Subject: Re: Proposal to revise ISOC's mission statement

From: Phillip Hallam-Baker <[email-masked]>
Date: Wed, 1 Nov 2017 14:14:49 -0400

On Tue, Oct 31, 2017 at 5:44 PM, james woodyatt <[email-masked]> wrote:
> On 10/31/2017 05:20 AM, Phillip Hallam-Baker wrote:
>>
>> [...] it is the casual negligence many of the technologists show when it
>> comes to security risks.
>>
>> The question I see is who is going to be in control. Will it be the user
>> or someone else.
>> [...]
>
> I think you've already answer that question for yourself in the excerpt
> below.
>
>> We have to have a plan to make the Internet safe for users, yes. But what
>> we also need at this point is a plan to protect society from the Internet
>> itself. [...]
>
> According to that view, it will be someone else, unless "our" plan to
> protect "society" from the criminal users of the Internet is adequate.
>
> Absolutely speaking *only* for myself here, but I view talking about plans
> "to protect society from the Internet itself" like a pretty much straight up
> attack on the fundamental idea of an Internet Society as a thing worthy of
> that name.

Not at all. Much of the problem of 'Internet crime' has nothing to do
with the Internet.

Until 1995, almost no critical infrastructures were designed with the
expectation that they would be connected to a global network and need
a security model to meet that attack model. The principle exception
being the Internet which very few people understood to be critical.

Phishing is not a problem of Internet insecurity, the fundamental
security problem is that the credit card security model is based on a
password printed on the front of every card.

Advance fee fraud is not a problem of Internet security, it is
primarily a problem caused by unscrupulous people being able to
efficiently contact hundreds millions of people and then deceive a
small fraction (less than 0.1%) whose behavior is frequently explained
by dementia.

The fact that we now have SCADA attacks on a regular basis is not a
problem of Internet security, it is primarily caused by the fact that
the protocols they use today were designed 40 years ago and have no
inbuilt security.

Your response here is the response typical of many technologists,
'nothing to do with me'. Having been involved in national politics in
multiple countries, I can tell you that approach is not going to be
remotely acceptable to elected representatives whose constituents rely
on them.

Congressional, EU action is inevitable, in fact it has already begun.
The question is one of framing. Right now, the Internet is seen as the
problem because it was the new factor that was introduced and
invalidated the assumptions that the legacy infrastructures depended
on. If we don't want to get regulated to heck and back, we have to
change the conversation so that policy makers understand that the
Internet is the one infrastructure that was originally designed with
the understanding that every device would be connected to every other
device and that this would create a new set of security requirements.

> Instead, it seems to me that we have a philosophical tussle between A)
> people who think of the Internet firstly as a command and telemetry system
> for political and economic data, to be policed by and subservient to state
> power, used mainly as a tool for governing the populace, and B) people who
> think of the Internet firstly as an open standard communication technology
> to which justice demands that everyone is recognized to have an equal right
> to lawfully regulated use for any public or private purpose.
>
> How you think about security risks, it seems to me, depends on which side of
> this philosophical debate you align. Accusing the other side of "casual
> negligence," when it's actually the case that the other side has set
> different priorities, is probably not the best way to facilitate better
> mutual understanding.

The reason I am presenting these issues here is precisely the fact
that they are dismissed out of hand as you do here while making a plea
for seeing both sides!

I am currently writing an infrastructure that makes open end-to-end
secure messaging as easy to use as regular email despite the express
opposition to this idea from my own government expressed repeatedly by
the Prime Minister and Home Secretary. So I think it is pretty clear
which side I sit on. But that does not mean I reject the other side
out of hand.

Closing his plenary address to the first Web conference, Tim
Berners-Lee described the Web as 'building a whole new world'. Well we
have built a whole new world and it has replaced the old one. And a
lot of people are rather upset with us as a result even as they spend
their time venting their rage at what we have wrought on Facebook and
Twitter.

---

From: james woodyatt <[email-masked]>
Date: Thu, 2 Nov 2017 11:21:12 -0700

On Nov 1, 2017, at 11:14, Phillip Hallam-Baker <[email-masked]> wrote:
> On Tue, Oct 31, 2017 at 5:44 PM, james woodyatt <[email-masked] <mailto:[email-masked]>> wrote:
>> 
>> 
> […]
> 'nothing to do with me’.

I think you may have mischaracterized my response here. When I speak only for myself, I am disclaiming any representation of the entity that owns the domain name in my email address. I’m speaking as an individual and independent participant, and I think the Internet society, and the set of political, philosophical and economic problems it poses, has everything to do with me.

> Having been involved in national politics in

I’m not taking "that approach” at all. I’m trying to point out that a strong majority our elected representatives, particularly most of the ones who are powerful members of the ruling parties, view the fundamental concept of an Internet Society as essentially unacceptable. In that light, I think that revising the ISOC mission statement to align better with their view of the world would be to neuter the ISOC completely. I’m not sure that’s an outcome I would support, but I do think pretending that we aren’t doing that is a road to failure.

> device and that this would create a new set of security requirements.

My sense of politics tell me that the pressure for the Internet to be “regulated to heck and back” originates from sources across the full spectrum of politics. It’s an overwhelming and irresistible force. We *will* be regulated to heck and back, and moreover, maybe that’s a thing reasonable people can welcome.

The relevant question here, I believe, is whose political interests will be guarded by the inevitable new regulations, and whose political interests will be damaged in the construction of those guard towers, and I don’t agree there is anything to be gained by lecturing policy makers about how the original design of the Internet was expressly to create a whole new system of security requirements— which, let’s be honest, they have spent the last several decades in a determined and furious effort to sweep those new security issues under a rug conveniently provided to them by technology industry lobbyists. They’re not likely to take that lecturing in the spirit in which we might hope to be seen giving it.

