Most government is in practice pretty technocratic and slow. Effective law enforcement as an example is complex and technical, and the policies that have a prima facia appeal are often ineffective or even counterproductive. Prohibition in the United States is an example along those lines. Real world government is usually full of imperfect compromises, but on average they work better than the alternative.

Governing of the Internet is also pretty technocratic. If you are not conversant with the technology and lingo you are not regarded as capable of forming a useful opinion. Ignorant policymakers with a new wheeze are a positive liability. Internet technocrats, however, have to learn to appreciate imperfect compromises, and that the general public won’t always agree with them, or behave as expected.

In terms of governance, the Internet has in many ways reflected the evolution of conventional politics over centuries. Vint Cerf and Sir Tim Berners-Lee are both in their way somewhat reminiscent of King Alfred the Great. They have brought people together and inspired trust in their viewpoints in a landscape of tribalism. Yet in many areas the Internet is coming to resemble the mercantile city-states of the 14th Century that are closely associated with Machiavelli. The powerful and wealthy can cynically manipulate the innocent and idealistic; motives and agendas are obscured. The harsh reality is that the Internet will never be the Libertarian utopia that some hope for, but a new domain for the same old political realities.

While there is a lot to learn from history, there are some important and obvious attributes of the Internet that are new and problematic for traditional approaches to government. The Internet was designed to circumvent attempts to block it; the original intention was to build resilience in the face of physical attack, but it can be just as effective against state intervention for political reasons. The Internet can adapt overnight to interventions that take years to develop. Borders exist, but can be passed in milliseconds with little in the way of controls. While routine state checks take anything from minutes to months in the offline world, anything that routinely takes more than a few seconds on the Internet is impractical. The view that governing any behaviour on the Internet is simply too hard, or that it has too many negative consequences, has some merit.

There is one simple driver that will force change. When the balance of economic, social and political activity takes place through the Internet, the general population will expect and demand that they have their say in how it is run. The Internet is embodied by physical devices interacting with real people inside the jurisdictions of real countries. The idea that the Internet is another plane of existence beyond the law is delusional, and will not be a reason for inaction accepted by the electorate. People will demand action from their political structures, and their politicians will act.

Ultimately that means there can be no division between the mechanisms in how a country – and indeed the global community – is run offline and online. In the interim, the collisions between online and offline governance and government risks chaos and suffering as political systems adapt. Those who make practical policy offline and online need to become expert in each others trade in order to minimise that chaos.

The IGF is therefore of great importance as the place where these groups meet and communicate. By building understanding, learning from good practice and generally coming to terms with the way the Internet is changing global society – and how global society is changing the Internet – the IGF can accelerate positive change. The UK delegation brings with them many examples that provide evidence that there can be a positive future for Internet Governance. They also bring with them the belief and hope that our conventional political systems can learn and adapt to the new challenges of the Internet. That is vital, as to quote a former Prime Minister of the UK, “There is no alternative”.

Two recent official reports - Digital Britain; and Ofcom’s Communications Sector Review - have suggested that Britain is at a tipping point in respect of the internet. To date, it is suggested, the internet has generally supplemented offline behaviour. Now, it is suggested, it is becoming the norm. In many areas of life, most of us are beginning to do things online by preference and by habit.   If so, the digital has not just entered the mainstream; it has or is about to become the mainstream.

This tipping point in internet behaviour has, of course, long been predicted and advocated by most people who are concerned with internet policy, by much of business and by much of government.  In spite of acknowledged problems - spam, child protection, online fraud - the internet is generally regarded by policymakers as highly beneficial in delivering desired social outcomes; as, one might say, “morally positive”.

This attitude towards the transformation of society by information technology is rather new.  For most of the 20th century, at least in popular culture, the potential of information technology was more often felt to be alarming than progressive, in particular because it was expected to increase the power of the state versus the citizen.  It is only since the advent of mass internet that dystopian visions of the future like 1984, Brave NewWorld and Blade Runner have been succeeded by enthusiasm for technologies that are seen as personally empowering.

Impact on society

Although the tipping point described here has long been predicted, however, there is still very little policy analysis of the impact of the internet on society as a whole.  Most of what is written about the internet’s impact on society still concerns the positive impact that policymakers expect it to have on specific dimensions of behaviour in single sectors (education, for example, or online democracy) or the need for mitigation of known negative impacts (child pornography, fraud and other internet crime).  

