Snowden disclosures reveal NSA abuse

I had no knowledge of the NSA’s programs, but I’m not surprised by most of it. James Bamford articulated in The Puzzle Palace in 1980 what the NSA was capable of, and it has always been clear to me that they would establish whatever intelligence capabilities they could in order to carry out their mission. There are several areas that raise substantial concerns:

1. NSA’s own documents indicate that they intended to interfere with and degrade crypto standards. That on its own has caused the agency substantial harm to its reputation that will take decades to recover from. But they haven’t just sullied their own reputation but that of the National Institutes of Standards and Technology (NIST) who are a true braintrust. Furthermore, they’ve caused the discounting in the discourse of anyone who is technology knowledgeable who have either recently held or currently hold government posts. I will come back to this issue below.

2. It is clear that the FISA mechanism just broke down, and that its oversight entirely failed. Neither Congress nor the Supreme Court took its role seriously. They all gave so much deference to the executive because of that bugaboo word “terrorism” that they failed to safeguard our way of life. That to me is unforgivable and I blame both parties for it. In fact I wrote about this risk on September 12, 2001. I wrote then:

I am equally concerned about Congress or the President taking liberties with our liberties beyond what is called for. Already, millions of people are stranded away from their loved ones, and commerce has come to a halt. Let’s not do what the terrorists could not, by shrinking in fear in the face of aggression, nor should we surrender our freedom.

Sadly, here we are.

3. There are reports about law enforcement taking intelligence information and scrubbing the origin. Where I come from we call that tampering with evidence in an egregious attempt to get around those pesky 4th and 5th amendments.

4. The NSA’s activities have caused great harm to U.S. services industry because other nations and their citizens have no notion as to when their information will be shared. This is keenly true for companies such as Google and Microsoft who, it is reported, were ordered to reveal information. The great Tip O’Neill said that all politics is local. That may be true, but in a global market place, all sales are local.

It would be wrong to simply lay blame on the NSA. They were following their mission. Their oversight simply failed. Congress needs oversight. That is our responsibility.

Restore Morsi Now!

I am no fan of the Muslim Brotherhood, as many of their political positions are diametrically oppose to my own.

However.

I am a big fan of democracy. However imperfect his election and that of the parliament, President Mohammed Morsi deserves the world’s support. We in America often forget just how imperfect our democracy is. Putting aside hanging chads, they used to have a saying in Chicago: vote early, vote often.

Democracy takes time to get right. It takes commitment, and it takes patience. Could you imagine the United States Army going in and taking over CNN in Atlanta, and arresting the president, simply because of a large protest on the Mall? Those protests are meant to sway legislators and those who vote for them peacefully.

And it hasn’t always been so peaceful, even in America. Some people may remember Sheriff Bull Connor who set dogs and fire hoses on peaceful protestors. And we don’t even have to go back that far. But we got better at it.

So would Egypt, if they give it time and patience.

Who owns your identity?

“On the Internet, nobody knows you’re a dog.” Right? Not if you are known at all. Those days are gone. As if to prove the point, one of my favorite web sites is on the wrong side of this issue. An actress unsuccessfully sued imdb.com for lost wages for having included her age on their site. There is a well known axiom in Hollywood that starlets have a half-life, and age is something that is best kept secret. IMDB countered that what matters is not an actress’ age but her ability to play a certain age.

My point is this: she sued and was unable to have information about her removed. Is age something that you believe should be private? I do. I especially do for people born after 1989 where a birthday and a home city can lead to someone guessing your Social Security Number.

But what about other physical attributes one might consider private? “He has a mole that you can only see if he’s naked.” How about illness? “This actor cannot lift his arm due to a stroke.” Once the information is out there, there’s no way to get rid of it. And this in the UK, which is subject to the European Data Privacy Directive. The situation is considerably bleaker for your personal information in the United States.

Related to this is The Right To Be Forgotten. In Europe they are considering new rules that say that you have a right to have information about you removed. This has some American firms in an uproar, arguing that a lack of transparency only increases risk and inefficiency. But what are the limits? What about this actress who doesn’t want her age known? How did her age provide for market efficiency?

