Security

SOPA and PIPA

As this article is being written on January 18, many high-profile web sites have gone "black" in order to protest proposed legislation in the US that would, ostensibly, combat online "piracy". Lots of different sites are participating, from Wikipedia and Google to sites that cater to more technical audiences like Reddit and Bruce Schneier's security blog. The intent is to raise the profile of the two related pieces of legislation with the hope that users (both technical and less so) will recognize the threat to a "free and open internet" that the laws represent.

As seems to commonly be the case—at least in the US—the proposals have been given names that don't accurately reflect their scope. The "Stop Online Piracy Act" (SOPA) is the House of Representatives' entrant, while the Senate bill is called the "Protect Intellectual Property Act" (PIPA). Both are strongly backed by the content industries who make unsubstantiated claims about the financial and job losses caused by online piracy—and are undoubtedly pouring lots of money into lobbying for their passage. But, many internet sites and luminaries are extremely wary of the bills' contents because they could "break the internet".

The law of "unintended consequences" is often present in internet-targeted legislation, but it's a little hard to see some of the consequences from SOPA/PIPA as being unintended—at least by some of their proponents. The content industry has found it expensive and difficult to combat the copyright infringement of its works under the existing laws, and is always looking for a way to make others responsible for enforcement. SOPA/PIPA are just the latest salvo in that effort.

The biggest technical problem with the legislation is that it tries to fundamentally alter how the domain name system (DNS) works, so that "rogue" sites that carry infringing content—or even links to infringing content—can be "banished" from the internet. As pointed out by Paul Vixie, though, all of the technical measures that SOPA/PIPA want to use to blacklist these supposedly rogue sites won't do so. In addition, implementing these "features" will just increase the load on DNS servers as clients try to route around the censorship.

The argument from proponents is that many of the sites that they would like to shut down are foreign-owned, and thus are impossible to affect via US law. Aside from the irony of using US legislation to somehow do the impossible, mandating that US companies blacklist web sites via DNS or any other method is only likely to result in fragmenting the infrastructure of the internet. As an open letter from 83 internet inventors and engineers to the US Congress in December put it:

The bills would mandate that US companies enforce the blacklist, and provide penalties if a service allows users to circumvent the list. Not only does that put a large burden on ISPs, web application providers, internet startups, and others, it also adds a large uncertainty factor by the terms used. Rather than focusing strictly on sites that infringe copyrights (for which there are plenty of laws already available), these bills would be enforced against sites that are "enabling or facilitating" infringement (at least in SOPA). That kind of ambiguity leaves the door open to all sorts of abuse.

Those penalties can be severe. One of the actions that a copyright holder could take against a site deemed to have violated these acts is to get a court order that requires payment sites and advertising networks to cut the site off. So, a site that "facilitates" infringement (which could easily be applied to almost any site on the internet) could suddenly find itself cut off from its funding sources—or in court to show why it shouldn't be. For larger, well-established sites and service providers, that will be an expensive annoyance, but for smaller fish (including startups and sites like LWN) it could easily put the company out of business.

Proponents of these laws downplay the potential for widespread applicability, explaining that they are targeted at the "worst of the worst" offenders. But, as we have seen with almost any law (internet-focused or not), they is almost always some kind of overreach. Once these (or similar) laws are on the books, the content industries will be pushing the envelope. We've seen this overreach with the DMCA, anti-"hacking" laws, the PATRIOT act, and more. Meanwhile, the rest of the world (along with much of the US) will just find ways to route around the blockades.

Certainly copyright infringement is a problem. Copyright is, after all, the tool that the free software community uses to enforce its licenses. The question is how big of a problem infringement really is, and what the right solution is. The content industries would have us believe that infringement is stealing food from the mouths of babes—while often reporting record profits. It's not at all clear that passing more and more laws will "fix" the problem.

The only real way to completely prevent digital copyright infringement is to curtail general purpose computing (and networking) in ways that would be drastically detrimental to the worldwide economy (not to mention little things like personal freedom). Cory Doctorow recently spoke about the likelihood of an upcoming war against general-purpose computing. One could argue that we have already lost some battles in that war (e.g. DMCA) and SOPA/PIPA are yet another. Hopefully, the efforts of the high-profile sites protesting this legislation will start to wake people up about what kinds of things the content industries and their "pet" legislators are trying to do. If not, we will likely see even more draconian legislation down the road.

For readers wanting to know more, Techdirt's Mike Masnick has two analyses of SOPA/PIPA [1, 2] that are well worth a read.

Comments (5 posted)

Brief items

NSA releases security-enhanced Android (The H)

Comments (21 posted)

Berrangé: Building application sandboxes with libvirt, LXC & KVM

Comments (17 posted)

New vulnerabilities

acroread: code execution

Comments (none posted)

kernel: multiple vulnerabilities

Comments (none posted)

kernel: syscall instruction induces guest panic

    [bits 32]
    global _start
    SECTION .text
    _start: syscall

Comments (none posted)

kernel: denial of service

Comments (none posted)

libxml2: code execution

Comments (none posted)

openssl: private key disclosure

Comments (none posted)

plib: arbitrary code execution

Comments (none posted)

rubygem-rack: denial of service

Comments (none posted)

simplesamlphp: cross-site scripting

Comments (none posted)

t1lib: multiple vulnerabilities

Comments (none posted)

wordpress: cross-site scripting

Comments (none posted)

Page editor: Jake Edge
Next page: Kernel development>>