Information Policy

The internet of things (IoT) promises to revolutionize the daily lives with their increased reliance on machine-to-machine (M2M) technology that filters out the bottleneck of human decisions.  The IoT promises real-time capture of information in cities—from traffic patterns and emissions to waste production and energy consumption—and “connected homes”—the fridge that ensures you never run out milk, the climate control system that dynamically adjusts heating/cooling to the presence of humans.  

As a computer scientist, I am excited at the prospect of added conveniences that IoT can provide in making my life easier than it is now.  However, to this end, I believe there should be a certain degree of concern as to the security of these emerging hardware devices posed.  As asserted in the “Silent Intelligence,” there is great diversity in the M2M technological ecosystem, and as such, standards are still emerging.  In the chaos of this diversity, there is great potential for exploitation of such technology by hostile parties, such as foreign bodies, in using the IoT for malicious purposes—the most salient example of such an event would be the recent hack of Dyn using home networks and routers.  Such attacks could grow to be worse in scale and scope with the arrival of unsecured devices in the IoT.  There has been significant growth in the use of IoT in global supply chains presently—think Amazon and its use of warehouse bots to move/organize packages around.  One potential risk that cannot be overlooked is the possibility insecurity of IoT devices and the potential disruption that could be unleashed if robots working in the supply chain were hacked.  Some may claim that regulation on IoT devices could stifle innovation, but in this end, policymakers need to lay some sort of careful groundwork to ensure that IoT devices used on an industrial level and scale have some reasonable degree of security from malicious hijackers.  As factories and distribution warehouses rely more heavily on automation, the potential for disruption from a hijacking grows significantly.  Ensuring some sort of security may prove to be especially troublesome given the growing democratization of hardware production with the advent of 3D-printing which makes the scope of regulation much larger for the government (many parties engaged in creation, including small firms instead of few large players making such devices.)

The internet of things has come up in conversations in class all semester, so covering the topic in a comprehensive manner is long overdue. There are so many things to consider with IoT policy: security, privacy, interoperability, governance,  infrastructure, and the list goes on. I think part of the reason that IoT is so far reaching when it comes to relevant topics is that it is a fairly broad term. Anything that connects to the internet could be considered an IoT device, which means that with enough imagination, anything could introduce new concerns for all of these topics.

I first learned of IoT maybe a year an a half ago. I mean, the idea of a fridge that connects to the internet wasn’t by any means unheard of to me at that point, but that never had a word for me until I learned of IoT in a formal sense. Since learning of it, school has been the only place that I encountered IoT conversations, at least until recently. In the last 3 or so months, I have noticed talk of IoT seeping into public discussion in places like Reddit and Facebook. I found it shocking however, how the conversations I was seeing online were so contrast to the conversations I was having at school.

In my experience, IoT is really only talked about in a negative light at school. It is talked about as a breed of technology that presents far more chance for harm than for good. It is talked about as a hassle to regulate and to insure. “The ability to start a coffee maker from across town does not really justify the additional potential point of failure for our private data,” is the general tone of the conversations. But online, everyone seems to be really excited about the possibilities. I’ve seen advertisements for companies hyping up IoT devices, which is a little jarring for me because given my experience, I would have assumed companies would want to avoid the IoT label. The embracing of IoT is interesting from an academic standpoint, and mildly terrifying from my own personal viewpoint.

The trend of adding new technology to old technology is not new by any means. Look at cars for instance: it is really hard to find cars with manual transmission today. Automating transmission made driving a far easier skill to learn, but it also made maintenance a fair bit more complicated. We traded usability for the fact that we pretty much have to go to a mechanic to get any aspect of a transmission looked at. That tradeoff was only really noticed my the mechanically inclined. And that trend has gotten far worse with cars. Now, nearly every aspect of a cars operation is linked to an onboard computer, and the only people with access to that computer are dealers. Fixing your own car is almost impossible today compared to fixing your own car 30 years ago. The same trend can be seen in computers. They started as a tinkerer’s dreamland, but through proprietary hardware, increased connectivity and questionable business practices, they have become accessible to everybody, but have lost almost all ability to customize, repair, or even understand by way of disassembly. Every “advancement” makes it easier for companies to enact planned obsolescence, and we tend not to mind because everything gets more convenient for the average user. I know how to disassemble and fix the lock on my front door, but I am almost certain that I would not be able to do the same if that lock was an IoT device. Not even because I wouldn’t be able to understand the new lock, but because the company producing electronic locks would likely make it nearly impossible to fix without calling them so that they can charge you for the fix.

