The Emerging Bot Armies: What are the Threats to US Cybersecurity?

Bots are the weapon of choice for cyber crime and orchestrated attacks

Bot networks are already generating attacks of overwhelming volume, in ways that are nearly impossible to stop or to trace back to their origins.  Earlier this year, government web sites in Estonia were crippled by denial-of-service attacks coming from a network of bots.  Investigators still don’t know who triggered and controlled the attack.

Bot networks are growing in number and power, to where they now pose a serious threat to the U.S. government, businesses and online consumers.  According to Secure Computing, more than 250,000 personal computers are infected with bots each day, putting at least 10 million computers at the disposal of those with bad intentions.

Bots are used by illegitimate businesses to generate billions of spam emails and to spread malware worldwide.  Moreover, criminal organizations use bots for identity theft via phishing scams.  Attacks like that in Estonia may be merely practice drills by crime factions to showcase their computing firepower and their ability to disrupt networks.

Can we stop the bots?

Law enforcement and internet infrastructure companies are cooperating to discover who’s planting and orchestrating bot net attacks, but with limited success.  The Internet’s very nature makes investigations difficult, especially after the fact.

In what amounts to an arms race, operators of the Internet infrastructure are investing constantly to add capacity to handle the volumes of transactions generated by bot attacks.  They are also adding teams of professionals and new systems to perform real-time network monitoring and rapid response.

But there remains one aspect of the bot threat that can’t be addressed by centralized systems or government investigators.  End users are a critical line of defense, in how they recognize and avoid deceptive tricks designed to download bots to their computers. User awareness is becoming even more critical as the Internet rapidly expands beyond the billion people online today, and reaches the four billion people not yet online.

The ‘Next Billion’ Internet Users may bring on the ‘Next Billion’ Bots

The Wall Street Journal reported this week that ICANN, manager of the Internet domain name system, is implementing internationalized domain names (IDNs). IDNs will help the next billion Internet users enter web addresses entirely in their native language and character sets.  As part of this project, ICANN is encouraging users to test native character domain names in their browsers, email software, and other applications.

At the same time, ICANN and others should be warning new internet users against downloading any patches or new applications unless they are dealing with a trusted website and scanning for viruses and malware.   Otherwise, ICANN is inviting the “next billion” users to download the “next billion” bots capable of generating spam, phishing fraud, and the kind of denial-of-service attacks that brought down Estonia’s internet.

10 Years After U.S. v. Microsoft

New Technologies, New Competitors, and a New Microsoft

Abstract

It’s been 10 years since the U.S. Justice Department launched its antitrust investigation of Microsoft. In the past decade the world of personal computing changed in so many ways that today’s dizzying array of choices—handheld devices, wireless Internet, Linux desktops, and Google’s on-demand desktop—must be quite a surprise to government antitrust regulators who could only see a static market with well-defined boundaries.

Competition is alive and well in today’s desktop computing market, but it is doubtful that the Microsoft case did much to drive these changes. It should be just as obvious to governments around the world that regulation of the software sector is unnecessary and likely to undermine the competitive dynamics that have benefited consumers and economies so well.

Introduction: It’s a Whole New World

In 1998, the Clinton Justice Department called its Microsoft antitrust case a “surgical intervention,” while Microsoft’s largest competitors saw the trial as an opportunity to dismember the company. Fortunately, the Court of Appeals quashed the notion of splitting up Microsoft. Instead, the federal government and 19 states settled with a consent decree that promoted choice and interoperability with Microsoft middleware—on the presumption that Microsoft would continue to control middleware for Windows.

But ten years later, Microsoft’s dominance is anything but certain. In fact, the personal computer software industry has been transformed by new information and communications technologies, creating multiple alternatives to Microsoft. Changing consumer preferences and technological innovation continue to re-shape the dynamic software market, as seen in several examples below.

