Vint Cerf, one of the pioneers of the Internet and a vice president at Google, at a meeting of the International Corporation for Assigned Names and Numbers in Los Angeles, October 2007. (Joi Ito)

CTV.ca

Officials from 18 countries held an impromptu, late-night meeting earlier this month at the United Nations office in Geneva, and made a decision that rattled Internet technocrats around the world.

Autocratic governments like China and Iran attended the meeting, as did several democratic ones. Despite protests by Portugal and the United States, they voted to staff a working group on the future of the Internet Governance Forum — an important theatre of discussion on matters of cyberspace — by governments alone.

The seemingly arcane move reverberated through a community of technical experts, academics and civil society groups who felt they had been unfairly excluded.

Fourteen technical organizations that help oversee how cyberspace runs wrote an open letter asking the UN Commission on Science and Technology for Development (UNCSTD) to reverse its decision. Meanwhile the Internet Society, an umbrella group that helps manage technical standards online, posted a petition to its website in protest.

“A significant fuss has been kicked up about it,” said Byron Holland, president and CEO of the Canadian Internet Registration Authority, which manages the .ca domain.

Even Google waded into the fray. Vint Cerf, a vice-president at the online behemoth and one of the pioneers of the Internet, added his name to the petition, alongside 2,600 others. He also attacked the UN decision in a Dec. 17 blog post on Google’s website.

“We don’t believe governments should be allowed to grant themselves a monopoly on Internet governance,” Cerf wrote. “The current bottoms-up, open approach works — protecting users from vested interests and enabling rapid innovation. Let’s fight to keep it that way.”

Eleven days later the UNCSTD buckled under the pressure, according to the Internet Society, and agreed to include up to 20 non-governmental groups.

The episode underscored what has become an uneasy relationship between organizations that have helped gently steer the Internet since its infancy, and UN bodies that came to focus on Internet governance during the 2000s as cyberspace continued to unfurl across the brick-and-mortar world.

“The root of the debate here is a philosophical difference between how you approach the future governance of the Internet,” Holland told CTV.ca by phone. “Everything that goes forward from that will have a very different tone or direction.”

Technocrats like Holland have also been hinting at a specific threat: that the UN could become a forum where authoritarian governments who are riled by the free flow of information work to put the breaks on its superhighway.

Cyber peace treaty

A second UN body — the International Telecommunications Union (ITU), which manages the world’s radio frequencies and orbiting satellites — has been debating who should govern the Internet for years.

Its secretary general, Hamadoun Toure, would like to spearhead the creation of a “cyber peace treaty” to prevent the Internet from becoming another domain in which countries wage war against one another, as they do by air or at sea.

“Cyber threats can reach critical infrastructure of any country, the nerve centre of any nation,” Toure said by phone from Geneva. “A sophisticated attack can bring even the most powerful nation to its knees.”

There have been several recent examples of such events. During a dispute with Russia in 2007, Estonia was hit by widespread cyber attacks that knocked out bank, newspaper and government websites. Similar denial-of-service attacks struck Georgian media and government websites a year later as Russian tanks rolled into South Ossetia.

Then last July, the discovery of the Stuxnet worm led to speculation that a foreign government was trying use malicious software to cripple Iran’s nuclear program.

But there are a number of hurdles to creating an international agreement that would discourage such attacks. One is who would forge it.

“If we were to have a roundtable on this, you would see not only governments around it. Are we mentally prepared for that, to have around the same table private sector, civil society, consumer groups and governments?” Toure said. “That is what it will take for meeting the challenges of a cyber peace treaty.”

Risky business

Critics of Toure’s proposal worry that non-governmental groups would not be given an equal seat at the table, and point to the ITU’s plenipotentiary conference in October.

There, delegates discussed a Russian proposal to take over managing Internet domain names. Currently that task falls to the Internet Corporation for Assigned Names and Numbers, a private organization whose president and CEO was barred from attending the meeting.

Others say the ITU’s government-to-government approach is too slow and clunky to manage something as fast-moving as the Internet, or that it could pave the way for less open regimes to introduce new online controls.

