CISPA is Back and I Don't Care Anymore

Published by manu
Tags:

Cyber Intelligence Sharing and Protection Act which would enter U.S. law if passed, the House of Representatives will be voting on this in the next few days. There are many flaws with this, the EFF has a good FAQ about CISPA. In short it gives power to private companies to share their user's data with 3rd parties whenever they feel like it. This concerns anyone who uses an American company for anything from forums to email and so on.

Obama promised to veto it which could mean he'll actually sign it and say he has some reservations, a bit like with the NDAA.

We Don't All Live in America

There are a few Internet defense organisations based in the U.S.A., many do a brilliant job of gathering informations and breaking them down, investigating and so on. They often will have an option for non-Americans to participate, which is cool. Yet still, the whole thing feels way to America-centric and non-Americans have their own problems too, problems that these organisations do not address unfortunately.

As a non-American, it's perhaps time to stop playing along with American laws/bills and all their protests and petitions. These things just come back over and over again, that's how it works. People invest so much time reading about the new amendments, signing petitions, discussing these things on forums and chatrooms, but in reality it feels more like a big waste of time and energy. Time that could be spent actually doing things.

Actually, Most of Us Do Live in America, Virtually

There are 1 billion active Facebook users (according to Pingdom 2012 in numbers) out of 2.4 billion Internet users. If you want to know what people are thinking and doing, design a law that lets you into the Facebook and you have access to almost 50% of the world's profiles.

Facebook is an American company, if you are a European with a Facebook account then your profile is subject to American law. Even if your data is stored on a server located in Europe. In this case a part of you lives in America.

Facebook is obviously just one example, the same applies to any and every American operated Internet service, so Google, Hotmail, Twitter, Reddit, and so on. Even DuckDuckGo. Within the lot there are some companies that are more or less "good guys", others may be submissive and silent, in the end they are all subject to the Patriot Act and other goodies.

You may be interested in reading Safe Harbor: Why EU data needs 'protecting' from US law.

What Else Can I Do Besides Sign and Tweet ?

CISPA and many of its friends exist only because the overwhelming majority of Interweb users use centralised services. The problem is that almost everyone uses the same communication tools. This makes it easy to design laws that would target them and exploit their already exploited users. And that's what they do.

If the majority of users used their own servers all these laws would be very hard to implement. It would require actual work to start gathering a user's profile, so much that it would probably only happen when it's at least somewhat justifiable.

Running your own server isn't half as complicated as it sounds, I wont go into details here, but there are tools that make it easy (DISS for example, maybe not the best, but I tried at least). The ideal is to do this with friends and provide email services to your family and friends. Cheap and reasonably reliable servers exist and can be found under 20 euros a month even, they could host quite a few users.

All those Internet defense groups should be promoting self hosting, when they do that I will take them seriously.

comments 6

Internet Freedom Defenders, Please

Published by manu
Tags:

Lately there have been more and more attempts to legislate, censor and control the Internet and with that many protests to counter these measures. There are also more and new groups and political parties that advocate Internet freedoms, freedom of speech and all that stuff. Even some website that wants to have a "Bat signal" to gather activists when action is needed.

There are a few things that have been bothering me for quite some time now, if you already understand how we ended up with the Internet we have today you may skip to the end.

Brief History

Internet before

Internet was designed to be a global distributed network, which means no central point of failure or governance. Having a decentralised network was key in the design, this made it virtually impossible to shut down communications between peers as there would be many different possible routes from point A to B.

Before 2000 it seemed normal or at least common for people to host their own services even at home on their desktop computer.. Even though things like AOL, Hotmail and other such services existed, censoring and/or controlling the Internet was nearly impossible. People used so many different email providers, different search engines and various forums and chatrooms, the users were scattered all over the place.

The network slowly concentrated in to bigger centres. Some services grew and became better and better to a point were their names became synonym for the type of service they initially provided. Some extended their services to new domains, like that search engine who quickly understood that user data was the real money maker. They offered to capture user data as a service, they called it "email with unlimited space". People loved it so much that the other providers had to follow the same path or risk extinction. It became the most popular way of monetizing the Internet.

Later on newcomers landed directly on this new world of "ad-supported data violating web based services" and saw it as normal Interweb procedure. Meanwhile many "computer geeks" abandoned their personal servers and signed up for FaceSpace+ accounts, with that the wild west style communities started to die off, their users were outraged by any web page that did not have Ajax effects or OMG kittens. The first battles in the war on Digital Autonomy and Freedom were lost to fancy user interfaces and pokes.

Current Situation

Internet after

It's very simple, most users rely on one major search engine to tell them where to go, the same company provides them communication tools (email, chat), news aggregation, maps, calendars, document editors, etc etc. If you look at the top 500 global sites (according to Alexa) you can see that most of the biggest sites are all owned by a very small club.

Internet services are mostly centralised. It is now easier than ever to censor content on the Internet, Twitter accepts per country censorship on their network. Google has been complying too. In this case I am not judging Twitter and Google on their censorship policies and/or methods, they are quite open about this unlike others we might not always hear about.

