[applause]
>>CERF: Thank you very much, Bill, and good evening, everyone.
Can we kill the music now?
[laughter]
>>CERF: Thank you. First of all, I appreciate the opportunity
to greet you this afternoon. I am reminded on occasions like this about
a story called The Talking Dog. There's a man who discovers a dog that can
talk, and he takes the dog around to various conventions like this one showing the dog,
and people are amazed. They don't care what the dog says.
Just the fact that the dog can talk is very impressive.
Sometimes I feel like I'm the talking dinosaur at these events.
[laughter]
>>CERF: I'm going to try to cover 3 specific topics this evening very briefly because I
know many of you would like to get back to drinking and greeting and networking.
First of all, let me draw to your attention the incomplete internet.
Despite the fact that this system was designed in 1973, and became operational in 1983 and
became commercially available about 1989, it still lacks many features that it needs.
One of the most critical features is authentication. And every single one of you who cares about
the transactions that take place on the net that are concerned about whether the devices
you're talking to or the people whose e-mail you are receiving or the systems with whom
you are carrying on transactions are the right ones should be deeply concerned about that
technology even in simple cases like the domain system
where we don't have yet digitally signed entries in the domain name system.
It's possible to be misled on the network to get the wrong IP address or a lookup on
the domain name system. There are some top level domains today that
are digitally signing the entries in the domain name zone files.
And this would be an area where any of you who have responsibility for any portion of
the government's domain name system could seriously give some thought to that.
More generally, authentication isn't available on an end-to-end basis at all layers of the
architecture. We're pretty good about building concrete
tunnels using simply SSL techniques. The trouble is those generally don't identify
the end points. They simply secure the channel.
Securing channel is not adequate, generally. Suppose that you have an e-mail with an attached
virus. You build an encrypted tunnel to send this
e-mail from one end to the other. The virus goes along with it thoroughly encrypted.
Nobody can see it, and it gets out the other end.
It gets encrypted, and then, of course, it does its damage.
So the solutions to many of these problems do not involve simply applying cryptography
in one place in the net. It's going to have to be integrated into many
different layers. Generally speaking, we have other security
problems that need to attention. The routing system, for example, can be easily
confused. In fact, we often shoot ourselves in the foot
by mis-configuring routing. But worse, it's possible to emit misleading
routing information and cause traffic to go where it should not.
On the other hand, we have digitally signed entries that associate systems with specific
ID address allocations when routing updates occur.
When announcements are made, you can double check to make sure the party making the announcement
actually has the right to do that. The other example of the problem is e-mail.
Everybody understands that you can spoof the source of an e-mail right now.
We don't have a regular practice throughout the electronic mail system of finding ways
to authenticate the origins of those e-mails or, for that matter, their content.
I'm not arguing that these things don't exist. Of course there are examples like PGP and
so on, but they aren't uniformly in use. That's something which we should be worried
about on a national and international scale. And to the extent that the government can
show leadership in this domain is something that I hope we all take into account.
And the last obvious thing about security is malware.
There's a lot of it out there. It causes a great deal of trouble.
It's not easy to detect. Google does the best it can when we crawl
the web to identify places where malware may be present on a website's HTML or XML files,
but we don't always successfully detect them, and so some people are harmed.
Of course, we do warn people when we detect malware.
And we tell them, "Please don't go there," if they happen to use our search engine to
find places in the net. Some of them after they get these interstitial
pages go there anyway. That we can't stop, but we do the best we
can. Another example is incompleteness.
Let's take broadcast. We take broadcast radio channels and turn
them into point-to-point links in the protocol architecture of the internet.
Well, what we should be doing is augmenting that architecture so that we take advantage
of the fact that a radio broadcast could be received by multiple parties.
There aren't a set of protocols that take advantage of that today.
What about mobility? We do a terrible job serving up mobility,
and yet more and more of the internet is being accessed by mobile devices-PDAs and mobile
phones, specifically. There are on the order of 4 billion of these
devices in use today. About 15% to 20% of them are internet capable.
More and more of them will be over time. We need to incorporate some serious protocol
work in order to deal with that. And just to add to the list, of course, we
all know we're running out of IPv4 address space.
Somewhere around 2011 there will be no more to be allocated by the InterNet Assigned Numbers
Authority. And the next time an ISP goes to one of the
regional internet registries and says, "I need some more address space," the answer
is, "There ain't no more left unless you want IP version 6 addresses of
which there aren't a great many." Specifically 3.4 times 10 to the 38th of them-
[laughter]
>>CERF: -which is a number only the congress-only the congress can appreciate numbers on that
scale.
