0001010101001111101

Although DeNardis wrote this more than two years ago, in her book The Global War for Internet Governance, and is talking about SOPA and PIPA, she could very well have been writing about the new independence of ICANN from the US government that went into effect a few weeks ago.

On October 1st, the US government let lapse its contract with the Internet Corporation for Assigned Names and Numbers (ICANN), resulting in “an organization that is largely independent of national governments” (para. 1). Notably, Senator Ted Cruz, of our lovely state of Texas, argued that this decision “poses a significant threat to our freedom” and “will empower countries like Russia, China and Iran to be able to censor speech on the Internet” (para 2). Besides obvious fear tactics, it’s clear that our politicians have little understanding of the ways in which Internet governance works.

(Sidebar: doesn’t Cruz’s comments mean that the US could censor speech on the Internet up until October 1st? #murica).

The Internet has been globally oriented for a long time now and arguably American control of ICANN has made little sense for a while now. As DeNardis points out “internet governance is about governance, not governments” (p. 11). And as we have talked about a little bit in class, geo-fencing is an almost completely arbitrary practice on the internet. Furthermore, as DeNardis describes the US initially always intended to phase out oversight of ICANN.

I particularly enjoyed Laura Denardis’ extensive treatment of internet governance—from the underlying technical infrastructure, to its history, the role of government in the grand scheme, and the role of private players.  I particularly enjoyed her treatment of the role of private information intermediaries.  I have always found the dynamic with regard to copyright and the nearly ubiquitous DMCA takedown notices in my Google search results to be quite interesting given that private actors such as Google have to act as an enforcement arm of the government by taking down copyrighted content.  Whenever one thinks of regulation in the traditional sense, there seems to be a strict division between enforcer and enforce—the FDA and the food industry, financial institutions and the CFPB, etc.  In the context of copyright takedowns, however, it is often the case Google acts on a complaint filed by a third-party to the government.  Google in this sense becomes an augmentation—or at least some proxy—for the government enforcer.  

The relative immunity of content providers from lawsuits is also particularly interesting, as it presents a situation where a third-party actor can knowingly say copyright infringement is occurring within the bounds of its control without facing huge repercussions.  In a conventional setting, if I were to knowingly allow someone to synthesize illegal drugs or participate in some illegal activity, I would be held liable by traditional authorities.  In this case of content providers, the scale and distributed nature of content makes pinpointing such illegal activity difficulty which results in the interesting situation where a content provider can, with high certainty ascertain that some sort of illegal activity (namely, copyright infringement) is taking place, but is unable to reasonably identify all illegal activity.  

I worked for a little under a year for a small payment processing company. Think PayPal or Square, but built on 90s technology. Like so many ecommerce companies, the company grew up in the 90s, went public, exploded in the dot-com bubble, collapsed in the dot-com crash, and has barely scraped by ever since, never having the capital or management to seriously invest in new infrastructure and top-tier programmers. Instead, it continued subsisting on existing contracts, most of which were large government contracts (!!). The programmers they did employ were perfectly capable, but not brilliant, and the development had neither the expertise nor the manpower to build a whole new modern system, so it continued patching its old technology.

One day, our team decided it was time to update our hashing system, which is basically the security mechanism that protects users’ passwords when we store them in our databases. Remember, of course, that these usernames and passwords are for a banking system processing billions of dollars a day, for a variety of clients including businesses and government agencies. So, how was our system “protecting” these passwords? Well, with a nice little 90s algorithm called MD5, of course!

MD5 is what’s called a hashing algorithm, which essentially means that you can use it to change a password into a “hash”. The important thing about this is that it’s (theoretically) infeasible to reverse the process, so even if someone evil gets ahold of the hash, they can’t figure out your password without simply trying every possible password in a brute-force attack. A lot of really smart people have shown that, if you have a secure hashing algorithm and choose a password that isn’t easy (for a computer) to guess, then it’s safe to store passwords this way. So even if a hacker gets ahold of the whole list of users and hashes for your system, they can’t break into it or figure out the passwords. This is all well and good except for one little detail: the MD5 hashing algorithm has been shown repeatedly, to the point of hilarity, to be totally fucking broken. As in, it’s so easy to break that there are websites where you can copy and paste an MD5 hash and it’ll just tell you the password, straight up. Here’s one for giggles: https://isc.sans.edu/tools/reversehash.html

