Redesigning the Internet: Anonymity or

Transcription

1 Redesigning the Internet: Annymity r Accuntability? Ira Rubinstein Senir Fellw, Infrmatin Law Institute NYU Schl f Law Center fr Cybercrime Studies, Jhn Jay Cllege Nvember 30, 2009

2 Early Internet The Evlving Internet t Overview Accuntability in a Future Internet David Clark s Wrk Overcming Sme Objectins Lessig Zittrain Privacy and Free Speech Cncerns Next Steps

3 Basic Gal: Cnnectivity Design Principles: i Early Internet Packet switching End-t-end argument Intelligent endsystems Netwrk f cllabrating netwrks Layering

4 Lack f Security Prtcls designed fr benign and trustwrthy envirnment Prtcl design assumed that end-pints wuld cperate t achieve gals Security nt designed in Little authenticatin f packets r peple Weak identity ty Varius effrts t blt n security but with limited success Current status: End-hst security is weak and end-pints are untrustwrthy Entire system vulnerable t explits and attacks

5 The Scial and Plitical Overlay Open: Access t all devices, users, services; pen standards/pen surce Innvative: New (and unanticipated) applicatins, services, infrastructure Free: Freedm f expressin; n centralized cntrl f services r prducts Als, specific views n limited gvernment cntrls and IP rights Annymus? Often assciated with free sftware and free culture mvements Annymity is the given, the default, the substrate Meaning f annymity y Absence f name and address Identity-annymity cntinuum Internet annymity: Levels f privacy prtectin

6 Lessig s Regulability Argument Cde is law--meaning that Internet architecture regulates and cnstrains its use Fr Lessig, TCP/IP is an architecture f liberty This is partly due t the design f TCP/IP, which reflects bth a plitical decisin abut disabling cntrl and a technlgical decisin abut the ptimal netwrk design. But Lessig fears that business and gvernment will make the Internet mre regulable by mving frm a default f annymity t a default f identificatin Why? TCP/IP is identity-ignrant ignrant But cmmerce requires security in the frm f a trust system (PKI), and gvernment will leverage this change fr cntrl purpses f its wn S Lessig (writing in 1999) fears an inevitable shift t S Lessig (writing in 1999) fears an inevitable shift t an architecture f cntrl

7 The Evlving Internet Changing Circumstances Vast scale and reliance n Internet as critical infrastructure Lack f security Spam, phishing, DDS, btnets New threat resurces: rganized crime, terrrists, state actrs New requirements Security, reliability and availability Accuntability and what this means: Cmmn structure cnsists in three necessary elements: infrmatin, standards, and sanctins; als, n accuntability withut identity. Annymity minimizes i i r eliminates i accuntability Other requirements Future Internet Incremental vs. clean slate apprach

8 Accuntability via Incremental Prevent spfing Apprach Ingress filtering and surce-based accuntability Hst authenticatin Tracking and tracing Use IP addresses t track and trace cmprmised hsts Data retentin Revcable annymity Replace IP prtcl with Accuntable IP (AIP) Self-certifying addresses

9 Accuntability via Clean-Slate Apprach Future Internet Design (NSF-funded FIND prject) Treats security as fundamental Rejects band-aid aid apprach and recmmends including apprpriate identity mechanisms Flexible architecture that makes identity available at packet level r end-pints as needed Next Generatin Secure Internet (NGSI) When shuld identity be visible at the packet level? One apprach: Make available an identity field but with n fixed specificatin

10 David Clark s wrk Redesign f Internet characterized by tussles including annymity vs. accuntability Design shuld permit variatins in utcme Mechanisms needed that regulate interactins based n mutual trust Permit users t chse with whm they interact* Permit users t chse the level f transparency Reframe the end-t-end argument in terms f trust (where and between whm trust exists) rather than in terms f physical lcatin Rely n trusted third parties t manage identity, prtect end-users frm attack r unwanted cntent, prvide mutual assurances, and s n Design fr delegatin s that end-user cntrls trust decisins *See Jhnsn, Crawfrd and Palfrey, The Accuntable Internet ( cnnect nly with thse wh have shwn they are wrthy f yur trust ).

11 Need new rle fr identity Clark n Identity Identity (knwing whm ne is cmmunicating with) key t deciding n apprpriate level f trust Many design questins fr identity at bth the netwrk level and the applicatin level Preliminary ideas Avid a single (universal) identity scheme but instead create a framewrk fr talking abut identity Permit annymity but make it visible r at least hard t disguise

12 Teasing Out the Plicy Issues Redesigned internet prtcls wuld give a new rle t identity and thereby challenge lng held views abut the relatinship between architecture and scial and plitical values Entrenched view (Lessig/Zittrain): i Identity undermines civil liberties by enhancing regulability Security enhancements threaten innvatin Annymity highly desirable in preserving/achieving free speech and privacy Emerging view (Clark et al): Accuntability is necessary aspect f re-designed Internet Early design principles require certain mdificatins Gal is t make necessary changes while preserving privacy and free speech

