Infrequently Noted

Alex Russell on browsers, standards, and the process of progress.

Centralized

On rumored proposals to build a central Net monitoring system:

There are a number of things that one must understand to completely grok what is (supposedly) being proposed. First, this system is not without precedent or precursor. The infamous "Carnivore" system (now widely deployed by the FBI) is at least as privacy endangering as any such proposed system. The jokes that were Carnivore's privacy protecting features are just eliminated with the new proposal. Anyone clinging to the vain hope that the FBI/DHS actually care about privacy or can't can't wait to have access to information about every little thing you do need to snap out of it. They are professionals with a job to do, and worse than that, at some level they are burecrats with jobs to protect. Getting more information would (in the simple minds of the burecrats) make doing that job easier, but there's a price involved. But then that's not really their problem until we make it so, is it?

Secondly, any such system touted as "just" doing pen register or trap and trace functioning simply cannot hope to constrain itself to these goals unless the code for doing so is made public and independent verification that privacy controls are in place, active, and operators are well trained is mandated. Odds this'll happen under the current administration?

Next, such a centralized system breaks all the rules for a well-designed security tool. The failure mode of any such system is catastrophic, and it creates a single point of failure. I'll spare you my full thoughts on how very, very bad an idea this system is for now, but I beleive that any independent review of a system matching the descriptions given in the media will be damning not only on a privacy, but also and effectiveness basis. Law enforcement isn't suffering from not having enough information now, it's suffering from not being able to analyze what it already has. Any effort to increase the ammount of information available will only be a drain on law enforcement's already strecthed capabilities. It is a very simple thing for politicans to submit that something is absolutely necessaray to "fight terror" as any resistance to their proposals can easily be branded un-american, so between those they employ and those they can cower, expect little rational resistance to any such actively detrimental proposal.

As if that weren't enough, recall that any such system will be built and operated by the lowest bidder.

Are YOU a member of the EFF yet?