HTTP must die.
Hi everybody, I'm Parker, and this is Jan.
We work at the Electronic Frontier Foundation.
I'm an activist there, and she's a technologist.
And today we're going to be talking about HTTPS and web encryption and the many shortcomings of unencrypted web protocols.
So, thank you for coming.
Just quickly, do people here know what the Electronic Frontier Foundation is?
We can't actually see you, so it's okay if you don't raise your hands.
So, yeah, at EFF we do a lot of things around preserving people's privacy and anonymity online.
And so we'll talk a little bit about the things that we do in law and in activism and in code to make people's online and technical experience a little more private.
Alright, so how many people here have ever felt insecure?
Because you're lonely, you lost your job, you're not happy with yourself for some reason.
So, I've never actually felt any of those things, but the other day I was visiting Quora, quora.com, which many people visit, and I noticed they're serving their login page over plain HTTP.
And that's bad, because even if you're sending things over HTTPS, the attacker can modify the form and then change the target to whatever they want.
So in their case, it was even worse, because they were actually just sending usernames and passwords in plain HTTP.
Shame on them.
And by the way, it's 2014.
This went out of fashion in like 2001.
And they're asking me to use Flash.
Eww, right.
So, I mean, you guys aren't Hope.
I'm pretty sure most people here know why HTTP sucks.
But to go over it again, there's no data confidentiality, so the person at the coffee shop or the person sitting next to you right now can read what you're sending over the wire.
No data integrity, so they can tamper with it and you can't detect anything.
And there's no server authentication, so if you're visiting httpcora.com, it could be anything.
So given all of this...
It could be Cora.
What?
It could even be Cora.
Oh my gosh.
So given all of this, why are we still using HTTP?
Okay, so people say HTTPS is hard.
It's not actually true.
But people might say certificate authorities are gross.
They kill elephants.
They are people we don't trust.
They can be corrupted by governments that say issue a certificate for something.
And we've seen evidence of this in the wild.
So that's a real concern.
Certificate authorities suck.
A lot.
Mixed content is bad.
So if you're a news site and you've switched over to HTTPS, you're probably serving ads that don't support HTTPS.
So you have to support HTTP, and then you have HTTP JavaScript on an HTTPS page, and then it's no security guarantees anymore.
Many advertisers don't yet support HTTPS, and that's why news organizations have been slow to transition to HTTPS by default.
And if you're using a CDN, sometimes Alchemy, for instance, they can charge extra for HTTPS because they say, oh, you know, Windows XP doesn't support SNI, and so we need extra IP addresses, and so forth.
And if you have set up HTTPS, you have to remember to renew a cert.
So I recently saw a statistic that something like 40% of SSL certs in the wild were set to expire within a few months.
Great.
Let's go on.
So let's start the talk with part one.
Why are we interested in HTTPS?
Why do we start there?
And I think the obvious answer is because we know they are interested in HTTP.
This slide is a Snowden slide.
Of course, it's been in vogue for a year now to have slides that contain images of slides, and we will not break from that trend.
We know that the NSA is interested in HTTP because they said that.
HTTP touches almost everything that users do, and we saw this in the X-Keyscore leak, and more particularly, we saw that they drilled down to search terms and news sites, and here Glenn is quoted as saying, As one slide indicates, the ability to search HTTP activity by keyword permits the analyst access to what the NSA calls nearly everything a typical user does on the Internet.
So this matters a lot.
And it's important to note that HTTPS and the commitment to HTTPS doesn't stop at the lock on the user's browser.
You have to be encrypting the whole way.
This, of course, is from the Muscular leak.
I think most people will have seen the evil smiley by SSL added and removed here.
And that comes from a failure to be using HTTPS or encryption along the whole path, in this case, between data centers.
And when you've got an agency with a footprint as large as the NSA, that actually matters.
So how many of you have seen this article from The Intercept?
So I know Michael Lee.
Oh, quite a few.
I can't really see anything, but I can kind of see some hands.
So Michael Lee, who's in the audience, actually works on The Intercept and I'm sure can tell you all about it.
But anyway, so they published this article that was really shocking to us a few months ago that says NSA has these servers set up to potentially implant millions of devices with malware.
That's pretty scary, and that's a lot of devices.
So how does HTTP traffic enable this?
So here is a slide, within a slide, from the NSA's quantum program.
So what you see here is a diagram of the target, which could be me, or you, or Parker, or anyone here, logging into their Yahoo Mail account, because maybe it's like 2008 and we're still using Yahoo Mail.
And so they log in, and Yahoo Mail, maybe at that time, isn't HTTPS by default, even though it does a 302 redirect or something.
So the NSA server can see that they're going to Yahoo.
And this sends a signal to what's called a Foxasset server.
And the Foxasset server does the work of sending back malicious packets to the user's devices, spoofed to look like Yahoo packets.
So in essence, by putting these packet ejection servers at strategic geographic locations, they can exploit this race condition and get to the target's computer before the real Yahoo packets.
And this packet ejection will exploit some sort of vulnerability in browsers and implant the malware.
And this is quite scary.
So you might be asking, so millions of computers, maybe they're doing sort of targeting, like targeting people that they think are suspicious.
So what would they be using for targeting?
And it turns out they're using things like cookies, like Google Cookies, Yahoo Cookies, etc.
Because many services like Google, even if they're using HTTPS by default, they're leaking your identity all over because they have not secured cookies.
So if you don't set the secure flag on a cookie, as many of you know, a man in the middle can say, I am Google.com, send me all the cookies for Google.com.
And they'll read all your Google Cookies, which are really unique.
And they can even set cookies for you.
They can say, set this cookie for this target so I can look at them later.
So cookies are being used as selectors, in this case, plain HTTP cookies.
They also use some browser selector.
We don't know what code name Silly Bunny is, but we've chosen to illustrate it with a Silly Bunny.
Yeah, so we asked some lawyers, and no one knew what Silly Bunny was.
If anyone knows what Silly Bunny is, please tell us.
We'd really like to know.
Right, so let's reiterate that.
So unencrypted cookies, we used to think cookies are bad because advertisers use them to track us around the web.
Now we know they're also bad because they're used as weapons for NSA to decide who to target with malware.
So, we know that there's a privacy reason and a security reason, but there's also another really important reason to be using HTTPS, and it's maybe one that doesn't get as much attention, and it has to do with censorship.
So when we talk about something like the Great Firewall of China, there's a number of ways in which it works, but one of the ways it works is by doing keyword filtering, by drilling down on the contents of a particular web page or of a page within a site.
So, you know, you can access a newspaper but not necessarily the offending article.
And the way that HTTPS addresses this is that when you make an HTTPS connection, only the host is available in the clear.
So if you're looking at an article, for example, on The Intercept here, a man in the middle can know that you're looking at something on First Look.
But they don't necessarily know which part of First Look or even which article.
And there's a big asterisk next to that.
So this is true for all sorts of sites.
A big example is Wikipedia, of course.
It means something different to be looking at Wikipedia than to be looking at an article on something in particular or inflammatory.
But the big asterisk there is that that is still vulnerable to things like metadata analysis.
So if each article has a distinct file size, then you can get around this by just measuring the size of the files that are being transferred and you can know which article people are looking at.
There are ways of avoiding that.
You can do padding, but that has pros and cons.
The important part here is that HTTPS makes that kind of attack much more sophisticated and expensive.
And so even if it's not perfect, it does a good job of protecting privacy.
But the censorship angle here is that it forces somebody who wants to block certain keywords to make the decision to block an entire site or not.
And we've actually seen this play out.
So last year, GitHub was, for a little while, blocked in China.
The entirety of GitHub, because it's HTTPS, was blocked because there were...
the leading belief is that there were a handful of repositories that had something offensive.
And so the only solution, because you can't block those repositories, is to block the entire site.
And of course, the Chinese developer community was not very happy about this.
And they were very vocal.
And they said that we can't do our work.
And so there was a backlash and that backlash forced the hands of the Chinese censors to say, okay, we'll let the whole thing go, including these repositories we don't like.
And there's a quote from a prominent Chinese developer who said he compared the blocking of GitHub to trying to catch a mouse by burning the entire house down.
Forcing that decision is a good position to be in, to release the mice into the house and say, well, your only option is to burn the whole house down.
And that puts the blame really squarely where it belongs, on the censors.
So that's an important story with a good conclusion.
There's one that didn't end as well, which is the story of Google Reader.
Similarly, Google Reader was at a path.
It wasn't a subdomain.
So it was google.com slash reader.
And so countries had to choose whether they were going to block all of Google services or allow Reader.
And of course, Reader could make connections to other sites.
And so people in Iran were able to read the news from around the world by accessing it through Reader.
And it made the censors decide, do we want to block everything Google?
And for the most part, they didn't.
There was one or two weeks where they did that.
But for the most part, Reader was a way to access this news.
And this is really important.
In Iran, there's estimates that one in three news sites are blocked.
So this was an easy way for people to get around that censorship.
And now it's gone.
So here's a quote that I really like from our friend Nicholas Weaver, who I think sums this up really well.
The only self-defense from all of these things above is universal encryption, which is difficult and expensive, but unfortunately, necessary.
And we know why it's necessary.
There's another great advantage.
If you run a news site and you turn on HTTPS, the ACLU's Chris Segoian has offered a bottle of whiskey to any admin at a news org that switches websites to HTTPS by default.
So not only are you defending your readers' privacy and security, but also you can get a drink off Chris off of it.
I think Chris might be here right now, by the way.
So you could even get it from him.
Let's bankrupt him.
Let's go nuts.
Okay, so this talk was actually meant to be a really optimistic, happy one.
And I think it's going to end up being that way.
But I think because it's nice to be cautious, part two is called, not everything sucks, sometimes, probably.
Yeah, and we'll see why not everything sucks, sometimes, probably.
So one way that we look at this, the way that things don't suck, is through the Encrypt the Web report.
And this is, it's just a sampling.
We look at a handful of websites, services that people use, and we measure how those sites are doing in terms of encrypting user data.
And so you can see the first category is, this is just, by the way, this is a long chart that I've just split up into two.
Encrypts data center links, which we saw matters because of the muscular attack.