13 Lessig Redux: Prblems Cde 2.0 (2006) Lessig reaffirms his argument that the Net will becme increasingly gy cntrlled and regulable thrugh digital identity technlgies Ntes in passing that recent wrk n a new identity layer is very prmising but this des nt allay his fears f increasing regulability Prblems The design f TCP/IP is nt the result f any plitical decisin Lessig s accunt f TCP/IP as identity-ignrant is almst entirely lacking in histrical i cntext t The default cnditin f the Internet is nt annymity, but weak identity Lessig views security almst entirely thrugh the lens f its secndary effects n regulability, and never as a serius prblem in its wn right In addressing why gvernment has yet t transfrm the Net int a regulable space, Lessig mainly defers t Zittrain

14 Zittrain s Generative Dilemma Shares Lessig s views n annymity and regulability but takes security far mre seriusly Primary cncern is that malware and related security issues will trigger a fatal shift: Generative Internet appliancized netwrks Generativity: The capacity f technlgy t prduce unprmpted change driven by large, varied and uncrdinated audiences. The Internet & PCs are generative; tethered appliances and sftware as-service are nt Appliances are ptimized fr specific apps and restrict user and 3 rd party mdificatins, thus permitting perfect enfrcement and security via lckdwn On this accunt, security is inversely related t, y y generativity, hence the dilemma

15 Prblems with Zittrain s Reslutin Either/r analysis Generativity r appliances But rpsed slutins are inadequate Peer-based slutins premised n cllabrative actin and self- rdering nrms: the Wikipedia mdel Make the Internet mre stable fr rdinary users Deply cmmunity-based tls Examples: Red-green virtual machines? N StpBadware? Clser t the mark. But unlike Wikipedia, the Internet at large lacks a cmmn eths and is highly vulnerable t asymmetric threats Security that passes a least harm t generativity test still may fail at prtecting ti hsts against attack and meeting availability requirements

16 Other Objectins t Re-Designing g Netwrk Prtcls: Privacy Annymity y prtects privacy PII/nn-PII distinctin Annymity tls cmbat surveillance Cunter-arguments Incmplete cnceptin f privacy Ring f Gyges scenaris Annymity tls have very mixed recrd f success Privacy by design is a better apprach This includes user-centric identity systems

17 Other Objectins t Re-Designing g Netwrk Prtcls: Free Speech 1 st Amend. prtects annymity y including annymus plitical speech cnducted nline McIntyre: An authr s decisin t remain annymus, is an aspect f the freedm f speech prtected by the First Amendment. McIntyre in cyberspace Subpena cases: Unmasking annymus defendants CDA/COPA False identity cases ACLU v. Miller Jaynes v. Cmm. f Virginia

18 McIntyre Cunter-arguments e Language g f pinin is equivcal Annymity r pseudnymity? Cnfrnting the enfrcement dilemma McIntyre in cyberspace Subpena cases rely n balancing tests CDA/COPA cases cnsider impact f age verificatin devices n free speech w/ recgnizing i right t annymity Miller cnstrues a badly drafted statute Jaynes miscnstrues the relevant technlgy and arguably uses the wrng standard f review State actin issue What if re-design f Internet results frm pen standards prcess g p p rather than gvernment mandate?

19 Cnclusin: A Few Next Steps Treat security as a cre aspect f any future Internet design; this includes acknwledging a new rle fr identity Evaluate any identity-based slutins against the fllwing criteria: Are there equally effective alternative slutins that avid the privacy/free speech cncerns assciated with identity? If a slutin requires identity, d identity applicatins suffice r is it necessary t build identity int the netwrk? If a slutin relies n identity at the netwrk level, what are the scial implicatins? Hw des any new identity-based capability play ut in bth demcratic and repressive scieties? Hw d these capabilities fare against Zittrain s perfect enfrcement scenaris?

20 Bibligraphy S. Bellvin, D. Clark, A. Perrig and D. Sng, Clean Slate design fr the Next-Generatin Secure Internet (2005) M. Blumenthal and D. Clark, Rethinking the Design f the Internet: The End t End Arguments vs. the Brave New Wrld, ACM Transactins n Internet Technlgy (TOIT), v.1 n.1, p (Aug. 2001) David D. Clark, Marjry S. Blumenthal End-t-end Arguments in Applicatin Design: The Rle f Trust (2004) David D. Clark, Requirements fr a Future Internet: Security as a Case Study, (December 2005) Anja Feldmann, Internet Clean-Slate Design: What and Why? ACM SIGCOMM Cmputer Cmmunicatin Review, July 3, 2007 D. Jhnsn, S. Crawfrd & J. Palfrey, Jr. The Accuntable Internet: Peer Prductin f Internet Gvernance, 9 Va. J. L. & Tech. 9 (2004) Lawrence Lessig, CODE AND OTHER LAWS OF CYBERSPACE (1999) and CODE 2.0 (2006) Jnathan Zittrain, THE FUTURE OF THE INTERNET AND HOW TO STOP IT (2008)