As a result, we have a fairly good idea of the way in which the internet may change specific aspects of society.  But we have only very speculative ideas of how the displacement of offline by online ways of doing things will change the way in which society as a whole is organised - in terms of employment, personal relationships, participation in democratic governance - and just as little understanding of how the life experience of particular social groups is likely to be affected.  This needs to change.  A few foresight reports and speculative thinking by advocates of change will not enable us to maximise the benefits of the “internet as norm”, or to anticipate its problems.

I will raise three examples of why this is important - concerned with law enforcement, social exclusion and governance.

Law enforcement

One of the principal drivers for personal use of the internet has been the opportunity it provides to bypass the constraints of existing commerce, law and social norms.  On the one hand, this has enabled the success of businesses that offer a much wider choice of goods to customers, irrespective of location, than they could previously obtain - businesses such as Amazon and iTunes, for example.  On the other, the opportunity to bypass legal constraints and social norms has enabled much more widespread consumption of pornography and gambling, and has disrupted established international tax and intellectual property regimes.  Even though the law does not distinguish between online and offline behaviour in these contexts, as is usually the case, its enforcement in these areas has perforce become asymmetrical.  Widespread experience of this kind of behavioural bypass has changed attitudes concerning law and social norms, as importantly – though less visibly – as it has changed commercial relationships between customers and the suppliers of particular types of goods.

Social exclusion

Providing services online has generally - and rightly - been seen as highly positive for the majority of citizens, offering more choice, more convenience and often lower costs in accessing both commercial goods and public services. There are often associated cost savings for businesses and providers of public services.  As a result, putting services online and extending online access to those services have been policy priorities.  

Some service providers, however, including banks and some government departments, have sought to go further, and explicitly to push customers online by reducing the availability of offline provision. Yet, as recent research for the Department of Communities and Local Government (Digital Inclusion: An Analysis of Social Disadvantage and the Information Society) has made clear, there is a significant segment of the population which rejects online service provision, and which is therefore unlikely to make use of online services even where these offer substantial benefits.  This segment does not seem susceptible to advocacy concerning the benefits of online services.  It is also significantly correlated with social groups that suffer other forms of social exclusion.  Providing services primarily or only online may further disadvantage highly disadvantaged individuals.  As the internet becomes the norm, our focus needs to shift from ensuring that online services are available to all towards ensuring that those who wish to access services offline still have the right and means to do so.

Governance

The term “internet governance” comprises both “narrow” governance of the internet itself (standard-setting, coordination and administration of IP addresses, domain names, etc.) and “broad” governance of the interface between the internet and other areas of public policy.  The latter has become increasingly important as the internet has extended its reach, so that much of the internet policy debate that takes place today concerns issues such as access, security and rights rather than the technicalities that keep the internet in play.

Internet governance entities are proud of their multistakeholder character - that is, of the involvement, on relatively equal terms, of governments, the private sector, “civil society” and internet technical specialists.  This is rightly seen as enabling a different style of decision-making, which can be more responsive to different groups’ requirements in a rapidly changing technological environment.  However, the quality of interface between internet governance and mainstream governance in other fields is often weak.  Policies concerning how to deal with the internet’s impact or potential impact on (e.g.) civil rights or the environment, the judicial system or social welfare, need to be led not from the internet but from the mainstream policy area concerned.  Building effective dialogue between these mainstream areas and internet governance has proved difficult.  And, although internet governance bodies and debates are multistakeholder in character, some key stakeholder communities - notably private sector users of the internet, and mainstream civil society organisations - play very little part in them.  We need much more engagement from them if we are to maximise the gains and minimise the problems resulting from this “tipping point”.

There has been a lot of talk over the past ten years about how the internet will change society.  There has been much less talk of how society will change the internet.  There should be more.

Engaging young people in the IGF process is critically important as it is these young people who are at the forefront of using and adopting new Internet technologies.  Children and young people have fully embraced technologies in a way that many adults have failed to do.  For them, the Internet is a norm.  It is a major part of their everyday lives, and the topics discussed at the IGF do affect them, even if the language of engagement that they use is different from the established pillars of discussion at the IGF.