Then (1998)	Now (2007)
Most personal computers were desktop models running Microsoft Windows and Microsoft Office	Laptops, handheld PDAs, and cell phones serve as gateways to the Internet for communication, information, and applications
Most applications were built for thick-client desktops running Microsoft Windows	Desktops are hosting more on-demand Internet-based applications, using free online storage of documents and emails
Internet access via dial-up lines, with limited adoption of cable broadband and DSL	Ubiquitous broadband via cable, DSL, cellular and wireless Internet connections
Security not a serious concern for consumers	Firewall, pop-up blockers and anti-virus protection integrated into software
Internet Search by Yahoo, etc.	Integrated desktop and Internet search tools

Today we have a truly vibrant software market, especially considering that the Internet bubble collapsed in 2000. Consider just these indicators:

· In the decade since 1997, software companies have raised $78 billion in financing through more than 10,000 individual transactions in the U.S. alone.[1]

· Information-communications-technology industries experienced double-digit real growth for the third consecutive year, increasing 12.5 percent in 2006, compared with 13.3 percent in 2005. These industries accounted for less than 4 percent of the U.S. economy but more than 14 percent of real GDP growth.[2]

· Ten years ago, broadband penetration in the U.S. was negligible; only 18 percent of U.S. households had any kind of Internet access at all.[3] Five years later, broadband penetration broke 30 percent for the first time.[4] Today, nearly 58 million, or 75 percent, of U.S. households subscribe to broadband, according to the Consumer Electronics Association.[5]

This relentless pace of technology innovation is matched only by the rapid evolution in ways to develop and serve technology to consumers. Here’s how a leading business school publication describes the changes in software delivery:

Traditionally, Microsoft and most other software companies deliver software primarily by licensing “shrink-wrapped” products sold through retail channels or arrangements with hardware vendors. […] But new models of software pricing and distribution are becoming increasingly popular. “Open source” software relies on voluntary programmers to build applications that can be distributed freely. Ad supported software includes web-based applications that are free as well, but they generate revenue through advertisements. Also on the increase: “on-demand” software where customers rent software applications when they need them and pay only for what they use.[6]

In the next section, we examine these evolving competitive threats to the software distribution model used by Microsoft at the time of the antitrust case.

Competitors Derided Then Are Rising Now

“Prediction is very difficult, especially about the future.” – Neils Bohr

By the late 1990s, personal computers were “bulking-up” to carry a heavy load of operating systems and locally installed application software. This was called the “thick-client” model, as distinct from the “thin-client” terminals that had long been used to connect with mainframe and minicomputers.

Microsoft products contributed to the weight gain of PCs by adding graphical user interfaces and an Office suite with ever-growing features. Although other companies were also offering thick-client PCs at the time of the Microsoft antitrust case, Judge Thomas Penfield Jackson carved Apple right out of the relevant market, and laughed at the idea of Linux as a competitive threat to Windows.

Ten years later, Microsoft finds itself in ever-greater competition with Linux-based desktops and Apple computer. Use of these non-Microsoft systems has surged in the years since the Microsoft case began:

· Market research firm IDC reports that paid Linux shipments have grown by 25% each year since 2002.[7]

· Dell, Gateway, and Sony are packaging hardware with Linux operating systems from Red Hat and Ubuntu.

· Market research from Gartner and IDC shows that sales of Linux-based servers are up 42% during the first quarter of 2007 in all of Europe, the Middle East, and Africa.[8]

· Apple now ships 1 of every 6 laptop computers in the U.S., moving up to a third-place tie with Gateway.[9]

At the same time Linux has made inroads on Intel-based computers, Apple has won converts to its proprietary Mac platform, based largely on its well-integrated features. In its TV commercials, Apple claims that Mac users can create websites, use its built-in camera, and edit movies “right out of the box” whereas a Windows user is portrayed as having to download drivers and read manuals before he can use the same features.[10]

While the above indicates much greater competition within thick-client software, the importance of this software model may be on the wane. For millions of Internet users today, the only thick-client software they use is the operating system on their cell phone or PDA.