The solution was simple enough: switch to a new hashing algorithm. It’s actually a rather trivial process of swapping out a few lines of code using MD5 to call a different algorithm, SHA-256, instead. There’s only one difficult part: all users have to reset their passwords in order to hash them and populate the new password database. One developer at the table half-jokingly suggested an alternative: “We’re changing from MD5 because it’s so easy to crack. Why don’t we just crack all of our users’ existing passwords and rehash them ourselves, so they’re not bothered having to reset their passwords?” We laughed it off, but it would’ve been totally doable for most users’ insecure passwords.

A common theme in this class has been the contrast of the virtual and physical worlds—from social norms and issues of general privacy, there is often a very different playing field with regard to these issues when they are handled in the virtual world.  In the same regard, cyber warfare as touched on in “Cyber Warfare: the Next Threat to National Security and What to Do About it,” completely upends the usual rules of war when such “war” is conducted in the virtual space.  As the author notes, whereas conventional warfare is bound to specific apparatuses affiliated with war (tanks, planes, aircraft carriers), cyber warfare is not tied to distinct entities that can be used expressly for war—the author notes on an example of exploiting a copy machine’s internal vulnerabilities for malicious cyber warfare intent.  Given the lack of global control at the operational level and the structure of the web to facilitate free communication between different networks as well as the intertwining of benign and malicious systems, the web itself poses an interesting geography from which one can wage cyber warfare.  

The author’s discourse on the potential inapplicability of deterrence and no-first-strike (from nuclear warfare) to cyber warfare was particularly interesting.  Cyber warfare seems to pose some sort of prisoner’s dilemma whereby any self-imposed no-first-strike policy, while probably better off for all combatant parties involved, may be untenable due to the desire of cyber warfare combatants to not be disadvantaged to any potential combatant.  The notion of warfare itself in the usual sense often is tied to a beginning and an end—from the declaration to the signing of a peace treaty or armistice, but in the case of cyber warfare this line seems blurred.  Any attack could have been preceded by a pre-attack to compromise an enemy’s system—so this fundamentally begs the question of when “war” actually starts.  

As is suggested by the header, one of the aspects of Schneier’s book that I really appreciated was his breakdown of the ways in which average users do not understand data and what it is used for and that the ways data is analyzed is fundamentally different than human thought, problem solving, and understanding. Computer systems are not only able to brute force analyze large sets of data in the time it would take a human analyzer to understand one small section of one data set, but they can do other things too. Schneier mentions their ability to do hop searches which allow connections to be made that might otherwise not be apparent to humans. They can effectively look back in time. They can search for things about a certain topic or they can sort data sets by importance after learning what to deem important and what not. It’s also important the way he delineates data and metadata about individuals - a difference I think the average user cares little about.

All this is to say that, because the average user either does not see the amount of surveillance occurring or because they do not understand it, most are unfazed by the idea of surveillance. We have, ourselves, mentioned the anecdotes younger people admitting that they are fully aware that they are being surveilled by the government and private companies, but that they do not care because they get goods and services for that. In those situations, while they might be aware that it is happening, if they actually saw what data was being collected and what it could be used for in real time, would they care? I’m not sure about that, but it is an interesting thought experiment, I think. Imagine you are on Facebook or just casually browsing, and there is a window to the side listing the metadata being collected on you as you do these casual tasks. Would it change your usage? Would you stop checking in at that restaurant that gives you coupons when you check in? Would you stop using Google Maps to get somewhere and instead use the atlas that is under one of the seats in your car? Maybe. Maybe not.

As touched on by Bruce Schneier in Data and Goliath, surveillance via the internet is widespread on a corporate and government level in today’s modern world.  On many levels, I agree with Schneier’s points on government collection of data bordering on the illegal.  The use of the NSA powered by tacit executive approval in the United States to spy on Americans with little judicial oversight is frightening—more frightening than the corporate surveillance that Schneier asserts.  

