The Enigma

We are in the midst of another technological revolution. Some call it the Internet of Things. Others have termed it the Internet of Everything, ubiquitous/pervasive/embedded computing, the Industrial Internet, or Machine-to-Machine communication (M2M). In their book The Silent Intelligence, Daniels Kellmereit and Obodovksi – who prefer the term M2M – provide a useful overview of the technology’s history and trends, the M2M technology ecosystem and examples of its application in the market of today and tomorrow. I found the title of their book particularly apt because most of the development of the IoT has indeed occurred outside of mainstream visibility of the broader public. In fact, even in 2014, a year after their book was published, a survey found that 87% of consumers hadn’t heard of the IoT.

Of course, the IoT is nothing new: the first internet-connected toaster was unveiled at a conference in 1989 and many people have devices connected to their smartphone via the internet. But is the IoT real? Is it not just another example of an overhyped technology that has reached its peak and will descend down into the (disappointing) valley of realistic expectations sooner rather than later? I would argue that the IoT is real and quite significant, but not in the way we traditionally conceive of it. Kellmereit and Obodovksi argue that the IoT’s biggest benefit is “that it gives us a unique opportunity to talk to the analogue world around us […] in a digital way…” This is a conception of the IoT as being primarily about things. I would posit that what we should be paying closer attention to what could be called “hardware as a service”

Companies are miniaturizing RFID sensors and antennas and embedding them in everything from t-shirts to milk cartons to thermostats. The cost of many IoT sensors has fallen enormously and near-ubiquitous cellular connectivity in some parts of the world has reduced the size of challenge on the hardware side. Developing a set of standards and achieving interoperability across producers, industries and devices remains an important area of work, but the truly interesting side of IoT is not achieve connectivity per se, but how connected devices can be harnessed to provide a service or experience to their users.

Take Uber for example. Instead of thinking of the future of their service as connected (and, at some point, self-driving) cars, you think of it as transportation as a service. Most of us could not care less how the technology works as long as we get from it what we want. While we must be cognizant of data privacy and security concerns and create an opt-in system, predictive analytics tied to cell phone and location whereabouts can making getting around in urban areas easy and seamless. The truly valuable part of the IoT, I believe, is the data gleaned from the billions of interconnected devices and not the temperature sensing sneakers or the smart fridges themselves. Therefore, the question we should be asking is how does the combination of smarts, sensors and connectivity enhance people’s lives?

The internet of things has come up in conversations in class all semester, so covering the topic in a comprehensive manner is long overdue. There are so many things to consider with IoT policy: security, privacy, interoperability, governance,  infrastructure, and the list goes on. I think part of the reason that IoT is so far reaching when it comes to relevant topics is that it is a fairly broad term. Anything that connects to the internet could be considered an IoT device, which means that with enough imagination, anything could introduce new concerns for all of these topics.

I first learned of IoT maybe a year an a half ago. I mean, the idea of a fridge that connects to the internet wasn’t by any means unheard of to me at that point, but that never had a word for me until I learned of IoT in a formal sense. Since learning of it, school has been the only place that I encountered IoT conversations, at least until recently. In the last 3 or so months, I have noticed talk of IoT seeping into public discussion in places like Reddit and Facebook. I found it shocking however, how the conversations I was seeing online were so contrast to the conversations I was having at school.

In my experience, IoT is really only talked about in a negative light at school. It is talked about as a breed of technology that presents far more chance for harm than for good. It is talked about as a hassle to regulate and to insure. “The ability to start a coffee maker from across town does not really justify the additional potential point of failure for our private data,” is the general tone of the conversations. But online, everyone seems to be really excited about the possibilities. I’ve seen advertisements for companies hyping up IoT devices, which is a little jarring for me because given my experience, I would have assumed companies would want to avoid the IoT label. The embracing of IoT is interesting from an academic standpoint, and mildly terrifying from my own personal viewpoint.

