Who Really Controls the Internet - And Why it Matters with Emily Taylor and Roxana Radu

Speaker A: Welcome to Cyber Leaders with me, Kieran

Speaker B: Martin, and me, James Line. Now, we're both from the SANS Institute, who are kindly backing this podcast. I myself, I'm a techie, a massive geek, and I've spent my life chasing cybercriminals around the Internet.

Speaker A: I've wasted my life. Well, whatever I've done, I've dealt with cybersecurity policy and government and set up the UK National Cyber Security Centre. And now James and I are trying to unpack the weird, wacky wired and wireless world of tech security and all the complicated things that it involves.

Speaker B: That's right. Getting around the cybersecurity community, finding useful people to help us make up for our own shortcomings. Right, Kieran?

Speaker A: Well, indeed, and I think we're going to do that today. But anyway, you go on.

Speaker B: This podcast, uh, is a voice for security leaders. We want CISOs, security directors, and frankly, everyone beyond, to build up their knowledge of what works, what doesn't, and frankly, to make life a little bit harder for the cybercriminals.

Speaker A: That's right. So I've got a challenge for you on that note today, James.

Speaker B: Go on.

Speaker A: Well, in this podcast, we want to make sure we don't shy away from the toughest questions. So, what. What is the most complicated question to answer you can think of? And it must be in no more than four words.

Speaker B: Why are we here? Uh, what are you doing? What are you thinking? Oh, that one's a bad one.

Speaker A: I'm asking you a question.

Speaker B: Uh, but that was my answer.

Speaker A: Ah, yes.

Speaker B: So, once again, Kieran, we're getting into a habit of starting these podcasts. I've got absolutely no idea what you're on about or where you're going with any of this. So the hardest forward question by Occam's Razor on Earth at this moment has to be, what are you thinking? And where are you going with this? Which is now a lot more than four words. So maybe cyber security. Let's focus there.

Speaker A: All right, then, um, here we go. Refine it. So here's my forward question. The question for today on my mind. Who controls the Internet?

Speaker B: Oh, that's a tough one. Uh, give me a few minutes.

Speaker A: Now, stop. I know you're a very talented hacker, but that wasn't an invitation for you to seize control of the Internet. You've done that before. It ends horribly.

Speaker B: I thought that was permission.

Speaker A: No, no, no. I have many powers, but breaking the law globally and domestically is not one of them. It was an invitation for us to explore on this Wonderful podcast of ours, one of these really, really tricky issues. So we've talked a 30 episodes now, I don't know, getting there, about the foundational problems of the Internet, how it was built without security mind and all of that stuff. But who, if anyone, owns it, runs that? How does it all run and work? Who sets the standards and why does any of that matter?

Speaker B: And um, why are you asking me? I'm still thinking about who I can ask for permission to take over the Internet, to be honest.

Speaker A: Well, I'm not actually asking you because neither of us have much of a clue about this, especially you. But luckily I have not one, but two brilliant Oxford based colleagues and they do, insofar as anyone does understand this, they give spellbinding classes students along with their other work. And these students won't know anything about the Internet and they tell them all how it works and who runs it and what we have to worry about.

Speaker B: Oh, this is going to be fantastic. I've spent lots of time looking at how packets fly around the Internet and all the dilapidated technologies that should no longer work for the global Internet today. But uh, well, although I'm very disappointed my seas to control the Internet to have that halted before we even really truly began, I am delighted that we've got some guests who can tell us how it all works. Mostly so I can seize control later. But you better introduce our guests.

Speaker A: I will. I'm delighted to introduce them both. So first we have Emily Taylor of Oxford Information Labs. Now, as well as providing some of the best anti scam initiatives in the world, Oxford Information Labs advises in Internet governance and technical standards. Emily is one of its finders and CEOs and she sat on some of these incredibly important obscure bodies that uh, most people have never heard of who will feature in today's discussion and alongside lots of other things, she's an Associate Fellow at Chatham House. So that's Emily. We also have Roxana Radu. Roxana is originally from Romania and she is Associate professor of Digital Technologies and Public Policy at the Blavatnik School at the University of Oxford alongside me. And for the purposes of this podcast, among her many achievements I want to highlight, she's the author of a highly relevant and most excellent book called Negotiating Internet Governance.

Speaker B: Fantastic, Kieran. I think we have the perfect people to help us take over the Internet. I think we can all agree it would be better if I ran it, but for the meantime, welcome Roxana and Emily. Great to have you here.

Speaker C: Thank you very much for asking me on the show and always delighted to welcome work with Roxana and with Kieran. Great to meet you, James.

Speaker D: Hello. And thank you for the invitation.

Speaker B: Uh, a pleasure. So thank you so much for coming on, Emily and Roxana. But before we start and ask you about the meaning of digital life and if there's a digital God and how do I become that digital God and all those sorts of things, can you both tell us about your path into cybersecurity and this field of Internet governance? We asked this as there are so many different ways into this profession. We have so many astounding people turn up with different stories, and it's fascinating to hear them. So, Emily, why don't you go first and then you can give Rockstar some time to think of a response to one up you. It'll be fun.

