FINISHED TRANSCRIPT
NINTH ANNUAL MEETING OF THE
INTERNET GOVERNANCE FORUM 2014
ISTANBUL, TURKEY
"CONNECTING CONTINENTS FOR ENHANCED
MULTISTAKEHOLDER INTERNET GOVERNANCE"
04 SEPTEMBER 2014
16:30
WS 100
CARRIER GRADE NAT IMPACTS ON USERS, MARKETS, AND CYBERCRIME
***
The following is the output of the realtime captioning taken during the IGF 2014 Istanbul, Turkey, meetings. Although it is largely accurate, in some cases it may be incomplete or inaccurate due to inaudible passages or transcription errors. It is posted as an aid to understanding the proceedings at the session, but should not be treated as an authoritative record.
***
>> MARK McFADDEN: Good afternoon. My name is Mark McFadden. I am with Interconnect Communications. I’m an infrastructure consultant, based in Wales, in the UK.
Next to me on my right is Robert Flaim, from the FBI in the United States.
Next to me on the left is Emily Taylor, an Internet governance consultant based in Oxford.
And next to her is Patrik Faltstrom, who I’ve learned in the last session we have to allow him to introduce himself. He is in charge -- let me see if I can -- he is in charge of search and development at NetNod. He holds many other hats, as we have learned. But most importantly – well, most importantly to me anyway, he is the chair of the security stability advisory committee at ICANN as well as a routine participant in the IETF.
The panel is joined by Geoff Huston remotely. Geoff is in on assignment I think in Hong Kong. He will tell me if I'm wrong. He routinely does that. And I often him.
This is IGF's workshop 100. It's a workshop on Carrier Grade Network Address Translation. My goal here and the goal of the workshop as we proposed it to the IGF was to raise awareness in the capacity building programme of this IGF to talk about what the impacts were on the network, and Geoff and Patrik will talk about that; talk about what the impact is on law enforcement and cybercrime, and we have Bobby here to talk about that; and then what happens in the legal environment, and Emily about talk about that. If we have time, one of the things we will be talking about is unexpected impacts on users. I think that is one of the most intriguing parts of the Carrier Grade Network technologies.
The approach I’m going to take in this workshop has actually changed since I edited it on the website. We will start with a couple of the presentations and then open it up for questions, comments and potential rants. Perhaps “potential” is the wrong word. Near certain rants.
So let me start by looking around the room there are so many people around the room who do not need an introduction to this topic, but as I prepared the slide I feel compelled to take you through a couple slides at least to make sure that everyone understands what the technology is and how it works before we talk about the implications. Let me see if this works.
I am sure I’m doing this wrong. I will say before I start here I was in a session previously that was on the issue of accountability. One of the things that I reflected on, as I sat through that session, was how people describe their understanding of how the Internet works. And I'd like to propose a thought to you of how the Internet works. Someone sat you down with a soda, a cup of coffee, a cup of tea, two or three glasses of beer, and tried to explain how the Internet works. I can assure you that whatever you think, it's wrong. There are a handful of people who actually know how the Internet really works. And it's like peeling back an onion. The network dynamics and the architecture are complex and very different from what we think of when we think of the old style end-to-end communications between very intelligent end points across the stupid network. That was your grandfather's Internet and your grandfather only uses the Internet now. He doesn't architect it.
The new Internet is much, much different. And an important part is something that many of us are used to in small businesses, big businesses, at our homes, at our offices, and that is the technology called Network Address Translation device. Now a Network Address Translation device usually has multiple functions. But one of its most important is to conserve public IP addresses. And it does this by doing a translation function.
People using, for instance, at your house, people using a network inside of a house would use private address space, private address space that can be reused in other locations, other offices, other homes and so forth. And the NAT box, or the network address translation box, is responsible for doing the translations from the private address space into the public address space. This is a technology that has been with us since the '90s. It's been a part of broadband implementations since the early 2000s. It has been with us a long time. It is extremely well understood technology. It has caused us problems, but largely problems that we have solved over the years, both engineering problems, content problems, security problems, and so forth. All of those are largely solved. A well understood, very mature technology.
Now, carrier grade NAT, and I apologize for using the acronym here, but you'll catch me drifting and using CGN as a way to shorten up the presentation, places a second player of Network Address Translation in the access network. The idea here is in an era where we're short of IPv4 public addresses, one of the things that is possible is to actually extend the content of NAT and put it into the network, making network address translation actually that take place not just in your home, not just in your office, but actually in the ISP. The provider's network. That means that as packets are sent from one end of the network to another, as they go through these CGNs, they're modified twice. Once at the ISP and another time at the boundary of the consumer's network, whether that's a business or a home or residence and so forth.
Regrettably, one of the things that it does is it moves the public IPv4 address, and you'll hear a lot about this in the next hour, from the user's device, the device that's in their office, in their office, at their location, right, or the one that is shared in a larger business, into the network itself. And that is going to have significant impacts as we will see. There are law enforcement impacts, there are network impacts, there are also legal impacts.
Now, here is a look at the picture that you saw before, now just modified with having a second NAT put in place. You have on the right-hand side of the pictures the customer’s NATs, the ones that we're all so familiar with. But they connect back to a carrier grade NAT that is in the provider's network. And so the network address translation takes place twice. The impact of that is one of the things that we want to explore this afternoon.
Here's another look just with more words. This is what things looked like in the early 1990s, and 1980s, before we had NATs at all. Now you'll see things get more complex when we actually put NATs at consumer devices, this time confusingly on the left-hand side of the picture. And then finally, in the current -- in the environment that we find ourselves in, where we're starting to see the implementation of carrier grade NATs, two sets of translations and you see the dashed lines in the middle of the diagram there.
Now, what is the motivation for actually doing this? One of the things that many of you know is that we're at a point at which we're running out of IPv4 addresses. And I worked for what was formerly a dominant ISP in a country, harking back to another presentation, and one of the things that some large ISPs have a problem with is inward investment to try to take advantage of new technologies, without obvious customer bases. And so what some ISPs want to do is actually extend the lifetime of their existing public IPv4 address space as they manage the transition to IPv6. Our company did some research and some interviews with ISPs, and these two words were commonly used as a motivation for carrier grade NATs is that they gave them time. And the words we heard several times in fact was that it provided breathing space for large ISPs to manage their transitions to IPv6. It allows them to support truly traditional users under traditional circ*mstances with the NAT box that we have known again since the 1990s. And it allows ISPs that are under pressure to support additional broadband development of their business to support growth while they are not having to go out and find new IPv4 addresses.
Now, almost every ISP we talked to remarked and said that they did not feel that carrier grade NATs were a replacement for IPv6. Most of the interviews we did in our study said that what they wanted was breathing space. An assistive technology that allows them to get out of the predicament that they found themselves in and gain some time so that they could do the investment that they needed to move to IPv6.
Now, the people who appear to be using IPv6 -- and I'll say more about this in a moment -- are people who are not in a position to move quickly to IPv6. Let me back up here. The people who are most likely to use CGNs are the people who are having trouble with the transition to IPv6, eEspecially ISPs who find themselves in a situation where they don't have a pool of available public IPv 4 address space.
