Inormation Policy

I tend to be a voice of “now hold up now y’all” with most of our topics, so I am going to stick with that theme for the last week.  Before saying anything else, though, I think it is important to stop conflating IoT or smart devices with digital versions of analog appliances. Smart devices are normally what people think of when they are discussing the IoT, and it implies a connectedness or the potential to communicate with other devices. So, a nest that communicates with your cellphone, or a wearable that connects to your smart coffee maker when you’re starting to get sleepy, or any other connected device, those are smart devices and should be considered in the IoT. A pacemaker that measures your heart rate and blood pressure and helps regulate health, however, if not connected to other devices, is not the same thing. If I have a wearable device that measures the atmosphere around me for toxins or checks health markers, but it is not connected, then it is not the same thing. Ubiquitous computing, maybe. IoT, not necessarily. I think this is important to note, because there are some real concerns with IoT that are different than the trend towards ubiquitous computing that we are also witnessing. One of the things that our readings mentioned was the decrease in possible physical crimes such as theft that would occur with the IoT. I found this an interesting point because I had been musing about the disintegration of user ownership as he was talking about this. Let me explain what I mean.

As of now, for the most part, once I buy a product, it is mine to use as I wish. The manufacturer and industry can suggest usage, but I can choose to go against that if I wish. Furthermore, I could (again, for the most part) disassemble that product, tinker with it to enhance it, resell it, give it to someone else as a gift, or use it in an innovative way that the manufacturers might not have considered. With the IoT, however, users seem to lose that control. 

While IOT is a really interesting issue, I feel like this is a good space to write about the concepts we’ve learned about in class and applying them to the recent election. I believe there are a lot of technology issues that will be important to the debate going forward, especially in understanding how this happened. 

The first is, did the data lie? So much of what we have discussed revolves around the use of big data and its ability to predict useful outcomes. The number of polls, models, and statistical jargon used this election was overwhelming. I remember reading for an hour on Tuesday the explanation of the Princeton statistical model that had a 99% prediction for Hillary Clinton. A 99%! And it was completely wrong. Is this a sign that we trust data too much or that was this a case of trusting bad data. When you really boil it down, polling relies on a person picking up the phone and telling a stranger who they are going to vote for. That seems like pretty weak data to make such strong predictions based on.  Where the polls reaching the wrong people or were the people not telling the truth? Not sure how we are ever going to figure that out, but I for one am not going to believe the polls again for a very long time.  Think about how much we rely on polling data. In order for a third candidate party to make it into a debate, they need about 15% support in the polls. Now that we have seen the polls miss be huge margins, do we re-think when we allow third parties into the debates?

The internet of things has come up in conversations in class all semester, so covering the topic in a comprehensive manner is long overdue. There are so many things to consider with IoT policy: security, privacy, interoperability, governance,  infrastructure, and the list goes on. I think part of the reason that IoT is so far reaching when it comes to relevant topics is that it is a fairly broad term. Anything that connects to the internet could be considered an IoT device, which means that with enough imagination, anything could introduce new concerns for all of these topics.

I first learned of IoT maybe a year an a half ago. I mean, the idea of a fridge that connects to the internet wasn’t by any means unheard of to me at that point, but that never had a word for me until I learned of IoT in a formal sense. Since learning of it, school has been the only place that I encountered IoT conversations, at least until recently. In the last 3 or so months, I have noticed talk of IoT seeping into public discussion in places like Reddit and Facebook. I found it shocking however, how the conversations I was seeing online were so contrast to the conversations I was having at school.

In my experience, IoT is really only talked about in a negative light at school. It is talked about as a breed of technology that presents far more chance for harm than for good. It is talked about as a hassle to regulate and to insure. “The ability to start a coffee maker from across town does not really justify the additional potential point of failure for our private data,” is the general tone of the conversations. But online, everyone seems to be really excited about the possibilities. I’ve seen advertisements for companies hyping up IoT devices, which is a little jarring for me because given my experience, I would have assumed companies would want to avoid the IoT label. The embracing of IoT is interesting from an academic standpoint, and mildly terrifying from my own personal viewpoint.

