Policy by the Numbers: Security

Information sharing for more efficient network utilization and management

Friday, September 18, 2015

Andreas Terzis is a Software Engineer at Google. This post originally appeared on the Google Research Blog.As Internet traffic has grown and changed, Google and other content and application providers have worked cooperatively with Internet service providers (ISPs) so that services can be delivered quickly, efficiently and cost-effectively. For example, rather than content having to traverse a long distance and many different networks to reach an Internet access provider's network, a content provider might store (cache) the data close by and interconnect ("peer ) directly with the access provider. Google has invested billions of dollars in the network and infrastructure necessary to bring our services as close to your Internet access provider's front door as possible, for free—which both reduces ISPs' costs and improves the user experience.Content and application providers can also tune their services for congested and/or lower bandwidth environments. For instance, YouTube detects how smoothly a video is playing and adjusts the quality to account for temporary fluctuations in bandwidth or congestion. In the Google Video Quality Report, we transparently reveal the speeds YouTube is experiencing on different networks.As more of Internet traffic becomes encrypted, some network operators have expressed concern about the effect encryption might have on their ability to manage their networks. We don't think there has to be a trade-off here—there are ways to do effective network management of encrypted traffic today, and, through further cooperation between content and application providers and ISPs, we believe this could be made easier while still respecting encryption.To spur discussion and collaboration on this front, we recently submitted a paper to a workshop organized by the Internet Architecture Board outlining some ideas. We advocate for a model where ISPs selectively share network state to content and applications providers, enabling them to adapt to available network resources.For example, we recently proposed to the Internet Engineering Task Force the concept of Throughput Guidance (TG), whereby mobile network operators could share information about the throughput of a radio downlink. Preliminary field tests in a production LTE network showed that TG reduces YouTube join latency, defined as the amount of time until the video starts playing, by 8% on average, rebuffering time by 20% on average, and rebuffer count by 2% on average. In addition to improving quality of experience for users, this mechanism improves the utilization of providers’ networks. Encryption of traffic would have no impact on the efficacy of this approach; it works equally well with encrypted and unencrypted traffic.Throughput Guidance is one possible solution and many questions remain unanswered. It's still relatively early days in our exploration of this and the other measures in our short paper, and we're looking forward to getting feedback and collaborating with network operators and others.

The Price of Data Localization

Wednesday, June 24, 2015

Forced data localization laws require data be stored in a specific country, rather than in a distributed “cloud” spread across global networks. As we see the development of more cloud-based products and services, these laws run counter to the direction of technological innovation.In fact, many studies have shown that forced data localization could negatively impact privacy as well as security and integrity of data. Other studies, like one by the European Centre for International Political Economy, have shown that data localization has negative impacts on the economies that require it.Adding to the mounting evidence against data localization, new research by Leviathan Security Group shows the harms at a smaller scale: direct cost of forced data localization to local businesses, rather than whole economies. The costs can be pretty dramatic: ...[W]e find that for many countries that are considering or have considered forced data localization laws, local companies would be required to pay 30-60% more for their computing needs than if they could go outside the country's borders.Leviathan looked at the major public cloud providers who allow on-demand self-service provisioning through their infrastructure. The group includes Amazon Web Services, DigitalOcean, Google Compute Engine, HP Public Cloud, Linode, Microsoft Azure, and Rackspace Cloud Servers. Consumers in affected countries might be able to find other cloud providers, but many of these providers don't allow self-service provisioning, instead requiring a confidentiality agreement, a full business-to-business agreement, or other paperwork. In many countries, cloud providers won't be available at all, so businesses must make major capital investments in computer hardware and infrastructure, rather than being able to take advantage of flexible and cost-saving per-use models.Leviathan created an interactive visualization that allows anyone to compare all the cloud vendors by location and price around the world. You can check out this study and the visualization, along with their previous work on cloud security, at valueofcloudsecurity.com.

New research on security and cloud computing

Friday, February 13, 2015

Ross Schulman is a Policy Manager at GoogleEarlier this week, Leviathan Security Group released three white papers that explore cybersecurity in cloud computing versus local storage. Each paper examines a different aspect of security and storage, including availability, cost, and talent acquisition. In general, Leviathan finds that cloud solutions are generally more secure, resilient, and redundant than local equivalents.A few data highlights:

Cloud services provide much better resiliency and redundancy than local services in the face of disasters of all sizes—from small transformer explosions that affect 30,000 users to superstorms the size of Thaiphoon Haiyan. This means quicker data recovery and the ability to keep communications infrastructure like email up and running, which is essential in a post-disaster environment.

