The Internet
Total Page:16
File Type:pdf, Size:1020Kb
•• TEN THINGS SHOULD KNOW LAWYERS ABOUT THE INTERNET .. The COMMONS Initiative: Cooperative Measurement and Modeling of Open Networked Systems KIMBERLY CLAFFY .. CAIDA: Cooperative Association for Internet Data Analysis BASED AT THE SAN DIEGO SUPERCOMPUTER, CENTER AT UCSD .. table of contents .. .... about the author 01 07 Table of contents, Point #6 -08 Author biography How data is KC Claffy being used Kimberly Claffy Point #1 02 Point #7 08 received her Ph. D. Updating legal -10 in Computer Science frameworks Normal regulatory responses doomed from UCSD. She is Director and a prin- Point #2 02 -03 10 cipal investigator Obstacles to progress Point #8 -16 Problematic responses for CAIDA, and an Point #3 03 Adjunct Professor Available data: -05 Point #9 16 of Computer Science a dire picture The news is -19 and Engineering at UCSD. Kimberly’s not all bad research interests include Internet Point #4 05 measurements, data analysis and vi- -06 The problem is not so 20 sualization, particularly with respect new Point #10 Solutions will cross -23 to cooperation and sharing of Internet data. She advocates the use of quanti- Point #5 06 boundaries An absurd situation tative analysis to objectively inform Sponsors, Credits 24 public Internet policy discussions. Her email is [email protected]. Adapted from: http://www.caida.org/publications/papers/2008/10_things_Lawyers_Should_Know_About_The_Internet 1 2 Last year Kevin Werbach invited me to his Supernova 2007 conference to give a 15- minute vignette on3 the challenge of getting empirical data to inform telecom4 policy. They posted5 the video of my talk last year, and my favorite tech podcast ITConversations , posted the mp3 as an episode last week. I clearly needed more than 15 minutes... In response to my “impassioned plea”, I was invited to6 attend a meeting in March 2008 hosted by Google and Stanford Law School — Legal Futures — a “conversation between some of the world’s leading thinkers about the future of privacy, intellectual property, competition, in- novation, globalization, and other areas of the law undergoing rapid change due to technological advancement.’’ There I had 5 minutes to convey the most important data points I knew about the Internet to lawyers thinking about how to update legal frameworks to best accommodate informa- tion technologies in the 21st century. With a few more months of thought, here is my current top ten list of the most important things lawyers need to understand about the Internet. All content in this booklet (including text, photographs, graphics, and any other original works), is licensed under7 a Creative Commons Attribution-No Derivatives 3.0 license. 1 Kevin Werback bio, http://werbach.com/about.html 2 Supernova 07 Conference archive, http://conversationhub.com/category/supernova07/ 3 “Closing the Interactive Loop”, http://conversationhub.com/category/supernova07/ 4 ITConversations, http://itc.conversationsnetwork.org/ 5 “No Access To Internet Data”, Jun 2007, http://itc.conversationsnetwork.org/shows/detail3440.html 6 Legal Futures Conference, Mar 2008, http://www.law.stanford.edu/calendar/details/1594/ 7 Creative Commons Attribution-No Derivative 3.0, 2008, http://creativecommons.org/ licenses/by-nd/3.0/ 01 point one point two Science Foundation’s program for Internet secu- Another caveat: most security-related studies rity research13 spends ~$35M/year on dozens of are published or funded by companies trying to I. Updating legal frameworks to II. Our scientific knowledge about the research projects, none of which have data from sell more security software, their objectivity is Internet is weak, and the obstacles to accommodate technological ad- operational Internet infrastructure. also in dispute. Again, EOT factors render truth vancement requires first updating progress are primarily issues of econom- other legal frameworks to accommo- ics, ownership, and trust (EOT), rather elusive. date empirically grounded research than technical. C. Not only is traffic data off limits, but sharing into what we have built, how it is data on the structure of the network is forbid- point three used, and what it costs to sustain. Economically, network research is perpetually den too — commercial ISPs are typically not behind network evolution — basic instrumen- even allowed to disclose the existence of peer- III. Despite the methodological limi- tations of Internet science today, the \ tation can increase in cost 10X with one net- ing agreements, much less their terms. So when There is increasing recognition that various legal work upgrade, while network research budgets developing tools for accurate Internet mapping, few data points available suggest a dire picture: frameworks (from copyright to privacy to wire- are lucky to stay