Internet and Information Policy

Goodman’s book honestly left me feeling kinda depressed and completely hopeless, how am I suppose to protect myself and my data in this world? I read about 200 pages of just chapter after chapter about how we have no chance of every regaining control over anything connected to the Internet. I now know my phone is window into a criminal enterprise, Google thinks it owns anything I create or save in Google drive through their “what feels like criminal” terms of service, and NSA is capable of creating fake pages to gather more of my data. This book has just made me more fearful of typing this post on my iPad through Word’s app. I bet the NSA is reading this as I type. Rude. But my biggest complaint was, once reading the first part of the book, I felt like I was completely defenseless against these attacks against my devices and data. When giant companies like Experian, Microsoft, and MacAfee cannot protect themselves, how am I, someone who can’t even remember to charge my devices, protect myself against cyber criminals and cyber governments?

As I was reading this book, I was thinking, maybe I’ll just stop using Google products, or maybe I can limit my phone usage? But when the university actually FORCES us to use Google gmail, how am I suppose to work around that? The university maintains I need to have access to this email. I was shocked to learn that Google’s ToS actually says that if you receive a gmail message, Google automatically gains access to your information, even if you don’t have a gmail. WHY ARE MORE PEOPLE NOT UPSET BY THIS? MORE PEOPLE NEED TO KNOW! Google’s “Do no evil”…yea, sure Google. I understand this suppose to be my half of the bargain for these “free” services, but honestly, I would prefer to just figure out how to have my own cloud server. When I read that Google thinks they can own the things I put on its Drive, I almost moved everything from my drive account out of it. Luckily, I don’t save my graphics I create for commission, but what if Google tried to assert they owned these and I couldn’t sell them? I would be out of a side business.  I can’t stand that these data MONGERING companies are able to amass it and sell it to the highest bidder. But how can I limit their access without keeping me from doing my day-to-day activities, especially when its for grad school?

What’s the point/if being hacked is inevitable, why bother? There is one thing that needs to be pointed out about the vast majority of hackers. They are lazy. They the kind of people that are lazy enough to spend hours writing a program that will automate a 5 minute process. Unless you have given hackers a reason to single you out from a crowd, you are simply not worth the effort. The only thing you really need to worry about/can take steps to prevent,  is being caught in some hacker dragnet: the hacks that catch low hanging fruit. If someone tries to access your account and realizes that you have a complicated password, then they are going to move on to easier targets. To survive a bear attack, you don’t need to be able to outrun the bear, you just need to make sure that you can run faster than the slowest person in your immediate vicinity.

Should I stop using products A,B and C altogether? Yes and no. Don’t delete your facebook account, because that leaves you open to the possibility that someone can steal your identity by creating a fake account and passing themselves off as you. Having that been said, you can have a facebook account and be conscious of the information that you publish. With companies like google, I personally avoid any of their products whenever possible. You can use DuckDuckGo for your primary search engine, you can use a browser other than crome, you can change your primary canvas/university account to send all notifications to a non-gmail account. For most google products there are alternatives, but you should accept to one degree or another that you will have to give up some privacy. Being aware of that puts you ahead of many people with regard to privacy.

Marc Goodman’s Future Crimes is another piece that is made to frighten us about the future of technology. And this reading could not have come at a better time as we recently saw the cyberattack on DYN that utilized our love of the internet of things. It is a scary thought that our personal device, bluetooth speaker system, car, or even our washing machine could be used in future crimes against us.

The big critiques I’ve read about Future Crime is that there is far more fear mongering than actual solutions. Sort of the same critic as Clark’s CyberWar. It lays out all the potential catastrophes that may happen in the near future. It is scary stuff. But how afraid should we be? And what can we do about it? Our discussion of cyberwar has largely focused on the global level. How is the United States protecting the country from attack from hackers? But Future Crimes brings the individual into the equation, as the devices we have, can now become weapons. We discussed the issue with Dr. Martinez early this week and wondered if companies should require stronger passwords. One of the easiest ways to enter into a system is through the weak passwords that come as default for so many devices. What if the government required a certain level of encryption for basic passwords. Similar to how we require seatbelts. We’ve clearly discovered that people are not going to take the initiative to protect themselves by making more challenging passwords. But we need to create a herd mentality around cybersecurity, just as we approach the spread of disease. The more connected we all become, the more important it is that we are take the necessary precautions. We (sort of) require vaccines, maybe we should require stronger passwords.

