Subject: WCIT outcome?

From: Phillip Hallam-Baker <[email-masked]>
Date: Sat, 29 Dec 2012 01:26:56 -0500

We seem to have missed a discussion on the outcome of the Dubai WCIT
conference, or rather the lack of one.

The end result was a treaty that 54 countries refused to sign. The
non-signatories being the major developed economies including UK, US,
Japan, Germany, Canada. Many of the signatories have signed with
reservations.

Back at the dawn of the computer industry, IBM was a very late entrant but
it quickly came to dominate the industry by building on the commercial base
it had established in punchcard tabulator machines. There was a real risk
that ITU might have managed to pull off something similar by convincing
governments that there needed to be a global regulatory body for
communications and that the ITU should be that body.

Instead they seem to have pulled off the equivalent of OS/@ and
microchannel architecture which were the marketing moves that were intended
to allow IBM to consolidate its hold on the PC industry but instead lead to
the rise of the Windows and the EISA bus clones.

It now seems reasonably clear that the ITU was an accident of history that
resulted from a particular set of economic and technical limitations. The
ITU was founded when each country had exactly one telephone company and
almost all were government controlled. One country one vote was an
acceptable approach in those days because there was only one telephone
company per country. The telephone companies were the only stakeholders
needed to implement a proposal.

The old telephone system is fading away. It is becoming an Internet
application just as the pocket calculator has become a desktop application.
And as it passes, the institutions it founded are looking for new roles.
There is no particular reason that this must happen.

The stakeholders in the Internet don't even align to countries. My own
employer is relatively small but was founded in the UK, moved its
headquarters to the US and has operations in a dozen more countries and
many times that number of affiliates. The same is even more true of the
likes of Google, Cisco, Apple, IBM, Microsoft etc.

A standards process is a two way negotiation. There are things that I want
other people to implement in their products and there are things that they
want me to implement in mine. The second one is actually rather more
important than the first. Having the process mediated by government
employees does not appear to add any value to the process to me and seems
to be a complete waste of time for them.

What is not a waste of time for governments is to look at the control
points in the technology infrastructures the emerging economy depends on.
Radio spectrum and geostationary orbit slots are finite resources and no
country can afford to be locked out of the new economy because of the lack
of access to them.

There are some control points in the Internet but they are rather less
critical than many imagine. IPv6 address space allocations, DNS zone
management and AIS numbers are arguably control points.

If we can eliminate the control point nature of those resources then the
essential government needs in Internet regulation will have been met and
the need for the ITU to be involved will disappear entirely. There are
still concerns that an ITU-like body could usefully address. A treaty
baring cyber-sabotage would be an important and useful effort that demands
a diplomatic approach.

-- 
Website: http://hallambaker.com/

---

From: Jorge Amodio <[email-masked]>
Date: Sat, 29 Dec 2012 04:43:09 -0600

ITU was founded previously as the International Telegraph Union before AG
Bell's phone was patented, no doubt the evolution of telecommunications and
the Internet puts ITU with its current behavior in the path of becoming
obsolete and extinct, but you can't discount many positive contributions
particularly from the standards section.

As the multistakeholder model and its associated processes, which is far
from perfect, continues to evolve, ITU must be part of the evolution. The
issue is that as an organization they must accommodate and realize that now
they are "part of it" and not "it" anymore.

There is also a big confusion and still lack of a clear consensus on what
"Internet governance" means or entitles, and many take it as "governing the
Internet," hence governments want a piece of the action, and the constant
and many times intended perception that the Internet is controlled by the
USG and its development and evolution is US centric, which I believe at
IETF we know since long time ago is not true. But many countries, and as
you well say those where there was or still is a single telecom operator
and controlled by government, see it that way.

About the countries that signed, not many but most did it with
reservations, and those that didn't sign probably represent 2/3 or more of
the telecom market/industry. An interesting observation after spending
countless hours following the meeting, some of the countries that were
pushing the discussion for a reference to the universal declaration of
human rights are the ones who don't care much about them, particularly in
respect to women, and on the other hand others complaining about
discrimination and restricted access to the Internet are the ones currently
filtering on the big pipes and have the Internet as the first thing on
their list to shutdown during internal turmoil.

