providers, Broadband, Telecom
Feared by the Bad, Loved by the Good: Robin Hood

Posted: April 6th, 2012, 12:42am WST by Philip Sheppard

The eccentricities of California-based ICANN, the allocator of domain names, know few bounds. Based on the best of legal advice, though perhaps not the best of PR advice, it's Board has announced the system for allocating priority in the processing of around 1000 weighty applications for new top-level domain names. It has described the system, with all seriousness, as Digital Archery. A description that just begs for comparison with the English folk hero, Robin Hood.

Those who like me grew up in the UK may recall the lyrics of the 1960s TV series The Adventures of Robin Hood, with Richard Greene as the eponymous hero. "Feared by the Bad, loved by the Good, Robin Hood, Robin Hood, Robin Hood". Here is why to fear Digital Archery.

Not a lot of lottery

One obvious way of fairly allocating a processing order is by random selection. Alas, such wisdom apparently falls foul of California's lottery laws which would not allow the not-for-profit ICANN to operate a lottery. So when is a lottery not a lottery? When it's a game of skill and not chance. Thus ICANN has invented a contest for the muscled longbow archers of the globe to compete with one another. The game, played on-line of course, is to hit a button as close to a fixed time in the Universe as is possible. Those within two femtoseconds win, others lose. Well something like that. ICANN's newly femtoseconds win, others lose. Well something like that. ICANN's newly bought Caesium Clock will ensure better accuracy than the Staff's Sports Day stopwatch.

But if all that is needed is a game of skill why not a quiz with questions such as: "Who will be ICANN's next CEO?"; "How long will the CEO last?"; "What will be the size of ICANN's bank balance at the end of the round priced at $185,000 an application?"

Prince of thieves and master of disguise No we must play Digital Archery. And like Robin Hood, its not enough to be a good marksman, you may need a bit of disguise to smuggle yourself in first to Nottingham Castle or Bastion ICANN. Even now in the cellars of neighbouring hotels and marina-view peasant hovels, merry men may be at work to steal time itself, building chrono-warping servers within a zeptosecond (thank you Wikipedia) of the ICANN treasury.

Will they be thwarted by devices to discover such covert archery? Will rules for allocation by geography strike new fear around the Realm? Tune in to next week's exciting episode.

In the meantime, Sedari's merry men have a cunning plan.
Written by Philip Sheppard, Director of Policy, Governance and Public Affairs, Sedari
Follow CircleID on Twitter
More under: ICANN, Top-Level Domains
IPv6 and Prepaid Electricity

Posted: April 5th, 2012, 12:44am WST by Yves Poppe

When visiting a friend in the UK in my student days some decades ago, he asked me at one point in time if I had some coins to keep the electricity meter going. This was the first and last time I saw a coin activated electricity meter. In my mind, prepaid electricity now essentially belonged to a distant past when Scrooge like landlords would make sure renters did not disappear without paying their electricity bills.

On a recent business trip however, I realized that prepaid electricity has rather adapted well to the modern age with electronic readers and even prepaid cards, just like for telephony. In India, prepaid metering is in fact quite common as is also the case in a number of former British colonies including South Africa. Not only that, the popularity of prepaid electricity is growing as the Times of India reported recently, citing the city of Pune.

Smart grids are a hot topic everywhere including here in Canada where our ITAC Smart Grid Committee is quite active and participation proves interesting. International standards that govern smart meter data exchange are more advanced than widely assumed. A closer look at the PLC G3 spec for example, shows 6lowpan and compressed IPv6 on the network and transport layer. On the application level, we find the data exchange formats with electric meters defined by ANSI C12 in North America and IEC62056 in Europe.

This is not just talk. In a North American first, BC Hydro announced that they would deploy IPv6 smart grid architecture as an element of its Smart Metering Program and started to replace its 1.8 million electromechanical meters. They had looked at Smart Grids since 2005 but the 2010 the BC Clean Energy Act mandated smart meters and thereby provided the impetus needed. Canadian Big Telco ices the IPv6 puck and Big Hydro scores.