In all of Childnet’s work we have sought and continue to put children and young people at the heart of what we do. Working directly with children and young people, and learning from their experience of interacting with technology, helps us to ensure that the advice we share with them and the messages that we communicate from them to government and others is credible and relevant.

To engage more young people in the IGF we have aimed to make the concepts of the IGF accessible and interesting to young people and to challenge them to think about how openness, access, security, diversity and the online rights agenda are relevant to their lives and what action they might want to consider taking as a result.  We commissioned a film (http://www.youtube.com/watch?v=SV9QrytuXDE) introducing the IGF and the topics for discussion, and have utilised some of the key online media that young people are using including social networking sites to promote the film, to ask further questions and to create multiple opportunities for young people to take part in the discussion. 

The film was designed to be provocative and to be a starting point for discussions.   Early on it was evident in the responses from young people, that while the topics of discussion are very pertinent to their lives, their understanding of them cannot be pigeonholed into a neat framework of discussion.  We have encountered a range of responses and opinions, but have been struck by the overwhelming positivity from young people about being asked their opinions on a process that will most likely affect their future and their future use of technology.  As one young person put it, “it is important for us to have our say about the net because we use it the most and sometimes know more about it than adults do!”

We have talked about rights and Internet rights as a key theme during our discussions and conversations, and alongside this the notion of responsibility.  One of the things that has been revealed through the project is that young people are faced with a conundrum; they have a desire for ‘automatic’ safety which often sits at odds with their desire for freedom and to be able to do whatever they want online.  Engaging with young people on this topic has enabled them to think about their conduct online, their use of these technologies and what they want to see happen to the Internet in the future.  

In making what young people have to say about Internet Governance count, the project has not just been about the process of engaging young people on this topic.  Including the voice of youth at the IGF is not as simple as asking them questions and then considering that the task is complete.  It is vitally important to continue to include young people in the IGF process moving forwards, incorporating their experience and thoughts in the discussions.  The benefits of increased participation will be an increased sense of ownership and interest in this area, which in turn has the potential to positively impact on the online conduct of many young people as they gain a greater sense of awareness about their responsibilities and the difference that they can make.  The amplification of the voice of youth through the Youth IGF Project is just the tip of the iceberg, and there remains a need to engage with more young people in the UK and internationally on Internet Governance and what it means to them.   

We will be running a joint session with Eurim at the upcoming Parliament and the Internet conference to share some of the findings from the Youth IGF Project and to bring industry, parliamentarians and young people together in a discussion on the IGF.  We hope that you join us.

It’s IGF season again. Representatives of key stakeholders are meeting again in Geneva to prepare the ground for the forthcoming fourth meeting of a body that has turned out to be considerably more useful than those of us involved in its invention expected.   But despite its success, the future of this, the only multi-stakeholder forum available to consider Internet Governance, is under threat. If we want it to continue then we all, we multi-stakeholders, must speak up and demonstrate how and why we find it useful.

These issues were highlighted last week at the excellent East African Internet Governance Forum. Very well run, with solid participation from regional governments, CCTLD’s, Civil Society and Industry. A novelty was a special session for Parliamentarians. I argued that Members of Parliament had a vital role to play and should consider themselves internationally as another stakeholder group. They knew what their constituents needed, and were best placed to put pressure on governments and resist unnecessarily restrictive legislation, which might stifle the benefits of the Internet as we have come to know it.

All this was taking place in Nairobi, against the background of the remarkable progress being made in Broad Band connectivity in Kenya. No less than four undersea fibre-optic cables will be coming on shore in the coming two years. One has already landed and will be coupled to links reaching beyond the immediate East African region and north to Ethiopia and South Sudan. We talked about various different methods for distributing links beyond the cable proper. Wi-Max systems will link up the smallest municipalities with all the attendant benefits. Exciting stuff. It will be fascinating to see how these cables will spread their invaluable tentacles throughout the region. Can there be a more effective multiplier for economic and social development?

In Nairobi we also discussed the proposal for a Commonwealth IGF, designed to take advantage of that unique coalition of like-minded countries of all sizes, shapes and stages of development. The Commonwealth Secretariat is active in support of this initiative and side-events are planned for Sharm El Sheikh. Something else which will be raised in Geneva this week where representatives from Commonwealth countries will consider how best to share experiences and best practice across the broadest possible range of ideas. 