Now, CGN changes some very fundamental things, and on the screen are the two most important things, the two small bullets. Traditionally, for instance, in my father's Internet, one of the things that we had was a NAT box at our premise, whether it was a business or residence, and we got a public address for that box and then that box translated on behalf of the boxes behind it in some topological sense. They translated it into private address space.
Now, that has changed. In fact, and this is a very important point, consumers share their IPv4 addresses with others. That means that you and I and many others actually share a common public IPv4 address under this architecture. Address sharing is fundamental to the changes and challenges, and I'll say a couple more words about it here, because it is really one of the fundamental points that causes the problems that Bobby, Geoff, Patrik, and Emily are going to talk about, and that is this address sharing has significant impacts on the way that we do things on the protocols that we know and love on the public Internet.
Here is an example, and this is my favorite example that is not related to law enforcement. Imagine that an ISP shares a single address among 5,000 customers, and that a banking site has a policy that if someone does fraud, what they do is they block that IP address that is identified with the fraud. The moment that they have blocked that IP address, they have blocked 5,000 customers. One bad actor under this scenario has the effect of taking 4,999 other customers down with them. That's a significant problem. And that's a great example of what one of the problems is with address sharing.
Now, this is my disclaimer slide. One of the things that you should know is that carrier grade NATs have been used in mobile networks for many years, for a very long time. And that's because the environment in mobile networks is much different than traditional consumer broadband networks. For instance, there are very few inbound connection to your mobile device. That doesn't happen very much. You don't have meadow owe you usually don't have a media server running on your phone. And new operation applications in the home do depend on inbound connections so there is a real difference there.
Mobile networks generally have very tight connections of their end devices. And so in home networks we don't see that. In fact, there are great challenges in terms of the kinds of devices that are in place in, for instance, a home or a business network. So mobile networks are very, very different.
Now, the implications of CGN on users are significant. You can no longer use the IP address to identify a specific customer ,and Bobby will talk about that in a moment and what that means. It has legal implications, and Emily will talk about that. Any service that relies on an IP address to identify their customer or service is broken, immediately. There is no hope for it.
And a lot of basic Internet services like to have a one-to-one correspondence between users and addresses, and now that's broken as well.
Now, there is also something called geolocation. One of the things that many people like to do is be able to take their mobile device or their laptop, take it from place to place, and the device can discover, often by using the IP address, where it is in the world. That's broken. And I'm going to sound like a broken record.
There is also a real problem with inbound connections. And if we have time at the end today I'll tell you a story about the Sony play station, and that is the short story of the Sony play station is when it's actually looking -- when you're looking to play games with someone, you can't find someone who is sharing the same IP address as you. If you can't actually find -- and they are sharing 5,000 addresses or 5,000 consumers are sharing a single address. Then the problem is that that is 5,000 possible people you could be playing a game with that are no longer available to you. So there are huge implications on users for this technology.
Well, you may say that was a lot of bad news in one slide. Indeed it is. Then one of the things you could ask me is why do ISPs bother with this? Because they're going to have support costs, obviously there are going to be real problems.
It turns out that many basic Internet services and applications where things like e-mail, things like basic Web browsing work just fine. For instance, my 83-year-old mother just uses e-mail and browses the Web most of the time. And most of the time a CGN connection would work for her. Client applications usually work. Now, peer-to-peer ones are a problem, but client applications often work. And services that don't depend on a connection between the subscriber and the IP address, those work as well. So a basic Internet user is often not affected here.
But what we found is that in the growing community of Internet users, the basic Internet users are becoming more and more of a minority. And so the success of deploying CGNs is how it's deployed and configured for whom.
Now, we have already talked about this and I'm going to move past it, because one of the things that's going to happen here is I'm going to let Geoff and Patrik talk about the architectural implication of this and what it means to the Internet in general. I'm going to let Bobby talk about what this means for breakage and law enforcement. And I'm going to let Emily talk about, very interestingly, about the things that happen in the legal environment here. But the things break primarily because of this address sharing and the things that are required to support the address sharing.
Now, the three things that ISPs face when they implement CGNs that we found in our surveys is they find an increase in their requirements for logging, support calls get greater. We actually can document that.
And they have troubleshooting -- they have problems troubleshooting connectivity issues. And so what happens is, and we have this story from one ISP that is in Europe, is that they have implemented CGNs. And if a customer calls to complain about the service they're getting from that CGN, the help desk will simply move them to a traditional circuit and claim the problem is solved. Well, it might be. But there is no way to know.
Now, I'm skip through this. Logging is a huge problem, because one of the things that happens is that we use something else in the Internet Protocol to capture the unique identity and allow the Network address translation to take place, and those are called port identifiers. Too technical for the talk today, but one of the implications for ISPs is the cost of logging. Every ISP who implemented CGNs has told me that their support costs actually go up. We have documents for that.
And now what I'd like to do, and if I could ask the person who is helping me here, move to the presentation that we have one slide for, and then see if we can get Geoff in a situation where he can have the mic. I'm going to introduce Geoff Huston, who is not with us but definitely with us in spirit, and I think Geoff your mic is on. What I've done is I put some links on the screen, because Geoff is not doing a remote presentation. We talked about whether or not to go through slides with him, and that's difficult to do in a remote presentation. But I wanted to make sure that you had the resources.
And the third link working from the bottom here, the third link is a presentation given -- gee, I remember it as in January but apparently March of this year that would have been very close to the slides that Geoff would have presented had he been here.
The second one up is a slightly geekier one on network forensics. It covers things in the presentation of CGN, how does CGN actually make things more difficult to discover a connectivity problem, problems in the chain of routing, for instance, and so forth.
And then finally, an interesting presentation that is also fairly geeky that came from -- I remember it as the winter of last year, I guess it is the winter of last year, on some other issues related to carrier grade NAT. And so now here is our test, Geoff, can you hear me?
>> GEOFF HUSTON: Certainly, Mark, I can hear you. The question is can you hear me?
>> MARK McFADDEN: Great. May I pass it to you and add I'm hoping you'll just take a short minute to introduce yourself as chief scientist at APNIC, and then talk a little bit about your interest in architectural issues and your feeling about the implications for CGNs on architecture.
>> GEOFF HUSTON: Thanks, Mark. Again, my apologies for not being able to make it to Istanbul. Other things have called me away, including the Hong Kong network operators' group. But I'm pleased to be here in what is in the middle of the night for me and pleased to give you a quick reaction from my perspective on this.
I come from one of the regional Internet registries and I'm a scientist at the Asia Pacific regional Internet registry. I suppose you could say we're part of the problem here, because we have run out of v4 addresses. We ran out of them back in April of 2011. If you were in the Asia Pacific area, you're an ISP, you're a service provider, you wish to expand your business, knock on that door: Can I have addresses? No. I can give you a very small amount, 1 thousand, no more. Oddly enough, we may be in a situation, the RIPE NCC in Europe ran out in September 2012. More recently LACNIC, South America and the Caribbean, ran out of v4 addresses in May of this year.