The e-age incarnation of the old electricity coin eater even finds renewed respect in the marketplace. A recent study by Pike Research forecasts a growing market with the number of prepaid meters growing from a current 20 million worldwide to 33.7 million by 2017. Another study in the US shows that consumers actually like prepaid and save more than 10% on their electricity bill. In an age where going green and browsing for the best deal are fashionable, the Pike Research forecast might even turn out to be conservative.

Nowadays, my long lost British friend might even be reloading his electricity counter by m-payment. He might shiver if his prepaid voice account ran out and his phone battery was about to die while the lights went dark and the heater turned silent on a damp and humid London winter night.
Written by Yves Poppe, Director, Business Development IP Strategy at Tata Communications
Follow CircleID on Twitter
More under: IPv6
ICANN To Publish New gTLD Applicants On April 30th

Posted: April 5th, 2012, 12:10am WST by Michele Neylon

In a recent press release ICANN has stated that they will publish the list of applicants for new generic Top-Level Domains (gTLDs) on April 30th.

Previously many had spoken of a "big reveal" on May 1st, though that would have coincided with a public holiday in many countries and might have been "missed".

However ICANN CEO, Rod Beckstrom, claims that the organisation had always planned to publish the list two weeks after the application window closed:

"Our plan always has been to publish the list of applied-for strings approximately two weeks after the close of the April 12th application window," said Rod Beckstrom, President and CEO of ICANN. "Setting a target date gives people the opportunity to plan for this highly anticipated event."

Whether ICANN will be able to stick to the now published date of April 30th is debatable and even their own press release suggests that they aren't 100% confident that they'll be able to meet the target date they've set.

Beckstrom also noted that if ICANN receives an overwhelming number of applications to process, publication of the list of strings could be postponed.

The organisation has been criticised recently for its punctuality with respect to publishing documents and materials, while the IPC's latest comments on Conflicts of Interest reveal a level of frustration with public participation:

The IPC has a strong interest in improvement of ICANN's conflict of interest policy.

However, it finds itself unable to offer substantive comments at this time for the following reasons.

I guess we'll know (or we won't) in the next few weeks.
Written by Michele Neylon, MD of Blacknight Solutions
Follow CircleID on Twitter
More under: ICANN, Top-Level Domains
From 80 to 8,000 - The Growth of the RIPE NCC Membership

Posted: April 4th, 2012, 12:52am WST by Mirjam Kuehne

The RIPE NCC is 20 years old and it now has over 8,000 members. In this article we are looking at the growth curve and the composition of the membership: what industry do RIPE NCC members come from today.

The RIPE NCC became the first Regional Internet Registry in September 1992 (six months after it was set up as the secretariat for the European operators community, RIPE). During the course of 1993, the distributed IP allocation system was established in which Local Internet Registries (LIRs) received blocks of IP addresses from the RIPE NCC which were then further assigned to their customers and others who wanted to connect to the Internet.

By the end of 1993, there were 83 LIRs registered as members of the RIPE NCC. Most of these LIRs were operated by academic networks and the first commercial ISPs that started around that time in some European countries.

Now, 20 years later, 8,000 members are registered with the RIPE NCC (March 2012). The RIPE NCC's membership has been steadily growing since 1998 when it passed the 1,000-member milestone, followed by 3,000 in 2001 and 6,000 in 2008 (as you can see in the graph below).

It is interesting to note that despite the fact that IPv4 is becoming very scarce, we still see a large number of organisations join the RIPE NCC. In fact, in the first quarter of 2012, we saw the highest number of new membership applications ever. In 2011, we experienced the highest growth since the dot com bubble around the year 2000. Also, that the graph only shows the number of LIRs that were active at any point in time. It doesn't show any of the members who closed in the meantime (if we counted every registry ever opened, we would be looking at a total of over 13,000).

In the graphic below, you can see which industry area our members are from. Note that this is a self-chosen category and it is possible to choose more than one category. Organisations that provide the following services are highest on the list: service hosting, collocation and broadband. But Telecom operators, dial-up service providers and transit providers also make up a big portion of the RIPE NCC membership. There are also quite a number of government institutions are members of the RIPE NCC.