“We have to be careful about what institutions take the lead,” said Ron Deibert, director of the Citizen Lab and the Canada Centre for Global Security Studies at the University of Toronto. “The Chinas, the Irans, the Saudi Arabias of the world want to impose a territorial vision of control over cyberspace — and if the ITU got its wishes, that’s essentially what would happen.”

In future, the debate over who should govern the Internet would do well to bear in mind its success stories like Google and Facebook, said Olaf Kolkman, director of NLnet Labs and chair of the Internet Architecture Board.

If the ease of accessing an unfettered online world helped those billion-dollar corporations evolve from tiny start-ups in garages or university dorm rooms, he suggested, then closing off the Web could lead to stagnation. It might also wall off opportunities for everyone who has yet to set foot in cyberspace.

“If we can preserve the spirit of openness moving forward,” Kolkman wrote in an email, “we will see much of the innovation coming from developing countries, and the billions of people who have yet to come online but who will change the shape of the Internet when they do.”

http://www.ctv.ca/CTVNews/TopStories/20101228/un-governments-future-of-the-internet-101230/

Internet users at a cafe in China.

CTV.ca

“All stuffs delivery instant after payment,” the cyber-crook has written in broken English. “I dont sell by 1 Card, if you need ask me I will give you some free.”

Below this offer, logos of HSBC, Lloyds and a few other major banks are aligned in a row. Far from acting on behalf of these financial institutions, however, the person who runs this website is selling stolen banking information in bulk to miscreants interested in defrauding their customers.

The prices for credit-card numbers range from $15 to $40 depending on the type. Buyers choose from five payment options, including Western Union. The stolen numbers are then transmitted by instant message or email.

Although they keep a low profile, similar websites abound online. Another offers TD Bank Visa Classic numbers for 10 euros apiece (just add them to your virtual shopping cart and check out). A third stocks “Canada Classic” numbers for $20 and “Canada Platinum/Gold” for $33.

Welcome to the shadowy world of cyber crime, where swindlers face such remote risks that they sell stolen information in plain view on the Web, yet their payoffs can be staggering.

In one recent case, the FBI alleges that more than 100 people in the United Kingdom, Ukraine and the United States stole US$70 million by using a strand of malicious software known as Zeus to uncover Internet users’ banking details.

No wonder business is brisk. By all accounts the industry is big and getting bigger, but exact measurements have proven elusive. Estimates of annual losses from online crime during 2009 ranged anywhere from $100 billion to $1 trillion.

“It dwarfs the size of the illegal drugs market but it’s impossible for anyone to accurately come up with numbers,” said Steve Santorelli, a former detective with Scotland Yard’s computer crime unit who now works with Team Cymru, a non-profit group that monitors Internet security.

“There’s advertising. There’s return on investment. There’s a lot of branding,” he told CTV.ca by phone from Burr Ridge, Illinois. “This is their living.”

Growing threats

Nearly two decades after the Internet’s popularity caught fire, two billion people around the world have moved online. But now there’s talk that cyberspace as we have come to know it — an inclusive, global network of networks — may be in danger from a range of threats including by online criminals and restive governments.

Legitimate Internet users jostle with ever more prolific, tech-savvy crooks. Other culprits launch political cyber attacks at the behest of governments eager to use criminal groups as proxies, according to many experts.

Adm. J. C. Harvey Jr. and Vice Adm. H. Denby Starling II cut a cake commemorating the establishment of the U.S. Navy Cyber Forces on Jan. 26, 2010. (U.S. Navy / Spec. 3rd Class Nina Hughes)

China, Russia, Israel, France and the United States have also developed “advanced” capabilities with which to wage war online, according to a 2009 report from Internet security firm McAfee.

“There’s a general climate of an arms race in cyberspace that I think is a major threat to an open Internet,” said Ron Deibert, co-director of the Citizen Lab and the Canada Centre for Global Security Studies at the University of Toronto.