So we're running on empty. We knew this a long time ago. And the use of NATs placed at the consumer level has been very prevalent. We estimate around 90 percent of the youth is behind one level of NAT. But what we're now finding is that the use of carrier grade NATs is becoming increasingly obvious. We found that more than 5 percent of the Internet's quiet base, it's 2.3 billion people, 5 percent of them will change their IP address within ten seconds. They will simply flip to using a new address. Now, that's a lot of things. And the real issue is NATs as a whole , if they don't do this, then we're too late. We are well past the point of trying to say stop. So in one sense, criticizing that is like criticizing reality, saying reality is bad. We have to get used to it.
We're finding it really different. The mindset of the Internet was borrowed from the mindset of telephony. And we like to view the Internet as a network that shares a lot with the telephone legacy. In the telephone network every handset as a phone number. And that association of a physical location, a subscriber, a person, and a phone number is very stable and very long lived. Telephone numbers identify inputs. And so the network becomes a point where if you can find what telephone number it is, you can establish what to call.
We used to run the Internet like that, but then we started to deploy NATs. The implications of NATs are quite subtle. At first, we divided the world into clients and servers. Servers have stable IP addresses. They are Web servers, mail servers, and so on, that you and are I clients. We now borrow an address for a conversation and our computers might have multiple conversations and oddly enough they might have multiple addresses at the same time. And that same public address can be used by many of us clients also at the same time.
The network doesn't know who we are anymore. The network can't tell the difference between me and Mark and Patrik or anyone else. That's a really big architectural shift. All of a sudden now addresses aren't end point identification type ins, they're not stable. They're not long lived. The best they are is an ephemeral nonunique conversation token with no lasting significance. Architecturally we have taken the concept of a phone number and ripped it apart.
What does that mean? Well, as you'll hear from Bobby, the whole issue around forensics and gathering data records from the network doesn't work in a NAT world. Because all of a sudden the addresses you get from the packet headers make no sense anymore. ByThe significance is not personally identifying information, it's nationally identifying information and at least it's certainly Continental. It doesn't identify you or someone else, and a minute after the event someone else is using that address or a very large number of people. So data retention becomes questionable. And what we're compelling ISPs to do in retaining all of that data is collecting a garbage bag of bits with 1s and 0s, with no significance.
From the perspective of an application designer , the network is now untrustable. Applications are forced to use their own approaches for persistent end point identity and hide those from the network. Applications are now submarine. TOR and Skype are examples of where we're heading as exemplars, rather than one off aberrations. What we're finding now, applications use internal V mapping. They use encryption on the fly continuously, because what they want to do is hide the true behavior and masquerade for something that makes it look like it's NAT friendly. Now we're finding application behavior becoming increasingly fragile. The network itself is no longer what it used to be and it's no longer as open as it used to be.
Now, in theory, all of this is going to come to an end because we're all going to be running PCs. And at that magic day all of these NATs will just be dismantled. In theory.
But as the years progress, that basic product done, we don't have a clear idea of how to get to that magical point. What we know is this transition has taken a long time and the network grows at a continuing huge rate. And the only way that we can absorb that growth is not by fielding extra v4 addresses, because we haven't gotten any. The only way we can do that is to fuel NATs that get more and more complex. So port sharing NATs? Yesterday's news.
I think we have got to look towards NATs that are called five tupel NATs that manage to squeeze a few thousand customers behind one single address and do so with multiplexing the same port number and address across different connections in order to squeeze the national amount of value out of each address. At this point you can truly say the network has no clue about what you are doing and even applications that are found to be robust and work well inside a complex environment.
I think with those conversations to the more detailed pack, I've probably said as much as I can inside of this context. So I'll hand the microphone back to you.
>> MARK McFADDEN: Thanks so much, Geoff. And I appreciate you staying up. And if you can bear with us I'll have you stay on the line a bit longer.
>> GEOFF HUSTON: Sure.
>> MARK MCFADDEN: I want to put Patrik on the spot because of his experience in the standards community. Both of you are active in the standards community. But also from his point of view in terms of network architecture, what the evolution of carrier grade NATs means from his perspective. Can I do that, Patrik?
>> PATRIK FALTSTROM: Thank you, Mark. I was looking at your slides and arguments on why people use carrier grade NATs, and just as people think that carrier grade NAT is a security device, they think this that will solve all kinds of different problems, including star vision, lack of water, too much water and other kinds of hurricane, earthquake, natural disaster things. So to be able to understand and talk about NATs, we have to try to untangle what various features we have there. So if I take one of the examples that you had, you said mobile operators, they run out of IP addresses. If you look at communication over the Internet, we have to remember that what IP addresses are used for is not only to identify the other end point. We actually have a five tupel, five different numbers which together must create for the moment a unique combination that identifies a flow or a communication.
And out of those five numbers, two of them are IP addresses or the end points that communicate. Two of them are the Protocols. And the fifth one is what Protocol it is, TCP, UDP, et cetera.
This means that when we look at core of the Internet -- and I must point out, Mark, that I don't really like your picture, Mark, because you had the Internet over there and then sort of Netbooks and stuff like outside of the Internet. I'm sorry, all of that is actually part of the Internet. So... make new slides.
Anyways --
(Laughter)
>> PATRIK FALTSTROM: Well, you wanted to have comments. So if we take a mobile operator that runs out of addresses for the end-users, and they add a NAT, that implies that what they want to do is that they would like to reuse IP addresses and have fewer IP addresses on their upstream side than downstream side. Because if they have multiple clients, they were okay.
Unfortunately for the ISP or for the cell phone provider, people like to have their phone connected all the time. And they like to be connected to Facebook all the time. And the -- there are at least three different cell phone providers that I have helped that started to go down the path of carrier grade NAT and they understood that wait a second, that is actually not a good thing at all. They had to move from using -- having nine customers per IP address, because people use their phones so sparsely, so they check their Facebook and then they didn't do anything, wait a bit, and then they started to use it again. So they could have nine customers per IP address. Just three years later, they could only have 1.1 customer per IP address. This means that all of their customers were using their cell phone all the time.
Now, on the upstream side of a NAT, you are supposed to share the IP address in the five tupel among, across several users downstream. If we have a one-to-one mapping between the IP address, then the only thing you can all sort of share are the port numbers. Because you still need a unique sort of combination upstream.
In the IP Protocol, we have 65,000 ports per IP address. And if you use Google maps or if you look at your laptop or phone or whatever you use, like there is basically no difference between the two, you see that each computer nowadays easily has 200 connections up at the same time. This means that if we have one to one mapping between the IP addresses we can only have 65,000 divided by 300 customers per IP address upstream.
If you now calculate, which is not so much, if you look at the cost for a CGN box, that business calculation for the IP, for the Telco, to remove the NAT and give public IP addresses to the end-users, and only implement firewalls for security reasons, was a piece of cake.
So there are no technical reasons to use carrier grade NATs except maybe in the cases where you deploy IPv6 for your cell phone, customers want to keep control. So in reality what people want to do, what they think they want to do, is keep control. And this is back to what Geoff talked about and you mentioned as well, that too many people who build business models think about the old days.
