Featured Blogs

The Cyber Security Ecosystem: Collaborate or Collaborate - It’s Your Choice

As cyber security as a field has grown in scope and influence, it has effectively become an 'ecosystem' of multiple players, all of whom either participate in or influence the way the field develops and/or operates. It's increasingly evident that, more than ever, it is crucial for those players to collaborate and work together to enhance the security posture of communities, nations and the globe. more

Digital Governance Discussion Group (DGDG): One World, One Internet, Many Voices

On February 12–13, 2024, the first round of the final consultations for a Global Digital Compact (GDC) took place online and offline at the UN Headquarters in New York City. Around 50 governments and 50 speakers from non-governmental institutions took the floor. It was not really a dialog; it was a formal presentation of three-minute statements. more

President Díaz-Canel, Cuban Internet Is More Than Facebook on Cell Phones – Don’t Be Afraid of It

As a result of Internet service interruption during the recent anti-government protests in Cuba, Florida Senator Rubio and Governor DeSantis and President Biden have called for measures to strengthen and guarantee Cuban Internet connectivity, but that won't happen until the Cuban government recognizes that doing so is in its long-run interest. I have seen several suggestions that we smuggle end-user satellite terminals from services like SpaceX Starlink into Cuba but attempts to... more

Taking a Multi-Stakeholder Look at Cyber Norms

Recently we've seen several examples of likely state sponsored security incidents of which the appropriateness was later strongly debated. Incidents such as states impacting commercial enterprises during cyber attacks; purported sabotage of critical infrastructure, and attacks on civilian activists have all, to a greater or lesser degree, led to concerns being raised by both civilian watchdog groups, academics, technologists and governments. more

Who Will Crack Cloud Application Access SLAs?

The broadband industry doesn't have an agreed-upon unit of supply and demand that meaningfully "adds up". This is rather odd for a service that aspires to be a utility. It is also a barrier to a much-needed transformation from "bit pipes" to "digital supply chain management". The chart here ought to be in every basic undergraduate textbook on packet networking and distributed computing. That it is absent says much about our technical maturity level as an industry. more

Who Is Responsible for Your Application’s Security?

The dividing line between developers and IT operations used to be distinct. Developers were responsible for adding new features securely, but it was IT operations who had responsibility for infrastructure and network security. For the most part, developers didn't have to think too much about the wider security context. With the advent of the cloud, and of devops, things changed radically. more

The Competition to Become the Next .eu TLD Registry Is Now Open

I am glad to announce that the European Commission has officially launched the process to select the next Registry for the .eu Top-Level Domain (TLD). This is done through a competitive procedure that will be concluded, by October 2021, with the signature of a service concession contract between the European Commission and the entity that will be entrusted with the organisation, administration and management of the .eu TLD. more

Bypassing Geo-Locked BYOD Applications

In the wake of increasingly lenient bring your own device (BYOD) policies within large corporations, there's been a growing emphasis upon restricting access to business applications (and data) to specific geographic locations. Over the last 18 months more than a dozen start-ups in North America alone have sprung up seeking to offer novel security solutions in this space - essentially looking to provide mechanisms for locking application usage to a specific location or distance from an office, and ensuring that key data or functionality becomes inaccessible outside these prescribed zones. more

Government Hacking: Proposed Law in the Netherlands

In 2012 I wrote a blog on CircleID called State hacking: Do's and don'ts, pros and cons. In this post I give some thoughts to the concept of a government "hacking back" at criminals. The reason for this was an announcement by the Dutch government that it contemplated law along these lines. The proposed law is now here: the Act Computer Criminality III. more

Omnibus Cybersecurity Bill May Not Go Where Original Authors Intended

In an interview with GovInfoSecurity, Sen. Thomas Carper said that the U.S. Senate is considering attaching cybersecurity legislation to a defense authorizations bill. Though clearly a ploy to be able to say "we did something about those evil hackers" before the elections, CAUCE applauds the attempt. There can be no doubt that the United States (and many other countries) sorely needs better laws to deal with these threats. more

A Recap of the 36th ICANN Conference in Seoul, Korea

The recently completed ICANN Conference in Seoul, Korea will be remembered for a unique accomplishment -- the first definitive step towards the addition of Internationalized Domain Names (IDNs) to the Internet root... As the announcement states, the applicants, at this time, are limited to nations and territories; the first IDNs will be in country code top level domains (ccTLDs). The generic TLDs, (the gTLDs, e.g., .org, .com and .info) will have to wait for their opportunity to apply for IDNs... more

Article 22 of the GDPR Should Not Preclude Contemplated Automation

There is an ongoing disagreement among various members and groups in the ICANN community regarding automation -- namely, whether and to what extent automation can be used to disclose registrant data in response to legitimate data disclosure requests. A major contributing factor to the complications around automation has been confusion about how to interpret and apply Article 22 of the GDPR. more

Routing Attacks on Internet Services

This post was co-authored by Yixin Sun, Annie Edmundson, Henry Birge-Lee, Jennifer Rexford, and Prateek Mittal. In this post, we discuss a recent thread of research that highlights the insecurity of Internet services due to the underlying insecurity of Internet routing. We hope that this thread facilitates important dialog in the networking, security, and Internet policy communities to drive change and adoption of secure mechanisms for Internet routing. more

UDRP and the ACPA Differences, Advantages and Their Inconveniences

The ACPA and the UDRP provide two separate and distinct methods for resolving domain name disputes. Both alternatives have many critics and proponents, but the true value of each will ultimately be determined by how well each combats cyber-squatting. Separately, the UDRP and the ACPA will probably work well to defuse most of the cyber-squatting that is currently invading the Internet. If combined together the UDRP and the ACPA can be a cost saving and effective way to prevent cybersquatting... more

Using Electricity Infrastructure to Roll Out Broadband

The FCC proposal in its recently launched National Broadband Plan to share infrastructure is a very smart initiative indeed. Sharing infrastructure makes a lot of sense. Without it the business model for universal high-speed broadband will not stack up -- the costs of infrastructure is one of the most critical elements in any national broadband plan. Australia is following an identical course with the rollout of their National Broadband Network. In all six current rollout sites utilities are either already involved or are negotiating to become involved. more