The trend of adding new technology to old technology is not new by any means. Look at cars for instance: it is really hard to find cars with manual transmission today. Automating transmission made driving a far easier skill to learn, but it also made maintenance a fair bit more complicated. We traded usability for the fact that we pretty much have to go to a mechanic to get any aspect of a transmission looked at. That tradeoff was only really noticed my the mechanically inclined. And that trend has gotten far worse with cars. Now, nearly every aspect of a cars operation is linked to an onboard computer, and the only people with access to that computer are dealers. Fixing your own car is almost impossible today compared to fixing your own car 30 years ago. The same trend can be seen in computers. They started as a tinkerer’s dreamland, but through proprietary hardware, increased connectivity and questionable business practices, they have become accessible to everybody, but have lost almost all ability to customize, repair, or even understand by way of disassembly. Every “advancement” makes it easier for companies to enact planned obsolescence, and we tend not to mind because everything gets more convenient for the average user. I know how to disassemble and fix the lock on my front door, but I am almost certain that I would not be able to do the same if that lock was an IoT device. Not even because I wouldn’t be able to understand the new lock, but because the company producing electronic locks would likely make it nearly impossible to fix without calling them so that they can charge you for the fix.

Goodman’s book honestly left me feeling kinda depressed and completely hopeless, how am I suppose to protect myself and my data in this world? I read about 200 pages of just chapter after chapter about how we have no chance of every regaining control over anything connected to the Internet. I now know my phone is window into a criminal enterprise, Google thinks it owns anything I create or save in Google drive through their “what feels like criminal” terms of service, and NSA is capable of creating fake pages to gather more of my data. This book has just made me more fearful of typing this post on my iPad through Word’s app. I bet the NSA is reading this as I type. Rude. But my biggest complaint was, once reading the first part of the book, I felt like I was completely defenseless against these attacks against my devices and data. When giant companies like Experian, Microsoft, and MacAfee cannot protect themselves, how am I, someone who can’t even remember to charge my devices, protect myself against cyber criminals and cyber governments?

As I was reading this book, I was thinking, maybe I’ll just stop using Google products, or maybe I can limit my phone usage? But when the university actually FORCES us to use Google gmail, how am I suppose to work around that? The university maintains I need to have access to this email. I was shocked to learn that Google’s ToS actually says that if you receive a gmail message, Google automatically gains access to your information, even if you don’t have a gmail. WHY ARE MORE PEOPLE NOT UPSET BY THIS? MORE PEOPLE NEED TO KNOW! Google’s “Do no evil”…yea, sure Google. I understand this suppose to be my half of the bargain for these “free” services, but honestly, I would prefer to just figure out how to have my own cloud server. When I read that Google thinks they can own the things I put on its Drive, I almost moved everything from my drive account out of it. Luckily, I don’t save my graphics I create for commission, but what if Google tried to assert they owned these and I couldn’t sell them? I would be out of a side business.  I can’t stand that these data MONGERING companies are able to amass it and sell it to the highest bidder. But how can I limit their access without keeping me from doing my day-to-day activities, especially when its for grad school?

What’s the point/if being hacked is inevitable, why bother? There is one thing that needs to be pointed out about the vast majority of hackers. They are lazy. They the kind of people that are lazy enough to spend hours writing a program that will automate a 5 minute process. Unless you have given hackers a reason to single you out from a crowd, you are simply not worth the effort. The only thing you really need to worry about/can take steps to prevent,  is being caught in some hacker dragnet: the hacks that catch low hanging fruit. If someone tries to access your account and realizes that you have a complicated password, then they are going to move on to easier targets. To survive a bear attack, you don’t need to be able to outrun the bear, you just need to make sure that you can run faster than the slowest person in your immediate vicinity.

