Featured Blogs

How Many Bots? How Many Botnets?

We touched on this subject in the past, but recently Rich Kulawiek wrote a very interesting email to NANOG to which I replied, and decided to share my answer here as well: I stopped really counting bots a while back. I insisted, along with many friends, that counting botnets was what matters. When we reached thousands we gave that up. We often quoted anti-nuclear weapons proliferation sentiments from the Cold War, such as: "why be able to destroy the world a thousand times over if once is more than enough?" we often also changed it to say "3 times" as redundancy could be important... more

Domain Registrars & Registries: Don’t Say You Weren’t Warned

There is an old saying that "bad news comes in threes." Domain name service providers have witnessed two unsettling developments in the past few weeks. The third, still winding its way through the U.S. Congress, could have enormous ramifications. Registries and registrars, in particular, need to speak up or resign themselves to the consequences. more

Internationalized Domain Names: The Babelization Factor

As current statistics now clearly indicate, two-thirds of the estimated 560 million people online are non-English speakers. As one would expect, in the upcoming ICANN Shanghai Meeting of October 28, 2002, IDNs (Internationalized Domain Names, also known as Multilingual Domain Names), are one of the main topics of discussion. This global affair is also fueling the growing list of Internationalized Domain Name Certified Registrars that offer domain names in many other non-English characters with .com, .net, and .org. more

Making DKIM More Useful with Domain Assurance Email

The IETF DKIM working group has been making considerable progress, and now has a close-to-final draft. DKIM will let domains sign their mail so if you get a message from [email protected], the furble.net mail system can sign it so you can be sure it really truly is from furble.net. But unless you already happen to be familiar with furble.net, this doesn't give you any help deciding whether you want the message. This is where the new Domain Assurance Council (DAC) comes in... more

Protecting Your Brand in the New World of NFTs

Months ago, while watching a Saturday Night Live skit about non-fungible tokens (NFT) featuring a parody of Janet Yellen speaking to a high school economics class, I realized what an NFT is and how they work. What they represent, how they are minted, and how their value is exchanged became clear while watching Pete Davidson in a boy wonder unitard rap about the latest crypto-phenomena. It was only later that I realized that NFTs have plenty of practical applications. more

How to Choose a Cyber Threat Intelligence Provider

Throughout the course of my career I've been blessed to work with some of the most talented folks in the security and cyber threat intelligence (CTI) mission space to create a variety of different capabilities in the public, private and commercial sectors. Before I came to lead the Verisign iDefense team about five years ago, I had to evaluate external cyber-intelligence vendors to complement and expand the enterprise capabilities of my former organization. more

ICANN - Time to Act!

At the start of the TAS outage, I said ICANN had a great opportunity to get its crisis management right by communicating properly. Now, nearly two weeks after the application window was supposed to close, ICANN has clearly done just that... But clearly, communication isn't the only parameter in crisis management. At some point, you also need to act. more

A Public Briefing on ICANN, Internet Governance and Africa

The Collaboration for International ICT Policy for East and Southern Africa (CIPESA) recently published "ICANN, Internet governance and Africa", a public briefing on the current status and key points of the debate that provides essential background for the second phase of the World Summit on Information Society (WSIS). During the last few years the relationship of African stakeholders with ICANN has received greater attention, largely driven by a few key individuals within African governments, the technical community, and civil society organizations. Meanwhile, the broader topic of Internet governance has been put on the public agenda in the context of the WSIS. ...Decisions taken at the upcoming second phase of the WSIS (to occur in Tunis in November 2005) are likely to have a profound impact on ICANN and the field of Internet governance more generally. more

Black Frog: Next Generation Botnet, No Generation Spam Fighting

Black Frog -- a new effort to continue the SO-CALLED Blue Security fight against spammers. A botnet, a crime, a stupid idea that I wish would have worked -- News items on Black Frog. Blue Frog by Blue Security was a good effort. Why? Because they wanted to "get spammers back". They withstood tremendous DDoS attacks and abuse reports, getting kicked from ISP after ISP. ...The road to hell is filled with good intentions. Theirs was golden, but they got to hell, quite literally, non-the-less. ...When Blue Security went down, some of us made a bet as to when two bored guys sitting and planning their millions in some café would show up, with Blue Security's business plan minus the DDoS factor. Well -- they just did. more

Global Paradigms We Relied Upon Were Destroyed Overnight - How Prepared Are You for New Realities?

Unprecedented new Political and Cyber Security Threats are happening at a scale that has never been witnessed before. These threats are large and malicious enough to take down nuclear programs, render oil refineries inoperable, and take billion-dollar websites offline (not to mention smaller ones). Recent events confirm that NO ONE IS IMMUNE. Despite the obvious warning signs, Internet business stakeholders the world over continue to act as if nothing has changed, and seem unaware that global paradigms have undergone a seismic shift almost overnight. more

Privacy Commissioner Finds Facebook Violating Canadian Privacy Law

The Office of the Privacy Commissioner of Canada has released its long-awaited finding in the complaint against Facebook on a variety of privacy grounds. The complaint was launched by CIPPIC in May 2008 (note that I am an advisor to CIPPIC but had no involvement in this complaint). The case marks an important step in assessing how Canadian privacy law addresses social media with the Commissioner identifying some significant concerns. Moreover, as the case potentially heads to court, it will be closely watched to see whether the findings can be enforced against a global social media power like Facebook. more

First Do No Harm: Ensuring Compliance with the EU’s GDPR While Preserving Access to WHOIS Data

There is growing concern about how ICANN will comply with the EU General Data Protection Regulation (GDPR), whose enforcement sanctions come into force in May of 2018. How will ICANN comply with GDPR without unduly restricting global Internet users' access to the public WHOIS database? For nearly the past 20 years, Internet users, businesses, law enforcement and consumer protection agencies have relied on WHOIS as a necessary resource. more

Phishing: Competing on Security

The UK today is one of the main attack targets by phishing organized crime groups, globally. Phishing damages will amount to about two billions USD in 2006 worldwide -- not counting risk management measures such as preventative measures, counter-measures, incident response and PR damages. In most cases, phishing is caused by the fault of the users, either by entering the wrong web page, not keeping their computers secure or falling for cheap scams. Often this is due to lack of awareness or ability in the realm of Internet use rather than incompetence by the users... more

Why New TLDs Don’t Change a Thing

I have a heard a lot lately about ICANN unanimously voting in favor or relaxing top level domain rules and had a few people come to me and ask 'how does that affect what you do?' The short answer is, it won't; at least not for a long time and here is why... There might be some huge potential gain if all shoe companies got .shoes and branded it, but someone would have to manage it and each would have to spend money to brand .shoes to consumers. Adidas gets adidas.shoes but spends nothing to brand it and lets Nike pay to brand .shoes and Reebok to brand it as well and leech. So instead of cartel like behavior (which is hard to maintain), we fall back into .com more

It Is Payback Time! - Government of Sweden on Internet Governance

Today is a wonderful day for us working with Internet Governance that do believe in an Open Internet and multi stakeholder model for its governance. FTTH Council is having its annual meeting in Stockholm, Sweden, and the IT Minister, Anna-Karin Hatt, made an opening speech that was among the strongest I have heard from any country. Yes, any country. And I do not even know if any organization have said such strong things. more