Beyond just our own devices being used against us, there is the larger threat of terrorists having easier access to new tools to cause destruction. Consider the 3-D printer and its ability to manufacture weapons with the press of a button.  And while I think we should be very aware of the dangers that lie ahead, we should not panic. Just like every other advancement in technology, it has been used to destruction as well as creation. We have adapted to times, just as we will find ways to protect ourselves from new threats. Dr. Martinez made the point that while it is important to be prepared and to protect ourselves from cyberwar, it is essential that we build resilience as a nation. We have to be prepared that not every attack will be thwarted and that we will be able to rebound, just like we have been able to recover before.

“Space: the final frontier. These are the voyages of the starship Enterprise. Its five-year mission: to explore strange new worlds, to seek out new life and new civilizations, to boldly go where no man has gone before.”

Jamie Bartlett’s book The Dark Net: Inside the Digital Underworld explores the “hidden” parts of the internet or to put it in Captain Kirk’s words “the final frontier.” Bartlett paints the picture of “strange new worlds” which most people have never gone to before. Strange worlds full of drug dealers, activists, pedophiles and bullies. Through the use of the “The Onion Router” (TOR) browser, people all around the world have the possibility to use the internet anonymously (although it should be noted that the security of TOR has been questioned) in order to freely trade illegal goods, evade the surveillance of their governments, transfer stolen information, blow the whistle or indulge in dark and illegal fantasies. Bartlett also explores the hidden sides of services we all use such as troll groups on Facebook. Overall, he paints a picture of a world where innovation is created in order to survive. He makes the argument that for all its faults, the “hidden” web is also a great source of hope and progress.

I believe that, like any technology, the internet can be used for good or for bad. The internet is an unimaginably great source of information, a platform for freedom of speech and an escape route for oppressed people. On the other hand, the internet’s semi-anonymity allows individuals to act in contradiction of all social norms and in violation of many laws. Certainly, we can all agree that the use of the dark net to exchange child pornography is an abomination. But when it comes to a marketplace for drugs, should we see it as a horrible phenomenon or a way for the natural demand for drugs to be channeled towards a market where users are not at risk from violent dealers and where user reviews ensure that drug quality is higher than on the street.

Another question we must pose, is whether online activity can be excused by offline personality. Bartlett interviews an English man who is part of the racist English Defense League and spends countless hours abusing people online and spewing racist hatred. In real life, however, the man in question appears to be a nice and shy man more interested in football than anything else. The veil of anonymity on the internet may explain this behavior. As the creator of the “Assassination Market” posits, we would all order assassinations if we could never be caught. The argument can be made that the way society regulates itself is because anonymity does not exist so much in everyday life: a person committing acts that violate social norms (e.g. parking over two parking spots) is easily shamed to stop that activity. On the internet, this social control is much harder to achieve.

Author Jamie Bartlett’s book The Dark Net explores the shadowy world of the deep web, a parallel anonymous Internet. Its diverse set of users, including hackers, drug dealers, dissidents, and government agents, is a testament to the deep web’s equivocal nature. Originally developed as a means of protecting the identity of government officials and dissidents of oppressive regimes, Tor, the primary browser for the deep net, was advanced by the U.S. Naval Research Laboratory in 2002. By redirecting online traffic through a worldwide, volunteer network of computers (it’s open sourced), Tor obscures the IP addresses of its users. As time passed, however, the deep web morphed into a hotbed of nefarious activities, including human trafficking, money laundering, drug sales, and terrorist recruitment, to name a few. Central to this devolution was the creation of Bitcoin, which provides a cover for online transactions.

As it stands, the vast majority of Tor users do not engage in illicit online activities. They simply want to avoid data mining and online advertising and maintain their privacy. In fact, only three percent of Tor users even visit the deep net, with an even smaller fraction engaging in illegal activity. However, the dual nature of the deep net and Tor’s part in enabling it raises serious questions about the proper role of government. Sixty percent of Tor’s funding comes from the Department of Defense and the State Department. Meanwhile, the Department of Homeland Security, the Federal Bureau of Investigation, and law enforcement agencies around the world are engaged in multiple investigations of criminal activity made possible by Tor. For example, today hackers launched a cyber attack that disrupted service for several major websites and services in the United States. Some security experts have raised the concern that this event and several other recent, large-scale attacks indicate that some group(s) is learning how to take down the internet. Clearly, this would have a major and adverse impact on the global economy.