And to some degree of course the customers are asking for it. Because the customers, whenever something doesn't work, what do people do? They call the company whose name it is on the phone itself, Nokia or Apple or whatever it is, or they call their ISP or cell phone provider regardless of why there is a problem.
So to some degree there is some control that the provider would like to have, but the answer is not NAT. The answer might be to have a box that could filter the traffic that makes sure that you don't get downflow service that attacks downstream. Make sure that -- because you don't want to run SMB on this, anyway, so they can filter out the Protocol, other things, but that's not a NAT and that's not IP address sharing.
The second thing you were talking about, you mentioned there are so many applications and services that take for granted that you only have one customer or one user per IP address and that the end-user has the same IP address all the time, et cetera. Those are false assumptions. Those were true like many, many years ago. There were people that believed that if you run a Web server, you must have a unique IP address per Web host if you run TLS. No, that was true up until 2003. Okay? People that today claim that you need to have unique IP addresses because you want to run HTTPS, they are sort of 11 years behind. Okay?
So even on the Internet side there is so much more that can be done to make software and services stable regarding quick changes of IP addresses, which for reasons that Geoff explained that, we have multiple addresses, that will still happen, that has nothing to do with NAT. So there are certain things that NAT implies that we will have anyway, and that is bad design on the application side.
I'll stop there. Thank you.
>> MARK McFADDEN: All right, thanks, Patrik.
I want to open the floor to the workshop here. I have quite -- a little call for five o'clock in the afternoon, it's a pretty good collection of people, although I would say we didn't get gender balance right. Maybe that's the selection of topic more than anything else.
(Laughter)
What I'd like to do is open the floor to any comments, any questions. Geoff I think is still with us. Patrik is here. And talk about the architectural issues that have been brought up, and any questions or comments that anyone has.
You? Could you say who you are and who you work with?
>> AUDIENCE: Sure. My name is Maria Farrell, and I work at Internet connect -- I cannot remember -- Interconnect Communications and Mark McFadden is my boss.
And if I were a privacy advocate and I were listening to all of this stuff about how hard it is to track people, how hard it is to go location, how hard it is, et cetera, et cetera, I would think this sounds fabulous. So I'm sure there must be a down side and what is it? Apart from all of the many, many down sides that you presented already. But for those of us worried about privacy, you know, what -- what's bad about this picture?
>> MARK McFADDEN: I --
>> GEOFF HUSTON: Could I offer a couple comments here, Mark?
>> MARK McFADDEN: Please do, Geoff.
>> GEOFF HUSTON: From the point of view of someone looking from the outside, a law enforcement agency or similar, putting the pieces together of a bit log, a transaction log from the ISP, some retained data logs, NATs make that task remarkably difficult. Because of course where you collect the data alters the data you could be looking at. It could be addresses changed on the network. But there is one operator that gives a detailed view because they happen to know who the user is, and they happen to know where they're going to, and that's oddly enough the operator of that carrier grade NAT. Everything that you do, every add, every click, everything that happens on your device happens through that carrier grade NAT. And if you're that network operator, in realtime, you can actually put the pieces together for yourself .
The third parties find it difficult.
So you know, it advantages some folks but other folks find it a lot tougher. And that's the kind of weird outcome that we get from that situation.
Thank you.
>> MARK McFADDEN: Go ahead, Emily.
>> EMILY TAYLOR: I would just agree with what Geoff said. And as somebody who is interested in privacy myself, when I first started looking at this, I was very much like yeah, this sounds good. Except as Geoff says, it's who knows. And instead of people who, you know, in certain situations you actually might want to know, like law enforcement in certain -- not in everybody situation, but in certain situations, like fighting crime, you would actually want that data to be available to them.
It's, instead, it is the omniscience of the network provider and it promotes them in the pecking order,, in the hierarchy of, you know, if knowledge is power, then they're right up there. And it really changes the sort of complexion of what they do, and the trust and the trustworthiness that they need to have. And I don't know about you, but my levels of trust in network operators -- well, in pretty much everybody to do with the Internet have been pretty shaken in the last few years and I'm not at all comfortable with that situation.
>> AUDIENCE: I think Maria here touches on the core concept and hooking up to what you said in your introduction, to the basic Internet user NATs are wonderful. The traditional NAT everybody sees that as a firewall. This essentially is a huge marketing problem, because to an average user this is this wonderful feature. This is this wonderful device. And, unfortunately, what people lack is the awareness to know what they're missing. Because this is so widespread. People don't care. And I think that's -- and looking around the room, I unfortunately see a lot of familiar faces and not a lot of people who I think are really new to the problem. What we need I think also here for Civil Society to take one step further. Like you said in your introduction, Mark, the basic Internet user is becoming a minority and looking way forward with machine-to-machine, the Internet of Things, and what it comes down to is maintaining the openness and maintaining the freedom to innovate. And this is what we're breaking and making people aware of that problem that can hopefully turn away from NATs are a wonderful thing, because really, they aren't.
>> MARK McFADDEN: Go ahead, Patrik.
>> PATRIK FALTSTROM: What is bad product marketing for one party is good product marketing for another one. And so we have to remember that, that there are forces who absolutely think that this is a good thing.
We have since -- in the mid 1980s we came up with some sort of idea to start with competition and we started with sort of private led innovation regarding telecommunication, and that has sort of led to the Internet that we have today. That we can do whatever we want. We can connect whatever we can. I think in 1989 and '88, when I wanted a phone, I had to go to the Telco, ask for a phone, and maybe I can go there and actually get a phone in one of maybe three colors. Whoohoo. They released about two services a year and the most advanced one was star 21, star phone number square. How many new services do we have on the Internet every year today? A few more than two, right?
So what is now happening -- the reason for that is that we moved the ability -- we have created an environment, both political, because this is a good thing for the society, technical, and like -- that we all like. The ability to innovate on the edge. And that means that the core of the network has lost control. And obviously this was a good thing.
What is happening with carrier grade NAT is that we are moving back the control, just like we heard, and as Geoff said it's not at all the case that we get higher privacy by hiding behind a NAT. It's the other way around. You cannot choose what carrier grade NAT you have, only by starting your own ISP or that you have your own carrier. Or move to an authorized ISP. For me, privacy is choice and transparency, that's where you have -- that's how you attack the privacy issues, not by completely trusting a single party that has the CGN but knows everything what you're doing.
>> MARK McFADDEN: Okay. Good. Other thoughts? Sure.
>> AUDIENCE: Just a small note. Actually, the number of IP before other services is two degrees in. And in the most cases, CGN, the choice due to these three now, you thought about that, and yeah, right now, it might be cheaper to buy just public addresses and give public addresses to the clients and do not have all this mess with the CGNAT. That's right. Tomorrow probably CGNAT can be cheaper because the price of IPv4 will increase. But what I would say is that what we are doing here, we are trying to postpone IPv6, actually. We are trying to -- and IPv6 is not magic. IPv6, actually, to be honest, it's a full body of problems -- unknown problems. You know, we don't know those problems yet. And trying to postpone it means that we want to know them at once, ll problems at once.
That's not wise, actually. It's reasonable to start IPv6 right now, to understand what is going on. What we have there, and this is very important for industry in the whole, I mean, so I think it's a very important idea to understand that it's necessary to do something else except CGNAT even if you are out of IPv4. That's it.
