WS 354 PRIVACY FROM REGIONAL REGULATIONS TO GLOBAL CONNECTIONS

 

FINISHED TRANSCRIPT

EIGHTH INTERNET GOVERNANCE FORUM

BALI

BUILDING BRIDGES ‑ ENHANCING MULTISTAKEHOLDER COOPERATION FOR GROWTH AND SUSTAINABLE DEVELOPMENT

OCTOBER 24, 2013

9:00 AM

WORKSHOP 354

PRIVACY FROM REGIONAL REGULATIONS TO GLOBAL CONNECTIONS

********

This text is being provided in a rough draft format. Communication Access Realtime Translation (CART) is provided in order to facilitate communication accessibility and may not be a totally verbatim record of the proceedings.

********

>> MODERATOR: Good morning to everybody. We start this workshop session here we have several participants making the presentation about the effective applications of multistakeholder in different areas. I will participate as the moderator and as a speaker and we will talk about our Brazil.

First I will ask Alexandre to do the opening. The floor is yours.

>> ALEXANDRE FONTENELLE: Thank you very much. It's a pleasure to be here with you. I believe this workshop gives us a very good opportunity to speak about the principles, in the context of the WSIS review process for which Brazil attributes great, more are developed following the principles established in the Geneva declaration in the first phase of the work summit on Information Society.

As you know ‑‑ well, first of all, I forgot to present myself. I'm Alexandre Fontenelle, I'm from the ministry of external relations of Brazil. As you know, Brazil has been participating very actively in the follow‑up of the WSIS, not only in the government level, but all multistakeholders are involved that we are discussing, the implementation of the recommendations of the WSIS. Internally, we have developed, as most of you are already familiar, the Brazilian Internet Steering Committee, CGI.br. It is a multistakeholder entity comprising of private sector, Civil Society, academia, and technical communities.

And for the past year this model has been attracting a lot of attention from many countries and different stakeholders, for its transparent and democratic approach which coincides with what was established at the WSIS summit.

The CGI aims at coordinating and integrating all Internet service initiatives in Brazil, promoting innovation, quality dissemination of services, and, of course, also managing the NIC.br. It's financial sources were not only destined to that, but also to foster research and different initiatives as later on we will see how important these initiatives are. It was also in the CGI.br in the government use of Internet, which we already presented in previous decisions of IGF, which had an important role in the development of the Brazilian Internet, which was in discussion in the Brazilian Congress.

As mentioned by Minister Paul Bernardo in the opening session will be a legislation that will establish a set of principles for the usage of Internet in Brazil by also defining rights and duties of Internet users. And these same principles also guided President Dumas in the speech at the United Nations General Assembly this year. In that occasion she mentioned freedom of expression, privacy of the individual and respect for human rights, open democratic governance carried out with transparency by stimulating collective creativity and participation of society, governments, private sector and multistakeholder as we heard in her speech later on, universality in the known discriminatory societies, without imposition of beliefs, customs and values, net neutrality, rendering it inadmissible restricted for political, commercial, religious, or any other purpose.

Of course, as you know, these principles were presented by our president in the context of the Brazilian response to the surveillance programs that affected the communication of Brazilian citizens, companies, and high‑level authorities.

While mentioning again our Minister Paul Bernard and the president, these principles we believe should guide us in the direction of a more democratic transparent Internet Governance. To enrich ethics also play a very important role. It's not my intention here to divert the focus of our discussion from the multistakeholder initiatives in the follow‑up of the WSIS declaration of principles. However, being from the Brazilian government, I could not abstain myself from commenting on this very important aspect of our policy to Internet Governance nowadays.

As you know, our president announced our intention to host a summit next ‑‑ in the first semester of next year, probably at the end of April, early May, to which, of course, we counsel on all stakeholders.

We believe will also help us in the follow‑up of the WSIS summit in many aspects of the WSIS outcomes that today we feel still have not been adequately implemented. So this is also one initiative that will feed our already existing processes.

So with these comments, I think I will give the floor to the other panelists which will present more concrete initiatives on the implementation of WSIS principles. Thank you.

>> MODERATOR: Next speaker would be Nnenna Ndakanma. I ask you to present yourself.