Should I stop using products A,B and C altogether? Yes and no. Don’t delete your facebook account, because that leaves you open to the possibility that someone can steal your identity by creating a fake account and passing themselves off as you. Having that been said, you can have a facebook account and be conscious of the information that you publish. With companies like google, I personally avoid any of their products whenever possible. You can use DuckDuckGo for your primary search engine, you can use a browser other than crome, you can change your primary canvas/university account to send all notifications to a non-gmail account. For most google products there are alternatives, but you should accept to one degree or another that you will have to give up some privacy. Being aware of that puts you ahead of many people with regard to privacy.

Marc Goodman’s Future Crimes is another piece that is made to frighten us about the future of technology. And this reading could not have come at a better time as we recently saw the cyberattack on DYN that utilized our love of the internet of things. It is a scary thought that our personal device, bluetooth speaker system, car, or even our washing machine could be used in future crimes against us.

The big critiques I’ve read about Future Crime is that there is far more fear mongering than actual solutions. Sort of the same critic as Clark’s CyberWar. It lays out all the potential catastrophes that may happen in the near future. It is scary stuff. But how afraid should we be? And what can we do about it? Our discussion of cyberwar has largely focused on the global level. How is the United States protecting the country from attack from hackers? But Future Crimes brings the individual into the equation, as the devices we have, can now become weapons. We discussed the issue with Dr. Martinez early this week and wondered if companies should require stronger passwords. One of the easiest ways to enter into a system is through the weak passwords that come as default for so many devices. What if the government required a certain level of encryption for basic passwords. Similar to how we require seatbelts. We’ve clearly discovered that people are not going to take the initiative to protect themselves by making more challenging passwords. But we need to create a herd mentality around cybersecurity, just as we approach the spread of disease. The more connected we all become, the more important it is that we are take the necessary precautions. We (sort of) require vaccines, maybe we should require stronger passwords.

Beyond just our own devices being used against us, there is the larger threat of terrorists having easier access to new tools to cause destruction. Consider the 3-D printer and its ability to manufacture weapons with the press of a button.  And while I think we should be very aware of the dangers that lie ahead, we should not panic. Just like every other advancement in technology, it has been used to destruction as well as creation. We have adapted to times, just as we will find ways to protect ourselves from new threats. Dr. Martinez made the point that while it is important to be prepared and to protect ourselves from cyberwar, it is essential that we build resilience as a nation. We have to be prepared that not every attack will be thwarted and that we will be able to rebound, just like we have been able to recover before.

Another problem that would arise is the fact that there is a plethora of material out there that describe how to build sophisticated 3d printers from simple electronic parts. All of those electronic parts are generic enough that they couldn’t realistically be limited. So a license system would not likely stop anybody from building 3d printers, and passing such a regulation might actually have an affect opposite of its intention (by way of drumming up interest via the Streisand effect). Not to mention there would undoubtedly be a black market with 3d printers just as there is with guns. The technology has just become too ubiquitous to effectively reduce the number of people that have access to them.

Internet jurisdiction is one of those sticky concepts, governments want to impose their boundaries, like in the physical world, but it just creates more questions and issues. The Global War for Internet Governance, attempts to define this concept. Rachelle’s post talking about ICAAN reminded me of the little understanding of how the Internet actually works. I remember reading an article in the Austin Statesman about Ted Cruz’s erroneous fear-mongering about the U.S. giving up ICAAN governance. How can we start to develop talks about Internet governance with legislators without an understanding of how the Internet actually works. If we’re debating about the merits, how will, less enlightened, politicians make informed, well-balanced decisions? Also, domain names don’t even hold much weight, even though politicians like to think so. Countries like Tuvalu, whose domain name ends as .tv, actually sell their domain extension to television providers and shows. Its intended for Tuvalu entities, but its quite lucrative for Tuvalu to sell the extension for television shows. Another supportive read to Global War is Erica Wass’s Addressing the World: National Identity and Internet Country Code Domains. Her books delves into how countries either identity for use their domain codes more lucratively. It’s just a naming convention, and however a country uses it should make no nevermind to the US.

