KGOU

Derrick Cogburn On Internet Governance In The Age Of Cyber Attacks And Data Breaches

Mar 30, 2018

This week the Federal Trade Commission confirmed it is investigating Facebook over its handling of user data. The U.S. Department of Homeland security also published a report revealing that Russia hacked the U.S. electricity grid. And a cyber attack shut down the city of Atlanta for over a week.

 

Unbeknownst to many, American University professor Derrick Cogburn says there is actually a system for governing the internet, which enables things like cyber attacks and data breaches. It just doesn’t revolve around government actors.


“There are a whole range of organizations that contribute to internet governance,” Cogburn said. “Governments play a role but they're not at the center of it.”

Since the internet’s inception in 1990, governments have been given a voice through the annual Internet Governance Forum.

“This is where we have these debates that take place and where you have a convergence of expectations,” Cogburn said. “No decisions are being taken within the Internet Governance Forum. That's happening in these other parts of the internet governance ecosystem.”

Cogburn listed several organizations that develop protocols for how the internet functions, like The Internet Corporation for Assigned Names and Numbers (ICANN), a nonprofit  responsible for maintaining a massive database matching IP addresses with domain names, among other things.

Today, even governments that have historically allowed the internet to go unregulated, like the United States, are getting more involved. Obama-era “net neutrality” rules and the Federal Communication Commission’s decision to repeal them is one example.

The direct involvement of government has Cogburn worried. As co-director of the Internet Governance Lab at American University, he values a decentralized process that allows private citizens, companies and governments to play a role in internet governance.

 

INTERVIEW HIGHLIGHTS

Cogburn defines internet governance:

Internet governance ... is a broader way to think about cyber security and cyber policy. And internet governance really takes us to the technical side, the policy side, and the implementation of the protocols related to the internet, and the content and the policy areas related to governing the internet. And all of that is related to creating opportunities for people to both share resources, share content, but also it opens up those possibilities for the breaches… as well.

Cogburn on the unique role the United States played in developing internet governance:

The only government that has been at the center of this has been the United States government in some ways… If you look at when ICANN was created in 1998, you have a role for governments in something called the Government Advisory Council. But it's not  the center of this process. It's the technical community, the user community, and the private sector and governments that all play a role. But governments are not at the center of this process. And that's why in some ways when there were discussions about the UN taking over the internet, there was a concern that there would be more governmental control starting to be introduced into this process that was not centered around governments. And so there was a concern that you'd have much more government involvement than many people are comfortable with.

Cogburn’s opinion on how internet governance is evolving:

There are governments who don't like the private, the civil society playing a role, and a prominent role, in these spaces, and so they're pushing back against the spaces that have been opened up for civil society participation. And it's unfortunate that that's the case.

INTERVIEW TRANSCRIPT

Rebecca Cruise: Derrick Cogburn, welcome to World Views.

 

Derrick Cogburn: Thank you very much. My pleasure to be here.

 

Cruise: You're an expert on internet or cyber security, and I think perhaps that's where we should start is trying to understand exactly what we're talking about when we're talking about cyber security. You know, we hear a lot of information about breaches, and there certainly have been some of late, data breaches. And then, on the other hand, we hear about kind of cyber warfare between states or perhaps other non-governmental organizations, and there's certainly a fear of that. But what exactly are we talking about?

 

Cogburn: Right. Well I would broaden it out to start to talk about broader internet governance, which is a broader way to think about cyber security and cyber policy. And internet governance really takes us to the technical side, the policy side and the implementation of the protocols related to the internet and the content and the policy areas related to governing the internet. And all of that is related to creating opportunities for people to both share resources, share content, but also it opens up those possibilities for the breaches that you talked about earlier, as well. So it really takes us to thinking about how is the internet governed? What are the underlying technologies and protocols that allow the internet to work? And again, by opposition, to be to be taken advantage of. And then what are the policy issues related to the Internet as well?

 

Cruise: OK well then let me ask the obvious question: how is the internet governed?

 

Cogburn: Well some say it's not governed. [laughs]

 

Cruise: Well a lot of people argue, of course, that it shouldn't be and then there are others that say it should because of these...

 

Cogburn: Absolutely.

 

Cruise: ...these breaches or other nefarious activities that can take place on the internet. But, as you say, I think it's important that it's how we monitor it that lets us understand how it can be used positively and negatively... but how is it governed?

 

Cogburn: ...and all the different roles that different actors might play as well.

 

Cruise: Absolutely.

 

Cogburn: So, you know, many people are increasingly using the internet, and it becomes something that they rely on for how they live, how they work, how they entertain themselves. And most people don't know how it works, and don't understand...