Supports HTTPS, and then the next two categories are how well are they doing HTTPS.
And then the last one is StartTLS for encrypting user emails in transit, which we'll talk about a little bit later.
And really the exciting thing here is that we started with a lot of gray and red, and it's gotten, over the last, we've been running it for about six or seven months, it's gotten a lot more green.
We've gotten a bunch of sites that have started rolling out HTTPS and doing it well and perfect forward secrecy, and these things, you know, in response to the news cycle, in response to someone pushing on them and saying, you know, your users deserve better.
One major example of this was Facebook, you probably can't see the date, but it's July 2013, so this is the month after the Snowden revelation started, switched on HTTPS by default.
It was, most users had it before, but it's by default, and this is a huge amount of connections that are now encrypted.
We saw Google made an adjustment, and HTTPS protects not just the contents of the page, but also if you go from an HTTPS site to an HTTP site, there's an extra measure of privacy added by, your browser will blank out the referrers.
So in Search Engine Watch, they're just upset that they stopped getting keyword data, but for users, that's actually an extra level of privacy.
Oh, by the way, the timestamp on this is September 2013?
Yeah, September 2013.
Wow , thank you, Snowden.
Yeah, the Snowden effect.
So it's not just web browsing, so there's also email, and email SMTP can optionally use an encryption protocol called StartTLS, which is opportunistic, which means a server can advertise, I support encryption, and then the other side will upgrade to TLS,
but it's unauthenticated, and a man in the middle can downgrade by saying, this side doesn't support TLS, and it'll just fall back to plain text, because you really want your mail to be delivered, usually.
So my colleague Peter made this awesome, although somewhat confusing-looking chart from Google's data, so I don't actually know why there's this periodicity, but on the whole, it looks like StartTLS usage is rising pretty well.
So since December 2013, which is when this chart starts, there's been a 33% to 58% increase, and that's really, really great.
And this has been, similar statistics have been shown by Facebook's data.
So if you want a mail server, you can actually do an analysis like this yourself, because you can look at the percentage of inbound and outbound connections that are using StartTLS, and if you find out, you should send it to EFF, because this data is really hard to get.
We can't just scan the web and see what mail servers are using inbound and outbound StartTLS.
So it was really nice to get this data released by Google and Facebook, and we'd always like to hear more.
So after all of this, there was this report recently from Wired, well, reported in Wired, that said encrypted web traffic more than doubles after NSA revelations.
That's pretty dramatic, but what did I actually mean by that?
So if you read the report, it says that between pre-Snowden and after Snowden, the percentage of overall web traffic in each of these continents that is encrypted has gone from 2.29 to 3.8 percent in North America, which is pretty good.
In Europe, it's gone from about 1.5 to 6 percent.
But in Latin America, it's gone from 1.8 to 10.37 percent just in one year.
That is...
Yeah, that deserves applause.
I would applaud for that.
And a lot of that is due to large service providers like Google and Facebook doing their part and starting to encrypt things by default.
But that is super, super significant.
So, part three.
What is next?
We've been doing really well, but there's always things we can be doing better, and part three is supposed to be about...
So, you're at Hope.
You're probably going to go to a lot of talks that are really pessimistic, like whistleblowers are all going to die soon.
That's what Hope's all about, right?
They put Hope in the name because it's not in any of the talks.
Okay, yeah, that's true.
So, this is day one, and it's nice to start on kind of a high note.
So, whatever you hear in the rest of Hope, remember that Cloudflare is pledging the double SSL usage on the web in 2014.
Cloudflare, I believe, is getting...
is man-in-the-middling about 5% of web traffic right now, so doubling that is going to be really, really important.
And, moreover, if Cloudflare does this, perhaps we can get Alchemy to do the same and say, Alchemy, you've been using your excuses long enough.
Look, Cloudflare is offering SSL to everyone, even free customers.
Why aren't you going to do the same?
And once we get CDNs on board, that will be really awesome.
Okay, and then there's the browsers.
So, you know, there's this chart that I really like about browsers and what they're like.
Sorry if you're in the back.
It's very funny.
I'm sorry if you can't read it, but it's really funny.
We'll tell you each individual answer.
Just come up after this.
If you ask a question about what the test...
We'll explain what the question is.
I'm sorry, this is so small.
I didn't realize this was going to be a large room.
So, how many of you know about HSTS?
Yeah, some of the fans, I guess.
I can't really see.
But HSTS prevents against this attack called SSL strip, right?
So, usually you go to a website by typing in gmail.com and your browser by default goes...
unless you're using HTTPS everywhere, which is this awesome browser extension.
But usually your browser will go to http gmail.com and if someone's actively monitoring your connection, they can take that and redirect it to a fake site and you won't notice that the lock icon is missing, perhaps.
So, HSTS is a header that the server sends to the client that says, I only want you to contact me over HTTPS for the next several months or however long the server wants you to do that.
And so that prevents against this SSL stripping attack.
And it's been around for a few years.
Chrome and Firefox have supported it.
Safari also has for a while.
And now IE, after EFF asked them, Microsoft has said that they're going to support HSTS in the next release of Internet Explorer.
Browsers!
Yay!
Browsers!
Cool.
Yeah, and also we've seen large companies like Yahoo say pretty awesome things, like pretty large promises.
And it's up to everyone here to remember that people like Yahoo have said this and hold them to it.
Because this is how we get things done, right?
So they've said that traffic moving between Yahoo data centers is going to be fully encrypted as of...
well, okay, so that's in the past.
It's already fully encrypted.
They made Yahoo Mail more secure, HTTPS by default.
Search queries will also have HTTPS by default.
And at the last one, it's kind of interesting.
It says there will be a new encrypted version of Yahoo Messenger that will be deployed in the coming months.
So... great!
So I wanted to talk a little about an initiative that we worked on in this.
This is actually the members of a coalition that worked on a campaign called Reset the Net.
As you can see, it was a pretty large and diverse coalition.
And Reset the Net launched on June 5th, 2014.
It was the one-year anniversary of the Snowden leaks.
And it really showed how far we've come in that year.
And it's an ongoing campaign to try to increase the security across these major platforms.
Many of the sites listed here made improvements.
Perhaps one of the most exciting was WordPress.com announced that by the end of this year, they will serve pages only over SSL for all WordPress.com subdomains.
And so that's a lot of blogs.
This is our attempt at an SSL added here.
Smiley face.
So WordPress powers, between .com and .org, 15% of the web.
So this is a really major thing.
And we're seeing this, and we're seeing it more and more.
And of course there are some other exciting things that aren't easily illustrated.
Yeah, so to be honest, I made most of these slides at 4 a.m.
this morning.
And I just didn't have time to find pictures.
Though I'm sure some can exist.
So this is kind of a slide about what's new in SSL land, other than people deploying it.
How is SSL inherently going to get better?
So people yell a lot about SSL.
They say that, you know, you can't trust certificate authorities, right?
Like, if NSA can go to DigiCert and say, issue me a cert for Google, then it's game over, right?
They can decrypt all the traffic, etc.
So how are we going to prevent things like that?
It's not impossible, it turns out.
So there's a new proposal called Certificate Transparency that will basically make every certificate issued by a CA have to be added to a log that is maintained by Google and other organizations.
Possibly EFF will run on one of these logs.
And for the browser to accept the cert, the server has to show proof that the cert has made it into one of these logs.
And it uses a cool data structure called a Merkle Tree that makes this lookup process very efficient.
Yes, people really like Merkle Trees.
I heard someone really get excited at that.
So, you know, what Certificate Transparency, at the end of the day, what it means is that if a CA issues a bad certificate, either we can see it in the certificate log or the client won't accept it.
And that's really, really nice.
And Google is actually...
You might say, oh, this is some theoretical math thing.
It's not going to be used anytime soon.
Google is actually planning to require Certificate Transparency for all extended validation certs by the end of the year, if I remember correctly.
I'm not sure if that timeline has changed, but I think that's what they said a few months ago.
And then there's HTTP public key pinning, which solves the problem that anyone can issue a cert for EFF.org, or any CA can issue a cert for a site like EFF.org.
And HTTP public key pinning lets EFF say, I only want the cert from StartSSL.
And this is the cert that you should expect to see every time you connect to EFF.org.
And that will make it harder for people to create fake certificates for EFF or Google, and so forth.
HTTP public key pinning is...
I think you can already do it statically through a preloaded list in Chrome.
And soon you'll be able to do it dynamically by sending a header, like HSTS.
And on the mail encryption side, EFF has just launched a project called StartTLS Everywhere.
Some of the creators of that are in the audience.
You can't see them though, because it's really dark.
But StartTLS Everywhere tries to solve the problem of downgrade attacks on SMTP servers.
The problem is SMTP servers don't know each other's TLS policies.
So if you say mx.gmail.com doesn't support TLS, if you say that from a man in the middle, then the other server has no way of knowing that's a man in the middle.
So StartTLS uses these configuration files to enforce TLS policies between SMTP servers.
And we'll be giving more talks on that in the future, so I won't tell you everything about it right now.
Spoilers.
Yeah, no spoilers.
So I heard earlier someone at Hope said, I just overheard someone say, oh, you know, sysadmins are never all going to deploy TLS by default.
It needs to just be enforced.
The default just needs to be encryption.
We can't make people have to buy CERT and set it up and all this work.
So HTTP 2.0 has a proposal to address that called opportunistic encryption, which will make all HTTP traffic encrypted by default.
But then you might say, oh, what about CAs?
How do we get authentication?
And the answer is opportunistic encryption might just mean unauthenticated encryption, which means, of course, that NSA can just pretend to be any server and do an attack or a downgrade attack.
So real HTTPS is still better, but opportunistic encryption is on the table for HTTP 2.0.
All right.
Sorry, we put these comics up and then you have to read it and I didn't say anything funny.
So I hope that we effectively made the point today that HTTP is horribly insecure and that if you're running a website, it's not optional.
It's for your readers and users' privacy and security and for your site to be accessible and to preserve the integrity.
HTTPS is something that you should absolutely be looking into and deploying.
As we like to say, it's too important to leave up to an unencrypted protocol.
So if you like it, you should put an S on it.
Sorry.