This shows how easy it has become to control what information gets propagated on the Internet. Countries like Egypt may find it more effective to censor Tweets and Google searches rather than pulling the plug on the whole Internet. This more discreet approach should have something closer to the desired effect, indeed censorship works best when it goes unnoticed.

Tracking Users to Provide Tailored Content

Most Internet users nowadays have all their emails read by robots/scripts which then find the most appropriate advertisement to incorporate to their webmail page. Most of the data we feed into the machine gets mashed up into data that is sold to marketing researchers. If you don't have an account with any of these companies, you might still be feeding them copious amounts of data via cookies, analytics and other types of embeded web content.

It is nearly impossible nowadays to visit a web page that does not ask your browser to retrieve data from other sites. Even a simple image embeded to a website will provide useful statistics. True story, some random guy once linked to an image from my website for his site's footer, I suddenly had his complete visitor statistics.

Imagine how much more can be done from a company that owns an incredible amount of very popular websites and provides many analytical services to a point where almost every website visited implies a request to at least one of their servers. Now imagine that a lot of the people running around on this Internet are logged in to this big company's services and are hence personally trackable among almost all the sites they visit.

One of the goals of all this is to provide "tailored content", not the advertisements that happen to match your recent conversations, but your actual search results, news, etc. You might not have the same results using Google as someone sitting right next to you. Some say this is good, others say this is evil. I say is that it's a demonstration of what is technically possible today and it should make you react.

Internet Freedom Defenders, Please

The main reason why any of those CISPA/ACTA/PIPA/SOPA/CABANA things could affect the Internet is because of the way most of us use the Internet. Being mainly passive users has made it technically possible to apply very creepy legislation. I see these protests mainly as a wake up call for people to start changing their habits and to take the Internet back.

A few things many movements that try to defend and promote Freedom, Internet freedom, Free speech or any variant of those things need to start doing are:

  • stop using Facebook as your primary point of contact

    I get that you must use those tools to reach the masses, but you are losing the core by doing so exclusively. I really can't take you seriously if you communicate mostly via the same website that supports the law you are protesting against (Facebook supports CISPA). Just setup a public webpage somewhere with the infos people need, then share/spread the info via other mediums such as social networks, email, forums, etc.

  • Learn to use distributed and decentralised social networks

    You should use and promote usage of social networking tools that do not depend on a central authority, a great example is of course Friendica, there are many others too. Avoid corporate policy censorship by being your own social network administrator.

  • Don't use URL shorteners

    It should be obvious that shortened links are obfuscated links, there is no good reason to use them, ever. If you have a link to share, just share the link, not a link to the link.

  • Emails, install your own server

    This should be the most important element, a private mail server. This is where you tend to concentrate most of the confidential stuff. You should already want to do this by default, especially if you want to defend the Internet and Freedom, etc etc... . .

  • Avoid embedding tracking devices on your websites

    All those gadgets to "like", "sign in with", "comment using", etc etc are often tracking devices. By embedding them you automatically identify most users to their email and/or social network providers about their visit, without the user's consent.

Just one more thing, when Facebook, Twitter or some site like that starts acting weird, remember this: Their terms of Service allow them to do pretty much anything and you agreed to them (if you have an account). They do not owe you anything because you are not the customer, you are the product.

I feel sad sight when I see organisations like Demand Progress ask their subscribers to sign a letter to ask Facebook to stop supporting CISPA. Instead of trying in vain to change the corporation, do what these fine people did when Godaddy supported SOPA, change your habits.

What you do counts more than what you sign.

comments 2

CISPA - Another Bill Designed to Waste Our Time

Published by manu
Tags:

You may have already heard about CISPA (or CISPA or CISPA at !wiki), if not the simple version is: It's another law/bill/treaty/crap designed to waste everyone's time.

The slightly longer version is that it is a bill designed to allow companies to share data with other companies or governments with less hassle, like the hassle of asking or even informing the person who's data is shared. The full title says it nicely: To provide for the sharing of certain cyber threat intelligence and cyber threat information between the intelligence community and cybersecurity entities, and for other purposes.

One interesting thing has popped up in the news, it's that Facebook supports CISPA. Here are some other letters from some brave companies who support CISPA. In Facebook's case I can totally understand their view, their whole business is based on user's data. How could they not support this ?

Now the expected thing to do, if you are interested in privacy and that sort of thing, is to spend hours reading boring legislative crap until your brain starts pouring out of your ears. However, I really don't care this time. This might sound selfish or just lame, but I don't feel very affected by this. I don't have personal data on third party services (or ones I can't trust).

The real reason I don't care is not because I feel covered, it's because many of those that aren't covered do not care. Seriously, so many people believe that the practicality of having an email provider that let's you "star and tag" emails and the convenience of keeping up with friends just by clicking on their name outweighs any reason for concern, since years.

So if you use such services, and again disagree with this sort of legislation then it's your problem to solve now.. You can delete your account(s), write to them or just hope it will go away magically.

comments 3