RightsCon: Encryption vs. Surveillance and How Do You Govern the Web, Anyway?
Yesterday, the third annual RightsCon kicked off in San Francisco. The conference brings together tech executives, diplomats, policy advocates, and self-described cypherpunks who sometimes double as security experts, to name a few. The goal is to find ways in which the digital realm, which is ever more encompassing and impacting daily life, can be used to protect and expand the rights of people worldwide. Here are two highlights from the first day of the conference:
1. Encryption won't save us from surveillance, but it's better than regulation
Where do we stand in the battle against digital surveillance? "If you imagine being a cypherpunk in the '90s, and waking up right now, you might actually think we won," speculated Morgan Marquis-Boire, a Senior Security and Technical Adviser at the Citizen Lab (Marquis-Boire is also a Senior Security Engineer at Google, but explicitly said he was not speaking in that capacity). He pointed to the proliferation of the Tor Project, the encryption of major operating systems, and the interpretation of HTTPS into most browsers. But, the surveillance game has changed too.
While governments used to rely on their in-house capabilities, the demand for surveillance has given rise to third party cybersecurity companies like Narus, Amesys, and Blue Coat Unfortunately, their technology ends up in the hands of repressive regimes, who use it to find dissidents, infect them with malware, and extract information about them and their allies. Last year, Reports Without Borders declared Blue Coat an "enemy of the Internet" for helping China, Russia, Venezuela and others free speech-squelching capabilities.
Marquis-Boire was hesitant about regulatory efforts to do away with these problems, noting that secret court systems, such as the U.S. Foreign Intelligence Surveillance Court, could easily make exceptions for themselves. Instead, he suggested engineering solutions. Encryption "won't save you," but that "we need to start engineering in a commercially resistant manner." Marquis-Boire explained that security engineers can develop encoding that's so complex and hard to crack, decrypting would be financially unfeasible. He also pointed to opportunistic encryption, which can secure communications between clouds.
2. Who governs the web? And more importantly how?
Who governs the Internet? "This is a very important question," said Fadi Chehade, the CEO of the Internet Corporation for Assigned Names and Numbers (ICANN), which plays a major role in internet governance.
Speakers on a panel listed an alphabet soup of organizations like ICANN, the Internet Architecture Board (IAB), the Internet Engineering Task Force (IETF), the Internet Governance Forum (IGF), which all play different roles, such overseeing domain space and IP addresses, managing the engineering of the internet, and conducting policy discussions.
A more important issue, though, is how they are held accountable. After all, as Professor J.D. Ross of Syracuse University writes, ongoing is a "15-year controversy over the U.S. government's special relationship to [ICANN]."
Betrand de La Chapelle of ICANN contended that the "accountability mechanism of the representative-democratic system is relatively weak for international issues," and presented a hypothetical crime in which an "Australian traveling in Peru, using Yandex, to say something about a Chinese. What's the jurisdiction for that?" De La Chapelle suggested that this leaves the world in "in a framework where you have to pile up accountability mechanisms," and that the best way to do so is through transparent multistakeholder meetings, in which (ideally) anybody can participate.
Particularly, next month the international community hopes to address some of the issues around this next month at the Global Multistakeholder Meeting on the Future of Internet Governance in Brazil. The panel acknowledged that currently, those outside the tech community–and even many within it–are unaware of Internet governance and the ability to participate in it. One panelist suggested a simple solution: making information public on GoogleDocs and allowing anybody to comment on it as it is being discussed.