North Korean Nonsense:

In the last two weeks we’ve heard about how the North Koreans have, well, let’s see…

All of this stemmed from further sanctions the U.N. imposed after these nutcases conducted a nuclear test.

These people are, quite simply put, wackos with nuclear weapons, each dictator worse than the last. The people they least endanger is America, and the people they most endanger are themselves, and their brothers, sisters, and cousins to the south. Not far behind them are the Chinese to the north. Clearly basketball diplomacy hasn’t helped at all.

The United States has a tendency to clean up messes all around the world. We get yelled at for doing so, and then people privately thank their lucky stars we do. Wouldn’t it be nice if someone else did the dirty work for once? As it happens the Chinese have been flexing their muscles all over the region, from Japan to Malaysia. They’ve even breached South Korean waters. But the North they leave alone.

With lots to lose and the fact that the Chinese have been propping up this government for six decades, the Chinese will have to deal with the consequences far more so than we will. It is a problem that the United States cannot solve. Our having sent B-2s was a nice show, but if we end up in an armed conflict with North Korea, mostly South Koreans, Chinese, and maybe Japanese get hurt. That region must resolve the matter. B-2s shouldn’t do it.

You don’t get to be a leader by simply showing military might. You have to use that might to address real problems. The Chinese have feared above all that if they intervene in the affairs of others, some day it will be their turn to be on the receiving end of such interference. Their turn may come, but not because they’ve done the right thing with North Korea.

Scaling the Internet and Re-considering Routing: LISP

A new experimental approach to routing on the Internet is maturing. It’s called Locator-Identifier Separation Protocol (LISP), and I am proud to have worked on it with people like Dino Farinacci, Vince Fuller, Dave Meyer, Scott Brim, Darrel Lewis, Wolfgang Riedel, and Greg Schudell.

Number of BGP Routes, Courtesy cidr-report.org

In 1993 and 1994, Paul Traina, Tony Li, and Yakov Rehkter led a rag tag effort to quickly get all the service providers to BGP 4 so that CIDR-based aggregation could save Cisco routers from hitting the dreadful 20,000 route limit. This involved a substantial operational change over a very short period of time, where people like Sean Doran at Sprint and Vince Fuller at BARRNET (who I think still used Proteons back then) as well as others went from router to router, quickly bringing up the new version of very fresh code. Talk about stress!!

Today, that number of routes looks like a blip, and in fact you can barely see the drop in the graph. In 1994, there were already 21 million users, representing a scaling factor of just over 1000. With over 2.4 billion people using the network today and 440,000 routes in the system, that represents a scaling factor of just under 5,500. Put another way, for one route, on average 5,500 people use the Internet. It’s a lot more complex than that because generally speaking only sites that have more than one Internet connection show up in the routing table. Still, based on that scaling factor, to get to today’s entire world population of 7 billion would require an additional 835,000 routes or so, and all the associated processing, which still makes some of us nervous. In the so-called Internet of Things (what connected before that term?), that number becomes a bit more unhinged in as much as it is not directly tied to the population. Tony Li has continually cautioned us on the risks of feeling good about Moore’s Law, and how it generally doesn’t apply to specialized routing devices..

LISP’s work, as well as that of ILNP, considered these issues. LISP functions as an overlay, not requiring the core of the Internet to have edge routes, effectively pruning any given routing tree by one level.

LISP-NERD focused on two particular aspects:

Is it possible to make a separation between operational state and provisioned state within the routing system, on the basis that (a) the core of the network is extremely stable and (b) edge instability could be managed through the Locator Status bits in LISP to reduce the amount of managed operational state?
Is LISP’s mapping function properly separated from the core? Having multiple mapping system makes it possible to test the abstraction. Other mapping systems would have served this purpose equally well.

I still encourage the development of LISP and alternatives like ILNP under the assumption that even though 835,000 sounds like a small number, there are many restrictions built into that number, specifically that will either undo themselves, or prevent us from selling more gear (and I’m specifically thinking about multihoming in the home).