The same forces that pushed at WCIT will keep doing the same thing on other
international fora to insist with their Internet governance agenda, the
ITRs will become effective in Jan 2015, two years, which on Internet time
is an eternity, and it will be only valid if those countries that signed
ratify the treaty. Meanwhile packets keep flowing, faster, bigger and with
more destinations, not bad for a packet switching network that was not
supposed to work. (During WCIT I was wondering, could you imagine doing the
webcast via X.25? )

I agree that it is not clear what the outcome of WCIT12 was, but something
that is clear is that ITU needs to evolve, or as Vint characterized them,
the "dinosaurs" will become extinct.

Cheers, Happy Holidays and great start for 2013
Jorge
http://about.me/jamodio

---

From: Masataka Ohta <[email-masked]>
Date: Sat, 29 Dec 2012 21:18:55 +0900

> likes of Google, Cisco, Apple, IBM, Microsoft etc.

You miss the most important stakeholders, the end users aligning
to countries.

						Masataka Ohta

PS

Of course, countries acting as representatives for telephone
companies are just as bad as countries acing as representatives
for ISPs.

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Sat, 29 Dec 2012 13:19:07 -0500

> particularly from the standards section.

The original purpose was to stop consumers from reducing their telegraph
bills by adopting codes.

> they are "part of it" and not "it" anymore.

ITU must change if it is to survive. But it was merely a means to an end.
There is no reason that the ITU 'must' be kept in existence for its own
sake.

Tim Berners-Lee has on numerous W3C AC meetings reminded people about the
X-Windows consortium that did its job and then shut down.

> and controlled by government, see it that way.

Many parts of the world do not understand the difference between a standard
and a regulation or law. Which is why they see control points that don't
worry us. I do not see a problem with the US control of the IPv6 address
supply because I know that it is very very easy to defeat that control.
ICANN is a US corporation and the US government can obviously pass laws
that prevent ICANN/IANA from releasing address blocks that would reach
certain countries no matter what Crocker et. al. say to the contrary. But
absent a deployed BGP security infrastructure, that has no effect since the
rest of the planet is not going to observe a US embargo.

I can see that and most IETF-ers can see that. But the diplomats
representing Russia and China cannot apparently. Which is probably not
surprising given the type of education their upper classes (sorry children
of party bosses) receive.

> their list to shutdown during internal turmoil.

Funny thing about treaties is that the governments that signed the UDHR
with great cynicism sixty years ago started to actually discuss it a
generation later. Now two generations on it is what the entire political
class has grown up with and it is accepted as something the country has
committed to.

A similar thing happened with the first ban on chemical weapons which
actually preceded the first large scale use in WWI. But in the aftermath
the victors realized that breaking the ban could be used as the basis for a
war crimes prosecution. Almost a century later the ban is pretty effective.
The UK is currently hearing a case in the high court arising from the use
of torture in Kenya. Pinochet was put on trial for his crimes in the end.

> The same forces that pushed at WCIT will keep doing the same thing on
> other international fora to insist with their Internet governance agenda,
> the ITRs will become effective in Jan 2015, two years, which on Internet
> time is an eternity, and it will be only valid if those countries that
> signed ratify the treaty. Meanwhile packets keep flowing, faster, bigger
> and with more destinations, not bad for a packet switching network that was
> not supposed to work. (During WCIT I was wondering, could you imagine doing
> the webcast via X.25? )
>

Two years may be longer than some of the unstable regimes have left. I
can't see Syria holding out that long and nor it appears can Russia. The
next dominoes in line are the ex-Soviet republics round the Caspian sea
where having the opposition boiled alive is still considered an acceptable
means of control.

> the "dinosaurs" will become extinct.

I think that what we should be doing is to help the ITU become extinct by
eliminating the technical control points that would make ITU oversight of
Internet governance necessary.

This does not need to entail a great deal of technical changes but does
require that we accept that they do have a valid interest.

