Presented at MIT Workshop on Internet Economics March 1995

Abstract

A flurry of events in 1995 demonstrated that issues related to electronic commerce and information security are of deep concern to the public, businesses, government, researchers, and users of the rapidly expanding Internet. The sometimes heated and wide ranging debate concerning cryptographic policy, content controls, commerce, and interoperability on the Internet tends to divert attention away from the need for a reasoned assessment and understanding of the true dynamics of nurturing a diverse global marketplace on the Internet. Lost in the contentious debate is a principle we feel is particularly important given the nature of information technology: that a policy consistent with user requirements and market acceptance provides economic benefits. In some cases, the 'economic pie' can be expanded—or shrunk—by corporate or government actions, inevitably affecting all.

We argue that information security is compromised if federal policies and corporate initiatives ignore user requirements and the basic principles of Internet economics. This in turn may limit market acceptance of new research, services, applications, and technologies. For example, unintended results from ill-formed federal laws may severely limit economic benefits gained from billions of dollars of federally sponsored research that created and sustained the Internet. Furthermore, in the guise of enhanced security and advanced features, proprietary systems and partitioned markets lead to a lack of interoperability that further compromises prospects for society to realize the aforementioned benefits. Many of these problems can be avoided by an open policymaking process that is informed by collaborative research and development activities.

It would be ironic indeed if the set of federal policies that founded and sustained the precursors of the evolving electronic marketplace centered on the Internet forced those new opportunities offshore. Aside from affecting the balance of trade, jobs and opportunities for further innovation will possibly be lost to overseas competitors. Specifically, the information security policies of the Cold War era, which provided much of the motivation for the critical federal research and development support of the Internet and its predecessors, the NSFnet and ARPANET, threaten to cripple the development of commercially acceptable levels of security for electronic marketplace transactions.

These issues are discussed in this paper, by drawing on recent events and the Commerce and Information Security session of March 9-10, 1995; part of an NSF and ARPA- sponsored workshop on Internet Economics held at MIT. An intensified dialog among industry, academia, government, and the public on information security and electronic commerce issues is clearly needed. Our research shows that these issues are critical to establishing and maintaining U.S. leadership in the Age of Information.

Introduction

Electronic commerce and information security are growing areas of concern to user communities. New applications, new users, and faster connections have spurred the Internet to become an important medium for communication, information dissemination, and commerce. Nevertheless, planned and current security policy regarding the Internet is not well developed. In its absence entrepreneurs, venture capitalists, technologists, and other nations are amassing knowledge and funding so as to exploit the benefits of the new age. The complete lack of federal involvement in this realm would be felt by the lack of a cohesive national policy, the disadvantage our corporations would face in competing against large foreign conglomerates, and an alarming disarray of protocols that do no interoperate, become static, and ultimately fail. However, a partial and misguided federal involvement could be even worse—purposefully crippling the capabilities of our technological sector to meet the worldwide demand for secure and interoperable communications and commerce.

Many constituencies are beginning to recognize that the growth and benefits of the Internet are explained by a combination of economic, technical, and policy factors: positive economic network externalities such as the bandwagon effect, economies of distribution and scale, and statistical sharing [1]; other benefits are the interoperable and layered approach of the Internet, and the distributed peer-to-peer architecture. [2] Unfortunately, information security does not tend to exhibit positive network effects; instead, it takes an immense amount of knowledge, foresight, and technical skill to design an effective infrastructure. However, the giddy expectations of the Internet's abundant information resources and new market potential cannot be fully realized until the alarm over the lack of a security policy expressed by some federal agencies, businesses, and the public has been addressed.

We will explore these issues and their implications for future federal research and development activities. To do this requires at least a rudimentary understanding of the uniqueness of Internet Economics. (A more detailed analysis on this topic is forthcoming [3].)

Internet Economics

The Internet Economics Workshop concerned itself with the rise of a new marketplace, a new economy, and with how to evaluate that marketplace from an analytical, economic, and technological point of view. Perhaps in no other technological market is the underlying technology such an integral part of the market. A very large portion of the expenditures and profits concerning the online world are currently for infrastructure. [4] This is important because one cannot simply create a product, conduct marketing research, price the object, and place it before consumers. Rather, it is the real demand—very different from the assumed or perceived demand—that guides which infrastructure/product is the most efficient and cost effective.