On a personal level, I believe that it is completely fair for companies to collect data in exchange for free or very inexpensive services (the author brings up the point of Gmail, Drive, and other suite of Google products), and I agree that the “third-party” doctrine is completely valid.  Seeing the indispensability of these free services in modern life (email and messaging apps to communicate with family and friends, using Amazon to buy things that are hard to find in one’s geographic locale, etc), I am very skeptical of providing an onus on companies to collect less data.  Forcing companies to less data could very well reduce the quality of services that internet companies provide such as Google and reduce the effectiveness of their advertising.  Reduced advertising revenue could drive companies to resort to alternative revenue generation models that could result in more of a burden to the consumer—such as paying for email.  Could you imagine paying for an email?  Neither can I.   For all the power that internet corporations have with data collection, consumers still have ultimate power—that of choice.  

Unlike government surveillance, to which express consent is rarely given, we implicitly give consent to corporations to surrender our data when we use their products and services.  If I really wished to avoid surveillance of Gmail, I could very well set up my own mail server at my own domain and send email from there.  However, as I wish to spend my own time NOT setting up and maintaining a mail server and doing more interesting things, I use Gmail and choose the conveniences of having an integrated suite of products that I can use to organize my life.  The fact that the Google, Facebooks, and Amazons of the world have my data has not been of negative consequence—I can only see the benefits of being able to easily communicate with others, easily find the things I need to buy, easily organize my life.  Their presence has been both benign and unobtrusive.  

First off, wow let’s talk about these social media numbers described at the beginning - 10 million new photos uploaded to Facebook every hour, three billion likes a day, and 400 million tweets a day. I knew these numbers were high, but these are much higher than I could have ever imagined. Two things come to mind. 1.) we spend way too much time and energy on social media and it probably is only going to get worse. 2.) we’ve come a long way from 20 minutes to download a picture.

OK, now on to Big Data!  

I recently read an article in the New York Times that discussed a recent contract between University of Michigan and Nike worth $170 million. The technology includes heart-rate monitors, GPS trackers and other devices that log biological data. The potential is huge. Real-time tracking of an athlete’s stats to maximize analysis of all types of stuff. It reminds me of Drago in Rocky IV when he is training to beat Rocky.

  On the other hand, players were not asked to consent to the contract. Again, as we have discussed many times, we hit a big privacy concern. Can this information be shared with NFL teams? Is that fair to players? Mayer-Schonberger and Cukier bring up the go to sports example for big data, Billy Beane and Moneyball, to discuss how big analytics can eventually drive out human decision making. How much data can sporting scouts use to make the “perfect” decision on a recruit? Will NFL teams crunch data from a decades worth of information of a player gathered by their clothes to determine if they will draft him?

This question of how we use big analytics to make decisions goes beyond sports, but it raises the important question of at what point does human judgement disappear. Will enough data be available and algorithms good enough to get rid of decision makers? Will a team owner pick players with the push of a button? We live in a world today where we use data as a tool to make decisions, but often it is not the only one. We still use human judgment to make decisions, but it is not hard to see a world in which decision making relies solely on an algorithm. I’m not sure how we feel about this. While maybe we are making the most optimal decision using analytics, is it the most ethical decision, or the one that is best for society. Also, what do we lose in the human experience when we stop making decisions. An integral part of life is making decisions and living with the terrible decisions we made.

The measurement of sports stats also makes me sad, though, especially for our future feel-good sports movies. What happens when we crunch all the numbers and find that 'heart' never mattered at all. It will truly be a terrible loss.

Big Data: A Revolution That Will Transform How We Live, Work, and Think repeatedly makes the excellent point that data speaks for itself, even if we don’t know the how’s or why’s behind it. Mayer-Schonberger and Cukier present a hypothetical situation in which an algorithm could discover that orange juice and aspirin correlate with cancer remission through extensive analysis on a sufficiently large-scale database of medical records. Perhaps scientists, given this information, would be able to run appropriate studies and determine its mechanism of action, but in some sense, it doesn’t really matter; with an appropriately programmed algorithm that accounts for independent variables, the results could speak for themselves.