The trend of adding new technology to old technology is not new by any means. Look at cars for instance: it is really hard to find cars with manual transmission today. Automating transmission made driving a far easier skill to learn, but it also made maintenance a fair bit more complicated. We traded usability for the fact that we pretty much have to go to a mechanic to get any aspect of a transmission looked at. That tradeoff was only really noticed my the mechanically inclined. And that trend has gotten far worse with cars. Now, nearly every aspect of a cars operation is linked to an onboard computer, and the only people with access to that computer are dealers. Fixing your own car is almost impossible today compared to fixing your own car 30 years ago. The same trend can be seen in computers. They started as a tinkerer’s dreamland, but through proprietary hardware, increased connectivity and questionable business practices, they have become accessible to everybody, but have lost almost all ability to customize, repair, or even understand by way of disassembly. Every “advancement” makes it easier for companies to enact planned obsolescence, and we tend not to mind because everything gets more convenient for the average user. I know how to disassemble and fix the lock on my front door, but I am almost certain that I would not be able to do the same if that lock was an IoT device. Not even because I wouldn’t be able to understand the new lock, but because the company producing electronic locks would likely make it nearly impossible to fix without calling them so that they can charge you for the fix.

A broader question derived from your blog would be whether the trend of IoT reducing jobs instead of creating them. As we discussed a lot in our previous class, I feel the IoT technology poses further threat compared to the development of automation. Not only some unskilled or low-skilled works will be replaced, but also plenty of service jobs will be affected or destroyed. Of course, someone still wants human interactions but doesn’t it sound fascinating that you have an intellectual servant who knows your habits, understands your hobbies, and provides what fits you best which you even don’t realize? The same one will never judge, discriminate, or misbehave while offering the high-quality service as long as we “program” it to act in the most decent way. Apparently, there are still technological challenges to satisfy these standards, but I think it is a foreseeable future of having such services. 

The internet can undermine or strengthen the authority of a regime in a multidimensional fashion, however it is often viewed as a subversive force. As The Global War for Internet Governance highlighted, systems of technological control such as the internet are layered, which means there exists many different focal points of power through which market and governmental entities can exert influence. One key component of internet regulation and governance is access. Access can include the ability to possess a laptop with an internet connection, being able to afford the per-minute fee at an internet cafe, or belonging to a municipal broadband network. With increased access to the internet, citizens are endowed with the ability to develop a new realm, a new modality of participation in civil society. Participation in online civil society can take place in a chatroom/web forum, or working as a journalist for a web-based news organization, such as Wikileaks.

Governments, viewing the implementation of new internet communication technology as inevitable, have implemented mechanisms limiting the internet’s capacity to influence the political ideology of its citizens. In a piece from the Carnegie Endowment for International Peace titled “The Internet and State Control in Authoritarian Regimes: China, Cuba, and the Counterrevolution,” authors Shanthi Kalathil and Taylor C. Boas assert states can respond to this potentially harmful problem reactively or proactively, and they often use internet technology to do so.

Reactive measures to control the internet include:

limiting the diffusion of internet technology,

censorship,

mass surveillance of internet activity,

the complete proscription of the internet.

On the other side of control, proactive actions can incorporate:

the dissemination of propaganda globally,

the creation of a national internet that is separate from the worldwide web,

the formation of state-sponsored internet services that positively influence the populace’s opinion of the government,

or even engage with other countries internationally through cyber warfare.

These proactive strategies reveal a pattern: states that have particularly strong involvement in the development of their internet often have the greatest degree of stability. Our book this week was published in 2014, but in 2001 Kalathil understood how technology impacts society, with or without state control. The author’s conclusions regarding her research reveal a shrewd foresight into the potentialities of the internet, saying “As access to the Internet increases or other intervening variables evolve over time, Internet use may indeed play a greater role in challenging authoritarian regimes - perhaps even contributing to their eventual demise.” If only she could have known about the Arab Spring, the political revolution largely known for the apparent use of social media services like facebook and Twitter to organize protests and assemblies, particularly in Egypt and Tunisia.

To hear more about how the diffusion of internet technology influences the arena of international relations, watch this TED Talk by David Rothkopf, CEO and editor of Foreign Policy Magazine and foreignpolicy.com.

https://www.youtube.com/watch?v=NA7krbsdXFA

I’ve summarized his potential causes for concern he details in the above video. I’d love to hear what you guys think about these possibilities.

When 80% of the world’s population has a smartphone, as is predicted to happen by 2020, nearly every human being will be a part of a man-made system for the first time in history. The implications of this has yet to be realized, and governments are largely ignoring what may come.

