Puppies Yapping Noisily
Archive for June, 2010
Cisco Announces the Cius, the BlackBerry of Tablets
Jun 30th
Cisco Announces the Cius, the BlackBerry of Tablets
Cisco announces that it will be launching an Android-based tablet next year named the Cius, aimed squarely at the business market.
Tweet Of The Day – Maggie Gallagher
Jun 30th
Tweet Of The Day – Maggie Gallagher
A new study by a Spanish gay rights group reports that about 10,000 gay marriages have taken place since Spain legalized gay marriage in 2007. Spain has about 30 million people in 2008 over the age of 15. If 3 percent of the population is homosexual, that would be about 900,000 gay and lesbian adults. So 20,000 gay people have chosen to marry so far — about 2 percent of gay adults. Why so few?
Theories abound regarding the low rate of gay marriages in places where it’s legal. A populace not emotionally trained to expect the possibility of marriage, a distaste for the heteronormative institution itself, etc etc.
TORONTO: Chief Of Police Heckled By Gay G20 Protesters At Pride Party
Jun 30th
TORONTO: Chief Of Police Heckled By Gay G20 Protesters At Pride Party
Angry about their treatment by city police at last weekend’s G20 Summit, a group of gay anti-globalists heckled the Toronto chief of police yesterday as he attempted to enter a cocktail party at the headquarters of Pride Toronto. Demonstrators denounced Pride Toronto as a “disgrace and a sellout” of hosting the police at their party. If it’s not one thing, it’s another for beleaguered Pride Toronto. Things get really heated at times in the below clip.
Cisco Announces the Cius, the BlackBerry of Tablets
Jun 30th
Cisco Announces the Cius, the BlackBerry of Tablets
Cisco announces that it will be launching an Android-based tablet next year named the Cius, aimed squarely at the business market.
Music Publishers Keep Lashing Out At Consumer Groups; Those Who Respect Individuals’ Rights
Jun 30th
Music Publishers Keep Lashing Out At Consumer Groups; Those Who Respect Individuals’ Rights
It appears that music songwriters and publishers don’t yet recognize that going on the attack against groups representing public interests and consumers’ rights is a strategy destined to backfire. They just keep doing it, and it’s really making them look both petty and petulant, with no desire to actually understand these issues. Instead, they just think the world owes them their business model, and anyone looking out for larger interests is, quite literally, “the enemy.” We’ve already covered ASCAP’s (long planned) attack on Creative Commons, EFF and Public Knowledge. These attacks are so distasteful that even many ASCAP supporters are upset about them.
Now, it appears that the National Association of Music Publishers is getting in on the misplaced anger. In a recent speech, its CEO, David Israelite lashed out at these groups, and lumped CEA and CCIA into the bunch. CEA and CCIA, of course, have both been pretty strong supporters of making sure that copyright law is not harming innovation or the economy. These are important issues if you believe that a stronger economy is important for everyone — including musicians and songwriters — but it appears that Israelite and the NAMP take a very narrow, zero-sum view of the world, which is that, if the gov’t isn’t handing over greater and greater protectionist policies, something’s wrong — and anyone who supports looking at the actual evidence should be shouted down as an enemy. It’s not a position that can be supported by logic, so it’s pure emotion:
But there is a growing enemy that does not have respect for copyright at all. And this is a very different enemy.When the U.S. Government Accountability Office released a study in April on the economic impact of intellectual property piracy, the Electronic Frontier Foundation, Public Knowledge, the Consumer Electronics Assn. and the Computer and Communications Industry Assn. took out a full-page ad in newspapers around Washington, D.C. “Content industry piracy claims are bogus,” the ad read. “For years, claims of huge losses from digital piracy have been used to justify harsh restrictions on innovators and consumers . . . They have harmed our competitiveness, hampered legitimate businesses and impeded innovation.”
Who are these four groups and why would they take out full-page ads to suggest the ridiculous–that theft of intellectual property isn’t really bad? The answer is, this is the new face of our enemy.