Even with increasing emphasis on STEM education and growth of computer science programs, organizations—private and public—will not be able to acquire all of the talent necessary to satisfy the demands of local storage infrastructure. For example, there are currently over a million open security positions worldwide, but beginning in 2017, all of the GCHQ-led cybersecurity programs together will graduate just 66 PhD's per year.

Of note for numbers lovers, the paper titled “Value of Cloud Security: Vulnerability” lays out a thorough analysis of storage needs for companies of different sizes and compares cost of cloud versus local storage solutions. They find that cloud solutions are cheaper for small organizations in the near term and provide better security because of the expertise, which is concentrated in large organizations.

So what do these findings mean from a public policy point of view? Many countries, including Brazil and Russia, have proposed laws requiring that companies keep the data of that country’s users within national borders. This idea, known as “data localization,” purports to keep citizen users safer and out of the hands of spying governments and hackers.However, forced data localization prevents companies, governments, and organizations from realizing many of the benefits afforded by cloud services. For example, if a local data center is impacted by a natural disaster, that data is not replicated elsewhere and thus is lost. And given the shortage of security expertise, there’s simply no way that every organization’s security infrastructure for locally stored data can keep up with the state of the art. Finally, preventing small enterprises like startups from using cloud services means that they must take on additional costs in terms of talent and infrastructure, and will likely end up with systems that are less secure than what cloud infrastructure would provide. In the end, data localization reduces opportunities, results in weaker security, and, in some instances, compromises the availability of data.To learn more about data localization proposals around the world, check out Anupam Chander's paper, "Breaking the Web: Data Localization vs. the Global Internet."

Risks of the open Internet

Tuesday, May 15, 2012

In February the FTC published their yearly Consumer Sentinel Network report. The report examines the various kinds of complaints the FTC gets from consumers on the Internet. One way to think about the report is that it provides us with a key to prioritize actions—government, academia, industry, etc.—in response to risks on the open internet. The complaints included in the Sentinel Network—7 million of them from the period 2007-2011—give a helpful portrait of the online risk landscape.First, we learn that the Internet, with its vast offering, still garners fewer consumer complaints than the old telephone network. For example, in the same period internet complaints were collected, the Do Not Call Registry registered 9 million complaints. Second, the composition of the complaints helps us assess the priorities of consumers on the Internet. 55% of the complaints are about fraud. A total of 1.5 billion USD was reported to have been lost in Internet-related fraud, by the 43% of consumers that reported a loss. If all consumers who experienced a loss had reported fraud, the number could be at least double that figure. These are not small amounts: the median reported loss was around 500 USD, and the average was above 1000 USD. (For comparison it would be interesting to know what average amounts are for offline fraud). Identity theft trails fraud with 15% of complains. Together, these two concerns make up 66% of the complaints in the CSN, suggesting that government resources should be concentrated on these two issues.Third, in 2011, the CSN received 1.8 million complaints in the US. The US had 240 million internet users in 2010, indicating that 0.75% of Internet users reported to the CSN. This suggests that for the vast majority of US Internet users, their 2011 internet experience was a safe one. While this is good news, the 1.5 billion USD lost in fraud is nothing to sneeze at, however, and should be taken very seriously.Fourth, the web at large is not the primary channel for online fraud. Instead, it’s email: of the 60% of complainants that reported how they were first contacted, 43% said email. Only 13% had their initial contact through a website. The real dangers are not the web sites you visit, then, but rather unseemly messages in your inbox. Luckily, many sites have sprung up that allow you to check if the offer that seems to be too good to be true really is. The internet has its share of entrepreneurs and parasites, making trust online extremely important. The reason the Internet can carry e-commerce worth more than 180 Bn USD in the US alone is that consumers trust the network. Finding ways to inform and empower people to have trustworthy relationships matters. Given the findings of the CSN report, any agenda for improving trust should start with addressing email fraud and identity theft, ideally through research that includes crowdsourced data gathering. Eric Davis is a Policy Manager at Google.

2012: Driving down the information superhighway, in reverse

Wednesday, April 4, 2012

Metaphors comparing the Internet to an information superhighway were common in the 1990s. They’ve since been replaced by other terms and abbreviations, such as the net, but this older comparison to a freeway is still applicable. In particular, digital citizens require a type of “driver training” program to be able to understand the cyber rules of the road and navigate to the online content that’s most important and compelling to them. Without knowing how the Net can change their world, users may not fully benefit from or value becoming digital citizens.