Speaker C: Thank you, James. So, yeah, I think probably like many people who got into the Internet and technology in the 90s like I did, we all came from different backgrounds because we had to. You know, if I was at school thinking about what I wanted to do, cybersecurity wouldn't have been a word that I would even know and far less understand. So, actually, my first profession was as an actor. And then I kind of got sensible after a while and retrained as a lawyer. And really my driving force that led me to work in an Internet company was I wanted to do less hours. I, uh, needed to work part time because I had young children. And I had a job opportunity to go and work with a client, which was called Nominet, and that was the registry of dot UK domain names. And I started working with them in the late 90s. I became their first in house lawyer, developed their dispute resolution service, and sort of stayed there for about 10 years. And that was such an interesting journey because none of us knew how any of this stuff worked. We were just making it up as we went along, and it was very frightening, but also very interesting. And so that's kind of what led me into it. I sort of got drawn into the policy space again, largely by accident.

Speaker B: I love it. Fascinating journey through different paths, as we hear from many of our guests. And towards the end of your tenure there at Nominet, I'd have just started working with that organization on some takedowns of nasty domains from cybercriminals. So I think I'd have used some of that. Dispute resolution, sir.

Speaker C: Oh, good. I hope it was useful.

Speaker B: It worked.

Speaker C: It's still there. So that's always nice. You know, it's always nice when you move on the one little thing that you did is still there later.

Speaker B: Absolutely. Well, it's continuing to make life hard for the cybercriminals, which we rather enjoy. So great to have you here. And, um, Roxana, hopefully that's given you enough time to come up with something even better than Emily's story there. Go on. Competition started.

Speaker D: Absolutely. So my journey has been an academic one. So I came to this much later in 2010, and it all started during my master's studies. And I had this simple curiosity at a time when digitalization was becoming the new mantra. All governments wanted to move services online, and a lot of those services had to do with education as well. So my interest during the master degree was whether that was going to make everything a lot better for all of us. It turned out not to be the case. But I also soon discovered that I needed to understand a lot more about the whole ecosystem to better understand some of the power dynamics. Why was it that, uh, education wasn't becoming a lot better by moving services online? Did it have to do with private delivery? Did it have to do with some of the public interest commitments and so on and so forth. So I soon ended up with studying regulation, standards and all of that. And that led me to pursue a PhD later on on the governance of the Internet. And I was doing that research in Geneva, um, right in the middle of the diplomatic community. So that gave me a front, uh, row seat to some of the global negotiations on Internet governance. And a decade later, I'm still interested in all of this.

Speaker B: I love it. Well, look, it's fantastic to be with two people who have spent their life looking at regulations and how all this stuff works and trying to make it more standardized. I've spent my entire life trying to break regulations and standards and legally, I might add, Kieran. Legally.

Speaker A: Well, I hope we put in place strong legal boundaries for people like James and you can help us understand them. So, look, Roxana, you came to this later. Thank you for reminding, uh, us and the audience that you're considering considerably younger than Emily and me. So we'll do the elder states thing first. Emily and I'll talk to you.

Speaker C: Cheers for that.

Speaker A: So let's make this nice and simple. So who controls the Internet? Name, address, date of birth? Where does he live? Or she much do they want for it? Who owns this thing? Who runs it? How's it work?

Speaker B: Sounded like the script to a Terminator movie.

Speaker A: Increasingly, I thought it was more an episode of Only Fools and Horses, but there you go.

Speaker C: Yeah, I wish I knew the answer, but I think it's one of those things that is such an easy question to ask and such a difficult question to answer. So the Internet, of course, is a distributed system, custom. It was actually built so that it would resist a point of control. But if you're thinking about, you know, what choke points might there be on the Internet, you very quickly end up, uh, in the domain name system, which is not the sexiest part of the Internet, to be honest.

Speaker B: Oh, I don't know.

Speaker A: You're on the wrong podcast with answers like that.

Speaker C: You know, I've spent a lot of time there.

Speaker B: Good stuff.

Speaker C: I can assure you it really, really isn't. But it is incredibly important because each domain name is by design guaranteed to be, you know, universally accepted and also unique. And those are two really important qualities. I know it just sounds so weird, but if you think about if domain names weren't there, you just wouldn't know where to find anything.

Speaker B: It's the underpinning of trust and resource location for the modern world. Really take it so for granted. But it's just used thousands and thousands and thousands of times per second for everything.

Speaker C: Yeah. So, you know, thanks for that endorsement, Jamie, because it can feel really, really thankless as an area of technology to be interested in or to know about. But so to come back to your question, Kieran, who controls this? There's an organization called icann which stands for the Internet Corporation for Assigned Names and Numbers. It's a Californian, not for profit. If anybody from ICANN was here, they'd vehemently contest the idea that they control anything. They're a coordinator. It's all bottom up. It's all very, you know, it's very 90s. It's very multi stakeholder. Nobody's, uh, in control. It's a bit like one favorite films, the Incredibles. You know, they say when everyone's super, no, uh, one is right. You know, so it's sort of like nobody controls it, but kind of ICANN sort of does. And it's a community. It's very confusing, but somehow it works.

Speaker A: Okay, so look, I'm gonna m make you two promises, Emily. One is we'll definitely come back to ICANN because it's so weird and wonderful and we'll even come back to DNS, I promise you. In fact, we'll make it so sexy, we might even try and get it rated explicit on Spotify.

