In April, Spanish police charged a man with a massive distributed denial of service (DDoS) attack on anti-spam watchdog, Spamhaus.  He enlisted help from hacker friends and they slowed big parts of the Internet.  Also in April, LivingSocial said it suffered a cyber attack that exposed names, e-mail names, birth dates, and encrypted passwords for 50 million customers.   Between December 2012 and now, an international crew hacked credit card transaction processers and set up a $45 million cash haul.  Hackers are doing massive damage.

The Internet’s current design leaves us exposed to hacker attack because it allows anyone to assert a false identity, help themselves to information that isn’t theirs, and damage other’s property.  It was designed for open exchange of memos and data among academic researchers at DARPA, not for secured communications.

Major stakeholders are resistant to Internet design changes because their investments were built around today’s flawed design.  For example, even a highly constructive change such as IPv6 (which allows for more Internet destinations) faced foot-dragging.  Design changes that enforce strong identity verification may take several decades, and we can’t just change a few lines of code to flush the hackers from the system.

While we allow hackers to profit and to face inconsequential punishment, they will continue attacking.  Sternly worded speeches on the evils of hacker theft and attacks are worse than useless — they may convince a gullible audience that politicians will handle the problem.  It’s not that easy.   Without redesign, halting attacks depends on the hacker’s identity and protector.

When domestic hackers are arrested, court progress can be delayed by a defense attorney working the motions and appeals processes.  Some even argue that violating “terms of service” agreements are not a crime.  Other gambits claim the perp is a modern day saint – exercising first amendment rights; or have fellow “hactivists” invent socially redeeming intentions for their crimes while relying on the media to downplay the theft and vandalism of other people’s property, or hoping the readers are unaware that there is no first amendment entitlement to vandalize private property.  When convicted, these perpetrators are released or briefly incarceration.

The bitter irony is that hacking victims bear the direct cost of the crime, usually the cost for the perp’s public defender, the cost of incarcerating the perp, and often the cost for post-release welfare payments to the perp.  Until law forces a mandatory sentence of bankruptcy-proof full restitution for court costs and victim damages, the gain from hacking will continue to outweigh the pain from being caught.

It is more difficult to bring offshore hackers to justice.  A foreign commercial hacker who is pursued by U.S. police may attract support from other hackers, nationalist activists or politicians.  A U.S. decision to press forward with arrest has implications for international relations, dragging in the Department of State, muddying up the choice of jurisdiction, and perhaps converting the perp into prisoner exchange fodder.  Attorney costs, incompatible codes of law, and high profile opportunities for political narcissism push “justice” beyond reach.

State-sponsored hackers such as the Iranians and Chinese are beyond the reach of U.S. courts so must be handled differently.  Avoiding media coverage, we need to determine how reliably we can defend against the sovereign hackers and how severe the damage done by the hacking might become.  If we cannot defend against it or cannot tolerate the potential damage, then we should demand an immediate end and threaten painful retaliation (e.g. hobble the sponsor country’s communications, or banking system, etc…).  The big stick is necessary.  Stuxnet was a successful example of a big stick, even though no country has admitted ownership of it.

Letting a hacking sponsor off the hook in return for his promise of future righteous behavior is out of the question — which politician would be crazy enough to rely on the word of a proven sneak capable of harming us lethally?

Taking slack out of the post-arrest treatment for hackers is a useful project.  But redesign of the Internet so that it enforces identity verification is far more productive.

Alan Daley is a retired businessman who lives in Florida and who writes for The American Consumer Institute Center for Citizen Research

The reporter stayed in the courses long enough to grade them.  He gave his MOOCs an A grade for convenience.  He assigned a B grade to professors, assignments, student-to-student interactions, and the overall experience.  Teacher-to-student interactions earned a D grade.  Clearly better teacher access needs to be addressed.

Unionized faculty at all three California higher education systems oppose offering equivalent academic credit for MOOCs – even for students shut out of on-campus classes.  Some professors ridicule MOOCs as suitable to college “autodidacts” but unsuitable for others who need the “small liberal arts institutions that provide convenient social and academic engagement opportunities for students.”  To the contrary, students who lack access to $50,000 per year of someone else’s money will probably learn to thrive in MOOCs.

Constructive critics note that “online courses taught by professors at local universities can cultivate autonomous learning strategies and create opportunities for student-to-student engagement as well as student-to-professor engagement.”  This is already happening and it addresses the teacher-student interaction shortcoming.  A course offered to San Jose State engineering students is “circuits,” a difficult course where only 59% pass the traditional lecture version.  When offered as an MIT-authored MOOC with some traditional classroom time, 91% of students passed.  Children now in K-12 will likely acquire the skills needed to learn from MOOCs.   That should be an important goal for K-12 teachers.