>> NNENNA NDAKANMA: Good morning. My name is Nnenna Ndakanma. I'm wearing the African Society badge, and I'm speaking on my personal behalf. I'm not speaking on behalf of the Worldwide Web Foundation. I cannot even pretend to speak on behalf of the whole of Africa. So I would just be speaking as someone who has been through WSIS on the self‑society side before the WSIS declaration and after the WSIS.

The first thing I would like to do is to remind us, I see some veterans here. Raul is here. Raul has been there from day minus one. And I see some of the people here around. I salute you all. Some people have grown gray hair since then, is grown fatter, they've aged in ten years. Someone who was born during prep now has a Smartphone. Someone who is born at that time now owns a Smartphone. That's how far we've come.

I want to point out particular issues. WSIS was one that came to bring in Civil Society. Before then I used to be a human rights activist. I used to be outside of U.N. conferences then. WSIS was the one that said you guys come in and let's hear you. So that was a break in tradition in the UN tradition for Civil Society and human rights activists. So that was the first initiative in itself.

During the prep, there was still government, but still open governments that said no, let's come to the table. So question a lot of drafting. The first thing we did was to have the Internet Governance Caucus. There were a lot of caucuses going around, but the Civil Society established itself as a stakeholder. And there were caucuses along the actual lines, education, human rights, Civil Society, governance. I still recall we had a finance caucus in those days, child rights. There were lots of these caucuses. And we did fit in into the general documents Prep‑Com1, Prep‑Com2, Geneva, second round, and finally Tunis to what we call a Tunis Agenda.

To be honest, the Tunis Agenda did not capture all our desires as Civil Society. Of course, did not capture all my desires as Nnenna, but we did realize this was a watered down consensus document. So now, moving from a watered‑down consensus document, how do we go about implementing it? And what I can say in multistakeholder initiatives is that in itself has been a victory. At least it has been what the French people call a key. It's been a solid result that at every point in time all the action line holders ‑‑ all the action line legacy holders, if I can call them ITU, and every other person, have met an e‑foot to be open. I recognize that an e‑foot has been made, Mr. Chair. I'm not saying that is effective.

And when I was doing the opening speech, I'm asking myself, should we be measuring multistakeholderism now? Because it is not enough to say all stakeholders are welcome. We must make sure that the participation of all stakeholders is equally valued.

The issue, as we've been ten years, can we say that the participation of all stakeholders have equal value? That's number one question. The second question is have we consciously engaged in making sure that the presence, the participation, the contribution, the desires of all stakeholders have equal footing? Finally, now that WSIS is getting to ten years old, where next are we going?

It's a good thing that this session is being organized by Brazil. Let me say that way. Now Brazil had stood up. Now everyone's looking at Brazil. So my last question will be what will be the rule that madam, thank you God, she's a lady ‑‑ thank you that she is a lady. So this great nation, led by a great woman, that is making efforts into looking at what could be a more participative approach. So my last question will be what will be the role of Brazil in multistakeholder initiatives around the policy areas of Internet Governance in particular and WSIS plus 10 in general. So I don't have answers to give you. Maybe you will regret that you have ever invited me, but I have questions for everyone here.

Thank you for now.

>> MODERATOR: Thank you, Nnenna. Our next speaker, everyone knows you.

>>RAUL ECHEBERIA: My name is Raul Echeberia. I'm from the Latino and the Caribbean group. I'm happy to be here. Thank you for the invitation to organize this workshop.

I think the topic of this workshop is really very interesting. The first thing that happened to me after I was invited to be part of this workshop was that I started to think about what happened in 2003. And I had not done that for a long time. And it is interesting when we realize that everything has changed since 2003. And just as one example, remember those of you that were around those topics at that time, remember that no government organizations were not permitted to participate in most of the debates in Geneva in 2003. In fact, we were not permitted to go into the rooms, as we were outside of the rooms trying to lobby the governmental representatives that were more friendly to us. We were trying to talk to them to explain our points.

When we come back to the present time, we realized that at this moment it's almost impossible to justify that something would be discussed in a normal stakeholder way. Sometimes when you are in a conference and you are writing or participating in the wording of our resolution, you don't understand the importance of what is happening. In many times of the things that are right you have no importance at all. But the impact of this declaration of principles in 2003 was really huge.