Speaker B: Oh, that would make me so happy, Kieran.

Speaker C: XXX think is what you mean.

Speaker A: Excellent. Right? Done. Now that we've Achieved a goal already and we're only a few minutes in.

Speaker C: Yeah, an actual domain joke. Right.

Speaker A: But look, before we massively geek out, let's stick in my territory. Before you go down too many technical rabbit holes with James, because he loves doing that. You mentioned some sort of words and themes and your words, they're very 90s, so distributed, no control and so on, are sort of explicitly designed this way. And you know, if we'd had a podcast. Don't even know if there were podcasts in the 90s. Can't remember back that far. That would have been the zeitgeist. That would have been the narrative back then. Nowadays, of course, we talk about a much more contested one. So is this the only vision? Here's a phrase just for you as an expert. And um, it's a very sort of high level one. You know, people keep saying, oh, the Internet knows no borders. Is that even true anymore? What's going on in the world now? So we had this designed single system worldwide. Governments can do anything about it, um, blah, blah, blah. Thirty years on, it looks a bit different. Discuss.

Speaker C: Yeah, I agree with you, Kieran. And it's a bit like, you know, I love history and looking back in time as well as loving technology. Technology and thinking about the future. And when you think about sort of real seismic shifts or revolutions that have gone on in other eras, what normally happens then is a counter revolution where the status quo reasserts itself. And I think there was a huge amount of optimism in the 90s, partly because of the geopolitical landscape. You know, the collapse of the Soviet system, the, uh, Berlin Wall coming down, a sense like, you know, it's bridges, not walls. And it felt incredibly optimistic. And we don't really even need governments or borders anymore. Now here we are 25, 30 years later, how different the world feels, how much the old order is reasserting itself. And those geopolitical massive competitions, often. I don't know if you'd agree, Kieran. I think they're being played out through technology. Not just that technology is receiving them, but they're often being played out in this environment.

Speaker A: Yeah, I mean, just on that, Emily, because I mean this could be a whole podcast series. We're trying to cover as much as possible. But if we were, let's say we were both in China and we could speak Mandarin and then we're having this conversation and you ask the question, who controls the Internet? The answer would be kind of different, wouldn't it?

Speaker C: Yeah, kind of would.

Speaker A: And uh, it is that real There are different models these days. We're working off one model, but others are now really are available.

Speaker C: Yeah, I think that, you know, so channeling my ICANN buddies, there's still a global Internet and there's always actually been a fragmented Internet in terms of national versions. China is like the emblematic version and it's always been a kind of semi gated community if you like. But there's still a level of connectivity that happens internationally. Whether we will be able to say that in five or 10 years time, I really don't know. And I feel much less optimistic than I used to.

Speaker A: Oh, okay. I better switch to James now.

Speaker B: Oh, you're gonna come back to that one. I feel like. Yes, Kieran, you're like a recursive DNS resolver. You never stop asking questions. DNS jokes are coming out now. Normally my DNS jokes don't land. They usually time out.

Speaker A: I don't know what rating this will get it on Spotify. It won't get explicit, but maybe a new special category of warning.

Speaker C: Exactly.

Speaker B: Explicit and straight.

Speaker A: Inaccessible jokes.

Speaker D: Alert.

Speaker C: Inaccessible and weird.

Speaker B: We'll come back to that. I'm starting to think of, um, from that last description of multiple intimates, we might have to start with a T shirt of the smorgasbord of Internets. But anyway, Roxana, ah, you've literally written the book on Internet governance. And so Emily's talked a bit about some of the different models around the globe, how it all connects together, where it might go in the future. Now, in most walks of life you've had a new technology and it's all been a bit chaotic at the start. Think cars, aviation, AI at the moment, Anyone, iPhones, you name it. And then we've come together across the world to figure out a set of rules so we can all work together and make things work right. Pragmatism over time comes through. If you go back to the turn of the century or Even, you know, 2010, even 2017, when Brad Smith was talking about the Digital Geneva Convention, there was this assumption that the world would find a way to world peace on the Internet and there'd be some kind of grand bargain, some unifying set of rules. Like Einstein pursuing his perfect marble general theory of relativity. Well, that clearly hasn't happened. So tell us the story and how we seem to have ended up in a place where there aren't really any global rules.

Speaker D: When Microsoft was calling for the Digital Geneva Convention in 2017, it was, uh, just after the WannaCry ransomware that crippled computers across 60, 70 countries.

Speaker A: Almost my career, if you're looking for things that were almost crippled by wallacraft.

Speaker C: But there you go.

Speaker D: Curious career.

Speaker B: He was very scarred. We don't like to mention that particular campaign. It's a dirty word on this one, Roxana.