>> MARK McFADDEN: Any other questions about infrastructure?
Let me go here and then I'll go to McCallee.
>> AUDIENCE: I'm Nicolo Rice. And I'm maybe more of a layman than most people sitting around the room. But listening to this presentation, I'm starting to think that who in their right mind would put this in place? And we heard that there are economic reasons. So given that we have concerns over the security aspects, over the market aspects, over the privacy aspect, that's enough reasons to stop this.
My question is, how common are CGNs today in the architecture? Is this something that is so common that we require panels like this, or are we more worried about the transition coming up to IPv6, where they will become more common?
>> MARK McFADDEN: Well, Geoff should you or I take the how common is the problem? We have to give you a microphone. Here you go. You're on.
>> GEOFF HUSTON: Thank you very much. We guess right now that almost half of the people today live behind carrier grade NATs. It's not such a bad guess because that's based on the observation that in the mobile services market, carrier grade NATs are the norm and not the exception. So for almost every kind of device that runs on battery and uses radio, it's got to be behind a carrier grade NAT most of the time, with a small number of exceptions. What we are seeing recently in the wired network, however, is carrier grade NAT appearing here and there. It's more prevalent in the developing economies.
So, for example, if you live in Ethiopia, it is around a 50 percent chance that you are behind a carrier grade NAT, and we observe the address changes happening inside ten seconds. So for many of those economies, carrier grade NAT is very prevalent. It is less prevalent in the wired networks in the more developed economies, and my guess is of the total Internet population of the wired network, not wireless, carrier grade NATs cover at this point between 10 and 15 percent of that population, but it's rising. That's my estimates, Mark.
>> MARK McFADDEN: I'll just add a data point to that, Geoff. In 2012 when we did our survey of UK based ISPs, we found that if you measured the number of ISPs that are either implementing or doing test bed implementations of carrier grade NAT, you got to nearly 90 percent of the ISPs in the UK. So it definitely is, it is something -- now, that doesn't tell you about -- that doesn't tell you about how many of those have actually moved to implementation, and I don't have statistics about that from the survey that we did a year ago. But what you see is that there is a great deal of research going on.
I have McCallee and then this gentleman.
>> AUDIENCE: Thanks. McCallee Neelum.
>> MARK McFADDEN: He's pointing at me, it makes me nervous.
>> AUDIENCE: This entire thing around carrier grade NATs, the IPv4 exhaustion, and the total lack of take up of IPv6., it's a timely discussion for those of us on my side of the business. We're a hosting provider. We're a domain name registrar. Whilst I'm sitting in this session, I'm also discussing with my business partner how on earth we're going to acquire more IPv4 address space.
Rates we're being quoted now, I'm sure other people in the room will have other numbers, varying from five or six dollars per IP address and upwards. You know, I'm not -- that's a significant cost. It also has a significant impact on businesses' ability to develop, grow, innovate, be that on the edge or anywhere else. If, for example, we as a company end up being limited in our growth because we simply have run out of IPv4 address space, then that's really pathetic.
Now, the carrier grade NAT tests and all well and good and fascinating, and the limitations and issues there, a lot of us know about. The flip side to that is that most of the ISPs that I dealt with have conducted trials and tests on IPv6. But only a tiny percentage of them have actually moved into any form of production. I'm, for those of you who are not familiar with me and can't tell from my accent, I'm Irish. In Ireland at present a percentage of what we would consider to be the mainstream ISPs, the ones that are doing the bulk of the business, offer IPv6. They are all technically capable of doing it. They have all tested it. They have all tested it further and backwards and forwards and inside out. They have all been asked repeatedly when they will deploy IPv6. And none of them have done anything about it.
So the question I would ask of the Government types in the room, would you please, please, please provide an incentive to the private sector, in other words, the ISPs, to turn on IPv6. And the simplest way for you to do that is to actually include an IPv6 requirement or score in your public tenders. If you did that, they would start paying attention.
Thanks.
(Applause)
>> MARK McFADDEN: I promise I'll come to you, but Bobby go ahead.
>> ROBERT FLAIM: I just want to answer that question, excellent point, and I was going to bring this up in my presentation. But I'm the co-chair of the U.S. Government IPv6 task force. And one of the things that we require is that public tenders or procurement where we require that all the services and all the equipment that is bought is supposed to be IPv6 capable and enabled. A lot of problems that we're facing is in the implementation, in that the procurement people don't know enough about the tech requirements. So they're not actually demanding it and asking it.
There is one very big Cloud provider that I recently spoke to, and I said you know you're not doing IPv6, why isn't it? And they said well, we are going to start doing it now because one of the very big ISP providers who is very proIPv6 in talk and in action is now going to require that from Amazon, you know, it being IPv6. So that's when they are going to start doing it. I said well, what about the U.S. Government asking that? And they said well, you don't bring us enough business to make us change our business plans.
But your point is well taken and it's excellent. It's all about the money. Because IPv6 is about a tech refresh. It's about buying routers, it's about buying equipment. It's about buying everything that is IPv6 and it costs money. So if a lot of these companies, the ISPs, whoever, can hold on to the last threads of whatever they have, that's what they're going to do.
And now another thing that is happening is there is a big market from the vendors who actually make CGNs. And once all the ISPs put all their money, millions, sometimes tens of millions of dollars in CGN equipment, it's not going to disappear overnight. And that's a huge problem and we need to create a huge disincentive to building more CNG equipment. Because the more they spend, the more it's less likely it is that it's going to disappear.
>> MARK McFADDEN: These exactly right.
I'm going to sneak Emily in over here and then I have someone over here and then a gentleman over there. And then I'm going to close the queue.
>> EMILY TAYLOR: Very quickly, Mccallee, excellent points. And I think from the other side of the Irish sea, it's a pretty woeful situation in terms of IPv6 adoption. And the study that Mark and I and others from Interconnect did a year before we did this one was answering the question of why is the UK so rubbish at IPv6? And we looked around the world and tried to figure out what were the success factors. And to our surprise we found, and I was very interested that you invoked the Government in the last comment, that the countries that were doing well had one thing in common, and that was that their Governments got right behind it. Not just as incentives, but as you say in tenders, deploying themselves. But the fundamental and elephant in the room is that deploying IPv6 is expensive and difficult, so why wouldn't you put off that evil hour if nobody is going to do anything about it. And the evidence is that nobody is going to do anything about it.
>> MARK McFADDEN: Okay. Sorry to keep you waiting. I apologize for that.
>> PATRIK FALTSTROM: No problem, because now it's quite interesting to answer for me because I've been in both roles, I've been an ISP since ‘96 and the past four years I was a member of the German Parliament dealing with all the Internet issues.
And we had a -- a special Working Group dealing with Internet and digital society and a subgroup concerning the addressing, the issue of IPv6, and also carrier grade NAT. And we have been discussing over half a year both sides. One is more privacy, and on the other hand -- well, how do we get rid of IPv4? And if we introduce IPv6, everyone has a personal address, that is personal, addressable and there is no anonymity there.