“Part of that feeds into techniques of cyber crime and encourages privateering,” Deibert said. “You see many more instances of hacking and denial-of-service attacks directed at political targets” such as human rights and opposition groups.

Over the past several years, Deibert and a small clique of colleagues in Toronto, Ottawa and at Harvard have helped expose a global cyber-espionage ring, document Internet filtering around the world and dismantle a Russian criminal group that was making millions off a Facebook advertising scam.

He also advised Google after the company discovered last December that it had been targeted by China-based hackers. The attacks affected at least 20 large American companies, Google said, and allowed the perpetrators to access Gmail accounts belonging to Chinese human-rights activists.

Another major cyber attack came to light in July, when a Belarusian antivirus company discovered a new malicious computer program known as the Stuxnet worm.

It mainly infected computer systems in Iran and appeared to have been designed to target nuclear centrifuges. Those findings led to speculation that a foreign government created the virus, or hired a criminal group to do so, in an attempt to shut down the Islamic republic’s contentious nuclear program.

No silver bullet

Whether such events are driven by profit or by politics, the question of how to discourage them looms large.

“Any new technology can be misused,” said Igor Muttik, a senior architect with McAfee Labs in Slough, England. “It’s such an evolving and rapidly changing thing, governments and legislators are frequently behind.”

A number of fixes are needed, Muttik said, from educating Internet users about online threats, to creating software that will better protect them, to passing new legislation that can keep cyber criminals from stealing with impunity.

Complicating things, many of the governments who would institute those fixes are trying with greater success to rein in the Web.

Sixty countries experienced “some form of Web censorship” in 2009, twice as many as in 2008, according to Reporters Without Borders. The group singled out democratic countries such as South Korea and Australia as well as authoritarian ones like China.

“The World Wide Web is being progressively devoured by the implementation of national Intranets whose content is ‘approved’ by the authorities,” it warned in a report last March.

Similarly, Deibert believes the Internet is entering a dangerous new phase. After growing from a research tool in academic and military circles to a sort of global shopping mall, he’s convinced that a contest is now underway to determine who will control it.

“You’re finding elaborate doctrines now in how to fight and win wars in cyberspace, and proposals that would seek to re-engineer the Internet. These are coming from very powerful actors,” he said.

“People may look back at the 1990s and the 2000s as a brief window where we at least came close to this open, global commons of information and communication,” he added. “But right now we’re headed in a much different direction.”

http://www.ctv.ca/CTVNews/TopStories/20101228/internet-cybersecurity-hackers-101229/?utm_source=twitterfeed&utm_medium=twitter

Customers checking out at Sonic Boom Music, a 14,000-square-foot record shop in Toronto, April 15, 2010.

CTV.ca

A key episode in Jay Ferguson’s music career came about when, at age 12, he landed a job at a small record shop in Halifax.

“Another guy got fired while I was in the store,” Ferguson recalls. “So the owner looked at me and was like ‘do you want a job?’”

He worked at the store for the next four years, immersed in music by artists such as Elvis Costello, The Kinks and The Who. Those years changed his life.

“Working in that environment opened up a whole other world of music to me. I just really fell in love with it and wanted to play in a band ever since,” Ferguson said. “Everything else went by the wayside.”

Nearly three decades later, Ferguson and his bandmates from veteran power-pop quartet Sloan are joining dozens, perhaps hundreds of bands around the world by playing a free in-store concert on Saturday, in a collective gesture of support for the embattled neighbourhood record shop.

The performances are being held as part of Record Store Day, an annual campaign held on the third Saturday of April. This is a day to remind music listeners that, in the face of changes wracking the recording industry, independent music retailers would love their support.

More than 1,400 stores are participating in this year’s festivities, mostly in the United States and Britain. About 70 Canadian shops are taking part, including Vancouver’s Zulu Records and Sonic Boom in Toronto, where Ferguson will be playing with Sloan.

Record Store Day was dreamed up three years ago by Chris Brown, an employee at a New England indie music shop. Since then it has grown into a major international undertaking.