[laughter]
>>CERF: But it's vital that we get both v6 and v4 running in parallel.
This is not a throw the switch kind of a phenomenon so we're going to have to work to get the
ISPs to turn on v6 and v4 and to interconnect with each other using
both of those protocols. I'm very proud to tell you that Google has
worked hard in the last 18 months to implement IPv6 in parallel with IPv4 for all
of our products and services that are reachable online.
I want to switch gears now and talk about broadband because that is a major consideration
today-especially in the course of the recovery efforts that are underway.
Specifically, I wanted to say that the definition of broadband first of all has to be more than
200 kilobytes a second. My preference for broadband is 100 megabytes
a second and up. But more importantly, the term broadband is
sometimes not used to mean broadband access to internet.
It's simply meant to be broadband transport. And here I think we have a very fundamental
question to ask ourselves. In the past we had something called universal
service. And the purpose of that was to assure that
everybody could get telephone services. In the 21st century, I submit to you that
the universal service that we want is broadband access to the internet-not simply broadband
and not simply lots of television channels. The reason I believe that that's an important
position to take is that I believe the flexibility of basic internet is so great that having
lots of it around will stimulate new applications and new products
and services. I would much rather see lots and lots of broadband
internet carrying virtually any product or service-whether it's a video stream
or an audio stream or all the usual applications that we currently run.
The openness of that platform should generate a substantial amount of GDP improvement where
new products, new services, new companies and new jobs are created.
I would much rather see that for national benefit rather than seeing a separation of
broadband into 2 parts-an internet part and an other part.
Now, that may not maximize the benefits to specific companies providing broadband.
And I understand that argument, but I guess if we're looking for a national policy that
maximizes benefit for the entire country, I would rather see very, very high speed internet
services available everywhere, including the rural parts of the country.
The last observation I want to make has to do with economics.
We are in a period of time where the economics of digital information are transforming a
lot of industries in the sense of interfering with their business models.
The economics of paper-especially newsprint-was very, very attractive when cheap paper was
produced in large quantity and could be distributed on a regular daily basis.
The problem is that digital content can be distributed in a far more efficient way than
any physical material. The consequence of that is business models
that were built around the economics of particular media have to be rethought.
And it is a very major collision. The other example of this is the area of copyright.
We all understand that the principal purpose behind copyright was to provide benefit to
those creating intellectual property and for a period of time.
Some people will argue that current copyright arrangements allow for a longer period of
time than is necessary, but that's a debate that we can have.
The more critical thing is that the control of copies was the basic way by which this
copyright benefit has been conferred. Internet comes along, and it turns out to
be a giant copying engine off you look at the way the worldwide web works-
which is one of the principal ways in which information flows around on the net.
Your browser goes out on the internet and it copies a file-the home page of that destination
host. It copies it and then interprets it.
So we have this gigantic copying engine running, and it's in substantial conflict with the
model of intellectual property protection that copyright has adopted for many, many
years. The solution to the problem is not that we
should eliminate the notion of protecting intellectual property or rewarding people
for creating it, but we are going to have to step back and
ask ourselves, "In the context of this kind of digital distribution environment, what
new models of copyright benefit can we invent?" It may take the engineers and lawyers and
others-the legislators-to figure out new ways of compensating people for creating intellectual
property. An example of the dam breaking in some respects
is the presence of Larry Lessig's Creative Commons.
Here is a clear expression of a broader range of choices to the creators in intellectual
property than have been available in the past because the past models have been bound to
particular physical manifestations. So I think that we are going to see a number
of business models having to be rethought and reconsidered and maybe new businesses
or old businesses reinvented in the context of an online broadband
digital environment that the internet poses for us.
So I'm going to stop there. I'm going to thank you very much for allowing
me to interrupt all of the fun and games at the bar.
I've been told that if people have questions, I'm compelled to respond to them.
And I will do so if you wish, but I understand that I'm also standing between you and the
networking that's been going on. So I leave it to my host, Bill Bond, to tell
me whether we're going to Q&A or whether you're back to drinking again.
>>BOND: Let's take some questions quickly. Anybody?
Here's a grand opportunity.
>>CERF: By the way, I hate the idea of Q&A. It implies that I know all the answers, and
I don't. So if you happen to have an answer that you'd
like to offer, that'd be okay.