Monday, June 18, 2012

Anonymity and the public internets

There is a pervasive myth that the public Internets provide anonymous access.  This implication of an ability to say anything you want without being able to be identified causes some people to do and say things they wouldn't otherwise.  The current situation is such that this isn't really true, but the future is upon us.

The Internet, that collection of autonomous networks using the IP protocols, is not, and never was, a place that one could just hook up a computer and go without having to ask permission.  The requirement that each machine has to have a unique numerical ID number in order to communicate with any other machine means that there is a traceable means of finding the source of the traffic.  There are some anonymous nets out there, via The Onion Router (TOR) and similar methods, but even there, there are certain vulnerabilities that can reveal the real IP address of the source in some cases.  Additionally, somewhere on the other side of TOR, there is a real IP address that the machine has to use before it gets into the cloud.

A little history may be in order.  The original ARPAnet, from whence sprang the Internet, was strictly regulated.  Sites had to have a reason to get a connection, and the rules required some rather tight controls on the users who were to have the privilege to use the net.  (I almost got to use ARPAnet, a site I was associated with was due to get an ARPAnet IMP just about the time it morphed into the Internet; subsequently that site was one of the early additions to the public internet and I was an early participant in that.)  Even so, the machines and users were enumerable and recorded.

As the internets grew, each additional machine and its administrators signed contracts and authorizations that provided a traceable authority structure.  Even today, one doesn't just get on the net without someone accepting a delegation of authority to ensure that the rules will be observed.  That someone may take a great deal of risk -- such as in the case of "free Wi-fi" in a restaurant or bar  -- but there is a delegation of authority on record for all the connections.   For another example, I am sitting here at home connected to Google Blogger using an IP connection. I have a contract with the Internet Service Provider who gives me the IP address, and they keep track of the amount of traffic I use; they also have logs that show each time my modem connects and gets the IP address.  They may not know exactly where I am physically, but they know how to get in touch if they need to do so.

If one were to egregiously break the law (for example post "child pornography") the state could exert its authority and catch up with the perps eventually.  The perps could use an anonymizing service to hide in the "Dark Net" but they had better be damn careful to not let any clues leak that would let the authorities make a connection to their real IP.  It is more a matter of there being too much information to sift through that keeps the authorities from spending the resources to find the perps.

The current version of IP addresses (IPV4) is limited to a single 32-bit number, providing over 4 trillion possible addresses.  This seemed to be big enough back in the 1970s, but here we are in 2012 and the IPV4 address space is exhausted.  There are stopgap methods in use that allow the continued growth of IPV4 addresses; right here at my place there are 10 devices sharing the one IP address given to me (and I could actually have several million addresses in my private space, but it would not be efficient or fast.)  This gives some inkling of the vastness of the numbers.

The next generation of IP addresses (IPV6) expands the size of the number to 128-bits (about 3.4 x 10 to the 28) and the whole of the IPV4 address space is adsorbed into it.  This amplifies the problem the authorities face in having too much information -- the FBI and the UN/ITU are whining already.  They are, however, insisting that method have to be developed to assist them in their attempts to keep up with the technology.  In many places the state will seek to control the deployment in such a manner so that they can preserve (an illusion of) control. 

I wish them the best of luck in their efforts, they need all the help they can get.

No comments:

Post a Comment