When thinking about copyright in an Internet governance sense, it become more convoluted than I thought. I have a fairly strong grasp of how US copyright works, but when you think about those being held to US copyright law, without being or ever setting foot in the US, it throws a kink in things. US copyright is enforceable if the copyrighted-object is registered with the US copyright office, the copyright holder (not necessarily the author) has the ability to enforce damages. If the copyright-holder’s work is registered with the copyright office, it depends on if the holder wants to proceed with a lawsuit, regardless of the offender’s nationality. Copyright holder may not want to pay for an international intellectual property lawyer, but that’s neither here nor there. The Internet has pushed copyright and intellectual property into the global arena. Before it was photos, ads, and written works on a local scale, now it’s international. With countries trying to impose their boundaries on the Internet, it’s going to pull new laws into the playing field.

That raises the tremendously fascinating question of what happens if the laws of a country change to facilitate online copyright infringement safe havens? Iceland has been in the news recently because their Pirate Party has been polling extremely well, and actually just became the 3rd largest party in Iceland with about 15% of the total vote. Hypothetically, let’s assume that this allows them to reform copyright in Iceland to allow for sites like piratebay and sci-hub. Does that mean these sites could exist in Iceland with impunity? Or would there be too much pressure from the US for Iceland to shut them down and turn over the guilty parties?

Internet jurisdiction is one of those sticky concepts, governments want to impose their boundaries, like in the physical world, but it just creates more questions and issues. The Global War for Internet Governance, attempts to define this concept. Rachelle’s post talking about ICAAN reminded me of the little understanding of how the Internet actually works. I remember reading an article in the Austin Statesman about Ted Cruz’s erroneous fear-mongering about the U.S. giving up ICAAN governance. How can we start to develop talks about Internet governance with legislators without an understanding of how the Internet actually works. If we’re debating about the merits, how will, less enlightened, politicians make informed, well-balanced decisions? Also, domain names don’t even hold much weight, even though politicians like to think so. Countries like Tuvalu, whose domain name ends as .tv, actually sell their domain extension to television providers and shows. Its intended for Tuvalu entities, but its quite lucrative for Tuvalu to sell the extension for television shows. Another supportive read to Global War is Erica Wass’s Addressing the World: National Identity and Internet Country Code Domains. Her books delves into how countries either identity for use their domain codes more lucratively. It’s just a naming convention, and however a country uses it should make no nevermind to the US.

When thinking about copyright in an Internet governance sense, it become more convoluted than I thought. I have a fairly strong grasp of how US copyright works, but when you think about those being held to US copyright law, without being or ever setting foot in the US, it throws a kink in things. US copyright is enforceable if the copyrighted-object is registered with the US copyright office, the copyright holder (not necessarily the author) has the ability to enforce damages. If the copyright-holder’s work is registered with the copyright office, it depends on if the holder wants to proceed with a lawsuit, regardless of the offender’s nationality. Copyright holder may not want to pay for an international intellectual property lawyer, but that’s neither here nor there. The Internet has pushed copyright and intellectual property into the global arena. Before it was photos, ads, and written works on a local scale, now it’s international. With countries trying to impose their boundaries on the Internet, it’s going to pull new laws into the playing field.

“Space: the final frontier. These are the voyages of the starship Enterprise. Its five-year mission: to explore strange new worlds, to seek out new life and new civilizations, to boldly go where no man has gone before.”

Jamie Bartlett’s book The Dark Net: Inside the Digital Underworld explores the “hidden” parts of the internet or to put it in Captain Kirk’s words “the final frontier.” Bartlett paints the picture of “strange new worlds” which most people have never gone to before. Strange worlds full of drug dealers, activists, pedophiles and bullies. Through the use of the “The Onion Router” (TOR) browser, people all around the world have the possibility to use the internet anonymously (although it should be noted that the security of TOR has been questioned) in order to freely trade illegal goods, evade the surveillance of their governments, transfer stolen information, blow the whistle or indulge in dark and illegal fantasies. Bartlett also explores the hidden sides of services we all use such as troll groups on Facebook. Overall, he paints a picture of a world where innovation is created in order to survive. He makes the argument that for all its faults, the “hidden” web is also a great source of hope and progress.

