Web Security Trust Models
I will try to lay out the different types of models on a high level, and I encourage corrections or clarifications. It's worth re-stating that what we're talking about is how you as a web user know that who you are talking to is who they claim to be (if they are, then you can be confident that your other security measures like end-to-end encryption are working). (more...)
Monday, February 22, 2010
How Do You Trust On the Web?
Over at Freedom to Tinker, I've done a post outlining different models for web security trust models. This issue intersects with policy because it helps determine who we trust with our communications.
Saturday, February 13, 2010
Google Buzz Blowback
The story of the week from my perspective has been Google Buzz and the various privacy concerns it raised. It seems clear that Google did not think this one through entirely. The best critique of the issues I've seen so far was Harry Lewis' "What Was Google Thinking?" post.
The latest blog post from the Gmail team may not fully answer this question, but it does demonstrate a willingness to listen to users and try to fix mistakes... and kudos to them for admitting that they made a mistake.
That's about as close to "we screwed up" as you're going to get from a large corporation.
For what it's worth, I see promise in Google Buzz. I haven't yet deleted my profile, and if Google sorts out the issues then I might actually keep using it.
The latest blog post from the Gmail team may not fully answer this question, but it does demonstrate a willingness to listen to users and try to fix mistakes... and kudos to them for admitting that they made a mistake.
We quickly realized that we didn't get everything quite right. We're very sorry for the concern we've caused and have been working hard ever since to improve things based on your feedback.
That's about as close to "we screwed up" as you're going to get from a large corporation.
For what it's worth, I see promise in Google Buzz. I haven't yet deleted my profile, and if Google sorts out the issues then I might actually keep using it.
Monday, February 1, 2010
The Internet and Common Carriage
I spent this past weekend at the Silicon Flatirons broadband conference in Boulder. The gathering draws telecom lawyers, academics, and advocates for a discussion about policy issues in broadband. The Silicon Flatirons community is also responsible for a very good journal (now open access!), and the 2005 book Digital Crossroads (co-written by former Executive Director Phil Weiser and his friend Jonathan Nuechterlein). Nuechterlein is a brilliant telecom attorney, and although Digital Crossroads is fundamental to my understanding of internet law, I find myself in eternal disagreement with his policy positions.
We are all currently awaiting the conclusion of the Comcast/Bittorrent case in DC Circuit Court, which will determine whether the FCC has jurisdiction to enforce its so-called "four internet freedoms" (I described the issues way back when this fight started a year and a half ago). In parallel, the Commission is conducting a proceeding to determine whether it should more explicitly establish "open internet" rules. Neuchterlein generally does not like anything resembling ex ante regulatory obligations on telecom infrastructure providers -- certainly not from the perspective of his clients (like AT&T), and apparently not as a matter of personal opinion either. I disagree, as I have described elsewhere (footnote 161, etc.).
But that's old news. This year there's a new twist. Historically telecommunications were regulated under Title II of the Communications Act, and were referred to "common carriers" (or "telecommunications services"). Under this regime, carriers had to remain non-discriminatory in their service, and were subjected to a host of arguably overbearing price controls and the like. Between 1998 and 2005, the FCC effectively "deregulated" broadband by classifying it under the vague Title I (redefining it from a "telecommunications service" to an "information service"). This took seven years due to a series of court cases that ultimately put the issue in front of the Supreme Court, which affirmed the FCC's authority to classify broadband however it wished. If the FCC loses the Comcast case, it will likely consider whether to re-classify broadband under Title II so as to regain authority to regulate. Susan Crawford has a great description of the state of play.
Nuechterlein thinks that reclassification would be horrible. First, he is afraid of the many onerous elements of Title II that are unrelated to the policy goals of the "open internet" crowd. The FCC has the power to "forbear" from enforcing any or all of these, but Nuechterlein doesn't think they would. Second, he claims reclassification would confer very comprehensive regulation on FCC for "all corners of the internet ecosystem." In particular, he claims that application and content providers like Google and Netflix would fall within reach of the long arm of common carriage. You can see him make the case in the video below, starting at 1:23:00:
Even if Nuechterlein is right, these developments can be seen as direct backlash for years of chipping away at anything resembling regulation. After winning the battle to reclassify broadband, these entities continued to push against the notion that the FCC retained any authority at all to regulate. Harold Feld has argued that keeping oversight in a vaguely defined ex post arena serves incumbents' goals of maintaining the appearance of jurisdiction without any practical authority. However, the Comcast case threatens to expose this ruse (assuming the FCC does lose the case) and re-introduce the specter of Title II.