A long list of industry giants including The Rolling Stones, Bruce Springsteen, Velvet Underground, R.E.M. and Emmylou Harris are marking this year’s event with limited edition releases available only at independent record stores.

“It seems to have grown at a phenomenal rate,” says Spencer Hickman, a spokesperson for the event who runs Rough Trade East, a three-year-old record shop in London, England. “But I work in a busy store so I know how much people love record shops still.”

Industry changes

The Internet has visited sweeping changes on the recording industry, changes that are still playing out and that no one seems to fully understand yet.

Many specialized independent record shops, particularly in major cities, say they’re doing well. Others are closing their doors due to competition from music piracy, online retailers and big-box stores.

The number of indie record shops in Britain dropped from 734 in 2005 to 269 last year, according to the Independent Retailers Association. An estimated 3,000 stores sell recorded music in the United States, down from 12,000 a decade ago.

In Canada, sales of compact discs and vinyl fell nearly 7 per cent last year while digital sales jumped 42 per cent, mirroring changes in other markets. Business is quickly migrating online to outlets like iTunes, which boasted in February that it had sold an astonishing 10 billion songs.

Phil Gallo, an American journalist who has been writing about music for 25 years and co-authored a new book called “Record Store Days,” says neighbourhood music retailers are still coping with industry decisions that were taken more than a decade ago.

In the 1990s, the major labels embraced large chain stores as a way to sell huge volumes of “hit” CDs, ignoring small independent shops, Gallo said. Then the Internet collapsed the market.

But record labels such as Warner Music are starting to pay attention to small retailers again, he said, because they’re learning that such shops “drive the pace, either in the types of music or how it’s sold.”

“I think they’re starting to realize how vital they are to telling them what consumers want.”

Bouncing back?

If the 21st century has been tough on brick-and-mortar music shops so far, Record Store Day might be a sign of better times ahead.

EMI, Universal Music and Warner Bros. Records are among the event’s sponsors in the U.S., and Mayor Michael Bloomberg has said the date will be officially recognized in New York City.

Audiophiles are also turning to vinyl records in greater numbers, a format that many independent music shops never stopped stocking. In the U.S., vinyl sales shot up 33 per cent last year, according to Nielsen SoundScan.

Still, in the Internet age, big questions loom over many independent retailers, particularly those outside major markets like Toronto or Montreal.

“We’re a dying breed,” said Chris Boyne, an employee at Encore Records in Kitchener, Ont. “I mean it’s sustainable for now. But who knows?”

On Record Store Day in 2009, there was a line-up out the door of the 29-year-old shop, he said. But overall, sales have been dropping since he started working at Encore six years ago.

“We all love good music, and we like to try and share it with people,” Boyne said. “You can find that stuff on the Internet by yourself. But it’s not the same — it’s really not.”

The sign outside Google China headquarters in Beijing, adorned with flowers and notes from local Internet users. (Mike Dong)

CTV.ca

For nearly two months, Internet users in China have been waiting anxiously to find out whether the world’s largest online search engine will close in their country.

As ecologist Xiong Zhenqin told the journal Nature recently: “Research without Google would be like life without electricity.”

The Internet giant announced in January it was reassessing whether to continue its operations in China, where 384 million people surf the Web under tight government controls.

Google discovered that hackers had broken into its popular Gmail application. The attacks appeared to originate from mainland China. The culprits were looking for information about Chinese human rights activists and that suggested government involvement, Google alleged.

Citing concerns over security, human rights and freedom of speech, the California-based Internet giant said it would either find a way to stop censoring its search results in China or leave.

Whether Google and Beijing are in negotiations is unclear, but the company has made no public decision on the matter. Meanwhile the cyber attacks, which Google said hit at least 20 other firms, have reverberated through Washington.

The U.S. National Security Agency probed where the hackers were based, tracing the attacks to servers in Taiwan, then reportedly to a pair of Chinese schools. U.S. Secretary of State Hillary Clinton also demanded that Chinese authorities conduct a thorough and transparent investigation.