Speaker D: And I was uh, at the UN when he came to deliver that speech. I was there in the room and he talked very eloquently about the need for some sort of humanitarian corridor, if you wanted. In cyberspace, attacks happen on infrastructure that is owned by various companies. At the end of the day, we should be treating the tech sector as neutral and allow them to intervene and fix the problems as soon as they are aware of them. So he called for that with, uh, some very mixed reactions from governments and also from industry. In fact, it was quite surprising that there weren't a lot of backers for that proposal. So Microsoft went on and proposed a tech accord that would meet some of those, uh, objectives, uh, they had in the digital Geneva Convention. But that discussion died out very quickly. And I think it brings us back to the two approaches we've seen in governing the Internet. When we think about the rules that keep the network running. We have soft law and hard law. And in the soft law bucket we have all the voluntary standards, all the industry standards, multi stakeholder declarations and so on and so forth that keep the network running on hard law. We've seen lots of variation over time. We've seen governments coming in with all sorts of proposals. Cybersecurity has always been in focus, but so has online behavior, for example, regulations on content, privacy and so on, so forth. So we have a mixed patchwork now of some of, uh, the voluntary commitments that still keep protocols and standards to the level needed for the network to function, and some of the hard law regulations, binding regulations that come with different levels of enforcement and apply across the stack from provisions on infrastructure all the way to application level. So we have all of these coming together in something that remains very chaotic, as you pointed out. And it's both a strength and a challenge. It's a strength because it allows for some local adaptation. And it's very much in the spirit of that early community of developers that saw the Internet as constantly growing and constantly tailored to local needs. And it's also a challenge because we don't have a global agreement that uh, would set a baseline so anybody can do anything they want and generally these laws come in conflict with one another.

Speaker A: Yeah, yeah.

Speaker B: Look, I think one thing I just want to really quickly underline and Then you, Kieran, we all wake up and take this stuff for granted. I'm listening to you, Emily and Roxana talk about this, right? The Internet feels immutable and kind of ever present, and it's just a critical part of everything. We joke about how unsexy DNS is, but nothing works without it, you know, be it business, home or otherwise. And yet there's all this political struggle, these, you know, islands of Internet behaviors, these obscure organizations doing critical work that underpins it all, from education, finance, you know, your social media, the whole of our lives, all of it. And it's nowhere near as standardized and robust as one might think. And for our listeners, of course, course, if they stop for a moment, they do appreciate the challenges. They understand the difficulties of the protocols involved, the handshake agreements and the weaknesses in the various different things that we're using from the 80s, 90s, 2000s that are long past their cause. But it's so easy to forget it, even for the technically inclined, because life without it's just so unimaginable. So like many human systems, it's imperfect, but it mostly delivers. Kieran, go on.

Speaker A: Well, you see, I told you there are very good teachers because we've only been going 20 minutes and you've learned all that already?

Speaker B: I know it's staggering.

Speaker A: So I'll try and frame it, I mean, for people, say, who are political geeks as opposed to tech geeks like James. Analogies of, say, nuclear security. In the nuclear world, they're always imperfect. But if you look at the way the world works, you've got this thing set up under the auspices of the United nations called the International Atomic Energy Authority. And it's got rules and it's support to enforce them and so forth. We don't have anything like that for the digital world, but we do have a bunch of groups and you've mentioned some of them, Roxanna, doing the soft rules, the standards and so forth, and they've emerged over time. They're mostly sort of, as I understand it, but I'm going to ask you to explain them. They're sort of technical engineering bodies, they've got weird governance, no treaty ever established them and so forth. So could you give us a bit of an insight into this type of world? I mean, Emily's mentioned one, and we'll come back to icann, so you can leave that for Emily. But you've got the ietf, you've got Etsy, you've got Zolti. Actually, I made up Zolti. It doesn't exist. I was just checking. James was still listening.

Speaker B: I'm off to register Zolti McZalt face right now.

Speaker A: But you've got all sorts of the. These bodies, maybe, I don't know, you can pick the ietf because you've told me about it before, or you can pick another one. But these are sort of, maybe even reluctantly, the secret rulers of the Internet universe in some parts. I mean, uh, who are they, how do they work, what do they do? Why does it matter?

Speaker D: Yeah, the ITF is extremely interesting.

Speaker A: So what does it stand for, for a start? Because I didn't say that. Which I should have.

Speaker D: It's the Internet Engineering Task Force.

Speaker A: Excellent. Right, and who are they and what do they do?

Speaker D: So this is a group of people that meets three times a year and sets the standard and protocols for all the basic functionalities we have online.

Speaker A: Right.

Speaker D: They make that every packet can travel, that every website can load, that every email can arrive, and that there are some basic security levels involved with that. So without them, the network wouldn't really function in the way we know it. And for sure it wouldn't be interoperable.

Speaker A: And who selects these people? I mean, why do they get this massive power?

Speaker D: They self select. Wow. In fact, that's, uh, the other interesting aspect related to the ietf.

Speaker B: Wait, wait, wait, wait. One can just decide to be in charge of the Internet. This is, this is interesting news to me.

Speaker D: It's self organized and it is open to everyone. So any one of us could join one of their meetings tomorrow, could propose some protocols, go through the whole process and.

Speaker B: Interesting.

Speaker C: But we couldn't really, could we, Roxana?

Speaker D: In principle we could, yes.

Speaker C: I uh, would definitely be laughed out of the room, or not really laughed out of the room in the Internet Engineering Task Force because although it's self selecting, yes, some stakeholders are more equal than others when it comes to holding your own in Internet protocols.

Speaker A: Uh, and they claim not to be power hungry, don't they? It's kind of the opposite. They say, say I'm, um, quoting from their website. We reject kings, presidents and voting. We believe in rough consensus and running code. Is that still kind of the way they work? Rosanna, how does it go?