Furthermore, research and development funding can have an immense impact on what occurs in the real marketplace within a matter of a few years! To examine one quirky example, the NCSA was established in 1985 [5] to conduct research on high- performance computing and communications with funding from the HPCC program and other corporate/government support. Capitalizing on work previously done by CERN in 1989 on HTTP, the NCSA offered the world the Mosaic browser in 1992. In three short years the result hardly needs explaining: the usage, expansion, and the excitement over future applications for the World-Wide Web are phenomenal. Returning to our point, the economics of such a new and dynamic environment are simply not very well understood. An example of this was the large amount of discussion concerning pricing at the workshop. Which form of pricing is the most efficient? Flat- rate pricing where a fee is paid to connect, but usage is not metered? Usage-sensitive pricing where usage is metered and a fee is paid for each bit sent and/or received? Or, transaction-based pricing where the price is determined by the characteristics of a transaction and not by the number of bits sent and/or received? This very much depends on user behavior, which in turn is affected by the biases of the technology already deployed.

An example of such ambiguity resulting from user behavior was made by David Clark [6] during the workshop when he introduced the term expected capacity: during congestion the users pragmatically have an expectation about what they can do, based on what has happened in the past. If one could measure such expectations, one could actually assess the needs of users and charge them differently. User behavior is based on provisioning, which in turn is based on the amount of network bandwidth. Perhaps in order to maximize the utility of all involved one should set cost according to the expected capacity.

Eric Brynjolfsson noted that our current accounting practices and economic concepts were invented for the industrial age a century ago. The information productivity paradox (in which companies employing IT do not see significant gains in productivity) is not necessarily the result of the lack of productivity increases. Rather, it could be a sign that economists are not measuring added value properly . Just as we need new designs for organizations and markets, we also need new metrics for measuring value in the information age.

Not only is user behavior at the personal level important, but so is the ethos and culture of the user base as a whole. At the workshop, Mitch Kapor argued that the "Internet culture" has relied on collaboration and is likely to lead to better overall results. Admittedly there will always be misbehaving or malicious users. Nevertheless, a system will be designed very differently depending on whether criminals are the norm or exception. Based on this principle, Kapor and others posed the following questions. Does the Federal government's cryptographic policy presume that the infrastructure should be built about the assumption that a portion (even if very small) of the users are malicious or conducting illegal activities? Will the commercialization and privatization of the Internet break down the cooperative nature and assumption that the Net citizen one meets is a good citizen? Is it economically feasible to retain the Internet culture and support for heterogeneity? One would hope the previous culture of the Internet will grow into the future. The Internet has thrived because of a culture of cooperation. Significant positive network externalities associated with being on the Internet have translated to powerful economic incentives to cooperate. These incentives bring perceived benefits to individual users and have been, until now, sufficient motivation to avoid worst case abuses.

Thus, the challenge is not only to develop effective Internet pricing and security mechanisms, but to do so without losing the benefits of positive network externalities currently gained through interoperability, cooperation, statistical sharing, and the peer-to-peer architecture of the Internet. Achieving economic efficiency without inciting users to abandon the Internet's core technical and cultural approach is the challenge to policymakers, businesses, and the public.

Commerce and Information Security Policy

Within the single month of August 1995 a number of startling events confirmed the impressions of many at the Internet Economics Workshop, [7] that electronic commerce and information security is an extraordinarily exciting field as well as an area that is woefully neglected in terms of proper policy. An announcement regarding electronic commerce was made by fourteen banks and financial institutions that formed a company under the name of SmartCash. Participants include MasterCard, Bank One, and the Bank of America; the goal of the program is to provide smart cards that can hold immense amounts of information and security functionality. Also, efforts are wisely being made to standardized SmartCash's system with those being developed by Europay, and Visa. [8] Also recently, Phil Zimmermann, author of the personal encryption application PGP, has announced the release of the telephony application PGPfone which will allow users to conduct encrypted voice communications over normal phone lines and eventually the Internet! However, references to Phil Zimmermann and interoperating with Europay (a European electronic commerce company) quickly turns one's mind to the announcements regarding the US's cryptographic policies. The US has pursued a domestic cryptographic policy that some argue violates its citizens' right to privacy, as well as a foreign export policy thought by most industry leaders to be damaging the competitiveness of American companies. [9]

Most people concerned with cryptographic policy followed the Clipper Chip debate and many argued that a mandatory requirement to disallow citizens from using all cryptography other than that to which the government would have backdoor access would be a violation of civil rights. The Clinton administration contended that it was never its goal to disallow other forms of cryptography (like PGP) but merely to make the Clipper protocol the required protocol for communications with the federal government. However, the Electronic Privacy Information Center (EPIC) under the Freedom of Information Act recently obtained and made public files from the FBI. One of the files submitted to the White House National Security Council in February 1993 was entitled "Encryption: The Threat, Applications and Potential Solutions" and was endorsed by the FBI, NSA, and the Department of Justice. The document states, "Technical solutions, such as they are, will only work if they are incorporated into all encryption products. To ensure that this occurs, legislation mandating the use of government- approved encryption products or adherence to government encryption criteria is required." [10] Similar documents confirmed the fact that recommendations were being made contrary to the public statements of those organization at that time.

