Cable Lobby Working Hard To Ensure Biden Broadband Plan Doesn't Encourage Real Competition

from the do-not-pass-go,-do-not-collect-$200 dept

While the Biden administration's $2 trillion American Jobs Plan set aside $100 billion for broadband infrastructure, the details of how that money is to actually be spent remains murky. Enter cable industry lobbyists, who are hard at work attempting to dictate who gets access to those funds, while also trying to make sure the funds aren't used for anything that could threaten their regional monopolies. They're particularly worried about the Biden administration's promise that a big focus of the effort will be on giving aid to locally owned and operated broadband networks, as detailed in this good piece by Issie Lapowsky at Protocol:

"Comcast, Charter, AT&T and their respective industry associations have spent years beating back municipal broadband networks in states across the country, lobbying for laws that prohibit such networks and arguing that government-funded broadband puts the thumb on the scale of competition. With potentially $100 billion in federal funding on the line, the last thing the cable lobby wants is to see those restrictions lifted and funding diverted to cities, not their own coffers."

Granted as we've noted for years, these communities aren't getting into the broadband business because it's fun. They're doing so as an organic, voter-backed response to decades of market failure and regional monopolization. Said monopolization is obviously hugely profitable, and the cable industry lobby is working overtime to prevent anything upsetting that broken status quo. As Lapowsky notes, Charter and Comcast alone spent $7 million on lobbying Congress last year, and that doesn't including the millions in additional dollars spent by their policy and lobbying organizations like the NCTA (run by former FCC boss Mike Powell).

Nor does that tally include the millions spent annually by AT&T and Verizon on an army of consultants, lobbyists, think tankers, academics, and astroturfers, all of whom are now working overtime to ensure a lot of that money goes into their pockets, and not the pockets of regional community broadband networks threatening to bring real competition to bear. Networks that wouldn't exist if America's entrenched telecom monopolies actually cared about things like competition and consumer welfare.

Historically, the telecom lobby has had success after success when it comes to ensuring the U.S. government doesn't take regional monopolization and corruption seriously. But as Protocol notes, COVID (specifically news stories showing toddlers having to huddle in the dirt just to get online for class because home broadband either isn't available or is too expensive) has changed the dynamic and really showcased the harm of monopolization and corruption:

"But as this fight moves from the states to the federal level, local broadband proponents have some advantages they haven't had before. They don't just have the backing of the White House and support of Democrats who control Congress. They also have more than a year's worth of examples of how people on the wrong side of the digital divide in both cities and rural America have struggled during the pandemic — and how cable giants have failed to fill the gap."

Even then, some community broadband proponents are expressing concern that the telecom lobby is already having a negative impact on the important terminology being used at departments like Treasury to dictate where U.S. government funding is going to go:

"Earlier this year in March, the Biden Administration signed the American Rescue Plan Act, which included, among many other things, multiple sources of funds for broadband infrastructure. The U.S. Department of Treasury was tasked with writing the rules of how local governments can spend the various funds. The Interim Rule has been published and it appears to significantly limit local ability to invest in needed networks."

While community broadband is framed by telecom as "socialism run amok" or a "government takeover of the internet" to try and encourage partisan division, being pro-competition and pro-accountability is yet another subject that isn't actually partisan. Most community broadband networks have been built in conservative areas with the support of local voters. And again, the telecom lobby has a 25 year history of fighting tooth and nail against all broadband competition, not just community-run broadband. While getting slathered in tax breaks and subsidies for networks they routinely half deliver.

It has taken a quarter century to even get the U.S. broadband policy conversation to the point where we can admit (barely!) that monopolization and regulatory capture (corruption) are the two primary reasons U.S. broadband is expensive and mediocre. It's not clear how many more decades it will take to actually do something about it.

Filed Under: american jobs plan, broadband, community broadband, competition, infrastructure, joe biden, municipal broadband

Mastercard Lays Down New Rules For Streaming Sites That Require Them To Review Content Before Publication

from the war-on-porn-continues dept

Mastercard is in the process of killing off another way for sex workers to make money. Its updated policy on "illegal adult content" takes aim at a bunch of adult content that isn't actually illegal. What the new policy does is make it impossible for streaming platforms to comply with the new rules. Since they're not able to prescreen streamed content, they're just going to start blocking anything that seems like it might lead to Mastercard pulling the plug.