I think that Richard A. Clarke would appreciate that we are having a dialogue about cyber war in this course, and I think he would be equally delighted that there is a course on “Internet and Information Policy” at the “Texas’s Lyndon Johnson School.”

With that being said, like most of the readings in this class, “Cyber War: The Next Threat to National Security and What to Do About It” is probably already out of date – even though it was only written in 2010.

Clarke seems to think that we are not taking cyber war seriously in this country, but I think we are taking some necessary and important steps. James Clapper, the Director of National Intelligence, has listed cyber threats as his number one threat in the last three editions of the Worldwide Threat Assessment. Congress and the White House have eschewed in important policies in 2014 and 2015 in particular. In 2014, Congress passed the Federal Information Technology Acquisition Reform Act (FITARA), which was the first major overhaul of federal IT infrastructure in almost 20 years. Congress also passed the Federal Information Security Modernization Act (FISMA), which “codifies the Department of Homeland Security’s role in administering the implementation of information security policies for federal Executive Branch civilian agencies, overseeing agencies’ compliance with those policies, and assisting OMB in developing those policies,” in 2014.

And finally, the White House produced a detailed Cyberspace Policy Review to assess policies and structures around American cybersecurity. The Office of Management and Budget also launched a 30-day Cyber Sprint as a focused effort to assess and bring all federal assets and networks up to speed. Since the publishing of “Cyber War,” Congress has taken a more active role in oversight of federal cybersecurity. The House Oversight and Government Reform Committee is conducting a comprehensive review of every federal agency and calling each one to testify before the committee. Some cabinet departments, which we may not typically consider as major targets, are rather susceptible to cyber criminals. There is much work that still needs to be done. An ongoing challenge for federal agencies is that they do not have the talent and resources to compete with their private counterparts and frequently lag behind the private sector.

Cyber-attacks on civilian infrastructure, eclectic power grids, and banking systems should scare us all. We’ve become so dependent on technology that cyber-attacks on critical infrastructure – not to mention a full-blown cyber war – have the potential to wreak serious havoc, as evidenced by the Estonia and Georgia examples. Unlike Bruce Schneier, Clarke actually proposes some detailed solutions.

Now, are his solutions practical? That’s another story. I think that this is above the heads of average citizens and not readily applicable to their everyday lives, making a broad public dialogue unlikely. This debate seems destined to be confined to intellectuals, policy wonks, and the technology community. Clarke proposes that we create the Cyber Defense Administration to provide a greater focus. But we already have 18 intelligence agencies. James Clapper, the current Director of National Intelligence, has finally solidified that role. I think that the Cyber War Limitation Treaty (CWLT) is a tough sell. For better or for worse, the U.S. is one of the biggest users of cyber espionage in an offensive capacity. I also don’t think that countries would want to be held responsible for non-state actors acting as cyber criminals. Enforcement of such a treaty seems particularly challenging. Countries could sign the treaty and keep doing what they’re currently doing. If they get caught cheating by another country, they could just deny it or attribute it to a non-state actor.

Notwithstanding, Clarke and Knake do put some detailed and intriguing proposals forward. They have started the discussion; it’s up to us to continue it.

Reading the book Big Data: A Revolution That Will Transform How We Live, Work, and Think was as unnerving to me as it was intriguing. As someone who is very cautious with their internet privacy, the information gathering aspect of big data worries me. But as someone with interest in the advancement of technology and science, parts of big data are also really exciting.

I think that this book, along with pretty much all the books we have read for this class so far, overhypes itself. Every topic we have covered so far has been “the next big revolution.” Don’t get me wrong, I see why big data is important, and I believe that it has immense promise, but I still don’t think ‘revolutionary’ is quite appropriate.