Yup. They call these groups “enemies” twice. Very subtle there. What’s really glaring, however, is that Israelite doesn’t even respond to the actual study at all. I mean, you would think that the actual evidence presented by one of the few parts of the government that is widely respected for its objectivity in doing research, would be worth commenting on. Nope. He skips right over the actual evidence and blames these four groups for actually highlighting what the evidence says. And then he claims that they’re “suggesting the ridiculous”? In other words, Israelite has taken such a faith-based position, that when actual evidence is presented that goes against his faith, he doesn’t just shoot the messenger, he shoots anyone who repeats the message. Convincing.
These four groups have an extremist, radical anti-copyright agenda. They all have an economic interest in the theft of our music or paying little to nothing for it. [And] they are intellectually dishonest in how they approach these fights.
Radical extremists, huh? Isn’t that what the Canadian politicians behind the new copyright law, James Moore, just called critics of his bill? Sounds like the talking points on anyone actually interested in consumer rights is making the rounds, and “radical extremists” is the key phrase in trying to tar and feather anyone who suggests consumers have rights.
I have put together a top 10 list of the positions taken by these groups that I will define as their extremist, radical anti-copyright agenda.
Oh, do tell. This is going to be a great list, I’m sure. Please make sure that it’s in Letterman-style countdown format too…
No. 10: They support changing the law to reduce damages for copyright infringement.
That’s radical extremism? Wow. Of course, when the damages for copyright infringement are so far out of line with the actual harm of copyright infringement — such that someone sharing a single album’s worth of music for non-commercial purposes can be fined $2 million — it seems like it’s actually kind of a pretty good question why the damages are so high. Even judges in these cases appear to find the damages results laughable. When the damages are entirely out of line with actual harm, it seems perfectly reasonable to suggest they be brought more in line. How is that radical or extremist?
No. 9: They support the elimination of statutory damages for secondary copyright infringement.
Again, how is it either radical or extremist to suggest that liability for breaking the law should fall on those who actually break the law, rather than some 3rd party with deeper pockets? Personally, it seems a lot more radical to blame one party just because it’s easier and they have more money, rather than those who actually break the law.
No. 8: They favor rolling back copyright extension; in some cases, radically.
Again, I’m at a loss as to how this is either radical or extremist. Actual evidence (again, the stuff Israelite would apparently prefer to avoid at all costs) has shown the net loss to society and culture from copyright extension. Our original copyright law lasted for, at most, 28 years. The entire point of copyright law was supposed to enrich the public domain, but we haven’t had anything enter the public domain in years, and it’s unlikely we’ll see much enter the public domain in our lifetime. That seems radical.
No. 7: They favor the elimination of the songwriter and publisher rights for server, cache and buffer copies.
Again, this is not at all radical. Nor is it about “eliminating” rights. It’s about accurately applying the law so that ridiculous results don’t emerge — such as cases where cache or buffer copies of songs require additional royalties and licenses, when they’re clearly in transit. It was about not outlawing technology based on how long the wire is (i.e., the Cablevision case, where Israelite apparently supported the blatantly ridiculous position that a DVR hosted by Cablevision is illegal, because it hosts cached versions in transit, while the DVR in your home is legal).
No. 6: They oppose efforts to obtain the identities of individuals engaged in massive copyright infringement.
Not quite. They oppose efforts that expose individuals’ privacy without fair and due process. Who knew it was “radical extremism” to insist on privacy rights and due process. These groups have no problem with exposing the identities of those who break the law when there is due process involved. It’s hard to believe that Israelite is really suggesting that music publishers don’t believe in due process or privacy rights.
No. 5: They support extreme versions of orphan works legislation.
Misleading again. Orphan works legislation is a red herring — only brought about because of the ridiculous overreach in copyright law that wiped out the public domain. The sort of overreach that Israelite’s group supported. So now when these groups try to fix one of the massive problems that this overreach created, it’s dubbed “radical extremism.” Yikes.
No. 4: They have filed legal briefs supporting anti-copyright positions of Grokster, Napster, LimeWire, Cablevision, Google, YouTube and Verizon.