Speaker B: Oh, true engineers. Oh, I love it. What a philosophy.

Speaker D: It still works that way. But Emily is right. In principle, it's open to everyone.

Speaker A: Right.

Speaker D: We can sign up for the mailing list, we can attend the meetings, but it's highly technical, so most likely we wouldn't participate meaningfully to the discussions. And it tends to have have a number of nationalities overrepresented and others not present at all. So there's that big gap between those that are in the room and are technically minded and those that are sitting on the sidelines or are not even part of the conversation.

Speaker A: So this is fascinating. What is this national balance, roughly? Did it start off very American and it's now a bit less American, or.

Speaker D: Absolutely. We have the Americas and the Chinese now in the lead.

Speaker A: Right.

Speaker D: And then we have lots of small island nations nowhere near the meeting rooms or mailing lists.

Speaker A: Okay. Uh, and how do the US and Chinese get along in these things? I mean, do they get to these consensus points like they're supposed to, or is there tensions and, um, how do they get resolved? Sorry to prolong the question, but it's just such a fascinating world. So you've got a bunch of engineers who are kind of almost there as a favor, because it is work, but it's inaccessible to most people. But the outputs of these control essentially what we're doing now online, what everybody else is doing online to connect to this. They're not government people is what I'm taking from it. But they might have very different, different views of the world, as Americans and Chinese engineers tend to do. So bring all this together, is that kind of it?

Speaker D: Tensions arise all the time. These meetings can get quite intense. Ultimately, it's a whole negotiation process taking place in those rooms as well as on mailing lists. So you'll have, uh, different points of view, different protocols put forward, and it matters whether those real implementations can work or not. So ultimately, there is a question of merit. Merit in how those protocols advance through the process. But there's also a question of rough consensus. Most participants need to agree that it's worthwhile. It matters who is in the room ultimately.

Speaker B: Okay, so, Emily, I want to bring you back in here. Let's turn to icann. Now, perhaps it's a bit easier to envisage what ICANN does, because names and numbers, dot gov mil, all of that kind of stuff. And you've worked with them as well, so obviously you've got the insider stories for us. What is it? How does it work? What do we need to know about them?

Speaker C: It's so hard to explain. I've tried to explain to my friends and family what ICANN is for 25 years and nothing. Nothing. You know what would happen to you if ICANN suddenly disappeared?

Speaker D: Yeah.

Speaker C: Uh, okay, so let's just do some basics. ICANN is a company. It's a non profit company. So it has all the things that a company has. It has a board of directors and it does things through its company statutes. So so far, so normal. And then it gets weird. So, uh, because it's got this global function and it's a California not for profit, those two things really don't fit together very comfortably. So what's the solution is that it has a staff who are, ah, usually very expert. Very, very expert, but they are very constrained in what they can say or do. Because it's actually, actually the ICANN community that is the engine room of making ICANN happen. And it does this by numerous constituencies, numerous groups, numerous working groups. Quite a siloed structure, I would say. It's sort of modeled to prevent different stakeholders from really interacting with one another, but after a bit they come up with consensus policies. So very much like Roxana was talking about with the Internet Engineering Task Force, the touchstone of these communities is consensus, which in practice actually means unanimity. Very, very difficult to do. And, you know, how do you become a member of the ICANN community? You just show up. Why not? You decide which community you vibe with most and you just join them. And so for policy types like Kieran, this is just like, your brain starts to fry immediately because it's like, how do I know people are who they say they are and working for who they say they are? How do I know that they have any representative capacity or authority to say things or you don't. That's the point. It's all designed that way. So it's sort of got this incredibly homespun feel. And you know, James, I was really struck by what you said earlier about we rely on this infrastructure so much, it almost disappears and melts away in our head. But it's incredibly fragile. I mean, we haven't even talked about the route servers and them being operated sometime by individuals. These guys can die. There's no contracts in place.

Speaker B: Oh, you know, we're gonna get to that, Emily, for sure. I will say this ICAM stuff very quickly then. Kieran, you get me out of the way here. I once heard the expression. I think it applies here. It makes sense if you don't think about it very hard.

Speaker C: I think so.

Speaker B: Which I think is a wonderful description. But you are so right about these types of folks that I'm going to stereotype for a moment. That isn't entirely fair and might sound like it has negative connotations, but I actually mean it with greater signs of respect that the small number of occasions in which I found myself in discussion with some of these folks you're describing, it's like a meeting of the Council of Greybeards, like these kind of arcane wizards with extra clacky heavy keyboards and coffee fueled by passion to somehow make this ridiculous stitched together Internet using string and chewing gum function for the modern world. And it does, seemingly through lots of argumentative long emails and bulletin board discussions and beard stroking. Yeah, you don't have to have a beard. Of course. That's. That's optional.

Speaker C: Yeah, you don't have to even be a B.

Speaker B: No, no, no, no. Exactly. Although I'm working on it, Emily.

Speaker A: We are.

Speaker B: It doesn't grow very fast.

Speaker A: We're getting towards the Spotify classification boundaries more and more. But look, so James, I think we'll have to tear up part of the script at some point because we're essentially promising you and Emily a bit of a geek fest about root servers and, you know, all of that stuff. But, I mean, this is absolutely fascinating. We're often pushed by sans justify the impact of this podcast. So I've got to set a new KPI, which is the listeners are going to sort of take over icann and the idea there's going sudden arrival of people at these meetings. We were told that anybody could turn up and take over the Internet.