This will hit sites like OnlyFans and MyFreeCams the hardest, as sex worker/advocate Mary Moody points out. But it will also cause collateral damage at streaming sites that aren't able to comply with Mastercard's new demands and may start banning accounts and blocking streams if they suspect (without verifying) "adult content" might be offered.

Here's what Mastercard is requiring from sites hosting content:

• Documented age and identity verification for all people depicted and those uploading the content

• Content review process prior to publication

• Complaint resolution process that addresses illegal or nonconsensual content within seven business days

• Appeals process allowing for any person depicted to request their content be removed

Some of these are steps that platforms should be taking already. But the second bullet point poses significant challenges. This "for the children" effort will harm adults who produce adult content -- many who have never produced any content considered "illegal" under the First Amendment. Mastercard cites its partnership with several law enforcement agencies (as well as child porn clearinghouses like NCMEC) but doesn't say why it feels all adult content should be subject to rules meant to prevent the streaming of illegal content.

In the absence of any meaningful efforts on Mastercard's part (this puts the onus on everyone else but the credit card company), a statement like this is meaningless:

We’re committed to doing everything in our power to ensure only lawful activity takes place on our network.

But Mastercard isn't actually doing anything. It's handing out more requirements for platforms that accept Mastercard payments, but that's not actually doing something. That's making a bunch of other people jump through impossible hoops under the threat of defunding. And it will cause damage to plenty of lawful activity.

Mastercard is free to choose who it does business with. But if it just wants to dump cam sites used by sex workers, it could at least come out and say that, rather than hide behind "for the children" platitudes as it makes it impossible for sites like this to host actually legal content. This is just more anti-porn crusading that willfully lumps child porn and revenge porn in with legal content created by adults. Then Mastercard makes it impossible for platforms to comply without cutting off a majority of their user base.

Filed Under: infrastructure, payments, sex work, streaming sites
Companies: mastercard, onlyfans

Conspiratorial Attacks On Telecom Infrastructure Keep Getting Dumber And More Dangerous

from the head-full-of-pudding dept

On one side, you've got wireless carriers implying that 5G is some type of cancer curing miracle (it's not). On the other hand, we have oodles of conspiracy theorists, celebrities, malicious governments, and various grifters trying to claim 5G is some kind of rampant health menace (it's not). In reality, 5G's not actually interesting enough to warrant either position, but that's clearly not stopping anybody in the post-truth era.

But it's all fun and games until somebody gets hurt.

Over the last year or two, conspiracy theory-driven attacks in both the UK and US have ramped up not just on telecom infrastructure, but on telecom workers themselves. From burning down cellular towers to putting razor blades and needles under utility pole posters to injure workers, it's getting exceptionally dumb and dangerous. To the point where gangs of people have threatened telecom workers who don't even work in wireless.

As the Intercept notes, the rise in attacks has finally gotten the attention of law enforcement. In New York, law enforcement has finally keyed into the fact that the conspiracy theories have fused white supremacists and Q Anon dipshittery into one problematic mess that's resulting in concrete harm. White supremacists (here and abroad) have apparently figured out they can amplify and contribute to the conspiracy theories to generate more chaos for the American institutions they're eager to demolish. All stuff that's being amplified in turn by governments like Iran and Russia eager for the same outcome.

While superficially a lot of these folks have the coherence of mud, in many cases the attacks are very elaborate, and specifically targeted:

"In one case, it says, on December 14, 2020, an individual or individuals broke into a cellphone tower ground station in Fairview, West Virginia, severing the tower’s main power cable and removing the primary and back-up generator batteries. The tower had provided wireless coverage throughout West Virginia, Pennsylvania, and Maryland, and the damages totaled over $28,000.

In another instance, an unknown individual is said to have sneaked into a cell tower site in Tennessee on December 19, 2020, by cutting open its perimeter fence. The individual then severed the site’s fiber-optic cables and damaged several other telecommunications components, resulting in a “significant disruption of service for approximately 12 hours."