Misleading in the extreme. None of those lawsuits involved “anti-copyright” positions, no matter how much the entertainment industry likes to spin these cases that way. The first three — Grokster, Napster and LimeWire — were never “anti-copyright” positions, they were questions about third party liability. Again these are just questions about who it’s fair to blame: the user or the toolmaker. The entertainment industry wants to blame the toolmakers. Common sense says you blame the actual user. Claiming that a debate over properly applying liability is an “anti-copyright” position is deliberately dishonest. The Google/YouTube case is the same story. It’s a case about liability. Not anti-copyright. The Cablevision case we described above. It was about whether or not the industry could veto technology based on the length of a wire. That’s not anti-copyright at all.
Finally, it’s pretty shocking that he includes Verizon in this list. I’m guessing he’s referring to the RIAA’s fight with Verizon way back when. To suggest that Verizon is “anti-copyright” is ridiculous. That was, yet again, a case about due process — which I guess Israelite is admitting he doesn’t believe in. This Verizon case involved the question of whether or not the RIAA could just demand Verizon hand over details of Verizon customers without a court-reviewed subpoena. The issue covered basic due process, which had nothing, whatsoever, to do with copyright.
It’s really stunning how blatantly Israelite is basically admitting that due process is meaningless if you interfere with “his” business model.
No. 3: They oppose graduated-response protection for copyright owners.
Yes, it’s “radical extremism” to support the view held overwhelmingly by consumers that kicking people off the internet is punishment that does not come remotely close to fitting the “crime” of sharing, distributing and promoting music you love for free.
And, again, of course, most of the arguments against graduated-response efforts are due the clearly unconstitutional lack of due process involved: cutting people off the internet based on accusations rather than convictions is pretty radical and extremist. Actually fighting for due process? Not so much.
No. 2: They oppose treaties that support copyright enforcement like the Anti-Counterfeiting Trade Agreement.
Heh. This one is amusing, because he conveniently ignores the serious problems with ACTA. They’re not “opposed” to these treaties just for the hell of it, or because of some “radical extremist anti-copyright” position. They’re opposed to it because it has all sorts of ridiculous language that will do serious harm. But, I guess for Israelite to realize that he’d have to look at the evidence, and he’s less a fan of that than he is of supporting due process.
No. 1: They actually argue that illegal peer-to-peer file-sharing traffic helps the economy and doesn’t hurt songwriters.
I’m actually not aware of any of those four groups actually saying that, but I will say it. What’s hurting songwriters is their inability to adapt to a changing market. The songwriters who are adapting seem to be doing just fine. We write about them all the time, but Israelite won’t read this blog, I’m sure, because it’s filled with “evidence.” Yes, if you don’t adapt to market changes, it can “hurt” your business. But that’s what most of us here in capitalist America think is a good thing. Otherwise we’d all be riding around in horse buggies. So, sure, automobiles “hurt” the horse buggy market. And the printing press “hurt” the monks-writing-books business. But what happened? Much greater opportunities came about as a result, and the smart horse buggy makers who jumped ship to join automobile makers did just fine. We’re seeing successful songwriters adapting all the time. It’s just that they’re doing it without kowtowing to Israelite and NAMP.
I don’t see how any of that represents “radical extremism.” I see plenty of attempts to falsely demonize those who believe in due process, privacy rights, consumer rights, innovation, correctly applying liability and (*gasp*) actual factual evidence. But, that’s not radical extremism. It’s called reality.
The Oscars vs. GoDaddy
Jun 30th
The Motion Picture Academy is somewhat infamous for its over-aggressive IP claims around the “Oscar” awards. It’s even sued a blog that was helping to promote the event. Apparently, just suing one website wasn’t enough, so back in May it sued domain registrar GoDaddy for allowing a bunch of domains to be registered.
Now, in a reasonable world, where liability is properly applied, GoDaddy would never be liable for actions of its users. But, unfortunately, one of the very few areas that DMCA and Section 230 safeharbors do not cover is trademark law. So, the Academy may actually be able to get away with blaming GoDaddy for not magically blocking anyone from registering any domain that might, possibly, maybe be about the Oscar Awards:
Suing under the Anticybersquatting Consumer Protection Act, the Academy disputes more than a 100 domain names, including 2011oscars.com, academyawardz.com, jaylenososcars.com, betacademyawards.com, oscarsunplugged.com, oscarshotels.com, oscarstravel.com, oscarsliveblogging.com … etc. Damages could total as much as $10 million.