---

From: Patrik Fältström <[email-masked]>
Date: Sat, 29 Dec 2012 23:46:15 +0100

On 29 dec 2012, at 19:19, Phillip Hallam-Baker <[email-masked]> wrote:

> ITU must change if it is to survive. But it was merely a means to an end. There is no reason that the ITU 'must' be kept in existence for its own sake. 
> 
> Tim Berners-Lee has on numerous W3C AC meetings reminded people about the X-Windows consortium that did its job and then shut down.

There are, IMHO, two major differences between the "old world" and the "new world":

In the new world, there are many different SDOs that are, in combination, bringing whatever "standards" are needed to the table. In the old world, there was only one.

In the new world, "governance" is no longer "by decree", "by legislation" or similar. In the new world we use the word "collaboration", and that is done via policy development processes that are multi stakeholder and bottom up. Like in the RIRs (for IP addresses etc), like in ICANN (for domain names) or locally for the various (successful) ccTLDs that are out there. And of course in the various industry consortia that bring so many valuable specifications to the table.

This is, I claim, ratified in the UN context in the outcome we call "The Tunis Agenda" and it has come back over and over again. In various formats, using slightly different wordings, but always the same theme.

Sometimes, I do though think also IETF participants should think a bit more about what the basic principles are for them. Why they fight for their views. What could make them give up. What the values are that they think are essential. That they are ready to really fight for.

   Patrik Fältström
   Chair of ICANN SSAC
   Former member of IESG, IAB etc and delegate of the Swedish Delegation at WCIT-12

---

From: SM <[email-masked]>
Date: Sat, 29 Dec 2012 22:25:01 -0800

At 10:19 29-12-2012, Phillip Hallam-Baker wrote:
>ICANN is a US corporation and the US government 
>can obviously pass laws that prevent ICANN/IANA 
>from releasing address blocks that would reach 
>certain countries no matter what Crocker et. al. 
>say to the contrary. But absent a deployed BGP security

:-)

At 14:46 29-12-2012, Patrik Fältström wrote:
>In the new world, "governance" is no longer "by 
>decree", "by legislation" or similar. In the new 
>world we use the word "collaboration", and that 
>is done via policy development processes that 
>are multi stakeholder and bottom up. Like in the RIRs (for IP addresses

What people say and what they actually do or mean 
is often a very different matter.  An individual 
may have principles (or beliefs).  A stakeholder 
has interests.  There was an individual who 
mentioned on an IETF mailing list that he/she 
disagreed with his/her company's stance.  It's 
unlikely that a stakeholder would say that.

The collaboration is less about process and more 
about culture.  In some parts of the new world 
"governance" is still by legislation, etc.  That 
could be attributed to cultural or other 
factors.  The WCIT outcome might be highlighting the fracture.

Regards,
-sm

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Sun, 30 Dec 2012 08:42:17 -0500

On Sun, Dec 30, 2012 at 1:25 AM, SM <[email-masked]> wrote:

>> absent a deployed BGP security
>>
>
> :-)
>
>
>> In the new world, "governance" is no longer "by decree", "by legislation"
>> or similar. In the new world we use the word "collaboration", and that is
>> done via policy development processes that are multi stakeholder and bottom
>> up. Like in the RIRs (for IP addresses
>>
>
> What people say and what they actually do or mean is often a very
> different matter.  An individual may have principles (or beliefs).  A
> stakeholder has interests.  There was an individual who mentioned on an
> IETF mailing list that he/she disagreed with his/her company's stance.
>  It's unlikely that a stakeholder would say that.
>

The reason that rule is useful is that just as it is ridiculous for the US
representative to the ITU to attempt to convey the positions of Comcast and
Google, it is no more practical for one person to represent the position of
Cisco or Microsoft.

Where the problem comes in is when you have a proposal that requires the
active support and participation of stakeholders like VeriSign. When I told
the IETF that DNSSEC would be deployed in dot.com if and only if the opt-in
proposal was accepted, I was stating the official position of a stakeholder
whose participation was essential if DNSSEC was going to be deployed.

It was a really minor change but the reason it was blocked was one
individual had the crazy idea that blocking deployment of DNSSEC would
cause VeriSign to lose dotcom. He was not the only person with that idea
but he was the only person in a position to wreck all progress in the IETF
if he didn't get his way.