In the field of electronic commerce, two members of the Internet mailing list "cypherpunks" recently broke a 40-bit RC4 key, an algorithm used by Netscape's Secure Socket Layer (SSL). SSL is the security protocol built into the Netscape Navigator and Commerce Server to allow for the authentication of customers of Internet stores and for the encryption of payment information such as credit card numbers. The 40-bit key has long been considered to be very weak (Netscape itself has acknowledged this) however little can be done to strengthen the protocol since export restrictions disallow the use of longer keys. Unfortunately, since the information market is largely international, most Netscape browsers in use are in fact the Ôweakened' applications. This poses a risk to the users of electronic commerce as well as to America's technological strength: other countries without such restrictions can easily develop stronger products that can be sold competitively throughout the world. Unfortunately, the government's response has been a return to the Clipper/Capstone proposal. In August 1995, Ray Kammer of the National Institute of Standards and Technology and Michael Nelson of the White House Office of Science and Technology Policy announced that the administration would propose to allow the use of 64-bit keys in international products if those products had a key escrow system similar to the one proposed in the Capstone/Clipper initiative. Industry has responded favorably to the administration's movement on this issue but Robert Holleyman, president of the Business Software Alliance stated that though it was "a step in the right direction, "the 64-bit limit is "unnecessary and incompatible with the whole purpose behind key escrow systems which will allow lawful government access and, importantly, assure users the privacy and security they need for their communications." [11]

Commerce and Information Security Research

These events underscore the concern many feel regarding the possible loss of America's prominent place in information technologies. The state of the art in these technologies was presented at the Internet Economics Workshop. Presentations on the significant research underway towards designing architectures for billing [12] and electronic payment mechanisms [13] reflected that without information security many of the positive economic effects regarding payment and billing would not be possible. Certainly, without security, information technologies cannot realize their full potential. From a policy perspective, in making decisions regarding information security and electronic commerce, equal consideration must be given to: 1) the role of government, 2) the role of Internet users, and 3) the role the Internet has in a global economy.

To show the extent of the importance and concern of developers of systems dependent on information security policy we briefly present some of the technologies discussed at the workshop.

Marvin Sirbu of Carnegie Mellon University, developer of the NetBill system, concluded his analysis by stating that security and privacy issues must be addressed to ensure the integrity of electronic commerce systems. NetBill, an Internet billing and payment system, employs digital signatures, encrypted goods delivery, and pseudonyms to support anonymity. Moreover, NetBill recognizes the importance of interoperability by building on a foundation of standard interfaces and open protocols.

Clifford Neuman of ISI, developer of the NetCheque System, argued that services envisioned for the NII will themselves be a part of the electronic marketplace, for electronic commerce services can only be offered efficiently if service providers are themselves compensated for their work. NetCheque is a system that supports payment for access to NII services. Such an electronic payment service must have a secure, reliable, and efficient system design. Specifically, the system must be flexible to support many different payment mechanisms, scalable to support multiple independent accounting services, efficient to avoid delays, and unobtrusive so that users will not be constantly interrupted. Furthermore, there are several forms of payments that must be considered, including secure presentation, electronic currency, and credit-debit instruments.

As the final example, Dan Schutzer of Citibank noted that the key needs of electronic commerce include security, privacy, and intellectual property protection. The electronic commerce architecture must be open and provide for a competitive market. If possible, it should reach everyone without requiring merchants to vie for electronic storefront space.

Future Directions for Research and Development on Electronic Commerce and Information Security

A great deal of significant work has been done by researchers and developers of systems like the ones presented above. However, there is also a great deal of work yet to be done in the technical and engineering fields to make such systems efficient. Of equal importance is the work left to be done by members of the policy, economic, and business fields to properly understand what has previously occurred on systems like the Internet and how these lessons may be applied in the future. Economists will have to come to a new understanding of Internet utility and pricing models; businesses will have to adapt their marketing, customer service, product support, and sales infrastructure to a digital marketplace; and policymakers will have to realize— among other things—the international aspects of the new market.