I believe that, like any technology, the internet can be used for good or for bad. The internet is an unimaginably great source of information, a platform for freedom of speech and an escape route for oppressed people. On the other hand, the internet’s semi-anonymity allows individuals to act in contradiction of all social norms and in violation of many laws. Certainly, we can all agree that the use of the dark net to exchange child pornography is an abomination. But when it comes to a marketplace for drugs, should we see it as a horrible phenomenon or a way for the natural demand for drugs to be channeled towards a market where users are not at risk from violent dealers and where user reviews ensure that drug quality is higher than on the street.

Another question we must pose, is whether online activity can be excused by offline personality. Bartlett interviews an English man who is part of the racist English Defense League and spends countless hours abusing people online and spewing racist hatred. In real life, however, the man in question appears to be a nice and shy man more interested in football than anything else. The veil of anonymity on the internet may explain this behavior. As the creator of the “Assassination Market” posits, we would all order assassinations if we could never be caught. The argument can be made that the way society regulates itself is because anonymity does not exist so much in everyday life: a person committing acts that violate social norms (e.g. parking over two parking spots) is easily shamed to stop that activity. On the internet, this social control is much harder to achieve.

I really like this part of your post because I think it gets at the core of the book The Dark Net (at least one of the cores anyway). Not that I think the book was defending the criminals and bullies. I think that  humanity, by nature, is flawed, and those flaws have driven so much of innovation throughout time. Greed drives capitalism, war pushed us to develop both nuclear weapons and space travel, and porn played a massively influential role in the development of both modern cameras and the internet itself. What people do with innovation may be deplorable, but this book explores how those people innovate to remain anonymous, and I think that is something that some people miss in the midst of all of the fear and crime.

The dark net as an idea does not exhibit new behavioral phenomena; as Jamie Bartlett explains, we have always created our own realities but the web makes it easier to become trapped in ‘echo chambers of our own making’. Surrounding ourselves with people and information that matches our believes and engaging in confirmation bias is a human cognitive reality but the web further allows our world views to radicalize while hiding behind a screen. 

The web allows us to reshape our social interactions building even closer relations and embedding ourselves in peer groups that according Alex Peatland in Social Physics: How Good Ideas Spread can dramatically influence individual behavior. The web has the potential to foster creativity and productivity but also hate and isolation. If individuals are indeed more group-oriented than self-directed then the velocity of interactions enabled by the web has the potential to get us faster to the extremes of either virtuousness or invidiousness. 

As a mirror of society, the internet supports multiple words –from hit lists in the dark net to successful social movements through social media. It seems that, being such an unregulated space, it is governed by a delicate equilibrium of multiple opposing forces. Although this equilibrium is continuously disturbed –suicides from cyberbullying, privacy violations of innocent users just for the lulz, the DNC cyber attacks, and today’s (Friday 21) DDoS attack against Dyn that prevented access to Twitter, Spotify, Netflix, Amazon, Tumblr and Reddit, to name a few–, the average user has probably remained unaffected.  

The hack of Sony by the Guardians of Peace (operating on behalf of the North Korean government). The breach of the Office of Personnel Management by [agents of] the Chinese government. The release of DNC emails by WikiLeaks. The hack of the DNC and other campaigns, which the Obama Administration has just accused the Russian government of today. 

These are a just a few examples of some of the high-profile attacks that have occurred over the last several years. The recent attack on the DNC is perhaps the most troubling. I don’t think we’ve seen such clear evidence of a foreign government attempting to influence the result of an election in another country.

In one of our previous classes, someone applied the logic of comparing actions before and after the widespread use of technology and the internet. For example, could we do things, like conducting surveillance on individuals, before technology? Has technology completely changed this, or is it simply a new mechanism to do the same thing? 

Admittedly, technology has completely changed how we conduct espionage and surveillance. We can do many things that we could not previously do. But I would argue that this is a somewhat necessary step. The reality is that we are fighting asymmetrical actors – sometimes acting on behalf of governments and sometimes acting on their own accord. State actors are currently not the biggest threat – although it is very possible that tensions with Russia and China could escalate in the near future. 