The low economic cost associated with cyber warfare may lead us into a period Rothkopf calls a "Cool War,” in which no doctrine exists shaping how decisions and responses should be made, and digital conflict wages unceasingly.

Cyber-nationalism vs. cyber-internationalism - evinced in Trans-Pacific Partnership negotiations regarding global internet regulation, states are weary about NSA surveillance programs and want to protect the privacy of their citizens. As a result, internet connectivity across countries can be limited, as nationalized intranets or large firewalls are preferred to global internet access.

The United States no longer appreciates or encourages technological development, especially with the dissolution of the Office of Technological Assessment. The September 11th terrorist attacks engendered a paranoid myopia in the United States government, and the idea of “national security” became a top priority.

The phrase Internet governance is a bit of a misnomer in that several parties, private, public, and otherwise, have control over various aspects of how the Internet is run, as opposed to a single or collective governmental body that directs how it operates. It follows that Internet governance is related to the concept of ‘multistakeholderism’, which Laura DeNardis explores in her book The Global War for Internet Governance. While public policy discussions often center on online content and usage, DeNardis asserts that more attention ought to be directed at the virtual architecture of the web and the players that comprise it (including private information intermediaries such as network operators, exchange points, search engines, hosting services, e-commerce platforms, and social media providers) because they govern of how individuals experience the Internet.  

The administration of the Internet (such as The Internet Corporation for Assigned Names and Numbers’s (ICANN) supervision of domain names) may appear neutral, but DeNardis argues that it is in fact political in its design and effect. Much of the conflict comes down to how much power a particular player ought to be able to exert. Take Apple’s recent stand against the government for example: As a major private information intermediary, Apple was ordered by the Federal Bureau of Investigation to create new software that would break the iPhone encryption of one of the San Bernardino shooters. It resisted the order, as it believed acquiescing would create a precedent whereby the government could force companies to take proactive steps – creating new software – in order to violate the privacy of their customers, now and later. This conflict points to how major Internet stakeholders are often at odds, and how private companies actually have a great deal of leverage, as they’re key to maintaining the functionality of the net.

Fighting a battle, you are not actively aware of, is challenging and hence the need to be on the offense. Cyber War by Richard Clark and Robert Knake explores cybersecurity, the government and private sector roles and the ongoing international cyberwar just within our connection space.  Clark expounds on the history and evolution of cyber activities and damaging consequences from the initial information war to the present.  This is a keen view point coming from a former Special Advisor with intimate knowledge of the government’s attitude and directives to cyber activities.

The book brings forth the urgency and essential need for guidelines to handle cyber security. Though the exact responsible for safe guarding is still in contention, both public and private efforts are required. While the government might view regulation in the private sector as constricting, however, as demonstrated by the cyberattack on Estonia, the collapse of major sectors nationwide is the collapse of the government. It is quite frightening to know that life as we now enjoy can be destroyed simply by multiple attack on major societal infrastructure which are mostly digital.

The authors propose methods to address cyberwar. Their idea moves away from singularity of the government or private players to methods utilizing advantages from both ends. I agree with the need for regulation that defines a common goal and general framework for defense in the cyber war. Though the ingenuity and creativity of the private sector gear towards improved security solutions, a general framework or regulatory idea further drives a unified a force against intrusion in cyber warfare.

Another component of the agenda proposed in the book is a Cyber War Limitation Treaty, CWLT. On paper, this seems as an actionable plan to guide and reduce the damaging effects of a cyber war. However, in my very limited knowledge, I do not think it would be agreed upon until a major technology nation is faced with utterly damaging effects of cyber war and seeks to retaliate at the opposing party. Presently, everyone is trying to play their best defense and offense game, and there is little lasting crippling international effect yet seen. Hence, a treaty might not hold as much importance to all parties. Also, the idea of national cyber accountability for each nation state would really help with independent cybercrime actors, thereby, every cyber activity is justifiable to the state.

One reason, as you mentioned in your blog is that the nations around the world are still in the phase of preparation for the coming cyber war if there is going to be such a war in the near future. During this phase, most players that are technologically advanced will just be furthering their software and devices, testing the power of their products secretly, and infiltrating into others’ network for disturbances. I'm pretty sure until now no country has the ability to destroy its counterpart and nor does it has the knowledge of what damaging effects a sole attack could cause. In the light of unpredictable consequences, games probably just refine their initial setups, exchange the position of different pawns and avoid triggering the first move recklessly.