But governments are only one element of the unique multi stakeholder approach to which many of us attribute the phenomenal success of the Internet. And not all the influences are positive.

At WSIS, when we created the IGF, we also agreed that there should be a programme of “enhanced cooperation” among all the actors involved in Internet Governance. The UN Secretary General was asked to produce a report on how matters might be improved, possibly with recommendations.

I think this report was supposed to be produced after about a year, but it eventually appeared a couple of months ago in the form of a compilation of the views of interested parties which had been called upon to contribute. It included submissions from e.g. the Internet Society, ICANN, and also from the International Telecommunications Union (ITU). In each case the views and ambitions of the authors were made very clear. I would recommend that all those interested in the continuation of liberal internet governance   look at this report, and in particular the views of the ITU Secretariat. [http://unpan1.un.org/intradoc/groups/public/documents/un-dpadm/unpan035383.pdf I say Secretariat because I understand the contribution was not necessarily cleared in advance with its membership.  Nevertheless it would appear to be a clear statement, as it were, of intent, and   should serve to encourage us to work harder to ensure that the IGF mechanism will continue to give all parties, all stakeholders, an opportunity to express their views.

This should of course include developing countries whose interests are I believe much better served by this liberal approach rather than by the repetition of the sort of government driven bureaucratic rules previously deemed appropriate for the old telecoms system. I think our experience in Kenya last week amply demonstrated this.

And so I was delighted when the Kenyan Government formally announced its intention to host the IGF in the year 2011. (Next years event is already fixed for Vilnius, Lithuania). This guarantee of continuity is very important as we face the five-year review process built in to the WSIS decisions. I am a great believer in such reviews. Too often we create mechanisms which trundle along, impelled only by their own bureaucratic existence. Not so with the IGF which has demonstrated a real vitality as all the previous meetings, and in particular Rio (2007) and last year   Hyderabad have shown. And all with only the most limited bureaucratic support. “Secretariat-lite!” Well done Markus Kummer!

Nevertheless there are still those who for a variety of reasons seek either to supplant or suppress this useful mechanism. If we are to maintain this admirable energy we must all, all we multi-stakeholders, redouble our efforts to renew the mandate of the IGF. Some governments are doing their best, but I would like to hear more from Industry, and from Civil Society, particularly among developing countries where most of the next billion Internet users reside. We should all speak up to announce that we all still have much to learn from each other, through Sharm El Sheikh, then Vilnius and on to Nairobi in 2011.

Nick Thorne

Les Augers.

September 2009

(Nick Thorne CMG was UK Ambassador to the UN in Geneva from 2003to 2008 and led the UK and the EU at the Tunis WSIS Summit.  He now consults on Internet Governance issues and is International Relations Adviser to the President and CEO of ICANN. )

Reflecting our area of expertise and experience, this post focuses on child sexual abuse content which is as much an issue for the UK internet as for every country, every law enforcement body, every facet of the global internet community, and every citizen. 

1.    There are few issues so serious, on and offline, as child sexual abuse; and there are few mediums so appropriate for the distribution, sharing and trade in records of this abuse than the internet.

2.    There are few technologies in our lives so revolutionary and full of opportunity as the internet.

3.    The abuse of the internet by criminals around the world for the distribution, sharing, and trade of child sexual abuse images can be thwarted.

What we do

IWF was established in 1996 by the UK internet industry to provide the UK internet ‘Hotline’ for the public to report criminal online content within remit, primarily child sexual abuse images, and to be the ‘notice and take-down’ body for that content. This remains our core role which we carry out in partnership with the online industry, law enforcement, government, the education sector, charities, and, international partners.

We are an independent self-regulatory body, funded by the EU and the wider online industry. We work with UK government to influence initiatives developed to combat online abuse and this dialogue goes beyond the UK and Europe to ensure greater awareness of global issues, trends and responsibilities. We work internationally with INHOPE and other relevant authorities and organisations to encourage wider adoption of good practice in combating online child sexual abuse content and to promote inclusive and united global responses to this dynamic, cross-border criminality.