Bringing internet to the masses is a valuable endeavor. It’s complicated, involves multiple stakeholders and usually requires payment of some kind (monetary or not). Facebook seems to be trying that with their Internet.org initiative. The internet.org site claims to give people who can’t access it, free internet through satellites, high flying drones, and other technological advances. It’s been criticized for numerous things like restricting the level of information given to users, not providing the local carriers with reimbursements, and falsely portraying itself as a non-profit. All of these criticisms are true, and it’s not good that the Indian government banned Internet.org, but this post will be, as the title indicates, the case FOR Internet.org.

I know some of you are already foaming at the mouth, but hear me out. This is a leading organization in media providing internet to pats of the world that wouldn’t normally have access to it. Single islands in Indonesia, mountain villages in Tibet, and remote parts of the African savannah. Yes, it’s not exactly the “internet” and it usually gets used by people who already have access to regular internet, but it’s safe to say that there’s a small amount of people that utilize Internet.org in its intended form: access to information they would normally never have access to. There’s one example Internet.org gives on their site as a pregnant woman looks up information on her growing baby. This is exactly how this service is supposed to be working. Providing individuals, the tools to communicate with those they would never have had the opportunity with before they received Internet.org. The business model is also viable (yes I did just call it a business) because it’s providing a service in order to get more users to charge more for advertisements. It’s the exact same business model network TV uses. If you have a digital antenna you can get all these shows, news and entertainment for free…as long as you watch our ads too. This same business model can be transposed onto what Internet.org is doing.

This week’s reading was a couple of articles regarding information and communication technologies for the developing world. Though the papers are a bit dated, they capture some of the ongoing challenges with ICT in the developing world. There are many issues such as privacy, big data revolution, information economy and much more. However, the most foundational issue is affordability and access to the internet.

Mobile phones have bridged the large digital divide which exists between the developing and developed worlds. Years ago, there was only a limited access to the global community, rather passive, majorly through news media. It was usually a one-way traffic, the outsiders looking in. However, mobile phones brought in access, communication and active participation. This has revolutionized the community, bringing exposure and fostering innovation. Though access through mobile phones has made connection seemingly easier and quite affordable, corporately, accessibility isn’t much affordable. Compared to services in the US, such as internet connectivity in the home, free WiFi in cafes, widespread connectivity, general connectivity is mainly still limited to mobile phones. Few houses in major cities have a home-based internet service because for the high expense and in other public places, service is majorly by subscription. Even educational institutions are slowly coming into campus-wide connectivity; they mostly just reserve it for administrative purposes and library use. Access is still a challenge because of the limited internet or supporting infrastructure in developing communities. Even if there is an IXP in a country, the country still faces challenges with electric power supply. Though the internet has brought some changes, there is still much more developing communities should do.

I wish I had gotten a little more time with The Global War for Internet Governance, because I was really enjoying it and I wish I didn’t have to do as much skimming as I am having to do. Internet governance seems to come up every week in class in one form or another, so it is nice to finally dive in and thoroughly explore the topic. The internet is borderless by nature, at least in the traditional sense, and the closest thing we have to a universal governing body over the internet is the domain name registry, so it is almost impossible to not talk about who, if anyone, should be in charge and how.

Private organizations and companies obviously have the most direct control over the internet because so much of the web is private and companies control their own websites. However, we have seen many instances recently, especially with Yahoo handing over all of their information to the NSA, that show that the government has the power to control the companies. That raises the question of how much of a distinction is there between private and public internet governance in a society where the public can in many cases control the private.

Websites that exist outside of American borders should at least be free of American government internet governance, but even that has proven to not always be the case. Kickass Torrents was recently shut down, and the owner of the site was arrested for violating American copyright law despite never having set foot on American soil. That definitely paints a picture of a government that has global internet governance to some extent.