And I have to confess now when I look at 2003 again that the solution that was provided by the UN Attorney General at the time to save the summit that was really close of failure, the solution that he proposed to create the working group on Internet Governance was really a brilliant solution. And the working group on Internet Governance was a multistakeholder experience itself. And I say the professor was a colleague in that adventure in that working group. And so I remember the first time that I walk in the Geneva, we realize that there was not Internet access there. There was not enough plugs for connecting our computers.

So most of us say, okay, if this is the situation, we cannot work here. We will not come back because we cannot come to stay two or three days working in a working group in a closed room without connectivity.

So the next time when we come back to Geneva, everything had changed. We had Internet access. And the format of the desk had changed that we had enough plugs for connect the computers. And I realized how we were impacting in those small things the way in which the work was done in United Nations at the time.

It was a point that everything changed since that. And so we had opportunity to arrive to the second part of the summit in 2005 with a more clear understanding of all stakeholders that permitted to consolidate the principles of the Internet Governance.

So let's see. Let me not ‑‑ I would beg you permit me to not be very humble. And I think there is a good example of openness and participation. We are very open in our culture. Probably if we would not have that discussion in 2003 and 2005, we would not have changed the way that we use it to work. But we understand in that process to involve all the stakeholders. It became part of our culture. We cannot conceive our work without that openness.

We are not only open to the input coming from other stakeholder groups, but we are practically engaging and looking for engagement of all stakeholders. So we don't wait for people to come to ask to work with us. We go there trying to engage the people.

We have usually meetings with governments and Civil Society trying to understand what we can do in order to satisfy the expectations. In fact, tomorrow we have a meeting with the Internet Society. We're trying to understand what do you expect from us and anticipating a claim from any of those groups.

There is a level of maturity among the stakeholders in the Caribbean is really impressive. One example is ALAC is the Information Society in the region. It's a process that is led by Economic Commission of the Latin and Caribbean. In the first meeting that was held in 2005, it happened the same that I mentioned with regard to WSIS. The nongovernmental organizations were not allowed to participate in the discussions.

Now, since 2008, we not only are allowed to go into the rooms and participate in the debates, but also we are part of the following mechanism. There is a mechanism that is formed by governments and representatives from Civil Society and private sector and the community. We are following up in between the meetings, the mechanism of following up with what's happening in the region with regard to the Information Society.

The tradition that intergovernmental forums are increasing in the region, we are not only allowed to participate, but invited to participate. So now I can say that this is nongovernmental stakeholders are more open to the participation of governments and to the other stakeholders, too. Also, the tradition of governments is open to the participation of other groups. I think this happens just because the ‑‑ what we did ten years ago in 2003 in Geneva when the WSIS first part of the WSIS summit adopted those principles.

Now I think the next challenge is to go one step forward to increase the number of ‑‑ to step up the multistakeholder at the national level. There are some good examples mentioned here like the Brazilian 1, and other examples around the world. But the most common is that same governments or same people that promote multistakeholder government mechanisms in the level, don't implement governments at the national level. What we need now in order to have more involvement in all stakeholders in public policies that are mainly at the national level.

Thank you.

>> MODERATOR: Thank you. So now Cristine will present the case of using technical management. Cristine, explain the situation and technical background. Later will you present how you will implement the solution in Brazil.

>> CHRISTINE HOEPERS: Thank you. Good morning, everyone. My name is Cristine. I am from the technical community, the technical side. So I'm going to dive a little bit more in the technical area. Specifically, this effort that we did in Brazil, I think it's one of the examples of how multistakeholder model takes people from different countries or different sectors, but also from different backgrounds. This was an effort that actually brought together people from the legal area, from policy making areas, the technical people, all to understand the same problem and try to see how cooperating in doing everyone its part would actually make a difference for the situation in Brazil. I will talk about what it is that we are trying to solve, so we ask people that were in the main session. Spam was a major issue being discussed there and I think it was pretty clear that we have several different areas to combat spam. Even the definition of spam is not actually clear. There's criminal activities involving spam. There are botnet being used to send spam. There are also enterprising sending advertisement and it's really a broad problem. And then we'll talk more about the challenges and how are the multistakeholder challenges that we discussed in all the meetings and negotiations.

