Several years ago I was in a meeting with a bunch of execs from a number of high level security companies, talking about ways to improve Internet security globally. It was a bit of a big wig brainstorming session. Most of the comments I heard were innane things like “We need IPv6 globally! That would get rid of NAT!” and “An IPS in every home would solve everything.” As we went around the table I heard more and more ill thought through ideas that probably would do only more harm than good for internet security. Then came my turn.
I looked at these execs who were all more than 10-15 years older than I, with presumably the same level business accumen, and I told them, “Accountability. If you had accountability for every transaction, every packet on the entire internet, to trace back to the person typing the commands, internet crime would nearly halt.” Today, I still believe that to be true, however the cost associated would be enormous - not to mention the backlash. However, let’s step through it for academia’s benefit:
- The reason why blackhat SEO can exist is because Google cannot programmatically tell who originated every last byte.
- The reason why spam can show up in my inbox is because I can’t go and readily beat the person who sent it to me with a lead pipe.
- The reason why the internet can transmit cross site scripting attacks is because the website owners can’t effectively parse threir logs to find out who sent the traffic in the first place.
Let’s assume the data that the Internet had on you were 100% flawless and real time for a second. Think about it. If you knew that every email you sent, and every internet site you went to had every peice of relevant and up to date personal information about you and your whereabouts, would you do anything illegal on the web - even as a bad guy? The problem is that the Internet was built with anonymity in mind. It was designed to hide the user behind IP addresses, and pseudonyms.
The reason why security will always be a problem on the net is because it is intentionally designed to be a vast dumping ground for all activity, in a highly random but also very organized manner, so that anyone who surfs it is relatively safe and anonymous. Of course there are exceptions, and there are valid prosecutions, but that proves my point. When accountability for actions is held, the users are forced to stop their malicious activities. There are no further crimes committed (at least in that way) by that person because guess what? Prison sucks - especially international prisons.
I’m certainly not advocating the goverment know everything about every user who uses the Information Super Highway - no indeed. I’m actually far more of a privacy advocate if anything. However, the systems that are placed on top of applications these days (like DRM and spyware) are circumventing the anonymous nature of the Internet by broadcasting as much information as possible to the originator - thereby adding accountability. Looking into the faces of the men around me, I truely believe the point was lost on them. Not that there is anything any of them could to to create accountability on the Internet anyway, so back to IPSs we go. With that, I think the issue is not about accountability afterall, it’s about risk mitigation. Bruce Schnier is a smart man. If you haven’t already read Secret and Lies, and you work in the security world, go buy it - it’s non technical, but worth the read.
In Bruce’s first book Applied Cryptography, he basically says, “All security can be solved by math”. In his second book, Secrets and Lies, he basically says, “Wow, hahah, remember that last book I wrote about the math stuff? I was totally wrong about that one, sorry, it’s all about risk mitigation.” I have to respect that - he really grew up a lot between those two books. In any case, I think risk mitigation does not have to come at the cost of privacy even though it would help a lot. So no, I don’t think accountability is the key to security, even though I believe it would solve the issues.
The backlash, as I said would bring us full circle back to an insecure version. A secured version of the internet may be useful for children and people who have no need or desire for privacy. The rest of us will suffer with security issues.