A responsible internet: increasing trust in the foundation of digital societies (part 1 of 2)

The societal problem: increasing dependency, declining sovereignty

Economies and societies increasingly depend on digital services. This includes ‘ordinary’ services such as video conferencing, data storage and connected homes, but also emerging safety-critical services such as smart energy grids, self-organising supply chains and ambulances that in advance share sensor data with the hospital. While these kinds of services are widely expected to make societies safer, smarter, and more sustainable, there are also increasing concerns around the world about how they decline societies’ ‘digital sovereignty’. This is because the underlying computer systems and networks (e.g. algorithms, DNS services and network equipment) are increasingly manufactured or operated elsewhere, while organisations and individuals have limited insight into and control over how they depend on those systems. This is a problem because it ultimately limits the capabilities of societies to autonomously decide and act on how they use, depend on, and set up their digital infrastructure, which poses a risk to public values such as safety, transparency, privacy and democracy. The European Union Agency for Cybersecurity (ENISA) recently emphasised the significance and urgency of the problem in their report on Europe’s digital sovereignty. For example, they highlighted that the top 15 internet companies in the world (e.g. Google, Facebook and Alibaba) are from the USA or China and not one from Europe, and that European tech companies are often acquired by non-European ones (e.g. 53 were bought by US 'tech giants' between 2011 and 2016). The risks the agency identifies include Europe no longer being able to meet its citizens’ values and expectations, reduced competitive power, and a drain of technical expertise. The Australian government has similar concerns and will track the dependencies of their critical IT infrastructure under the Security of Critical Infrastructure Act, for instance in terms of company ownerships, composition of supply chains, and outsourced projects.

Relevant in multiple areas of technology

The problem of declining digital sovereignty is being addressed in several ways and in different areas of technology. For example, Artificial Intelligence (AI) researchers have developed design guidelines to make the decisions of AI algorithms more transparent and explainable through what they call 'responsible AI'. Similarly, the European Commission is driving the development of a European federated cloud service called 'GAIA-X' that aims to improve Europe’s data sovereignty. The European Commission recently also mapped out various policy instruments for areas such as 5G cellular access networks and the Internet of Things. In addition, there is an intensifying public debate about digital sovereignty that takes place at various levels, as illustrated by recent publications in the mainstream media on public policy making, AI and data sovereignty.

The internet infrastructure is the gap

While these developments illustrate that digital sovereignty is a widely acknowledged and urgent problem, we observe the discussion largely overlooks the internet infrastructure: the technical systems (e.g. routers, switches and DNS servers) that enable remote internet devices to communicate with each other and that all of the other 'layers' (policy making, AI, data) depend upon. The exception is the debate around the alleged security weaknesses in 5G equipment. According to the European Commission, these pose a risk to the strategic autonomy of the European Union, but 5G networks only cover the cellular access part of the internet infrastructure. The specific sovereignty problem in the Internet infrastructure is that users have no insight in, or control over how they depend on network operators and their systems, which ultimately poses a serious limitation for governments, institutions, companies, and individuals to decide how they can securely communicate. This is particularly relevant for critical service providers (e.g. power grids, transportation systems, mobile networks and manufacturing facilities), which have become increasingly dependent on computer networks. For example, such providers want to know if the internet routes their traffic through networks with equipment that might have backdoors. At the same time, internet users by design depend on third parties because the internet is a massively distributed and global system of some 70.000 autonomous networks. For example, during a typical website visit, users unknowingly make use of the services of several DNS operators, transit providers, cloud services, and content distribution providers, all of which may reside in different geographical locations and jurisdictions.

Our vision: a responsible internet

To fill this gap in the digital sovereignty discussion, we recently proposed the notion of a responsible internet, a novel security-by-design extension of the internet (or future networks) that offers users (e.g. providers of critical services or individuals) additional security-related options that give them a better grip on their dependencies on the internet, thus increasing their trust in and their sovereignty over internet communications. A responsible internet accomplishes this by making its networks more transparent, accountable and controllable. This means users can ask a responsible internet to provide high-level descriptions of the chains of network operators (e.g. ISPs, data centres and DNS operators) that potentially handle their data flows, for instance in terms of security and administrative properties, their interrelations and the management operations they carried out (transparency). A responsible internet allows users to verify that these details are accurate (accountability) and to subsequently instruct the responsible infrastructure to handle their data flows in a specific way, for example by allowing them to only pass through network operators with certain verifiable security properties (controllability). Our notion of a responsible internet is inspired by responsible AI, a design paradigm that focuses on giving people more insight into how AI systems reach decisions and why, for instance for parole and air pollution decisions.