For projects like IPv6 the standards development process needs to be better
at identifying the necessary stakeholders and ensuring that enough
essential requirements of enough stakeholders are met. Otherwise we end up
with yet another Proposed Standard RFC that everyone ignores.

The main fault of IETF culture is the idea that the Internet is waiting to
receive everything that we toss over the wall. That is not how I view the
utility of the process. If I want to have fun designing something I invite
at most five people to the brainstorming session then one person writes it
up. The only reason to have more then five people is to seek buy-in from
other stakeholders.

---

From: Masataka Ohta <[email-masked]>
Date: Mon, 31 Dec 2012 20:48:43 +0900

> It's unlikely that a stakeholder would say that.

That's how the global routing table has bloated so much because
of requests from ISPs as stakeholders even though it is harmful
to not only end users but also ISPs, which is "fallacy of
composition".

ITU did it better for phone numbers.

						Masataka Ohta

---

From: John Day <[email-masked]>
Date: Mon, 31 Dec 2012 09:51:03 -0500

Phillip,

>
>The reason that rule is useful is that just as it is ridiculous for 
>the US representative to the ITU to attempt to convey the positions 
>of Comcast and Google, it is no more practical for one person to 
>represent the position of Cisco or Microsoft.

Then I take it from this comment that you believe that all forms of 
representative government (and reaching agreements) are ridiculous?

Surely you don't believe that pure democracy will work?  That myth 
had been dispelled 250 years ago.

The process of a representative form for creating agreements seems to 
be (as flawed as it is) about the best we have come up with.

Wrt its application in standards outside the ITU it works the same 
way.  When a voluntary standards organization organizes by country, 
it is to give voice to the small companies as well as the Ciscos and 
Microsofts.  The big guys can send 10s of people (which represents a 
different problem) to meetings all over the world.  The little 
companies can't afford that but they have an interest.  Providing the 
means for them to agree on what their interest is and to make it 
heard is equally important.

It sounds like you are arguing for the hegemony of the robber barons 
moved to the 21stC.

>
>Where the problem comes in is when you have a proposal that requires 
>the active support and participation of stakeholders like VeriSign. 
>When I told the IETF that DNSSEC would be deployed in 
><http://dot.com>dot.com if and only if the opt-in proposal was 
>accepted, I was stating the official position of a stakeholder whose 
>participation was essential if DNSSEC was going to be deployed.
>
>individual had the crazy idea that blocking deployment of DNSSEC 
>would cause VeriSign to lose dotcom. He was not the only person with 
>that idea but he was the only person in a position to wreck all 
>progress in the IETF if he didn't get his way.
>
>For projects like IPv6 the standards development process needs to be 
>better at identifying the necessary stakeholders and ensuring that 
>enough essential requirements of enough stakeholders are met. 
>Otherwise we end up with yet another Proposed Standard RFC that 
>everyone ignores.

I would disagree slightly.  It is not task of the SDO to identify the 
necessary stakeholders but to ensure all of the stakeholder are 
represented at all levels.  The problems you describe above result 
from breaking that rule.

>
>The main fault of IETF culture is the idea that the Internet is 
>waiting to receive everything that we toss over the wall. That is 
>not how I view the utility of the process. If I want to have fun 
>designing something I invite at most five people to the 
>brainstorming session then one person writes it up. The only reason 
>to have more then five people is to seek buy-in from other 
>stakeholders.

Wrt some of your previous comments, I would agree.  When phone 
companies were owned by governments (remember this was often both the 
provider and manufacturer parts of the business) , there might have 
been a reason for ITU to be a treaty organization.  I can see that 
for wireless government involvement is still necessary.  However, 
given that providers are now private (often international) businesses 
it is hard to see wrt standards setting how the topics covered by ITU 
is any different than any other voluntary standards organization.