It is also interesting that currently the same six countries account for 50% of the membership, 50% of the number of IPv4 allocations and 50% of the number of IPv6 allocations in the RIPE NCC service region. For more information, please refer to the background article on RIPE Labs: RIPE NCC Membership from 80 to 8,000
Written by Mirjam Kuehne
Follow CircleID on Twitter
More under: IP Addressing, IPv6, Regional Registries
Global Payments Breach Confirmation

Posted: April 3rd, 2012, 3:27am WST by Gunter Ollmann

This morning, Global Payments held a conference call with investors and analysts covering their earlier breach announcement and projected earnings. Global Payments had also released an update advisory yesterday stating that "the company believes that the affected portion of its processing system is confined to North America and less than 1,500,000 card numbers have been exported" and that only Track 2 card data may have been stolen.

In discussing the breach, Paul Garcia, Chairman and CEO of Global Payments, reiterated that the investigation is ongoing, but that the 1.5m stolen card details likely represents an upper bound to the loss and that it only affected a "handful" of North American servers (i.e. this was not a Merchant breach). At this point, they are not aware of any fraudulent transactions related to the data theft.

Obviously, given the fact that they self-reported a breach, Global Payments is no longer Visa PCI certified and must now attempt to re-earn their ROC (Report on Compliance). Although they're not Visa PCI certified, that doesn't mean that they cannot process Visa cards — rather that, by being non-compliant, they will be liable for fines and additional losses. When asked during the call as to the likely charges and liability of the breach, listeners were reminded several times that the investigation is continuing and that the company has sufficient insurance to cover prospective liabilities. It was stated that Mastercard may take similar PCI certification actions.

I thought it was interesting that Global Payments had received assurances from competitors that they wouldn't capitalize on the breach — since any one of them could be similarly affected in the future (if not already breached, but undetected so far). I'm not sure how credible that is, and I'd be surprised that some of the competitor's sales folks aren't already independently using the breach to further their own agendas.

Global Payments stressed that, contrary to rumors, this is the first breach that the company has suffered. The breach itself is believed to be contained and was picked up by their server data monitoring and breach detection tools — "just not well enough" (no hints were made as to the nature of the technology deployed).

So, while the forensics investigations continue, what does it all mean? Based on the information disclosed thus far, it sounds like Global Payments is doing everything the right way. They disclosed as soon as they had enough information and confidence in their discoveries to do so. They've been using data monitoring tools to spot breaches — albeit these controls proved to be insufficient to stop the threat and don't sound like they were real-time reporting enabled. They've pulled in experts to help them get to the bottom of the breach. And they're aware of the business consequences — having taken out sufficient insurance to protect against associated liabilities. What's left?

Last week a number of 10,000,000 had been thrown out as to the size of the theft. It now appears that 1,500,000 cards were stolen. No discussion was provided as to what other data had been exposed (i.e. no "evidence" that it had actually been stolen). Regardless, while 1.5m is less than 10m, it's still a damned big number and it will cost the card distribution agents quite a bit of money to clean up and reissue cards — all of which Global Payments will need to cover. I think that lessons have been learned from the big data breaches like TJX, but it would appear that the cost of a breach is largely independent of the number of cards actually lost.

Global Payments has been deliberately cautious in revealing any details as to how the incident occurred and the nature of the systems that failed to protect against the penetration or alert to the breach. I'd expect that time will shed more light on the attack vectors. It is important that such details are exposed as and when it is prudent to do so. While Global Payments is a multi-billion-dollar enterprise, there are still hundreds of other card clearing houses around the world that could benefit from detailed disclosures of the incident so that they could construct better defenses. While these may be competitors to Global Payments, we — as in you and I — are the potential victims of their inadequate defenses and I'd like assurances that they're doing better than they are today.
Written by Gunter Ollmann, VP of Research at Damballa
Follow CircleID on Twitter
More under: Cybercrime, Malware, Security
The Take Away from Global Payments Breach

Posted: April 2nd, 2012, 4:06am WST by Gunter Ollmann
Global Payments, an Atlanta-based payment card processing firm, announced yesterday that they had suffered "unauthorized access into a portion of its processing system”. Sometime in early March they uncovered the attack, and there are some indications that the breach occurred between January 21st and February 25th of this year.