Revolutionary or not, the information that can be gleaned from big data in the hands of corporations and local police departments today makes federal espionage of the twentieth century look like child’s play. And we would be kidding ourselves if we think for a second that all of that information is not also in the hands of organizations like the NSA and the FBI. We talked about this briefly in class last week, but Microsoft was brought up as a company that is collecting unprecedented amounts of user data. And it was pointed out that Microsoft takes user data security very seriously, and has several measures in place to prevent hackers from getting their hands on that data. But these federal agencies regularly serve subpoenas to businesses like Microsoft with explicit orders to not disclose that any information was collected.

Many people are comfortable with businesses having their information. After all, if we ever decide we don’t want a business to have our information we can stop using that business and switch to another. But the federal government having that information is beyond our control, and the implications of that are not far off from George Orwell’s depiction of a police state in 1984 (obviously the totalitarian thought policing is nowhere near the level it was in 1984, but there are several very concerning similarities).

Now, to be fair, my aversion to this kind of information state is based in a set of values that I developed in a world where data collection was much less prevalent than it has become. As the book points out, society’s understanding of the concept of justice is going to need to be updated in years to come, and as part of society, it is not fair to exclude myself from that. Maybe privacy is just a right that we are making obsolete, and I will need to get over my antiquated sense of self and start embracing my role as part of a greater whole.

This week’s reading was “Interop: The Promise and Perils of Highly Interconnected Systems” by John Palfrey and Urs Gasser.

Interoperability (interop) is about connecting systems, applications, and components in such a way to enable them to work together more efficiently. The authors argue that interop generally improves competition and innovation. However, they point out that interop is a two-edged sword that if not wielded properly may lead to compromising privacy and security. They are also careful to point out that interop does not necessarily mean we have to require uniformity and standardization at all levels. Rather they argue that standardization at the right level/interface may facilitate interop, but that we have to be careful not to end up with “lock-in”. In which case, we have the opposite of the intended effect – to hinder competition and innovation.

I would like to tie this back to emergent systems that we studied earlier. Palfrey and Gasser argue that with proper interop we get systemic efficiencies and network effects that results in overall improvements. This is similar to what Johnson argued – that interconnectedness with the “right” local interactions (i.e. interop), results in emergent (and hopefully beneficial) behavior of the overall system that is not immediately obvious.

The policy question is how to achieve the right balance of interop such that competition and innovation are increased while privacy and security are protected and system complexity is kept manageable. The authors argue that “a pure laissez-faire approach to interop rarely works out well”, but rather that both the private sector and public sector should work together to achieve optimal levels of interoperability. “And this blend of approaches probably changes over time as circumstances change: the state may play a bigger or smaller role at different moments in the history of a given complex system. […] A key characteristic of today’s technology environment is the speed with which changes occur. […] Those seeking to establish interoperability remain flexible and open to change as they set policy in this fast-changing context; rigidity can result in disaster.”

I agree with the authors that a mix or private and public sector approaches are needed for optimal interoperability. However, I question whether the public sector is nimble enough for this purpose. The book discusses the tools available for the state to promote interoperability, and presented policy guidelines that officials can use as the basis for promoting interoperability. However, it has no discussion of the government structure that is most effective for implementing this policy. I believe implementing interop policy will require trial and error and therefore experimentation with policy is essential.

The authors used the 2008 financial crisis as an example of how interoperability can lead to unmanageable complexity and positive feedback loops that are hard to break. However, I have an additional observation from the crisis. Although, the executive and legislative branches of government were slow to react, I believe the forceful and decisive action of the Federal Reserve – an independent, but still accountable part of the executive branch – was instrumental in limiting the effects of the crisis.

I argue that if we set up some government agencies more like the Fed they may be better positioned to implement interop-promoting policy. The idea is that these agencies should be able to quickly take unilateral action to affect desired policy. That may also include reversing an earlier policy position that proved to be a failure. The officers of the agency should be independent. Specifically, the officers should be appointed by the president and confirmed by the Senate. After appointment they serve the full term and neither the president that appointed them or the next president can fire them, and they should also be term-limited (unlike the Fed). The officers should have relevant experience (e.g. Fed chairmen are typically academic economists or economists who have formerly been working in the banking sector). Further the officers should be free of conflict of interest with private companies that they are regulating. What should their mandates be and what enforcement tools should they have available? I don’t have an answer for that. It might be that Monetary policy (i.e. the Fed’s job) is easier to make independent, but it’s still worth investigating a similar structure for other agencies, like the Federal Communications Commission (FCC).