On top of the basics of blaming GoDaddy for allowing such domains to be registered, the Academy seems to directly be taking issue with the fact that GoDaddy has a system for letting domain holders “park” those domains and make money from ads. The Academy tries to spin this as GoDaddy purposely “profiting” off of its intellectual property, but that’s ridiculous. GoDaddy is just offering a general domain parking ad system. It’s making money off of any parked domains. It has nothing to do with their intellectual property. And, frankly, if these domains were really so valuable to the Academy, why didn’t they register them in the first place?
To make the whole thing even more ridiculous, the Academy claims that a GoDaddy patent application shows that it knows that it needs to filter out ads on certain types of domains. But just because you develop a system to do so, it doesn’t mean you are legally required to abide by it.
The whole thing is, frankly, absurd. If the Academy has a problem with certain domains, it should go after those who actually registered them. Not the registrar. If this lawsuit actually gets anywhere, it could create a real chill for registrars, who will then feel the need to review and block certain registrations, even if they would be perfectly legal.
Permalink | Comments | Email This Story
The Lack Of A Billion Dollar Pureplay Open Source Software Company Shows The Market Is Working Properly
Jun 30th
A few weeks back, Glyn Moody wrote a column discussing why there were no “billion dollar open source software companies,” in response to a discussion he had with Redhat’s CEO (Redhat is in the $750 million range):
He said that he did think that Red Hat could get to $5 billion in due course, but that this entailed “replacing $50 billion of revenue” currently enjoyed by other computer companies. What he meant was that to attain that $5 billion of revenue Red Hat would have to displace software that currently costs $50 billion. Selling $50 billion-worth of software — even if it only costs $5 billion — is somewhat hard, which is why it will take a while to achieve.
I immediately knew I wanted to write up something about it, as it reminded me of a point I’ve been wanting to discuss for a while. But I got busy with some other things, and in the meantime, a bunch of other folks picked up the ball and ran with it — and each time they did, they added something different to the conversation, which gave me more to think about before writing up this post. Matthew Aslett pointed out that this is leading many companies to adopt hybrid models while Stephen O’grady pointed out that the question was really irrelevant. Katherine Noyes, over at LinuxInsider highlighted many other points that people brought up as a part of the discussion. It’s all a very interesting read, though none really hit on the two key points that Glyn’s original column got me thinking about:
- There absolutely are billion dollar open-source companies, but they’re not pure play open source companies. But that’s okay, because a “pure play” open source company is like a record label trying to focus on just selling music. You’re in the wrong business — trying to sell infinite goods — so of course the direct profits should be limited.
- The lack of billion dollar pure play open source software companies is a sign of a working efficient economy. In fact, billion dollar pure play open source companies would be a sign of a market failure.
On that first point, I would argue that tons of companies are, actually, billion dollar open source companies: Google, IBM, Facebook and many others, for example, all rely heavily on open source software and are valued at well over a billion dollars. It’s unlikely that any of the three would be anywhere near what they are today without open source software. It’s just that all of these companies were smart enough not to be in the bad business of selling an infinite good. Instead, they all looked for ways to use an infinite good — for free — to make something scarce massively more valuable. With Google it was user’s attention and all of the information out on the web. With IBM it was services to support enterprise technology. Even Redhat, the company that kicked off this discussion, really makes its money from services and expertise.
Arguing about the profits directly attributable to pure play software sales of open source software is like only counting CD/digital download sales and claiming that’s the “music business.” It’s not. It’s the recording industry.
But the more interesting and more important point is about the lack of billion dollar pure play open source software companies is the fact that this is a sign of a strong, healthy and efficient marketplace. Even if you go all the way back to your Adam Smith, you would know that when you have a company making outsized profits, competitors will enter that market. That’s the nature of a free market, and it tends to lead to efficiency, innovation and (most importantly) consumer surplus.