To be fair, opponents of FCC jurisdiction or ex ante regulation have proposed theoretical alternatives. Weiser, Nuechterlein, and others in the Silicon Flatirons community have long argued for antitrust-like ex post enforcement. Their proposals for how it would be implemented evolve from year to year, but more importantly the practical hurdles to achieving it seem very hard to overcome. [Edit: Speta just came out with an article suggesting yet another variation on the antitrust-like approach.] I have described elsewhere (pp. 118-122) how I think that framing this solely as an antitrust question misses the point, and in my most pessimistic moments I am sympathetic with those that claim it is just a euphemism for doing nothing.
I do agree in part with Nuechterlein's first point -- that bringing the full force of Title II to bear on broadband would be a bad thing. Perhaps he is better at predicting how forbearance will play out than I am. Given that he wrote the book on the matter, I suppose this is likely. On the other hand, we do have ample evidence of Commission forbearance. Indeed, even as the FCC reclassified all broadband services under Title I, it noted that some operators may wish to continue to operate under Title II, and it preemptively chose to forbear from tariffing (see paras. 89-94). Maybe it is a bit like chipping away at Pike's Peak in order to carve a statue, but we are left with few alternatives. In any case, Title II at least carries a rich legacy of non-discrimination norms... even if it also carries baggage.
I am not remotely convinced of his second major claim -- that bringing broadband under Title II necessarily implicates a host of higher-level services in its regulation (like Netflix, Google, and VoIP [edit: although in the case of VoIP there may already be some limited jurisdiction]). We have a very rich history of distinguishing between transport providers and the services that are delivered over that infrastructure. The 2005 Supreme Court Brand X decision affirming the FCC's classification decision mangles these distinctions and is frankly a mess. To the extent that the description of the technology made sense in its time, it is largely inaccurate today, as described by Public Knowledge. In the course of the Brand X litigation, MCI had been making the argument that any information service that made use of a telecommunications service would necessarily be subject to common carriage. The majority opinion notes,
Nuechterlein claims that reclassification would necessarily validate this argument. There are two problems with this. First, the MCI argument on its merits is at odds with decades of precedent that distinguishes between regulatory treatment these two types of services. Second, the Court was discussing this argument in the context of whether the FCC had unreasonably interpreted statute, rather than proactively determining what would necessarily follow if the Commission decided to classify broadband under Title II. In that sense, Nuechterlein and I both agree with the Court: MCI's argument isn't going to fly.
If the Commission were ultimately to classify broadband under Title II, it might be a workable means of gaining necessary jurisdiction to do good policy. It is not without its risks, but I think that the risks are far less severe than Nuechterlein's straw men.
In the final panel of Day 2, Marc Berejka of the Commerce Department observed (starting 2:17:00 in the video) that the hardest thing about doing good internet policy is that we don't have good governance tools. Regardless of what the Commission does in the short run with respect to broadband classification, we need to seriously reconsider the structure of communications regulation, all the way back to first principles and enabling statute.
Bonus: Yesterday, CITP hosted Chris McDonald, who talked about "The Computer Utility and the First Computer-Communications Policy Debate." He gave a very good overview of the first round of debates in this area. The audio is now available.
We are all currently awaiting the conclusion of the Comcast/Bittorrent case in DC Circuit Court, which will determine whether the FCC has jurisdiction to enforce its so-called "four internet freedoms" (I described the issues way back when this fight started a year and a half ago). In parallel, the Commission is conducting a proceeding to determine whether it should more explicitly establish "open internet" rules. Neuchterlein generally does not like anything resembling ex ante regulatory obligations on telecom infrastructure providers -- certainly not from the perspective of his clients (like AT&T), and apparently not as a matter of personal opinion either. I disagree, as I have described elsewhere (footnote 161, etc.).
But that's old news. This year there's a new twist. Historically telecommunications were regulated under Title II of the Communications Act, and were referred to "common carriers" (or "telecommunications services"). Under this regime, carriers had to remain non-discriminatory in their service, and were subjected to a host of arguably overbearing price controls and the like. Between 1998 and 2005, the FCC effectively "deregulated" broadband by classifying it under the vague Title I (redefining it from a "telecommunications service" to an "information service"). This took seven years due to a series of court cases that ultimately put the issue in front of the Supreme Court, which affirmed the FCC's authority to classify broadband however it wished. If the FCC loses the Comcast case, it will likely consider whether to re-classify broadband under Title II so as to regain authority to regulate. Susan Crawford has a great description of the state of play.