Another option is to explicitly allow experimentation with interop policy. This is easiest to do by allowing different jurisdictions to have different policies. A good example of this is Pittsburg allowing Uber to experiment with driver-less cars. When viewed from an interop perspective, this experiment is about finding the right interop mechanisms between driver-less cars and existing city transportation infrastructure (pedestrians, other cars, roads…). Policy makers and regulators should allow for this kind of experimentation whenever possible.

Palfrey and Gasser (2012) write that interoperability, in a general sense, is the “ability to transfer and render useful data and other information across systems, applications, or components” (p. 5). And generally, interoperability is a great thing for users/consumers, innovators, businesses, etc. It allows for more efficiency across networks, can decrease costs, can increase diversity of choices, can facilitate the movement of ideas, encourage competition in the marketplace and lead to innovation (Palfrey and Gasser, 2012). Yet our authors acknowledge that “interop is not always an unalloyed good” (p. 12). Interop can encourage innovation “and thwart it… too much interop, or the wrong kinds of interop” can be detrimental (p. 17).

One example of this that I found particularly interesting a few months ago, was a blog post that went viral of the author losing his 122 GB of music because Apple deleted the original files: https://blog.vellumatlanta.com/2016/05/04/apple-stole-my-music-no-seriously/

The blog recounts how after realizing that his music was gone contacted Apple and received the following response:

“The software is functioning as intended,” said Amber. “Wait,” I asked, “so it’s supposed to delete my personal files from my internal hard drive without asking my permission?” “Yes,” she replied.

This example of the relationship between interop, cloud services, and its potential for unforeseen consequences highlights that moment when interoperability is not necessarily a good thing. Here I’ll address one of the major concerns raised in the blog:

4. Should I choose to reclaim my songs via download, the files I would get back would not necessarily be the same as my original files. As a freelance composer, I save WAV files of my own compositions rather than Mp3s. WAV files have about ten times the number of samples, so they just sound better. Since Apple Music does not support WAV files, as they stole my compositions and stored them in their servers, they also converted them to Mp3s or AACs. So not only do I need to keep paying Apple Music just to access my own files, but I have to hear an inferior version of each recording instead of the one I created.

Apple had uploaded the author’s entire 122 GB of music to the cloud and for efficiency, ease of access and smaller file sizes, that music was converted to a single file format - one that was unacceptable to the author but there was no way for him to prevent this. It makes interop sense to have a single file format for its music (especially since Apple uses Bonjour’s peer-to-peer file sharing to reduce what music is stored on its network). Palfrey and Gasser (2012) anticipated some of these tensions between interop and cloud services. They write that in a world of cloud services “who owns data in the cloud? who can access those data?… The list of issues related to data location, privacy, security, and ownership goes on and on” (Palfrey & Gasser, 2012, p. 236). Luckily the author of the blog post had recently backed-up his music files - but what if he had not? Who would have been culpable? Apple? Apple can hide behind its terms of conditions and use but for the average user, Apple’s behavior feels like theft or at the very least over stepping boundaries of ownership.

Yuval Harari’s article, “Big Data, Google, and the End of Free Will”, really shows how we as data users and information consumers have allowed our data to know more about us that we realize, or are willing to admit. In order to have our wireless lives work seamlessly together, we’re willing to sign user agreements without reading the fine print. Harari describes a world where our data knows us better than we know ourselves, which isn’t entirely inconceivable today. We rely on Google Maps to let us know how long our work commute will be and when we should leave to make it to work on time. Amazon’s “Alexa” will actually learn when you usually leave for work, where you work, and will alert you if you need to leave earlier depending on that day’s GPS data for traffic flow. “Big data” has become today’s buzzword. Everyone is mining for big data, learning more about everyday citizens. Medical records, GPS information, even your shopping cart tells more about ourselves than we can. This type of data accumulation is still highly unregulated, unstructured, and capable of huge potential. Policy and legislature concerning this data accumulation continually lags behind technology development by decades. Harari’s article really isn’t about the use of this big data by government and corporations, but how we, as society, let the big data govern us. By maintaining authority over our decisions, not letting big data wholly make them for us, we continue to maintain our humanistic qualities.