I’m reminded of various studies on modern societies without intellectual property protections (or with very weak intellectual property protections) that often saw thriving and highly competitive industries in those areas. One area that has been particularly interesting to me lately is looking at various countries that did not have patent coverage for pharmaceuticals, but then were forced into it. If you look at the pharma industry in those countries, you see the same story almost every time. Without patents, the industry is thriving with many, many different firms (sometimes hundreds). Yes, a percentage of these firms are certainly pure “copycat” firms, but the ones at the top are not. However, after patent protection is introduced (often with the claim that it will help investment, help competition and help innovation), the exact opposite occurs. Instead, many, many firms either go out of business or are gobbled up by large multinational conglomerates. The overall profits increase to those conglomerates, but the innovation and social welfare declines.
This is, of course, exactly what Adam Smith saw nearly two and a half centuries ago. If you give companies monopolies, they will take monopoly profits, but those monopoly profits come at the expense of innovation and consumer benefits.
So, giant billion dollar companies in markets — especially markets of infinite goods — suggests a market inefficiency of some sort. The lack of such pure play billion dollar companies is a good thing. It means the market is acting as it should, and being more efficient and creating greater economic benefit to the wider market. And this goes back to a point that Glyn makes in his original column:
I think this is the first time I’ve heard someone as senior as Whitehurst admit something rather profound: that open source solutions save money for customers by doing away with the fat margins for existing computer companies — and thus shrink the overall market. Opponents of open source like to paint this as “value destruction” that takes money “out of the economy” — as if free software went around burning down offices and warehouses.What they fail to grasp is that the 90% savings do not just vanish like the smoke from those supposed conflagrations. That money is still in the economy, it’s just spent on other items: free software allows people to use their hard-won money for things other than operating systems, office suites and applications. In developing countries, for example, it might mean more funds available for education or health.
And that’s exactly the point. When a market is made more efficient, that actually spreads throughout other areas and helps consumer surplus, economic growth and the rest of the world benefit. Automobiles and airplanes “shrunk” the railroad market, but opened up massive new markets. The end result was a much bigger economy and greater economic opportunity and consumer surplus. Automated telephone dialing “shrunk” the telephone operator business, but opened up massive new efficiencies, leading to advancements like the internet itself. And that created massive economic efficiencies and growth and consumer surplus.
So, just as we shouldn’t worry about the lack of “billion dollar” pure play open source software firms, we should also not fall sway to the complaints of companies who are being disrupted by these models, about how all that money they make is somehow “disappearing” if the government doesn’t come in and protect their business model. What’s actually happening is all that money is being put to more efficient use. Unfortunately, it’s rare to see politicians or business leaders who actually understand this simple, but important fact, and it leads them to propping up legacy businesses, which actually slows down innovation, economic growth and consumer surplus.
Scammers Actually Got Away With Millions Of Microtransactions Scam
Jun 30th
Scammers Actually Got Away With Millions Of Microtransactions Scam
It’s the idea that’s been put forth in various movies over time: what if computer hackers could just take a tiny amount off of millions of transactions — transactions so small that most people wouldn’t notice or care. And yet, we hadn’t really heard of it actually working anywhere… until now. The FTC has apparently shut down one such scam, though it was an operation since 2006. The details of how it was set up are pretty convoluted, and help explain, in part, why this sort of scam isn’t quite as easy as the movies make it out to be. Also, by “micro” charges, we’re not talking fractions of pennies, but charges between $0.25 and $9 — enough that they could get away with this for four years without too much of an outcry. In fact, apparently only 6% of the charges were contested. Yes, out of 1.35 million fraudulent charges, only 78,724 people noticed and complained.
Wired digs into the details of how this was set up, which highlights the complexity of the operation:
According to court documents filed (.pdf) in the U.S. District Court for the Northern District of Illinois, the scammers — identified only as “John Does” in the complaint — recruited money mules through a spam campaign that sought to hire a U.S.-based financial manager for an international financial services company.Mules who responded to the ad and were chosen for the task opened multiple bank accounts and about 100 limited liability companies for the scammers, which were then used to make the fraudulent charges and launder money to bank accounts in Cyprus and several east European countries, including Estonia and Lithuania.