It is unclear whether a MOOC-centric online degree will be seen as competitive in the job market against a bricks and mortar degree.  Professors with stellar reputations and schools with world class resources are investing themselves in MOOCs.  Students who proved they can interact virtually with others and thrive with challenging content online may have an advantage in some industries such as finance, engineering and marketing.

This week, the online education community received a proposal that would allow “any institution that had received state authorization for its online programs, based on certain quality and consumer protection standards, [to] be allowed to enroll students from other states that met the same basic standards and agreed to reciprocity.”  Udacity, EdX and Coursera are all offering proctored exams, and in some cases, certification for transfer credit through the American Council on Education.  Grants of state authority for these “schools” to operate are a financial issue.  States charge online schools more than $10,000 for authorization to operate in 5 nearby states for a few hundred students, up to $5.5 million for a public university to operate in 49 other states.  The state-imposed financial hurdle is inconsistent with keeping courses affordable.

Faculty resentments against MOOCs come from fear of being marginalized – being shunted from their prestigious lectern to a headset in a call-center.   But MOOCs benefit everyone else.  MOOCs can vastly improve access for underserved students of all ages and budgets since MOOCs can reduce the college’s costs and tuition prices.  Cash strapped states will see MOOCs as a budget victory.  Perhaps “big education” will encourage MOOCs evolution, even though it may cost entrenched union jobs.

Alan Daley is a retired businessman who lives in Florida and who writes for The American Consumer Institute Center for Citizen Research

Online Taxation to Crush Competition

On Monday, the Senate voted to take up the Marketplace Fairness Act, the bill that would force Internet retailers to begin collecting sales tax on purchases made online. Currently, Internet retailers have no obligation to collect sales tax, as the process would be a burdensome and arduous task, on both the businesses and consumers. The Senate could take a full vote later this week.

The bill’s name is a misnomer, because it’s anything but fair. As I explained in a previous blog post here at ACI, the bill would allow sales taxes to be collected by states from companies that are outside of their jurisdiction. So for example, Internet retailers found in California would have to abide by the tax jurisdictions in New York, Virginia, Illinois and all other states, as well as all city and municipal tax jurisdictions.  In all, it amounts to 9,646 different tax codes that Internet retailers would have to adhere to.

This obviously puts small businesses that operate on the Internet at a major disadvantage. Brick and mortar stores only have one, maybe two, tax codes to deal with. And Internet giants, like Amazon, have teams of lawyers, accountants and consultants to help guide it through the maze. Small businesses don’t have that luxury. They struggle as it is against larger retailers.  

The result of this legislation would potentially put small and medium sized business out of business or forced these businesses to raise their prices to cover costs.  Either way, consumers lose — they’ll either have to pay higher prices at the small businesses, or be faced with less choice as the small businesses are forced to shut down.

If you had any question over who would benefit and who would hurt if the bill were enacted, just take a look at who’s lining up on either side of the bill.

In favor of the bill are the Internet and brick and mortar giants—names like Amazon, Best Buy and Wal-Mart. These big businesses have lined up teams of lobbyists to push this bill through. If they can take out any competition before it gets too big, they stand to increase their bottom line by cutting out competition. This gives less choice to consumers, which in turn gives potential to raise prices with no check from the competition that doesn’t exist anymore because they were driven out of business.

It also can’t be a coincidence that Amazon sells tools for small businesses to attempt to comply with the regulatory demands that come with abiding by the 9,646 tax jurisdictions. There are others who have been around Washington longer, but I’m not sure I’ve seen such an agreement between Big Government interests and Big Business interests. Both will harm the consumer.

On the other side, you have companies like eBay, who help small businesses to connect with their customers. They’ve been opposed to the bill from the beginning, even sending out a system-wide email to their members warning what could happen to small businesses and consumer choice should this bill pass. As eBay points out in their letter, the bill would put single employee stores and Amazon in the same category—without taking into consideration the vast resources at Amazon’s disposal which allows them to jump through administrative and regulatory hoops. 

Another glaring example of the corruption inherent in this bill is an anecdote from a Reuters story—how one man who runs a fly-fishing business will be forced to move his business from eBay to Amazon, as Amazon could run his fulfillment and tax compliance.

I don’t know if you can find a better example of a business using big government to take out a rival.

If government was really concerned with leveling the playing field for Internet retailers and brick and mortar establishments, there are plenty of other solutions. There’s origin-based sourcing, which allows states to collect sales tax on where the Internet retailer is headquartered—the same way a brick and mortar establishment is taxed. Bottom line is this bill is bad for consumers and bad for small businesses – which means that it is also bad for the economy.

Congress should look at alternatives to this poorly conceived bill.