Clarke’s Cyberwar was all at once disturbing, unnerving, and a little desensitized. Unfortunately, in 2016, the constant “this county hacked this”, “this company was hacked”, “you’re going to need reset your password”, has me feeling a little aloof when I hear these reports on the news. After reading Clarke’s description of the potential massive cyber attack on our infrastructure, I can totally believe it. Even though our Department of Defense and our elite university scholars created the Internet, the ability to maintain the upkeep has been laughable. Our infrastructure is dismal compared to other countries and protecting our systems should be a higher concern. His outline of the overreliance on Microsoft products/software accurately describes our federal infrastructure. The IRS, voter information, and even Target have not placed cyber security higher on the list of priorities. Our infrastructure is in desperate need of upgrades. Our overreliance on existing phone structure is our biggest downfall. With so much invested in telecommunication companies and their infrastructure, it’s definitely restricting advancement and innovation. Other countries are light-years ahead of our structure, which leaves us vulnerable.

One of his concepts was a notion of a “nation state penetrating another nation state’s systems”. But what we tend to hear in the news are lone hackers penetrating other government systems. Whether its foreign hackers disrupting the election process or other governments, I think a better term for it would be cyber espionage. We tend to attribute the actions of a few hackers to a whole country, for example, Russia, China, and North Korea. His proposal for a secure, closed network could provide a more secure government network, but what does that mean for my access to some of the government provided services?

I “think” I agree with the proposal for a closed, secure network for government and financial networks. But as much as I want a secure network, I don’t know if I’m willing to give up my computer, online access. Giving up the instant ability to check my purchases, bank account, and my health care, it’s a real catch-22. Either I give up my access to maintain security or I continue my 24/7 access my personal information using an outdated and unsecured network.

The way in which Clarke gauged the overall cyber war strength makes sense to me. But I don’t agree that the offense power, the defensive capability, and the extent to which they are dependent on the cyber system are equally important in terms of measuring cyber war ability. As a Special Advisor to President on cybersecurity, Clarke is likely to give the most accurate score for each nation based on his experience and assessment. I found different results, though. As shown in the figure below, North Korea (Democratic People’s Republic of Korea) who ranked first in Clarke’s book, was not even on the list. Although it is arguable which methodology is better, I don’t believe that having a dependent network only increases one’s risks of being attacked. I think that’s where something called cyber ally should come in. For those who have overlaps or similarities in their network-based infrastructure, they can cooperate with their allies and shoulder the responsibilities together. But like any battlefield, each individual has to not only complete their assignment but also recognize who their true friends are in order to fight against enemies side by side.          

Bruce Schneier’s book “Data and Goliath: The Hidden Battles to Collect Your Data and Control Your World" emphasized that today, metadata is collected on us from the devices we use, the sites that we visit, and the applications that we employ. Schneier is very concerned that this data is being used to remove people’s privacy, and while I agree that this is true, I am not entirely convinced that we have that much to fear.

While I know that social media companies store metadata about us and even sell our information to other corporations, I did not realize, like Schneier mentions in the book, that most of us are walking around will a tracker in our pockets everyday: our cell phones. Every time we make a call, GPS data is attached to the call, and it can be used to generally pinpoint where we are. Which leads to one of Schneier biggest insights for me: we will probably continue to be spied on, because most us are unwilling to let go of the massive convenience and usefulness of surveillance devices like our cell phones and laptops. And if you are unwilling to chuck your cell phone and laptop, there really are that many practical things you can do to protect yourself.  It doesn’t even matter if  you only put your data out on the internet just once, for a short amount of time, and then took down. Computers have the computational power and memory to doggedly collect all the information you have put on the internet at some point and persist it. So does this mean we will never get back our privacy? Schneier seems to think that we can only protect our privacy by passing laws that will mandate it. My only concern is that collecting meta-data has clearly become profitable for business and given our government policies can be swayed by lobbyists, I wonder how long it will take for internet privacy laws to be enacted.

