A possible future

Currently there is a lot of legislation on the books or in progress designed to curtail the free flow of information and services across the internet. Or if not curtail, greatly enhance the ability of law enforcement to snoop on said flow of information and services. Private companies have been doing some of this for some time, but in general they don't have the authority (implicit or explicit) to do things like a running packet-sniff on customer network traffic.

The drive behind this legislation has been the rather high-brow goal of Protect The Children. Pedophiles are horrific in what they do, and they need to be stopped at all costs. The damage even one Pedophile can cause to children is irrevocable, so we'd best do our utmost to stop them from doing what they do.

A cynic's view of this would note that the Pedophile scare showed up after the Terrorism scare stopped working to drive privacy reducing legislation on the net. 9/11 did drive some items, notably the Patriot Act, but the real meat of the electronic surveillance measures have been driven in recent years by the drive to Protect The Children.

Arguably the first legislation to directly address children and the internet was the the Communications Decency Act. It did so by attempting to restrict that great engine of internet economic activity, porn. Pornography and other indecent material had been restricted by the FCC to the wee hours of the night broadcast and back-alley cable channels, with print restrictions varying by state. The Internet had been unregulated to this point, which Congress attempted to stop. The reasons for all of the regulations has been to Protect The Children, but not specifically from pedophiles, just early exposure to pulchritude.

The second attempt, the Child Online Protection Act, specifically addressed children and was put on hold by the Supreme Court pretty much the day it took effect. The ultimate status of COPA is still in legal limbo, eight years after its passage. The fact remains that this attempt to restrict porn on the internet has yet to pass.

But there are other areas that can be addressed. Recently a ruling was passed down that Internet Service Providers need to provide easy access to law enforcement to packet sniff their own networks, the same way that the phone companies already have to. The phone company requirements are addressed by decades old laws regulating wiretaps. The new ruling judges that the same wiretap authority extends to internet traffic. The reason cited for extending this authority was in the beginning to fight Terrorism, but has since then morphed into the fight to Protect The Children.

Higher Education is not exempt from this. Higher Ed networks are unique. They're not the private functions that corporate networks are, but they're not true ISPs either. Yet with student dorms using the educational network as their sole source of internet traffic, the ruling came down that Higher Ed networks had to provide the same kind of access as ISPs did. After a court-order, of course.

Also in the news lately has been a proposed requirement for ISPs to retain service records for two years. This is so that pedophile investigations have enough electronic logs to be able to build cases. The fact that a wide range of other illegal activity can be monitored the same way is just a happy side-effect.

All of which leads to an interesting, "if this goes on," sort of idea. There may come a time when Congress actually manages to balkanize the Internet into child-safe and unsafe zones. Perhaps regulated by some form of 'internet license' achievable on attainment of majority, like a Selective Service Card. The impacts to free speech are astounding, which is why such legislation hasn't gone anywhere so far. But if Congress can craft a solution to the problem of not restricting adult free speech while at the same time very sharply curtailing minor free speech, it could actually take off.

Several Supreme Court cases over the last several decades have shown that the 'bill of rights' only applies to adults, and that several of the rights do not apply to minors. The right to freedom of speech is one of them. This is how schools can get away with restricting the contents of student newspapers, and one of the driving justifications behind restricting 'sexually inappropriate' material from getting into the hands of minors. This is also the main reason the earlier attempts to regulate porn on the internet have been struck down, since doing this sort of regulation is a lot harder in the virtual world than it is in the physical world.

The regulation of the kid-safe domain would be what makes or breaks such a proposal. Once you have your 'adult card' you can gain access to the unrestricted internet, yet before you have that card you're stuck with the Disney/nickelodeon version of the internet. Such areas might arguably have to be 'kids only' due to the possibility of pedopiles coming into the areas to do what they do. This is very complex stuff, but it could happen given sufficient technology and political will.

Such kids-only areas would have two major liabilities incumbent on them. First would be records retention, since we want to be able to punish pedophiles who manage to gain entry. Second would be HIPPA-like privacy standards, since gaining access to the identities of children is a b-i-g no-no. The third area is of unknown liability but would be present, maintaining 'certification' of kid-safe.