At the moment there is very little public information relating to the nature of the breach, merely that the details of an estimated 10,000,000 cards (track 1 and track 2 — effectively what's needed to clone physical cards) have been slurped by the attacker(s). Global Payments will be holding a conference call Monday, April 2, 2012 at 8:00 AM EDT. Personally, I'm not expecting much in the way of additional information concerning the method and vectors of the breach to be discussed — but would expect a lot about what they've done to reduce fraudulent use of the stolen card details.

There are a number of unverified reports that a New York City street gang with Central American ties took control of "an administrative account that was not protected sufficiently". Hopefully a little more light will be shed over the following days as to the nature of the breach — less so for closing the case at Global Payments, but more for others to learn from and to not repeat these kinds of mistakes.

When it comes to breaches like this — as in attacks that appear to target large organizations that hold large volumes of easily sellable data in the digital underground — the three most common vectors from my experience are the following:
1. Insider threat – An insider with detailed knowledge of the businesses operations is able to install tools or access administrative accounts that enable large volumes of confidential information to be copied and transported out of the organization — past existing data inspection technologies. Often the transport mechanism is a USB device or a password-protected file that is uploaded to an external Internet server.
2. Crimeware installation – A system within the organization is breached through standard drive-by-download or phishing email vectors and a full-featured crimeware agent is installed. The malicious agent registers itself with a criminal's remote command and control (C&C) server and drops a bunch of stolen data relating to that single compromised host. The criminals inspect the small amount of stolen data and realize that they have access to a host within an interesting organization and turn on some additional functions of the crimeware agent to better enumerate the devices and accounts within the breached organization. Armed with a better understanding of the organization and a number of captured accounts and their passwords, the criminals may begin to remotely access other systems within the breached organization or, more likely, sell access to the device to someone that is more capable and better prepared to hack the victim's network.
3. Remote account access – Somewhere along the line the organization has enabled a number of remote access portals or VPN's to enable staff and business partners to access key servers or update data records. Some of these services have been poorly secured or, most likely, particular accounts have been uncovered and fully enumerated by the attackers. Armed with the accounts user ID and password, the attacker(s) can simply log in remotely and slurp down the data they want.
For organizations likely to suffer from such targeted breaches (whether or not the initial breach was due to an opportunistic or non-targeted infection vector), there are obviously a myriad of technologies and tactics that can be implemented (any typically are) to timely identify and limit the loss from a breach. Some of the most successful approaches I've seen in recent years are the following:
- Canary accounts — Dropping in a number of records that appear to be real in to key databases and record repositories, and carefully monitoring access to these particular accounts. For example, these may be credit cards that exist only within the card processing organization and if any external merchant tries to process a transaction against such a card it would be clear that data has been leaked. These canary accounts can also be used to track data propagation within the network from a data-leakage perspective.
- Administrative accounts that aren't — By including a number of accounts within internal corporate email address books and servers that appear to be administrative (or high privilege accounts), monitoring systems can be set to alert if anyone attempts to email them, or use the accounts to access any server. This will alert the organization to many internal breaches earlier than watching for externally used canary accounts.
- Destination monitoring - By tracking all egress traffic and identifying both anomaly traffic patterns to standard business entities and to "unexpected" destinations, it is possible to gain early warning of a breach in progress.
- Cybercriminal C&C monitoring - The most likely breach vector that the victim organization is going to be able to proactively detect and protect against is going to be against remotely controllable crimeware. By knowing which Internet infrastructure is related to what criminal operators it becomes an automated process of identifying crimeware infected computers operating within their organization and prioritizing their remediation over standard malware infections.
Hopefully most organizations are aware that modern crimeware rarely comes through the front door in an easily inspectable form. Even insider threats have found it increasingly advantageous to use their own crimeware as a method of remotely accessing devices within the targeted organization and transporting the stolen data out. As such there is a need to identify egress traffic associated with crimeware and to instrument the organization to detect canary data records and administrative accounts.