But unlike Schneier, I’m not as alarmed. True, the government can usually get our metadata from corporations, or simply collect it itself. But I don’t think our government or these corporations have malicious intent. The former wants to uphold national security and the latter really just wants to increase its profits by creating advertisements that are tailor their business to us.

For these entities, the government and corporations, to accomplish their goals, most of the time they look for specific patterns related to groups, not individuals. Why? Because its infeasible to look at each person separately and do an in-depth analysis. They simply do not have the time or budget. Like with any considerable task, an agent has to prioritize, and that means drilling into the individual level as late and as infrequently as possible.

For this week’s Information & Data Security topic I read Data and Goliath: The Hidden Battles to Collect Your Data and Control Your World by Bruce Schneier. Most topics we’ve covered, like complex adaptive systems, the information economy, interop, and big data have major privacy implications. All books we’ve read so far asserted the importance of privacy and the need to protect privacy.  However, I think Data and Goliath made the best argument I’ve read about why privacy is so important.

I’ve always been skeptical of the argument “if you aren’t doing anything wrong, then you have nothing to hide.” But at the same time, I’ve argued, even last week, that personalized advertisements are not an invasion of privacy. In Data and Goliath Schneier convinced me that both of these are bad arguments. Schneier devoted a whole chapter to explain the importance of privacy and why it’s a fundamental human right. I will not repeat all the convincing arguments he made, but one point stood out for me: There’s a strong physiological basis for privacy. Biologist Peter Watts makes the point that a desire for privacy is innate: mammals in particular don’t respond well to surveillance. We consider it a physical threat, because animals in the natural world are surveilled by predators. Surveillance makes us feel like prey, just as it makes the surveillors act like predators. There are facts about our lives that we choose not to share, not because we’re doing something wrong, but because someone else knowing them makes us feel like prey.

The reason I’ve concluded that personal advertisements are an invasion of privacy is because as Schneier explained “data we’re willing to share can imply conclusions that we don’t want to share.” Further, as he argued, even if it’s just an algorithm that’s doing the conclusion, the fact that a person may become aware of this conclusion is enough to feel like an invasion of privacy.

As a side note, I’d like to point out an irony in regards to privacy. As Schneier demonstrated in many examples, governments shroud their surveillance activities in secrecy. Governments have it backwards: they insist on secrecy (privacy) because they are doing something wrong. People have a fundamental right to privacy, because they are human, but governments don’t. There are probably limited reasons as to why government is entitled to secrecy, and we need policy to delineate these limits and ensure that we don’t suffer from “secrecy creep”.

So, privacy is fundamental right. How do we go about preserving that right? Like Schneier proposed, there are principles we all probably agree to. However, in practice different people’s understanding of these principles and the tradeoffs they are willing to make regarding their privacy are so different that coming up with policy is an almost impossible task.

However, one policy that I think is relatively easy to institute is protections for whistleblowers. In the end, humans are the best judge of when an invasion of privacy occurs. Whether in private or public settings, we need to empower the people are willing to point out these invasions, rather than discourage them.

Also, I would argue Schneier may take advantage of the word surveillance to make his point. By definition, surveillance means “the act of carefully watching someone or something especially in order to prevent or detect a crime,” (Merriam-Webster's) which is inherently very negative. My interpretation of government’s behaviors is more similar to supervision or oversight instead of surveillance with an intention to maintain its proper function. However, due to the abuse of data gathering and analyzing activities, especially when it is always not aboveboard, we have the reasons to become uncomfortable, thus have a strong need to defend our privacy. 

Big data has really revolutionized how approach to a lot of things these days. A total shift from sampling in a close system to analyzing the whole information available has changed our perception about data and this is the basis of the Big Data movement. Viktor Mayer-Schonberger and Kenneth Cukier, walk us through understanding the concept and how it affects our lives, how we work and think in this present day and years to come.

They describe it as a movement from basic traditional thinking of causality to correlation between events. This shifts away from precision and exactness towards generalization and emerging patterns in the data. With this emergence, we move towards probabilities and likelihoods. This is quite beneficial analyzing and predicting. Forgoing exactness for generalization might look like subscribing to an old wives’ tale or mere tradition, however, the probabilistic models and computation behind Big Data analyses, makes it entirely different. Big Data focuses on the “what” based on past evidences. Hence correlation isn’t random or a fad.