Zack Christenson writes on digital tech issues for the American Consumer Institute Center for Citizen Research, a nonprofit think tank.  For more information, visit www.theamericanconsumer.org.

You are no longer permitted to grab your rifle, saddle up, and drag the varmints back on a rope.  A private army is out of the question.  Instead we rely on policing agencies empowered for cybercrimes or cyber-terrorism.  In turn they hunt cyber-perpetrators with tips from other victims or allies (e.g. Internet service providers) who report suspect behaviors.    

That cooperation among government agencies and private companies is what Cyber Intelligence Sharing and Protection Act (CISPA) authorizes and protects from lawsuits.  There are some other nitpicky issues, but most opposition comes from those who fear CISPA could reduce our privacy when, a private company shares crime-related customer-specific information with the government.  Let’s pretend “tracking” you isn’t the main revenue for the biggest search firms. 

Instead of donated tips, government could get a court warrant for suspected US criminals or a FISA warrant for suspected foreign terrorists.  There are plenty of US cyber-perps who’d like to be seen as 1^st amendment saints.  The warrant alternative presumes they know whom to investigate, and that they get the warrant without delay – at Internet speeds – unlikely whenever a court or opposing attorney is involved.

For consumers it would be ideal to have zero loss of privacy and zero loss of safety.  But in the wake of any real world crime against you, the investigator will ask for a lot of personal identity and information like — “where were you”, “who has motive”, and “who else might be involved.”  Innocent as you are, the victim might name you as a potential witness.  Likewise, in return for flying on a commercial flight, your identity and person will be scrutinized.   To obtain a credit card or loan, you will hand over massive personal detail.  To obtain a driver’s license, you will share more information than just your name and evidence of driving skill.  Routinely, you or others share some of your private information for a privilege, an advantage, or some security. 

Unfortunately there’s no accepted quantifying method for measuring privacy lost and safety lost.  So there’s no repeatable measure of each new law’s shortfall from full privacy and full safety.  Minimizing the loss of privacy is a reasonable goal, but we cannot abandon safety due to privacy concerns.  Some will not agree.  Those who rank privacy as a modern day deity will say tradeoff is the wrong answer.   And, the opinions from wannabe hackers or those who parrot what the cool kids say – just don’t align with consumer’s interests.  

Some businesses already cooperate with government national security entities.  A few get the occasional national security letter, but share whenever Internet events merit it.  In my experience, Internet businesses that would be involved in the operation of CISPA can estimate the costs of CISPA versions and they will let legislators know how to avoid the worst outcomes.  Their press releases will, of course, feature socially redeeming platitudes.   

CISPA may be the right vehicle for balancing privacy and safety through information sharing with private companies, but perhaps it is not.  Certainly, no bill worth passing will give 100% privacy and 100% safety, and inaction is the wrong answer. 

Alan Daley is a retired businessman who lives in Florida and who writes for The American Consumer Institute Center for Citizen Research

Literally hours after Google made their announcement, AT&T announced plans to do the same—if they were given the same deal that Austin and the state of Texas gave to Google. In a statement, AT&T said:

AT&T’s expanded fiber plans in Austin anticipate it will be granted the same terms and conditions as Google on issues such as geographic scope of offerings, rights of way, permitting, state licenses and any investment incentives.

This is important, because we know that in Kansas City, Google was given a preferential deal over other telecom providers. Google was given easier access to rights-of-way, given easier access to poles, provided city staff devoted to Google’s service, afforded fast-tracking of permits and faced very little build out restrictions, among many other advantages that most telecoms, like Comcast or Time Warner or AT&T, don’t get. The local government has provided an uneven playing field and set up an uncompetitive landscape. AT&T is rightly pointing out that reducing the regulations and barriers to entry, and providing the same terms to all parties involved, is better for consumers.

Thankfully in the Austin scenario, city officials have pledged to provide the same terms and deals that it offered to Google to anyone else who wants to provide the same service. But one analyst quoted in a Reuters story wonders that with Google now facing a potential competitor, whether they will even bother to come to Austin after all. Google has enjoyed almost zero competition in almost every facet of its business—having a strong competitor could make it bow out.

Telecom companies are made to jump through hoops to enter any new market, doing things like giving away free service to community centers, paying for light bulbs on street corners, planting trees or building community centers. In the case of Google in Kansas City, it appears the opposite was done.

As the Institute for Policy Innovation rightly points out, no matter how great the Investment Google is making, this is terrible policy—titling regulation in one way or the other to favor one company over the other. By cutting special side-deals, some city governments are creating a barrier to investment and inhibiting competition. That is the last thing you would want, assuming that further broadband build-out is the goal.

Zack Christenson writes on digital tech issues for the American Consumer Institute Center for Citizen Research.