The scale problem of big data doesn’t arise inherently from large numbers. We have plenty of ways to understand and visualize large numbers. Whether it’s a hundred records or a billion records, we can understand percentages. We can tabulate totals in spreadsheets. We can run algorithms which determine a result and we can view the data which lead to that result. Sure, we might not know the mechanism by which the result arose, but at least we can see the correlation between the data and the result.

But big data becomes truly opaque when combined with our most powerful form of analysis: machine learning. Machine learning, basically, takes a large corpus of training data and “learns” how to create the correct outputs for similar future inputs. In other words, machine learning is inherently reliant on big data – a small training dataset makes it impossible to train the machine. For example, take the face detection problem. Basically, it’s the ability to look at a picture and put boxes around each of the faces in the image, without identifying the faces (that’s facial recognition). Now, it turns out that this is a fairly tough problem, and it gets tougher when you consider that faces might be far away or close up, blurry, obscured, sideways, of various shapes, sizes, and colors, blocked by another face, or what have you. When people started working on this problem, they created tons of theory: faces typically have a nose, ears, and eyes in certain general proportions; they appear on top of necks and shoulders; and even more theoretical ideas like the typical distribution of light as it falls across a face.

However, this problem was ultimately solved not with increasingly complex theoretical models, but rather, by machines teaching themselves what constitutes a face, and the theoretical implications are wholly unsatisfying. Sure, we might be able to determine that it represents faces as a 400-dimensional vector of color gradients and yada yada yada… But we have very little clue how it actually recognizes a face, in human terms.  I once heard of a professor who was frustrated to no end by this dilemma. He had dedicated his entire research life to creating carefully-tuned theoretical models for visual recognition. He had programmed passable methods to identify trees, fruits, and various other objects based on intense theory regarding the anatomy of the various objects. And, while he felt he was making progress, his programs’ accuracies got absolutely blown away by the machine learning people who had no idea whatsoever how their machine was identifying these objects. So the problem was solved, rendering his life’s work somewhat misguided, but with very little explanation of how a computer actually recognizes a tree or a fruit.

So how does this frustration relate to big data? Well, it has implications for every component of the book, but perhaps the largest are the messiness and value chapters. Machine learning is inherently messy, because (as Big Data points out repeatedly) the data it takes as input is messy. When you digitize an entire history of medical data, for example, there are bound to be thousands of different formats, scans, tests and information, many of which might not synthesize perfectly into a single picture of “human health.”  And, of course, the value of possessing big data arises from making novel conclusions out of it, which machine learning excels at.

Big Data: A Revolution That Will Transform How We Live, Work, and Think repeatedly makes the excellent point that data speaks for itself, even if we don’t know the how’s or why’s behind it. Mayer-Schonberger and Cukier present a hypothetical situation in which an algorithm could discover that orange juice and aspirin correlate with cancer remission through extensive analysis on a sufficiently large-scale database of medical records. Perhaps scientists, given this information, would be able to run appropriate studies and determine its mechanism of action, but in some sense, it doesn’t really matter; with an appropriately programmed algorithm that accounts for independent variables, the results could speak for themselves.

The scale problem of big data doesn’t arise inherently from large numbers. We have plenty of ways to understand and visualize large numbers. Whether it’s a hundred records or a billion records, we can understand percentages. We can tabulate totals in spreadsheets. We can run algorithms which determine a result and we can view the data which lead to that result. Sure, we might not know the mechanism by which the result arose, but at least we can see the correlation between the data and the result.

But big data becomes truly opaque when combined with our most powerful form of analysis: machine learning. Machine learning, basically, takes a large corpus of training data and “learns” how to create the correct outputs for similar future inputs. In other words, machine learning is inherently reliant on big data – a small training dataset makes it impossible to train the machine. For example, take the face detection problem. Basically, it’s the ability to look at a picture and put boxes around each of the faces in the image, without identifying the faces (that’s facial recognition). Now, it turns out that this is a fairly tough problem, and it gets tougher when you consider that faces might be far away or close up, blurry, obscured, sideways, of various shapes, sizes, and colors, blocked by another face, or what have you. When people started working on this problem, they created tons of theory: faces typically have a nose, ears, and eyes in certain general proportions; they appear on top of necks and shoulders; and even more theoretical ideas like the typical distribution of light as it falls across a face.