Jan dared me to do that one.
Yeah, and we thank you very much and we'd like to open the floor to questions.
Yeah, I'm sorry this talk was too short.
We didn't really time it.
It's half an hour.
You can get a snack or something.
But we're going to also take questions for a bit.
People have those.
Whoa.
Wow, there's people there.
Thank you.
Can we get the question mic on?
If you yell it at me, I will repeat it.
I'll repeat at the end.
It's not a people's mic here.
Two excuses at the beginning.
Number one is it takes too much computational time.
You know, doing AES is just too much effort for them.
Which, if you look at the figures, is just nonsense these days.
And the other one is the difficulty of getting service.
Because if you've got a CDN, you've got to be able to bring servers up and down.
Now, I work for CA, I work for Komodo.
And so I keep trying to say, well, you know, we've got technology that you could deploy.
It would solve that problem.
But then they say, well, we've not got the demand from the customers.
So it's really critical that the people in this room who are customers of those CDNs are telling their salespeople, we want to turn on TLS across the whole network.
Because they're only going to listen to them.
They're not going to listen to technologies with good ideas.
All right, so I'm going to attempt to repeat as much of that as I can.
We inadvertently threatened to kill this man's baby.
We didn't threaten, we just said it has to die.
And the problem, per the statement, is better addressed at the CDN level.
And most importantly, that the CDNs need to hear demand from their customers, which likely include people in this room, that they want to turn on encryption across the network.
And so I agree, at least with the conclusion, and probably with most of it, that we ought to be demanding this.
That's how we get companies to start doing those changes.
Could you talk a bit about Dane?
Because you didn't list Dane in your promising...
Do you know what it is?
Yes.
Okay.
I think we can talk more about that afterward.
But yeah, I think there's a lot of...
So I'm not an expert on DNSSEC, but we've heard a lot of people say that it's infeasible for them to deploy at the moment, which is part of why we started the StartTLSEverywhere project.
Okay, but the argument that the CDNs have for not being able to manage their certificates, if they could use self-signed certificates in their own DNS zone data, then that would circumvent that problem completely.
And moreover, it would circumvent the problem with the crappy, you know, everywhere trusted CAs in every government in the world that you don't want to be able to issue your certs.
So it would actually eliminate a lot of the pinning and transparency problems if DAIN were widely adopted.
So I urge you to follow the DAIN efforts, because I think they're going to be very promising.
Yeah, there are a number of... DAIN is one of them.
There are a number of efforts that have, at varying degrees of technical completion, that have yet to be adopted.
And, yeah, many of them are really interesting.
A little bit of what we're talking about is what we have now.
And, you know, we could easily double the number of HTTPS.
I mean, Cloudflare is talking about doubling it just with a switch on their end.
And that does a lot on the ground already.
Hi.
Is there any truth to the rumor that EFF is going to fight untrustworthy CAs by becoming a trustworthy CA?
That's a great question.
I think we don't comment on rumors and speculation.
I don't think we comment on that one.
Well, think about it.
But, yeah, thank you for asking.
Hi, my name is Richard Barnes and I do security stuff with Mozilla.
Thank you.
Which is relevant because I have some bad news and some good news.
The bad news is that if Cloudflare is saying they're going to double the percentage of SSL on the Internet, they're lying because it's impossible.
And I say it's impossible.
The good news is that it's impossible because I was just checking stats from our telemetry and we're seeing like 60% of the web being encrypted right now.
So I think that's largely due to a lot of the efforts of the folks in this room.
And so I wanted to applaud that part of it.
Say again?
You are counting differently from the way they are.
Oh, yeah.
I'm having fun with metrics here.
I say let's let them try.
Let's take them to 120% encryption and we're happy.
That's all we ask for.
We're simple.
So one of the things that was on your slides that's in active flux right now, really active discussion right now, is this idea of opportunistic encryption in HTTP2.
And I'm one of the instigators of that in the HTTPS working group.
So if people could take a look at that.
That's something where we have community discussions.
It's in the IETF.
There's a working group around this right now that's discussing it.
So if people have feelings about whether we should allow opportunistic encryption, whether we should require browsers to validate certs in HTTP2, that would be something where community feedback would be really helpful.
I also think this mail encryption you guys are getting involved in is really good.
The web is sort of on a really positive path and there's good momentum.
The mail community, they're much more fractured.
They don't really know how to do authentication.
So whatever you guys can do to help move them forward would be really helpful.
Cool, thanks.
Out of curiosity, do you want to offer your opinion on opportunistic encryption?
So those of us who have been sort of our internal security mafia at Mozilla have been talking a lot about this.
You know, we are...obviously HTTPS is the gold standard, as you guys said.
It's...it provides all of...it blocks a whole nother...
What is this thing?
Some color.
Yeah.
You know, it blocks a lot of attacks that we know happen, as you put on your slide.
We've been really supportive of opportunistic encryption.
In the ITF process, we've been putting forward proposals to enable encryption with the possibility of discovering when...
with the possibility for, as you said, unauthenticated.
So spin up your Apache instance.
Have it gin you up a self-signed certificate.
Don't bother going out to a CA if you don't want to.
And we'll go ahead and do the encryption.
And, you know, we're not...we might not display a lock icon or anything because you're still vulnerable to all this stuff because it's not HTTPS.
But we may go ahead and accept that cert and do the encrypted connection even if it's...even if it's not a cert from a CA that validates an identity.
I don't want this to turn into a Mozilla question hour.
So I can't speak off the top of my head to the development plans in terms of what we're planning to implement.
But in the ITF and the standards discussions, we've been trying to find ways that we can agree on to expand the set of website operators who can do encryption.
Thank you.
And I encourage people to take part in those discussions because they're interesting and I think it's a...
there are some hard questions raised.
And there's lots of different valid perspectives.
So , I mean, the more mass we can have behind different perspectives, the more we can understand how much the community feels one way or the other.
Thank you.
So after Heartbleed, OpenSSL was a media darling for a little while and got some security reviews.
And, like, a couple more flaws have floated around.
But in general, it's maybe in a better...
one could argue that it's in a better place.
However, there's also forks of it now, like LibreSSL and Google has their own deployment strategy for SSL now.
Burning SSL.
Yep.
What do you guys make of that?
Probably good.
Yeah, I mean, it's nice to have some diversity out there.
It's also nice to have...
I think if you don't have diversity, it's nice to have a lot of effort in one place.
And what the media reports after Heartbleed showed is that we had neither.
We had one solution that had, you know, one and a half people working on it.
Two and a half.
Sorry, two and a half.
And so, yeah, I think that if what we get is more attention on OpenSSL or if what we get is a number of really good solutions, then either way is better off.
And , you know, it's easy to...
Heartbleed was a rough week.
I work at Red Hat.
It was a rough week.
It sucked.
But I think it's, you know, we were able to recover and we at least have some sort of infrastructure in place for communicating that this happens.
I mean, it could have been worse.
And I think that there are steps we took after that that will make it more likely to be better.
Okay, thank you.
Thank you.
All right.
One thing I've been thinking of, and this is something I've actually been thinking of for a while in regards to dealing with the problems of both CAs and DNS, is...
I'm not sure if you're familiar with the Namecoin project, but the possibility of using multiple Namecoin server...
basically multiple Tor hand services as essentially Namecoin blockchain CAs, connecting to them through Tor and then using something similar to Moxie Marlin Spikes Convergence as a means of validating the entries when you receive them and then just transfer everything over to that rather than going through standard CAs and DNS.
And it's so simple.
Right, yeah.
So I've seen a number of proposals like that usually involving some sort of cryptographically verified append-only log like a blockchain.
But I think we've yet to see something that's really complete along those lines.
And if that comes along, I think it'd be interesting to think about.
Yeah, I mean, I'd love if something really weird happened.
You know, that's pretty weird, but yeah, let's try a bunch of stuff and see.
It could happen.
And there's been a lot of stories about the development of the web where it was pretty weird along the way.
Just remember, science isn't about why, it's about why not.
Yeah.
Thanks for the talk, guys.
Question, so SSL, yay!
Buying an EV cert for 500 bucks, not yay.
Not as fun.
So I do some work with non-profits and NGOs.
$500 is trivial to a large corporation, but to some of these smaller orgs, that's serious money.
Or some activist blogger in Nepal.
Are there any CAs that offer free certs?
Would such a thing be feasible?
Yes, so it depends.
If you just have a single-page website, or I think just a single-domain website, and you don't need arbitrary sub-domain coverage for SSL, StartCom will give you a free certificate.
But not EV, right, not EV, that's correct.
And so CloudFlare has stated that they are planning to offer SSL to free customers in the near future.
Thank you.
Yeah, I think that's a really important point, though, is that this is really important, and that's a good reason to try to make these prices come down.
And then that's a little bit of pressure, and hopefully CloudFlare switching it on applies more pressure, but yeah, that's obviously a burden.
And there's things that, not just the cost, if you're an activist blogger in Nepal, the complexity of deploying it might be a showstopper.
And so there's a lot of places to work on making this easier.
Thank you.
All right, I think that's all the questions.
Thank you very much.
Thank you all.
This was great.
Thank you.
Bye-bye.
Bye.
Hello , Hope!
Okay, just a few brief announcements before we move on to our next presentation.
One of them is if you want to hang stuff up around the conference, we're all for that, we love that.
But be sure to use the Blue Painters Tape.
Don't use any other kind of tape, no matter how much you may want to.
If you need some Painters Tape, go to our info desk or security desk and they'll have some and they'll just give it to you because they like you that much.
But don't use any other tape than the Blue Painters Tape to stick anything to this hotel's walls.
Beyond that, I think we're about ready.
These rooms have been filling up, so be advised that throughout the conference, if a talk fills up and you leave before the end of the talk, you probably won't be able to get back in because you've lost your place.
All right, so without further ado, it's my pleasure to present the Internet Society Speaks.
Ladies and gentlemen, Jerry Pesner and David Solomonoff.
Thank you, thank you.
Thank you , ladies and gentlemen, and extremely bright lights.
So, not that I can see any of you, but I'd like to take a quick poll before we begin.
How many of you would say that you are involved in Internet governance issues?
