System alert: web meltdown

Just when you thought it was safe to do all your business online comes another warning that the internet is about to crash. Wendy Grossman talks to the doomsayers

" Internet due to collapse - clueless users and networks blamed." You could have written that headline at any time in the 20 years since the internet began, as a collection of networks connecting five regional supercomputing centres in the US, and it would always have been half true: it's always been on the verge of not quite working. Equally, it has never really failed, not even on September 11, 2001, when terrorist attacks took out a key New York telecommunications node.

" Internet due to collapse - clueless users and networks blamed." You could have written that headline at any time in the 20 years since the internet began, as a collection of networks connecting five regional supercomputing centres in the US, and it would always have been half true: it's always been on the verge of not quite working. Equally, it has never really failed, not even on September 11, 2001, when terrorist attacks took out a key New York telecommunications node.

And yet, last month, in a back room in a scruffy Los Angeles hotel, three of the most respected internet pioneers convened a meeting to talk about how to prevent "internet meltdown".

One of them was Peter Neumann, who for decades has tracked the risks of our increasing reliance on computing systems. "Security, reliability, and accountability are going down the rathole," he said. "Good software engineering is not happening for critical systems." Yet we are increasingly basing critical infrastructures - banking, government, voting - on the internet, still barely out of its cradle.

Neumann's co-conveners were Dave Farber, professor of communications at the University of Pennsylvania, and Lauren Weinstein, whose online presence dates back to the earliest days of networking.

But what do they mean by "meltdown"? "The internet has 'melted down' when it becomes difficult or impossible for users to control their own use of it for their legitimate and legal purposes," says Weinstein. His list of threats begins with the two most in the news - viruses and spam, which are pushing some users to abandon the internet. Then there are the bandwidth caps imposed by service providers (ISPs) and download services, who are also slow to tell users exactly what usage is acceptable. (Can you share your broadband connection? Sort of... Can you run your computer as a web server, or an e-mail server? Maybe, maybe not...) There also is the fact that product liability in software is nonexistent, and that users cannot possibly keep up with the amount of patching and updating that security experts tell them is necessary.

The legal actions conducted by the Recording Industry Association of America and the Motion Picture Association of America are shutting down peer-to-peer networks and scaring off file-sharers (the popular file-sharing network eDonkey has died in the last couple of months). The American Library Association complains that even academic content is increasingly being locked away behind registration systems. Pop-up advertising swamps many users.

Weinstein further points to BT's "well-meaning but seemingly ad-hoc" scheme to block pornography sites, using information from the Internet Watch Foundation: without careful checks, he says, there will be a lot of "collateral damage" - sites that for users are unpredictably and unexpectedly unreachable, for no good reason.

Then there's the persistent disquiet about the Internet Corporation for Assigned Names and Numbers (ICANN). It is charged with overseeing the handing out of domain names (things like "independent.co.uk"), but its critics call its powers dangerous and uncontrolled, and say it is in charge of the only central point of failure in the internet's otherwise proven robust design - the "name servers" that translate site names into numbers computers can understand.

If these things all together aren't the meltdown, they provide the perfect conditions for one. The trigger may have just arrived, in the burgeoning use of internet telephony, also known as Voice over Internet Protocol (VoIP). VoIP offers huge savings; with services like Skype you can make international calls for free, piggy-backing on an existing broadband connection.

The problem with VoIP isn't, for once, bandwidth (although just wait for video to swamp all the connections we have). It's the baggage it brings with it. Telephone services around the world are, or have been, highly regulated. Some developing countries set artificially high prices for international calls and benefit from the resulting tax revenues. Undercutting that with VoIP doesn't make them happy, and so they want to regulate it to produce the same revenue; but that conflicts with (rich) users, who want lower prices, and don't care about tax benefits.

VoIP also disrupts policies about "universal access" - those which ensure rural areas can get a phone service - and structures underlying the provision of emergency services. And it is far more demanding than previous internet applications. Few users will notice if an e-mail message is delayed by an hour. The web is usable - if frustrating - when pages are delayed by minutes. But a 20-second delay is death to a phone conversation.

"The internet is becoming a utility," says Karl Auerbach, a software coder and well-known net maverick who briefly represented "the net at large" on ICANN's board. (Shortly after Auerbach's election, ICANN redesigned the body to eliminate his post.)

As a utility, the net will have to live up to different, more stringent standards than its previous uses as an academic and research playground, and then a mainstream experiment. People are building billion-dollar businesses, governments are turning themselves digital, and in the meantime there isn't so much as a service-level agreement to guarantee that the most basic level of connectivity will be there tomorrow.

When you listen to the statistics, it's a miracle the internet works as well as it does. An expert from McAfee says virus attacks have increased in frequency, scale and speed: in the mid-1990s it took a year for a known software gap to be exploited. But in July the Sasser worm exploited a hole discovered only 24 hours before. Anti-virus vendors can't keep up - knowledgeable techies can often spot that a computer is showing signs of a virus infection but lack up-to-date anti-virus software to be able to detect the culprit code.

Meanwhile, seven-eighths of some people's e-mail is spam. Denial of service (DOS) attacks don't just take out a few big e-commerce sites for a few minutes any more; BT's entire ADSL network had a slowdown one weekend earlier this year because of such attacks, and Telewest's mail server was barely usable for several days last year. The Internet Relay Chat (IRC) network Dalnet was so disabled last year by similar attacks it has never recovered.

Some say the internet has been on the brink of destruction for the past 20 years. At one stage the huge growth in traffic threatened to kill it. (Telecoms companies provided more bandwidth.) Then it was people on dial-up connections leaving themselves connected permanently, tying up phone lines. (Broadband freed up the lines and speeded up the experience.)

So what about today's problem - what can 50 expert technologists do? And in what other industry could a group of people like this expect to be able to make their ideas matter?

"All revolutions start like this," says Michael Froomkin, a Miami-based law professor who specialises in internet governance.

Nonetheless, many of the assembled technologists ask plaintively how to get computer-illiterate policy makers to listen to them before making short-sighted, bad law. And that's when my personal meltdown happens.

Ten years ago, a gathering of 50 impassioned technologists like this would have been filled with happy optimism. Yes, the internet is collapsing, they'd have said, but if the problem is an internal technical one we can fix it, and if the damage is coming from external forces - regulators, censors, corporate pirates - we can route around it.

The same people in 2004 are much more pessimistic. If the technologists no longer believe they can fix it by themselves, the internet really has hit a meltdown.