Significant opportunities to address these issues are present. However, the government's actions have continued to be heavily influenced by enforcement and intelligence agencies contrary to the expressed interests of many researchers, civil liberty groups, and leaders in the information technology industry. The upcoming NIST key escrow workshops are an example of an opportunity at which these issues could be publicly discussed. However, the intent of the workshops is expressed as follows:

1. developing the criteria for software key escrow encryption exportability and
2. the desirable characteristics for U.S. key escrow agents. [14]

which continues to exclude non-escrow alternatives. All constituents should have ample opportunity to discuss the full range of cryptographic policy initiatives. Members of the MIT Research Program on Communications Policy are working to promote opportunities for such discussions to take place.

Conclusion

As is often the case regarding the implementations of large complex systems which have an impact on society as a whole, the questions to be answered and the problems to be resolved are clear. Additionally, the Internet may not only have an impact on society, but may become an integral part of our lives when it guides our cars, provides us our entertainment, and allows us to pay our bills. Consequently, it would seem that there are even a greater number of questions and thornier problems—all of which interrelate in a delicate web of mutual influence. Since there are so many questions, the most important question is which of the others need to be answered now rather than later? Many would agree that one of the questions that needs to be dealt with now concerns the security infrastructure which will be the basis of the new marketplace and the Information Age. An infrastructure that is full of holes, plagued by fraud, rife with spies, and lurching upon a single leg for lack of interoperability are the consequences of a short-sighted policy. A direct result of the Internet Economics Workshop and research by the authors is that issues related to information security and the economic understanding through which the infrastructure is developed are of pivotal importance to this nation's future.

Acknowledgments

An earlier draft of this paper, titled "Strategies for Federal R & D on Heterogeneity and Information Security", was submitted to the America in the Age of Information: A Forum on Federal Information and Communications R & D. This paper draws upon work partially funded by the Sloan Foundation, the National Science Foundation, grant #NCR-9509244, and the Advanced Research Projects Agency, contract #N00174-93-C- 0036. This paper draws extensively on the research and insights of the participants in the Internet Economics workshop, their critical contribution to the development of this paper is gratefully acknowledged. Please consult our home page ([formerly http://rpcp.mit.edu/Workshops/cfp.html]) for Internet Economics workshop notes and other information. Any errors of fact or by omission are the author's sole responsibility. Views expressed here are the personal views of the authors, and not their sponsoring institutions.

Author Information

Dr. Lee McKnight (mcknight@rpcp.mit.edu ) may be reached at the MIT Research Program on Communications Policy; Center for Technology, Policy, and Industrial Development; Massachusetts Institute of Technology; MIT, E40- 218; 77 Massachusetts Avenue; Cambridge, MA 02139.

References

J. Bailey, S. Gillett, D Gingold, B. Leida, D. Melcher, J. Reagle, J. Roh, R. Rothestein, and G. Seale, "Internet Economics Workshop Notes," Research Program on Communications Policy, MIT, MA, USA, March 30, 1995.

J. Bailey, "Interconnection Agreements and Internet Economics," forthcoming, Journal of Electronic Publishing, University of Michigan Press, 1995.

Committee on Information and Communications, National Science and Technology Council, "America in the Age of Information," National Coordination Office for HPCC, Executive Office of the President, Office of Science and Technology Policy, March 10, 1995.

"The impact of electronic commerce on buyer-seller relationships," Charles Steinfield and Alice Plummer, Michigan State University, East Lansing, MI, USA and Robert Kraut, Carnegie-Mellon University, Pittsburgh, PA, USA. Paper presented at the International Communications Association Annual Meeting, May 25 to 29, 1995.

"The information superhighway and electronic commerce: Effects of electric markets," Rolf Wigand and Robert Benjamin, Syracuse University, New York, USA. Paper presented at the International Communications Association Annual Meeting, May 25 to 29, 1995.

"Electronic commerce and the banking industry: A study of Japanese, US, and UK owned banks in London," Andreas Crede, University of Sussex, UK. Paper presented at the International Communications Association Annual Meeting, May 25 to 29, 1995.

"Electronic markets: Automation or support of transactions?" Arnold Picot, Christine Bortenlanger, and Heiner Rohrl, University of Munich, Germany. Paper presented at the International Communications Association Annual Meeting, May 25 to 29, 1995.

D. Clark, "A Model for Pricing the Internet," forthcoming, Journal of Electronic Publishing, 1995.

L. McKnight and J. Bailey, ed., "Internet Economics," forthcoming, Journal of Electronic Publishing. University of Michigan Press, 1995.

