Person:

Palfrey, John

On November 6, 2008, the J. Michael Goodson Law Library at the Duke University School of Law held a number of events in celebration of its newly renovated and expanded space. This is an edited version of the program, "The 21st Century Law Library: A Conversation," that was held as part of that celebration. The conversation explores the role of the academic law library in legal education in an increasingly digital environment.

In the twenty-first century, a state can come to know more about each of its citizens via surveillance than ever before in human history. Some states are beginning to exercise this ability. Much of this additional surveillance ability derives from enhanced access to digital information. This digital information comes in the form of bits of data that flow through both rivers and oceans of data. These rivers are full of information that passes by a given point, or series of points, in a network and can be intercepted; these oceans are also stocked with information that can be searched after the fact. These data are held in private hands as well as public. The most effective (or invasive, depending upon your vantage point) new forms of surveillance often involve a search of data held in a combination of private and public hands. Both private and public entities are increasingly encouraged to retain more data as a result of legal and market pressures. There are essentially no Fourth Amendment protections for U.S. citizens whose data is collected by a private third-party and turned over to the state. Nor are there such constitutional protections for the re-use of privately collected data by state actors. The few statutory provisions that protect citizens in these contexts are out-of-date and riddled with loop-holes. This inquiry prompts hard questions about the need to redefine the public and the private in a digital age. The meaning of the public and the private is changing, in material ways, both from the perspective of the observer and the observed. We need to rethink legal protections for citizens from state surveillance in a digital age as a result of this third-party data problem.

This paper, one of three case studies in a transatlantic research project exploring the connection between Information and Communication Technology interoperability and eInnovation, considers the current state and possible evolution of Digital Identity. While consumers would undoubtedly reap convenience benefits from an ubiquitous single sign-on (SSO) technology, the potential for privacy and security issues makes Digital ID a complex issue. The user-centric, federated, and centralized models of Digital ID each have their advantages and drawbacks. While a few companies have previously attempted to establish a single Digital ID standard that they would control, the failure of those efforts has led to a situation where most players in the industry seem to see interoperability as essential to build up the market in the face of frequent ambivalence from consumers, e-commerce merchants, and other potential users.

Broadly, Digital ID could enable a wide range of new Web-based applications, increasing consumers' flexibility and reducing transactions costs. However, having Digital ID be too ubiquitous could threaten the continued viability of anonymous speech in some contexts. It could also lead to more entities having greater access to personal data of consumers, raising the stakes of potential data breaches.

The paper concludes that the route to interoperability most likely to lead to innovation would include continued collaboration among industry players to settle on one or a few consolidated efforts. Except in special areas, governments can best play a peripheral role, encouraging coordination through soft regulatory approaches like bringing stakeholders together and using their market power as major data holders and users. If privacy and security issues are addressed (and current stakeholders seem acutely aware of them), Digital ID interoperability has the potential to be extremely generative, creating new markets and enabling interoperability among other applications and services. If, however, coordination breaks down among market leaders and rival technologies emerge, it seems likely that user adoption will remain low and the benefits will be limited.

China's Internet filtering regime is the most sophisticated effort of its kind in the world. Compared to similar efforts in other states, China's filtering regime is pervasive, sophisticated, and effective. It comprises multiple levels of legal regulation and technical control. It involves numerous state agencies and thousands of public and private personnel. It censors content transmitted through multiple methods, including Web pages, Web logs, on-line discussion forums, university bulletin board systems, and e-mail messages. Our testing found efforts to prevent access to a wide range of sensitive materials, from pornography to religious material to political dissent. We sought to determine the degree to which China filters sites on topics that the Chinese government finds sensitive, and found that the state does so extensively. Chinese citizens seeking access to Web sites containing content related to Taiwanese and Tibetan independence, Falun Gong, the Dalai Lama, the Tiananmen Square incident, opposition political parties, or a variety of anti-Communist movements will frequently find themselves blocked. Contrary to anecdote, we found that most major American media sites, such as CNN, MSNBC, and ABC, are generally available in China (though the BBC remains blocked). Moreover, most sites we tested in our global list's human rights and anonymizer categories are accessible as well. While it is difficult to describe this widespread filtering with precision, our research documents a system that imposes strong controls on its citizens' ability to view and to publish Internet content. This report was produced by the OpenNet Initiative, a partnership among the Advanced Network Research Group, Cambridge Security Programme at Cambridge University, the Citizen Lab at the Munk Centre for International Studies, University of Toronto, and the Berkman Center for Internet & Society at Harvard Law School.

As the Internet has exploded over the past fifteen years, recently reaching over a billion users, dozens of national governments from China to Saudi Arabia have tried to control the network by filtering out content objectionable to the countries for any of a number of reasons. A large variety of different projects have developed tools that can be used to circumvent this filtering, allowing people in filtered countries access to otherwise filtered content. In this report, we describe the mechanisms of filtering and circumvention and evaluate ten projects that develop tools that can be used to circumvent filtering: Anonymizer, Ultrareach, DynaWeb Freegate, Circumventor/CGIProxy, Psiphon, Tor, JAP, Coral, and Hamachi. We evaluated these tools in 2007 -- using both tests from within filtered countries and tests within a lab environment -- for their utility, usability, security, promotion, sustainability, and openness. We find that all of the tools use the same basic mechanisms of proxying and encryption but that they differ in their models of hosting proxies. Some tools use proxies that are centrally hosted, others use proxies that are peer hosted, and others use re-routing methods that use a combination of the two. We find that, in general, the tools work in the sense that they allow users to access pages that are otherwise blocked by filtering countries but that performance of the tools is generally poor and that many tools have significant, unreported security vulnerabilities.

The report was completed in 2007 and released to a group of private sponsors. Many of the findings of the report are now out of date, but we present them now, as is, because we think that the broad conclusions of the report about these tools remain valid and because we hope that other researchers will benefit from access to the methods used to test the tools.

Responses from developers of the tools in question are included in the report.