What we know

The scale and scope of child sexual abuse content on the internet is the subject of much speculation; in fact we believe it is decreasing and that the remaining core represents a concrete target for investigation. Of those websites that remain active today, some have been in existence for many years; most are commercial; and most depict the abuse of young children suffering severe levels of sexual exploitation.

Since 1996 we have dealt with more than 200,000 reports and have over 13 years’ experience of tracking and understanding the technologies and behaviour behind the websites. According to our most recent data: 

• 58% of child sexual abuse domains traced contain graphic images involving penetration or torture
• 69% of the children appear to be 10 years old or younger
• 74% of child sexual abuse domains traced are commercial operations
• 75% of these commercial domains are registered with 10 domain name registries or registrars
• It is still rare to trace child sexual abuse content to hosts in the UK (under 1%) but when it occurs it is removed within hours by the UK internet industry.

The UK approach is grounded in partnership and self-regulation. In our experience, the most effective way of combating criminal content is to work closely with the wider internet industry as well as with government and law enforcement agencies.

What we recommend

This is an extremely fast-moving environment. What had an impact two years ago is becoming obsolete. The technologies of abuse are often developed by sophisticated criminals and what will challenge us in two years time is difficult to predict. National police agencies may be without the resources to carry out long-term investigations into large-scale global networks of criminals whose activities span multiple jurisdictions, borders, and continents.

However, there are a number of  tactics which are already having an effect in minimising the availability of this content and which, if adopted on a global scale could ensure the international internet community’s response to these crimes is more effective, faster and a better deterrent.

The IWF recommends that every country supports a Hotline which specialises in combating online child sexual abuse content using tactics which include:

1.    Operating a national notice and takedown system to swiftly remove child sexual abuse content at source

2.    Operating a free reporting mechanism for the public to report their exposure to potentially illegal child sexual abuse content

3.    Working in partnership with the national internet industry and with the support of government and law enforcement

4.    Working with national domain name registries and registrars to remove domain names persistently distributing child sexual abuse images

5.    Participating in international partnerships to share data, intelligence, and tactics in order to combat the cross-border nature of these crimes

Given the global nature of the online distribution of child sexual abuse images, the most significant and influential development would be the establishment of a global law enforcement body to work with international Hotlines and the internet industry in order to move beyond jurisdictional barriers to tackle those involved in the production and distribution of child sexual abuse content. United, global investigations into the most prolific websites can bring those responsible to justice and rescue children from suffering.

What are the challenges to the global internet governance community?

1.    To support and inform the establishment of a global law enforcement body to work with international Hotlines and the internet industry which is dedicated to investigating child sexual abuse websites

2.    To support the development of international notice and takedown systems to better enable the swift removal of criminal content at source

3.    To establish a universal procedure for swiftly deregistering domain names dedicated to selling child sexual abuse images

4.    To support the harmonisation of national legislation to include serious penalties for the online distribution, downloading, and possession of child sexual abuse images

5.    To inform international debate and policymaking on how to prevent the abuse of new technologies for the sexual exploitation of children and to support initiatives designed to combat this abuse.

For more information on the IWF visit: www.iwf.org.uk

1) Take-up of the Net:

In this country, 30% of homes are still not connected to the Net. In recent Ofcom research, it was highlighted that 42% of adults without the Net at home said the main reason was down to lack of interest or need. The self-excluded tend to be older and poorer and 61% have never used a computer. We now have a Digital Participation Consortium led by Ofcom which is addressing the 17 million digitally excluded and the Digital Inclusion Task Force led by Martha Lane Fox which is focused on the 6 million who are both digitally and socially excluded. We could share these initiatives with the IGF and seek ideas from other countries on how to engage the resistors and the refuseniks.

2) Access to a decent speed of current generation broadband:

The Digital Britain Final Report has proposed a basic minimum speed that should be available to all – 2 megabits a second by 2012 – and a mechanism for funding this – use of the ’surplus’ from the Help Scheme created for Digital Switchover – but, so far, the scheme is not operative and some believe that it might be inadequate and need future-proofing. Again we could share these ideas with the IGF and seek information on similar proposals in other nations.

