Side effects from Internet service prompt rethinking on Net oversight

NEW YORK (AP) _ When David Fitzpatrick's software for tracking and analyzing junk e-mail didn't work correctly, the Web designer assumed he had made programming mistakes and spent hours trying

Saturday, September 27th 2003, 12:00 am

By: News On 6

NEW YORK (AP) _ When David Fitzpatrick's software for tracking and analyzing junk e-mail didn't work correctly, the Web designer assumed he had made programming mistakes and spent hours trying to fix them.

Then he discovered it wasn't his skills that were faulty, but the Internet system. Elsewhere, more spam slipped through, printers misbehaved and cell phones got unusual Web traffic.

``I'm upset about this because it's cost us time and money,'' said Fitzpatrick, who runs Lone Star Interactive in Arlington, Texas.

The culprit was VeriSign Inc., which two weeks ago launched a new service for guiding Internet users who mistype Web addresses. Side effects from the service have prompted a fierce debate over who's in charge of the Internet.

``This is the first case I know where somebody that big has caused that kind of failure,'' said David Farber, an influential technologist formerly with the Federal Communications Commission. ``If that becomes the standard, things will break endlessly.''

With little warning or fanfare, VeriSign introduced its Site Finder service on Sept. 15. Web surfers who enter addresses that don't exist now get suggestions on where they might have wanted to go.

Normally, such innovation is encouraged and has led to such breakthroughs as the World Wide Web itself in 1990. In fact, America Online Inc. and Microsoft Corp., among others, have been offering similar services.

But VeriSign is unique because it is master-keeper of names ending in ``.com'' and ``.net.'' Its actions have more far-reaching effects.

While millions of people have used Site Finder without problems, some software depend on getting error messages _ not a redirection _ when addresses don't exist.

VeriSign spokesman Tom Galvin said the company has convened a panel of outside technical experts to suggest changes. Normally, however, such discussions take place in advance.

``You're playing with an engine change while the plane's in flight,'' said Vint Cerf, co-inventor of the Internet's basic communications protocols.

Fitzpatrick, for one, found his software capturing VeriSign's search site, instead of indicating that a spammer had faked a Web address. Junk mail filters also failed, allowing more spam through.

The Internet Architecture Board, a committee of Internet engineers, found other mishaps. Rival search services such as Microsoft's stopped working. Printer and other network misconfigurations became fatal. Mobile Web services got swamped with more data than the normal, potentially generating higher phone bills.

Business rivals, meanwhile, complained that VeriSign was making money off its monopoly on the ``.com'' and ``.net'' directories, because the company shares revenue with search engines that power Site Finder. At least two federal lawsuits have been filed.

A security committee of the Internet Corporation for Assigned Names and Numbers, which oversees domain names, plans to convene a meeting Oct. 7. Meanwhile, ICANN asked VeriSign to suspend its service, but VeriSign declined.

Cerf, ICANN's chairman, said the organization was ``evaluating a number of avenues.''

``I am very disappointed to see that VeriSign seems so insensitive to the widespread problems their modification is having,'' Cerf said.

Now long-time techies, including Auerbach, are suggesting a more formal regulation of the Internet.

``The same rules really can't apply anymore, now that the Internet really, really matters in commerce, in government,'' said Lauren Weinstein, co-founder of People For Internet Responsibility.

VeriSign welcomes a rethinking of how the Net is run. Galvin said the company has long been frustrated with how long it takes to decide on its initiatives, including domain names that include foreign characters.

Whether VeriSign did anything wrong is debatable. Voluntary Internet standards permit ``wildcards,'' the mechanism VeriSign employs to redirect mistyped addresses. But technical experts say those standards were never meant to apply so widely.

How the matter gets settled will have broad implications.

``If ICANN insists that this is bad and if it is not able to enforce it,'' said Harald Alvestrand, chairman of the standards-setting Internet Engineering Task Force, ``it has established the principle that domain name operators can do anything.''