The post-PRISM internet

As the founder of the ownCloud project, Frank Karlitschek has spent a fair amount of time considering the issues surrounding internet privacy. The recent revelations of widespread internet surveillance embodied in the PRISM program (and other related efforts largely revealed by Edward Snowden) have, essentially, broken the internet, he said. Karlitschek came to LinuxCon North America in New Orleans to talk about that serious threat to the internet—one that he believes the free and open source software communities have a responsibility to help fix.

A longtime open source developer, Karlitschek has worked with KDE, opendesktop.org, along with the KDE-Look and GNOME-Look sites. After starting the ownCloud project, he also helped found an ownCloud company in 2012. OwnCloud is "both a company and a community", he said.

But Karlitschek wasn't there to talk about ownCloud. Instead, he turned to the news to highlight the problem facing the internet, noting a few headlines from the last few months on surveillance-related topics: the NSA circumventing internet encryption, "full take" (storing all data gathered), and XKeyscore. The latter is a program that collects "nearly everything a user does on the internet", and because of the "full take" strategy used, the data all gets stored. The NSA doesn't have the capacity to analyze all that data now, so it stores it for later analysis—whenever it somehow becomes "interesting". It turns out that if the budget is high enough, one can essentially "store the internet", he said.

While XKeyscore only gathers metadata, that metadata is still quite privacy invasive. It can include things like the locations of people, who is "friends" with whom, what search terms people use, what they buy, and so on. If an agency puts it all together in the context of a single person, it can lead to surprisingly revealing conclusions.

In other news, Karlitschek noted that man-in-the-middle attacks are increasing, at least partly due to the brokenness of the SSL certificate authority scheme. He also pointed to the shutdowns of Lavabit and Groklaw as recent events of note. And, "news from yesterday" that he had seen in the European press (and not really in the US press, at least yet) indicated that much of the worldwide credit card transaction data had been compromised and collected by secret services.

The surveillance is not just a problem for one country, he said, as there are secret services all over the world that are reading our data. It is not just a problem of the NSA or the US—everyone who uses the internet anywhere is affected. These agencies are not just reading the data either, as man-in-the-middle attacks can also be used to change the data that is being sent if that is of interest. It is important to realize that this surveillance covers all of the communication on the internet, which increasingly is data that is coming from our devices. The data collected by those devices is sometimes surprising, including phones that never turn off their microphones—or, sometimes, their cameras.

He asked the audience to raise their hands if they used various internet services (banking, search, ...) and got majorities for them all, until he came to the last question. "Who thinks private data on the internet is still private?", he asked—to zero raised hands.

"The internet is under attack", Karlitschek said. This network and infrastructure that "we all love" and have used for years is being threatened. This is a huge problem, he said, because it is "not just a fun tool", the internet is "one of the most important inventions" ever created. It enables a free flow of knowledge, which makes it the best communication tool invented so far. It is an "awesome collaboration tool" that enables projects like, for example, Linux. Without the internet, there would be no Linux today, he said. Many companies have been able to build businesses on top of the internet, but all of that is now threatened.

There are various possible responses to this threat. One could decide to no longer transmit or store private information on the internet, but there is a problem with that approach. More and more things are tied to the internet every day, so it is more than just the web browser. Smartphones, gaming consoles, and regular phone conversations all use the internet even without the user directly accessing it through the browser. "Not using the internet for private data is not really an option these days", Karlitschek said.

Another response would be to use ssh, rsync, GPG, and "super awesome encrypted Linux tools". There are a few problems with that idea. For one thing, we don't know that ssh and others are safe as there are "new problems popping up every day". In addition, the transmission may be encrypted successfully, but the endpoints are still vulnerable; either the client or server end could be compromised. Another problem is that regular users can't really use those tools because they aren't targeted at those who are not technically savvy.

One could also just decide not to care about the surveillance that is going on, but privacy is very important. He is from Germany, which has some experience with both right- and left-wing secret services that were unconstrained, he said—it leads to "bad things".

Who invented and built the internet, he asked. The answer is that "we invented it". There would be no internet in its current form without Linux, he said. If users had to buy a Sun system to run a web server, it would have greatly changed things. Beyond Linux itself, we created languages like Java, PHP, and JavaScript; and free databases, open protocols, and many applications. Because we built it, "we also have to fix it".