Over the 30+ years I have been involved in standards it is pretty 
clear that the bottom-up nature of standards creates standards bodies 
among like-minded groups of people.  This seems to be the natural 
occurrence.  I see no problem with this.  There seems to be a 
like-minded group of people who gravitate toward the kinds of 
problems the ITU has traditionally dealt with. Fine.  The market will 
decide whether or not it wants to use them as it does with all 
standards.

The question is what, if anything, is there left relating to wireline 
communication that requires agreement among *governments*?  I can't 
think of much.

One other note:  We are very sloppy in our use of the term 
"Internet." And the ITU hierarchy and their allies have been 
skillfully using this.  We are not distinguishing clearly between the 
internet itself and the *users* (or is it uses?) of the Internet.  It 
appears that most of what they want to regulate or constrain is the 
"uses."  This is equivalent to saying that they want to regulate what 
is said over the phone.  Clearly outside their purview.  But *we* act 
like it isn't.  By not clearly distinguishing between the two in the 
discussions, we have already given up considerable ground.

Take care,
John Day

>
>--
>Website: <http://hallambaker.com/>http://hallambaker.com/

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Mon, 31 Dec 2012 13:05:21 -0500

On Mon, Dec 31, 2012 at 9:51 AM, John Day <[email-masked]> wrote:

> **

MPs and Congressmen are elected decision makers. ITU participants can make
decisions but they are not binding on anyone and only have effect if people
like me choose to implement them.

Representative democracy without the elections part has neither.

And it may have escaped your notice but pretty much every government in the
developed world tries to limit the scope of their authority these days.
They have discovered that they prefer to concentrate their influence on a
narrow scope and thus maximize it.

> Surely you don't believe that pure democracy will work?  That myth had
> been dispelled 250 years ago.
>

I lived in Switzerland for two years. They have a government that passes a
budget. How is yours doing?

> The process of a representative form for creating agreements seems to be
> (as flawed as it is) about the best we have come up with.
>

ITU is not a democratic organization, nor does it aspire to be. So it is
not representative in the slightest. Reciting slogans does not mean they
are applicable

> Wrt its application in standards outside the ITU it works the same way.
> When a voluntary standards organization organizes by country, it is to give
> voice to the small companies as well as the Ciscos and Microsofts.  The big
> guys can send 10s of people (which represents a different problem) to
> meetings all over the world.  The little companies can't afford that but
> they have an interest.  Providing the means for them to agree on what their
> interest is and to make it heard is equally important.
>
> It sounds like you are arguing for the hegemony of the robber barons moved
> to the 21stC.
>

I deal with the world as I find it. It is very difficult to change the
Internet without the support of a Microsoft or a Google or a Cisco. There
are a ten billion endpoints deployed. The real obstacle is the hegemony of
the installed base.

> the IETF that DNSSEC would be deployed in dot.com if and only if the
> opt-in proposal was accepted, I was stating the official position of a
> stakeholder whose participation was essential if DNSSEC was going to be
> deployed.
>
>
> better at identifying the necessary stakeholders and ensuring that enough
> necessary stakeholders but to ensure all of the stakeholder are represented
> at all levels.  The problems you describe above result from breaking that
> rule.
>

I think the idea that the stakeholders want to participate is a mistaken
one. VeriSign particpates in IETF. Some of the backbone providers do. But
many do not.

So the frequent result is that IETF develops a widget and the deployment
showstoppers are only discovered during deployment.

It can get really lonely pointing out to a group of people with some idea
their are bursting to implement that they need to at least talk to the
application providers they need to adopt their idea.

> communication that requires agreement among *governments*?  I can't think
> of much.
>

They need to come to an agreement to ban cyber-sabotage like they have
banned chemical and biological weapons.

Right now we have a group of US, Russian and Chinese military types all
looking to make their careers at the forefront of the new cyber arms race.
The military managed to piss away trillions of dollars in wealth with their
cold war, now they want to do the same in cyber. The cold war was
ultimately won because the youth of East Germany simply walked away from
the regime.

Like chemical weapons, cyber weapons are far more bark than bite and what
bite there is can hit the attacker. Stuxnet and Flame were crafted to
attack Iran, the vectors were repurposed and targeted at the US days after
they were discovered. We also have the interesting precedent that the UK
has launched a cyber sabotage attack against a nuclear facility declared as
civil and under an IAEA inspection regime.

