Security quotes of the week

Even if you feel that the COVID crisis is reason enough to endorse government involvement in social media content takedowns, please consider for a moment the next steps. Today we’re talking about COVID misinformation. What sort of misinformation — there’s a lot out there! — will we be talking about tomorrow? Do we want the government urging content removal about various other kinds of misinformation? How do we even define misinformation in widely different subject areas?

And even if you agree with the current administration’s views on misinformation, how do you know that you will agree with the next administration’s views on these topics? If you want the current administration to have these powers, will you be agreeable to potentially a very different kind of administration having such powers in the future?

I don't know where all of this is going right now, but I do know that I've been having conversations along these lines with a bunch of people over the last year or so, and there's a strong feeling that it's time for us to reclaim the open internet. To bring it back to the original vision of the earliest proponents and builders of the open web, in which it was all potential, but with the humility and knowledge of how that power can and will be abused. We can have an internet that empowers people, but not with blind optimism. We can recognize that optimism is warranted, but needs to be tempered with a healthy understanding of where things can go wrong. We can look for ways to enable more people to respond to those challenges, rather than relying on large companies and governments to step in and "solve it" for us -- often with a sledgehammer directed at the foundational things that make the internet such a valuable tool in the first place.

NSO can afford to maintain a 50,000 number target list because the exploits they use hit a particular “sweet spot” where the risk of losing an exploit chain — combined with the cost of developing new ones — is low enough that they can deploy them at scale. That’s why they’re willing to hand out exploitation to every idiot dictator — because right now they think they can keep the business going even if Amnesty International or CitizenLab occasionally catches them targeting some human rights lawyer.

But companies like Apple and Google can raise both the cost and risk of exploitation — not just everywhere, but at least on specific channels like iMessage. This could make NSO’s scaling model much harder to maintain. A world where only a handful of very rich governments can launch exploits (under very careful vetting and controlled circumstances) isn’t a great world, but it’s better than a world where any tin-pot authoritarian can cut a check to NSO and surveil their political opposition or some random journalist.

We’re not going to be able to secure the Internet until we deal with the companies that engage in the international cyber-arms trade.

Note: you can avoid this step in the future by logging into your LWN account.