Wiretapping, Piracy, and Policy

A Distinguished Engineer Considers Conflicting Concerns

By Al Riske

14.Nov.05--Susan Landau is no stranger to controversy. It's not that she likes controversy. She doesn't. It's just that, if you want to work on things that are important, you're going to find yourself in the middle of a conflict or two.

Right now it's two.

A Distinguished Engineer at Sun Labs in Burlington, Massachusetts, Landau has long focused on the interplay between security and public policy, and the big debates right now have to do with wiretapping and digital rights management.

Wiretapping is an issue because the FBI is interested in making sure it can tap into VoIP (voice over Internet protocol) communications. It wants that capability designed and built into the system.

The problem, Landau argues, is that what's good for surveillance is bad for security. And by that she means national security.

"In this particular situation, you have to balance law-enforcement's need for wiretaps with national security needs around information security. When you do that kind of balance, it doesn't come down on the side of wiretaps," she says.

A lot of critical infrastructure, from oil pipelines to the electric power grid, runs on the Internet or private networks that use Internet protocols, she points out.

"If you now introduce into those protocols the idea of a security breach, which is what surveillance is, and you have people out there using powerful search engines and remote monitoring to think about where they want to be looking for information, this is a vulnerability we don't want," Landau says.

"While the FBI has been pushing for wiretap capabilities in VoIP, you haven't seen that from the security agencies. Presumably, that's because they're aware that this is a double-edged sword."

Landau came to Sun six years ago from the faculty of the University of Massachusetts at Amherst. Her work there as a computer scientist yielded exponential improvements in algorithms for solving long-standing problems in computer algebra.

At that time, she was already active in public policy issues and worked with Sun's Whitfield Diffie on the award-winning book Privacy on the Line: The Politics of Wiretapping and Encryption. (Diffie later persuaded her to join Sun.)

The issues they wrote about then bear similarities to the current debate.

"The FBI was arguing very strongly for crypto controls and export controls on crypto," Landau recalls. "Then in 2000 the U.S. government loosened the controls on the export of crypto. There were a bunch of reason for that. One was the realization that the costs from not being able to understand communications were outweighed by the cost of not protecting information that needed to be protected. I'm not talking about Defense Department or diplomatic traffic. I'm talking about corporate traffic, critical infrastructure traffic. In order to protect that traffic you need strong cryptography ubiquitously available."

The rub was that the rules made it too complicated for high-tech companies like Sun to make strong cryptography available domestically if they couldn't export it as well.

"In 2000, the national security agencies turned around and said that, on balance, the U.S. is better off with the deployment of strong crypto, even though there will be costs. They didn't say it explicitly. They simply agreed with the loosening of export controls, but you can read between the lines," Landau says.

In any case, the rules proved ineffective because companies in other countries didn't have the same restrictions.

Will the current debate play out the same way?

"It will be tense, and I don't know," Landau replies.

One thing is certain: She will be advocating a contrarian solution -- tapping in at the application layer rather than the protocol layer. "It's more complex and more costly for the FBI, but the cost the other way is much higher for security and society," she says.

The second conflict that concerns Landau right now has to do with digital content and how to balance the needs of creators and users.

The discussion so far has centered on piracy, but Landau, who favors just compensation for musicians, moviemakers, and other creative artists (not to mention their distributors), thinks that's too narrow.

"What we want to think about is a world where new technologies empower the creators, the users, everyone," she says.

Sun, in fact, recently raised the curtain on the Open Media Commons, an initiative calling for an open-source, royalty-free standard for digital rights management.

The initiative is based on five principles that Landau helped formulate with Sun CTO Greg Papadopoulos:

• Innovation flourishes through openness -- open standards, reference architectures, and implementations.
• All creators are users and many users are creators.
• Content creators and holders of copyright should be compensated.
• Respect for users' privacy is essential.
• Code (both laws and technology) should encourage innovation.

"On one hand, the media companies like us a lot because we believe in open standards, which is a good thing for them. They don't want to see a business model in which their content gets locked up by a company they can't control," she says.

"On the other hand, they're very nervous because their business model has been one in which they control the content tightly. What we're talking about is something different, but it benefits them as well as us."

Landau points out that all creative endeavors build on what has come before and that new technologies are simply accelerating an age-old process.

"It's clear what I get from being able to cut and paste, sample and manipulate, but how does it benefit the content owners and producers? They haven't thought of it that way," she says. "When a user takes a piece of content and manipulates it and changes it and turns it into something new, everyone will benefit if you build things the right way. If you enable the user to do that, and the user then creates a piece of commercial content, the original creator benefits in the same was as if a poem is picked up and reprinted in an anthology."

Landau maintains that while new technologies may create new challenges, they also create new opportunities.

"If media companies want to hold on to their content so closely that the only way to access it is that you can look at it but you can't do anything with it, from copy it to cut it up to play with it, then they will have a limited business model, and in the long term it's not healthy for them," she says.

"With our open-source initiative, there's space for lots of experimentation, in technologies, in business models, you name it. There's a lot of challenge there. Change is good. It's not only good; it's necessary. But what we're trying to do here may upset a certain number of apple carts, that's for sure."