InternetPolicy.net

Group promotes "digital ubiquity" at home

"The job of connecting all the consumer electronics devices in your home is getting a boost with the formation of an alliance of some 145 consumer and electronics companies," Michael Singer wrote on Wi-Fi Planet . "The consortium [is] now known as the Digital Living Network Alliance... The group outlined its Digital Home Interoperability Guidelines v1.0 as well as plans for compliance workshops and certification programs at a press event [in San Francisco on 22 June]. Some 60 engineers from various member companies worked on the 204-page specification...

"'As more and more consumers bring digital technology into their homes, the need to move their "digital stuff" from one device to another will become a major issue but for this market to really take off, the sharing of that digital content between devices must be seamless and extremely easy to set up...' Tim Bajarin president of research firm Creative Strategies, told internetnews.com... Jupiter Research Vice President and Research Director, Michael Gartenberg [added that] 'Streaming music from their PC to their stereo is the number one reason why consumers desire a home network and 51 percent of consumers are interested in recording TV content on their PC but playing back on their TV sets. As interest in digital ubiquity in the home increases, the work of the DLNA to foster standards and reduce technical complexity will help make the vision a reality.'

"...[The] rest of 2004 will be spent working on the construction of digital rights management content protection with interoperability between platforms targeted for 2005... Currently, the [Digital Home Working Group] has agreed on HTTP as the default for media transports and Universal Plug-and-play (UpnP) architecture for device discovery and control. The group is also pushing the next generation of Internet Protocol - IPv6... DHWG says any format it chooses must be an open standard that has been formally ratified by an internationally recognized standards organization, and [intellectual property] must be licensed under reasonable, non-discriminatory terms..."

Media's role at issue again in WSIS?

Emrakeb Assefa reports from Prepcom-1 for the Highway Africa News Agency:

"An influential figure in the Geneva phase of the World Summit on Information Society (WSIS) demanded today that the minimal role accorded to the media in building an inclusive Information Society should be altered, calling for a new round of talks on the issue in the second phase of the Summit taking place in Hammamet, Tunisia.

"During the opening ceremony of the first WSIS [2] Prepcom... Mark Furrer, head of the organizing team of the Geneva phase of WSIS told participants that three pending issues remain to be solved, namely Internet governance, financing mechanisms and the role of the media... His remarks came as a surprise since other WSIS officials, including Yoshio Utsumi, the general secretary of the International Telecommunications Union (ITU) and Janis Karklins, president of the Tunis Prepcom, see the role of the media as a closed chapter. They agree that only two broad issues, namely Internet Governance and financing mechanisms are open for negotiation and debate during the Tunis phase.

"Furrer, explaining why the issue of media should be revisited, noted that one 'mistake' made during WSIS Geneva was to bring the issue 'too late to the board' and as a result, he maintained, negotiations were 'incomplete.' When asked to comment to Furrer's statement, Utsumi, however, denied that there would be a reopening of discussion. He said that the statement was not the WSIS's official position and should be regarded as Furrer's 'personal opinion.' The role of the media was one of the issues where a consensus was reached at the Geneva Summit, he further stressed..."

If media's role is reopened at WSIS-2, the event's location could fuel more controversy. As the editor of Reporters sans Frontieres' Internet Under Surveillance plaintively asked in his preface to the survey, "Didn't the UN know that the regime of Tunisian President Zine el-Abidine Ben Ali harshly represses Internet users? This shows there is little hope of the United Nations and the dictatorships among its members defending free expression [at WSIS-2]."

Indeed, Andy Carvin reported in his blog that the civil society caucus at Prepcom was overwhelmed yesterday by Tunisians demanding reconsideration of the choice of a critic of the Tunisian government's human rights record as the caucus' spokesperson. They even demanded that the caucus' leadership be changed. The clash was "kicked upstairs" in a most surprising way when governmental delegations invited the spokesperson, Souhayr Belhassen, to address their plenary in a timeslot separate from the one allotted to civil society. This could be a hint that UN officials and the Tunisian government won't be able to stop controversies from enlivening WSIS-2.

Florida to tax home networks?

Michelle Delio writes in Wired News that "Florida state officials are considering taxing home networks that have more than one computer, under a modified 1985 state law that was intended to tax the few businesses that used internal communication networks instead of the local telephone company... In 2001, that law was expanded to make 'any system that is used for voice or data that connects multiple users with the use of switching or routing technology' taxable up to 16 percent...

"'The tax language is so broad that virtually any communication technologies in your home or office could be subject to this tax,' said Chris Hart, spokesman for ITFlorida, a not-for-profit industry organization for the state's technology professionals. 'It's difficult to imagine a more anti-technology, anti-business tax... Information on this issue is starting to reach the general public, and it probably isn't widely understood just yet,' [Hart] said. 'However, once people do realize how this tax could impact them on a personal level, they wake up very fast.'