even. But the ownership and researchers cannot validate the connectivity tapping to common carriage) need updating in trust obstacles are even greater: policy support inferences they make, since the information is light of technological developments of the last for scientific Internet research has deteriorated typically intended to be secret. few decades. Unfortunately, the light is too dim 10 A. We’re running out of IPv4 addresses that can along several dimensions since the National 16 to really understand Internet behavior, usage 11 be allocated (there are Science Foundation left the scene in 1995 , and many allocated addresses patterns, architectural limitations, and econom- that are not in observed use17 , but there is no further when DARPA pulled out of funding ac- 18 ic constraints, because current legal frameworks 12 policy support (yet) for reclamation or reuse) , ademic networking research after 9/11 . Some 19 for network provisioning also prevent sharing of data points exposing the state of “Internet sci- and the purported technology solution ( IPv6 8 data with researchers to scientifically investigate ence”: ) requires investment that most ISPs are not pre- any of these questions. Even for data that is legal pared to make20. Regardless of whether Internet to share, there are overwhelming counter incen- A. Two decades of Internet research have failed growth is supported by IPv6 or a concerted ef- tives to sharing any data at all in the competi- to produce generally usable tools for band- fort to scrape more lifetime out of the current tive environment we have chosen — although width estimation, traffic modeling, usage char- IPv4 protocol, it will induce growth of core not achieved9 — for the network provisioning acterization, traffic matrix estimation, topol- Internet routing tables relying on a routing industry. ogy mapping, or realistic Internet simulation, system that is increasingly inappropriate for with progress primarily blocked on the ability the Internet’s evolving structure. So while it’s So while I support updating legal frameworks to test them out in realistic network and traffic fair to say that we need a new routing system21, to be congruent with reality, I think we need to scenarios. A few researchers who do manage to D. OECD published a 53-page report: Measur- no institution or agency has responsibility for first confront that we have no basis for claiming get data via relationships of mutual trust (in- ing security and trust in the online environment: developing one much less the global economic what reality is yet. 14 cluding CAIDA) are not allowed to share data a view using official data . As you may have and political challenge of deploying it. “no aphorism is more frequently repeated… with other researchers, inhibiting reproducibil- guessed by now, the report about ‘measuring se- than that we must ask Nature few questions, ity of any result. Compared to established fields curity’ is based on no measurements from any B. Pervasively distributed end-to-end peering or ideally, one question at a time. The writer is of science, it is hard to defend what happens in networks, only survey data reflecting user per- to exchange information is not only threatening convinced that this view is wholly mistaken. the field of Internet research as science at all. ceptions of their own security, which other stud- the integrity of the routing system, but also the ies15 have shown to be uncorrelated with reality. 22. Although it bears Nature, he suggests, will best respond to a logi- B. U.S. (and other) government agencies con- business models of the ISPs cally and carefully thought out questionnaire; tinue to spend hundreds of millions of dollars indeed if we ask her a single question, she will per year on network research — with cyber se- 13 NSF Trusted Computing program, http://www.nsf.gov/funding/pgm_summ.jsp?pims_ often refuse to answer until some other topic curity research being the most fashionable this id=503326&org=NSF has been discussed.” Sir Ronald A. Fisher, 14 Measuring Security and Trust in the Online Environment, Jan 2008, http://www.oecd.org/ decade — funding researchers who almost nev- dataoecd/47/18/40009578.pdf Perspectives in Medicine and Biol- er have any data from realistic operational net- 15 McAfee/NCSA Cyber Security Survey, Oct 2007, http://download.mcafee.com/products/manuals/en- , 1973. ogy works. An illustrative example: the National us/McAfeeNCSA_Analysis09-25-07.pdf 16 ANT Censuses of the Internet Address Space, Jun 2008, http://www.isi.edu/ant/address/ 17 Mapping The IPV4 Address Space, Mar 2008, http://maps.measurement-factory.com/ 8 “Toward a Culture of Cybersecurity Research”, 2008, http://papers.ssrn.com/sol3/papers. 18 ARIN’s Number Resource Policy Manual, Aug 2008, http://www.arin.net/policy/nrpm.html#eight1