Basically what was the part of the spam problem that we were talking and trying to resolve. Was not really all spam. There is no solution that would be able to solve everything. And back in 2009, especially Brazil was being called like the king of spam, the country that had most spam in the world. And we were already doing some studies at that time that we expanded with the support from the Brazilian Internet committee and doing studies. We were able to show more than 90% of our spam leaving Brazil was actually coming from other countries. So Brazil was not a source of spam. As most countries, we were just the middle man. We were just someone being abused, abused our infrastructure to send spam.

This was having a negative effect in the country and problems for our networks. We had networks being blacklists, people having difficulty to send spam.

The common goal for everybody was really how to reduce abuse of the Brazilian infrastructure by spammers and by criminal. I think this is the major point. From a technical point of view, the name is very complicated, like what it is. It's really that e‑mail started the very beginning if we were talking where everybody would just connect to a Unix machine. That was the early days. No one would have Smartphones or PC's at home. So basically we would use the same protocol and the same technical users and technical means to sending e‑mails and transport and everything.

What this is really is an evolution to separate from my Smartphone sending an e‑mail to my provider and delivering. And what this is is really to separate. If there's an image here just to see that, you know, legitimate users, what do you do? You have Hotmail, Gmail, or whatever account. You just send an e‑mail. That goes to your provider. That is the first loop. The second one, that provider delivers to the other one.

The thing is that the spammers, they subvert that. They really, as the protocol is the same, they just go and deliver themselves. And that's what's really the problem we're trying to see is that people were not using the fair use of the Internet, were not using the right protocols. We were having a lot of problems.

To implement that, technically it's basically easy. You have like that gray area. There is the end user. So if we can stop the red area, the spammers to really send spam to people, that would solve the problem. Technically that was easy, but there are some other problems. We were discussing net neutrality. We were discussing all the users who have to change their configurations, what would that be. So something that technically was kind of obtuse became a little bit more complicated because you were changing a lot of things on the Internet.

But when we're talking to especially the consumer rights protections organizations, the minister of justice, the prosecutors and the legal part, it was very clear that this is the scene after we adopted the change. Nothing changes from the first one. It's really I am sending an e‑mail, someone is receiving that e‑mail, and basically I'm talking to my provider and the other is talking, so what's changed? Conceptually not much. What really changed is that they have to use a small configuration. But the dramatic change is that the spammers cannot abuse the network anymore. Basically we were able to stop spammers to abuse most of Brazilian networks, most of the botnets in Brazil. This was an effort that involved a lot of people to make sure we were not doing anything that would harm anyone. And from the perspective of the technical people, that was pretty much clear, but we had to involve everyone to understand how that worked.

What would be the real benefits of that? So these are just some of the major ones that we are already feeling since the beginning of this year. That was when we finished the implementation. The first one is that this is not something that did acts on content. There was no content inspection. There was nothing actually saying that a message is the spam because someone thinks it's a spam. It is just a technical way to stop spammers before the spam actually enters the network, so it's really just stopping people from abuser networks.

We have dramatic decrease in the number of Brazilian IP's listed in blacklists. So most of the operators, they don't have to deal with black lists any more. There's still some machines, yes. We still have some small enterprises, but it's not that big of a problem.

Bottom line, it takes harder for people to abuse the machines. Maybe they can steal credentials, try to do something else. But in the end that increases the cost of sending spam. That really reduces the value of the affected machines. We probably still have machines infected in Brazil, there are botnets in there doing other things, but they cannot send spam any more. That reduces a lot of that effect.

One of the things that you can see on the technical slides here, a major challenge from our slide in the technical area is really to explain how it really worked, why it was good, why it was not inspecting content, why it was different than saying something was spam based on someone thinking that this is appropriate or it's not. It's just really one of the methods to separate what is abuse of networks from what is real use and fair use of networks from the users.

But to implement that, we had to really bring all the sectors of the society together to understand, to see what would be the best way to implement and to actually make this effort to work very well. So I'm going to pass and he can go to the most important this panel that is the stakeholders part of this initiative.