But we have been -- well, discussing a theoretical technical idea that well, with IPv6, both is possible because you can have as much addresses as you like. Fixed for special services where you want fixed addresses. And then mapped addresses where you want that. So it might be possible to have advantages from both sides with IPv6. It's technically of course a huge challenge to do so, I know, butBut it's possible.
>> MARK McFADDEN: Thank you. Let me go over here.
>> AUDIENCE: Hello. Thank you. Martin Levy with Cloud Flare.
V6, let's talk about some things that the end-users don't see and put a bit of a positive spin on this. There are carriers out there that when they have enabled v6, for all the problems that they go through to do that, but when they do, they find that traffic flows, the end-users get data, and more importantly on an absolute majority, because this is a requirement, the end-users don't see anything different.
And if you then map that into the life of the carrier as they deploy carrier grade NAT and go back even to Patrik's comment about the financial per user of putting a carrier grade NAT in there, you can in fact say that you can save money by deploying v6. You will -- you're not ever going to say you’re removing v4. That is -- we're a long way off from that ever being a statement. However, in the case where you can reduce the amount of users and traffic flowing through your carrier grade NAT, v6 gives you the cheapest path possible. And as many carriers have done this, whether they are in France or Romania and now surprisingly very heavily in the United States, where there are some pretty lethargic carriers who seem to have taken this on in gusto, you can do the math very quickly and realise that they are saving money from the number of not users, but the number of transactions, the number of TCP connections that will have to be dealt with on the carrier grade NAT.
It may not remove that carrier grade requirement, but it will simply reduce it.
And the final comment is that there are now enough major websites which importantly have revenue, advertising revenue or otherwise, associated with their deployment, who have gone full v6 as well as v4, that you can now relate that to any player that says oh, no, it's too much of an issue to go v6, because what if my users can't see my website? What if I lose money? Well, with the Googles and Facebooks and Bings and the list goes on and on, I apologize for missing all the other major ones, we have gotten to the point where there is a hell of a lot more revenue on their side at risk.
At Cloud flare we just decided to do this in March, and we just turn odd a million plus domains. And we're done. It's happy. And we see the spikes, when we see those carriers doing the v6 trials. It's there. Sorry, that's it.
>> MARK McFADDEN: Thanks. One last --
>> PATRIK FALTSTROM: First of all, I have to apologize, I have to go to the Swedish consolate here in Istanbul.
Anyway, two of the largest cell phone providers in Sweden turned on IPv6 two weeks ago. We clearly see numbers, they just turned it on. So from a cell phone point, it's not only the conservative ones in Sweden that are just stepping back. So turn it on, start running it. Easy.
>> MARK McFADDEN: Easy. Thanks, Patrik, and thanks for participating.
(Laughter)
And one last comment and then I'm going to close this.
>> AUDIENCE: Benedict Addis, national cybercrime unit in the UK and about to be Patrik's colleague on the ICANN SSEC.
So, generally, this is great. There is a weird idea that crept in that privacy and law enforcement somehow have trojanous ideas. Now, we operate in the EU, we operate according to the human rights act. And, actually, in every decision we think about the privacy of individuals that we're looking at. McCallee is shaking his head. But it's true for law enforcement, it really is. Every day we worry about that stuff. And you're not allowed to turn on your button and disagree with me!
So the problem with CGNs, and I think Emily has touched on this, is the idea that we take away law enforcement's possibility and due process ability to selectively breech the privacy of an individual that it suspects of a crime in its sovereign state. And, instead, makes that law enforcement agent, who is doing that legitimately, go cap in hand to the only people that now have the ability that allows you to attribute a crime, and that is somebody who is operating a social network service or a Web mail service, and the application layer. And they know damn well who the users are, but then they are Judge, jury and executioner of that person's privacy.
And I'll give two examples of where that has happened, where one, I've had to argue that a threat to life that was imminent, a threat to an ongoing court case where threats of life had been made, I had to argue the toss with an American company that actually it really was a threat to life. So I was a sworn law enforcement officer arguing that toss with a techie on a telephone line, effectively a customer service agent, for hours. That's not cool.
And, secondly, where a company decided that it would comply with one of my requests but would only give me information in what it deemed to be in my jurisdiction. So if that target -- again, a legitimate target-- had traveled, then they decided that they just wouldn't give that to me and they wouldn't tell me that they weren't going to give it to me. They would just blank it off the records.
>> MARK McFADDEN: That's exactly where I want to move next. And let Bobby talk. But let me take this moment to thank Geoff Huston, who has participated late at night. Geoff, I wanted to say thanks, and give you the chance to sign off here so that you can get to bed.
>> GEOFF HUSTON: Most gracious of you, Mark, thank you very much. And thank you, indeed, too.
>> MARK McFADDEN: Thanks, Geoff.
And now I want to just give the floor to Robert Flaim. There are no slides here but Bobby never needs them. And so I'll let him -- really, the last question, the last comment was a nice segue into many of the issues that Bobby faces on a day-to-day basis. And I think understanding the intersection of CGNs and law enforcement is a very, very important thing not just for the technical community, many of you are in the room, but also Civil Society and other people who are natural participants in the IGF. Thanks, Bobby.
>> ROBERT FLAIM: Thanks. Just by way of introduction, I'm Robert Flaim. FBI. I work in the operational technology division in Washington, D.C.
I got started with following or working on the carrier grade NAT issue I would say about 3 or 4 years ago. Some operational issues came up. Certainly it started on the mobile side and then it went to the wired side. But two of the big indicators was that the CEO of ARIN came up to me. We have an ARIN Government Working Group. He came up to me, he was like this is a real problem, carrier grade NATs. I hope you're aware of it. And I wasn't really aware of it to the extent of what was going on.
And the second person that came up to me was Phil Roberts, who works at ISOC and who was doing an Internet draft on carrier grade NATs. And I believe that was in 2011, I think that was when it was published.
So with all of that information we created an ad hoc Working Group with industry, law enforcement and industry in Washington DC. It was a U.S./Canadian joint venture that we held with the National Cable Telecommunications Association. And one of the things that we were trying to do, I guess I was very naive, we were going to try to come up with a solution to carrier grade NATs and attribution and how could we identify the end user and the subscriber in an easy way, like we did before.
And one of the mantras and the objective was simply to maintain current capability, you know, one user, one identifier. In the past, it was one IP address. With carrier grade NATs we didn't know what that was going to be. So we started with the ISPs in North America, Comcast, Sprint, Verizon, Cox, Bell Canada. Videotran I believe in Canada. So we were working with them. And then we realized the scope, since they were the ones deploying it, it kind of created a cascading effect where we had to get information from other people, such as content providers, and that meant getting a source port. And when you had to get a source port, that meant you had to use Microsoft IS or Apache. And you had to make sure that their software is configured so that you could easily collect the source port. So that was something else.
So our group over the past two years expanded to include more of private industry, the vendors, content providers, the Ciscos, Alcatel, Google, Yahoo! and so on and so forth. And they came in and out over the course of nine meetings in two years. We had the meetings in D.C. Europol had one of the last meetings last year at their headquarters in the Hague. For our efforts, there was some tangibles. One of the tangibles was an RF C6 302, which was to log the source port from content providers. And one of the other major accomplishments was cable labs, who works for the cable industry throughout the world, actually developed deterministic logging, which works for about 50 users or less, where you can I guess randomly generate through an algorithm the port source or how they are allocated. And through that, you are able to put the nexus and identifiers together to identify that one specific end-user. So we were able to do that.
