The regulations being rewritten in Dubai were twenty-four years old. The International Telecommunication Regulations had been agreed at Melbourne in 1988, when the thing that crossed a border was a telephone call and the business was the accounting rate between the administrations at either end. The International Telecommunication Union convened the World Conference on International Telecommunications from 3 to 14 December 2012 to bring the text forward: about 1,600 delegates from 151 member states, 1,275 proposals tabled, and a chairman — Mohamed Nasser Al Ghanim of the United Arab Emirates — holding a hall that had arrived divided. The union's secretary-general, Hamadoun Touré, had said at the outset that the conference would not deal with the internet, and that anything touching it would be settled by consensus, not counted.
The endgame ran past midnight. The chair closed discussion and put a package to the floor, and the hall was arguing over human rights language in the preamble when the delegate from Iran demanded a vote on a different line: the right of access of member states to international telecommunication services. The amendment carried, 77 in favour, 33 against, 8 abstentions. A conference that had promised consensus had counted hands. Then, in the small hours of 13 December, minutes before the plenary closed, the chair put the resolution on the internet through by taking the temperature of the room — no vote, a show of hands. Spain asked whether delegations might have acted differently had they known. The chair said it had not been a vote. The resolution was adopted.
The next day the refusals began. Terry Kramer, the American head of delegation, told the conference that the United States was not able to sign the document in its current form: his government had believed, and continued to believe, that the regulations should be a high-level document whose scope did not extend to internet governance or content; other administrations wanted otherwise. The United Kingdom's delegation said it had come to Dubai to work for revised regulations, but not at any cost. On 14 December, 89 of the 144 delegations entitled to sign signed the final acts. Fifty-five did not, among them the United States, Canada, Australia, Japan, the United Kingdom, most of the European Union — and India. Touré said he regretted that some countries had declined.
What they refused to sign is short and mild. Article 5A asks member states to endeavour to ensure the security and robustness of international telecommunication networks; 5B, that they endeavour to take necessary measures to prevent the propagation of unsolicited bulk electronic communications; the regulations state that they do not address the content-related aspects of telecommunications. The weight sat in the attached Resolution 3, "To Foster an Enabling Environment for the Greater Growth of the Internet", and in one sentence of it: that all governments should have an equal role and responsibility for international internet governance. Touré observed, accurately, that the revised regulations never mention the internet. He also said the word had been repeated throughout, the two worlds being inextricably linked. Both were true, which was the difficulty.
Two ways to empty an account
On 5 December Check Point and Versafe published a case study of what they called Eurograbber. A variant of the Zeus banking trojan took a customer's credentials from an infected computer, then asked for mobile details and pushed a second trojan onto the handset, which intercepted the one-time transaction number the bank sent by text. The researchers estimated that about €36 million had been taken from more than 30,000 customers of over thirty banks in Italy, Spain, Germany and the Netherlands, in transfers of €500 to €250,000. The figure was their estimate, not a total the banks confirmed. Six days later Seculert described Dexter, named for a string in its own files: it read the memory of the processes running a shop's point-of-sale terminals and lifted card track data out of them in the instant before encryption. Seculert counted hundreds of infected tills across forty countries — 42 per cent in North America, 19 per cent in the United Kingdom — at retailers, hotels, restaurants and car parks. The same technique took forty million cards from Target the following December, and Home Depot's self-checkout lanes in September 2014.
The terms and the think tank
Instagram published new terms on 17 December 2012, to take effect in mid-January. One clause said that a business or other entity might pay the company to display a member's username, likeness, photographs and actions in connection with paid or sponsored content, without paying the member. National Geographic stopped posting. On 18 December the co-founder, Kevin Systrom, wrote that Instagram had no intention of selling anyone's photographs and that the confusing language was the company's own mistake; on 20 December the advertising section was reverted to the version in force since the service launched in October 2010. A mandatory arbitration clause stayed, and a class action followed. The month closed elsewhere. By 21 December the Council on Foreign Relations' website was serving a previously unknown flaw in Internet Explorer 6, 7 and 8 — but only to browsers set to English, Chinese, Japanese, Korean or Russian. FireEye published on 28 December, Microsoft issued an advisory on the 29th and a stop-gap tool on the 31st, and the patch arrived on 14 January 2013. The same technique was inside Apple, Facebook and Microsoft by February.
The instruction from Delhi
India had spent the previous year arguing the other case. On 26 October 2011, at the United Nations General Assembly, it proposed a United Nations Committee for Internet-Related Policies: fifty member states, reporting annually to the Assembly, with advisory groups for business, civil society and the technical community. When India circulated an unofficial draft of its proposals in September 2012, industry and civil society read it as support for pulling naming, numbering and network security inside the treaty, and said so; the engagement that followed moved it. At Dubai the delegation was ready to sign. Officials in the negotiations told Down To Earth that instructions came from Delhi not to. "It was unexpected and a let-down for India and our global allies," an official of the communications and IT ministry said.