Although there are awesome benefits we derive, there are some draw backs form the Big Data revolution. A major one is privacy. Arguably, this generation isn’t too concerned about the availability of personal information online. Just looking at the data from social media, we are accessible digitally and globally. We freely give information out by sharing, updating, tweeting and many more. As long as there is no unfairness or explicit detriment, people seem not to overtly care. It seems our minds are programmed to the short term implication of this accessibility. We do not want to necessarily consider the effect of this openness over time. But with the lack of privacy in the Big Data world, there is the limiting factor of retraction. We don’t have the recourse of taking back our decisions and sentiments, pulling them away from our past dossier available. Once it is out there, it all adds up to the digital profile amassed. Hence, every future prediction would in some way attribute those past decisions even if they aren’t explicitly relevant or are something we do not want anyone to particularly remember. So are there second chances with Big Data or are we pretty much figured out without no form of recourse?

Taking the justice system as an example, sentencing is for both punishment and rehabilitation. However, by analysis, the probability of an ex-convict committing another crime is high. Thus, is rehabilitation a waste if they will just commit another crime by the analysis of Big Data? is there any choice in the matter? This contradicts our ability to choose. Probabilities can be limiting, ability to choose and be held accountable for our choices thereby gets diminished.

I  enjoyed Mayer-Schonenberger work commenting on the phenomenon of big data, particularly their exposition on the value of big data.  As someone who studies computer science, machine learning methods tailored to learn from data have grown extremely robust due to the onset of the era of big data (and the arrival of the appropriate storage and curation technologies) has allowed researchers (and companies) train more robust machine learning algorithms (e.g., neural networks) to do interesting tasks such as facial recognition, multi-object identification in images, and automatic speech recognition.  Machine learning algorithms, in general, have increased in value due to the availability of large amounts of data to train them more robustly to do such interesting tasks.  The characterization of data having an “option value” in Mayer-schonenberger’s work is particularly fitting, given that the volume, velocity, and variety are much larger than the ability of any one given party, individual, or organization to interpret such data—and the value lies in the ability of knowledgeable experts to separate the signals from the noise and do so in an efficient, scalable fashion, suitable to big data.  What comes to mind from the authors’ further remarks on the depreciating value of data are the implications for the business world –particularly, this begs the question, of how to assign a dollar/currency valuation to data that may only be useful in the future.  The authors in fact bring up this point, but this further begs the question as to what accounting metrics can be used to value data whose future value is uncertain.  

When I began reading Interop by Palfrey and Gasser, I had a more technical definition of interoperability in my head. To me, interoperability meant the ability for two or more systems to able to communicate with each other via the use of a standard.  For example, web applications exchange data with each other using the JSON standard. JSON specifies the format in which to write a web resource for the server and also how to unpack the resource for the client.

However, Palfrey and Gasser had a broader definition of interoperability that extended to the organization and institution levels. They gave some examples to illustrate their new definition. For instance, fire fighters and policemen need to be interoperable in order to provide effective aid in case of emergencies.  Another example was the case of currency, in which different national currencies are interoperable through conversion rates.

Even with these examples, I had a hard time wrapping my head around interoperability. So I thought of making my own metaphor. Many countries have their own language, but in order to do trade with each other they had to solve the interoperability problem of language barriers. Was the interoperability solution, then having people who new multiple languages that would act as translators? I would argue no, that’s not the interoperability solution. In fact I think it is the opposite. Interoperability, according to Palfrey and Gasser, seems not to be a solution (please correct me if this seems off) with a central authority that caters to the disparate units. Instead, it is usually a feature that the disparate units need to tack on, in order communicate with each other. I think, returning to our metaphor the interoperability solution would be the disparate units (countries in this case) learning whatever language is the dominate language for business in that area.

Speaking of interoperability, it is not necessarily equivalent to insecurity. Palfrey and Gasser argued, “The fact that a given computer system can interoperate with others does not mean that more people have access to underlying data in the system... Security problems are related not to interoperability itself but, rather, to what interoperability makes possible.” So it’s not interoperability but the implementation of interoperability that increase systematic vulnerability. The authors yet do not devise a clear overarching plan and claim it varies by circumstances.