What I would say we should want is a voice that provides some kind of counterpoint to those voices with large sunk costs in the infrastructure that needs to be redesigned and reconstructed for the new world where there is an Internet. There are plenty of other organizations that can devote themselves to advocating for big technology companies, advocating for ordinary private individuals, advocating for returning to an old pre-Internet world, et cetera. Where the ISOC can help, I would say, is to be an otherwise neutral advocate for embracing the new Internet Society, which includes refactoring the world's legacy infrastructure for dealing with the new security requirements.

> […] Well we have built a whole new world and it has replaced the old one. And a lot of people are rather upset with us as a result […].

I know. Most days, lately, I am considering myself one of them. Which is why I am a member of other organizations dedicated, among other things, to regulating the Internet to heck and back. Note well: I am not advocating for ISOC to be yet another one of those organizations. Quite the opposite, actually, I kind of want the ISOC to be neutral about that.

--james woodyatt <[email-masked] <mailto:[email-masked]>>

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Thu, 2 Nov 2017 16:16:59 -0400

On Thu, Nov 2, 2017 at 2:21 PM, james woodyatt <[email-masked]> wrote:

> I’m not taking "that approach” at all. I’m trying to point out that a strong
> majority our elected representatives, particularly most of the ones who are
> powerful members of the ruling parties, view the fundamental concept of an
> Internet Society as essentially unacceptable. In that light, I think that
> revising the ISOC mission statement to align better with their view of the
> world would be to neuter the ISOC completely. I’m not sure that’s an outcome
> I would support, but I do think pretending that we aren’t doing that is a
> road to failure.

That is nonsense.

If you begin by assuming absolute bad faith on the part of all elected
representatives then yes, you are going to end up in the meat grinder
because you refuse to recognize any legitimacy to their concerns
whatsoever.

The pathology of US regulation is that industry assumes that all
regulation will be utterly unacceptable, resists all attempts to come
to any form of common understanding and eventually ends up being hit
by a series of punitive regulations that are then taken as evidence
that the system is broken.

---

From: Keith Moore <[email-masked]>
Date: Thu, 2 Nov 2017 20:29:58 -0400

On 11/02/2017 04:16 PM, Phillip Hallam-Baker wrote:

> representatives

... you are not far from the truth.   Though the reality is somewhat 
closer to selfishness and desire for ego gratification rather than 
absolute bad faith, and nearly all elected representatives rather than 
absolutely all of them.   People do sometimes run for public office for 
unselfish reasons, but (a) the good ones tend to be weeded out by the 
system, and (b) those who aren't weeded out tend to be corrupted.

> that the system is broken.

No, industry assumes that legislators can often be bought, and that the 
purpose of legislation is to tilt the playing field in the favor of the 
buyers.   Any meaningful regulation is therefore likely to be seen as an 
insult to people who paid good money to have things go their way.

Keith

---

From: henry <[email-masked]>
Date: Thu, 02 Nov 2017 20:50:45 -0400

Sent from ProtonMail Mobile

On Thu, Nov 2, 2017 at 20:29, Keith Moore <[email-masked]> wrote:

> On 11/02/2017 04:16 PM, Phillip Hallam-Baker wrote: > On Thu, Nov 2, 2017 at 2:21 PM, james woodyatt wrote: > >> I’m not taking "that approach" at all. I’m trying to point out that a strong >> majority our elected representatives, particularly most of the ones who are >> powerful members of the ruling parties, view the fundamental concept of an >> Internet Society as essentially unacceptable. In that light, I think that >> revising the ISOC mission statement to align better with their view of the >> world would be to neuter the ISOC completely. I’m not sure that’s an outcome >> I would support, but I do think pretending that we aren’t doing that is a >> road to failure. > That is nonsense. > > If you begin by assuming absolute bad faith on the part of all elected > representatives ... you are not far from the truth.   Though the reality is somewhat closer to selfishness and desire for ego gratification rather than absolute bad faith, @google.com>

> HH> The system and responsibilities to inner stakeholders forces them to be political and politic. The system elects representatives occasionally who vote continually, as proxy. With prediction markets, continual voting of everyone, absent a proxy, provides dissolution of grab what you can responsibility to educate the voters and coordinate votes. The inner stackholders now need be politic. Change representative democracy to an advisory role. Technocrats educate the polity. Here’s the key it seems to me, illuminated by your own working groups, coming and going. Spread the meme of drafting and focus groups. We see how well it works, reaching consensus. Speak about it political beyond your dominion and get politic. Just my way of [email-masked]>

> and nearly all elected representatives rather than absolutely all of them.   People do sometimes run for public office for unselfish reasons, but (a) the good ones tend to be weeded out by the system, and (b) those who aren't weeded out tend to be [email-masked]>

> HH> you see, the system biases this [email-masked]>

> @google.com>

> @google.com>

> @google.com>

>> The pathology of US regulation is that industry assumes that all > regulation will be utterly unacceptable, resists all attempts to come > to any form of common understanding and eventually ends up being hit > by a series of punitive regulations that are then taken as evidence > that the system is broken. No, industry assumes that legislators can often be bought, and that the purpose of legislation is to tilt the playing field in the favor of the buyers.   Any meaningful regulation is therefore likely to be seen as an insult to people who paid good money to have things go their way. Keith @google.com>

> HH> all due respect towards your assumption filled with cynical estimation of others motivations, with the dynamic of making things happen within each Corp I think it’s more "beg forgiveness than ask permission" sort of limerick way. Were you to see what perspective I offer I would be grateful.

> Robert