India's statement said it needed to consider the wider ramifications of the resolution, and would undertake necessary consultations at home before announcing a final decision. The confusion travelled: an Indian technology publication reported that India had signed, then corrected itself — "We were mistaken, and wrong." The minister for communications and information technology, Kapil Sibal, was under pressure from Washington on one side and from Indian service providers and civil society on the other, in a country of about 125 million internet users. The larger question was answered two and a half years later: on 22 June 2015 Ravi Shankar Prasad told ICANN's fifty-third meeting in Buenos Aires that the internet must remain plural and be managed by a multistakeholder system. India then had neither a data protection statute nor a duty to report a breach: the duty came by direction in 2022, the statute in 2023.
Kurzweil at Google, DistBelief at NIPS
On 14 December 2012 Ray Kurzweil announced that he would start at Google the following Monday as a director of engineering, to work on "new projects involving machine learning and language processing". He had unveiled a reading machine for the blind in January 1976 and sold his speech-recognition company in 1997, and How to Create a Mind, published the month before, described the neocortex as a hierarchy of pattern recognisers. The more consequential work from Google had been shown the week before at Lake Tahoe, where the Neural Information Processing Systems conference ran from 3 to 8 December and Krizhevsky, Sutskever and Hinton presented their ImageNet paper. In its proceedings Jeff Dean and eleven co-authors, Andrew Ng among them, described DistBelief, a framework for training networks with billions of parameters across thousands of machines, and Downpour, an asynchronous form of gradient descent that ran many copies of a model at once; the same techniques had sped up training for a commercial speech-recognition service. Its successor, TensorFlow, was released as open-source software in November 2015.
Imperva's five per cent, and the objections
On 5 December 2012 Imperva formally released a study it had already shown journalists. With students from the Technion it had gathered 82 new malware samples from honeypots, searches and hacker forums and run them weekly for six weeks through VirusTotal's forty-odd engines: initial detection, it concluded, was under 5 per cent, and some vendors took up to four weeks to catch up. Vendors' researchers objected to the instrument. VirusTotal ran command-line engines and by its own account was not built for comparisons, and Trend Micro's Rik Ferguson argued that scanning a collection of files "misses the point of security software entirely". Imperva stood by its conclusion; the remedy it proposed, watching access to servers, databases and files, was what it sold. By 10 December Xuxian Jiang of North Carolina State University had found that the Verify apps check new in Android 4.2, which sent a package's name and hash to Google, flagged 193 of 1,260 known samples; the antivirus products he compared caught half or more. A Symantec executive would pronounce antivirus dead in May 2014.
⏳ Time capsule — December 2012
- On 11 December the sitar player Ravi Shankar died at a hospital in La Jolla, California, aged ninety-two, after heart valve replacement surgery; for half a century he had been the best-known exponent of Indian classical music outside India.
- On 16 December a twenty-three-year-old physiotherapy intern was gang-raped and assaulted on a moving bus in Delhi; she died of her injuries at a hospital in Singapore on 29 December. Protests followed across the country, and a committee under a former Chief Justice of India was appointed to recommend changes to the criminal law.
- On 21 December "Gangnam Style" became the first video on YouTube to reach a billion views, five months after it was posted.
- On 23 December Sachin Tendulkar retired from one-day international cricket — "I have decided to retire from the one-day format of the game" — after 463 matches and 18,426 runs.
The word they would not write
The revised regulations entered into force on 1 January 2015 for the states that accepted them. The rest stayed bound by the text of 1988, and that is where the fragmentation settled: two treaties over the same wires, a country's obligations set by which side of one December night its delegation stood on. The takeover the non-signatories feared never came through the union. The answer ran the other way on 1 October 2016, when Washington let its contract with ICANN over the internet's names and numbers lapse and the stewardship passed to the multistakeholder community the Dubai argument had been about. The argument itself only changed rooms: on 24 December 2024 the General Assembly adopted a United Nations Convention against Cybercrime, which binds once forty states have ratified it.
The rest of the month kept its shape. Instagram's clause lasted three days; the question under it — what a service may do with what people hand it — took five more years to reach a legislature, arriving as Europe's data protection rules in May 2018, two months after a personality quiz on Facebook became the Cambridge Analytica affair. On 16 December Iran's Maher described a wiper that deleted drives D through I on fixed dates; Symantec called the samples unsophisticated, and deletion became an instrument of states anyway. The second wave of denial-of-service attacks on American banks, announced on 10 December by a group calling itself the Izz ad-Din al-Qassam Cyber Fighters, ended in a March 2016 indictment of seven Iranians working for two companies the Justice Department said served the Revolutionary Guard; none was in American custody.