But today’s society is caught between Harari’s dataist and humanist concepts, we still make emotional decisions, but our decisions are becoming more and more influenced by the data we are exposed to and accumulate. Johnson’s book, “Emergence: The Connected Lives of Ants, Brains, Cities, and Software” attempts to create a connection between society’s data accumulation and structure, and the complexity structure as a whole. He describes various examples as complex structures, such as ant colonies, the human body, and New York. But what actually is emergence? Because the Internet is vastly diverse, is it the fact that it is still organized into a structure that allows simple problem-solving capabilities? That each user follows simple rules of behavior, like using ISP address to get to a specific website, the coding behind a webpage, or the search engine using crawlers to index new websites? He states the web, “wouldn’t truly be considered emergent until those local interactions resulted in a higher-level pattern interactions between local agents” (p. 19). Because we are interacting on a higher-level between each other, is the web truly considered emergent?

Johnson states the Web is not considered a “global brain”, which is understandable. Its processes are derived from the billions of people using it, searching and creating information. It may be able to “learn” about us, but it only learns by our own Web-use actions, its not organic. If I no longer use the Web via my phone, computer, iPad, or use my credit card, “going off grid”, my browser and Google no longer learn about me.

For example, at your local store, they want you to be a member, “have a store card filled with benefits“. This helps track buying patterns and end up help in the prediction of the next big thing you will be interested in buying. Also, your local hangout has a face book or Instagram page. They take a picture of you as a  happy customer, they post it and that becomes part of the collection of data about you. People you know see the picture and they also want to check out the place.

I hate to be a grumpy, skeptical old man, but since I turned 30 recently, I’m feeling more and more comfortable telling kids to get out of my yards and bursting people’s idealistic tech bubbles. I’ll start here with Steven Johnson’s book Emergence: The Connected Lives of Ants, Brains, Cities, and Software. Let me say first, that I liked this book. Who doesn’t like learning that ants are leaderless societies that have complex organization and even create their own trash dumps? And did you know that slime molds can be taught to move through a maze and don’t have a brain or central decision-making cell? However, Johnson’s obsession of networks doesn’t take into account how human bias makes network systems a poor solution for many of humanities problems.  I still love these ideas and think they could be applicable to certain parts of human society, but I’m not sure how helpful these lessons are for a diverse society that needs to complete tasks far more complicated than moving through mazes.

The book is about how small decisions at a lower level of society create higher level order and efficiency.  While Johnson’s examples are interesting and could hold lessons for planners, networks that select for one thing inevitably leave something out. Any system still has to choose what it will select for and often does this in a Darwinian manner. But when we want to create societies that are just, fair, and equal, the Darwinian method and the networking method begins to fall apart. A great counter-example can be seen in segregation.

Thomas Schelling’s 1972 paper Dynamic Models of Segregation uses game theory to prove that people’s small preferences to live with people of a similar race, lead to large segregation effects. These are small decisions made by many people that create a higher level order. This sounds awfully familiar, right? It is almost exactly the emergence network effect. But, it leads to an outcome that sorts people into homogenous groups which is exactly what we don’t want in our cities.

This idea can be modeled and visualized easily using game theory. Don’t worry, the website uses adorable triangles and squares so the exercise isn’t as depressing as it might sound. The model allows the user to move the controls up and down for preferences and baseline segregation to see how people would triangles and squares sort themselves. It’s an incredibly effective learning tool to see the side effects of emerging networks.

This website and model teaches us that we can have diverse neighborhoods, but we will probably need to be more conscious about what emerge from our networks. Secondly, we need to be careful about calling people racist, because everyone has some kind of preference to be with a similar people in a similar group. If we are to build a society that we want we need to be conscious of these and try to create systems and neighborhoods that go against some of our inherent bias. And this will not happen based on a network choosing what it wants.

Johnson mentions how networks can be biased towards majority viewpoints in an example he gives about a news aggregator website called Slash Dot. You may have heard about similar problems with Facebook’s newsfeed that favors cats and things you will ‘like’ over more difficult news. These websites tend to focus on majority viewpoints because they get more likes and positive feedback. These kinds of networks again, are great for one group, the majority, but fail to take into account all of the other things we want in our lives, like a diverse set of viewpoints.