All right, I can see maybe two or three hands.
How many of you have called your congressman or otherwise gotten involved in the net neutrality debates?
All right, I've got news for you.
You're involved in Internet governance.
And as we go through this presentation, you're going to see why.
But for right now, let's get started with the history of Internet governance.
We're going to go all the way from the very beginning, all the way to the possible and zany futures.
So, let's talk about how the Internet actually began.
This began in the mind of J.C.R.
Licklider when he envisioned the intergalactic network that was going to link all the computers in the world together of which there were maybe on the order of 10 to 20.
So, you can imagine, why would we need to link these things together?
And these days it sounds like a foregone conclusion, but think about what computers were like then.
These were giant information processing machines.
You fed data into them, and you got data back out of them.
There was no questions of using them to really research things or to find novel discoveries beyond what you were already doing with your data.
They were just giant, room-sized, bulky items.
And now this guy wanted to link them together for some reason.
Now, J.C.R.
Licklider only had a small two-year tenure at ARPA, but he wasn't able to get it off the ground at that point.
So, Robert Taylor, his protege, was the one who actually did it.
And Leonard Kleinrock at UCLA hosted one of the first nodes.
Kleinrock had published research in the packet-switching technique that we all know and love today.
And his grad students, Vince Cerf, Steve Crocker, and John Postel ended up forming something called the Network Working Group to elicit and to discuss new ideas for this emerging ARPA network.
And they sought requests for comments, or RFC, on ARPAnet's development.
Now, the cool thing about the Network Working Group was that anyone could participate.
Of course, when we're talking about a network of four nodes, that's not really a whole lot of people.
But the good news is that as we got more nodes, we got more people.
And since the object of the group was to talk about the network, it was sort of a self-propagating and beneficial feedback loop.
Anybody who wanted to get involved was really able to, and there was no question of exclusion or backlash, as long as you were able to play nice with other people.
And because people were collaborating and working together, they were able to develop a lot of foundational protocols and software that are foundation to the Internet today, such as email.
That was a combination of the already existing FTP protocol, plus some messaging systems customized for different nodes in the network.
So, as the ARPANET continued to develop, people realized that this packet switching network thing was actually a pretty cool idea.
And others started to prop it up.
We had the AlohaNet, and in the 80s, the NSFNet, and a few other networks.
BBN was trying to establish its own network.
I think IBM was as well.
So before we know it, we had dozens of...
well, maybe not dozens, but a whole bunch of different packet switching networks.
The problem is they all worked differently.
The ARPANET had these interface messaging protocols that sort of governed how traffic was directed, but others worked differently.
And it was just... these were all kind of on their own networks.
These were railroads with no interconnection.
And so, Vint Cerf and Bob Kahn developed the Transmission Control Protocol, and literally they called it Transmission Control Protocol slash Internet Protocol, the idea being that they could use this protocol to inter-network the networks.
It didn't matter what kind of data you were sending.
TCPIP was just focused on getting the data from one place to the other.
Then the networks could do with it as they wanted to.
They could insert their own protocols closer to the endpoints.
What was cool about the TCPIP protocol is that it was open source, or what we know today as open source, because they just shot it out to the network working group and said, here, look at this thing.
What do you think of it?
And then they were able to take it and improve upon it, and eventually implement it on the emerging popular Unix system in the late...
because you could include TCPIP at no extra cost.
Again, it seems given today, but at that point it was most definitely not.
So, now we get to network privatization.
As I said, there were all these different networks, and so TCPIP kind of made it as a... kind of, you know, glued all these things together, but it was a rickety operation at best.
And not only that, these networks were used primarily for academic or extremely geeky purposes.
The idea of the average user having anything to do with the Internet was still nowhere on the table.
But then a little something called the World Wide Web came around, and people started to take notice.
Suddenly there was human-readable text, yet you could change the fonts and style of this.
This was amazing.
The ideas of having graphics, graphical user interfaces for the Web, you know, this was big stuff in the late 80s and early 90s.
And so people started to realize, hey, maybe this Internet could actually be useful for the general public, people like you and me.
And so expansion started to... they wanted to expand it, but the Internet and its relevant smaller networks were being run by academic institutions and the NSF and other organizations that really had no business in trying to service a network for the general public.
So they saw privatization as the means to go, as the way to go.
Telecoms like AT&T could suddenly take this over and add, you know, this new Internet to their already existing copper telephone lines.
And this is how we had our little fun known as dial-up.
So that's how the network started to become accessible to the average person in the early 90s.
But there was another aspect to this, and this is where the whole governance thing starts to come in.
We may, you know, as you know, the Internet's inventor, Al Gore, became vice president in the early 90s.
And he had been working on technology issues for a couple of decades prior.
And once he was in the vice presidency, he was really able to make this a central component of the administration.
And he came up with this term, the information superhighways, the one that stuck.
But for policy purposes, this was all referred to as the National Information Infrastructure.
This emerging technological network that was going to better the lives of everyone around them.
So they set up some information infrastructure task forces to discuss some of these technology policy issues that they could foresee arising as this Internet became common.
Now, for those of you who are curious about the 1996 Telecom Act, too bad.
This is occurring in a different sort of space than what I'm about to talk about and was really more centered at the FCC.
I'm about to talk about stuff that was more focused at the White House and Department of Commerce.
So, but before I get to that, one thing I want to mention is that this was not simply an American initiative.
A lot of this was happening in the American White House, but they recognized that this was going to be a global phenomenon.
So many of the people involved were not only just working here, but they were going to meetings abroad.
They were trying to talk about how can we connect to users abroad, users in Europe, users in Asia, users in Africa.
These were questions even then, even before the Internet was as prevalent, anywhere near as prevalent as it is today.
And they strove for generally admirable goals, universal access and open competition, and different settings that could make the Internet easily usable and accessible by anyone.
Now, e-commerce was actually a pretty big topic that got a lot of attention, particularly when we're talking about international commerce.
Now, buying stuff on the web, oh, big deal today, right?
But, of course, we're talking about a network that, in the late 80s, was used strictly for research purposes and, in fact, was forbidden from having any commercial content posted to it.
Think about that.
Think about trying to talk about e-commerce on a network with that kind of history.
And, not only that, try to think about e-commerce between nations which have vastly different tax laws and different other sorts of regulations when we're talking about trying to buy and sell things.
This is huge.
And security, mobile payment, I mean, we're talking about issues that people are still grappling with today at a time before the Internet was in everyone's homes.
But it was a good thing to be able to put on the Internet as people started using it because people want to buy things.
And so lots of people had their different opinions on it, but it really started to make headway when the Clinton administration set up its own little interagency group among the different government agencies to talk about this.
But they really couldn't ever figure out a governance solution, and I haven't done much research on the modern issues of e-commerce, but I think they're still trying to figure it out.
So now we have to talk to the question, get back to the question of who was actually at the table for these things.
There were all these committees and all these discussions, that's great, but as I was mentioning, so far it was really mostly from the government.
And so the Department of Commerce established committees for several key issues, apart from the ones I already mentioned, including intellectual property and online privacy and government information.
And those committees each published very key reports, but the reports had different levels of effects.
The privacy paper was really sort of loose, like if you're a company using personal information, you should probably tell your users what they're using it for.
Simple, right?
But the IP, intellectual property committee, was a whole different story.
They published very strict and specific recommendations in favor of copyright holders.
Their logic was, well, the internet is here, but we've got to fill it with content.
And unless content providers are confident that their content is secure, they won't be putting their content onto the internet.
It seems kind of logical, but then they kind of missed the step where users generate content themselves.
And this whole new type of idea of information sharing that has arisen since then.
So there was a lot of internet outrage and coordination, even in the 90s, around issues like these.
There was particularly around universities and libraries and other types of digital eggheads who kind of saw these IP laws as threatening to them.
They really were concerned that if these recommendations, worded as specifically as they were, were put into place, all of a sudden the internet might turn into a place that was a little less desirable for them to be working.
And this is without the benefit of hindsight that we have today.
There was another organization called the Advisory Council, separate from the committees that I just talked about.
Now, this was interesting because this was comprised of people from outside government.
Everything else I was talking about to this point was made up of people already inside government, federal government.
But this council included people from education, included people from universities, from research, from telecom companies, from technology, from big media, etc.
So we were talking about a council that was 1.37 people strong from all these different areas.
Now, you might imagine that having all these people in the same room was great.
We got all sorts of debate going on and all sorts of ideas being exchanged.
But then it kind of comes hard to come to consensus.
If this committee with all these different people is expected to publish something, well, what exactly can you expect them to publish?
The result was these sets of reports that were very broad and high level in terms of what they discussed.
We want to talk about educating users on these capabilities.
We want to talk about getting Internet into hands of people.
We want to talk about people being secure in their information, but also information being able to be used for opportunities like commerce.
And we want property to be protected.
Nothing that really sounds terribly objectionable, but it was very broad and high level, and it represented really the base agreement of what such a diverse group of people were able to come to.
Now, as I mentioned, we had that thing with the IP committee and their very specific rules.
There was also the Communications Decency Act proposed by Senator James Exxon.
That would have made it illegal to show any obscene content to a minor through the Internet.
Now, imagine trying to enforce that without severely crippling the Internet as we know it.
And in fact, aside from the public outrage that it provoked, it was declared unconstitutional the very year after it was implemented based on free speech issues.
But the question is that the people who were from outside government who were involved, they had different levels of impact because the general public who were involved were pretty far back.
Some of them were very aware of what was going on.
Some of them were very much less aware.
Remember, we didn't have the Internet to easily keep track of these things.
So people had to do a lot more work to figure out what the status of these issues were and to even organize any kinds of protests or write a letter or anything like that.
And then we had this council that was a little closer to the action because they had this formal affiliation with the IITF.
But again, they were sort of one member among many who were all together trying to find the consensus of where people from all these different directions were coming from.
And that seems like it would be a little straining.
So, that was basically the policy that was happening.
Oh, before I forget, what actually happened with all this IP controversy?
Well, there was this big back and forth.
It actually took years of debate between the IP committee and the groups of academics
and universities and other libraries and other folks who found it objectionable.
