Tag: Internet

Categories
Links Writing

An Initial Assessment of CLOUD Agreements

The United States has bilateral CLOUD Act agreements with the United Kingdom and Australia, and Canada continues to also negotiate an agreement with the United States.1 CLOUD agreements are meant to alleviate some of the challenges attributed to the MLAT process, namely that MLATs can be ponderous with the result being that investigators have difficulties obtaining information from communication providers in a manner deemed timely.

Investigators must conform with their domestic legal requirements and, with CLOUD agreements in place, can serve orders directly on bilateral partners’ communications and electronic service providers. Orders cannot target the domestic residents of a targeted country (i.e., the UK government could not target a US resident or person, and vice versa). Demands also cannot interfere with fundamental rights, such as freedom of speech. 2

A recent report from Lawfare unpacks the November 2024 report that was produced to explain how the UK and USA governments actually used the powers under their bilateral agreement. It showcases that, so far, the UK government has used this substantially to facilitate wiretap requests, with the UK issuing,

… 20,142 requests to U.S. service providers under the agreement. Over 99.8 percent of those (20,105) were issued under the Investigatory Powers Act, and were for the most part wiretap orders, and fewer than 0.2 percent were overseas production orders for stored communications data (37).

By way of contrast, the “United States made 63 requests to U.K. providers between Oct. 3, 2022, and Oct. 15, 2024. All but one request was for stored information.” Challenges in getting UK providers to respond to US CLOUD Act requests, and American complaints about this, may cause the UK government to “amend the data protection law to remove any doubt about the legality of honoring CLOUD Act requests.”

It will be interesting to further assess how CLOUD Acts operate, in practice, at a time when there is public analysis of how the USA-Australia agreement has been put into effect.

  1. In Canada, the Canadian Bar Association noted in November 2024 that new enabling legislation may be required, including reforms of privacy legislation to authorize providers’ disclosure of information to American investigators. ↩︎
  2. Debates continue about whether protections built into these agreements are sufficient. ↩︎
Categories
Aside

2024.12.21

It’s a profoundly weird experience that some blogs — seemingly — only exist as read items in my RSS reader, years after the domains have been released back into the wild and the original CMSes have been turned off.

There are some of these blogs that I return to, and read again, every few years. I wish that others could find the articles like I can, and that the author hadn’t drifted away into the digital ether.

Categories
Aside

2024.10.14

I’ve been reading Minimalissimo for at least a decade now and have significantly honed my sense of design and style from the work they’ve curated through the years. As of today, however, the website is shifting into archival mode and no new content will be published.

It’s not the first long-term website closing that has hurt — arguably it is Ming Thein’s that still lingers the worse, followed by Andrew Kim’s Minimally Minimal— but at least the archives of Minimalissimo will remain to reflect on in the coming months and years.

Categories
Aside Humour

The Durability of Certain Online Comments

One of the projects I’m involved in at work relates very closely to a bulk of academic policy books I read while doing my PhD. That’s not particularly surprising, I guess. One of those books, in particular, would be invaluable to my team as they navigate a neat (and well researched) policy space.

So I did what most people do: go to Amazon, search for the book, and then send it to my employer to purchase the title for the internal library.

Lo and behold, however, when I found said book on Amazon there was a single review of it. Interesting! Who would comment on this niche academic text and what did they say?

Well… apparently I would comment on this niche book and leave a review, and did so way back in 2008. I’ll be honest: the review does hold up. Though the fact that I was reviewing my supervisor’s book, publicly, and offering (fair!) critiques admittedly makes me grin a bit. And, also, probably speaks lots about why I tend to fit in well at workplaces where speaking truth to power is just the daily 9-5.

Categories
Aside Quotations

What to Learn From the Silicon Valley Bank Collapse

Look, if you think the fact that my Internet of Shit door-lock failed because the company that designed it made no plan to let me into my house if they went out of business would make me sympathetic to that company, you are out of your fucking mind.

Cory Doctorow, “Learning from Silicon Valley Bank’s apologists”

The Internet-of-shit is real and we can only hope that the threats associated with their bank collapsing will teach a generalizable lesson.

I’m…..not optimistic.

Categories
Aside Writing

Adding Some Positivity to the Internet

Beneath Old Grandfather
(Beneath Old Grandfather by Christopher Parsons)

Over the past two years or so the parts of the Internet that I inhabit have tended to become less pleasant. Messages that I see on a regular basis are just short, rude, and often mean. And the messages that are directed to people who have an online professional presence, such those who write and speak professionally, are increasingly abusive.

I’m one of those writers and speakers, and this year I decided to do something that isn’t particularly normal: when I come across a good piece of writing, or analysis of an issue, or just generally appreciate one of my colleagues’ work, I’ve been letting them know. The messages don’t tend to be long and usually focus on specific things I appreciated (to show that I’m familiar with the work in question) and thanking them for their contributions.

This might sound like a small thing. However, from experience I know that it’s surprisingly uncommon to receive much positive praise for the work that writers or speakers engage in. The times that I’ve received such positive feedback are pretty rare, but each time it’s made my day.