Moreover, thick-client desktops from Microsoft, Apple, and Linux are feeling competitive pressure from an alternative software model, as discussed in the next section.

From Gateway, the Computer to a Gateway for the Internet

Does it even matter whose operating system I’m running? After all, my PC is just the way I get online.

With the ubiquity of broadband internet connectivity, a “thin-client” model has risen to challenge thick-client desktops from Microsoft, Apple, and Linux. Only this time around, the thin-client isn’t a dumb terminal connected to a mainframe computer. Today’s incarnation of the thin-client is a bare-bones personal computer, PDA, or cell phone that can run an Internet browser and connect to the Internet. As one analyst puts it, “browsers are quickly becoming the most important application in your computer.”[11]

This analysis is supported by the numbers in Harvard Business School professor Marco Iansiti’s report on the case of U.S. v. Microsoft. Iansiti writes that “[t]he competitive dynamic faced by client operating systems have [sic] been impacted over the last five years by the utilization of PCs for internet-centric activities. In 2006, U.S. households spent 31% more time on internet-centric applications than in 2001 while use of client-based applications dropped by 14%.”[12]

Thin-clients are hosting a new wave of Web-based software known as “Web2.0,” which includes “software as a service” or the “on-demand desktop,” where applications are designed as Web-based services to be hosted for use by constantly connected customers.^[13] This desktop trend is the subject of our recent report, The Rise of the On-Demand Desktop.^[14]

The rise of the on-demand desktop will forever change the concept of the desktop market. Centralized Web-based services can instantly deploy new features, integrate across applications stored on the server, and enable collaboration among connected users.

One of the leading proponents of the thin-client, on-demand model is Google, the “superpower of search.” Eric Schmidt, Google’s CEO, sees it this way: “Today’s desktop software will be overtaken by Internet-based services that enable users to choose the document formats, search tools and editing capability that best suit their needs.”[15]

Taken from our report, the table below summarizes the different business models used by four leading desktop competitors in terms of product development, distribution, and pricing.

As seen in the table, many on-demand desktop applications are available at no charge to the user since they are supported by advertising and targeted marketing. To increase their ad revenue, Google offers program interfaces specifically designed to help other applications invoke Google’s search, mapping, desktop and AdWord services.[16]

These new models offer competing ways to package and deliver software features, fundamentally changing the way that consumers access their desktop suite of personal productivity applications. In light of this new reality, the antitrust case’s preoccupation with Microsoft’s thick-client model is out-of-date.

In the next section, we consider how thick- and thin-client models will compete in the next stage of market evolution.

Rocks versus Sunglasses

Try to visualize the thick-client model as hauling around a heavy load of client software, or rocks. You need a lot of disk space and processor power to carry them, and you have to install new rocks every couple of years as updated versions are released. Vendors of desktop rocks like Microsoft and Apple usually spend several years on major releases, and even a core Linux distribution like Debian manages only about one release each year.

Now visualize the thin-client model as pair of sunglasses you use to gaze at the clouds. They’re easy to carry around, and interchangeable since you can switch to another pair of sunglasses and still see the very same clouds.

Obviously, this simple analogy portrays thick-client in a poor light compared to thin-client sunglasses. In reality, the thin- and thick-client models are blurring the distinction, and even Microsoft recognizes the rise of on-demand Internet applications. Ray Ozzie, taking over from Bill Gates as the company’s Chief Software Architect, told analysts that Microsoft would move more of its desktop offerings into “the cloud” of Internet services.[17]

When Microsoft does reach “the cloud,” the company will square-off against the likes of Google. 65% of all Web searches are performed using Google, and the Google toolbar easily integrates with the most popular Web browsers.[18] Moreover, Google is the number one provider of Web-based productivity tools:

Nielsen/NetRatings writes:

[I]n October 2006 the combined unique visitors to Google Docs and Spreadsheets reached 445,762, with an average time spent of 10 minutes per visitor. This accounted for 92% of unique visitors and 95% of time spent among providers of Web-based productivity tools that month.[19]

Thin-client software now works well in comparison to thick-client software. In a review of Google Docs and Spreadsheets, a PC Magazine review reports:

Though Google Docs doesn’t try to match Microsoft Word’s overpowering feature set, it does let you create fully formatted documents complete with pictures, tables, and hyperlinks.[20]

Another review of Google’s on-demand offering in VNUnet says that:

Google Docs & Spreadsheets is a very powerful part of the Google empire. The collaboration tools rival some of the more advanced features of Office and are well worth investigation by any group needing to share documents across a wide area.[21]

The power of the thin-client is not limited to productivity applications. Ten years ago, you bought a box of CDs to install an encyclopedia or mapping software on your PC. Today, all you need is an Internet connection and a handheld device running a browser. A ZDNet review puts it this way: “[T]he user never has to worry about updating to the latest version, since Google’s servers always provide the company’s most up-to-date product.”[22]

Even so, the thick- and thin-client models are destined to co-exist and compete in the near term. Google now offers a download of Sun’s OpenOffice—an extremely thick clone of Microsoft Office—which includes shortcuts to Google’s Web search pages. Even the popular Google Earth program requires a 13 MB download to install Google’s proprietary thick-client interface. And as noted earlier, Microsoft is now investing in thin-client office applications to be hosted on Microsoft Live.

These software technologies and business models ought to be allowed to compete on the merits, without interference from antitrust regulators.

It’s Time to Retire the Microsoft Consent Decree

Over the last ten years, software innovation has been unpredictable and unprecedented, and the results are undoubtedly benefiting consumers. The consent decree governing Microsoft since the antitrust trial shows that it neither predicted nor contributed to these innovations.

Consider the three main themes of the consent decree:

1. Restrictions on Microsoft software distribution deals with computer makers.

2. Required disclosure of program interfaces and protocols to help independent software and hardware vendors interact with Microsoft middleware.

3. Court-ordered review and rules governing how Microsoft integrates new middleware with Windows.

In 2006, after five years of operating under the consent decree, Microsoft voluntarily adopted a set of Windows Principles that it says will promote computer manufacturer and user choice, opportunities for developers, and interoperability for users.[23]

Microsoft General Counsel Brad Smith described Windows Principles as the result of lessons the company has learned through its antitrust troubles:

We’ve learned that people care not only about what we do but about how we do it. So, our goal today is to be principled, transparent and accountable in our design of Windows as we go forward now and in the future. The principles that we’re announcing today assure customers, our industry and regulators alike, that Microsoft is committed to developing Windows in ways that advance innovation for consumers and preserve important and robust opportunities for competition.[24]

One could view these principles as merely a restatement by Microsoft of many of its legal obligations from the antitrust decree. But at least one commentator believes that the Windows Principles are more—an “acknowledgement that Microsoft understands the Web is the number 1 platform now – not the OS.”[25]

Over the last ten years, the operating system has been losing its significance. Harvard’s Iansiti reports that “[t]he number of […] OS-agnostic applications has risen dramatically. […] For enterprises, the number of newly developed OS-agnostic applications grew at 24% CAGR [Compound Annual Growth Rate] from 2000 to 2006 while Windows based applications grew at a 1% CAGR during the same period. The percent of OS-agnostic applications is expected to surpass the percent of OS-specific applications by 2011.”[26]

Viewed this way, the Windows Principles are as much a response to the changing marketplace as they are to antitrust—“promoting competition” not against Microsoft, but by Microsoft. A recent company statement put it this way: “The Windows Principles reflect the degree to which the industry and the company have changed.”[27]

For instance, these Windows Principles commit Microsoft to disclose to the developer community all application programming interfaces within Windows that are used by any other Microsoft product. This means that anything Microsoft’s products can do with Windows, competing products will be able to do as well.