>> MODERATOR: Thank you, Cristine. So we believe in Brazil is a good case for the multistakeholder initiative, as an example of multistakeholder. When we discuss this inside CGI, we discuss several aspects of this problem. Since the legislation that there's a lack of legislation in Brazil about the spam, the question about the marketing, and also this idea of providing a technical solution to block the spam before it's submitted. We study and most of the spam that was sent from Brazilian network comes from machines that were compromised. So we put this project on this task force as a priority. So now I show you that after five or six years we succeed, because after implementation that's finished this year, we are as of the first or second place country that's and now we are in the 25th position. We have for some months a very stable situation on the statistic after we implemented these ideas.

First, I would make a short presentation of our Internet committee. Most of you know our organization ‑‑ in fact we are here since '95, since the introduction of commercial Internet in Brazil. We are since the beginning a stakeholder group comprised of government, people from the government, from the Civil Society, meaning ONG from the private sector, myself and I was elect from the community. There are three others bot members that come from the private sector. We also have representative from the academia.

Our mandate comprised the things that I show in the slide, so the proposed policy and standards established strategies and directives on the use of the Internet. We are, in fact ‑‑ the name of CGI. But in fact we are the government and involved ‑‑ on the governance of the Internet, but. We have the allocation of the IP's and also for the domain name under .br. So we provide the service for the registration under the .br suffix.

We ‑‑ since 2005 we have an approximate CGI, in fact, the .br, the organization that has the staff that provides a statistic about the Internet in Brazil. The department is a source of information about Internet and users of Internet and the and definitely shot with the organization. We have here on the left side the representation from the government has nine persons representing. The CGI itself is coordinated by a person from the government. At IGF, it comes from the minister of science of technology. He is the coordinator from the. We have the president of the organization that makes the organization and personalized what CGI .br, and the other side you have the other persons that were elected in the process of three years.

I show you have far from third sector and three from academia. This effort was very complex. In fact, when we start, few people could believe that the problem could be attacked. It involves a lot of things. It involves problems like marketing. So legislation maybe. So the way that you choose to attack the problem was to avoid the abuse of the network and it should be coordinated between different players, different stakeholders. Internet in Brazil is very complex, because we have DSL service and mobile operators that provide connectivity to the 3G and the cellphones and Smartphones and also the cable operators. This part of the entry was very important, because the process of blocking part must be done at the ISP level because the users should be instructed to change their configuration from port 25 to a new port, port 587. But it's not enough to change the configuration through the ISP.

If it doesn't block on the network, the traffic through port 25, the situation you begin the same. So this kind of coordination between those kinds of companies, 2- or 3,000 ISP companies, and also all the institutions that involved on that, mainly the Brazilian ‑‑ since the beginning we should involve because the tel operators told us they are under contracts with the agents and they should do nothing without formal agreement with the agents. So the steps aren't falling. The CGI make a resolution saying that port 25 shouldn't be blocked because it should be good for the come back to the spam. Based on that, we convince the agents to make also a resolution that was that was an enforcement to tel operators to make this also. At the moment we have ISP's with several meetings with all the stakeholders during three years. The ISPs are working on converting their base from port 25 to port 587. But the ISP's did their work. Big ISP's convert and they help us to make the allocation of the customers about this effort. But we didn't start yet effective blocking by the operators.

Finally, after we have the agreement of the tel agency to do that, the telco companies that maybe it's not enough because the customers could go to justice asking for their rights because it was not that the port 25 should be blocked. So again we went to the government that introduced us, especially to the department of consumer protection, together with the association of consumer protection to explain how is important to block this port to make the Brazil network better? And we've ‑‑ from some months after we have a technical paper provided by the minister of justice saying it's good for the customer to block this port. Finally, we sign an agreement between all parties, the ISP's, the cable TV operators, and that everybody putting the framework ‑‑ time frame to implement the measure.

So we start this in March. So the end of last year, so one year the telco companies region by region they block port 25 and their networks appeared. In fact, how this effort was directed to real users, people who use computers as using any technology, but a dynamic IP. We don't change anything to the companies that have IP ‑‑ direct IP's. But it was a huge ‑‑ it was a huge effort because we talk about over 50 million Internet users in Brazil. We are working on that on the location through a website that we develop called unspun.br. We are not sure how much noise will be happening when, in fact, we change the key. There was a good thing on that project because the people who use web mail was not affected on this change because they already use other ports to send e‑mails.

(Applause)