3) Access to next generation broadband:

At long last, roll-out of next generation access is happened in Britain with major plans from BT and Virgin, but it is widely understood that market mechanisms alone with only take NGA to about two-thirds of the country. The Digital Britain Final Report has proposed a next generation levy – 50p a month on each fixed line – to help fund NGA to the so-called ‘final third’, but the proposal is controversial and there is no certainty of it being implemented. The IGF is a forum is find out how others are addressing this danger of a current digital divide becoming a future digital chasm.

4) Obtaining the speed paid for:

Very few Net users receive in practice the ‘up to’ broadband speed for which they subscribe. Of course, there are many reasons for this, ranging from distance from the exchange to contention ratios to poor internal wiring. We need greater consumer understanding of the issues and clearer information from Internet service providers and the Ofcom-initiated Code of Practice is designed to achieve this. How well is it working? This is another experience which could be shared at Sharm el Sheikh.

5) Tackling illegal file sharing:

Illegal peer-to-peer files haring is a huge issue for the communications industry with bitterly contested positions. Understandably rights holders are angry at the slow progress is tackling an enormous leakage of revenue, but consumer bodies do not want millions of users to be treated as criminals and some users to be cut off entirely. In the middle are Internet service providers who do not want to be cyber policemen and to bear the costs of any enforcement regime, while rights creators – especially in the music industry – have a range of views. We need a proportionate and graduated scheme with due process and a ‘fair use’ provision. The IGF is a place where the different stakeholders can come together and international practice can be compared.

6) Dealing with illegal and harmful content:

The UK is rightly proud of its regime for tackling online child abuse images, but the Digital Britain Final Report challenges the industry to provide a more secure funding model for the Internet Watch Foundation and, although the UK Council for Child Internet Safety has been set up, Tanya Byron has criticised the Government for the lack of effort to implement her action plan. As for harmful content on the Net, we still have not had a calm and intelligent debate about how this might be defined and tackled. I have spoken more about this challenge in this presentation:

http://www.rogerdarlington.me.uk/Internetregulation.html

7) Combating spam and scam:

If there is one thing that angers Net users everywhere in the world, it is the volume of rubbish that overwhelms their in boxes and – even when this content is blocked – the effect it is having on slowing down the Net. In volume terms, we are no nearer solving this problem than we were five years ago. By definition, it is a global issue and the IGF is a place to explore new solutions with a new sense of urgency.

Providing IT support:

Too many people in the industry underestimate the problems that Net users have setting up and maintaining their equipment, installing and up-dating protective software, and dealing with problematic content and activity online. If you are at work, you have the IT Department (I know!). If you are at home, unless you have a friend or young relative who is really IT literate, often you are at a loss even for simple things. There is a case for having an IT equivalent to NHS Direct or Consumer Direct. How would an IT Direct scheme work? There is more detail in this blog posting by Lindsey Annison of Fiver to the Home – Fibrevolution:

http://www.convergenceconversation.com/posts/lindsey.annison/it-direct

At Sharm el Sheikh, we could see whether any other country has done something like this.

9) The switchover of public services:

Around the industrialised world, governments and local authorities have been investing heavily in making public services available online but the take-up of these digital services has been very variable. One way of stimulating take-up of these services, saving public money and promoting digital inclusion is to have a digital switchover of public services as proposed in the Digital Britain Final Report. However, since those citizens not on the Net are precisely those most likely to be users of public services, this proposition raises a serious public policy issue. Other countries are facing exactly the same dilemma and the IGF would be a good place to debate this.

10) A forum for policy discussions:

The kind of issues raised in this blog posting are of great interest and often concern to Government, industry, consumers and a variety of other stakeholders, but we have no adequate forum to discuss them. The UK IGF is a commendable attempt to move in this direction, but it has limited representation, presence and resources. How do we ensure that these issues are debated in an informed way with all those effected? Is there any international experience that would be useful?

Roger Darlington is a member of both the Communications Consumer Panel and the Consumer Focus Board but writes here in a personal capacity.

However, I don’t believe it is possible to simply say that the biggest threat to the safety of Internet users in the UK, or around the world, is the latest online malicious risk or highlight one single threat. We all know that just as technology evolves the same can be said, unfortunately, for cyber criminals. It is important therefore that users are aware of online risks and have appropriate up-to-date technologies in place to ensure they are safe online. However, given the very nature of the internet I believe it is also important to recognise that addressing internet security issues is not something that can be solved only through technological solutions, or solely by a single person, organisation or country.