There are political aspects to the problem that the politicians are, supposedly, working on, but Karlitschek doesn't hold out much hope for that kind of solution. Technologists have to work on it so that the internet "works like it is supposed to". To try to define how the internet should work, he and others have come up with a list of eight user rights that are meant to help define "how a good internet works".

Those rights range from things like "own the data"—taking a photo and uploading it to some service shouldn't change the ownership, the same goes for texts, emails, and so on—to "control access"—the user decides on when and with whom to share data, not the service. The other rights are in the same vein; the idea is to put users firmly in control of their data and the access to it.

Karlitschek then looked at four areas of internet use (email/messaging, the web, social networking, and file sync/share/collaboration) to see how they stack up on a few different "open data" criteria. Email and the web have similar scores. Both are decentralized, people can host their own or fairly easily migrate to a new service, they use open protocols, and have open source implementations available. All of that is very good, but both fail in the encryption area. Email has encryption using GPG, but regular users don't use it (and many technical people don't either), while SSL encryption is largely broken because of a certificate model that places too much trust in large governments and organizations.

Social networking is "very bad" on these criteria, he said. It is centralized (there is just one Facebook or G+ provider), it can't be self-hosted, migration is nearly impossible (and friends may not migrate even if the data does), open protocols aren't used, open source implementations don't really exist (Diaspora didn't really solve that problem as was hoped), and so on.

Things are a bit better in the file sharing realm, but that is still mostly centralized without open protocols (there are APIs, but that isn't enough) and with no encryption (or it is done on the server side, which is hopeless from a surveillance-avoidance perspective). On the plus side, migration is relatively easy (just moving files), and there are some open source implementations (including ownCloud).

Overall, that paints a fairly bleak picture, so what can we do about it, he asked. For regular users, starting to use GPG encryption and hoping that it is safe is one step. Stopping reliance on SSL for internet traffic encryption and using a VPN instead is another, he said. VPNs are hard for regular users to set up, however. Using Linux and open source as much as possible is important because "open source is very good protection against back doors". He noted that there were two occasions when someone tried to insert a back door into KDE and that both were noticed immediately during code review. He strongly recommends on-premises file-sharing facilities rather than relying on the internet. Beyond that, users need to understand the risks and costs as security is never really black or white, it is "all gray".

Developers "have a responsibility here", he said. They need to build security into the core of all software, and to put encryption into everything. Looking at SSL and the certificate system should be a priority. Another area of focus should be to make secure software that is usable for consumers—it needs to be so easy to use that everyone does so. He showed two examples of how not to do it: a Windows GPG dialog for key management with many buttons, choices, and cryptic options and the first rsync man page, which is just a mass of options. Those are not solutions for consumers, he said.

He would like to have an internet that is "safe and secure", one that can be used to transfer private data. Two groups have the power to make that happen, but one, politicians, is unlikely to be of help as they are beholden to the secret services and their budgets. So it is up to us, "we have to fix the internet".

Two audience questions touched on the efficacy of current cryptographic algorithms. Karlitschek said that he was no expert in the area, but was concerned that the NSA and others are putting several thousand people to work on breaking today's crypto. It is tough to battle against so many experts, he said. It is also difficult to figure out what to fix when we don't know what is broken. That makes it important to support efforts like that of the Electronic Frontier Foundation to find out what the NSA and others are actually doing, so that we can figure out where to focus our efforts.

Outside of Karlitschek's talk, there is some debate over how the "broken internet" will ever get fixed—if, indeed, it does. Technical solutions to the problem seem quite attractive, and Karlitschek is not the only one advocating that route. Whether well-funded privacy foes, such as governments and their secret services, can ultimately overwhelm those technical solutions remains to be seen. Outlawing encryption might be seen as stunningly good solution by some, but the unintended side effects of that would be equally stunning. E-commerce without encryption seems likely to fail miserably, for example. Hopefully saner heads will prevail, but those who prey on fear, while spreading uncertainty and doubt along the way, are legion.

[ I would like to thank LWN subscribers for travel assistance to New Orleans for LinuxCon North America. ]