America and other countries are facing asymmetrical threats from non-state actors, violent extremist organizations, and lone wolves. And citizens have a certain expectation that their governments will keep them safe. We’re generally ok with surveillance of foreign governments, but not of the domestic population – which Schneier draws a clear distinction between. But the reality is that the biggest threats may be from homegrown terrorists in isolated shootings and attacks. How are law enforcement agencies supposed to prevent such attacks without at least some level of surveillance of its own population?   

We’ve talked in the past about cyberspace being the new Wild Wild West, but Schneier’s characterization of the intelligence world certainly makes it seem like the true Wild Wild West. Governments are spying on each other in a multitude of ways, and they are spying on their own populations. They are spying on their adversaries and their allies. The U.S. intelligence community is composed of 17 different intelligence communities. There are various international partnerships, such as the Five Eyes, Nine Eyes, and (not to be redundant) the Fourteen Eyes.

I wanted to discuss this section of your post because I think that it gets to the heart of what this debate breaks down to. This argument was being thrown around a lot earlier this year during the whole Apple-FBI fiasco, and that is exactly what the FBI wanted, because it helped them politically. This argument is admittedly compelling. After all, knowing that we aren’t liable to die at any moment is one of the big benefits of civilized society. Where I think the argument breaks down though, is in practice. We do not have evidence of a single major terrorist attack being stopped by surveillance. The Paris shootings that took place late last year were absolutely horrible, and they were talked about openly and planned over unencrypted video game channels. They weren’t even hiding their plans, and yet they were still able to carry out their attack. So either far too much information is being collected for any of it to be useful, or these attacks are just not avoidable at any level of surveillance. Either way, we have given up more privacy than we should have.

To quote a review from the Wall Street Journal, Data and Goliath is “unable to make intelligent trade-offs among individual privacy, national security and business efficiency. ” If I didn’t have to write this assignment, I might just leave it right there, but I’ll elaborate. The book’s large scope makes it a good overview of the subject but the author doesn’t dive in deep enough into any one topic to give the reader an understanding of the cost-benefit of losing privacy. This lack of focus makes the book sound kind of like a conspiracy theorist who saves all his emails on his own personal server (which he does) ranting about privacy.

He does talk about the benefits some applications give us in return for relinquishing our privacy. He mentions traffic analysis and benefits to urban planning from GPS location services but never tries to reconcile these benefits with some of the risks. Performing a cost-benefit analysis on privacy would be a difficult task, but it seems like the easy way out to not give a fair description and equal time to both sides of the argument. This inherent bias towards privacy is particularly clear in his short discussion on video surveillance.

The author’s first mention of video surveillance comes when he writes about how annoyed he is that there is public video surveillance. Without a hint of self-reflection, he then talks about how video surveillance enabled the capture of the Boston marathon bombers and London subway bombers. He then fails to seriously reconcile the costs and benefits of between his annoyance and the catching of terrorists .  There have been benefits to mass CCTV systems and Britain has seen a drop in property crime possibly due to their installation. Futuristic blimp technology and license plate tracking with video surveillance are also covered in the book but the author doesn’t give either method enough time to understand the risks and benefits of the technologies. Every technology has different implications and it is unfair to label all technologies that violate any amount of privacy as a part of a slippery slope that should never be touched. 

The cutting edge of camera surveillance has moved much further since the release of this book and complete recreations of movements of people and objects in a city can be now be recorded . This technology was developed in Iraq and was tremendously successful in reducing the number of roadside bomb attacks. The footage taken from a plane allows for analysts to “wind back time” to identify people and cars that were in an area where a bomb exploded and then look to see where they came from, who they were with, and where they live. If first heard about this technology in a Radio Lab podcast that is worth a listen. This surveillance technology did violate people’s privacy but it also saved soldiers lives in Iraq and was implemented in Mexico to take down a major cartel. This technology is spooky for sure, but would you give up a little privacy to save a soldier’s life?