Now that the decree is nearing its expiration date, the U.S. Justice Department and states must avoid tying the hands of one company by extending a consent decree that inhibits integration of features. Nor should they continue to invite competitors to block Microsoft from integrating new features into its operating system and applications.

More importantly, an extension of the U.S. consent decree might continue the requirement for quarterly reviews by the Circuit Court. Those reviews have been turned into opportunities for large competitors to block Microsoft’s attempts to innovate and integrate to meet consumer demand. Consider these three examples of how the overhang of the Microsoft antitrust case is posing obstacles to the integration of features in Windows.

Anti-Virus Security Software

Security features have become critical to operating systems and application software. In particular, firewall protection against malicious intrusions has become a basic necessity as users spend more time connected to the Internet. Operating systems now routinely include firewall security software as standard equipment.

But when Microsoft announced its intent to include anti-virus software with Windows Vista, security software firms protested, citing antitrust concerns. Microsoft’s Windows Live OneCare, a service that combines firewall, antivirus and backup capabilities, was called anticompetitive by Symantec, one of the largest makers of software security products. “I don’t want to say it was monopolistic, but it looked that way to some of us” said Symantec CEO John Thompson.[28]

Portable Document Formats

Applications that allow users to save files in different document formats extend work product usefulness. According to Microsoft, a save-as-PDF feature was one of the features most requested by their customers.[29] Adobe, however, objected to Microsoft’s plans to include a save-as-PDF feature in Office 2007, claiming antitrust and predatory pricing violations. Adobe asserted that PDF export technology was a separate product which, when tied to Office 2007, undercut Adobe’s ability to charge for its own plug-in. Microsoft relented, and the save-as-PDF feature is now available only as a separate download for Office 2007 users.

Desktop Search

Web-based search tools are good for finding information on the desktop too. Yahoo, Google and Microsoft have popular search products that reside on the desktop. But Google is now objecting to the way Microsoft integrated desktop and Internet search features into Vista, its new version of Windows. Six months after Windows Vista was released to consumers and businesses, Google filed an antitrust complaint with the U.S. Justice Department, asking that Microsoft hold back a critical Vista update until their desktop search complaint is addressed.[30]

These kinds of objections and complaints have their desired effect: delay of new releases from Microsoft. Antitrust regulators should ensure that their legal scrutiny promotes competition, and not just complaints from competitors. Yet, quarterly court reviews of consent decree compliance are providing a forum for Microsoft’s largest competitors to dog the company and delay release of innovations.

Moreover, delays in significant software updates are disruptive to independent software vendors and potentially dangerous to consumers and users who are vulnerable to security threats.

Conclusion

Innovation and competition—driven by applications that harness the power of the latest technologies—continue to transform the landscape of the software industry. The on-demand model has risen to challenge thick-client desktops from Microsoft, Apple, and Linux.

Thin-client “cloud” software was not a factor in the late 1990s as it is now in 2007, and its largest proponent, Google, was not even incorporated the day that the U.S. Justice Department filed its antitrust suit against Microsoft. Almost a decade later, Google is arguably Microsoft’s strongest competitor.

Despite the new software environment, government antitrust regulators are targeting the industry for ever-greater scrutiny. Continued oversight of the consent decree in the U.S., the recent ruling in Korea, and the ongoing willingness of EU competition regulators to bring new cases are all signs of regulatory overkill.

Antitrust regulators should avoid overly interventionist policies in today’s on-demand technology markets. In the case of Microsoft, Justice Department supervision of the terms of the consent decree will end on November 12, 2007. We don’t need continued oversight going forward—we have Google and other market forces minding Microsoft well enough.