“The Google attacks were taken extremely seriously — more than just an incident of potential industrial espionage but a major body blow to the American political system,” said Ronald Deibert, a cybersecurity expert at the University of Toronto.

Deibert is one of the people Google has been soliciting advice from in its dealings with China. He delivered a presentation about the rise of cyberspace control at Google’s headquarters a week before the company uncovered the hack. And officials informed him of their discovery before they went public.

Deibert told CTV.ca the hackers went one step further than was widely reported, ostensibly trying to access directories of data that Google collects, as required by U.S. national security laws.

The company tapped Deibert’s expertise after he co-wrote a 2009 study into cyber attacks against the office of the Dalai Lama. Researchers uncovered an extensive online spy network dubbed GhostNet that they traced back to China. It had compromised 1,295 computers across 103 countries — including some in Canada.

Domestic appeal

Deibert says Canada needs to confront the issues of censorship and government intrigue on the Web that incidents like the Google hack raise.

In a paper published on Feb. 22 by the Canadian International Council think-tank, he called on Ottawa to develop a cyberspace strategy that includes:

• Fixing Canadian laws that foreign governments could use to justify controlling the Web, such as with content filtering or online surveillance
• Scrutinizing whether Canadian technology exports are being used by foreign governments to restrict Internet access
• Encouraging “arms control in cyberspace” by, for example, proposing a UN treaty to make the Web more open and peaceful

The idea of “arms control” may seem extreme, but governments have started using the Internet to help them wage war.

During the 2008 conflict in Georgia, hackers took down key government websites in the capital of Tbilisi while Russian tanks rolled across the border. Military powers including France, Israel and the U.S. have adopted such cyberwar tactics as part of their defence policies.

The Internet is “entering a dangerous and chaotic phase, essentially a cyber-arms race,” Deibert said, and that’s led to spiralling computer espionage and computer network attacks.

“We need at least some government to stand up and say ‘how are we going to restrain this?’”

Policy ‘vacuum’

Stephen Harper’s Conservative government pledged, in this week’s throne speech, to create a cybersecurity strategy that would protect Canada’s “digital infrastructure.”

So far, however, there has been a “surprising vacuum in Canadian policy around cyberspace generally,” Deibert says.

Ottawa has been considering legislation on the issue. “The Investigative Powers of the 21st Century Act” was tabled last June. It proposed that Internet service providers be required to hand over data and personal information about their customers to police. But the bill hadn’t become law by the time Parliament was prorogued.

The federal government’s existing cybersecurity efforts are organized around Public Safety Canada. For example, CSIS and the RCMP’s technological crime unit probe Web-based threats or attacks and report to Public Safety.

The department is also “leading cross-government efforts to produce a cybersecurity strategy,” David Charbonneau, a spokesperson for Public Safety Canada, told CTV.ca by email.

The strategy will incorporate input from private companies and foreign governments, Charbonneau wrote, “and will build on significant efforts that have been underway.”

Meanwhile south of the border, U.S. President Barack Obama appointed a White House cybersecurity co-ordinator in January. The U.S. Department of Homeland Security created a similar position in 2005, and Washington unveiled a national cybersecurity plan in 2008.

As governments in North America and elsewhere develop policies on cyberspace, they’re influencing how the Internet will evolve.

“The dominant trend right now is the growing militarization of cyberspace,” Deibert said. “That leads down a path towards islands of territorialized Internet that are not connected to each other.”

“Another path I’d prefer to see is one where there’s perhaps a treaty articulated by countries of the world that lays out basic principles for how cyberspace should be governed,” he added. “Hopefully that would be in an open, public way.”

For the time being, efforts to keep the World Wide Web peaceful and open are centring on China, which passed a new round of Internet controls last week.

Without an international cyberspace treaty, the U.S. government is considering whether to lodge a complaint about China’s online censorship with the World Trade Organization.

But China isn’t alone. The list of countries where Internet censorship has become a hot-button issue has grown to include democracies like Germany, France and Australia.