Front companies set up by the mules included Albion Group, API Trade, ARA Auto Parts Trading, Data Services, New York Enterprizes, and SMI Imports, among others.
The scammers then purchased domain names and set up phone numbers and virtual office addresses for the front companies through services such as Regus. They used this information — along with federal tax I.D. numbers stolen from legitimate companies with similar names — to apply for more than 100 merchant accounts with credit card processors, such as First Data.
According to IDG,
They used another legitimate virtual business service — United World Telecom’s CallMe800 — to have phone calls forwarded overseas. To further make it seem as though their companies were legitimate, the scammers would set up fake retail Web sites. And when credit card processors asked them to provide information about company executives, they handed over legitimate names and social security numbers, stolen from ID theft victims.
When they had to log into payment processor Web sites, they would do this from IP addresses that were located near their virtual offices, again evading payment processor fraud detection services.
Once approved by the card processors, the front companies were able to charge consumer credit and debit cards. Money charged to the cards was directed into the bank accounts set up by the money mules, who then transferred it to accounts overseas.
The charges showed up on consumer credit and debit card statements with a merchant name and toll-free phone number. But consumers who called the numbers to question the charges generally encountered an automated voicemail recording saying the number had been disconnected or instructing them to leave a detailed message. The calls, of course, were never returned.
See? A bit more complex than just taking a fraction of a penny off of each transaction. But, as the IDG report notes, if you’re looking to set up an online scam, here’s a blueprint.
ASCAP Assails Free-Culture, Digital-Rights Groups
Jun 30th
ASCAP Assails Free-Culture, Digital-Rights Groups
The association representing 380,000 composers, songwriters, lyricists and others associated with the music industry has begun a fund-raising campaign to stifle groups that support free culture and digital rights.
The American Society of Composers, Authors and Publishers is urging the membership to donate money to battle the Electronic Frontier Foundation, Public Knowledge and even Creative Commons.
In a letter sent to members this week, ASCAP said those groups and unnamed “technology companies” are “mobilizing to promote ‘Copyleft’ in order to undermine our ‘Copyright.’ ”
The letter continues, saying “the truth is these groups simply do not want to pay for the use of our music. Their mission is to spread the word that our music should be free.”
The fund-raising campaign came a day after Victoria Espinel, the nation’s copyright czar, outlined an intellectual-property enforcement plan that did not include a call to push internet service providers to adopt policies to cut service to repeat copyright scofflaws. Such a policy, referred to as “three strikes” or “graduated response,” was strongly backed by the motion picture and recording industries, and opposed by EFF and Public Knowledge.
Instead, Espinel said the nation’s “intellectual property-enforcement efforts should be focused on stopping those stealing the work of others, not those who are appropriately building upon it.”
The ASCAP, which also distributes royalties, said those groups are “influencing Congress against the interests of music creators. If their views are allowed to gain strength, music creators will find it harder and harder to make a living as traditional media shifts to online and wireless services. We all know what will happen next: the music will dry up, and the ultimate loser will be the music consumer.”
ASCAP did not return messages seeking comment.
ASCAP’s attack on EFF and Public Knowledge are farfetched. Those groups do not suggest music should be free, although they push for the liberalization of copyright law.
But the attack on Creative Commons is more laughable than ASCAP’s stance against EFF and Public Knowledge.
While lobby groups EFF and Public Knowledge advocate for liberal copyright laws, Creative Commons actually creates licenses to protect content creators.
The non-profit has issued various licenses to approximately 350 million pieces of content to writers, musicians, scholars and others. Flickr, for example, is filled with pictures licensed by Creative Commons.
The licenses allow the works in the public domain, with various rules regarding attribution, commercial use and remixing.
The group’s creative director, Eric Steuer, said nobody forces anybody to adopt the Creative Commons credo. “I think it’s false to claim that Creative Commons works to undermine copyright,” he said in a telephone interview. “It’s an opt-in system.”
Following Wednesday’s fund-raising letter from Paul Williams, ASCAP’s president, Steuer said several ASCAP members who also use Creative Commons licenses have donated money to Creative Commons.