With a bit of luck we'll get more insight to the Global Payments breach over the coming weeks. However, I suspect that it's going to be the same old story again. The cybercriminals have better tools than their victims and are more agile in their deployment and use.
Written by Gunter Ollmann, VP of Research at Damballa
Follow CircleID on Twitter
More under: Cybercrime, Malware, Security
IPv6 DNS Blacklists Reconsidered

Posted: April 1st, 2012, 10:15am WST by John Levine

I opined about a year ago that DNS blacklists wouldn't work for mail that runs over IPv6 rather than IPv4. The reason is that IPv6 has such a huge range of addresses that spammers can easily send every message from a unique IP address, which means that recipient systems will fire off a unique set of DNSBL queries for every message, which will swamp DNS caches, since they won't be able to reuse cached results from previous queries like they can for IPv4 mail.

Now I'm much less sure this will be a problem, because it's not clear that DNSBL results benefit from caches now.

Large and small mail systems access DNSBLs differently. Large systems make arrangements with the DNSBL operators to download their own copies of the DNSBLs they use via rsync or something similar. Then they glom all of the DNSBLs together and typically run copies of rbldnsd on the same local networks as the mail servers so for each incoming message, the mail server can send a local query to rbldnsd and get back one response with all of the DNSBL information relevant to the message. For these systems, a DNS cache provides no benefit because getting the answer from rbldnsd is just as fast if not faster than getting it from a cache. I don't know whether they currently configure their systems not to use caches, but if they don't, it would be technically straightforward. In a world with IPv6 DNSBLs, this would all work exactly the same way, download the DNSBL with rsync and serve it locally with rbldnsd.

Small systems send ordinary DNS queries to the main servers for each DNSBL they use, typically via a local DNS cache. As far as I can tell, caches don't help these systems either, because there isn't enough repeat traffic from the same IP to reuse cached results. It is surprisingly hard to find trace data to test out this theory, but it seems to be true of traffic on my small (100K connections/day) system, and on the few others I've been able to ask. (If you are willing to provide mail server connection traces of timestamps and IP addresses, so I can do more testing, please let me know. Or I can provide test scripts you can run on your own data and see how well your DNSBL queries cache.)

This suggests that DNSBL clients, which are usually mail servers, will be able to use DNSBLs largely the same way they do now, perhaps with modest cache partitioning tweaks to tell the caches not to bother caching DNSBL query results. But that doesn't mean that there's no problems with IPv6 DNSBLs. In the next message, I'll look at problems facing DNSBL operators.
Written by John Levine, Author, Consultant & Speaker
Follow CircleID on Twitter
More under: DNS, Email, IPv6, Spam
Why R&E Networks Should Be Aware of the CDN Interconnect Initiative (CDNI)

Posted: March 31st, 2012, 3:30am WST by Bill St. Arnaud

At the recent IETF meeting there has been considerable discussion about interconnection of Content Delivery Networks.

A lot of this is being driven unfortunately by the incumbent telco/cableco's who never understood CDN in the first place, and now want to assert control over this critical new Internet architecture, much in the same way that they want to take control over open WiFi hot spots as part of an integration strategy with their 3G/4G networks.

R&E networks are the only independent organizations that have the knowledge and independence that can develop alternate strategies that don't assume a "telco/cable uber alles" strategy. A good example is the Eduroam program which is now being used to seamlessly integrate WiFi with 3G/4G on networks like SURFnet, JANET, AARnet etc.

CDNI will be critical to a future anywhere, anyplace, anytime education and research strategy. It will also be critical to those R&E networks that operate transit or internet exchange points for community or anchor institution networks. Most R&E networks have come to realize that CDN and peering is critical to their core business functions. On some networks over 90% of the traffic is CDN and peering. It enables most R&E networks to become self sufficient and yet provide a much lower cost value proposition to their connected institutions, eliminating the dollars per Megabyte mindset of the incumbents.

For more information on this topic see:
A personal perspective on the evolving Internet and Research and Education Networks
OECD report: Internet Traffic Exchange Points
Content Distribution Network Interconnection (CDNI) Problem Statement
Written by Bill St. Arnaud , Green IT Networking Consultant
Follow CircleID on Twitter
More under: Telecom
U.S. Outgunned in Hacker War

Posted: March 31st, 2012, 1:59am WST by Terry Zink
The Wall Street Journal has an interview with the outgoing head of the FBI's cyber crime investigation Shawn Henry. In it, he has a blunt assessment of the US's capabilities when it comes to combatting online crime, especially data theft and hacking. The article jumps around a bit because it lumps in the Anonymous data hacks with cyber espionage conducted by the Chinese. While both involve hacking, the motivations for each of them are very different:

WASHINGTON — The Federal Bureau of Investigation's top cyber cop offered a grim appraisal of the nation's efforts to keep computer hackers from plundering corporate data networks: "We're not winning," he said.