Illustrative example: smart grid

Figure 1 shows an example in which the provider of a 'smart' grid (left) builds its services atop a responsible internet (the grey cloud in the middle). The grid provider uses a Security Operations Centre (SOC) to remotely control its energy stations in the field (right), for instance to connect or disconnect power lines. In a responsible internet, the provider’s SOC is able to show details about the security attributes of the chain of network operators that transport the commands the SOC sends to the field stations (operators 2, 4, 5 and 6) or that could potentially transport them (1, 3, 7, 8, 9), even if the grid operator has no business relationship with them. For example, the grid operator in Figure 1 buys internet connectivity from operator 2 for its SOC and from operator 6 for connectivity at power stations, but the SOC is able to get an operator description from the other network operators as well.

Figure 1. Example: grid provider using a responsible internet. NOD is short for Network Operator Description (e.g. NOD4 for operator 4).

A network operator description is a machine-readable electronic document that covers the properties of an operator that may impact the way it handles data flows. Examples include security properties (e.g. if the operator enables remote attestation of the security of its router software), administrative properties (e.g. jurisdiction and geolocation), relations with other operators (e.g. outsourcing relations), and operations that the operator has applied to its infrastructure (e.g. router security patches). For example, the SOC in Figure 1 could use the descriptions of operators 2, 4, 5 and 6 to verify that the router software on the path to the remote field station does not contain any backdoors (transparency) and to verify that all of these four operators installed the latest security patches on their routers (accountability). The SOC team subsequently uses the network operator descriptions to instruct the responsible internet to convey commands for remote field stations through any chain of network operators that meets the SOC’s requirements, such as that the routers on the path have been patched and have been scrutinised for backdoors.

A new style of internet communication

A responsible internet fundamentally changes the way organisations and individuals communicate over the internet, because the internet currently does not support the capabilities such as those available to the SOC in Figure 1. Instead, the internet is a 'black box' that only allows users to specify the remote endpoint where the network should send the data. The path is decided by mechanisms outside of user and even operator control. In terms of the example in Figure 1, this means that the grid provider will mostly not know which network operators its services depend on, and it will have little control over which classes of operator it would prefer to carry its traffic (e.g. based on the operators’ security postures). At the same time, the responsible internet that we envision will continue to follow the internet’s open, bottom-up and multi-stakeholder nature. Our notion of sovereignty is about service providers and individuals being more in control of their dependencies on the internet infrastructure. It is explicitly not about creating government-controlled or even isolated national networks (cf. the 'Beijing Internet' or the 'Moscow Internet'), nor is it about excluding technologies from specific regions.

A responsible internet benefits a wide range of users

The enhanced set of security-related options that a responsible internet offers will help not only critical service providers such as the grid operator in Figure 1, but also policy makers, network operators and ultimately individuals. Policy makers: the network descriptions that a responsible internet provides enable more data-driven and proactive policy making, mediation and enforcement. For example, they allow national policy makers to analyse risk areas in their local internet infrastructures (e.g. concentrations of power) based on historical data. Also, policy makers could feed network descriptions into a platform that enables critical infrastructure providers (e.g. power grids and transportation systems) to provide evidence-based feedback on the security postures of network operators. Network operators benefit from a responsible internet because its network descriptions enable them to handle large-scale security incidents more proactively. For example, a network operator in a responsible internet would include metadata in its description that indicates what parameters it measures regarding the DDoS attacks it has absorbed. As a result, it becomes much easier for other operators to find datasets on such attacks, which enables them to obtain better and more timely security information. Ultimately, this allows network operators to make better security-related decisions and increase the security and resilience of their services and those of their customers. A responsible internet builds such a collaborative approach to internet security by design into the network. Individuals: in the long term, we expect individuals to benefit from a responsible internet as well. For example, video conferencing users could request a responsible internet to show where their video flows end up, and potentially change their endpoint to a data centre in another region. Video conferencing provider Zoom recently built a feature like this into their service in response to security concerns, such as the storage of cryptographic material in data centres outside 'friendly' jurisdictions. In a responsible internet, such facilities would be an integral part of the network infrastructure and thus be available for all applications, including Zoom.

Part two

In part two of this blog, we’ll zoom in on our proposed technical approach to building a responsible internet and provide an overview of the research questions it introduces. If you’d like to fast forward to the details, then check our paper.

Acknowledgements

This work is part of the 2STiC research programme (Security, Stability and Transparency for inter-network Communications). Website: https://www.2stic.nl/ SIDN and the University of Twente were partly funded by the European Union’s Horizon 2020 Research and Innovation Programme under Grant Agreement No 830927. Project website: https://www.concordia-h2020.eu/ University of Amsterdam was funded by the Dutch Science Foundation in the Commit2Data programme (grant no: 628.001.001). Project website: https://dl4ld.nl/