But eventually, they were sort of stuck through the back door to a little international treaty provision and a lot of the usual politicking you might expect.
And eventually, we ended up with the Digital Millennium Copyright Act, which has caused no controversy since then.
So sorry, now we can go to the Internet Society.
And if you've been wondering since the beginning exactly what that is, wait no longer.
It was founded by Serf and Kahn in 1992 with the belief that the Internet is for everyone.
This is, again, a pretty big change from the research network of just a decade prior.
And they recognized that as this network became more prominent, there were going to be issues that developed, very key social and policy issues that developed, that something like this really needed to be around to address.
Its initial focus was to really sort of help the Internet's technical development through something called the Internet Engineering Task Force, which really focuses on sort of protocol and packet engineering.
But as it's developed, it's got this outreach...
it's got pillars from outreach, technology, and policy.
So today, the Internet Society actually has its hands in all sorts of Internet-related activities, from comments on policies like SOPA, to sponsoring international Internet organizations like the Internet Governance Forum, to even management of the .org domain system.
So the Internet Society really represents one of the first attempts, to get more people involved, people who weren't interested, who weren't already in policy or government, or had any reason already to know much about what was going on with this thing.
Today, it has about 100 chapters throughout the world, including one right here in New York, to address the concerns of its local members.
And another key organization that was founded in the late 90s was the Internet Corporation for Assigned Names and Numbers.
This is what is in charge of managing the domain name systems, IP allocations, and protocol port numbers.
This was a job that used to be handled by John Postel, but unfortunately, he died in the mid-90s.
So they decided that he was such a powerhouse, that they'd need an entire corporation to do his job.
Since then, there have been some long-standing concerns over ICANN's transparency, and the fact that it was established by the U.S.
Department of Commerce, as opposed to an international organization.
This has led many people who are from outside the U.S.
involved in Internet governance to basically say that the U.S.
controls the Internet, which I think is a little reductionist.
But it did remain a long-standing issue.
Now, for those of you in the know, you might be aware that ICANN has recently announced that it's ending the contract with Commerce, and intends to move into an international body.
But exactly how that's going to happen is yet, we're not really sure.
And also, if you've heard something about the global top-level domain, that's ICANN's doing as well.
And finally, these organizations, like ICANN and ISOG, really point to something called the multi-stakeholder model.
Now, what is that?
This is a change from, for those of you who are not political scientists, I'll fill you in, the traditional means of diplomacy and governance and policy agreements on a global scale was done through multilateralism.
This is comprised of established states and diplomats and transnational corporations.
We're talking about people on these types of scales here, which seemed appropriate before we had something like the Internet.
It was difficult to synthesize information about what was going on, and we as a people couldn't really communicate our interests and our ideas so effectively to the government.
So we kind of needed them to do a lot of this for us.
But as the Internet came into being, we had this multi-stakeholder model, which seeks to bring every stakeholder in.
That means if you are a user or otherwise involved with the Internet in every way, you have a stake.
But exactly how are we going to do that?
And to this day, there isn't really a clear definition of what the multi-stakeholder model actually is or how it works.
This graphic that I've got here is actually the only version, the closest thing I've found to any sort of definition of a multi-stakeholder model, any sort of clear definition.
But even then, that leaves a lot of room for interpretation.
And you can start to see how the history has led to very open questions of Internet governance that have...
And that's why we see a lot of debates today over issues like SOPA and Snowden and other issues in the Internet where a lot of things really haven't been settled or defined all that much because they weren't defined back then either.
But we do see how a lot of the discussions today mirror some discussions that were happening years and years ago as well.
So the Internet is a very young medium still, especially when it comes to its time in the public forum.
And in terms of understanding how it's going to be governed and used, it very much remains an open question.
It's not a utility that we can come to expect like electricity or running water.
And many people do tend to think that way.
But it is still something that has become enormously central to a lot of what people do, a lot of what people in this room do.
And it would be a mistake to not be aware of these key governance issues.
So I'm going to stop it here and let David Sullivan off here take over and bring us into the future.
Thank you.
Can you hear me?
No.
Oh, you can?
Oh, this is good.
Okay.
All right.
Okay, so to pick up the thread there with the multi-stakeholderism, the current debate in terms of things like ICANN a lot has to do with the degree to which whether nation states alone or large multinational corporations and owners of media companies and that type of thing should have the primary role in Internet governance,
whether NGOs, civil society should have a role and what that role should be.
But this is kind of misleading because now that effectively almost everyone uses the Internet, everyone is a stakeholder.
So the real challenge, I believe, and we're working on this particularly with the Internet Society of New York, is to educate more people about Internet governance because there are lots of people who are, say, politically active in other ways in their local communities,
even at the state or national level involved with politics, who don't understand anything about or even know that they use the Internet, that there is such a thing as Internet governance.
So I'm going to jump to the next level here.
We've figured out who the real stakeholders are.
And now let's go to another level.
And the model of the Internet Society is the Internet is for everyone.
The founder, Vince Cerf, also has been involved with different initiatives in terms of things like the Internet of Things, so he likes the Internet is for everything.
But now we're going to take a quick look here at the bigger question of who is everybody and what is everything and where is cyberspace going?
So in terms of users of the Internet, the new users are coming from developing countries, and typically a mobile, like a smartphone or a tablet, is their primary means of access.
The ongoing problem with new users of the Internet tends to be that over time they are technically less sophisticated.
At the same time, cheaper, more powerful hardware becomes available.
And in the case of mobile devices, most people here, I'm sure, are very pro-open source and the open source model.
But, as you know, things like tablets and mobile phones tend to be more locked down, more proprietary software.
It's harder to install open source software on them.
And, of course, as probably many people here are aware, the open source model is a better security model, not a perfect one, but it allows for better auditing of security problems.
So we're kind of moving in an area where we can expect more security issues at the end-user level with new Internet users.
We also see the same problem in terms of the IoT, as it's known, the Internet of Things.
A recent WIRED article I just read the other day had a situation with hotel rooms where they were using a WIRED communication protocol that was intended for WIRED communication, so security is pretty simple there.
But it was used for guests at hotels to turn on the lights in the air conditioner with an iPad.
But they adapted that WIRED communication protocol that had no security and put that on a wireless network because it was just the easy thing to do.
And so, of course, that meant that if you're a malicious hacker, you could turn off somebody else's air conditioning on a hot day and that type of thing.
So we may be seeing more incidents of that as there's a push to take things...
In the early days of the web, the corporate mainframe was put online sometimes for e-commerce without proper consideration of security.
We may be seeing a lot of incidents in the world of the Internet of Things with embedded devices, sensors, and such, where there are security problems.
We're looking at a point where the Internet of Things and wireless-connected devices like sensors and the like are going to be...
The use are going to be expanding massively because of a couple of trends here.
Probably most people here have heard of Moore's Law, that every 18 months a new computer chip has got double the density in terms of transistors on it.
There's also something called Cume's Law that is similar for actual energy efficiency in electronics.
So that is to say that the actual power that's needed to operate a certain type of computer with a certain capacity is dropping massively.
And what that means is that there's an interesting...
Charlie Strauss, a futurist and sci-fi author, recently had an interesting blog post where he speculates that by 2030 that a city would be able to cover every square meter of the city with sensors or embedded devices that would be quite powerful for the cost of currently what it costs them to clean the streets.
So naturally this is a lot of data and there's major kinds of privacy issues there.
At the same time, you know, it cuts two ways.
If general purpose computers become tiny and ubiquitous, we can also have cool things like this, which...
Okay, let's see, go here...
Ah , okay, right.
Okay, all right.
Oops, whoa.
Okay, sorry folks.
Okay, yeah, that's right.
Okay, can we page down here?
Okay, so this is a Raspberry Pi that's been set up specifically to be used as a Tor router.
And it's pretty inexpensive.
This is from the Adafruit website and it's like $100.
So you can imagine that in a few years that it would be possible to make lots of these incredibly tiny, incredibly cheap, and distribute them throughout, say, an urban area.
So on one hand you have problems with surveillance that becomes ubiquitous, but at the same time you have the ability to route around damage and censorship and the like in a way that has never been possible before.
Okay.
Ah, right.
There we go.
Back to, okay.
So, right.
Okay, so now what else, how else will the Internet change?
Well, okay, Vince Cerf, another pet project of his is the interplanetary Internet.
And that actually is not an attempt to communicate with space aliens.
We'll maybe get to that later.
But it's basically a way to adapt the Internet protocol for the long distances and interruptions of space travel, but it also has other kinds of interesting applications because it's basically delay-tolerant networking, where interruptions and problems of that type can be worked around in a way the current Internet protocol cannot be.
So it can also be used in a situation where there is some kind of major natural disaster, a breakdown of telecommunications infrastructure.
The interplanetary Internet protocol could handle that better.
It could also be used in some cases where a repressive government interrupted telecommunications services.
And a third application that's being looked at a lot is the use of scientific and environmental research in very remote places where there isn't normal infrastructure as well.
So if you're studying wildlife migration in a distant area, you could use the interplanetary Internet protocol to more effectively put sensors in that place and collect the data from them.
Another cool thing that Vint Cerf and musician Peter Gabriel have started is the interspecies Internet.
So again, our definition of a multi-stakeholder is expanding quite a bit.
The interspecies Internet is an attempt to communicate with intelligent creatures that are not human, like dolphins and such, using different kinds of digital interfaces, teaching them to, for example, having a really waterproof, of course, a large tablet computer which a dolphin might learn to bump with different sections of the screen,
the touch screen with his nose, and learn to communicate that way.
So obviously down the road we may be looking at some very different kinds of stakeholders in the Internet.
Another more bizarre and slightly disturbing trend is the use of military applications for animals that involve different kinds of implants and the like.
One particularly bizarre one is DARPA's HI-MEMS, that's an acronym, project, which stands for Hybrid Insect Microelectrical Mechanical Systems.
And what they were doing there, as of about 2011, I couldn't find anything more up-to-date on this, but it was a long-term project for about six or seven years.
They were embedding electronic devices into insect larvae, so that as the insect came to be an adult insect, that they would actually be able to control the insect's movements with the idea of basically, as bizarre as it may sound, making cyborg insect warriors.