Speaker B: We shall call it Operation no Beards.

Speaker A: But until this happens, I mean, in the introduction we say we're dealing with the weird and wacky world of tech security. And then Emily has used the word weird a couple. I think Roxana has too. This is our weirdest and wackiest subject to date. So let's just stick. Before you can geek out with the IETF and ICANN for a minute, I'm going to ask you each a question about just how weird this gets. So, Roxana, you first. We talk about consensus and the, uh, search for consensus at the, Iet etf. Is it true that there's some pretty novel ways of indicating consensus as our secret engineer ruler overlords are agreeing the rules of the Internet. What are some of the ways in which they can indicate consensus?

Speaker D: Humming is one of the ways you can get consensus.

Speaker A: So that is actually true.

Speaker D: That is true.

Speaker A: So you set rules from the Internet

Speaker B: by going, I like it. Is there a required frequency?

Speaker D: There is a sense of yes, how loud that gets in the way room to approve a standard.

Speaker B: Wow. Ah. So frequency and module. I like it. I like it. Good. I once learned to whistle and hum at the same time. Would that be an appreciated skill for driving Internet policy?

Speaker C: Possibly, I think you might become an Internet overlord with those sort of skills, James.

Speaker A: So if that's not mind blowing enough about humming, let me ask a follow up question to you, Emily, about icann, and then we'll come to Roxanne on the same thing. And I think this is one of the most extraordinary incidents in the history of cyberspace and its governance. So we have the awful events of February 2022, and Russia invades Ukraine and look this story up if you don't believe me. Maybe we'll put links to it in the show notes because it's true, but people don't believe it because it's so wild. The Ukrainian government in the form of Mykhailo Fedorov, Ukraine's Deputy Prime Minister and Minister of Digital Transformation at the time of the invasion, he writes an open letter to ican and it says, to the right place. And essentially the content of this letter says, dear Ican, we've been invaded. Please disconnect Russia from the Internet. I mean, that's true, isn't it? Can you take up the story from there?

Speaker C: Yes, uh, I remember it vividly, Kieran, because I was actually in a standards meeting in the UN environment, in the International Telecommunication Union when this letter landed. And very sadly, we've all kind of normalized the events in Ukraine over the last three years. But it's worthwhile remembering the incredible shock and revulsion that was in the room even in this very diplomatic environment. There were walkouts, Russian representatives were expelled from committees and prevented from participating. You know, really tough stuff for a standards meeting. So this letter landed in that everybody was like, oh, no. Because partly it's a request that could be made and could be fulfilled. And very frankly, I think I personally wasn't completely convinced that ICANN was going to come up with the right answer because it was actually a very difficult time to push back on such a request because feelings were running so high. But actually what happened was the ICANN board, in fact, very few days later, four days, again, a miracle if you're an ICANN watcher, that ICANN would turn itself around in a matter of days. They came back with a very thoughtful response, expressing all sorts of the right feelings, but saying, I'm sorry, we can't agree to your requests. But you know, Kiran, you and I have discussed this incident and it's an extraordinary insight into the fragility of the infrastructure, really, that a company that many people have not heard of would have the power to remove a country, country code, top level domain from the root now, would that cut off the Internet for the whole of Russia? No. Would it work? Not really. Would it make people feel like they

Speaker B: were doing something, cause some serious disruption,

Speaker A: though, including to civilians?

Speaker C: It would cause serious disruption. But they also wrote a parallel letter as well to Ripe ncc, the IP address registry. So the numbers that hold the Internet together, you know, and if we're talking about beardy type of communities, that's like, even the ICANN people think that the IP address people are strange change, you know, so absolutely fascinating.

Speaker A: So let me turn it over to Roxana. I started this podcast with an impossible question to you, Emily. So now it's Roxana's turn to get an impossible question. So you wrote negotiating Internet governance in, I think, 2019. So three years before the war, US, China, hostilities, and tech were beginning to really heat up, but they hadn't quite gone to their current level. So in the six years or so since you published this, the current system has been put under strains that it wasn't designed for. So can you reflect on this? You know, is there a better way? Is this system holding up okay? Did ICANN manage all right as the US China tensions, have they got the proper outlets, or is there something better we should be seeking? How is this fragile system that we're all depending on?

Speaker D: I think we've only seen that it's increasingly more vulnerable to this geopolitical competition. So in six years, lots of things have changed. We've seen more of a move to build the, uh, digital barriers. And we're really at risk of seeing these different parts of the world operate with different standards and potentially down the line, have different architectures for the Internet. So China has proposed something in this direction with the new ip. At some point, across different technical organizations, that proposal is still popping up here and there. It hasn't received the consensus it would have needed to move forward. Forward. But there was a sense there that the direction they're taking is towards an Internet that you can control more easily. And then there has been pushback from the west, obviously, to stick to the version of the Internet that we are used to. That in between has also changed, is not so much grounded in those ideals of the 90s, a free, open, accessible Internet. It's much more a, uh, combination of islands that have different levels of control.

Speaker A: Right, okay.

Speaker B: Smorgasbord of Internets.