However, this problem was ultimately solved not with increasingly complex theoretical models, but rather, by machines teaching themselves what constitutes a face, and the theoretical implications are wholly unsatisfying. Sure, we might be able to determine that it represents faces as a 400-dimensional vector of color gradients and yada yada yada… But we have very little clue how it actually recognizes a face, in human terms.  I once heard of a professor who was frustrated to no end by this dilemma. He had dedicated his entire research life to creating carefully-tuned theoretical models for visual recognition. He had programmed passable methods to identify trees, fruits, and various other objects based on intense theory regarding the anatomy of the various objects. And, while he felt he was making progress, his programs’ accuracies got absolutely blown away by the machine learning people who had no idea whatsoever how their machine was identifying these objects. So the problem was solved, rendering his life’s work somewhat misguided, but with very little explanation of how a computer actually recognizes a tree or a fruit.

So how does this frustration relate to big data? Well, it has implications for every component of the book, but perhaps the largest are the messiness and value chapters. Machine learning is inherently messy, because (as Big Data points out repeatedly) the data it takes as input is messy. When you digitize an entire history of medical data, for example, there are bound to be thousands of different formats, scans, tests and information, many of which might not synthesize perfectly into a single picture of “human health.”  And, of course, the value of possessing big data arises from making novel conclusions out of it, which machine learning excels at.

The theory of interoperability as posited by Palfrey and Gasser is intriguing as it attempts to provide a descriptive theory of interconnectedness and provide prescriptions as to what the “optimal” level of interconnectedness is in human and technological systems.   Though I appreciate the authors’ attempts at creating a unifying theory to describe interconnectedness and believe it to provide a nice mental map to reasoning about complex systems, I find it somewhat lacking, given its context sensitive nature (as noted by the authors), which lends itself to anecdotal descriptions of the theory in practice but not a systematic theory.  If Palfrey and Gasser could formulate a context-free metric to describe interconnectedness that could be used to make correct predictions of “success” or “failure” of a network, business, technology system, or legal standard, I would be more convinced of the applicability of their theory.

As a computer scientist and most likely soon-to-be software engineer, I find Palfrey and Gasser’s descriptions of the perils and potential of interoperability to be balanced.  The authors bring up a good point regarding the potential for interoperability to reduce incentives to create new innovative systems by providing greater incentives to integrate with existing system.  As a computer science student and most likely soon-to-be software engineer, I particularly enjoyed Palfrey and Gasser’s treatment of Facebook’s API—namely, its ability to “cover a broad range of functionalities” to “serve widely diverse needs [ranging from] games and sports applications to business tools, utilities, and applications” (Palfrey and Gasser 115).  By becoming a platform for a diverse range of functionalities, Facebook provides a general medium for diverse groups of people to come together on the internet, in line with its ethos of making the world “more open and connected.”  

The most interesting observation of Interop: The Promise and Perils of Highly Interconnected Systems by John Palfrey and Urs Gasser was that of the case where we prefer to avoid interoperability. Palfrey and Gasser continuously use the example of a gas station’s diesel pumps, which are apparently designed such that they won’t fit into the tank of a regular gasoline vehicle. It’s a perfect example, and we often see many others, such as chargers which won’t fit into other devices due to their different voltage/amperage outputs. Palfrey and Gasser also give moderately more nefarious examples, such as Apple’s desire to keep users within their ecosystem by limiting the interoperability of media bought on iTunes. Such barriers exist throughout the digital ecosystem, whether it’s Microsoft’s Office Suite, Google’s pervasive account system, or Facebook’s stranglehold on the social media scene. Interop makes a compelling case that such limitations are sometimes good for consumers and sometimes quite bad.