There are any number of policy proposals for ‘correcting’ online behaviour, many of which I have deep and severe concerns about. Simply saying ‘thanks’ in specific ways isn’t going to cure the ills of an increasingly cantankerous and abusive (and dangerous) Internet culture. But communicating our appreciation for one another can at least remind us that the Internet is filled with denizens who do appreciate the work that creators are undertaking day after day to inform, education, delight, and entertain us. That’s not nothing and can help to fuel the work that we all want to see produced for our benefit.

Categories
Quotations

The Internet and Systemic Inequity

The information superhighway is being promoted as a powerful means to even out disparities and inequalities that afflict people inside the United States and throughout the world economy … a privately owned and managed information superhighway will be turned toward the interest and needs and income of the most advantaged sectors of the society. Significant modification of this systemic tendency requires the pressure of a strong political movement.

Herbert I. Schiller. (1995). “The Global Information Highways: Project for an ungovernable world.”

What Schiller wrote in 1995 could as easily be written, today, as it pertains to the new technologies which are regularly promoted as evening out disparities and inequities. It remains unclear to me that there has been any significant change in the systemic tendencies that are baked into the contemporary internet, nor that there is sufficient contemporary political pressure to reform existing inequalities let alone ensure that next-generation technologies will not reproduce them.

Categories
Links

Finding a Foreign Policy for the Internet

Justin Sherman and Trey Herr have an outstanding essay that clarifies the need for Washington and its allies to build a cohesive foreign policy for the Internet instead of simply opposing the strategies presented by competitors such as China.1 Poignantly, they write:

Washington needs a foreign policy for the internet that advances a vision for the internet that speaks to the language of trust and embraces the need to focus on the role of individuals, grasps the utility of iterating small changes instead of grand bargains, and embraces the reality that the clock cannot be turned back. This strategic product must do more than reject the sovereign and controlled authoritarian internet model, based on principles of tight state control over internet data routing, tight state control over data storage, and limited content freedom. A foreign policy for the internet must build on not just U.S. government agencies but allies and partners overseas, and leverage the influence that the American tech industry has over internet infrastructure. It must realistically address the shortfalls and risks of a free and open internet but seek to maximize and revitalize that internet’s benefits—across everything from speech to commerce. A foreign policy for the internet should rest on three assumptions; there are myriad others but these three are systemically significant.

These strategies absolutely must be developed and cohere given the importance of the Internet for day-to-day life; the Internet underlies everything from trade coordination, military engagements, and is increasingly lifeblood for civic life or organizing. It is time for the West to make clear what it is for, and how it plans to navigate the challenges that the Internet has wrought, without succumbing to fear or abandoning the democratic principles which have undergirded the Internet and its composition for the last several decades.

  1. Should you doubt that China has a cohesive strategy for the Internet, I’d recommend reading about the prospect of a splinternet forming as a result of China and its allies building out competing standards that prioritize placing control in centralized and obedient-to-government hands. ↩︎
Categories
Links Writing

VPN and Security Friction

Troy Hunt spent some time over the weekend writing on the relative insecurity of the Internet and how VPNs reduce threats without obviating those threats entirely. The kicker is:

To be clear, using a VPN doesn’t magically solve all these issues, it mitigates them. For example, if a site lacks sufficient HTTPS then there’s still the network segment between the VPN exit node and the site in question to contend with. It’s arguably the least risky segment of the network, but it’s still there. The effectiveness of black-holing DNS queries to known bad domains depends on the domain first being known to be bad. CyberSec is still going to do a much better job of that than your ISP, but it won’t be perfect. And privacy wise, a VPN doesn’t remove DNS or the ability to inspect SNI traffic, it simply removes that ability from your ISP and grants it to NordVPN instead. But then again, I’ve always said I’d much rather trust a reputable VPN to keep my traffic secure, private and not logged, especially one that’s been independently audited to that effect.

Something that security professionals are still not great at communicating—because we’re not asked to and because it’s harder for regular users to use the information—is that security is about adding friction that prevents adversaries from successfully exploiting whomever or whatever they’re targeting. Any such friction, however, can be overcome in the face of a sufficiently well-resourced attacker. But when you read most articles that talk about any given threat mitigation tool what is apparent is that the problems that are faced are systemic; while individuals can undertake some efforts to increase friction the crux of the problem is that individuals are operating in an almost inherently insecure environment.

Security is a community good and, as such, individuals can only do so much to protect themselves. But what’s more is that their individual efforts functionally represent a failing of the security community, and reveals the need for group efforts to reduce the threats faced by individuals everyday when they use the Internet or Internet-connected systems. Sure, some VPNs are a good thing to help individuals but, ideally, these are technologies to be discarded in some distant future after groups of actors successfully have worked to mitigate the threats that lurk all around us. Until then, though, adopting a trusted VPN can be a very good idea if you can afford the costs linked to them.

Categories
Aside

2018.10.13

It would be amazing if Sony actually worked to improve the quality of their PlayStation server infrastructure. It’s insane that I have to wait 4-5 hours to download 80GB on a 250Mbps symmetrical connection.