August 22, 2007 | Posted By : Liam Eagle at 9:06 PM PERMALINK | Blog Comments (0)

Internet Privacy, Online Crime and Terrorism

Remarkable story in the Globe and Mail this past weekend – remarkable in part for its length (it’s roughly 3,600 words. So set aside a few minutes to read it), but also for its expansive dissection of the emerging new battle ground for the “war on terror.”

In the piece, Globe reporter Omar El Akkad, who apparently has established a certain degree of expertise in the online activities of terrorist organizations, explores the online propaganda war that has become a major part of worldwide terrorist activity.

Given the Globe’s focus, the article pays particular attention to the possible role of Canada in the distribution. It points to examples of companies like Tucows and a Canadian arm of Register.com being used by terrorist-supporting websites to disguise registration information, so the registrants of addresses used to distribute material including videos glorifying terrorist attacks can’t be easily uncovered by a simple whois lookup.

The domain privacy issue, of course, is a minor bookend to a much larger article. And not a serious impediment to justice. Most of us are quite aware that a friendly “you appear to be providing private registration services to an arm of al-Qaeda” email is probably enough to get a domain name pulled in most cases. And the registrars providing the privacy services have the accurate registrant information.

Private registration services aren’t enabling terrorism. But they’re emblematic of a larger problem with law enforcement efforts to combat terrorism online:

“Even on the traditional counterterrorism front, law-enforcement officials are coming up against a major wall: For the most part, the legal system was not designed for cyberspace.”

Akkad uses the example of child pornography or neo-nazi material, other widespread online causes for concern. Law enforcement was behind on fighting each of these.

“In the case of child pornography… there was a lag of about five to seven years before independent groups began forming for the purpose of shutting illegal sites down. The delay might be equally long with terrorism sites.”

Ultimately, this article ought not to teach you about how to run your business. But it could open your eyes to another possible offense that could be taking place on your servers.

Print | Send | del.icio.us | Linking Blogs

June 14, 2007 | Posted By : Liam Eagle at 6:35 PM PERMALINK | Blog Comments (0)

Trojans, Sinister Links and the Material on the Sites You Host

Quite a few news sites have commented this week on a report from Sophos that cyber criminals are using access to otherwise-legitimate sites to promote access to promote illicit material.

Specifically, Sophos points to medium of message boards and the material of child pornography, sort of the gold standard of despicable Internet content.

Sophos’s point, in particular, is that Web hosts should take steps to monitor the material that goes up on the sites they host.

According to the report, all of these posts appear on legitimate Web sites (in one case a site designed for children).

“The posts are all found on message boards within these websites. All contain offensive words and hidden links to the pornography sites.”

While ordinarily these sort of tactics would be used to install malware on users’ machines, the involvement of child pornography gives the issue an added bit of sinister import.

One of the quotes supplied in the press release:

"Some of the same techniques that malware authors use in order to infect victims with malware are being used to distribute links and drive traffic to all sorts of web content," continued Howard. "The fact is that any unprotected website can be targetted by cybercriminals trying to spread their malicious content. It is essential that web hosts remain vigilant for hackers' attacks, and deploy security solutions to defend against new and emerging threats."

The question here is one that isn’t made entirely clear by the press release itself. Are Web hosts responsible for content posted to the sites they host? And responsible how? Legally? Well, David Snead would be the man I’d turn to for the answer to that question. But I’d bet his answer would be something to the effect of: not really, as long as they make sure they have a policy in place for dealing with any copyright-infringing or otherwise-illegal material that is brought to their attention (including taking it down in many cases).

But perhaps what Sophos is proposing is an ethical question. Do hosts bear any social responsibility for taking steps to wipe something as disgusting as child porn from their servers? Maybe. But ought the operator of a message board not bear the initial responsibility for dealing with that kind of material? Are these message boards operating without moderators or administrators?

The question was made a little clearer by a post on the Sophos blog, which included some specific questions about the material:

1. Why are the message boards not scanning for offensive posts? 2. Why do the message boards allow JavaScript?

3. Why do the messages boards allow anyone to post?

These questions, again, would seem to put the operator of the message board under the microscope, and not the Web host.

However, it may be worth knowing that these violations exist. If you receive a complaint about one of the sites you host, you’ll know what you’re dealing with, and possibly where your customer may be lax in allowing posts to their site.

Print | Send | del.icio.us | Linking Blogs