Shawn Henry, who is preparing to leave the FBI after more than two decades with the bureau, said in an interview that the current public and private approach to fending off hackers is "unsustainable." Computer criminals are simply too talented and defensive measures too weak to stop them, he said.

...

Mr. Henry, who is leaving government to take a cybersecurity job with an undisclosed firm in Washington, said companies need to make major changes in the way they use computer networks to avoid further damage to national security and the economy. Too many companies, from major multinationals to small start-ups, fail to recognize the financial and legal risks they are taking — or the costs they may have already suffered unknowingly — by operating vulnerable networks, he said.

...

High-profile hacking victims have included Sony Corp., which said last year that hackers had accessed personal information on 24.6 million customers on one of its online game services as part of a broader attack on the company that compromised data on more than 100 million accounts. Nasdaq which operates the Nasdaq Stock Market, also acknowledged last year that hackers had breached a part of its network called Directors Desk, a service for company boards to communicate and share documents. HBGary Federal, a cybersecurity firm, was infiltrated by the hacking collective called Anonymous, which stole tens of thousands of internal emails from the company.

...

Testimony Monday before a government commission assessing Chinese computer capabilities underscored the dangers. Richard Bejtlich, chief security officer at Mandiant, a computer-security company, said that in cases handled by his firm where intrusions were traced back to Chinese hackers, 94% of the targeted companies didn't realize they had been breached until someone else told them. The median number of days between the start of an intrusion and its detection was 416, or more than a year, he added.

The more I read around the Internet, the more clear it's becoming at how cyber security is becoming a central focus. This has pretty big implications for the cloud. Companies who provide cloud services, like Amazon and Microsoft, store not just their own data there but the data of lots and lots of people from all sorts of organizations there. That presents a serious risk for these types of companies and they must provide mechanisms to:
1. Protect data by classifying data (something I've written about many times on this blog) and encrypting highly sensitive data.
2. Restrict access to the data, or at least have procedures and processes for granting it (we're going through this right now and it's a pain-in-the ***).
3. Harden the perimeter from attacks from the outside by implementing a Secure Development Life Cycle (SDLC) which forces developers to think about security. For example, our own SDLC makes people think about sanitizing user input when accept data from a web page. I'd say that this bullet point is more important than (2) (but I am biased).
I am biased towards Microsoft's policies because I work here and am familiar with them, but they do seem to have better privacy controls than other big companies like Apple, Google or Facebook, and their SDLC has been copied by other companies, notably Adobe.

The other security meme is "Assume you've been breached." This is something that is less relevant for the cloud. Whereas companies who protect data in the cloud are usually protecting customer data like medical information, credit cards, and other PII, most companies prefer to keep their Intellectual Property in-house. If you're paranoid like me, you wouldn't want to store your uncompiled algorithms and source code on Amazon's web servers (or maybe you would, what do I know?).

But if you assume that you've been breached, what applies? Well, you need to come up with ways to detect breaches like searching for abnormal behavior among users, unauthorized logins, having securing policies for users, and so forth. I'm not as much the expert in this area but I do find it interesting. But those things above apply — access to sensitive data should be restricted so not just any old person can get it.

Let me close with the final paragraph from the article:

Companies also need to get their entire leadership, from the chief executive to the general counsel to the chief financial officer, involved in developing a cybersecurity strategy, Mr. Henry said. "If leadership doesn't say, 'This is important, let's sit down and come up with a plan right now in our organization; let's have a strategy,' then it's never going to happen, and that is a frustrating thing for me,'' he said.

Completely true. I think that many businesses today either don't think that they are a target or underestimate how valuable their intellectual property is, or how sophisticated the attackers are. Part of implementing a strategy is getting to understand that this is a problem.
Written by Terry Zink, Program Manager
Follow CircleID on Twitter
More under: Cloud Computing, Cyberattack, Security