Having that been said, Apple’s battle earlier this year with the FBI does show that government control over private companies has its limits. In addition to that, the book talks about the Global Network Initiative, an organization of companies dedicated to protecting the rights of internet users. The GNI is something that I had not heard of before reading this book, despite this being an area that I follow. I was familiar with the EFF though, which is also a big advocate of online privacy and freedom of information. The EFF frequently lends legal aid to people or organizations that butt heads with government surveillance.

For this week’s Information & Data Security topic I read Data and Goliath: The Hidden Battles to Collect Your Data and Control Your World by Bruce Schneier. Most topics we’ve covered, like complex adaptive systems, the information economy, interop, and big data have major privacy implications. All books we’ve read so far asserted the importance of privacy and the need to protect privacy.  However, I think Data and Goliath made the best argument I’ve read about why privacy is so important.

I’ve always been skeptical of the argument “if you aren’t doing anything wrong, then you have nothing to hide.” But at the same time, I’ve argued, even last week, that personalized advertisements are not an invasion of privacy. In Data and Goliath Schneier convinced me that both of these are bad arguments. Schneier devoted a whole chapter to explain the importance of privacy and why it’s a fundamental human right. I will not repeat all the convincing arguments he made, but one point stood out for me: There’s a strong physiological basis for privacy. Biologist Peter Watts makes the point that a desire for privacy is innate: mammals in particular don’t respond well to surveillance. We consider it a physical threat, because animals in the natural world are surveilled by predators. Surveillance makes us feel like prey, just as it makes the surveillors act like predators. There are facts about our lives that we choose not to share, not because we’re doing something wrong, but because someone else knowing them makes us feel like prey.

The reason I’ve concluded that personal advertisements are an invasion of privacy is because as Schneier explained “data we’re willing to share can imply conclusions that we don’t want to share.” Further, as he argued, even if it’s just an algorithm that’s doing the conclusion, the fact that a person may become aware of this conclusion is enough to feel like an invasion of privacy.

As a side note, I’d like to point out an irony in regards to privacy. As Schneier demonstrated in many examples, governments shroud their surveillance activities in secrecy. Governments have it backwards: they insist on secrecy (privacy) because they are doing something wrong. People have a fundamental right to privacy, because they are human, but governments don’t. There are probably limited reasons as to why government is entitled to secrecy, and we need policy to delineate these limits and ensure that we don’t suffer from “secrecy creep”.

So, privacy is fundamental right. How do we go about preserving that right? Like Schneier proposed, there are principles we all probably agree to. However, in practice different people’s understanding of these principles and the tradeoffs they are willing to make regarding their privacy are so different that coming up with policy is an almost impossible task.

However, one policy that I think is relatively easy to institute is protections for whistleblowers. In the end, humans are the best judge of when an invasion of privacy occurs. Whether in private or public settings, we need to empower the people are willing to point out these invasions, rather than discourage them.

The hack of Sony by the Guardians of Peace (operating on behalf of the North Korean government). The breach of the Office of Personnel Management by [agents of] the Chinese government. The release of DNC emails by WikiLeaks. The hack of the DNC and other campaigns, which the Obama Administration has just accused the Russian government of today. 

These are a just a few examples of some of the high-profile attacks that have occurred over the last several years. The recent attack on the DNC is perhaps the most troubling. I don’t think we’ve seen such clear evidence of a foreign government attempting to influence the result of an election in another country.

In one of our previous classes, someone applied the logic of comparing actions before and after the widespread use of technology and the internet. For example, could we do things, like conducting surveillance on individuals, before technology? Has technology completely changed this, or is it simply a new mechanism to do the same thing? 

Admittedly, technology has completely changed how we conduct espionage and surveillance. We can do many things that we could not previously do. But I would argue that this is a somewhat necessary step. The reality is that we are fighting asymmetrical actors – sometimes acting on behalf of governments and sometimes acting on their own accord. State actors are currently not the biggest threat – although it is very possible that tensions with Russia and China could escalate in the near future. 