Many of these attacks are orchestrated by folks who know exactly what they're targeting. Often it's the loopy pudding-brained aspect of these stories that gets the most attention. Less talked about historically is how this bullshit enables white supremacist accelerationist fantasies, something law enforcement chatter is starting to more accurately discuss after decades (centuries?) of apathy:

"In recent months, white supremacist extremists, neo-Nazis, far-right Telegram groups, and online conspiracy theorists have all emphasized attacking valuable critical infrastructure targets.” Many far-right groups adhere to the “accelerationist” principle, which maintains that hastening the collapse of society will bring about political change. Targeting critical infrastructure, which impedes the state’s ability to function, is a common insurgency tactic used by militant groups worldwide."

Conspiracy theories work so well in America thanks to decades of greed slowly nibbling away at cornerstones of a functioning democracy, whether that's a lack of cohesive, affordable mental health care, a government gridlocked by corruption, or a press that still can't pay journalists a living wage while Instagram influencers nab million dollar contracts. Less informed, intentionally agitated, and increasingly faithless in the ability of institutions to protect them, the public clings to anything they can to feel in control, and that increasingly winds up being... complete and total bullshit. A systemic failure that's then exploited and amplified by no limit of bad actors, both foreign and domestic.

Filed Under: 5g, attacks, conspiracies, infrastructure, wireless

Study Shows California Telcos Are Simply Letting Their Networks Fall Apart

from the do-not-pass-go,-do-not-collect-$200 dept

On the one hand, it's understandable that US phone companies companies don't want to maintain aging copper phone networks in the wake of sagging usage. On the other hand, traditional phone networks are very much still in use (especially among vulnerable elderly populations), many of these DSL lines remain the only option consumers can get thanks to spotty US broadband deployment, and much of the phone and DSL infrastructure was heavily subsidized by American taxpayers. Oh, and as Texas just realized, many of these older copper phone lines still work during disasters, when internet voice services don't.

As such, there are numerous regulations that prevent these companies from just severing these lines completely. But US telcos, tired of traditional phone and residential broadband service, want to shift focus. So instead of a responsible transition plan (one that might mandate even coverage of wireless or fiber broadband upgrades they don't want to perform), many of these companies are simply letting the networks fall apart. And refusing to repair the lines when they fail. In large part because they know US state and federal regulators will (usually) be to chickenshit to actually do anything about it.

In California, a report requested by the government found the same thing throughout the state. The April 2019 report, only just released after regional incumbents AT&T and Frontier tried to block it, found that as customer rates skyrocketed for both AT&T and Frontier, both companies increasingly cut back on infrastructure upgrades, repairs, and maintenance over the last decade. The report also found that AT&T has increasingly engaged in "redlining," or the act of failing to meaningfully upgrade lower income and minority communities at the same rate as more affluent neighborhoods:

"...AT&T's investment policies have tended to favor higher-income communities, and have thus had a disproportionate impact upon the state's lowest income areas. For example, the weighted average 2010 median annual household income for... areas that had been upgraded with fiber optic feeder facilities to support broadband services was $72,024, vs. only $60,795 for wire centers without such upgrades. Using 2010 US Census data, we find a clear inverse relationship between household income and all of the principal service quality metrics. Wire centers serving areas with the lowest household incomes tend to have the highest trouble report rates, the longest out-of-service durations, the lowest percentages of outages cleared within 24 hours, and the longest times required to clear 90 percent of service outages. The opposite is the case for the highest income communities."

This lack of reliability of infrastructure, combined with steadily skyrocketing prices, runs in stark contrast to what we should actually be doing in the face of a global pandemic and climate destabilization. And of course it's far from the first time these two companies have been found to be utterly neglecting their networks. It's why a 90 year old man just had to take out a $10,000 newspaper ad just to get AT&T to finally upgrade his aging DSL line to fiber. And it's far worse in places like West Virginia, where Frontier's apathy toward its own customers (or basic upgrades and maintenance) is fairly legendary.

Again, this is what natural monopolies do in the face of limited competition and regulatory capture. Obtain a regional monopoly, do the bare minimum to keep that business afloat (while you focus on other ambitions like mindless media mergers), then throw a few thousand in PAC donations at local politicians so they pretend that none of this is happening.