While Interop acknowledges the validity of controlling interoperability between services, I think it underestimates the value that such barriers provide. While this may be an extreme example, take the case of the Stuxnet virus (https://en.wikipedia.org/wiki/Stuxnet). In the late 2000s, Iran was, to the dismay of many western governments, expanding its nuclear program. A key component of this process is enriching uranium, which requires heavy-duty centrifuges. In Iran’s case, these centrifuges were produced by Siemens and were controlled by Windows computers completely off the network, physically unconnected to the internet or to any outside computers. A country’s controversial nuclear enrichment program is, of course, a prime example of a system which should not be interoperable with the outside world. Yet Stuxnet programmers were able to infect and destroy the centrifuges by exploiting the interoperability of usb flash drives and other Windows features which were connected to the centrifuge controllers. This would have been impossible had the systems been truly devoid of interoperability features, or perhaps if their systems were designed from the ground up to be locked down and non-interoperable. Instead, Windows generally promotes many types of interoperability, and virus programmers were able to exploit flaws such as its USB protocols – that’s the Universal Serial Bus, by the way – and its ability to connect to printers on the network.

For similar reasons, many U.S. military systems rely on ancient and profoundly non-interoperable systems, such as systems only accepting 8-inch floppy disks from the 70’s (http://www.cnn.com/2016/05/26/us/pentagon-floppy-disks-nuclear/). Needless to say, these systems are not inherently designed with the ability to “share this on Facebook” or “sync to my iCloud.” But such concerns are not limited to a country’s nuclear program. Most current online account systems rely on your email as a backup source of legitimacy, sending password resets to the email you’ve supplied. Aside from perhaps requiring a security question – which, by the way, are widely considered “next to useless” in the industry (https://www.macobserver.com/tmo/article/google-study-finds-security-questions-next-to-useless) – an email generally gives access to all of a person’s account’s tied to it, even if they use strong and unique passwords across sites. This is a prime example of an inherent flaw of interoperability. While it may be handy to have one singular point of failure for my entire online identity, it’s certainly not secure.

Cybersecurity is increasingly becoming a hot topic among a number of disciplines: computer science, public policy, communication, and financial. This is such a huge topic of discussion in people lives because our digital world is quickly overshadowing our “real” world. Though, many would say that their digital world is just as real as the one where stubbed toes and tickle monsters exist. Counting individual files, music, cloud files, and software,  I keep more things in digital format than i do in my apartment. And just like someone can break into my apartment and take my bike or PS4, someone could just as easily break into a server i’m connected to or a network i’m a part of (in the right hands of course). 

This is a big issue for financial companies specifically. If their servers and databases aren’t secure, it’s not a matter of when they’ll get infiltrated but when they get infiltrated. The problem with modern financial transactions over the internet is because it’s usually one or two channels that make that message possible. In theory, all someone with malicious intent has to do in break into that one channel, pull information, and use that information to his or her personal (usually financial) gain. However, there is a technology that makes this process more complicated and more secure but easier to use all at the same time.

Blockchain connects a series of nodes along a network with a singular ledger or list of transactions. each node or computer can manipulate that ledger in a secure way and then that new item becomes a new “block” in the chain. Every other computer on that network assesses the new transaction and, once it’s verified by the network, becomes a permanent change in the system. The important part of that entire process is that the whole system is encrypted. If you want one part of that ledger someone would have to break into each block in the chain on each node of the network at the same time. 

Sounds cool right? Sounds like a perfect solution to a complex and sensitive process. But, the theory of diffusion of innovations tells us that not all perfect solutions get adopted by the public or majority of the target audience. A wide variety of factors could contribute to whether or not an innovation gets widespread adoption. It could be that the innovation is just too complicated and with out a trained professional or the resources for those professionals to teach and implement new technologies and processes, people might just see it as too difficult to adopt. Another reason might be that there’s no driving force behind the communication of that technology. If the technology or process isn’t owned by a company there might not be any incentive for anyone to sell that technology or process. The best way for an innovation to get widespread adoption is for a combination of the above practices as well as interpersonal conversations and people you know personally advocating the innovation. All this to say that if people you know aren’t talking about it, you can’t use and pre-test it with a professional, and/or there isn’t a campaign for repeated memory recall, you probably won’t have an incentive to adopt.