IP piracy is just like terrorism (and vice versa)
Two other things occurred to me about that bird-supplied testimony before the Senate, so I'll share them quickly and then return to hi-tech frivolity. Apologies in advance for seeming to presume that I know things about terrorism; clearly, I don't. I do know things about the internet, though.
And that's the first thing that struck me: how typically internetty it all is. The networks as described in Michael Doran's testimony sound very much like other illicit online networks.
At any given moment in any given language, only a limited number of sites post original material produced directly by terrorist organizations or by religious authorities to whom the organizations have pledged loyalty. The majority of terrorist websites in operation are either mirrored versions of these existing sites or simply bulletin boards that disseminate material that originated on the websites under the direct control of the terrorist organizations.
...
Well, these are websites that are controlled by people who are known to each other and they will post authoritative information on the website and then it will be disseminated out by loyalists all across the Internet.
On these bulletin boards — these are bulletin boards where they're password protected — certain individuals, their user names will become known as authoritative individuals.
I'll give you an example. There was this American Johnson who was kidnapped in Saudi Arabia and killed. Within hours of his kidnapping, his wallet with his ID appeared — a photo of it — appeared on this website.
So from an event like that, you can then conclude that that website is directly connected to the kidnappers and it's an authoritative website.
Then an individual on that website, whenever an al Qaeda-related event would take place would tell you, if you want to see our statement about that event, go to the following address and then you go to that address. Once it's out there and authenticated, then it just spreads like wildfire.
If you haven't, go read Jeff Howe's excellent "The Shadow Internet" over at Wired. It describes the surprisingly centralized system that powers nearly all online piracy. There's a collection of "topsites" operating as a darknet — one that's known and accessible only to trusted individuals. Release groups compete within the topsites to see who can provide the best software fastest. From there the releases trickle into increasingly public places on the net: private bittorrent trackers, usenet, and finally public P2P networks. The same sort of tiered content distribution system seems to underpin terrorist website economy.
They're similar in other ways, too:
Jihadis — they compete for membership. They don't all like each other. It's not a monolithic organization that everyone supports everyone. They are discrediting and de-legitimizing their competitors online.
This all sounds very familiar. It seems plausible to me that the same dynamic emerges in both cases: an ecosystem of poseurs, parasites and a very few elite operators who can provide the original content that powers the scene. These individuals arrange and rearrange themselves into groups that compete for prestige.
If this analogy is valid, the good news would be that the majority of people involved are hapless, subliterate, and totally useless to the purpose of the scene with which they've associated themselves. Getting groups to pick fights with one another would be relatively easy, and targeting elite users could yield large benefits. Check out how many pirated releases one user (or group of users assuming a single identity) named aXXo is responsible for, for instance. For all of our internet-powered talk of network effects, it's still the case that particular individuals can have an outsize effect.
But this analogy would bring bad news, too. Elite members of the piracy scene do what they do purely for the prestige that comes with it, and so are not prone to rationally responding to the risks and rewards introduced by law enforcement. They typically don't make any money from piracy — that's frowned upon — but they persist at their secret hobby despite the years or decades of jail time they face if caught. You'll occasionally hear a Marxist accounting of their pasttime, but it seems that in most cases that's merely a self-serving justification for their prestige-seeking behavior. It's tempting to see parallels between this and the apparently not-all-that-devout 9/11 hijackers.
There's another analogy that became apparent to me, too, relating to how the government plans to assess and interdict these groups. The vast majority of online interest in jihad must come to nothing — like punk rock's endorsement of anarchy or hipster use of communist iconography, it's just a standard under which disaffected teenagers can unite. I've had a site vandalized with anti-American/anti-Israel rhetoric before, for instance, but I think it'd be a stretch to call it a political act. And it would clearly be a colossal waste of resources for the IDF or US military to track down the perpetrator.
So what threat do these sites actually pose? Here's Mr. Doran again:
The Internet is also a useful tool for recruitment. In addition to other social influences, potential recruits are flooded with propaganda, training manuals, and religious justification for joining the jihad via the Internet.