The answer now is: what will California regulators actually do about it? And even in one of the most "progressive" states in the nation, the answer will be jack shit. It's fairly trivial for AT&T and Frontier to simply claim these networks don't matter because they're old, or to try (as AT&T does in the link above) to insist any data that suggests they're anything less than the pinnacle of corporate responsibility is fraudulent.

Filed Under: california, competition, copper networks, decay, infrastructure
Companies: at&t, frontier

Texas Power, Phone Outages Again Highlight How Infrastructure Underinvestment Will Be Fatal Moving Forward

from the things-will-need-to-change,-quickly dept

If you hadn't noticed, the United States isn't really prepared for climate change. In part because corporations and disinformation mills have convinced countless Americans a destabilizing climate isn't actually happening. But also because we were already perpetually underinvesting in our core infrastructure before the symptoms of an unstable climate began to manifest. It's a massive problem that, as John Oliver highlighted six years ago, doesn't get the same attention as other pressing issues of the day. You know, like the latest influencer drama or mortal threat posed by TikTok.

Infrastructure policy is treated as annoying and boring... until a crisis hits and suddenly everybody cares. As millions of Texans found out this week when the state's energy infrastructure crumbled like a rotten old house under the weight of heating energy demands, leaving millions without power during a major cold snap. While outlets like the Wall Street Journal and Fox News quickly tried to weaponize the crisis by blaming the renewable energy sector for the problems, deeper, more technical dives seem to indicate a lack of wind power output wasn't the underlying problem:

"While some early reports indicated that frozen wind turbines were causing significant shortfalls, 30GW is roughly equal to the entire state's wind capacity if every turbine is producing all the power it's rated for. Since wind in Texas generally tends to produce less during winter, there's no way that the grid operators would have planned for getting 30GW from wind generation; in fact, a chart at ERCOT indicates that wind is producing significantly more than forecast."

While it will obviously require a deeper investigation to flesh out the failure points, the real culprit appears to be entirely predictable and notably more banal. Namely, inconsistent regulatory oversight and a systemic underinvestment in essential infrastructure:

"Ed Hirs, an energy fellow in the Department of Economics at the University of Houston, blamed the failures on the state’s deregulated power system, which doesn’t provide power generators with the returns needed to invest in maintaining and improving power plants.

“The ERCOT grid has collapsed in exactly the same manner as the old Soviet Union,” said Hirs. “It limped along on underinvestment and neglect until it finally broke under predictable circumstances."

Texas' issues are somewhat unique by nature of the way the Texas utility grid is structured. It's isolated in part because of the state's unwillingness to be regulated by the federal government. And while deregulation efforts in the late nineties and early aughts were supposed to fix the state's power monopoly problems, the policy wound up being a bit of a mixed bag:

"from 2002 to 2013, the average household in deregulated areas paid a total of about $4,800 more than residents of cities — like Austin and San Antonio — served by just one municipal utility, or those served by electric cooperatives, the analysis said."

Either way, these problems could have been avoided. In fact, a decade-old report pointed out precisely how to avoid them via weatherization, investment, and greater emergency natural gas reserves. Many Texas utilities talked about how they were doing these things, but didn't actually follow through, the 2011 report politely noted:

"Although generators and gas producers reported having winterization procedures and practices in place, responses were generally reactive in their approach to winterization and preparedness."

And of course because gutting state and federal regulatory oversight is treated as a panacea on many fronts, government didn't do enough to ensure these companies were disaster-proofing their network. Going this extra mile also requires spending money on preparing for climate change, something that's hard to do when you've got millions of folks running around -- especially in Ted Cruz' state of Texas -- who don't believe in climate change. In fact as the crisis has become more and more pronounced, many political leaders did the exact opposite of responsible leadership, by turning infrastructure investment and competent regulatory oversight into another idiotic political trolling opportunity:

In addition to the power outages, millions of Texans lost access to voice services. While old copper phone lines still work, cable voice or VOIP services quickly fell apart -- in part because we stopped mandating back up batteries in many internet-based phone services. Meanwhile, cell phones don't work if there's no power going to your local tower, and a lack of backup power options at those sites:

After Hurricane Katrina, in 2008, the FCC passed rules mandating that cellular towers be upgraded to include battery backups or generators capable of delivering at least 8 hours of backup power, if not 24 or more. But the US cellular industry, you know, the one whose rates are some of the highest in the developed world, cried like a petulant child about the requirement and sued to scuttle the rules.