 

Cruise: That's the understatement... [laughs]

 

Cogburn: [laughs] Exactly... the underlying complexity behind it... And if you think about it, it's a global resource. And that's one of the things that makes the internet so valuable is that it is, in fact, a global resource, and that you can pick up a smartphone and send the message or a video to somebody anywhere in the world. That has also allowed for civil society groups around the world to be able to share information and videos about things that are happening on the ground. And so there's a set of underlying protocols that enable data to be digitized and broken up into packets and sent in various ways around the world, using the underlying telecommunications infrastructure that the Internet rides on top of, and then to be reassembled at its location. And so all that happens almost instantaneously through fiber optics and this digitisation process.

 

So the protocols that allow that to happen, new protocols that evolve to make that process more secure, happen through technical communities who debate these protocols. And there are all kinds of acronyms and alphabet soup related to how that happens, from ICANN (the Internet Corporation for Assigned Names and Numbers), the Internet Engineering Task Force, the Internet Governance Forum (the IGF). And so on, and on, and on and on. And so you have the need for different kinds of experts to come into this process. So you have the communications experts, the technology experts, the protocol experts, and then all of the content areas experts that all come together. And so, if you were to say what's the center of this governance process? In some ways it is ICANN (the Internet Corporation for Assigned Names and Numbers) because that's where the technical aspects of assigning domain names, and assigning IP addresses, and the matching process, the root zone file that matches the IP numbers, the IP addresses, those series of you know one to eight point one two for, that IP address, with the domain name, like OU dot edu, and that links those two together. So it's the Internet Corporation for Assigned Names and Numbers is in some ways at the center of that process because of what they do on that, in that aspect, but there are a whole range of other organizations that contribute to Internet governance, contribute to the principles and the values related to governing this resource.

 

Cruise: And these are made up of state stakeholders? Or they're scientists? Or technicians? Or everyone in-between?

 

Cogburn: So that's one of the things that makes it so unique is it's a multi-stakeholder process. So governments play a role, but they're not at the center of it. The only government that has been at the center of this has been the United States government in some ways, and we can talk about that.

 

But if you look at when ICANN was created in 1998, you have a role for governments in something called the Government Advisory Council. But it's not a the center of this process. It's the technical community, the user community, and the private sector, and governments that all play a role. But governments are not at the center of this process. And that's why in some ways when there were discussions about the UN taking over the Internet, there was a concern that there would be more governmental control started starting to be introduced into this process that was not centered around governments. And so there was a concern that you'd have much more government involvement than many people are comfortable with.

 

Cruise: So what are the advantages... You kind of alluded to some of them, but the advantages of governments not being quite so involved?

 

Cogburn: Well you know all governments are not equal in terms of their principles related to privacy, and security and openness, and democracy, and transparency and these kinds of issues. So when you did have the United States playing the unique role... You know most people probably know the Internet was developed here in the United States. It was came out of the Advanced Research Projects Agency and the Defense Advanced Research Projects Agency. So ARPA and DARPA played this you know tremendously important role in developing the protocols for for the Internet.

 

You had contracts with the Department of Commerce that led to the continued growth and development of the Internet. And these unique relationships of the U.S. kind of guaranteed a certain sense of openness and transparency, security and stability, and that this would function. And this was something that all of us wanted was we wanted this to function. We want to be able to pick up our phone or to send a message in it get there. As other governments start to come into play, you can't guarantee that level of openness and transparency and consistency.

 

Cruise: So places like China, Egypt...

 

Cogburn: Absolutely. And so when you have a venue like the United Nations where it's one country one vote, and you have this equal opportunity for countries to weigh in and to slow things down and so forth, you run into that problem. So that's why we don't want governments to be at the center of this at all.

 

Cruise: Sure. How does that lead to governance though? If you have states that are perpetrators of some sort of cyber crime, or spying, or something along those lines, how do these organizations... How can they either reprimand or I don't know go after these states?

 

Cogburn: Sure. So we talk a lot about governance without government. So we don't have a world government. So how do we govern this process? So there are a number of ways to look at it. I tend, in my work, to use international regime theory to help us understand this. And regime theory tells us that if we have a convergence of expectations around principles norms values we start to have the groundwork of an international regime of governance mechanism, and then do we have any enforcement capabilities? And this makes a stronger regime or a weaker regime. And in some ways we have very limited enforcement mechanisms, and that's one of the things that weakens our approach to Internet governance, because we don't have the ability to really enforce some of the decisions that are made.

