April 2015

Feds Say Encrypting Data is Key but Don't Want to Pony up the Cash

Despite an increasing volume of data traveling across federal networks, a majority of federal IT managers recently polled do not believe that data is secure. Only about a quarter of the 200 respondents from 60 agencies were certain of their network data’s safety, according to the recently released report by research company, Market Connections. Incomplete and haphazard encryption are the likely culprits. “Despite the volume of unencrypted inter- and intra-agency data traversing most enterprises, many federal agencies are not implementing procedures to protect the network because it is expensive and degrades performance,” the report stated.

Almost all respondents said encrypting their network data is important. But when asked whether their agency actually does so, that number decreased to 76 percent, according to the report. The main challenge facing agencies when it comes to keeping network data safe is insufficient budgets. Three-quarters of those polled said it’s an issue. A lack of internal resources and concerns that data protection systems are too complex were also cited as obstacles for about 50 percent of respondents. The majority of those polled said they consider prevention a “high priority” in cybersecurity. Identification and remediation were both “high priorities” for almost 50 percent of those polled.

The Internet’s dark corners cannot be without laws

[Commentary] The sophisticated encryption software that now comes as standard with many electronic gadgets is, in many ways, just another instrument of modern life. Like air travel, international banking and mobile telephones, it contributes to all kinds of productive human endeavour -- and also presents new security risks. But there is a difference. Its rapid and organic growth left little scope for regulatory control and balance. The police are sometimes characterised as despotic agents of digital repression. That is wrong. I have never believed that encryption should be banned; it is a fundamental part of how the Internet works. But its utility and effectiveness, like that of the Internet as a whole, also creates significant criminal opportunity by masking identity and hiding communication.

Other innovations that have multiplied the freedoms of modern life were the product of democratic deliberation, and incorporated security by design. When telephones were introduced, a set of balanced legal instruments gave police the power to intercept them. Financial institutions have become more complex, but they are compelled to operate strong anti-money laundering controls. Why should the Internet, alone in the territories in which we live our lives, be one in which rules do not apply. It should not, of course. We have to craft rules that will operate in a balanced way. The digital age has changed our way of life but police teams are still in the same business of preventing crime, tracking offenders and securing evidence with which to convict them. It is just that, these days, much of the information needed to do that is in the hands of the private companies that run online services. To do our job, we need to earn their trust. Together, we can keep the Internet both a free and safe part of our lives.

[Rob Wainwright is director of Europol, the Europpean police agency]

Potent, in-the-wild exploits imperil customers of 100,000 e-commerce sites

Criminals are exploiting an extremely critical vulnerability found on almost 100,000 e-commerce websites in a wave of attacks that puts the personal information for millions of people at risk of theft. The remote code-execution hole resides in the community and enterprise editions of Magento, the Internet's No. 1 content management system for e-commerce sites. Engineers from eBay, which owns the e-commerce platform, released a patch in February that closes the vulnerability, but as April 20, more than 98,000 online merchants still hadn't installed it, according to researchers with Byte, a Netherlands-based company that hosts Magento-using websites. Now, the consequences of that inaction are beginning to be felt, as attackers from Russia and China launch exploits that allow them to gain complete control over vulnerable sites. "The vulnerability is actually comprised of a chain of several vulnerabilities that ultimately allow an unauthenticated attacker to execute PHP code on the Web server," Netanel Rubin, a malware and vulnerability researcher with security firm Checkpoint, wrote in a recent blog post. "The attacker bypasses all security mechanisms and gains control of the store and its complete database, allowing credit card theft or any other administrative access into the system."

The attacks are coming from the IP addresses 62.76.177.179 and 185.22.232.218, which are both based in Russia. Web administrators who are concerned their sites are compromised should also check their logs for these addresses. Still, that method isn't fool-proof. According to Incapsula, attacks are also coming from addresses located in China, and it wouldn't be surprising for attacks to become more widespread in the coming days.

