September 29, 2022

Posts Comments

 A Multi-pronged Strategy for Securing Internet Routing

April 19, 2022 by Leave a Comment

By Henry Birge-Lee, Nick Feamster, Mihir Kshirsagar, Prateek Mittal, Jennifer Rexford

The Federal Communications Commission (FCC) is conducting an inquiry into how it can help protect against security vulnerabilities in the internet routing infrastructure. A number of large communication companies have weighed in on the approach the FCC should take. 

CITP’s Tech Policy Clinic convened a group of experts in information security, networking, and internet policy to submit an initial comment offering a public interest perspective to the FCC. This post summarizes our recommendations on why the government should take a multi-pronged strategy to promote security that involves incentives and mandates. Reply comments from the public are due May 11.

The core challenge in securing the internet routing infrastructure is that the original design of the network did not prioritize security against adversarial attacks. Instead, the original design focused on how to route traffic through decentralized networks with the goal of delivering information packets efficiently, while not dropping traffic. 

At the heart of this routing system is the Border Gateway Protocol (BGP), which allows independently-administered networks (Autonomous Systems or ASes) to announce reachability to IP address blocks (called prefixes) to neighboring networks. But BGP has no built-in mechanism to distinguish legitimate routes from bogus routes. Bogus routing information can redirect internet traffic to a strategic adversary, who can launch a variety of attacks, or the bogus routing can lead to accidental outages or performance issues. Network operators and researchers have been actively developing measures to counteract this problem.

At a high level, the current suite of BGP security measures depend on building systems to validate routes. But for these technologies to work, most participants have to adopt them or the security improvements will not be realized. In other words, it has many of the hallmarks of a “chicken and egg” situation. As a result, there is no silver bullet to address routing security.

Instead, we argue, the government needs a cross-layer strategy that embraces pushing different elements of the infrastructure to adopt security measures that protect legitimate traffic flows using a carrot-and-stick approach. Our comment identifies specific actions Internet Service Providers, Content Delivery Networks and Cloud Providers, Internet Exchange Points, Certificate Authorities, Equipment Manufacturers, and DNS Providers should take to improve security. We also recommend that the government funds and supports academic research centers that collect real-time data from a variety of sources that measure traffic and how it is routed across the internet.  

We anticipate several hurdles to our recommended cross-layer approach: 

First, to mandate the cross-layer security measures, the FCC has to have regulatory authority over the relevant players. And, to the extent a participant does not fall under the FCC’s authority, the FCC should develop a whole-of-government approach to secure the routing infrastructure.

Second, large portions of the internet routing infrastructure lie outside the jurisdiction of the United States. As such, there are international coordination issues that the FCC will have to navigate to achieve the security properties needed. That said, if there is a sufficient critical mass of providers who participate in the security measures, that could create a tipping point for a larger global adoption.

Third, the package of incentives and mandates that the FCC develops has to account for the risk that there will be recalcitrant small and medium sized firms who might undermine the comprehensive approach that is necessary to truly secure the infrastructure.

Fourth, while it is important to develop authenticated routes for traffic to counteract adversaries, there is an under-appreciated risk from a flipped threat model – the risk that an adversary takes control of an authenticated node and uses that privileged position to disrupt routing. There are no easy fixes to this threat – but an awareness of this risk can allow for developing systems to detect such actions, especially in international contexts.  

Filed Under: Uncategorized Tagged With: , , , , , , , , , ,

CITP Case Study on Regulating Facial Recognition Technology in Canada

April 7, 2022 by 1 Comment

Canada, like many jurisdictions in the United States, is grappling with the growing usage of facial recognition technology in the private and public sectors. This technology is being deployed at a rapid pace in airports, retail stores, social media platforms, and by law enforcement – with little oversight from the government. 

To help address this challenge, I organized a tech policy case study on the regulation of facial recognition technology with Canadian members of parliament – The Honorable Greg Fergus and Matthew Green. Both sit on the House of Commons’ Standing Committee on Access to Information, Privacy, and Ethics (ETHI) Committee and I served as a legislative aide to them through the Parliamentary Internship Programme before joining CITP. Our goal for the session was to put policymakers in conversation with subject matter experts. 

The core problem is that there is lack of accountability in the use of facial recognition technology that excarbates historical forms of discrimination and puts marginalized communities at risk for a wide range of harms. For instance, a recent story describes the fate of three black men who were wrongfully arrested because of being misidentified by facial recognition software. As the Canadian Civil Liberties Association argues, the police’s use of facial recognition technology, notably provided by the New York-based company, Clearview AI, “points to a larger crisis in police accountability when acquiring and using emerging surveillance tools.”

A number of academics and researchers – such as DAIR Instititute’s Timnit Gebru and the Algorithmic Justice League’s Joy  Buolamwini, who documented the missclassification of darker-skinned women in a recent paper – are bringing attention to the discriminatory algorithms associated with facial recognition that have put racialized people, women, and members of the LGBTIQ community, at greater risk of false identification.  

Meanwhile, Canadian officials are beginning to tackle the real world consequences of the use of facial recognition. A year ago, the Office of the Privacy Commissioner found that Clearview AI, had scraped billions of images of people from from the internet in what “represented mass surveillance and was a clear violation of the privacy rights of Canadians.” 