Backed by the then Bush White House, cellular carriers told anybody who'd listen that the requirement would create "a huge economic and bureaucratic burden" for the industry. A better approach, the industry proclaimed, would be to let the industry self-regulate and adhere to entirely voluntary guidelines, leaving it with the "flexibility" to adapt to problems as the industry saw fit. It didn't work, and as a result outages were equally dire during Hurricanes Katrina, Sandy, and Irma. And now again in Texas.

Infrastructure policy is often dismissed as droll wonkery and largely ignored... until a crisis. But these problems are made all the more frustrating because experts know what to do to prevent disruption and save lives... we just refuse to do it. Regardless, it's increasingly clear that letting powerful regional companies (be they in energy or telecom) self-regulate, while underinvesting all the while, is going to prove increasingly fatal as the climate increasingly destabilizes. The real question is: how many people are going to die before we actually learn something from the experience?

Filed Under: broadband, electricity, infrastructure, power, storms, texas, voip

A Few More Thoughts On The Total Deplatforming Of Parler & Infrastructure Content Moderation

from the it's-tricky dept

I've delayed writing deeper thoughts on the total deplatforming of Parler, in part because there was so much else happening (including some more timely posts about Parler's lawsuit regarding it), but more importantly because for years I've been calling for people to think more deeply about content moderation at the infrastructure layer, rather than at the edge. Because those issues are much more complicated than the usual content moderation debates.

And once again I'm going to make the mistake of offering a nuanced argument on the internet. I urge you to read through this entire post, resist any kneejerk responses, and consider the larger issues. In fact, when I started to write this post, I thought it was going to argue that the moves against Parler, while legal, were actually a mistake and something to be concerned about. But as I explored the arguments, I simply couldn't justify any of them. Upon inspection, they all fell apart. And so I think I'll return to my initial stance that the companies are free to make decisions here. There should be concern, however, when regulators and policymakers start talking about content moderation at the infrastructure layer.

The "too long, didn't read" version of this argument (and again, please try to understand the nuance) is that even though Parler is currently down, it's not due to a single company having total control over the market. There are alternatives. And while it appears that Parler is having difficulty finding any such alternative to work with it, that's the nature of a free market. If you are so toxic that companies don't want to do business with you, that's on you. Not them.

It is possible to feel somewhat conflicted over this. I initially felt uncomfortable with Amazon removing Parler from AWS hosting, effectively shutting down the service, and with Apple removing its app from the app store, effectively barring it from iPhones. In both cases, those seemed like very big guns that weren't narrowly targeted. I was less concerned about Google's similar removal, because that didn't block Parler from Android phones, since you don't have to go through Google to get on an Android phone. But (and this is important) I think all three moves are clearly legal and reasonable steps for the companies to take. As I explored each issue, I kept coming back to a simple point: the problems Parler is currently facing are due to its own actions and the unwillingness of companies to associate with an operation so toxic. That's the free market.

If Parler's situation was caused by government pressure or because there were no other options for the company, then I would be a lot more concerned. But that does not appear to be the case.

The internet infrastructure stack is represented in different ways, and there's no one definitive model. But an easy way to think of it is that there are "edge" providers -- the websites you interact with directly -- and then there's everything beneath them: the Content Delivery Networks (CDNs) that help route traffic, the hosting companies/data centers/cloud providers that host the actual content, the broadband/network/access providers, and the domain registers and registrars that help handle the naming and routing setup. And there are lots of other players in there as well, some (like advertising and certain communications providers) with elements on the edge and elements deeper in the stack.

But a key thing to understand is the level of granularity with which different players can moderate, and the overall impact their moderation can have. It's one thing for Twitter to remove a tweet. It's another thing for Comcast to say "you can't access the internet at all." The consequences of moderation get much more severe the deeper you go into the stack. In this case, AWS's only real option for Parler was to remove the entire service, because it couldn't just target the problematic content (of which there was quite a lot). As for the app stores, it's a tricky question. Are app stores infrastructure, or edge? Perhaps they are a little of both, but they had the same limited options: remove the app entirely, or leave it up with all its content intact.