Net Vitality: Identifying the Top-Tier Global Broadband Internet Ecosystem Leaders

This is the first-ever quantitative and qualitative composite analysis of the global broadband Internet ecosystem, viewed in a country comparative context. The development of this index helps identify the top-tier global broadband Internet leaders -- an elite grouping of five countries that distinguish themselves as pacesetters for future benchmarking and best practices analyses. These leaders, grouped in a leadership tier rather than rank ordered, are the United States, South Korea, Japan, the United Kingdom, and France.

The Open Internet as a broadband Internet goal is worthwhile, but also too narrow as a foundation for Net Vitality. Rather, the Wide Open Internet is what the United States and other countries around the world should be trying to achieve. The Wide Open Internet encompasses the broader goal of an efficient ubiquitous broadband Internet ecosystem with virtually unlimited content and applications available without government restrictions. With continuing focus on the broadband Internet ecosystem, the idea of Net Vitality can be realized through a future-oriented policy process that capitalizes on the blazing speed of Internet time that has propelled us so far, so fast, and so impactfully.

Net neutrality rules will be used to regulate online marketers, advertisers and app developers

[Commentary] Data is the bedrock America’s $1 trillion digital Internet economy and a driver of America’s third-largest export, digital goods and services. Unfortunately, the Federal Communications Commission’s new rules, which impose a framework from 1934 on today’s Internet, could put a significant damper on this flourishing part of the American Internet ecosystem. A nightmare scenario would be for the FCC to take the path of the European Union’s cookie law, which requires that every time a user visits a website, a screen or pop-up window appears requesting the user to accept or reject information collection. Information Technology and Innovation Foundation estimates the cost of industry compliance and lost user productivity to be some $2.3 billion annually, as it takes users about two seconds per website to process the annoying pop-up. It is widely agreed that the law is a disaster, and it is slated for review by the new EU commission. Furthermore, the FCC’s net neutrality regulations could also restrict the use of application program interfaces (APIs), network information which is made available by telecommunications operators to enable edge providers to make mobile apps.

It is increasingly evident that what the FCC billed as rules to protect a free and open Internet are a bait and switch for more government surveillance and regulation of the parts of the Internet that were supposed to be kept free from meddling. The FCC has overstepped its bounds, and it’s time for Congress to define the rules and the FCC’s authority.

[Roslyn Layton studies Internet economics at the Center for Communication, Media, and Information Technologies (CMI) at Aalborg University in Copenhagen, Denmark]

Resistance to Verizon FiOS Promotion

Disney and Fox took another swipe at Verizon, informing the telecommunications company that they would not run a commercial for FiOS’s new cable package on some of their channels. Disney, Fox and NBCUniversal objected this week to the FiOS cable package, which offers a slimmer version of basic cable. The product, called FiOS Custom TV, made its debut on April 19. A Verizon spokeswoman, Deidre Hart, said Disney told the company that it would not run ads for FiOS Custom TV on local stations, including WABC, A&E and ESPN Radio in New York (NY) and the ABC affiliate in Philadelphia (PA). Likewise, Fox will not run the ad on its New York affiliate, WNYW, and on the sports cable channel YES, Hart said. The FiOS ad began airing on April 22 on local broadcast stations.

“This anticompetitive tactic is only hurting consumers,” Hart said. “As we’ve been saying, FiOS Custom TV is a product consumers want, and it’s all about consumer choice. We believe we are allowed to offer consumers and small businesses this choice and flexibility under our existing contracts.” A Fox spokesman said that the company preferred “to keep our commercial discussions confidential.” Disney declined to comment.

The big challenge facing Google's new smartphone service

Google's Project Fi aims to reduce the cost of wireless connectivity by helping customers rely more heavily on cheap Wi-Fi networks rather than expensive cellular ones. These services will exert some pressure on incumbent wireless cellphone carriers to cut prices. But so long as Google is reselling those companies' services, there's a limit to how much savings it can offer. The big question is how much Google can help customers shift off of cellular networks in favor of free Wi-Fi networks. The experience of Republic Wireless, a startup that pioneered Google's Wi-Fi-first model, suggests that it's not as easy as it looks. First, Project Fi will be most appealing to customers at the low end of the market. If you want a bare-bones plan that uses less than 1 GB of data from cellular networks, Project Fi is a more affordable option than any of the alternatives. On the other hand, for customers who need large amounts of cellular data Google's offering isn't a particularly good deal. Other providers offer cheaper packages at the 3 GB and 5 GB levels. And if you know how Project Fi works, this makes perfect sense. Google doesn't own its own cellphone towers; instead, it's reselling capacity provided by Sprint and T-Mobile.