In America, it’s common for new automobile drivers to pass a driving instruction test with both a technical component teaching laws and procedures and, for all new drivers, a practical driving test demonstrating their ability to drive a car around town.

Similarly, digital citizens that learn the “technical” rules of the road are able to access the Net without revealing private information, avoiding unsafe practices and without leaving digital footprints that could adversely impact their future job prospects. ConnectSafely, Enough is Enough, iKeepSafe, Wired Kids, the Family Online Safety Institute, GetNetWise, the National Consumers League, the National Center for Missing and Exploited Children, the National Cyber Security Alliance and Common Sense Media are just some of the important safety organizations that help organizations like mine teach non-users how to pass some of the technical parts of their online drivers training program and safely traverse the Net.

Unfortunately, some digital inclusion providers don’t spend adequate time on the “practical” parts—asking non-users what’s important to them in the “real world” so they can learn about the related content that is online and will make the Net relevant to them.   According to the Pew Internet & American Life Project, most people that remain offline do not believe that the Internet is sufficiently relevant to justify the time, money and energy for them to become digitally literate. Most non-users haven’t been shown a compelling and personal value proposition, and without one, the Net is much less compelling and useful to them. Last year between May 2010 and August 2011, Pew reported that the number of adult Americans that don’t use the Internet increased from 21% to 22%! Because many users don’t have a personal value proposition that makes the Net important and useful, they exited the highway.

Culturally respectful grassroots initiatives with a national direction best leverage the synergies within the colorful mosaic of communities that comprise America. Net Literacy is a long-time proponent of tapping into the tens of millions of digital natives that attend high schools and colleges to form a Digital Literacy Corps that helps to reduce the digital divide. In 2009, the FCC recommended the creation of a Digital Literacy Corps in the National Broadband Plan presented to Congress. One non-user at a time, a Digital Literacy Corps could help individuals discover their personal value proposition and why they should accelerate to the onramp of the information superhighway.

Posted by Daniel Kent, Founder of Net Literacy

Protecting personal data through encryption is not enough

Monday, December 12, 2011

Everyone worries about companies losing their customers’ data. Consumers are upset when their private data is exposed, and rightly so. Firms fret about the potential legal consequences and costs of security breaches, which on average decrease their market capitalization by 2.1%. Policymakers feel they should do something to limit this market failure, but what?

One solution that looks like a one-size-fits-all easy fix is encrypting consumer data. In theory, encryption should be foolproof because it means data cannot be read without an encryption key. Many laws currently offer firms “carrots” to use encryption. For example, firms do not have to send out costly notifications to consumers about lost data if the lost data was encrypted.

My research (also found on SSRN) with Amalia Miller of the University of Virginia and RAND investigates how effective encryption regulation has been in reducing the risk of data breach. We focus on healthcare because there is data on encryption software adoption and publicized data breaches in that sector, and because medical data is especially personal.

Surprisingly, we find empirical evidence that when hospitals adopt encryption software, it does not reduce instances of publicized data loss. Instead, adopting encryption software makes publicized data losses more likely, particularly instances of data loss due to negligence or internal fraud. The result is a moral hazard: firms using encryption software are more careless about controlling internal access to encrypted data and their employees are more careless about computer equipment containing encrypted data. Losing a computer with encrypted data might matter a lot, especially since employees often keep the key with the encrypted data or lose the password, compromising the encryption.

We therefore recommend that encryption software is not the answer when it is the only security measure a firm takes. Instead, firms should use a broad set of practices, including training and awareness programs, manual procedures and controls, and strong identity and access-management deployments. The fact that encryption software adoption is associated with an increase in fraud may suggest that firms relying on encryption software often do not also deploy effective data access controls.

Our findings matter for policymakers because safe harbors for companies that encrypt their data are at the heart of the recently proposed federal bills governing the security of data. Encryption only works as well as the firm's ability to protect the password or key. By promoting this seemingly easy technological solution in isolation, while failing to promote additional human-based processes that complement encryption's effectiveness, giving a safe harbor to encrypted data may not have the intended effect.

posted by Catherine Tucker, Douglas Drane Career Development Professor in IT and Management and Associate Professor of Marketing at MIT Sloan School of Management