WC Archive

It is of worldchanging significance that the U.S. government has gone through four cyber-security czars in less than two years; one quit after one month and went to work for the Kerry campaign; another lasted three months and went to work for Microsoft; the latest lasted one year and quit with one day's notice. DHS is funding some good research work, but the U.S. government seems to be missing the significance of the problem, and other governments aren't much better. Fortunately, the Internet long ago outgrew governments.

Researchers created the ARPANET thirty five years ago to share computing resources. It quickly sprouted electronic mail and mailing lists, and turned into a collaboration medium. The Internet was created to connect different underlying networks, including ARPANET, CSNET, NSFNET, and network technologies such as X.25 and Ethernet. Its explosive growth began when all the pieces came together (fast fiber, fast routers) and became sufficiently distributed (TCP/IP, DNS, etc.) to enable use by more participants, especially commercial ones. Old communication applications (mail, chat aka IM) got ever more use, new resource sharing ones appeared (the web, p2p file sharing) and group forming applications burgeoned (VPNs, FOAFs) all because the Internet was open and collaborative.

It's ironic that people are now reacting to spam, worms, and attacks by building ever higher yet smaller forts: firewalls, patches, detection, etc., and even by hiding; people frequently change their electronic mail address when an old one gets infested by spam. These Internet security problems are fragmenting users and damaging the utility of major applications such as mail.

Building more and smaller forts won't make the Internet secure. The time from announced bugs to major attacks using them has dropped from months to a week. And we've seen several exploits recently for which there were no patches at the time. Plus many problems that affect the Internet aren't even malicious: routers fail; links congest; hurricane s happen.

What's common among all these problems is that they affect multiple people and organizations. Fighting aggregate risk with isolated reaction isn't enough. What we need is collective action.

As Robert McNamara said in 1966, shortly before he left the U.S. government:

“A nation can reach the point at which it does not buy more security for itself simply by buying more military hardware. We are at that point. The decisive factor for a powerful nation already adequately armed is the character of its relationships with the world.”

There are new-to-the-Internet methods of collective action that have been tested for many years for fires, earthquakes, electrical brownouts, and banking: insurance policies, catastrophe bonds, performance bonds, and capital withholding. Such financial instruments can pool risk and smooth it out over time.

Financial transfer instruments while increasingly necessary, won't be sufficient, even though insurers will require companies to use technological security measures just as they require sprinkler systems for fire insurance.

We need social and economic incentives for people to deploy technological changes such as BCP 38 and SPF that may not directly aid the deployers but will help everyone else, thus indirectly aiding the deployers. We need people to realize we're all in it together, and helping the larger society helps ourselves. Isn't this the basic worldchanging problem?

The script kiddies who cause many worms are just (mis)-using the collaborative nature of the Internet. How do we get them to see more fun in building it? The few recent charges and convictions may be a useful stick, but what's the carrot? For that matter, if most spammers are in the U.S., and we know who and where they are, and there's supposedly a law against it, why aren't we seeing more charges against spammers? But the law is a blunt instrument, too hard to aim, too slow to act.

The bot traders who turn thousands of computers into zombies and sell off the results to spammers and other miscreants; how do we get them to see less profit in that and more in doing something more useful, like looking for mercenaries using similar means for military purposes?

The Internet won't die, because too many participants, especially the miscreants, have too much vested interest in seeing it succeed. But major applications such as mail may well die unless something changes; specific companies can be successfully targetted; and thousands of organizations can be affected by force majeure risks.

Governments are unlikely to solve these problems for us, at least not alone, and no single technical, financial, or societal solution will work, either.

A major reason we can attempt to deal with worldchanging problems such as global warming, desertification, exhaustion of oil, etc. is that we have developed means of seeing what is going on worldwide, as well as in specific locations, and how the two scales are related.

To deal with hurricanes and other bad weather, over time we've developed hurricane watches, ship logs, ship-to-shore reports, weather balloons, satellites, radar, aircraft data links, and ocean buoys. To track global warming we use everything from Greenland ice cores to desertification monitoring. We need the Internet equivalents of all of these, or at least methods as diverse as these. There are many ways to do this without surveillance of legitimate content or compromising privacy: trapping attacks targetted at addresses that aren't in regular use; observing changes in performance of public servers; tracking changes in paths and performance in the Internet mesh. These can add up to a gestalt reputation system that will let people see how their and others' actions affect the whole Internet.

This doesn't mean violating the end-to-end principle or the dumb network paradigm. Quite the contrary: we could see when they were being violated, and by whom, because we would see differences in performance for those parts. We could also see where the Internet goes beyond being a fragile-when-attacked scale-free network into being a true mesh. Such differences would then become competitive distinctions, and it is social and economic competition that will drive improvement in the security situation.

We need nothing less than for the Internet, by means of diverse and distributed observations of itself, to become self-aware.