Vint Cerf on Differential Traceability on the Internet (acm.org)

Addressing the bad behaviors on the Internet, that range from social network bullying and misinformation to email spam, distributed denial of service attacks, direct cyberattacks against infrastructure, malware propagation, identity theft, and a host of other ills require a wide range of technical and legal considerations, says Vint Cerf, even as he steers clear that he supports encryption. But is there a way to bring more accountability and traceability on our actions on the internet without compromising our privacy? He has a proposition: What is of interest to me is a concept to which I was introduced at the Ditchley workshop, specifically, differential traceability. The ability to trace bad actors to bring them to justice seems to me an important goal in a civilized society. The tension with privacy protection leads to the idea that only under appropriate conditions can privacy be violated. By way of example, consider license plates on cars. They are usually arbitrary identifiers and special authority is needed to match them with the car owners (unless, of course, they are vanity plates like mine: "Cerfsup"). This is an example of differential traceability; the police department has the authority to demand ownership information from the Department of Motor Vehicles that issues the license plates. Ordinary citizens do not have this authority.

In the Internet environment there are a variety of identifiers associated with users (including corporate users). Domain names, IP addresses, email addresses, and public cryptography keys are examples among many others. Some of these identifiers are dynamic and thus ambiguous. For example, IP addresses are not always permanent and may change (for example, temporary IP addresses assigned at Wi-Fi hotspots) or may be ambiguous in the case of Network Address Translation. Information about the time of assignment and the party to whom an IP address was assigned may be needed to identify an individual user. There has been considerable debate and even a recent court case regarding requirements to register users in domain name WHOIS databases in the context of the adoption of GDPR. If we are to accomplish the simultaneous objectives of protecting privacy while apprehending those engaged in harmful or criminal behavior on the Internet, we must find some balance between conflicting but desirable outcomes.

Comments

Abuse

[Anonymous Coward]

By way of example, consider license plates on cars. They are usually arbitrary identifiers and special authority is needed to match them with the car owners (unless, of course, they are vanity plates like mine: "Cerfsup"). This is an example of differential traceability; the police department has the authority to demand ownership information from the Department of Motor Vehicles that issues the license plates. Ordinary citizens do not have this authority.

Considering the government's efforts with license plate readers precisely because they're the only ones with the power to demand ownership information from the DMV, isn't this a great example of the whole problem with trying to introduce traceability? It's become very clear that computers not only allow for the rapid automation of use but also the rapid automation of abuse. Attach that to a global communication network, and you offer pervasive rapid automation of abuse. It stands to reason with that in mind, you want to take steps to reduce traceability as a necessary step towards resilience from the pervasive adversaries, not only to those endowed with authority but those who would bribe, mole, or engineer their way into that authority.

tl;dr - We need to take more steps towards protecting users, not trying to out villains. Computers are the one space where that's a much more doable option than most.

Re:The internet has gotten along well so far...

[AmiMoJo]

The internet has gotten along well so far...

Has it?

Foreign countries interfering with our democracies using fake accounts. Trolling getting to the point where people are dying e.g. swatting. Endless scams (Nigerian princes etc.), phishing...

The internet isn't some magical other dimension, it's just a part of everyday life and part of its immense power is that things that happen online have real world consequences. And that includes what bad actors get up to.

Personally I don't like this scheme because it's impractical and would give authorities far more power than car licence plates do, but the other extreme isn't much better.