For many years, we've talked about the risks of saying that players deeper in the infrastructure stack should be responsible for content moderation. I was concerned, back in 2014, when there was talk of putting liability on domain registrars if domains they had registered were used for websites that broke the law. There have been a few efforts to hold such players responsible as if they were the actual lawbreakers, and that obviously creates all sorts of problems, especially at the 1st Amendment level. As you move deeper into the stack, the moderation options look less like scalpels and more like sledgehammers that remove entire websites from existence.

Almost exactly a decade ago, in a situation that has some parallels to what's happened now, I highlighted concerns about Amazon deciding to deplatform Wikileaks in response to angry demands from then Senator Joe Lieberman. I found that to be highly problematic, and likely unconstitutional -- though Wikileaks, without a US presence, had little standing to challenge it at the time. My concern was less with Amazon's decision, and more with Lieberman's pressure.

But it's important to go back to first principles in thinking through these issues. It's quite clear that companies like Amazon, Apple, and Google have every legal right to remove services they don't want to associate with, and there are a ton of reasons why people and companies might not want to associate with Parler. But many people are concerned about the takedowns based on the idea that Parler might be "totally" deplatformed, and that one company saying "we don't want you here" could leave them with no other options. That's not so much a content moderation question, as a competition one.

If it's a competition question, then I don't see why Amazon's decision is really a problem either. AWS only has 32% marketshare. There are many other options out there -- including the Trump-friendly cloud services of Oracle, which promotes how easy it is to switch from AWS on its own website. Oracle's cloud already hosts Zoom (and now TikTok's US services). There's no reason they can't also host Parler.*

But, at least according to Parler, it has been having trouble finding an alternative that will host it. And on that front it's difficult to feel sympathy. Any business has to build relationships with other businesses to survive, and if no other businesses want to work with you, you might go out of business. Landlords might not want to rent to troublesome tenants. Fashion houses might choose not to buy from factories with exploitative labor practices. Businesses police each other's business practices all the time, and if you're so toxic that no one wants to touch you... at some point, maybe that's on you, Parler.

The situation with Apple and Google is slightly different, and again, there are lots of nuances to consider. With Apple, obviously, it is controlling access to its own hardware, the iPhone. And there's a reasonable argument to be made that Apple offers the complete package, and part of that deal is that you can only add apps through its app store. Apple has long argued that it does this to keep the phone secure, though it could raise some anti-competitive concerns as well. But Apple has banned plenty of apps in the past (including Parler competitor Gab). And that's part of the nature of iPhone ownership. And, really, there is a way to route around Apple's app store: you can still create web apps that will work on iOS without going through the store. This does limit functionality and the ability to reach deeper into the iPhone for certain features, but those are the tradeoffs.

With Google, it seems like there should be even less concern. Not only could Parler work as a web app, Google does allow you to sideload apps without using the Google Play store. So the limitation was simply that Google didn't want the app in its own store. Indeed, before Amazon took all of Parler down, the company was promoting its own APK to sideload on Android phones.

In the end, it's tough to argue that this is as worrisome as my initial gut reaction said. I am still concerned about content moderation when it reaches the infrastructure layer. I am quite concerned that people aren't thinking through the kind of governance questions raised by these sledgehammer-not-scalpel decisions. But when exploring each of the issues as it relates to Parler specifically, it's hard to find anything to be that directly concerned about. There are, mostly, alternatives available for Parler. And in the one area that there apparently aren't (cloud hosting) it seems to be less because AWS has market power, and more because lots of companies just don't want to associate with Parler.

And that is basically the free market telling Parler to get its act together.

* It's noteworthy that AWS customers can easily migrate to Oracle Cloud only because Oracle copied AWS's API without permission which, according to its own lawyers is copyright infringement. Never expect Oracle to not be hypocritical.

Filed Under: app stores, aws, cloud computing, content moderation, deplatforming, infrastructure, network stack, play store
Companies: amazon, apple, google, parler

The Slope Gets More Slippery As You Expect Content Moderation To Happen At The Infrastructure Layer

from the sliding,-sliding dept

What a week the first week of January has been! As democracy and its institutions were tested in the United States, so were the Internet and its actors.