The idea is initially that they would fly around and could do reconnaissance, but I suppose if you've got a really venomous insect, you could use it as an assassin too.
But again, the point is here that basically anything electronic now is likely to be connected, and often wirelessly, to the Internet.
So the cyborg insect warriors are also stakeholders in the Internet, potentially.
Now we're going to go the reverse direction here.
So now we're talking about who's coming online.
Now I'm going to move to our jumping a little bit further into cyberspace with virtual worlds and augmented reality.
And virtual worlds are taking off at a rapid pace now, and things like immersive online games and the like.
And you may think, if you're not a gamer or into such things, that it still seems that the resolution and the actual quality of the experience is very poor, and that you can't imagine people really living in cyberspace quite yet.
But the brain is hardwired to respond to two things without questioning very much whether they're real or not.
And one is threatening stimuli.
So if you're threatened, you don't worry too much or question too much if something's real, because you don't want it to hurt you.
Conversely, if it's something pleasurable, why worry if it's pleasurable or whether it's real or not either.
So, for example, a really sophisticated, well-designed game might switch rapidly between threatening and pleasurable stimuli to the degree that it becomes very immersive, and even if, again, the resolution of, say, an online game, the imagery, is not really ultra-high resolution or realistic,
you can become very, very absorbed in it.
And at the same time, we're moving towards the increasing use of, currently for medical and military applications, things like implants for people who are hard of hearing that are network-connected, bionic eyes for implants, the optic nerves for people who are blind or have visual problems.
But obviously, these types of things can be used just as a general purpose in replacement for the current monitors that we have.
So basically, we're looking at a situation where the sense of self will be changing rapidly.
If you have this stimuli that's coming from cyberspace or somewhere else, feeding directly into your brain, your sense of what your body is and your sense of self that way will change very rapidly.
And also, what we're seeing is a shifting sense of self and loyalty to institutions that's changing, partly because of things like younger people feeling alienated, having economic difficulties and so forth.
One study found that people's life satisfaction with their lives in the real world was kind of inverse to their satisfaction if they do a lot of things in Second Life or what have you.
Their Second Life existence, if that was very positive and they were very happy, it was probably because their life in the physical world in vSpace was not as good.
So we're seeing younger people who are due to economic disparity and other kinds of issues alienated from political and economic systems in the real world, moving rapidly to spending more and more time in virtual worlds.
The other interesting thing there is that this is a fairly recent study, but a couple of years ago, that at that point the users of online games and virtual worlds typically had four avatars.
So now each stakeholder has now been multiplied by four.
We have four people, online personalities for every person.
So things are changing that way.
And the growing presence of people, or the movement of people into virtual worlds and online games and that virtual environment presents a lot of interesting challenges to the traditional nation-state.
So basically the concept of... I'm citing Mark Goodman, who is a law enforcement consultant who specializes in cybercrime and cyberterrorism and information warfare.
And he talks about how the concept of virtual reality is pretty new to law enforcement agencies around the world, yet more and more people are spending more and more of their time in the virtual worlds and the full range of criminal activities that we see in the real world is rapidly migrating to cyberspace.
Specifically in terms of virtual worlds, where things like money laundering, theft of intellectual property, exchange of child abuse images, and the like are occurring without the same kind of awareness in terms of law enforcement.
Currently, most virtual worlds are kind of siloed environments, like a company like Second Life uses proprietary software, a very centralized kind of architecture.
But that's changing too.
A person you've never heard... everyone here has heard of Tim Berners-Lee and knows that he invented the World Wide Web.
Another person is probably, I think in a few years, will be seen as important as Tim.
And her name is Christina Videra Lopez, a computer scientist based out of the University of California.
In 2009, she developed the HyperGrid.
And that's an open source technology for doing what, in virtual worlds, what the Web does for the Internet.
So that is, it makes interoperable virtual worlds, so you can go from one...
your avatar can go from one world to another.
And this opens things up radically, but it also presents interesting problems in terms of intellectual property and that type of thing.
What can you take from one world to the next?
Some kinds of issues, much more complex, but similar to ones that have been...
have mostly been dealt with in the Web a long time ago.
In addition, there is now an open metaverse currency that allows transactions across these different virtual worlds and they can be converted to regular currencies, bitcoins and US dollars and that type of thing.
So, I was talking a moment ago about the change of sense of self and identity that people experience through immersive technologies, virtual worlds, and also implants.
And these present a lot of interesting questions here, too.
DARPA is currently working on mood-altering implants to help people with post-stress traumatic PSTD.
So they are looking to be able to alter people's moods with brain implants, which, of course, will be connected to wirelessly, most likely, as increasingly medical prostheses are.
And who else is going to be on the Internet?
Well, you think we've already determined that people are becoming several people in terms of different personalities in cyberspace with their different avatars.
But it gets a little stranger here.
DARPA also is working on a type of sensors that will recognize a threat.
Basically, when you experience a threatening situation, you sense it unconsciously more quickly than you respond consciously.
So, to speed things up in the battlefield, they are looking to develop different kinds of monitors that will recognize the unconscious reaction to a perceived threat and help a soldier, by having an electronic gun sight on his weapon, start to look for the target before he's even aware that he or she has identified a threat.
So, basically, the unconscious mind is going to have its own input on the Internet, separate, and this could be obviously developed into other kinds of applications and a different sort of thing where you can maybe deny that you did something because my unconscious didn't,
but it wasn't me.
In any event, obviously these kinds of more invasive types of interfaces present major kinds of security issues that haven't been, again, the technology is running ahead of where security is being, you know, and it might be bad if somebody, you know, breaks into your bank account and steals money,
but if they start, you know, controlling your arms and legs and your impressions of the world, that's a little scarier.
And so there is a reaction to all of this, so that, of course, more mundane kinds of security issues we've been all very aware of recently, like the Snowden revelations, and a bigger reaction to it, so that both the Kremlin and the German government, for example,
are reverting to paper and manual typewriters for critical high security communications in their organizations.
A visionary sci-fi author of mine, Philip Dick, wrote a novel many years ago called Ubik, which described a part of the story that involves a prudence organization, which employed people with sort of inverted kind of psychic abilities, not that they weren't psychic,
but they were able to block other people's psychic abilities because telepathy was being used in industrial espionage.
So if you had a company that you were concerned about another company might spy on you, you'd hire an anti-telepath to accompany you when you went into a conference and you were going to discuss some sensitive stuff.
So this all is kind of grim and scary stuff.
And basically we need... it comes back, I think, in the end to the fact that in the end, human beings develop technology, even if we make the technology then can, you know, promulgate itself.
And ultimately what has to be built into the technology is an ethical sense.
And as machines become more intelligent, we need to do that even more so.
Eben Moglen, who is a friend of the Internet Society of New York, an important software freedom advocate and did a lot of legal work for the Free Software Foundation as well as teaching at Columbia, warned specifically about mobile devices that knew too much and whose inner workings were not understood.
And he suggested that there be a... basically that the ethics, ethical behavior be programmed, hardwired into intelligent machines.
And he was kind of thinking a little bit of Isaac Asimov's iRobot, of course.
There is now a really pretty cool organization called the Open Roboethics Initiative, which is a think tank that's addressing issues of ethics as they pertain to robotics and trying to take an open source approach to it, looking to the development models of Wikipedia and Linux,
too.
The final question here, I guess, and this gets back to the issues of a little bit of Internet governance, the real question is whether a human community can get to the Internet Engineering Task Force credo of rough code and consensus, whether... rough consensus and running code,
I knew it was something like that, whether before the machines can go on to their, you know, act out on their worst impulses of human beings and then ultimately on to their own unknown agenda before we can stop it.
So, thank you.
Thank you very much.
I bet you weren't planning to hear about cyborg insect warriors today.
All right, so I think we'll start to take questions now.
We might want to turn up the house lights so I can... there we go.
Thanks, there you all are.
All right, so if anyone has any questions, we'd be happy to field them.
Oh, yes, how could I forget?
Oh, it's on.
The question slide indicates it's question time.
I have a question more about the sort of mechanics of the Internet Society and ICANN and such as it currently exists.
You'd mentioned I'm familiar with the ICANN, like trying to distance itself from being a US... what's the...
Run by the Commerce Department.
Yeah, the Commerce Department.
Is there been any discussion of like moving it underneath the Internet Society or having its own thing or...
The Internet Society is taking more of a role in ICANN recently, so that we have people who are on the different kinds of committees and oversight organizations for ICANN.
Also, and this is a good thing, and this is why you should join the Internet Society and get involved with your local chapter.
The... yeah, this is the sales pitch.
There are... there are like caucuses within ICANN.
They're called at-large structures.
And in the past, a few Internet Society chapters were at-large structures, including ours, the New York one.
But that's changed radically so that now about 50% of the at-large structures are actually Internet Society chapters.
So the Internet Society is taking more of an active role.
They're not going to take over or control ICANN, but have a growing role in terms of advocacy and are really very much working... pushing for greater accountability and transparency.
Thank you.
Hi, my name is Kevin Caron.
I'm from Atlanta, Georgia.
And full disclosure, I'm more of a political activist than I am a tech person, so bear with me.
But one of the issues that I work on in Atlanta is the issue of autonomous weapons that's coming up more recently.
There's going to be some more work done on this in the international community coming up here.
And I talked to Mark Gaborud, who's a scientist.
He suggested a ban on autonomous weapons in 1988.
I'm curious, like, where you see this going and kind of what needs to be done.
There's a researcher in Atlanta who's working on it right now, and the DOD wants him to do it.
So I'm just curious in your thoughts on that.
Well, yeah, I'll let David... I'll just start by saying that I think a total outright ban or total outright support of anything is an oversimplification.
I mean, because as with any software or technological item, an autonomous weapon system is made up of different parts.
I mean, really, it's the weapon parts that's dangerous.
The autonomous part, maybe not so.
You take away the rocket, there's not really much of a threat.
So I think that, you know, so the question is, would we ban this technology or maybe ban, you know, the use of the rocket?
Or I think that in order to answer that question fully, we'd have to break it down.
Sure, sure.
There was a DOD directive that kind of defines what the U.S.
is calling autonomous weapons.
