Should the ITU Handle Cybersecurity or Cybercrime?

Cybercrime and cybersecurity are two very important topics that are largely being lost in the noise around the American elections, the Arab Spring, or the European banking crisis. Nevertheless, there is an attempt by the ITU and some governments to take a more active role in this space.

Roughly defined, cybercrime is a crime that occurs or is facilitated by computers. Cybersecurity is the actions taken to protect against cybercrime. This includes protection of devices so that they don’t get broken into, and remediation.

Cybercrime itself is a complex issue. It relates to many things, including fraud, data theft, privacy theft, and just about any criminal endeavor that happened before the term “cyber” ever came to be. There’s a great paper by a laundry list of Who’s Who in the economics of cybersecurity that proposes methods of estimating actual losses, breaking down crime into various categories. Statistics in this space are remarkably fluid- that is, there are poor standards for data collection.

As it turns out, there is a treaty on cybercrime, conveniently called The Convention on Cybercrime, developed in the Council of Europe. Nearly all of Europe, as well as the U.S. and a number of other countries have ratified this treaty, and there other signatories. Research from the University of Singapore has already shown that either accession to the treaty or even becoming congruent with it will reduce a country’s cybercrime rate. While the causalities are not clearly explained in that paper, one part is obvious: the first part of the treaty is what amounts to a best practices document for governments, on how they should develop legislation.

The treaty itself is fairly involved and took many years to get as many signatures as it did. It has to deal with diverse societies who have differing constitutional views on freedom of speech and expression, as well as on due process.

The Secretary General of the ITU and his staff, as well as a few governments, have been under the impression that the ITU could do a better job than what was done by the Council of Europe. There is little chance of this happening, and in all likelihood, they would make matters worse, if for no other reason (and there are other reasons) that anyone who already signed the Convention would have to reconcile differences between that and whatever would be created by the ITU.

There are other reasons the ITU cannot do better, not least of which is that they lack the technical expertise to actively engage in cybersecurity. Part of the problem is that most Internet standards are not ITU standards, but come from elsewhere. While the ITU has any number of standards involving fiber optics management, and good codec support, the computer you’re reading this blog on uses mostly the work of others. Another reason is that the state of the art in both cybercrime and cybersecurity is rapidly moving, beyond the ITU’s capability to adapt. Here’s just one example: contrary to what people had thought, the battle ground for cybercrime has not really moved to mobile devices. As we’ve previously discussed, this has a lot to do with the update mechanisms and business models in play, but the most notable one being that applications on the iPhone in particular are both reviewed by Apple and signed. The only iPhone you hear about being vulnerable is the one that has been cracked by the owner, and that doesn’t account for a whole lot.

One WCIT proposal that refers to spam as a threat demonstrates how far off some governments are on the subject. Spam itself has never really been much of a threat, but more of an annoyance. 80-90% of it is never delivered to the end user, and most Evil Doers have moved on to more sophisticated approaches, such as spear phishing. Worse, the ITU-T’s study group 17 had to take years simply to come up with a definition of spam, when it really was a problem.

This is not to say that the ITU shouldn’t have a role to play with cybersecurity. The ITU has extraordinarily access to governments of developing countries, and can work with them to improve their cybersecurity posture, through training and outreach. In fact they do some of this in their Development or ITU-D Sector. One thing that the D sector has done recently has been to put developing governments in touch with FIRST, the organization that coordinates discussion among Computer Incident Response Teams or CIRTs. But the ITU should give up any idea that it can play more of a role than outreach and capacity building, all of which should be done in consultation with actual experts.

Are bad iPhone maps a security problem?

A while ago I talked about business models and how they impact security. The key thing then was that Apple had a direct path to the consumer, which drove update rates of iOS very quickly, in comparison to Android. Implicit in all of that was that consumers would find a reason to upgrade to the latest software.

Now we see a new version 6 of iOS that has what can only be described as a miserable replacement for Google Maps, as well as a number of reported problems with WiFi connectivity. All of a sudden, the tables are turned. Are the 200 new features found in iOS worth risking one’s ability to use WiFi or have accurate mapping information? Note that the question makes no reference to security. That’s because consumers don’t care about that.

So, here’s the thing to watch, and Google will be watching very closely: what is the adoption rate of iOS version 5 as compared to its predecessor? The converted have already moved over. Now it’s time for the rest of us. Will we or won’t we? I already have decided to wait for a “.0.1” version of iOS 6, as my iPhone works fine as is, and none of the new features really seem so interesting, such that I want to risk breaking WiFi or my maps. Note again, I’m not even mentioning security.

Is it us or is it all of the Middle East that needs fixing?

There is a great interview in the New York Times with Egyptian President Mohamed Morsi, and I encourage everyone to read it. Egypt has a very complicated and pivotal role in the region, and with the United States. Since their treaty with Israel, the U.S. has given Egypt over $1 billion a year in financial aid, and either in turn or simply by happy coincidence they have been a moderating influence in the region. Of course, we were giving money to a government that was not democratically elected, and whose policies towards Israel were not popular.

President Morsi takes America to task. He says that we need to change, and that we need to not ignore the suffering of Palestinians. I agree. We have not done a good service to the Palestinians. Mr. Morsi views that the promise of the Camp David Accords has not been fulfilled. He further accuses us of interfering with the region with our foreign aid polices, while at the same time noting our support for the Arab Spring. This man is clearly positioning himself as the spokesman for the region, and he has pretty good street creds to do it. Furthermore, he is the democratically elected leader of a region where previously the only country to have one was Israel.