Speaker D: So we are seeing that risk of no longer operating with standards that can bring us to the same place.

Speaker A: So we're just about holding it together. Let me ask you about one Area where, at least superficially, and my knowledge of this is superficial. Superficially, the world seems to think, look, we may have a smorgasbord of Internets and we'll try and keep it all just about together so everybody can use the same thing. But we have this common problem of cybercrime. So let's all get together and work out how to tackle cybercrime. And surely nobody can disagree with that. And there's talk of global treaties and agreements and so, um, on anything meaningful happening. I mean, every country's facing scourges of ransomware and all of this. What's going on in terms of tackling the criminals?

Speaker D: Yeah. In fact, this is one of the very few areas in which we do have some global consensus. We've just seen the adoption of a UN Cybercrime convention and that was many years in the making. It's the result of years of negotiations at the multilateral level. But it's a good sign that we could get something on paper. Uh, we have a broad framework convention that allows countries then to align their national legislation with what was agreed at the UN level.

Speaker A: Do you think it'll make much practical difference?

Speaker D: It's not likely to change much. And throughout the negotiations we've seen quite a few points of contention. One of them was the scope of criminalization. What exactly is cybercrime? It's a major question. Then human rights safeguards, investigative powers, all of those became points of contention. And it was very clear that Russia and some of the countries proposing parts of the time text and the rest of the world couldn't agree on those. So we have just minimum denominators at the global level.

Speaker A: But fascinating all the same that there's a glimmer of something that looks like a conventional global agreement on this. So thank you for that, James, as always, but particularly in this episode. It's a bit ludicrous to try and do this in one podcast, but I did promise you some geek time. So I'll get my egg timer. Off you go.

Speaker B: I like it. I feel like there's a new podcast series, How James took over the Internet, featuring all of these guests here. Multi part series. But look, Emily, I'd love turn to another part of your work, uh, here on, um, basically the resilience of the digital ecosystem. So I've spent my career abusing dilapidated protocols that could be in theory easily improved. Whether it's address, resolution, protocol at the local kind of network level that trusts things that were last broadcast and authenticated, or frankly a lot of the protocols that hold the Internet together, that have all kinds of kind of weak trust models given the difficulty of implementing some something new. We've seen these examples of BGP route hijacks or route hijacks, depending on one's nomenclature and pronunciation choices. There was that 18 minutes when lots of the US government traffic and so on was accidentally routed through China and the kind of Iranian hijacks and similar. It does seem like we're making some progress on this stuff, but still a lot of these protocols that we use, a lot of these technologies seem way behind how resilient they could be be if we could get more adoption. So I know you're working a lot of foundational level stuff here, working on DNS, security improvements. Is this stuff part of the answer? To what degree does it depend on different governance or better international collaboration? Or is this stuff ticking along and frankly providing decent pipes for the Internet and much of it is about what enterprises do. We can't continue hoping that, you know, some international collaboration is going to save us from ransomware and other dirty contaminants to our clean connection, connected Internet pipes.

Speaker C: It's so difficult, isn't it, James? Because actually, the more you think about it, the more certainly I fall back on how incredible the elegance and simplicity of the foundational protocol for the Internet is. Tcp ip, what is it? Transmission control protocol. Internet protocols indeed.

Speaker B: Getting geeky. I like it.

Speaker C: So the TCP will, you know, do things like maintain state, state, keep the transmission open, and the IP will tell you just very simply who sent something, who received it, where did it come from, where's it going to? That's it. That's all it is. And it's still foundational.

Speaker B: Good, bad or ugly, I'm going to deliver it.

Speaker C: I mean, I've been through 20 years, things that ought to be easy but are difficult. Like, let's get everybody onto the upgraded Internet protocol number because actually the ones we all still use ran out more than 15 years ago. How difficult could it be? It turns out it's incredibly difficult.

Speaker B: How long have we been trying to get IPv6 everywhere? Emily, we've been talking about that since I was born.

Speaker C: Oh my God. I've known people their entire career has been about IPv6 adoption and now they're retiring and it's still not done. And actually we all need to do it for the Internet to function properly, and yet we still don't do it. And it's a bit like one of those human problems we see across all sorts of different environments. Environments there is actually a huge inertia in this system when you get mass adoption. The deeper you go down into the plumbing, the harder it is. It's a bit like, how would you react if I said, your house is fine? I just need to completely rewire and replum it and do the roof as well and underpin your foundation.

Speaker B: Oh, could you, could you move out?

Speaker C: Could I just get away with a lick of paint, please? And so it's all of us, isn't it?

Speaker B: If we just turn the Internet off for a few years, turn it back on with the new protocols, we'd be fine, right?

Speaker C: That's right. So one of the most poignant stories I heard was a lovely interview with Vint Cerf. M, you know, the guy who co developed the brilliant TCPIP protocol, Very eloquent chap as well. Well, he's a wonderful guy. And he said that, uh, at the point that they were doing all of this in the open space, he was also doing a lot of work to try to create a secure Internet, the actual Internet as he saw it. And he felt like it would be so obvious to people that a, uh, secure Internet was better and easier. He just expected everybody to adopt it. And nobody, nobody did. We just carried on with the one we had. And so I think that it's a very, very difficult job and it should be easy, but it's difficult. I don't know why, but it's a bit like a lot of things that when you don't think about very much, you think, well, this should be easy to solve climate change, for example, or world peace. But actually getting there is difficult.