"...Florida Gov. Jeb Bush...has said he isn't in favor of the tax, but many fear he may be swayed by city and county government officials. The tax would go, in part, toward school construction and other projects. Additional meetings on the proposed rules for the tax will be held in other locations around the state later in the year, Department of Revenue officials said.

"If the law is implemented, Florida would have the most wide-reaching state tax on technology... [Officials] estimate enforcement of the tax could bring in more than $1 billion a year in revenue for the state."

New infection spread by business websites

CNET's Robert Lemos sums up what is known or surmised about the sophisticated new contagion first seen 2 days ago:

"Security researchers warned Web surfers on Thursday to be on guard after uncovering evidence that widespread Web server compromises have turned corporate home pages into points of digital infection. The researchers believe that online organized crime groups are breaking into Web servers and surreptitiously inserting code that takes advantage of two flaws in Internet Explorer that Microsoft has not yet fixed. Those flaws allow the Web server to install a program that takes control of the user's computer. Late Thursday, Microsoft advised customers to increase their browser security to the highest settings, although that could cause some Web site functions to stop working. The extent of the attacks is unknown, but the security community has seen numerous cases of personal computers infected when the user merely visits a Web site... [The] flaws affect every user of Internet Explorer, because Microsoft has not yet released a patch...

"The Internet Storm Center, which monitors Net threats, confirmed that the list of infected sites included some large Web properties... The group also pointed out that the malicious program uploaded to a victim's computer is not currently detected as a virus by most antivirus software...

"Researchers believe that attackers seed the Web sites with malicious [javascript] code by breaking into unsecured servers or by using a previously unknown vulnerability in Microsoft's Web software, Internet Information Server (IIS). When a victim browses the site, the code redirects them to one of two sites, most often to another server in Russia. That server uses the pair of Microsoft Internet Explorer vulnerabilities to upload and execute a remote access Trojan horse, RAT, to the victim's PC. The software records the victim's keystrokes and opens a back door in the system's security to allow the attacker to access the computer...

"Symantec believes that the attacks last fall and in April, which the current one most resembles, were conducted by online organized crime groups from Russia. The theory is supported not only by the fact that the server storing the malicious code is in Russia, but also by the sophisticated nature of the attacks, Symantec's Huger said. 'It's a group of people that have resources to bring to play,' he said, adding that the attack programs were not amateur material. 'The code wasn't pulled off a Web site; it was custom.'

"Meanwhile, the average Internet surfer is left with few options. Besides choosing the highest security settings for Internet Explorer, Windows users could download an alternate browser, such as Mozilla or Opera. Mac users are not in danger..."

Net outage reports - public or private?

The US Federal Communications Commission has proposed amending its rules that require telecom carriers to report significant interruptions of service, to extend reporting requirements to the providers of high-speed data lines, satellite links and wireless networks (see ET Docket No. 04-35, Notice of Proposed Rulemaking, FCC 04-30, Feb. 23, 2004).

"Enacted in the wake of the June 1991 AT&T long-distance crash, the FCC credits the rule with having reversed a trend of increased outages on the phone network, as telecom companies used the disclosures to develop best practices and learn from each others' mistakes. The commission is hoping for similar results on the wireless and data networks that have become integral to the US economy and emergency response capability," Kevin Poulsen explains on The Register. "The reports would include details like the geographic area of the outage, the direct causes of the incident, the root cause, whether not there was malicious activity involved, the name and type of equipment that failed, and the steps taken to prevent a reoccurrence, among other things.

"To the Department of Homeland Security, that's a recipe for disaster. 'While this information is critical to identify and mitigate vulnerabilities in the system, it can equally be employed by hostile actors to identify vulnerabilities for the purpose of exploiting them,' the DHS argued in an FCC filing this month. 'Depending on the disruption in question, the errant disclosure to an adversary of this information concerning even a single event may present a grave risk to the infrastructure.' If the FCC is going to mandate reporting, the DHS argued, it should channel the data to a more circumspect group: the Telecom ISAC (Information Sharing and Analysis Center), an existing voluntary clearinghouse for communications-related vulnerability information, whose members include several government agencies and all the major communications carriers. Data exchanged within the Telecom-ISAC is protected from public disclosure..."

Updates from Prepcom-1 in Tunisia

A reminder that Andy Carvin is blogging from the WSIS Prepcom-1 meeting in Tunisia - today he reported that the plenary session was abruptly suspended just before civil society presentations were supposed to start. Raul Bendrath is also reporting from Prepcom-1, in German and English, on the Heinrich Boll Foundation's WSIS website.

Civil society unheard at cybercime hearing

The US Senate Committee on Foreign Relations held a hearing last week (17 June) on the question of whether Congress should ratify the Council of Europe's Convention on Cybercrime as requested by President Bush. (Several other law-enforcement-related treaties were also on the hearing agenda.) "The only witnesses who testified about the Cybercrime Convention were government officials," notes the latest EPIC Alert, "and no nongovernmental organizations or industry groups were given the opportunity to participate. The government witnesses did not mention any criticisms or possible drawbacks of ratifying the treaty... In fact, the treaty remains very controversial in Europe, particularly the provisions relating to the lack of protections for the use, collection, and distribution of personal data...and there is concern that the extensive surveillance tools enabled by the Cybercrime Convention are threats to a democratic society."