 

But we do have a number of vehicles that help facilitate the governance around the convergence of principles and norms and values. And one of the things that the Internet Governance Forum, which is now in its what 12th year I guess, or 11th... 12th year, I guess. It's starting in December... Gives us a way for these multistakeholder actors to come together and represent themselves, not their governments or their companies, but to represent themselves in this U.N. sponsored forum. And all these issues, from security to development, are discussed at the Internet Governance Forum. So the next one is coming up in December in Geneva. And this is where we have this these debates that take place and where you have a convergence of expectations. Now the actual governance, so the allocation of resources, doesn't happen there. No decisions are being taken within the Internet Governance Forum. That's happening in these other parts of the Internet governance ecosystem like ICANN, like the Internet Engineering Task Force, like the Worldwide Web Consortium, where all of these different issues are taking place.

 

Cruise: Well you mentioned that they come together and talk about a number of issues, and I think one of the issues that has come up of late is concern about the dark web? Obviously the deep web and the dark web are two different things .  The dark web we're talking about were still relatively small percentage of very nefarious things that are potentially taking place. I teach on illicit trafficking, and so we have spent some time going over this. Are there things in place to try to mediate what's happening on the dark web?

 

Cogburn: Well I will say that people sometimes tease me because I tend to focus on the positive aspects...

 

Cruise: Which is great...

 

Cogburn: I focus on how we use the Internet and the web for collaboration and, you know, to enable multi-stakeholder actors to be able to participate in these processes

 

Cruise: And activism on the dark web...

 

Cogburn: Absolutely. I focus a lot on activism. You know and I focus on, you know, accessibility, you know, on the web. So I don't focus focus as much on the dark web. It is certainly a an ongoing aspect of the web and how people are using these hidden spaces on the web to engage in human trafficking, and child pornography, and all of these negative aspects of the internet and the web. And I don't focus on them as much. So...

 

Cruise: Fair enough. Fair enough.

 

Cruise: One of the ways that we think about doing business on the the dark web has been bitcoin, and that seems to have... It's part of the dark web, but it looks like it's becoming more an everyday common occurrence. It's uh, I think an obvious idea of what Bitcoin is a virtual currency, although it's much much more confusing than that. But I've had my students ask and so I'm going to ask you: is this the way of the future? Are we going to move towards some sort of virtual currency, if not bitcoin something else?

 

Cogburn: I would think absolutely. And so one of the ways it enables this activity in the dark web is the anonymity that comes with it. And so if you look at, you know, Bitcoin as being able to provide kind of a ledger of these relationships and these transactions that enables people to pay for things in an anonymous way and essentially an untraceable way, which you know gives many of our agency's concerns around, you know, how do you you know trace these transactions as well? But there is clearly a need for it both in these nefarious spaces, but also in legitimate spaces, as well. To be able to have this kind of virtual currency that is out outside in some ways of, you know, the traditional banking system... You know to be able to share resources and to pay for things as well. So I think that this is absolutely going to become an increasing increasingly important part of how we think about the web. Universities, you know, wanting people to pay for online, open courses, you know, for example and tracking did you pay for it or not? And do you get the certification that might come from that process or not? So I think absolutely it will become an increasingly important part of what we do. A number of my students are asking you know I want to focus on Bitcoin. You know it's really growing as one of the key areas in this space.

 

Cruise: I feel like we hear about it all the time. So some positive things coming out of that. What other things should we look for in the future of Internet governance?

 

Cogburn: So I think that the multi-stakeholder participation will become increasingly important. There is a growing push-back against involvement of civil society and private sector in some of these spaces. You know there are governments who don't like the private, the civil society playing a role, and a prominent role, in these spaces, and so they're pushing back against the spaces that have been opened up for civil society participation. And it's unfortunate that that's the case.

 

Cruise: Absolutely.

 

Cogburn: So I see that as happening. You know a lot of the work that I do focuses also on persons with disabilities so I'm executive director of the Institute on Disability and Public policy, as well as directing our Internet Governance Lab. So a lot of my work is pulling these two areas closer and closer together, and so with a focus on the needs of the more than 1 billion persons in the world with living with some form of disability, I think we're going to have to focus more on accessibility around the Internet and ensuring that the standards are in place to enable persons with all types of disabilities to engage appropriately online as well.

 

Cruise: And certainly there are ways to enhance their learning as well.

 

Cogburn: Absolutely. So I don't know if you know, you know, part of what has kept me busy for the last seven to eight years is we built one of the first virtual graduate institutes on disability and public policy in the world. We built American University's first fully online master's degree and on disability and public policy. Now there are multiple online degrees. And it was the first fully online master's degree in disability and public policy. All online. And so we've had cohorts of students who are blind and visually impaired Deaf and Hard of Hearing and mobility impaired all living in Southeast Asia taking our online master's program, and now we've turned that over to our partners in Southeast Asia. We expect more of that to continue to happen.

 

Cruise: It certainly seems that there are endless possibilities here... Very positive outcomes we can look forward to.

 

Cogburn: Absolutely I think so.

 

Cruise: Great well thank you so much for your time today. Thank you.

 

Cogburn: You're welcome. Thank you.