Nuechterlein thinks that reclassification would be horrible. First, he is afraid of the many onerous elements of Title II that are unrelated to the policy goals of the "open internet" crowd. The FCC has the power to "forbear" from enforcing any or all of these, but Nuechterlein doesn't think they would. Second, he claims reclassification would confer very comprehensive regulation on FCC for "all corners of the internet ecosystem." In particular, he claims that application and content providers like Google and Netflix would fall within reach of the long arm of common carriage. You can see him make the case in the video below, starting at 1:23:00:
Even if Nuechterlein is right, these developments can be seen as direct backlash for years of chipping away at anything resembling regulation. After winning the battle to reclassify broadband, these entities continued to push against the notion that the FCC retained any authority at all to regulate. Harold Feld has argued that keeping oversight in a vaguely defined ex post arena serves incumbents' goals of maintaining the appearance of jurisdiction without any practical authority. However, the Comcast case threatens to expose this ruse (assuming the FCC does lose the case) and re-introduce the specter of Title II.
To be fair, opponents of FCC jurisdiction or ex ante regulation have proposed theoretical alternatives. Weiser, Nuechterlein, and others in the Silicon Flatirons community have long argued for antitrust-like ex post enforcement. Their proposals for how it would be implemented evolve from year to year, but more importantly the practical hurdles to achieving it seem very hard to overcome. [Edit: Speta just came out with an article suggesting yet another variation on the antitrust-like approach.] I have described elsewhere (pp. 118-122) how I think that framing this solely as an antitrust question misses the point, and in my most pessimistic moments I am sympathetic with those that claim it is just a euphemism for doing nothing.
I do agree in part with Nuechterlein's first point -- that bringing the full force of Title II to bear on broadband would be a bad thing. Perhaps he is better at predicting how forbearance will play out than I am. Given that he wrote the book on the matter, I suppose this is likely. On the other hand, we do have ample evidence of Commission forbearance. Indeed, even as the FCC reclassified all broadband services under Title I, it noted that some operators may wish to continue to operate under Title II, and it preemptively chose to forbear from tariffing (see paras. 89-94). Maybe it is a bit like chipping away at Pike's Peak in order to carve a statue, but we are left with few alternatives. In any case, Title II at least carries a rich legacy of non-discrimination norms... even if it also carries baggage.
I am not remotely convinced of his second major claim -- that bringing broadband under Title II necessarily implicates a host of higher-level services in its regulation (like Netflix, Google, and VoIP [edit: although in the case of VoIP there may already be some limited jurisdiction]). We have a very rich history of distinguishing between transport providers and the services that are delivered over that infrastructure. The 2005 Supreme Court Brand X decision affirming the FCC's classification decision mangles these distinctions and is frankly a mess. To the extent that the description of the technology made sense in its time, it is largely inaccurate today, as described by Public Knowledge. In the course of the Brand X litigation, MCI had been making the argument that any information service that made use of a telecommunications service would necessarily be subject to common carriage. The majority opinion notes,
[Respondents] claim that the Communications Act unambiguously classifies as telecommunications carriers all entities that use telecommunications inputs to provide information service. As respondent MCI concedes, this argument would subject to mandatory common-carrier regulation all information-service providers that use telecommunications as an input to provide information service to the public.
Nuechterlein claims that reclassification would necessarily validate this argument. There are two problems with this. First, the MCI argument on its merits is at odds with decades of precedent that distinguishes between regulatory treatment these two types of services. Second, the Court was discussing this argument in the context of whether the FCC had unreasonably interpreted statute, rather than proactively determining what would necessarily follow if the Commission decided to classify broadband under Title II. In that sense, Nuechterlein and I both agree with the Court: MCI's argument isn't going to fly.
If the Commission were ultimately to classify broadband under Title II, it might be a workable means of gaining necessary jurisdiction to do good policy. It is not without its risks, but I think that the risks are far less severe than Nuechterlein's straw men.
In the final panel of Day 2, Marc Berejka of the Commerce Department observed (starting 2:17:00 in the video) that the hardest thing about doing good internet policy is that we don't have good governance tools. Regardless of what the Commission does in the short run with respect to broadband classification, we need to seriously reconsider the structure of communications regulation, all the way back to first principles and enabling statute.
Bonus: Yesterday, CITP hosted Chris McDonald, who talked about "The Computer Utility and the First Computer-Communications Policy Debate." He gave a very good overview of the first round of debates in this area. The audio is now available.
Subscribe to:
Posts (Atom)