November 14, 2007
By Janna Quitney Anderson, Director of Imagining the Internet and Assistant Professor of Communications, Elon University
Rio de Janeiro, Brazil – It can be a personal disaster. A virus can wipe your hard-drive clean, destroying years of work; spyware can steal your personal information and put you, your family or your finances in danger. We fight back with anti-virus software and e-mail filters to block the bugs and spam, but they just keep coming.
Even more of a threat is the likelihood that entire portions of the communications network – a network that handles the world’s finances, air-traffic control and many other vital operations – or the power grid that supports it can be taken down, halting activities and even threatening lives.
Some Internet problems are created by hackers, some by criminals and some are even created by robot programs running out of control.
PC World recently estimated that 80 percent of consumer PCs are infected with spyware. As many as two-thirds of computer users may have been hit by a virus at least once. A recent study by CIO magazine projected that by the year 2010, computer programmers will discover about 100,000 software vulnerabilities for hackers to exploit during the calendar year – that’s one new opportunity every five minutes … of every hour … of every day.
The stakes get higher when you consider such things as cyber terrorism and even the threat of cyber warfare.
These are some of the challenges being discussed by delegates here at the second annual Internet Governance Forum in Rio de Janeiro, Brazil. It is a forum facilitated by the United Nations and born out of the processes surrounding a couple of other previous events called the World Summit on the Information Society. These meetings bring stakeholders from all walks of life together to discuss the future of the Internet along with their expectations and concerns about this developing technology. For many of these people, one of the most urgent issues is security.
Can we respond effectively to security threats while we protect people’s rights to privacy and free expression? And how do you come up with rules and responses that cross national boundaries?
The challenges are immense.
It is estimated the cyber crime costs hundreds of billions of dollars annually worldwide. This includes acts of fraud, counterfeiting, intellectual-property theft and the exploitation of stolen passwords, credit card numbers and other private information. With the Internet’s global environment, criminals have found they can easily ply their trade while law-enforcement agencies in each country struggle through the red tape of tangled international laws and jurisdictions.
Some are calling it the Golden Age of Crime. The threat becomes scarier when the damages go beyond economic and move into the realm of cyberterrorism and cyberwarfare.
But it is difficult to stop the negatives without influencing the positives.
“If you start criminalizing hacking tools that a lot of system administrators need for testing the security of their networks,” explained political scientist and privacy researcher Ralf Bendrath during the main-room Security session at IGF, “then you might actually try to do something for security, but the unintended consequence is that you’re less secure in the end… We need to talk about protection against fraud, protection against things like cybercrimes and so on, but also about the protection of privacy. And we had a couple of very interesting discussions over the last few days on how with the latest technologies you can actually have better privacy and at the same time better security.”
In April 2007, the government of Estonia claimed Russia launched a three-week-long cyber warfare attack aimed at shutting down Estonian government offices, banks and newspapers – all of this a retaliation over Estonia’s decision to relocate a Russian war memorial statue. Estonia, which prides itself as having a “paperless” e-government, said at least six foreign and justice ministry Web sites were swamped by the attacks, and an Estonian defense ministry spokesman compared the attacks to those launched against the United States on 9-11.
The attack was started when overwhelmingly massive waves of data requests were sent into Estonia from Russia and from computers that had been co-opted by robots around the world. Estonia had no option but to cut its data ties to the outside world, halting commerce and damaging the country’s economy for several days.
Future wars will be fought in network attacks that can cripple a country’s infrastructure, shutting down power and water plants, disrupting communications and transportation systems, and even affecting military or defense systems.
The people attending IGF say the world must consider the implications of cyberterrorism and cyberwarfare. Bendrath mentioned what he called “arms control in cyberspace.”
“That could be one potential global public-policy issue that could be addressed in the future at the IGF or elsewhere,” he said. “As more nations are entering the virtual arms race and are setting up cyberattack units in their armies and so on there’s a need for arms control.”
A big problem with crime on the Internet stems from the fact that different countries have different laws. For instance, if a person wants to run an online gambling operation he can’t base it in the U.S. – that’s illegal – but there are plenty of other places he can take that business and still make it work.
Another borders concern is the issue of how to coordinate the effectiveness of various countries’ police forces and judicial systems. Because countries and cultures are so different, no one is willing to agree on a world Internet police force or judicial body, so savvy criminals can find ways to work the system.
“The difficulty we are facing is the fact that law enforcement agencies to need to cooperate and that is something that is lacking at the moment,” said Marco Gercke, a cybercrime researcher. “It does not help you if you have sufficient [criminal law] instruments in place if you cannot cooperate with other law-enforcement agencies quickly. We are still using traditional instruments that take weeks and months.” He urged that more governments agree to the Convention on Cybercrime, which was developed by the Council of Europe – it has been signed by leaders of 43 countries, most of them (including the U.S.) in the developed world.
It’s a real challenge to respond to security threats and provide intellectual property protection without dismantling freedom of expression and universal access, the very things that make the Internet so powerful. There’s danger in having too many laws, too much hard-set policy.
Alun Michael, a member of the UK parliament active in telecommunications issues, made an excellent point at the IGF’s main security session. “Whenever there’s a problem,” he said, “the public demand more laws, more regulation. And the problem is that laws rarely prevent what they forbid. So we must agree, mustn’t we, that we need a cleverer approach. Too often, security is an add-on, and that’s useless. Security and enterprise development must be developed together, but they have to do it in a partnership with civil society and government.”
Cristine Hoepers, a security analyst for the Computer Emergency Response Team, urged technology people to build security concerns into the development of software and hardware from the most basic level upward. “We need to prepare the next-generation professionals … think about security in the whole process,” she urged. “There will be someone interested in attacking. Ask, ‘Am I using good practice to implement [security]?’ If they are, since the beginning, being taught to be security-minded and about the security problems we may have, we can mitigate … we will have less problems and maybe we can deal with and manage better the problems we have.”
Can we have a more secure Internet and still protect the freedoms – the civil liberties that allow us to speak our minds as we choose, voice objections to our governments, be as creative as we want to be, write computer programs, do our business and conduct 21st century life? Or are we headed to a new world in which we must register to use the Internet, sign in with our government or on an international Internet personal identification system when we go online and have every online move we make tracked – all in the name of increased security?
When people at the Internet Governance Forum discuss security, they are also talking about:
- Coming to an agreement on the definitions of security threats, cybercrime, cyberterrorism and cyberwarfare.
- Cooperation across national borders, taking different legal policies into account.
- Keeping primary internet resources secure.
- The best way to assure authentication and ID online while maintaining people’s privacy.
- The challenges to privacy in a security environment.
- The best ways to assure security in the future for the wireless, mobile internet.
There is no expectation that governments or organizations around the world can magically come up with security solutions that lessen the threats of viruses, scams, cyberterrorism or cyberwarfare. But we can share our own solutions with others and we can come to an agreement on how to work together whenever possible. The way each nation executes its plan to provide some level of security can provide a model for people in other nations.
(Eryn Gradwell and Dan Anderson were contributing reporters for this article.)