Once again, Congress is being asked to make bad rules that will hurt network security, but this time the blame doesn’t fall on the privacy lobby. This time the booby prize goes to the intellectual property lobby.
Below is an op-ed I wrote for Politico this week on the security consequences of the copyright enforcement bills now on the Hill — PROTECT IP and the Stop Online Piracy Act. As it happens, the House Judiciary Committee held a hearing on the proposal on Wednesday, when the op-ed appeared, and some of the questioning turned on my op-ed. Indeed, I gather that it contributed to an unexpectedly ragged performance from Hollywood’s normally smooth witnesses.
Unfortunately, the Politico article was posted behind a paywall. That’s pretty ironic for an op-ed questioning the value of over-enforcing the copyright laws. So I’m posting it here, too:
Everyone knows that internet security is bad and getting worse. Recognizing the problem, Congress is hard at work on cybersecurity, with a number of bills on the table. Ironically, at the very same time, Congress is getting ready to pass a copyright enforcement bill that could kill our best hope for actually securing the internet.
How did that happen? Let’s start with the internet, where fake websites cost users millions of dollars in fraud losses every year. Unless we find a better system for locking down website identities, this and other forms of online crime will continue to skyrocket.
It turns out that internet engineers have already designed a system to solve this problem — a set of technical rules that go by the unlovely name of DNSSEC. Under these rules, an Internet website will be given identification credentials by the same company that registers its Internet name. Thus, when Citibank claims the domain name citibank.com, the registry who issues the name will at the same time lock that name to a particular Internet address. From then on, anyone who types “citibank.com” into his browser will be sent to one and only one Internet address. Under the new system, the browser simply will not take the user to a site that isn’t verified by Citibank’s unique credentials.
That’s protection that the people who bank online need today.
Why don’t they have it? Two reasons. The first is friction. Moving to the new rules won’t be free. It will require a lot of work by browser companies, internet service providers, domain registries, and others – many of whom may never get any direct benefit from the change. Naturally, these companies are a little slow to spend money that just makes the internet overall safer; that’s the tragedy of the commons. But as the need for security becomes obvious to all, we’re slowly overcoming that friction, thanks in part to the leadership of my old agency, the Department of Homeland Security, in getting government to adopt the new procedures.
The second problem is new. It is Hollywood’s desperate desire to keep foreign websites from delivering pirated movies and music to American computers. To do that, the movie industry wants a law that will require internet service providers block their customers from going to those sites. Instead, the users are supposed to be sent to a site that warns them against copyright infringement.
Hollywood has sold that idea to Congress, and bills are now moving through both houses to impose this “block and redirect” obligation on internet service providers. And they’re moving fast. The Senate bill is out of committee, while the House judiciary committee is holding hearings on a similar bill this week.
This is far faster than Congress’s cybersecurity effort, and it runs directly counter to that effort. Because “block and redirect” is exactly what crooks are doing today to bank customers. If the bills become law, the security system won’t be able to tell the difference between sites that have been blocked by law and those that have been sabotaged by hackers. Indeed, it isn’t hard to imagine crooks redirecting users to sites that say, “You were redirected here because the site you asked for has violated copyright,” while at the same time planting malware on the user’s computer.
What’s more, the bill will likely break the fragile consensus that my former agency, the Department of Homeland Security, has spent years helping to build around the switch to DNSSEC. If the bill passes, practically everyone who needs to make changes to implement DNSSEC will instead be on the phone to their lawyers, asking whether they will be sued for adopting a security technology that makes the mandated “block and redirect” system even more difficult.
If “block and redirect” could stop Hollywood’s bleeding, perhaps a case could be made for undermining everyone’s security in order to protect the studios’ intellectual property. But it won’t stop the bleeding. Even today, if someone is blocked and redirected away from his favorite pirate website, he can find many simple ways to defeat the block. He can paste his favorite pirate website’s number (rather than its name) into the address box on his browser. Or he can simply tell his computer to look up the site’s address on a Canadian server instead of an American one.
Passing this bill will make Hollywood feel better, and richer.
For about a minute.
It will leave the rest of us hurting and poorer for years.