G. Medvinsky, and C. Neuman, "NetCash: A Design for Practical Electronic Currency on the Internet," ACM Conference on Computer and Communications Security, 1993.

C. Neuman and G. Medvinsky, "Requirements for Network Payment: The NetCheque Perspective," Proceedings of IEEE Compcon '95, March, 1995.

M. Sirbu, and J. Tygar, "NetBill: An Internet Commerce System Optimized for Network Delivered Services," Carnegie Mellon University, 1995.

"Internet Economics Workshop Notes," J. Bailey, S. Gillett, D Gingold, B. Leida, D. Melcher, J. Reagle, J. Roh, R. Rothstein, and G. Seale, Research Program on Communications Policy, MIT, MA, USA, March 30, 1995.

"Interconnection Agreements and Internet Economics," J. Bailey. forthcoming, Journal of Electronic Publishing, University of Michigan Press, 1995.

Papers presented at the International Communications Association Annual Meeting, May 25 to 29, 1995. For further information see: "The impact of electronic commerce on buyer- seller relationships," Charles Steinfield and Alice Plummer, Michigan State University, East Lansing, MI, USA and Robert Kraut, Carnegie-Mellon University, Pittsburgh, PA, USA; "The information superhighway and electronic commerce: Effects of electric markets," Rolf Wigand and Robert Benjamin, Syracuse University, New York, USA; "Electronic commerce and the banking industry: A study of Japanese, US, and UK owned banks in London," Andreas Crede, University of Sussex, UK; "Electronic markets: Automation or support of transactions?" Arnold Picot, Christine Bortenlanger, and Heiner Rohrl, University of Munich, Germany.

Notes

1. Statistical sharing is the ability for networks to allocate bandwidth to users based upon the users' needs. It does not allocate a fixed bandwidth for all users so that the bursty nature of the traffic can be accomodated. As the bursty traffic get aggregated by all users, better performance can be realized. For example, when user A is idle, more bandwidth can be given to user B who is doing a large file transfer.

2. This definition of the critical features of the Internet as well as other findings discussed in this paper are partially a result of the authors' work in organizing an Internet Economics Workshop (hereinafter referred to as "the workshop") sponsored by the National Science Foundation and Advanced Research Projects Agency. The workshop was held in Cambridge, MA at MIT on March 9 & 10, 1995.

3. L. McKnight and J. Bailey, ed., "Internet Economics," forthcoming, Journal of Electronic Publishing. University of Michigan Press, 1995.

4. In "Computer Networking: Global Infrastructure for the 21st Century" V. Cerf stated that, "Although not easy to estimate with accuracy, the 1994 data communications market approached roughly $15 billion/year if one includes private line data services ($9 billion/year), local area network and bridge/router equipment ($3 billion/year), wide area network services ($1 billion/year), electronic messaging and online services ($1 billion/year), and proprietary networking software and hardware ($1 billion/year). Some of these markets show annual growth rates in the 35-50% range, and the Internet itself has doubled in size each year since 1988. "

5. See http://www.ncsa.uiuc.edu/About/NCSA/ for details.

6. D. Clark, "A Model for Pricing the Internet," forthcoming, Journal of Electronic Publishing, University of Michigan Press, 1995.

7. This section of the paper addresses the notes from the Internet Economics Workshop held on March 9 & 10, 1995 in Cambridge, MA at MIT are available from the workshop's World Wide Web (WWW) server ([formerly http://rpcp.mit .edu/Workshops/cfp.html]) in postscript and ASCII form along with other information about the workshop.

8. New York, Aug. 16 (Reuters).

9. An open later to the Honorable Lee Hamilton, Chairman of the House Foreign Affairs Committee. http://www.eff.org/Crypto/ITAR_export/hamilton_eff_industry.letter.

10. " FBI Documents - Clipper Must Be Mandatory", 08/23/95, Clari News Services: clari.nb.govt.

11. "White House Offers Encryption Compromise", 08/22/95, Clari News Services: clari.nb.govt.

12. M. Sirbu, and J. Tygar, "NetBill: An Internet Commerce System Optimized for Network Delivered Services," Carnegie Mellon University, 1995, and C. Neuman and G. Medvinsky, "Requirements for Network Payment: The NetCheque Perspective," Proceedings of IEEE Compcon '95, March, 1995.

13. G. Medvinsky, and C. Neuman, "NetCash: A Design for Practical Electronic Currency on the Internet," ACM Conference on Computer and Communications Security, 1993.

14. Attachments to the August 22, 1995 memorandum from Ed Roback of NIST concerning "Upcoming Key Escrow Meetings."