It is difficult to say how much direct recruitment takes place on the Web. While it is likely that direct invitations to take party in terrorist organizations are usually delivered face to face, there is no doubt that the Web plays an important role in indoctrinating recruits before they are drawn in directly. Probably for this reason, extremist will not attempt to recruit overtly for violent action, but will instead legitimate the actions of terrorists and encourage readers to support the jihad however they can.
Terrorist websites, chat rooms, and other forums make use of the Internet for fundraising. These websites often use the argument that every Muslim has a duty to support jihad but that participation on the ground is not required of everyone. The appeal for financial support alone is a method of permitting an individual to feel that they have done their duty as a Muslim but do not need to change their life in order to join the actual fight.
Terrorist use of the Internet also includes operational training. Would-be terrorists can find training information in the use of small arms, mortars, rockets and artillery, guidance on where to fire at U.S . military vehicles in order to inflict the greatest damage, sniper training and detailed instructions about the construction of improvised explosive devices, suicide vests, et cetera. Training is also available for guidance on how, when and where to cross the borders of Iraq to join the jihad and how to avoid detection as a jihadist.
So it's difficult to quantify the specific damage being done by these sites — we know there's fundraising, but don't have numbers for it (or at least none impressive enough to present to a Senate committee). We know that the sites probably lower the cost of recruitment for terrorist groups, but can't say by how much or whether the supply of offline recruits is sufficiently constrained for it to make much of a difference. And we know that some training information is available online, but don't know whether this is actually used to perpetrate violence or whether it's more akin to the ASCII copy of the Anarchist Cookbook that my friends and I nervously XMODEMed to one another in middle school and then never, ever used.
In short, we know these sites are bad but can't say exactly how bad (although if this was a budget hearing the answer would probably be "very"). What are we going to do about it?
We've got to do everything we can as quickly as we can to disrupt their websites when appropriate and necessary and compete with them for the attention of those who frequent their sites. We need to monitor their sites constantly for information and use them to exploit the visions among different sects and factions. And we need to recruit trolls who can sew seeds of doubt in the different extremists' websites and chat rooms. Obviously in the end, we need to develop the ability to shut down these sites when they represent an actual danger to us.
And here's Frank Cilluffo:
"Honey pots" offer one way to achieve these goals. Among other things, they could allow us to better understand how local political grievances may become appropriated by the larger extremist movement, which in turn could help us drive wedges and blast open existing fault lines between and among factions.
Monitoring, poisoning, honeypots, and takedowns. Sound familiar? It's what the media companies have been doing to fight piracy.
As you know, the results of that effort have been fairly dismal. It's true that the media companies have increased the effort and risk associated with downloading pirated content, but not by much — the return on their investment in services from firms like MediaDefender and Overpeer can't be very good.
It's hard to say how things would shake out when targeting extremist websites. On the one hand the effort seems likely to be much more expensive: the exchange of information on these sites must be predominantly legal, requiring more detailed scrutiny in order to find actionable offenses. And there are technical considerations that make it easier to automate catching P2P users than it is to catch visitors to a given website.
On the other hand, it seems likely that we could allocate more money for saving American soldiers' lives than we have for saving American executives' lifestyles. The scope (if not the implications) of iSlamofascism is smaller than that of piracy, too, and seems likely to stay that way: hopefully, deep down, the average human enjoys watching Bittorrented episodes of Lost more than they enjoy killing their fellow man.
Still, it seems likely to be an expensive effort that produces limited results against a threat that may not actually be all that threatening. As with piracy, the online problem seems likely to abate when the underlying condition is resolved: people don't like paying for mandatory content distribution systems that they don't need, and they like Western meddling in the Middle East even less.
The internet makes communication very cheap — but that's all it does. This lowers some of our enemies' costs. We can re-raise them, but it'll be expensive to do so. And given that the online extremist phenomenon seems to be primarily symptomatic in nature, I think it'd probably be a mistake to divert too many resources to fighting it.