The other thing we put in a request to Microsoft through ISA to collect the source board. I'm not sure that they have done that, but they did say that that was a request that they would look into.
One of the big things is educating law enforcement. Because in the United States we don't have data retention laws, so a lot of times when law enforcement asks for legal information via a legal process, whether it's a subpoena or court order, and if it's not there, sometimes we assume that the time has lapsed or there was some other reason why that information isn't there. A lot of times it's because of a carrier grade NAT. So we have to educate them that the carrier grade NAT is out there and they need to ask for more specific information. They have to go down to almost the second for the IP address, the destination and the source. And more importantly, they have to ask for that source board, because that is the critical identifier now with the IP address. So we were able to do that.
The other thing that we were able to do is actually determine the extent of the problem. Actually I published a survey within the FBI to see which cases have been affected by this. And the impact for us is that greater resources, manpower, are being needed. The job of the law enforcement is to always try to overcome any obstacles to do the job. But that is getting more difficult with carrier grade NATs. And carrier grade NATs is just one thing that is making our life difficult. I would almost say it's low hanging fruit, because you have proxies, you have a lot of other things out there that make our lives difficult. And we try not to over emphasize the carrier grade NAT, but it is a problem. And it does impact the way we do things. It slows things down. And that's always bad especially if you're talking about a kidnapping, you know, a threat to life, anything like that.
So that's where the problem is. It's also not only the end-user, we have the end-users, we have the pen register, which is recording the IP addresses back and forth. That has been up, where we used to just get a court order, now we need a search warrant. That requires greater efforts of proof and factual requirements that weren't there before.
And I guess the solution as we all talked about is the adoption of IPv6. So to put our money where our mouth is, when I was answering Mccallee’s question's earlier, I'm the co-chair of the U.S. Government's IPv6 task force. That has been a success, believe it or not, when we compare it to private industry. Because there are two mandates for the U.S. Government. One is that all US Government websites are accessible via IPv6. So if I'm an outside user and I'm trying to get to FBI.Com, it's IPv6 and you can access it. So we're over 50 percent for that. So that's pretty good, especially compared to the, I guess, private industry rates of I think it's hovering around 5 or 6 percent.
The second mandate is that as an internal user, you are able to get to IPv6 websites. So if I'm on my desk at work, at the FBI, you can actually go to Google and access their IPv6 website. So we're still working on that.
The other thing, to go to Mccallee's point, we worked on procurement laws or procurement requirements, stating that whenever the U.S. Government -- and that goes across all U.S. Government -- whenever they are procuring any devices, services, clouds, routers, telephone, anything, it's supposed to be IPv6. So we're trying to push that as well, kind of a pincher movement in all different directions. But the bad news is that the only solution to the carrier grad NAT is really legislation. We have already drafted it. And the legislation is technology neutral, which doesn't require an ISP or provider to log or to do anything specific. But only to merely identify that user at that time pursuant to legal process.
That being said, it's a solution, but it's a long way off because of, unfortunately, the gridlock in not only Washington but I'm afraid a lot of national capitals. So that isn't coming any time soon. So the idea is to continuously work with our ISPs, with our providers, with lots of different people, to see how we can overcome the current challenge.
So I know we're running out of time so I'll stop right there.
>> MARK McFADDEN: Thanks, Bobby, that's good stuff.
Naturally, the law enforcement part of this dovetails with legal and Public Policy issues. And if I could get the next set of slides, that would be great.
Perfect.
And so to talk about legal and policy implications of carrier grade NATs, Emily Taylor who worked with us on the original survey that we did in the United Kingdom is here. And so let me just pass the baton to you.
>> EMILY TAYLOR: Thank you very much, Mark, and thank for inviting me to be part of this workshop and doing the bit for gender balance here on the panel and in the room.
(Laughter)
Also, this is great to see the room so full at this late stage in the IGF and in the day.
So I'm just going to try to get this to work. Okay. There you go. You did it? Thank you.
So I'm going to very briefly discuss what the academic sources tell us about this development and I'm not going to go too heavy on that. But also, one of the things that I was very interested in is thinking about the implication potentially on things like competition in the marketplace, whether it would be new entrants into the ISP market, applications for online service providers, or developers, customers, and also the UK, which is where the study was based, versus International competitors.
And then as we touched on the ever-tense balance between privacy, law enforcement, security, intellectual property, these areas which are all difficult to balance, they aren't mutual ly exclusive, of course, but the difficulties that arise when you blur infrastructure and content.
So when we started looking at this, we were quite surprised to find how little dedicated literature there is on carrier grade NATs. It's a relatively new field of study. But it's quite interesting in a sort of gallows humour type of way. You have to realise how many fundamental and gritty policy issues it surfaces. Whether it's looking at the way networks form and the fact that networks don't form in an evenly distributed way, networks -- network theory predicts that people will -- nodes will powerfully attach. They are preferentially attached to powerful hubs. And there are difficulties pulling apart and pushing together that the network always threatens to pull apart.
So what does that mean for -- how do carrier grade NATs impact on this? What about the good old dumb network that we all grew up thinking the Internet was? Mark I think covered this very well. But also, network neutrality, Maria's question highlighted the different role of the Internet Service Provider in an increasingly intelligent network.
But also this concept that the Internet is a public good, but the fact that at the same time it is -- all of the infrastructure is distributed and privately owned. What happens? Are we risking what is known in the literature or poeticically as a tragedy of the commons?
So how could carrier grade NATs affect competition? Well, at the time that we were doing this study there wasn't widespread adoption of CGN in the UK, but we heard from speakers today that this is growing at a pace. But in the UK we have four big ISPs. There are high barriers to entry in any ISP market. We are fortunate enough to have very high penetration rates, and the latest indication is that the people who are offline are actually choosing to be offline and they don't really want to go online. But there is very high consumer dependence, lots of people reporting addiction to their devices and to various social networks. I know that nobody in this room would suffer from that. But, you know, we love our devices, we love our Internet. And so things that change it really will impact on the citizen.
So you know, we have talked about the benefits in terms of prolonging the life of IPv4, and that is a real benefit. That's not just something to skate over. IPv4 is going to be with us for a long time as we make this transition. But the competition impact, looking from the consumer's point of view, you think about your household. Your household probably isn't typical, but just think about if you live -- there are many of you living in the household, all with your own device, all with session hungry apps running at the same time. It's like the matrix in our house. We're just watching TV, all connected to the Internet in various ways. You know, the gaming and all of this.
What about new technologies? What about the Internet of Things that Vint said we all need and deserve? What happens if we are really behind the curve and don't adopt IPv6? Will we be left behind economically?
And so from business customers, the impact will be felt from, you know, a lot of businesses who do require a fixed IP address have one. So they pay for it. But increasingly workforces are working from home. They might be working through a VPN. These guys are going to be affected, too.