The people running those companies aren't stupid, so they're not going to sell Google capacity at a price low enough for Google to undercut their own offerings. Google can't offer customers lower rates for cellular data, but it might still be able to save its customers money by helping them shift more of their traffic from expensive cellular networks to affordable Wi-Fi ones. If Google can help customers use Wi-Fi more and cellular service less, it can save customers money.

Rural phone woes persist in Minnesota, across the country

Rural telephone connection problems continue to plague remote communities in Minnesota and across the country. A national test of 2,150 rural calls in 2011 showed that 344 never reached their destination and another 172 were “unacceptably delayed or of poor quality,” according to the Federal Communications Commission. Critics claim that some cut-rate long distance routers moving calls in the middle of the nation’s telecommunications network simply do not connect rural calls to avoid expensive connection fees. No one is sure how many of these intermediate carriers exist because they don’t have to register with the government. They can set up operations simply by downloading free software on the Internet and filing a rate plan with phone companies.

“It’s outrageous to have fly-by-night carriers just dump the calls,” said Sen Amy Klobuchar (D-MN), who with Sen Jon Tester (D-MT) and Sen Jeff Merkley (D-OR), recently introduced legislation to try to fix rural call problems that she calls “literally devastating.” When health care, law enforcement and emergency personnel cannot reach each other or the public, the threats are obvious. But telecommunications breakdowns can upend rural businesses, too. “It almost bankrupted us,” said Roger Brazier, sales manager for Mattracks Inc., a 50-employee manufacturer in Karlstad (MN), 30 miles from the Canadian border. “People we talked to said, ‘Did you guys get bought out? You never answered your phone so I ended up buying from a competitor.’ ”

It happens in small communities all over the state, from Chokio (MN), where an insurance agent got angry e-mails from would-be customers who said they would not do business with him because they could not reach him by phone to Brainerd (MN), where a tire dealer plagued by failed calls made a symbolic point by slapping his local phone company with a bill for $50,000 in lost business. “In rural areas it costs more to deliver long distance calls [than in urban areas] so they just don’t put them through,” explained Brent Christensen, who heads the Minnesota Telecom Alliance, a group of rural phone service providers. “We’ve been dealing with this for years.”

The debate over whether we should DVR the classroom experience

Just as entertainment has now been time-shifted thanks to the DVR, there are similar efforts underway to time-shift the educational experience, making course content available on-demand, any time you want, any place you want, on any device you want. This is either the greatest thing that has happened in the history of education or, conversely, just another way for predominantly white, high-income, college-educated elites to maintain their dominance via technology.

Perhaps no innovation better showcases this broader trend towards time-shifting the educational experience than the phenomenal rise of “lecture capture” technologies for the university classroom. At its core, “lecture capture” refers to the concept that every university lecture should be automatically recorded via video and/or other multimedia. Once it has been captured, this content can then be transformed into a more active learning experience. According to a new report from ResearchBeam, lecture capture could be a $672.25 billion industry by 2019, and from 2015-2019, it’s projected to grow at a 20 percent compound annual rate. All of the biggest educational players -- even the elite educational institutions that you might think would be opposed to it -- are involved in one way or another, and the scope of some of the test cases has been staggering. The problem is, the more that students are allowed to time-shift the educational experience, the more that the market for education could begin to resemble the time-shifted market for entertainment content. Binge-watching lectures will become the new “cram the night before the exam.” Supercuts of class lectures will become the new Cliffs Notes for the online video generation. From this perspective, it’s easy to see how time-shifting the classroom experience will fundamentally change the university experience. The other problem is that time-shifting entertainment may actually lead universities to de-emphasize high-quality content that simply isn’t getting a big enough “live” audience.

Benton

Search