The Electronic Privacy Information Center opposes US ratification of the Convention; on the day of the hearing, EPIC sent a letter to the Foreign Relations Committee explaining why. The written statements of those who testified at the hearing are online here.

Murky future of the .iq domain

"When an interim government takes over from the US-led occupation next week, Iraq will regain its place among the world's sovereign nations -- except on the Internet," notes the Associated Press' Brian Bergstein. "...[The] domain assigned to Iraq, .iq, is stuck in a strange bureaucratic limbo -- the company that had administered it is under U.S. criminal indictment -- and could remain there for months. As a result, if Iraq's government, national institutions or regular Iraqis want a Web site, they need to use international domains, such as .com, .org or .net, which are maintained in the United States...

"The US administrator in Iraq, L. Paul Bremer, and the head of Iraq's new National Communications and Media Commission, Siyamend Ziad Othman, have both urged ICANN to free up .iq as soon as possible, partly so government ministries can standardize their Web addresses.

"More than one group has applied to take over as .iq registry operator, said ICANN's general counsel, John Jeffrey, refusing to specify the number. For a while after the war ended, ICANN told applicants there were too many uncertainties about the stability of Iraq to assign the domain to someone else. Recently, however, ICANN began evaluating the technical qualifications of applicants and whether they truly have the support of the Iraqi 'Internet community.' Jeffrey wouldn't say how long the process might take..."

Online publishers not liable for 3rd-party ads

Paul Festa writes for CNET.com: "Web site owners [in the US] can rest a little easier following a little-noticed court decision last month that bolsters legal protections against lawsuits arising from the activities of their advertisers. Ramey v. Darkside involved a Washington, D.C., area dancer who sued a Web site publisher after one if its advertisers used a photo of her without her permission. In a May 17 ruling, U.S. District Judge Gladys Kessler rejected the bid in a decision seen as a statement that online publishers aren't responsible for the content of advertisements created by others... 'This case should help search engines and Web sites avoid liability for the ads they run, even if the Web sites help the advertiser develop the advertising content and decide where to place it,' said Eric Goldman, an assistant professor at Marquette University Law School..."

Study of porn distribution outside US

"Secure Computing Corporation...today announced the release of the first study of the global distribution of pornographic web pages... The study examined pornographic web pages in the Secure Computing SmartFilter(R) v4 Control List by non-U.S. country suffixes, such as .DE for Germany and .JP for Japan, and found over 46 million pages of pornography in the top 100 individual country suffixes... The study was limited to specific country suffixes, and did not include non-country specific domains such as .com and .net.

Region : Pages
Europe : 28,430,600
Pacific : 12,352,600
Asia : 3,193,000
Latin America : 1,048,600
Africa : 389,400
Canada : 283,600
Caribbean : 255,000
Middle East : 77,800
Total : 46,030,600

"While it was expected that most overseas pornography would be in European domains, the study revealed some surprising findings:

• "The .ST domain suffix of the smallest country in Africa, the island nation of Sao Tome, hosts 307,000 pages of pornography - three quarters of all of the 389,000 pages of pornography with African suffixes contained in the SmartFilter v4 database.
• "The only Middle Eastern domain suffix to host pornographic web pages in the SmartFilter database is the Israeli .IL, which hosts 77,800. The only Arab country domain in the database that hosts any pornography is Libyan .LY.
• "The domain suffixes of a number of small islands in the Pacific host a large number of pornographic web pages. The domain of the island nation of Niue hosts an astonishing 3 million pages of pornography on its .NU domain, and other island domains that each host hundreds of thousands of pages of pornography are the suffixes of Tonga, Christmas Island, the Cocos Islands, Tuvalu, and Vanuatu...

"The top ten country suffixes for hosting pornography in the SmartFilter database were:

Germany : 10,030,200
United Kingdom : 8,506,800
Australia : 5,655,800
Niue : 2,947,800
Japan : 2,700,800
Netherlands : 1,883,800
Russia : 1,080,600
Poland : 1,049,600
Spain : 852,800
Tonga : 848,800..."

UPDATE: GrepLaw heard from Seth Finkelstein about a press release from the registrar of the .NU domain: "Numbers in Secure Computing Study on Web Porn Were Fabricated and Defame the Tiny Nation of Niue... The more Web pages it can list in its filter the more protection it can claim to be providing, so in an apparent attempt boost the count, Secure Computing has included thousands of inactive and expired domain names, and the millions of Web pages associated with them, in its SmartFilter v4 Control List. 'The number of pornographic Web pages it has listed as being associated with the .nu domain name is wildly inflated as a result,' said [President of .NU Domain Ltd William Semich]..."