So that's kind of where my head's at, but...
Right, there are autonomous weapons now in place in certain parts of the world, like the DMZ in Korea.
They have... both sides have autonomous weapons there.
They're fixed, you know, basically the guns with a computer that will identify a target and shoot at it.
While I was at the Drones and Aerial Robotics Conference, which was, I think, down at the New York Law School, Daniel Suarez, who is a sci-fi author with a military background, gave a great, fantastic talk.
He just wrote a novel about the subject, specifically about both autonomous weapons and autonomous weapons that could join swarms or act in groups independently on an ad hoc kind of basis.
And what he suggested is that all drones have a cryptographic signature hardwired into the main circuit board of the device that would always identify themselves, and that any kind of drone that did not have this would immediately be assumed to be hostile and destroyed.
So that that would basically be, through this digital fingerprint, it would be possible to identify them.
So that was his technical solution to it.
Thanks.
Great talk.
Thanks.
Yes, definitely great talk.
Thanks very much.
David, you mentioned... you talked briefly about ambient connectivity, so Bob Frankston's idea.
For myself, I think that's really essential for an open, pervasive Internet of Things and the community of the future.
In the previous talks, we talked a lot about ISPs, Comcast being everywhere, and all this incentive to block something like ambient connectivity.
I'd be curious how you see it possibly playing out, the challenges.
Right.
I think it's a real cool idea.
I'm not quite sure how it exactly would be implemented.
To pick it up, and just to clarify ambient connectivity, Bob Frankston invented the original spreadsheet, Visicalc, but now he's... Smart Guy's gone on to other things, and he's pushing this idea of ambient connectivity, that basically, in the same way that we don't,
you know, take streets and sidewalks for granted, that connectivity to the Internet should be as accessible as that.
And his idea is that rather than breaking down the silos between different kinds of services, so that, for example, you might walk down the street here, and if you were to take out your smartphone, you would see that there are many, many different Wi-Fi hotspots and things like that,
but that they're locked down, and basically there's a lot of redundancy there.
We talk about a bandwidth shortage, but actually there's a huge amount of bandwidth that's not really available, so that basically if you could do something along the lines of mesh networking across topologies and networks, and make all of that connectivity available to anybody who needed it,
you know, with some kinds of restrictions, that that would be a good thing.
That's his model.
And the business side of that, or the political side, I'm not quite sure what the solution is.
It's a very cool idea, though.
In order to probably fully implement a vision like that, I don't know if TCPIP can take us all the way there.
There are talks on emerging Internet architectures, which probably we should have talked about a bit, but one specific type of content delivery networks.
This is often used as an example as Netflix.
Rather than trying to, if you're trying to watch Netflix and it's a busy time of day, you shouldn't just request the main Netflix server.
There should be content servers that can provision the content closer to where it actually needs to be.
And if we stop talking about IP addresses and start breaking down Internet content in terms of what it actually is, then we can start to get to where we're trying to go a lot quicker, and ambient connectivity becomes a lot more possible in that kind of context.
Awesome, thanks for sharing your thoughts.
Hi, first off, thanks for your talk, it was fascinating.
My question is, I think the Internet's one of its greatest strengths has been its lack of regulation, its lack of any of these current political structures that we have in most other areas of life, and it's allowed a great amount of flexibility.
Is that something that we really want to be aiming to have more of in the future, or is the current chaotic architecture actually a great strength and something we should strive to keep?
I'm sorry, the current what architecture?
Chaotic architecture.
Oh, chaotic.
Yeah, we want to...
The design of the Internet, in terms of being kind of permissionless, in terms of being able to offer new surveys on your own server and so forth, that is very important.
Certainly something that we at the Internet Society, particularly the Internet Society of New York, want everyone to be a first-class citizen on the Internet.
That is to say, a lot of times if you have residential broadband services, it's really designed for you to be a passive consumer.
It's asymmetrical, you can't upload as much as you download, you may not be allowed to have servers in your home according to the AUP, Acceptable Use Policy, or whatever.
And no, we're very much for a decentralized model and things like mesh networks, and outside of security and other kinds of real law enforcement kinds of issues that are legitimate, that people should be able to do what they want.
That's very much what we're about, including independent community networks and that type of thing.
We're very much for that.
Sure, thanks.
You had talked a little bit about the robots becoming autonomous and doing whatever they're wanting with their nefarious...
Can you talk a little bit about your thoughts on the Kurzweil thing and the exponential increase of technology and the singularity, how that...
I have an opinion about that.
Yeah, I'd like to hear your opinion.
I just saw him give a talk the other day.
I have a couple of thoughts.
One, I'm a technologist.
I believe that there is something beyond our current technology in terms of the human spirit and consciousness and such, and I don't think that machines are intelligent in the way that humans or living beings are, and that the type of intelligence that we have is radically different.
I think the biggest thing to do is to understand how our current technology is really different, even if it's supposedly intelligent, how it's different from human or organic, sentient consciousness, and to understand some of the ethical and moral issues there.
I think that's very important.
I'm not... my crystal ball is a little cloudy here.
Probably Moore's Law is going to continue more or less, and Cume's Law and the like, and so the current kinds of technology are going to get more powerful.
But I don't really know that they are the same as organic technology, you know, technology of our brains, or the ineffable, you know, thing of consciousness, which may be something very, very different.
And, you know, I'm a spiritual person.
I believe that there is something outside of the material.
That's my opinion.
And that we're not going to duplicate that with the current technology ever.
If we ever got close, it would be because it really changed a lot.
It was very different from this.
Could you comment?
I'm pretty much in agreement with him in the sense that we understand that even today's top artificial intelligence isn't really intelligent.
The artificial intelligence is designed to do a particular problem.
It's designed to be really good at Jeopardy.
It's designed to traverse a lot of terrain.
It's designed to make autonomous decisions about where to go.
What the beauty of, I guess, human and animal intelligence is that it's dynamic.
It can learn new things without really being programmed to do so.
You know, it's extremely inventive.
We have an understanding of aesthetic and beauty.
And my timer is getting close, so I'm going to cut it there.
Thank you.
No problem.
Last question.
Thank you.
It's a very nice, comprehensive introduction to the Internet governance issue.
I just wanted to comment quickly that what you mentioned about the multi-stakeholder model, that please do not make the mistake to consider multi-stakeholder model as a problem of representation, because the old national governance model in the world,
it was based on the concept of representation, structural representations.
And the whole idea of multi-stakeholder model tries to break up that idea of representation and instead build up freedom and liberties for people in a democratic sense to open up and raise their own issues.
When I say we couldn't define it, I'm not trying to put it down.
I mean, absolutely, I think the multi-stakeholder model has done wonders for the Internet society.
The problem is that when we try and talk about what is it, point to it, how does it work, how do we manage it, those become trickier questions.
But in terms of which Internet governance model is best, I think certainly the Internet society believes that the multi-stakeholder model is the way to go.
That just doesn't mean we can't, you know, we may just be able to tell you exactly what it is.
Thank you.
All right.
Thank you very much, everyone.
Thank
you.
Hello again, Hope.
Good evening, everyone.
Just a couple of brief announcements before the next presentation.
If you, through the course of this conference, go to a talk that gets filled to capacity, as has happened already a few times today, please note that if you leave before the end of the talk, we can't always guarantee you'll be let back in because bodies move into spaces where bodies once were and your body may no longer have a space.
If you want to hang any posters or anything like that up around the conference, that's cool.
We're all for it.
But please do not use anything but the blue painter's tape.
We'll give you some.
We have some at our security desks, I believe.
Or if you have your own, just make sure it's the blue tape.
That's the only tape that's allowed to be stuck to the walls of this hotel.
And I think we're about ready.
So without further ado, I'm happy to pronounce...
I'm happy to pronounce...
I'm happy to pronounce things.
I'm happy to present the next presentation, which is, Why the Future is Open Wireless.
Ladies and gentlemen, Adi Kamdar, Nate Cardozo, and Ranga Krishnan.
Thank you.
Hello.
Can you all hear me?
Great.
How's it going?
How's everybody doing?
It's been a long day.
Had enough Club Mate?
Yeah?
Because I clearly haven't.
We're here to talk to you guys about open wireless, about the open wireless movement.
Open wireless is a project that we're all from, the Electronic Frontier Foundation, that we've been working on for the last few years.
And it's getting better and better as the days go on.
So just by way of introduction, I'm Adi Kamdar.
I'm an activist at EFF.
Can we go down?
Sure.
I'm Nate Cardozo.
I'm one of the staff attorneys at EFF.
And one of the several things that I work on is the Coders' Rights Project.
So I defend hackers, coders, innovators, programmers, try and keep you guys out of trouble, and try and help you get out of trouble when you get in it.
And that's part of what I'm on this panel for.
And I'm Ranga Krishnan.
I'm a technology fellow at the EFF.
And I actually joined just last year to work specifically on this project.
And it has been very exciting.
And I hope to show where we are with it today.
So the open wireless project, it has a lot of roots.
But one of the issues that this is trying to solve is one that we may have all experienced, that I definitely experienced.
In fact, the other day I was at home, and my internet went out.
And I checked the available networks, and there were 15 networks.
And most of them were locked.
And I couldn't access anything, which was unfortunate.
And I did see one unlocked network, and it was called Big Blue House Guest.
And I knew exactly which house this was on my street.
And I'm like, great, you guys are going to allow me to use your internet.
Thank you, friendly neighbors.
Unfortunately, I ran into this right afterwards, a nice captive portal.
And it says, enter the guest account password, which I didn't know.
And I didn't really want to go over and knock on the door and ask for the password.
This is the sort of issue where we're living in a world where walking down the street, sitting at home, in the office, whatever, we have a bunch of wireless networks available, yet none of them are actually accessible.
And that seems inefficient to us.
There's another story from around a couple years ago, when we were launching this project, where Hurricane Sandy happened.
How many of you guys are from around here?
I can't see anything, so I'm assuming there's some hands up.
I realized that was useless.
Well, I'm sorry you guys had to experience Hurricane Sandy, because it seemed awful.
But one of the things that came out of that is, with the power outages and with the outages of service, we saw things like this.
This was a friend who tweeted this out.