Hat Tip: Boing Boing
Photo: labguest/Flickr
Data at Rest vs. Data in Motion
Jun 30th
Data at Rest vs. Data in Motion
For a while now, I’ve pointed out that cryptography is singularly ill-suited to solve the major network security problems of today: denial-of-service attacks, website defacement, theft of credit card numbers, identity theft, viruses and worms, DNS attacks, network penetration, and so on.
Cryptography was invented to protect communications: data in motion. This is how cryptography was used throughout most of history, and this is how the militaries of the world developed the science. Alice was the sender, Bob the receiver, and Eve the eavesdropper. Even when cryptography was used to protect stored data — data at rest — it was viewed as a form of communication. In “Applied Cryptography,” I described encrypting stored data in this way: “a stored message is a way for someone to communicate with himself through time.” Data storage was just a subset of data communication.
In modern networks, the difference is much more profound. Communications are immediate and instantaneous. Encryption keys can be ephemeral, and systems like the STU-III telephone can be designed such that encryption keys are created at the beginning of a call and destroyed as soon as the call is completed. Data storage, on the other hand, occurs over time. Any encryption keys must exist as long as the encrypted data exists. And storing those keys becomes as important as storing the unencrypted data was. In a way, encryption doesn’t reduce the number of secrets that must be stored securely; it just makes them much smaller.
Historically, the reason key management worked for stored data was that the key could be stored in a secure location: the human brain. People would remember keys and, barring physical and emotional attacks on the people themselves, would not divulge them. In a sense, the keys were stored in a “computer” that was not attached to any network. And there they were safe.
This whole model falls apart on the Internet. Much of the data stored on the Internet is only peripherally intended for use by people; it’s primarily intended for use by other computers. And therein lies the problem. Keys can no longer be stored in people’s brains. They need to be stored on the same computer, or at least the network, that the data resides on. And that is much riskier.
Let’s take a concrete example: credit card databases associated with websites. Those databases are not encrypted because it doesn’t make any sense. The whole point of storing credit card numbers on a website is so it’s accessible — so each time I buy something, I don’t have to type it in again. The website needs to dynamically query the database and retrieve the numbers, millions of times a day. If the database were encrypted, the website would need the key. But if the key were on the same network as the data, what would be the point of encrypting it? Access to the website equals access to the database in either case. Security is achieved by good access control on the website and database, not by encrypting the data.
The same reasoning holds true elsewhere on the Internet as well. Much of the Internet’s infrastructure happens automatically, without human intervention. This means that any encryption keys need to reside in software on the network, making them vulnerable to attack. In many cases, the databases are queried so often that they are simply left in plaintext, because doing otherwise would cause significant performance degradation. Real security in these contexts comes from traditional computer security techniques, not from cryptography.
Cryptography has inherent mathematical properties that greatly favor the defender. Adding a single bit to the length of a key adds only a slight amount of work for the defender, but doubles the amount of work the attacker has to do. Doubling the key length doubles the amount of work the defender has to do (if that — I’m being approximate here), but increases the attacker’s workload exponentially. For many years, we have exploited that mathematical imbalance.
Computer security is much more balanced. There’ll be a new attack, and a new defense, and a new attack, and a new defense. It’s an arms race between attacker and defender. And it’s a very fast arms race. New vulnerabilities are discovered all the time. The balance can tip from defender to attacker overnight, and back again the night after. Computer security defenses are inherently very fragile.
Unfortunately, this is the model we’re stuck with. No matter how good the cryptography is, there is some other way to break into the system. Recall how the FBI read the PGP-encrypted email of a suspected Mafia boss several years ago. They didn’t try to break PGP; they simply installed a keyboard sniffer on the target’s computer. Notice that SSL- and TLS-encrypted web communications are increasingly irrelevant in protecting credit card numbers; criminals prefer to steal them by the hundreds of thousands from back-end databases.
On the Internet, communications security is much less important than the security of the endpoints. And increasingly, we can’t rely on cryptography to solve our security problems.
This essay originally appeared on DarkReading. I wrote it in 2006, but lost it on my computer for four years. I hate it when that happens.