Speaker B: Where principle and good intention meets the reality of use by the entire planet. It is hard to push anything up that kind of hill, isn't it?

Speaker C: It is. And also, like, guys, backwards compatible, you know, would be good. Uh, one of the reasons IPv6 hasn't been adopted is because it's not backwards compatible. It's actually difficult to adopt. You have to get new equipment, you have to spend money on it, and no customer is ever going to say, where's my IPv6 address?

Speaker A: So that choice, the choice not to take Vint Cerf's secure option, is probably a good place to give you the final challenge of this conversation, which is to try to bring this all together. James has talked about making a career out of abusing weaknesses. We're almost being abusive of your time. We have to try to bring this together. Now, the audience for this podcast, you know, it's a mixture of people serving community Orders who are forced to do it by courts, you know, our friends and family, you know, some random people, but mostly. And we love all of you. Thank you. Even those of you doing this under court direction.

Speaker B: Duress, Duress.

Speaker A: Mostly it's cyber, uh, security leaders in organizations could be big companies, small companies in the profession and so forth. And my only worry from this fascinating conversation is we just say to them, look, here is this unbelievably m complicated. Exactly. Underpinning frameworks of the system that you defend all day. And here's all its idiosyncrasies and madnesses and weirdnesses and how they sort of work and we just about hold them together and they go, wow, this is really interesting. But we always have this thing, James's favorite bit, the 30 second takeaway, where we challenge you to sort of give people something useful about how it relates to them so you can do whatever you like. I'll probably ask you first, Roxanna. You can just even just say, look, if you're interested in this and learning more about how it works, here's where you go. Or try and relate it to, you know, how this relates to the life of a corporate defender to a side cybersecurity professional. Bring it home for us. So, James, I'll tee you up to

Speaker B: ask for the 32nd take. It is my favorite part of the podcast. And Kieran, I think you've described it so aptly. I. I really don't need to give more context, just something useful that people can do, can think about or something not to do that they could take away from the podcast. So Roxana, as we gave you extra time to prep your intro, you get to go first to give Emily more time here. It's only fair. So your 30 second takeaway for cyber security leaders on how we're not totally screwed on Internet security and it'll probably be fine at some point. What have you got to tell us?

Speaker D: Please take a look at this invisible part of governing the Internet and do participate. The more are part of it, the better and we can all build a stronger network together.

Speaker B: I like it. Call to action.

Speaker A: Excellent. And actually within 30 seconds. I don't think we've ever had that before. Wow.

Speaker B: Might even been 14 seconds. That's quite the over performance. Very impressive brevity, Emily. If only we could manage that on IPv6 upgrades.

Speaker C: Sorry, Emily, I selfishly want to point to an initiative that we've just started called the Global Signal Exchange, which is trying to address the gap of enabling signal sharing. You know threat signal sharing internationally across different sectors to help to combat cybercrime. It's going really well and although it's very difficult to do, I think we're seeing that people actually want to participate, want to do something and cooperate. It's one of those crazy voluntary things that shouldn't work but somehow seems to be working. So there is hope.

Speaker A: Well, with that, all I can say a mixture of the call to arms to get involved and the practical work on signals exchange, we actually have met the requirement to have takeaways as well as an utterly fascinating overview of one of the most complicated but mind blowing, mind boggling and important issues in this field. So, Roxana and Emily, thank you so, so much.

Speaker B: Fantastic job. Difficult stuff to explain. I'm left with lots of curiosity, lots of acronyms to look up and, um. Kieran, can I have a 30 second takeaway?

Speaker A: Oh, go on then.

Speaker B: I'll promise to be brief.

Speaker A: Do you need the rest of us for this or.

Speaker B: Uh, well, you know, I like an audience, but look, we've been relying on a lot of technology for a long time that, despite more secure and different alternatives, hasn't seen mass adoption necessarily. Whether it's new Internet standards, technologies, networking, quantum computing, AI, there's always new stuff going on. But there's a particular ballooning at the moment, moment of new things that could quite fundamentally disrupt how we connect, how we share information and so on. This is the right time to look at your team and look at who's thinking about architecture, who's thinking about these technology trends and start learning this stuff because it is going to change in some of the most fundamental ways we've seen through the course of my entire career in the last 20 years. So you take a lesson from Emily and Roxana, uh, on this podcast, keep an eye out for these changes. You don't want to be blind to sided. It's my not 30 second takeaway. Rockstar has put me to shame.

Speaker A: A bonus takeaway using up and exceeding the extra time provided by our more succinct guest.

Speaker B: Buffer overflow. Kieran, Buffer overflow.

Speaker A: Well, exactly. That does bring us to a close. I'd just like to ask, as always, for feedback at the podcast site or email us@cyberleaderspodcastans.org all that remains to be said, apart from thanking our wonderful guests, Roxana Radu and Emily Taylor. One once again is to say thank you for listening.

Speaker B: That's right, thank you everyone for listening. Great episode today.

Speaker A: And so keep cybering from me.

Speaker B: Kieran Martin, and me, James Line.

Speaker A: It's goodbye.

Speaker B: And please don't poison any ARP. Um. Or other dilapidated protocols.