We all share a collective responsibility to protect ourselves and our customers and that is why to me the UN IGF is so important; it enables countries, industry and civil society to come together to discuss and learn from each other about the key Internet security that all of them are facing across the world. I hope that a key message that resonates from the forthcoming IGF is the value and importance of finding appropriate ways to work together and taking a partnership approach to addressing online security issues. The act of businesses, governments, law enforcement, academia and other stakeholders coming together to discuss issues of concern plays a vital role in increasing our understanding of online risks and also finding possible ways to address the current online threat environment.

But I also believe that this year’s IGF is an opportunity not only to highlight the importance of partnerships but to perhaps consider and discuss possible challenges and potential barriers which could in fact prevent parties working together now and in the future. It is important to highlight that internet security is not only about a technological problem and therefore a technological solution. It is also a question of education and legal framework. We often refer to information security as a people, process and technology issue.

When one is looking at people of key importance is the ability to understand the risk of one’s actions and the appropriate measures one needs to take to protect itself. In many ways if one was to compare this with the off-line world it is developing this sixth sense of being “street-wise”. Knowing how to avoid walking late at night into streets that are not well lit, or understand why chatting with strangers online is sometimes no different than chatting up strangers in the street. Remembering that when putting information on-line the end result may very well be the loss of effective control over that information.

When one is looking at regulation I think one of the biggest challenges is to ensure a pragmatic regulation that is both enforceable and serves the true interests of those who it is trying to protect. I think a good example there is the discussions we have been having in Europe about breach notification and about IP addresses being or not personal data. I can easily see how breach notice is for the interest of everybody that is operating in an online environment. It is designed to reward and motivate the diligent enterprise that protects its customer’s data. It is aiming at empowering the user/customer/consumer with knowledge about how its information is being used and protected. It is providing information to the policy makers that allow them to decide what measures work, what not and what is the level of risk of a particular environment. It will also penalize entities that fail to ensure an adequate level of protection.

On the complete opposite side is the whole discussion about IP addresses. In a number of member states there are conflicting court decision as to whether an IP is personal data or not, even within the same jurisdiction. From a technical standpoint arguing that an IP is personal data is somewhat oxymoron because the basis of data protection is information self-determination, i.e. the right to refuse to share personal data. Obviously in the case of IP if you do not share it you are not connected……. From a technical standpoint IP addresses do not identify individuals, but together with other identifiers (and some effort) can lead eventually to identification depending on circumstances. Then the question arises, who are we really trying to protect? Do we successfully protect the individual rights by classifying IP addresses as personal data? I am not so sure……… in fact I would even argue that by doing so we may sometime put perhaps unintentionally other rights at risk.

Clearly finding the right balance to this and frankly other similar questions that arise when regulation online activity is something that is exercising minds across the world. The IGF alone cannot resolve such complex regulatory issues. But as we look towards to coming together in Egypt I hope that we use this opportunity not only to promote the benefits of collaboration where appropriate but also to recognise the possible impact and unintended consequence of decisions taken on public policy issues. We need flexible regulation that can withstand the test of time. In addition we need to recognise that no matter how much regulation and policies and projects governments put into place, unless there is effective education of users and a gradual shift in our attitude the progress on information security will be limited.

Posted by Nominet on behalf of Susan Daley - Symantec Government Relations Manager UK & Ireland

It is ironic that a technology originally developed to further military aims has turned out to be both insecure and difficult to make secure, but of course it is often argued that the Internet’s highly open approach to access is one of the key factors in its success. Attempts to secure the Internet often have the effect of restricting that access, which is unattractive and limits takeup, leading to a kind of catch-22 situation that seems to ensure that security is constantly being degraded over time.