Following the invasion of the Capitol Hill by protesters, social media started taking action in what appeared to be a ripple effect: first, Twitter permanently suspended the account of the President of the United States, while Facebook and Instagram blocked his account indefinitely and, at least, through the end of his term; Snapchat followed by cutting access to the President’s account, and Amazon’s video-streaming platform Twitch took a similar action; YouTube announced that it would tighten its election fraud misinformation policy in a way that it would allow them to take immediate action against the President in the case of him posting misleading or false information. In the meantime, Apple also announced that it would kick off Parler, the social network favored by conservatives and extremists, from its app store on the basis that it was promoting violence associated with the integrity of the US institutions.

It is the decision of Amazon, however, to kick off Parler from its web hosting service that I want to turn to. Let me first make clear that if you are Amazon, this decision makes total sense from a business and public relations perspective – why would anyone want to be associated with anything that even remotely hinges on extremism? The decision also falls within Amazon’s permissible scope given that, under its terms of service, Amazon reserves the right to terminate users from their networks at their sole discretion. Similarly, from a societal point of view, Amazon may be seen as upholding most peoples’ values. But, I want to offer another perspective here. What about the Internet? What sort of a message does Amazon’s decision send to the Internet and everyone who is watching?

There are several actors participating in the way a message – whether an email, cat video, voice call, or web page – travels through the Internet. Each one of them might be considered an “intermediary” in the transmission of the message. Examples of Internet infrastructure intermediaries include Content Delivery Networks (CDNs), cloud hosting services, domain name registries, and registrars. These infrastructure actors are responsible for a bunch of different things, from managing network infrastructure, to providing access to users, and ensuring the delivery of content. These – mostly – private sector companies provide investment as well as reliability and upkeep of the services we all use.

In the broadcasting world, a carrier also controls the content that is being broadcast; with the Internet, however, an actor responsible for the delivery of infrastructure services (e.g., an Internet Service Provider or a cloud hosting provider) is unlikely or not expected to be aware of the content of the message they are carrying. They simply do not care about the content; it is not their job to care. Their one and only responsibility is to relay packets on the Internet to other destinations. Even if, for the sake of the argument, they were to care, at the end of the day, they are not the producers of the content. Like postal and telephone services, they have the essential role of carrying the underlying message efficiently.

Over the past year, the role and responsibility of intermediaries has been placed under the policy microscope. The focus is currently on user-generated content platforms, including Facebook, Twitter and YouTube. In the United States, policy makers on both sides of the aisle have been considering anew the role of intermediaries in disseminating dis- and mis-information. Section 230, the law that has systematically, consistently and predictably shielded online platforms from liability over the content their users post, has been highly politicized and change now is almost inevitable. In Europe, after a year of intense debate, the newly released Digital Services Act has majorly upheld the long-standing intermediary liability regime, but, still, there are implementation details that could see some change (e.g, all of provisions on ‘trusted flaggers’).

It is the actions like the one that Amazon took against Parler, however, that go beyond issues of just speech and can set a precedent that could have an adverse effect on the Internet and its architecture. By denying cloud hosting services, Amazon is essentially taking Parler offline and denying its ability to operate, unless the platform can find another hosting service. This might be seen as a good thing, prima facie; at the end of the day, who wants such content to even exist, let alone circulate online? But, it does send a quite dangerous message: as infrastructure intermediaries can take action that cuts the problem from its root (i.e., getting a service completely offline), regulators might start looking at them to “police” the Internet. In such a scenario, infrastructure intermediaries would have to deploy content-blocking measures, including IP and protocol-based blocking, deep packet inspection (i.e., viewing content of “packets” as they move across the network), and URL and DNS-based blocking. Such measures ‘over-block’, imposing collateral damage on legal content and communications. They also interfere with the functioning of critical Internet systems, including the DNS, and compromise Internet security, integrity, and performance.