We can't stop everyone from developing cyber-sabotage capabilities but we
can push efforts that occur so far underground that they can't poison
attempts to deploy effective defenses. The US and Chinese critical
infrastructures may be separate at a physical level but they are tightly
coupled at a logical and economic level. Any weapon that affects one is at
least capable of bringing down the other.

That is the task that the ITU should be addressing. It might as well get
started on it because one consequence of the Dubai debacle is that the
remaining ITU standards efforts have been compromised.

---

From: John Day <[email-masked]>
Date: Mon, 31 Dec 2012 16:08:42 -0500

At 1:05 PM -0500 12/31/12, Phillip Hallam-Baker wrote:
>On Mon, Dec 31, 2012 at 9:51 AM, John Day 
><<mailto:[email-masked]>[email-masked]> wrote:
>
>Phillip,
>
>>
>MPs and Congressmen are elected decision makers. ITU participants 
>can make decisions but they are not binding on anyone and only have 
>effect if people like me choose to implement them.

This was my point. The standards part of ITU is just like any other 
standards organization. But there are other things it does which are 
not like this, e.g. spectrum allocation.  There are other aspects 
with respect to tariffs that are binding on signatories.

>Representative democracy without the elections part has neither.

Neither of what?

>
>And it may have escaped your notice but pretty much every government 
>in the developed world tries to limit the scope of their authority 
>these days. They have discovered that they prefer to concentrate 
>their influence on a narrow scope and thus maximize it.

That also was my point, if you had read to the bottom.  In fact, I 
would suggest that the delegations of the developed world made a 
mistake assuming that the scope of the ITU was the same as it always 
had been.  By doing this, they gave up ground they didn't need to.

>I lived in Switzerland for two years. They have a government that 
>passes a budget. How is yours doing?
>
>

I am sorry but I am not sure what Switzerland has to do with this 
discussion.  Last time I looked they had a republic (representative) 
form of government not a pure democracy.  No one every claimed it was 
efficient.

>
>The process of a representative form for creating agreements seems 
>to be (as flawed as it is) about the best we have come up with.
>
>
>ITU is not a democratic organization, nor does it aspire to be. So 
>it is not representative in the slightest. Reciting slogans does not 
>mean they are applicable

No one claimed it was.  In fact, quite the opposite.  I claimed it 
was organized as a republic form, which does what it is members vote 
on.  It turns out its members are countries.  (As I indicated below, 
I am not sure in the changed circumstances this is appropriate.) 
Actually one thing you seem to have missed, which I thought you would 
have jumped all over.  Generally, ITU meetings require unanimity to 
have a consensus.  This time they went with a simple majority.  I 
would have thought this would have created a fair amount of 
consternation.

>companies can't afford that but they have an interest.  Providing 
>the means for them to agree on what their interest is and to make it 
>I deal with the world as I find it. It is very difficult to change 
>the Internet without the support of a Microsoft or a Google or a 
>Cisco. There are a ten billion endpoints deployed. The real obstacle 
>is the hegemony of the installed base.

;-)  Why is that daunting?  ;-)  I hear that excuse often.  If we had 
had that attitude when we started this effort 40 years ago.  We would 
still be patching the PSTN.  There would be no Internet. Do you think 
the Internet was a success because we convinced IBM and AT&T it was a 
good idea?!!  I am sorry to see that the younger generation is so 
faint of heart.  Can't take a little challenge!

Actually, it isn't the ITU that is in the way.  It is the structure 
of the IETF that gives the big players such power.

>
>>Where the problem comes in is when you have a proposal that 
>>requires the active support and participation of stakeholders like 
>>VeriSign. When I told the IETF that DNSSEC would be deployed in 
>>accepted, I was stating the official position of a stakeholder 
>>would cause VeriSign to lose dotcom. He was not the only person 
>>with that idea but he was the only person in a position to wreck 
>>all progress in the IETF if he didn't get his way.
>>
>>For projects like IPv6 the standards development process needs to 
>>be better at identifying the necessary stakeholders and ensuring 
>>that enough essential requirements of enough stakeholders are met. 
>I would disagree slightly.  It is not task of the SDO to identify 
>the necessary stakeholders but to ensure all of the stakeholder are 
>I think the idea that the stakeholders want to participate is a 
>mistaken one. VeriSign particpates in IETF. Some of the backbone 
>providers do. But many do not.

