Crypto War III: Assurance

For decades, academics and technologists have sparred with the government over access to crypographic technology. In the 1970s, when crypto started to become an academic discipline, the NSA was worried, fearing that they'd lose the ability to read other countries' traffic. And they acted. For example, they exerted pressure to weaken DES... The Second Crypto War, in the 1990s, is better known today, with the battles over the Clipper Chip, export rules, etc. more

The Rising Cost of Digital Theft and Espionage in Germany

The German digital association, Bitkom, recently announced that the cost of IT equipment theft, data breaches, digital and industrial espionage, and sabotage is expected to reach a staggering 206 billion euros ($224 billion) in 2023.  more

Baltic Sea Infrastructure Targeted Amid Rising Geopolitical Tensions

An underwater data cable linking Sweden and Latvia was damaged early Sunday, marking the fourth such incident in the Baltic Sea, fueling concerns within NATO regarding the security of critical infrastructure. more

Losing a UDRP Case: Questionable Decision or Questionable Submission?

Complainants naturally want to prevail on their claims of alleged infringing conduct and respondents (when they appear) naturally do their best to resist having their domain names taken from them in proceedings under the Uniform Domain Name Dispute Resolution Policy (UDRP), but their success depends on their submitting the right constituents of fact and proof. In a forum that has adjudicated over 60,000 cases, it would be surprising if there were no questionable or badly reasoned decisions. more

AT&T CTO Donovan: We Need Non-Discrimination

"Outside applications need to be on an equal footing with our own applications," John Donovan said at a SUPERCOMM keynote here in Chicago. "My jaw dropped," one of his colleagues told me a few minutes later, because this is a reversal of AT&T's long-standing position they needed to be able to favor their own applications. AT&T D.C. needs to listen closely to their own CTO, because they are throwing everything they have in D.C. at preventing "non-discrimination" being included in the FCC Net Neutrality regulations. more

IRMA Threatens Irish ISPs

I don't want to get into the entire Irish Recorded Music Association (IRMA) vs Eircom and IRMA vs ISPs debacle. The only reason I'm even writing this is because I'm getting a bit tired of all the "quotes" of "quotes" and other unclear and misleading things that people have been saying about ISPs over the last few weeks. more

Popular ccTLDs for Domain Name Disputes

As I've written before, the registry operators for many country-code top-level domains (ccTLDs) have adopted the Uniform Domain Name Dispute Resolution Policy (UDRP) or a variation of it, while other ccTLDs have crafted their own dispute policies, or none at all. Although no ccTLD appears as frequently as .com in domain name disputes, it's interesting to see which ccTLDs are subject to dispute the most often. more

The Internet and the Legitimacy of Governments

In two recent debate events I participated in, on iFreedom and privacy in the online world, mistrust of government and government's intentions and motivations on and towards the Internet were abundantly present with more than just a few people in the audiences. The emotions were not new to me, no, it was the rationality that surprised and sometimes almost shocked me. Why? Well, should these sentiments get the support of the majority of people, it would undermine all legitimacy of a government to govern. Let's try and take a closer look. more

Measuring the Cost of Cybercrime

Last week at Virus Bulletin in 2012, Tyler Moore of Southern Methodist University (SMU) gave a talk entitled "Measuring the cost of cyber crime." It was a study done in collaboration with multiple individuals in multiple countries. The study sought to answer this question - How much does cyber crime cost? Up until this point, nobody really knew. more

The Incredible Leakyness of Commercial Mailers

Acronis is a company that sells backup software. They have been around for over a decade, and have lots of big respectable customers. The Wall Street Journal is the nation's leading business newspaper. Equifax is one of the big three national credit bureaus. Shelfari is a book interest web site owned by Amazon. The Economist is a globally influential newsweekly. Airliners.net is a popular photosharing site for airplane enthusiasts. What do they have in common? more

Obstacles in OneWeb’s Negotiations with Russia

This case illustrates the fact that political, security, and financial negotiations may be as difficult as designing satellites and rockets for a would-be global Internet service provider. OneWeb is investing billions of dollars in a constellation of low-Earth orbit (LEO) Internet-service satellites. In 2015 they placed launch orders for 21 Russian-made Soyuz rockets. more

Does Apple’s Cloud Key Vault Answer the Key Escrow Question?

In a recent talk at Black Hat, Apple's head of security engineering (Ivan Krsti?) described many security mechanisms in iOS. One in particular stood out: Apple's Cloud Key Vault, the way that Apple protects cryptographic keys stored in iCloud. A number of people have criticized Apple for this design, saying that they have effectively conceded the "Going Dark" encryption debate to the FBI. They didn't, and what they did was done for very valid business reasons -- but they're taking a serious risk... more

The Next Network Policy Battle

I've said it before, and I'll say it again. The biggest threat to the Internet innovation ecosystem from network operators is not discrimination but terms of interconnection. Metered billing, bandwidth caps, and wholesale transit fees can all be implemented consistently with net neutrality rules. And in practice, net neutrality will be limited to "legal" content... more

Thoughts on the Proposed Copyright Alternative Dispute Resolution Policy

A proposal from the Domain Name Association (DNA) would provide copyright owners with a new tool to fight online infringement -- but the idea is, like other efforts to protect intellectual property rights on the Internet, proving controversial. The proposed Copyright Alternative Dispute Resolution Policy is one of four parts of the DNA's "Healthy Domains Initiative" (HDI). more

AOL Has a Security Hole, and It’s Our Problem

Two weeks ago I wrote about Yahoo's unfortunate mail security actions. Now it's AOL's turn, and the story, as best as I can piece it together, is not pretty. Yahoo used an emerging system called DMARC, which was intended to fight phishing of often forged domains like paypal.com. A domain owner can publish a DMARC "reject" policy which, oversimplifying a little, tells the world that if mail with their name on the 'From:' line didn't come from their servers, it's not from them so you should reject it. more