But in what OFCOM called a sort of option swamp, it's very difficult for people to understand this stuff. And the risk is that people get up sold packages that they don't actually need in an effort to overcome some of the difficulties that they are suffering.
I think that there are far-reaching effects that will be felt in competition and in particular the role of the ISP, which is very, very interesting. There is massive potential for discrimination. If you are -- you know, the permissionless innovation that we all chant to ourselves as one of the major benefits of the Internet, well, you can pretty much forget about that in a carrier grade NATs environment, because the owner of the network has the ability to discriminate against potentially competing services. Now, that would never happen in real life, right? Except we already know that Apple was taken to task for blocking Google Voice on an Apple iPhone on the basis that it replicated the phone's functionality. So people do these things. And this gives people, ISPs, a powerful opportunity to flex that muscle.
Third-party applications break. ISPs' applications don't break. So there again is a potential for imbalance, a potential for market distortion. And when you think about one of the wonders of the Internet, I think Patrik Faltstrom put this very well of comparing the rate of change in the old telephony environment, where it was up to the Telco to give you something like star 21 hash Blah-de-blah and the real explosion of innovation and applications as we have seen.
Well, everybody starts as a new entrant and they don't have to worry at the moment or they didn't have to worry about how their brilliant application would be carried on the Internet. It would just be available. But if you have to go knock on the door of every service provider and ask them to punch a hole for you in their CGN, then they may or may not choose to respond.
So that leaves innovators and it leaves us as a society poorer for it. Consumers will have reduced choice, higher price, and it should -- I think it will -- you know, Tim Woos book, the "Master switch,” which I think is brilliant, goes through every -- the lifecycle of every new communications network and predicts that after about 20 years of incredible openness, every single one closes and ossifies into oligopolies, and that's really what we're already seeing. And I think CGN is a wonderful tool in the hands of those who want to ossify market position. Even if they don't want to, it will just have that effect.
National competitiveness, if you are in a country or region where CGNs are widely deployed, you are going to be behind mass markets in Asia. Asian Internet users are already over half the Internet users in the world, and that's going to increase. When you look at penetration rates in Europe and North America, there isn't a lot more growth potential. The growth potential is all east and south. They are well ahead on IPv6 adoption and we're going to be left behind. And if you are actually creating devices and applications for the interim, why would you try to do it? Wouldn't you be going to those growth markets?
And, of course, it does, you know, if you're going to have a two-tier system, then the smaller countries, the more behind on IPv6, are going to be on the losing side of that equation.
Law enforcement, I don't really need to go into this, because Bobby and Benedict have covered this brilliantly. The only thing to just emphasize is that IPv4 addresses, there is market scarcity, MacCallee you mentioned that the prices are going up. But also I'm aware that in certain RIRs there are differing policies about recognizing transfers. An almost ideological type of reluctance to do that because it would recognize IP addresses as property. Well, if the authority of the database is not actually any more authoritative on where the IP address is operated from, then you're going to get an analogous situation to the good old domain names, which perhaps the less said the better. Traditionally, the IP address "who is" was always much more reliable than domain name "Who is."
So another, you know, terrible or brilliant, if you're interested in this sort of thing, impact of carrier grade NATs is that it introduces a completely different network structure. You're back to the old telecommunications single point, single node broadcasting out, because that's what you have. And what you lose is the Paul Baron concept of the survivable network. The wonderful grid that was resilient to attack. I've got a chart about the attacks on this.
Some standard security features don't work. Application designers have to redesign, and emergency services lack important information in the absence of geolocation information, emphasizing the point about the single point, you know, when you go back to a condensed and centralized network, when you have attacks against a CGN infrastructure, they are 33 or so percent likely to have a devastating impact. And so you lose the benefits of that resilient Web structure.
Data retention costs we have talked about.
Application and service providers, it's higher costs, higher impact, and the consumers are just lost in this mush of information they don't understand.
But I do think taking the longer view has the potential to erode this permissionless environment and erode the separation between infrastructure and content, which is actually the benefit, the killer app that the Internet brought us in the first place. It's very hard to quantify what the impact on innovation will be, but it will be. And of course it doesn't help in this difficult and very tense situation we have particularly at the moment between balancing data retention, data protection, and human rights.
So I think we do see the potential for a tiered Internet, and a level of service where the basic, you know, is the sort of you're paying for what you should have for the initial thing.
So that's a canter through the legal and policy implications. Thank you.
>> MARK McFADDEN: Thanks, Emily. Before we close this workshop, and we are sort of close to our time here, I just wanted to open the floor for comments from the whole workshop on issues surrounding law enforcement, since we have Bobby here and the Public Policy issues, and give the whole workshop a chance to either make comments or ask some questions.
Please.
>> AUDIENCE: Thank you, Mark. Again, Marco (inaudible name) RIPE and (inaudible) intertertiary for Europe.
Yes, Bobby, I really, I mean, we've been bumping into each other for years now and admiring the work that has been getting done and getting the port IRC and getting the port logging. I fear it's too little, too late. Yes, you can address new deployments, but as Geoff earlier said, there is a lot of that already out there and people experienced in the industry can probably say yes to this, but it's always the hardest part is changing whatever is installed. There is not as much rolling out, but it's the software that is currently there that is not logging port numbers. And we are now starting to sound like a broken record, but what Alexy said, if we do encourage people to make those changes if they deploy CGNs is while you're changing your network, please also deploy IPv6 because that will be the ultimate solution. What we are discussing now is just patch work. CGNs are supposed to be a temporary solution, and let's not lose sight on that. Because ultimately getting rid of them should be the goal.
>> MARK McFADDEN: Great. Others? Sure, MacCallee, please.
>> AUDIENCE: I'll keep it brief. Bobby for the first time ever we actually agree on something, though your motives as we know are the usual law enforcement motives. But at least we agree on something.
(Laughter)
You're no longer law enforcement, stop backing him up.
>> MARK McFADDEN: I should close on that right now. Let me -- before -- that's a momentous enough occasion that I should just end right there. But before I do and before I thank the people on my panel, I want to do something that I think is not done enough here and I want to thank the people in the back of the room. They're the ones who make remote participation possible, the streaming possible, the fact that we have a transcript is an actual -- is a gift to people who couldn't be here or couldn't participate on the day that the process takes place.
It's not an exciting job in the back of the room, but it is something that is very important not just to the IGF but the Internet community as a whole, and I hope you join me in thanking them for making this process possible.
(Applause)
Yes, please join me, too, in thanking my panelists, remotely of course Geoff Huston, and Robert Flaim, Emily Taylor, and Patrik Faltstrom, who were gracious enough to agree to join to talk about this. And then, finally, thanks to all of you for coming, late on a Thursday, late in the IGF, a technical topic. You are not only brave, but gracious.
Have a pleasant evening.
(Applause)
(End of session)
***
This is the output of the realtime captioning taken during the IGF 2014 Istanbul, Turkey, meetings. Although it is largely accurate, in some cases it may be incomplete or inaccurate due to inaudible passages or transcription errors. It is posted as an aid to understanding the proceedings at the session, but should not be treated as an authoritative record.
***