Following that investigation, Clearview AI stopped providing services to the Canadian market, including the Royal Canadian Mounted Police. In light of these findings and the absence of dedicated legislation, the ETHI Committee began studying the uses of facial recognition technology in May 2021, and has recently resumed this work by focusing on the use by various levels of government in Canada, law enforcement agencies, and private corporations. 

The CITP case study session on March 24, began with a presentation by Angelina Wang, a graduate affiliate of CITP, who provided a technical overview where she explained the different functions and harms associated with this technology. Following Wang’s presentation, I provided a regulatory overview of how U.S. lawmakers have addressed facial recognition by noting the different legislative strategies deployed for law enforcement, private, and public sector uses. We then had a substantive, free-flowing discussion with CITP researchers and the policymakers about the challenges and opportunities for different regulatory strategies. 

Following CITP’s case study session, Wang and Dr. Elizabeth Anne Watkins, a CITP Fellow, were invited to testify before the ETHI committee in an April 4 hearing. Wang discussed the different tasks facial recognition technology can and cannot perform, how the models are created, why they are susceptible to adversarial attacks, and the ethical implications behind the creation of this technology. Dr. Watkins’ testimony provided an overview of the privacy, security, and safety concerns related to the private industry’s use of facial verification on workers as informed by her research.  The committee is expected to report its findings by the end of May 2022. 

We continue to do research on how Canada might regulate facial recognition technology and will publish those analyses in the coming months.

Filed Under: Uncategorized Tagged With: , , ,

A Start-Up Born at CITP

October 8, 2013 by

As is probably the case with many start-ups, Gloobe was born late at night. Early in 2013, on the night of a snowstorm in Princeton, I presented at the student-led Code at Night hackathon an idea for a web site that organized civic information onto online maps of local communities. With experience as a former elected representative of a relatively small community within Washington, DC, I understood the value of easing the availability of information about voting, upcoming community meetings, and regulatory agency actions, but lacked the coding skills to bring the project to life. Jian Min Sim, a student from Oxford who was spending his senior year at Princeton as part of an exchange program, heard about my presentation from a friend and when we got together, pulled out his laptop and said, “I have already built something very similar.” After winning a contest sponsored by the ITU, Jian had built a mapping website designed to provide a platform for NGO employees and others who travel frequently to share information about places that lacked detailed on-line limited maps. A partnership formed.

Over the course of the year, we have talked repeatedly about different ways of using technology to reach different groups of people – young people, people working for the government, in education, or at large corporations – who are looking to share knowledge more effectively. Through all of these conversations, we have sought to figure out what we think is important – a preference for wireless solutions, a simple platform, providing real-time access to information about what’s happening in local communities. Do we think our mission is best served as a for-profit or non-profit entity?
[Read more…]

Filed Under: Uncategorized Tagged With: , ,

Educating Leaders who Tackle the Challenges of their Time; Lessons from the Past: Book Review: First Class, The Legacy of Dunbar, America's First Black Public High School

August 10, 2013 by

One of last year’s CITP lectures that is still fresh in my mind is Brad Smith’s talk on “Immigration, Education, and the Future of Computer Science in America.” In his presentation on developing a process for educating the next generation of computer scientists in U.S. high schools and colleges, Mr. Smith noted that in the state of New Jersey, where 8.8 million people live, only 874 students took the computer science AP exam, and of those, only 17 were African-American. In Alison Stewart’s excellent new book “First Class: The Legacy of Dunbar, America’s First Black Public High School,” Ms. Smith tells the story of one of the best and most important American high schools of the 20th century. In the first half of the 20th century, Dunbar High School, a public school located in Washington, DC, produced numerous leaders in medicine, science, education, law, politics and the military, including several from my family. With the end of segregation, the conditions that resulted in Dunbar’s creation ceased to exist. The question remains, however, as to how in diverse public education systems to develop leaders in the fields that are critical to the country’s economic and social progress.
[Read more…]

Filed Under: Other Topics Tagged With: ,

Take Over My Dream Job: Associate Director at CITP

July 9, 2013 by

Nearly four years ago, I joined the Center for Information Technology Policy at Princeton as Associate Director. The CITP community is a fantastic collection of smart and funny people who work passionately on all aspects of information technology policy. It was my dream job, so it was bittersweet when I accepted a new job working on internet freedom programs at the State Department. However, this means that someone else has a chance to step into this incredible position. If you love tech policy and want to help lead a vibrant and growing research center, you can now apply to be the Associate Director of the Center for Information Technology Policy at Princeton. I am happy to answer any questions that you may have, at .

In my new role at the State Department, I help to award and oversee grants to groups that are supporting internet freedom worldwide. This includes technology tools as well as advocacy, training, and research. I am always eager to hear from folks with projects or ideas, and part of my goal is to help support the growing internet freedom community however I can. Feel free to email me at , and to submit a Statement of Interest (SOI) for technology projects (the next quarterly round of SOI’s are due on August 30th).

Filed Under: Uncategorized Tagged With: ,