The FSF has finally released GPLv3,1 and Eben Moglen proclaims “the time is rapidly approaching when the GPL is capable of leveling the monopolist to the ground.”2 There is no secret that the target in Moglen’s sights is Microsoft, which had the temerity to reach patent peace agreements with Novell, LG Electronics,3 Xandros,4 and Linspire5 to give these companies’ customers some assurance that they would not be liable for patent infringement for using Linux. The key weapon in the GPL arsenal is a provision that Moglen says will result in Microsoft’s patents being licensed to the free software community against Microsoft’s will. Can they do that?

Click Here for the Full Issue Brief

Abstract

Success in the computer desktop market is all about reading and responding to consumer demand. Although desktop competitors look at common clues for consumer preferences, they respond based on unique technology and new business models. Traditional, thick-client desktops from Microsoft, Apple, and Linux will feel competitive pressure from the thin-client, on-demand model offered by new competitors like Google.

The rise of the on-demand desktop will forever change the concept of the desktopmarket. Centralized services can instantly add new features, integrate across applications stored on the server, and enable collaboration among connected users. Thick-client competitors such as Microsoft, Apple, and Linux will have to ratchet-up their feature integration efforts just to stay in the desktop game.

Consumer Demand Drives Innovation and Integration in Desktop Computing (PDF)

Innovation, IP, and Entrepreneurs Video

To mark World Intellectual Property Day 2007, the Association for Competitive Technology released a new video explaining the key role that Intellectual Property plays in the hi-tech industry, the economy and in improving the lives of consumers.  The video presents a historical look at Intellectual Property and the central role it plays in our economy and in the development of many important products.  The video features ACT president Jonathan Zuck, intellectual property attorney Dick Wilder, Gary Mueller CEO of Digital Now, and Andre Carter, small business consultant and author of Little Blues.

“In an economy where creativity and innovation are the most important currencies, protecting your intellectual assets is critical,” said Jonathan Zuck, president of the Association for Competitive Technology.  “Intellectual property protections give entrepreneurs the incentive to invest time and money and take risks to bring an idea to market.”

Legal Analysis: GPLv3 is a Contract and Why it Matters

The FSF released the Third Discussion Draft of GPLv3, adding paragraphs four and five to Section 11 and explained, in war-like tones, that they were needed to “combat the threat” of a recent cooperation agreement between Novell and Microsoft and other agreements like it. The stated “threat” is a covenant by Microsoft not to assert its patent rights against customers who have purchased SUSE Linux Enterprise Server or other covered products from Novell. The real concern, however, is that Novell and Microsoft have found a way to build bridges between the two worlds of open source and proprietary software. This was a bridge too far for the FSF.

GPLv3-Contract-Not-Copyright (PDF)

ACT Joins 26 other organizations in sending a letter to the Senate Judiciary Committee in support of the Intellectual Property Rights Enforcement Act.

The Full Letter in PDF Format

GPLv3: The Legal Risks of Overreaching for Third Party Patent Rights

The FSF has now released the Discussion Draft 3 of GPLv3, adding paragraphs four and five to Section 11 for the stated purpose of blocking the recent patent cooperation agreement between Novell and Microsoft and other agreements like it, because they give some Linux users the benefit of a patent covenant not to sue, but not to the extent that the drafters would ideally like.

Those participating in the drafting and consultation process, or that plan to use GPLv3 once it is issued, should give careful consideration to whether such amendments do more harm than good by selectively overreaching for third party patent rights.  There is no issue with those who choose to develop and distribute under the GPL to commit their own copyrights and patent rights in their contributions to the program they are distributing.  But it is quite another for the GPL to seek to reach out and attempt to force third parties to surrender patent rights that they hold based on work and investment unrelated to development of contributions to GPL code.  Particularly when the terms of the GPL are revised selectively to target specific parties, undo their perfectly legal contracts, or forge a broad agreement not to do business with such parties, this calls into question the legitimacy and enforceability of the GPL, and unwittingly may create new liabilities for its drafters and users.  It also is a direct attack on the freedom of developers and companies to work together – seeking to undo or frustrate efforts to build bridges between the two worlds of open source and proprietary software.

ACT GPLv3 Legal Risks