Social networking sites such as MySpace, Livejournal, and Facebook would be not included in such things. Though perhaps myspace.kids could survive, so long as there was complete technical separation between the myspace that the unwashed, pulcritudinous masses use and the one that the pure, innocent children use. E-mail and IM would be very challenging areas, though, as there is legitimate communication between minors and adults that occur over those mediums.

Oh yes, it could happen. Some legislators already dream of such an environment. But there are serious technical problems in the way right now. Problems that may not be serious in a few years.

Microsoft security center

There has been much ado lately over the Microsoft Security Center in their new operating system, Vista. The Security Center was introduced in service pack 2 for Windows XP, so it has been around a while. Microsoft intends to take the Security Center to the next step in Vista as part of their Secure Computing initiative.

I applaud this. Windows is suffering from the double whammy of immense popularity and a historical code-base that focused on features first and security a distant third. Windows is famously insecure because of the historical code and not so historical software development practices. Windows Vista is several years late thanks to rethinks on the part of Microsoft to try and get it right this time.

They're still a long ways off, and they admit this. Their ultimate goal is the operating system after Vista, with Vista being the transitional phase to the secure platform. In my opinion it'll probably 2012 before we see that operating system and a lot can change in the mean time.

Microsoft is facing an exceedingly difficult challenge right now. They have a historical product that sets expectations for how things will operate. They have an immense range of software developed for the Windows platform as it exists right now that needs to run reasonably well on Vista when it comes out. They need to make Vista much more secure than any of the previous Windows. They need to allow the end-user to do things that they've become accustomed to with Windows. Most of all, no one in the history of computing as done all of that before so they are breaking new ground.

The Security Center made the news twice in the past week. First some European Union commission told Microsoft that they need to de-bundle the Security Center to allow European security companies to continue to offer products that fill that niche. Second, Symantec and McAfee have issued statements, likely inspired by the EU statement, to identical effect. I expect the big OEMs, Dell, HP, and Gateway, to also issue statements to that effect for economic reasons. The OEMs because they can get a kick back from Symantec or Dell if they install their product instead of Security Center on PC's they ship to customers; all with obligatory free trial periods of 60/90/120 days.

The reason these companies exist in the first place is because past versions of Windows have been so horribly broken. Now that Microsoft is making the attempt to fix that, these companies are crying 'Monopoly!' as a major hunk of their business is (potentially) lost due to Microsoft's not-very-sudden adoption of the 'security first' principle. This is a good citizen practice that we need to encourage, not the same thing as bundling Media Player with Windows. Security is not a value-add like Media Player, it's a base expectation like being able to access a newly installed hard-drive.

Forcing Microsoft to pry open security just to protect companies that have grown up to fill that niche is protectionism pure and simple. I expect that from the EU. I expect that from McAfee and Symantec thanks to pure business interest and potential loss of business. A very expected reaction of private capitalist enterprise. They're both wrong from ethical standpoints.

Microsoft is not going to stop viruses and malware with Vista. Any operating system that commands over 80% of market-share will face that problem. If Macintosh got that popular, Mac would be the #1 target of viruses and malware, smug advertising not withstanding. If Linux got that popular you'd see the same thing. Microsoft faces this problem largely due to their market position, and it's just the poor engineering that went into previous Windows versions that makes such grey and black market activity easier. And not coincidentally, drives significant economic activity to plug the holes the bad-ware writers exploit.

One of the most frequently cited reasons for why Microsoft shouldn't be mandating security like this, besides the protectionist ones of course, is because their history is so bad. Microsoft has spent a lot of time trying to get it right, and we haven't had a chance to see what their version of 'get it right' looks like. It won't be perfect, they've said as much themselves. They're still working on the usability/security problem, as the betas of Vista have proven. SP1 of Vista will probably fix a whole range of user-interface usability problems that real-world testing will illuminate once Vista ships and everyone from mom, to small business, to IBM try to deploy it in some way. This move will be as dramatic a change as the move from Windows 3.1 to Windows 95 was over a decade ago.

Microsoft needs to do this. Claims of economic expediency for them not taking such a hard line on security are from people who haven't taken a solid look at the whole picture. The aptly named, 'Broken Window Fallacy,' covers this quite well. All the resources spent by third parties to keep Windows secure is economic inefficiency. That's industry wasted that could have been used elsewhere. Microsoft doing it right from the first means a drag on innovation in the IT industry can be removed. That benefits us all.