Self-fulfilling prophecy.  The structure of the IETF makes it 
difficult to impossible.  So why should they waste their time?

>
>So the frequent result is that IETF develops a widget and the 
>deployment showstoppers are only discovered during deployment.

That is just bad design.  I am not sure I would admit to that if I 
were you.  It doesn't look good.  Indicates that the IETF does not 
understand its constituency.

>
>It can get really lonely pointing out to a group of people with some 
>idea their are bursting to implement that they need to at least talk 
>to the application providers they need to adopt their idea.

Why?  The WCTU said, never marry drunkard to reform him.  They will 
find out soon enough.

>
>The question is what, if anything, is there left relating to 
>wireline communication that requires agreement among *governments*? 
>I can't think of much.
>
>
>They need to come to an agreement to ban cyber-sabotage like they 
>have banned chemical and biological weapons.

Do they?  Don't you think it is interesting that the countries crying 
loudest for this are the source of much of it and have sufficiently 
authoritarian regimes that they could shut down next week if they 
wanted?

It is far from clear to me that such an agreement would be worth the 
paper it was written on, unless it is possible to prove (which we 
can't in 99% of the cases) that it was a State that mounted the 
attack.

>
>Right now we have a group of US, Russian and Chinese military types 
>all looking to make their careers at the forefront of the new cyber 
>arms race. The military managed to piss away trillions of dollars in 
>wealth with their cold war, now they want to do the same in cyber. 
>The cold war was ultimately won because the youth of East Germany 
>simply walked away from the regime.

You really believe that?!  The cold war was won, because Gorbachev 
*chose* not to repeat the response to the Hungarian and Czech revolts 
of '56 and '68.  Tian An Men provides a good counter-example.  You 
need to read Lutwack's Coup d'Etat: A Practical Handbook.   Walking 
away isn't sufficient.

>
>Like chemical weapons, cyber weapons are far more bark than bite and 
>what bite there is can hit the attacker. Stuxnet and Flame were 
>crafted to attack Iran, the vectors were repurposed and targeted at 
>the US days after they were discovered. We also have the interesting 
>precedent that the UK has launched a cyber sabotage attack against a 
>nuclear facility declared as civil and under an IAEA inspection 
>regime.
>
>We can't stop everyone from developing cyber-sabotage capabilities 
>but we can push efforts that occur so far underground that they 
>can't poison attempts to deploy effective defenses. The US and 
>Chinese critical infrastructures may be separate at a physical level 
>but they are tightly coupled at a logical and economic level. Any 
>weapon that affects one is at least capable of bringing down the 
>other.

This was another point I made although not specifically on 
cyber-security. If you look closely at these kinds of attacks they 
have little or nothing to do with the functioning of the *Internet.* 
They have a lot more to do with what the Internet is used for.  (This 
is like saying the ITU has some sort of authority over what is said 
over the phone. Not something I think is a good idea, although 
apparently you do.)  Which tells us why the authoritarian regimes are 
so big on pushing it.  They see cyber-security treaties as a means to 
increase their control for domestic suppression and isolate their 
populations.  Support it if you want, but I certainly would think 
twice about it.

>
>That is the task that the ITU should be addressing.

Gawd! I hope not.

>  It might as well get started on it because one consequence of the 
>Dubai debacle is that the remaining ITU standards efforts have been 
>compromised.

The ITU standards efforts were unaffected and irrelevant to what 
happened in Dubai. which is too bad.  For 30+ years, I have described 
their standards efforts as targeted a market window 15 minutes in the 
future.  Even before you get to how badly flawed they are 
technically.  The ITU standards effort is just another ho-hum 
voluntary standards group like the IETF, or IEEE, or ASTM, or EIA, or 
ICAO, or even ISO.

Take care,
John Day