What Amazon did is not unprecedented. In 2017, Cloudflare took a similar action against the Daily Stormer website when it stopped answering DNS requests for their sites. At the time, Cloudflare said: “The rules and responsibilities for each of the organizations [participating in Internet] in regulating content are and should be different.” A few days later, in an op-ed, published at the Wall Street Journal, Cloudflare’s CEO, Matthew Prince said: “I helped kick a group of neo-Nazis off the internet last week, but since then I’ve wondered whether I made the right decision.[…] Did we meet the standard of due process in this case? I worry we didn’t. And at some level I’m not sure we ever could. It doesn’t sit right to have a private company, invisible but ubiquitous, making editorial decisions about what can and cannot be online. The pre-internet analogy would be if Ma Bell listened in on phone calls and could terminate your line if it didn’t like what you were talking about.”

Most likely Amazon faced the same dilemma; or, it might have not. One thing, however, is certain: so far, none of these actors appears to be considering the Internet and how some of their actions may affect its future and the way we all may end up experiencing it. It is becoming increasingly important that we start looking into the salient, yet extremely significant, differences between moderation happening by user-generated content platforms as opposed to moderation happening by infrastructure providers.

It is about time we make an attempt to understand how the Internet works. From where I am sitting, this past year has been less lonely and semi-normal because of the Internet. I want it to continue to function in a way that is effective; I want to continue seeing the networks interconnecting and infrastructure providers focusing on what they are supposed to be focusing on: providing reliable and consistent infrastructure services.

It is about time we show the Internet we care!

Dr. Konstantinos Komaitis is the Senior Director, Policy Strategy and Development at the Internet Society.

Filed Under: aws, content moderation, infrastructure, slippery slope
Companies: amazon, parler

Security Researcher Reveals Solarwinds' Update Server Was 'Secured' With The Password 'solarwinds123'

from the [checks-luggage-combination] dept

As was noted here earlier, up to 18,000 customers of globally-dominant network infrastructure vendor SolarWinds may have been compromised by malicious hackers. The hackers -- presumed to be operating on behalf of the Russian government -- deployed tainted updates (served up by SolarWinds) that gave them backdoors to snoop on internal communications and exfiltrate sensitive data.

The attack was so widespread and potentially catastrophic, the DHS's cyber wing issued an emergency directive that stated the only way to mitigate damage was to airgap devices and uninstall affected Orion software. Meanwhile, SolarWinds filed an update with the SEC detailing the extent of the damage. It was limited, but only if you consider 18-33,000 potential infections "limited." It's only a small percentage because Solarwinds's customer base is so large. The company boasts 300,000 customers, among them several government agencies and all five branches of the military. (It's not boasting much these days. It has memory-holed its "Customer" page during this trying time.)

Unfortunately, the directive from CISA was delivered a bit too late. CISA itself was compromised by the hack, something acknowledged by the DHS less than 24 hours after its dire directive was issued.

The fallout from this hacking -- which may have begun as early as March of this year -- will continue for a long, long time. But this latest news -- delivered by Zack Whittaker -- adds another layer of irony to the ongoing debacle. Orion is Solarwinds' one-stop shop for IT software. It promises to secure customers' IT infrastructure by bundling in the company's network security products.

No doubt the company claims to take security seriously. But while users are being subjected to password requirements that demand them to utilize most of the alphabet and multiple shift key presses, internal security isn't nearly as restrictive. Here's the "OMFG are you goddamn kidding me" news via Reuters, which first broke the news of the malicious hacking.

Security researcher Vinoth Kumar told Reuters that, last year, he alerted the company that anyone could access SolarWinds’ update server by using the password “solarwinds123”.

All five branches of the military. The NSA. The IRS. The USPS. DHS. The Treasury Department. Nearly every Fortune 500 company. All ten of the top ten telcos. The list goes on and on. And with this access, attackers could move laterally, using compromised credentials to eavesdrop on mutuals of targeted entities. And all of this "secured" by a password so simple an idiot could have created it.

We're fucked. And we're fucked by people making far more money than we are who take our security far less seriously than we do. Say what you will about the security ambivalence of the general public, but it's the "experts" who endanger us with lax security measures who do the most damage. If Joe Blow fails to secure his email account, he's probably only going to hurt himself. When a multinational vendor can't be bothered to gin up a decent password, entire government agencies become a plaything for malicious hackers.

Filed Under: dhs, hackers, infrastructure, passwords, security
Companies: solarwinds