On the other hand, we are not the only ones who need to change. Each society in that region needs to recognize Israel’s right to exist, and that American values preclude us from prosecuting someone for their views about Islam, whether or not we like their views. Mr. Morsi does not address this. His failure to immediately condemn the invasion of our embassy as well as his failure to call out problems within the region, means that he himself must come to terms with what it means to be a leader. In the immortal words of Albus Dumbledore, it’s easy to stand up to your enemies, but standing up to your friends takes true courage. Furthermore, there are some regional values that we ought not stand for, and one of them is the poor treatment of women. On the one hand, he says that woman should be allowed to run for public office, but on the other hand, being a product of the Muslim Brotherhood, he implies that he himself wouldn’t vote for one. For the region, this is radically liberal.

The question for The Obama Administration is how to deal with this man of contradictions. It seems to me that the U.S. should make clear two things:

First, what conditions need to exist for the Palestinians to achieve their goal, and that Hamas’ violent views do not meet those conditions. Egypt has an especially important role to play here. While they are in a good position to support the Palestinians’ aspirations, Mr. Morsi can say, “you have us until you are violent.”
Second, our fundamental freedoms as articulated in our Constitution are not negotiable, and we will not treat with people or their representatives who threaten Americans or our diplomats, simply because someone said something they didn’t like.

Honesty in a relationship demands that divisions need to be exposed before they can be healed. The biggest question we should be asking ourselves is what the American aid we are giving is going to. Mr. Morsi clearly resents the aid we gave to his predecessors. What, then, does it mean to provide Egypt aid today?

Finally there must be follow-through on our part. If we say we’re going to do something, we must do it. If Palestinians meet the conditions to create their own state, we must support this position. Mr. Morsi is pointing out that at this time, nobody in the Middle East views the U.S. as an honest broker between Israel and the Palestinians, and that needs to be corrected – both the perception and the underlying reasons.

WCIT and the ITU?

The International Telecommunications Union (ITU) is making the news these days, in part because there is about to be a treaty conference called the World Conferences on International Tariffs (WCIT). What is the ITU? and what do they do?

The ITU is a specialized agency of the United Nations that focuses on telecommunications. It has four components:

A general secretariat;
A standardization sector or ITU-T;
A radio coordination sector or ITU-R; and
A development sector or ITU-D;

The radio sector coordinates spectrum allocation and so-called “orbital satellite slots”. It also is responsible for standardization of time. The development sector focuses on the special needs of developing countries. The standardization sector has over 150 years set international standards for telecommunications, starting with the telegraph. The general secretariat manages logistics of the three sectors, and represents the ITU to other international fora, and to the U.N.

How has the ITU been relevant to you? There are several key standards that are worth taking note of:

E.164 specifies pretty much what a telephone number looks like, starting with the international dialing code.
G.711, G.719 and others specify how voice is encoded into data.
X.509 is the basis for the public key infrastructure that is in use on the World Wide Web.
D.50 specifies accounting standards by which international carriers bill each other, or so-called settlement rates. There’s real money involved in this one.

This is some pretty important stuff.

The ITU-T was formed out of the CCITT, which was a coordination committee, primarily made of European governments. These days, its membership spans 193 countries. Only governments may vote, although civil society and paying sector members may have some influence.

So what is WCIT? WCIT is a treaty-level conference in which all those lovely accounting rates are agreed upon. But they’re not stopping there. The ITU-T has had a very limited role in the Internet’s development. Standardization and governance over the Internet falls to several classes of entities:

National governments with their own sets of laws;
Standards organizations such as the IEEE, IETF, W3C, and 3GPP; and
Not-for-profit organizations such as ICANN and Internet Registries.

This latter group focuses on what I call “internals”. That is- how do you get an IP address or a domain name? The Internet has grown over 1.25 billion users with very limited involvement of the ITU-T.

Now governments want to take a firmer hand in areas such as how addresses and names are allocated and cybersecurity. That is what WCIT is about.

More about the ITU and WCIT in the future.

Freedom of Speech means something

I don’t blog often these days, in part because of my role. However, I am taking a moment to do so to pay tribute to U.S. Ambassador Chris Stephens and Career Foreign Service Officer Sean Smith, who were killed this week at their posts in Libya, alongside two other Americans. All four served their country for the purpose of furthering not only the interests of the United States, but also those of Libya.

Members of the U.S. foreign service do not get paid well, in comparison to those of us in industry. They do the job out of a sense of duty and service to humankind, with the idea that dialog between peoples is the best way to avoid conflict, that all of our interests are served when differences are resolved peacefully. These people prevent wars, saving not only American lives, but the lives of those who would be lost or irrevocably harmed through conflicts.

Many people in the Middle East are upset over an “anti-Muslim” film. I have not seem this film. While words matter (whatever they are), they are no excuse for violence, especially violence against people who have probably not even seen or heard of the movie! But many outside the U.S., and perhaps even many inside the U.S., don’t understand the meaning of the freedom. It’s is easy listen when one isn’t saying something controversial. Nobody cares about a freedom when we’re all saying nice things.

Freedom of speech is needed by those who speak that which everyone else might find repugnant, outrageous, or simply rude. It’s the only way to insure in a free society that nobody has the right to judge, in an effort to control a political outcome, what should be spoken and what shouldn’t.

This freedom is not universally agreed to nor is it absolute. In the United States, you cannot yell “Fire!” in a movie theater, and in Germany you can’t go around espousing the views of Hitler. But even when people do espouse such views, you have the right to tell them where to go – but peacefully. You also have the right to ignore kooks and wingnuts, and sometimes that is the best response.