<Originally a Webwereld column - in Dutch>
In the middle of election season in Iceland a debate is raging about the need to protect young children from violent pornographic imagery that can be found on the Internet. Although it is unclear what the scale of this problem is, there is concern about the methods used by some in the porn industry to market their wares. There is an idea that some firms use the old tobacco industry method of 'get them while they're young'.
As I was in Iceland recently I was fortunate enough to be asked my opinions on these matters by government officials. The entire debate is being conducted during election season, so the local media are on top of every word uttered by anyone from either government or the local digital civil liberties organisations. What causes most of the (international) attention is the specific plan to put a national filter on all Icelandic internet connections. This would be a first for a western democracy (although such filters have been tried in various Asian countries from Iran to China). Proposing a method that could very well be called censorship is incongruous in a modern and progressive society such as Iceland (the only country to have convicted its bankers over their part in the current global financial crisis).
During an informal dinner a few days later with officials it became clear that no decision on a filter, or any other policy, had been made. The government was looking into the problem and discussing possible solutions. The emotive nature of the debate causes the problems and solutions to get mixed up. I therefore attempted to structure the discussion over dinner:
A few years ago, Israeli and American intelligence developed a computer virus with a specific military objective: damaging Iranian nuclear facilities. Stuxnet was spread via USB sticks and settled silently on Windows PCs. From there it looked into networks for specific industrial centrifuges using Siemens SCADA control devices spinning at highspeed to seperate Uranium-235 (the bomb stuff) from Uranium-238 (the non-bomb stuff).
Iran, like many other countries, has a nuclear program for power generation and the production of isotopes for medical applications. Most countries buy the latter from specialists like the Netherlands that produces medical isotopes in a special reactor at ECN. The western boycott of Iran makes it impossible to purchase isotopes on the open market. Making them yourself is far from ideal, but the only option that remains as import blocked.
Why the boycott? Officially, according to the U.S. because Iran does not want to give sufficient openness about its weapons programs. In particular, military applications of nuclear program is an official source of concern. This concern is a fairly recent and for some reason has only been reactivated after the US attack on Iraq (a lot of the original nuclear equipment in Iran was supplied by American and German companies with funding from the World Bank before the 1979 revolution). The most curious of all allegations of Western governments about Iran is that they are never more than vague insinuations. When all 16 U.S. intelligence agencies in 2007 produced a joint study there was a clear conclusion: Iran is not developing a nuclear weapon (recent speech by the leader of this study here).
At their yearly conference the Dutch The National Cyber Security Center stated this week they want to listen more to the hacker community. It is fine that the government will at last listen to the people who have been ahead of the curve for decades, although the question remains - why it has waited to do this until 2013? Even if this had been done as recently as 5 or 10 years ago it would have saved an incredible amount of trouble and public money. I sincerely hope that the consultations with the hack(tivist) community are about more than just technical tricks, because most benefits to society are derived from discussing policy. For purely technical issues the usual consulting companies can always be hired and then simply pay hackers for their knowledge and advice, just like any other experts.
Meanwhile a big group of hackers were unhappy about the fact they were not welcome and organized an alternative meeting. If the NCSC's intentions for the coming year work out in practice, next time this might not be necessary. On the community side, these invitations to the table should be dicussed openly and in detail (who sits at the table and wearing what hat). Because when community contributions and possible commercial interests get mixed up, things quickly degenerate into bickering and arguing. I speak from experience ;-). Nobody is "representative" of the entire hacker community. The NCSC will have to adjust to the idea that we have no centralised organisation with a head office where you can meet up with the CEO/director/top-dog.
Not sure what to say about the sudden death of Aaron Schwarz, idealist, freedom-fighter-extraordinaire and friend of open access to information for all of humanity. Aaron spend his life fighting for humanity's highest ideals, contributing to technologies most of us use every day (even if we don't know it). It just feels like something is very, very wrong is the so-called 'free world' is killing its best and brightest for living up to its highest ideals. We've got big problems and cannot afford to lose people like Aaron.
Cory Doctorow has written a eulogy here, Prof Lawrence Lessig had an overview of the case the US Department of Justice (ha!) saw fit to launch against Aaron. Glen Greenwald wrote about his heroic work in helping to defeat SOPA over the last years. A digital memorial to Aaron will be here for as long as there is an Internet. The files that started the case can be found here. Spread them around as wisely as possible.
But mostly just watch Aaron's speeches and interviews, as many times as needed before you understand his ideas and ideals fully.
On July 11th 2001 the European Parliament published a report on the Echelon spy network and the implications for European citizens and businesses. Speculations about the existence of this network of Great Britain-and-her-former-colonies had been going on for years but it took until 1999 for a journalist to publish a report that moved the subject out of the tinfoil-hat- zone. The report of the EU Parliament contains very practical and sensible proposals, but because of events two months after publication, they have never been implemented. Or even discussed further.
Under the heading "Measures to encourage self-protection by citizens and enterprises" lists several concrete proposals for inproving data security and confidentiality of communications for EU citizens. The document calls on Parliament to inform citizens about the existence of Echelon and the implications for their privacy. This information must be "accompanied by practical assistance in designing and implementing comprehensive protection measures, including the security of information technology". So not just some abstract government infomercial on TV/radio but hands-on tips to get some actual work done please!