OK, time for some opinions to get the ball rolling - in the interests of its continued survival the Internet needs an effective immune system, and this can only happen if society as a whole deems it important. The Internet is a vast resource that has developed into a complex ecosystem, and like any ecosystem it supports a range of players, including analogs of predators (such as fraudsters or paedophiles), parasites (such as spammers) and diseases (such as malware and worms). In biology, any organism that does not have an effective immune system will be quickly exploited and/or killed - and those outcomes are pretty much guaranteed to be the only ones on offer. In terms of human society, an immune response is typically provided by the application of factors such as social rules, laws, codes of moral behaviour and by society’s willingness to back them up by enforcement. In the case of the Internet all these factors have proved extremely difficult to apply due to its patchwork global and distributed nature, and the result of this is clear to see: fraudsters rake in millions of dollars a year in virtually risk-free scams, nearly all email is now spam, and tens of millions of computers are infected with malware and forced to support yet more crime and disorder.

In my own industry of banking I see all too well the effects of being targeted by well-resourced organised criminals, often operating from countries where there is no realistic prospect of their being found or arrested, let alone prosecuted and punished. In a way though, banks have an easier task in terms of agreeing security measures - because they are targeted with some of the most advanced tools at criminals’ disposal, and because what they guard is clearly so important - banks can readily implement tough regimes such as two-factor authentication, restrictive access controls and so on. These measures are undeniably effective, but I’ve often heard that these are measures that many others would blanch at - too restrictive, too expensive, our users would never accept it, etc. etc. So we have a situation where patches of interested parties are taking various actions, largely independently of each other and with no real coordination or agreement on tactics or strategy. However, over time I believe that it is likely that these measures will see wider and wider use simply as a side effect of the continuing arms race.

The experience of the banking industry is an interesting case to consider further. Like many others, it entered the Internet as a sea of opportunity where it grew and grew with apparently no downside. Then about five years ago it was discovered by predators, and what had looked like a beautiful coral reef turned out to be a shark-infested ocean. When banks looked for help in solving the problems they found - not much. More accurately, they found no equivalent to “real world” problems of similar type. Instead they found a patchwork of dedicated amateurs, small security firms, the odd law enforcement body with all-too limited jurisdiction and not much else. Clearly the Internet is still a very new place, and society as a whole has yet to catch up, but in the last five years the situation can hardly be argued to have improved in any measurable sense despite the best effforts of many dedicated individuals and organisations. This is reflected in the low key nature of response at national and inter-national level and it is clear that society as a whole still seems to have a problem in accepting that:

a) The Internet is no longer a toy - it is hugely important to all civilised societies; and
b) It should be robustly defended as such; and
c) societies should make available the resources and expertise to create and maintain that defence

True, these are widely and vaguely-stated aims, but taken to heart they would represent a surprisingly large-scale change in how the wider world often seems to perceive the Internet (i.e. a play-pen where so-called “crime” is enacted by cheeky apple-scrumping boys who can’t be caught anyway). To see how big a change, one need only consider the size - or lack of - the budget for the Police Central e-Crime Unit.

• The IGF environment encourages an open exchange of ideas because there is no pressure to make decisions. Participants can learn from each other and draw on a wide pool of good practice to help inform their own decisions;
• The open meetings foster the creation of multi-stakeholder partnerships so that dialogue can take place on a global level;
• The IGF provides an open and inclusive process whereby all stakeholders can discuss public policy issues related to Internet governance;
• The IGF has had a significant impact on Nominet and many of our stakeholders in the UK. Of particular note is the creation of the Nominet Best Practice Challenge and child protection issues being given a place on the international agenda and being discussed as part of a global debate;
• We are pleased that members of the UK Parliament have seen the value of the opportunity to engage in the IGF;
• The creation of the UK-IGF has helped us draw increased benefit from the IGF and we are pleased that other countries have also adopted constructive engagement in the IGF.

We have also made some recommendations on how the current methods and processes could be improved and these can be found within the full text of our comment on the IGF website at: http://www.intgovforum.org/cms/2009/postings/Nominet.IGF.review.comment.pdf

Other statements on the IGF review process can also be found on the IGF website at: http://www.intgovforum.org/cms/index.php/component/chronocontact/?chronoformname=FormalConsult032009ListView

We believe that the IGF has been immensely successful in what it has achieved so far. We hope to see its continuation far beyond 2010 and we are ready to continue our support for the IGF process. If you would like to comment on the desirability of the continuation of the Forum you can email your statement to the IGF Secretariat at igf@unog.ch Comments will be posted on a continuing basis.