Awesome picture of Internet infrastructure.
New Yorkers idling for free working Wi-Fi outside of Starbucks.
And this is actually right around the corner.
Starbucks was one of the few places that was offering free Wi-Fi that was working, and that people could actually access.
These were people who needed to get in contact with people, needed to check their email, needed to send out I'm okay Twitter updates.
These were people who needed to use the Internet, and yet they couldn't.
And the one place that was offering some sort of open Wi-Fi, some sort of free Wi-Fi, was Starbucks.
So with this in mind, we started the open wireless movement.
And the point of the open wireless movement is to encourage open wireless.
It's to create a world where open wireless is the norm.
And we're imagining a world, a future, with ubiquitous open Internet.
Why would you do this?
Why would you open up your wireless networks?
That's a good question.
Part of it could be because of sharing.
Sharing is actually a very important thing.
Not all of us are using all of our bandwidth all the time.
Not all of us are using our networks all the time.
We've been in situations where we needed to get on the Internet, and we couldn't.
And it would be nice if someone shared their Internet with us.
EFF actually has a board member, Bruce Schneier, who runs an open wireless network.
And I like his quote a lot.
He says, to me, it's basic politeness to run an open wireless network.
Providing Internet access to guests is kind of like providing heat and electricity or a hot cup of tea.
And who doesn't like that?
But besides access, why open wireless?
Access can't be the only issue.
There are a lot of groups and people advocating for access to the Internet.
And that's an issue that a lot of people are dealing with right now.
And open wireless by no means is the be-all end-all of this.
But it is a step in the right direction.
One of the big reasons is privacy.
Now, how can opening up your network be conducive to privacy?
And this is something we're actually going to talk about quite a bit from a legal perspective and a technical perspective.
But one reason is because right now when we're mobile, right now when we're roving around, we're tied to these things.
We're tied to our smartphones.
And when we want to access data, when we want to access the Internet.
And these smartphones use networks offered by folks like these.
And that's kind of an issue, right?
If we want to be mobile, if we want to use devices, if we want to connect to the Internet, and we're not close to a wireless network that we have access to, we have to pay a contract.
We have to use these sorts of services.
And our smartphones are essentially tracking devices.
So wouldn't it be nice if the privacy world we imagine actually fostered the sort of innovation that we're seeking?
If it actually fostered innovation that didn't have to rely on these few big players and could actually take advantage of all of these wireless networks running through us right now.
And this could be any sort of innovation.
Here are four random pictures I found.
If you want to connect your dog.
If you want to have a watch that does something smart.
If you want a face mask.
I'm not actually quite sure what that is, but it looked kind of cool.
And it could be connected to the wireless Internet.
And wouldn't that be great?
Potentially.
I don't know.
But these are the sorts of innovations that you can't necessarily use out in the open because AT&T and Verizon have this sort of domain covered.
One of the big questions that people ask is, alright, fine, I'm maybe okay with opening up my wireless Internet.
I may be okay with opening up even a part of it.
But doesn't opening up my wireless network just reward freeloaders?
Can't people just get on and do whatever they want with it and not pay for anything?
And doesn't that suck?
And our answer is no.
This is the sort of world that we want to live in.
We're trying to imagine a future where having that sort of culture of sharing and having that sort of culture of openness is something that we can actually foster and actually go towards.
So we're trying to fight against this mentality that this is a bad thing, that this is my wireless Internet.
I need to lock it down and have it be mine, mine, mine.
Because we think with sharing, with open wireless, it's sort of a rising tides effect and everybody just benefits.
So with that, we're going to get into the fun legal matters.
That's me.
As I said earlier...
Is this on?
Can you hear me?
Great.
As I said earlier, I'm Nate Cardozo.
I'm a staff attorney at EFF.
And one of the things I do is counsel the Open Wireless Project.
I also do coders' rights.
So now is my quick little lawyer stuff disclaimer.
I am a lawyer.
I'm not your lawyer.
And nothing I say will change that, unless you're already one of my clients, in which case I'm not talking to you right now.
So I will not be giving legal advice today.
If you come up to the microphone after we're done talking, which we will invite you to do, and you ask a question that calls for legal advice, this is not a confidential setting.
So I can't give it to you in this setting.
I will give you my card and we can talk about it later in a confidential setting.
But this isn't one of those.
Okay.
Copyright.
There are several...
I'm going to address sort of three...
sort of a little more than three sets of reasons why open wireless isn't a bad idea.
Copyright is one of the objections that a lot of people have to open wireless.
And what do I mean by that?
If I torrent a whole ton of movies without using any sort of protection online, chances are I'm going to get a DMCA notice or a six-strikes notice or some sort of complaint, right?
If I don't do that and I open my wireless network to others, is that a problem?
No.
I don't think it is.
And there's a number of reasons why that's the case.
If you're not the person doing bad stuff online, especially with copyright, you're not going to be held responsible.
In copyright, there's one way that you can be held responsible if you're not the one doing the bad thing.
Copyright infringement.
And that's secondary liability, and that comes in two flavors.
Contributory liability and vicarious liability.
These are doctrines which are extremely fuzzy and have a lot of ins and outs, but what we need to know about them for these purposes is that contributory liability requires, essentially, that the network operator have knowledge of what's going on and caused or induced that behavior.
And for vicarious liability, the network operator has to have the right and ability to control the copyright infringement going on and receive direct financial benefit from the copyright infringement.
Luckily, with open wireless, those factors are not satisfied for either contributory or vicarious liability.
If I open the wireless network at my house, I don't have actual knowledge that anyone is using it to do copyright infringement unless they come tell me.
And I'm certainly not inducing them to do so.
I'm not saying this is...
unless I put a big sign up in front of my house that you connect to openwireless.org SSID and use it to torrent your movies, I'm not inducing copyright infringement.
Don't do that.
That's a bad idea.
Vicarious liability is similarly the same.
If I'm a neutral network operator, I don't have the right and ability to control what people are doing on my network.
And I'm not receiving a direct financial benefit from it either.
If you have an open wireless network at your house, chances are you are not receiving a direct financial benefit from that.
But there's some other things that can help us out here too.
And this is one of the aspects of the DMCA which is not entirely bad.
The DMCA, and there's the code number, I was told that maybe if there are lawyers in the crowd they can get CLE credit for this, so that's why I actually included the case.
There's some case titles later down, and the statute.
So there's section 512 of the DMCA.
Creates a safe harbor for network providers.
This is completely optional.
Network providers do not have to take advantage of it if they don't want.
But it's often a good idea, and we have a plan for how they can do this with open wireless.
We've crafted a sample policy.
One of the requirements for the safe harbor if you want to take advantage of the DMCA safe harbor provision is that you have a policy.
A DMCA policy.
And we have a sample for you.
And the policy says that, you know, you can't use this for copyright infringement.
And that you, the network operator will terminate repeat infringers.
And the other part of the safe harbor is that it must accommodate rights holders technical measures.
Those technical measures must be jointly agreed upon.
That's never happened, so we don't really have to worry about that.
So, safe harbor.
512M, subsection M of section 512 says that the network provider does not need to affirmatively monitor the network to qualify for safe harbor.
And that even comes under the nice little subheading privacy.
So, what is safe harbor in general?
It is a way that will provide, it is a way to provide immunity to the network provider to DMCA complaints.
We think that the sample policy that we've crafted at openwireless.org and running an open wireless network at home or at your small business and if you post this policy or if you refer to it, which we think we're doing by having your SSID say openwireless.org and the policy is right there at openwireless.org there's a good argument it is untested that that would qualify.
And you would not be liable under the DMCA.
Negligence.
Some lawyers and I won't call them trolls but they're trolls have decided that the very act of running an open wireless network at your house is negligent.
Luckily they're wrong and the two courts who have addressed it directly have told them that they're wrong in very very strong language.
Running an open wireless network is not negligence.
Why?
Probably because that's what wireless was originally meant to do.
It's not a breach of the duty of care if that's the standard.
Which is completely true.
Risk .
This is something, this is one of the more strong objections to open wireless.
After Andy Greenberg's story on this project came out a couple of weeks ago, the reddit thread was dominated by people saying if I run an open wireless network at my house I'm going to get swatted.
I'm going to get a SWAT team busting down my door for people downloading child porn and doing whatever else bad people do on the internet.
That is not completely out of the question.
However, a lot of people run open wireless today and it doesn't, the SWAT team scenario doesn't happen very often.
And the more people who run open wireless the less likely this is going to be.
So there's a little bit of a first mover problem but luckily you're not going to be the first mover.
The first mover was years and years ago.
If you're running open wireless and police comes to investigate and they see that you're running open wireless, maybe that would help you out a little bit.
Sometimes police don't do that thorough of an investigation before they break down your door so that's not a sure fire.
But there's some other things we can do to mitigate the risk here.
And one of those things is in a future release of the software that Ranga is going to talk about we're going to have the option of routing all of the guest network traffic over a VPN of your choice or over Tor.
And that will not lead anyone back to your IP.
Obviously this is... I'm not recommending that you do your child porn surfing over Tor or a VPN.
In fact I recommend that you do not do that.
But hopefully most people don't do really horrible things online.
I know I've been running an open wireless network at my house for years and I've never been swatted but I don't think I'm unique in that.
So I think the risk is there but it is overstated.
There's some other things which I don't really have a slide for which I do want to talk about as Adi said.
How does open wireless increase your privacy and the privacy of others?
Right now there's a...
I wouldn't say it's a legal theory but there's a sort of prevailing attitude that a person's identity can be determined simply by their IP address.
We think that's wrong.
We think an IP address can sometimes be a proxy for identity but often isn't.
And that is absolutely not conclusive and courts are starting to come around to this.
It's been tested most often in the copyright troll situation where Malibu media sues a 79 year old grandmother for downloading unspeakable title and the 79 year old grandmother says look I wasn't the one who downloaded unspeakable title it couldn't possibly have been me and they say well you're the subscriber on the IP address and she said yeah but that doesn't mean it was me.
So the more people who do open wireless the harder it is going to be as a legal matter to claim that an IP address is your identity and that your identity is your IP address.
We don't think that's a good thing.
Secondly this sort of ubiquitous