America and other countries are facing asymmetrical threats from non-state actors, violent extremist organizations, and lone wolves. And citizens have a certain expectation that their governments will keep them safe. We’re generally ok with surveillance of foreign governments, but not of the domestic population – which Schneier draws a clear distinction between. But the reality is that the biggest threats may be from homegrown terrorists in isolated shootings and attacks. How are law enforcement agencies supposed to prevent such attacks without at least some level of surveillance of its own population?   

We’ve talked in the past about cyberspace being the new Wild Wild West, but Schneier’s characterization of the intelligence world certainly makes it seem like the true Wild Wild West. Governments are spying on each other in a multitude of ways, and they are spying on their own populations. They are spying on their adversaries and their allies. The U.S. intelligence community is composed of 17 different intelligence communities. There are various international partnerships, such as the Five Eyes, Nine Eyes, and (not to be redundant) the Fourteen Eyes.

Correlation does not equal causation. Big Data: A Revolution…spends a whole chapter showing how correlations within big data are now the hard and fast rule in retail, health, and government. I feel like this chapter was missing the rule of “correlation doesn’t always equal causation”, often pushed in the sciences. Big data is often pushed as the only way to gather information, and the book even has pushed so far as to say the scientific method and hypotheses are no longer strong forms of research. It bothers me that Mayer-Schonberger is making the case that predictability and probability will replace structured methods such as methodical experiments. Not everything needs to be rushed and “fast thinking.” I can understand Walmart’s use of correlations between hurricanes and selling more Pop-tarts, but once my health insurance starts rising because they think I watch Netflix for hours, then I have something to be worried about.

“Big data is the Enlightenment for the digital age.” So said Viktor Mayer-Schönberger, Professor of Internet Governance and Regulation at Oxford University and co-author, together with The Economist data editor Kenneth Cukier, of the popular 2013 book Big Data: A Revolution That Will Transform How We Live, Work, and Think. Just like the Enlightenment brought us reason and rationality, so will big data represent a paradigm shift that will help us unearth new insights as we gain a new perspective on reality.

But is big data ­- analyzing huge swaths of information to uncover insights and make predictions that were largely impossible in the past – truly poised to transform our lives, our jobs, and our science? In my view, the book is an important contribution to the public discussion on how the phenomenon of big data will shape many aspects of our human existence in the years to come. Yet, at the same time I had a sense that the authors at times succumbed to throwing ‘big data’ around as a vague and hyped-up buzzword and overlooked some important social implications of big data fetishization.

Take Google Flu Trends, for example. The authors tout the success of Google’s algorithms’ predictive power – pure statistical power that did not rely on solid theory – in using a plethora of search terms to predict flu outbreaks. However, only four years later Google Flu Trends failed spectacularly, as the theory-free, data-rich model overstated the figures of flu-like illness by 140 percent (see this WIRED article on the lessons of Google Flu Trends failure).

This story, based on the belief that algorithms coupled with a massive amounts of data points will save the day and ‘revolutionize’ our world, is just one example of what some critics have termed “big data hubris”. This is of course not to say that big data analyses are useless. However, one of the book’s themes, that we ought to dispense with reliance on causation in favor of correlation, carries some problematic implications. The authors write that for many things “knowing what not why is good enough”. This runs the risk of disregarding the reality that data does not, by itself, create meaning. We do.

Let us use the example of language. Google and many other companies have started mining books, magazines, blogs, Twitter, etc. for patterns on how humans use different languages. We can visualize the data using fancy graphs or word clouds, but we have to remember it is humans who create language, and algorithms alone are not sufficient to understand the complexities and nuances of how we choose to use, interpret and translate different languages. Google Translate is leaps better than the early translation software I remember from my childhood, but I agree with those commentators who remain doubtful whether machine translation will ever surpass the very human skills that professional translators offer.

Interop: The Promise and Perils of Highly Interconnected Systems presented some key overarching ideas about interoperability in the tech industry and society as a whole. For example, the authors noted that interoperability exists at four different layers: technology, data, human, and institutional.  Additionally, consumers generally favor interoperability, but interoperability can become harmful if data flows so freely that consumer privacy and security are at stake.  I didn’t find anything in this book particularly revolutionary, but the case studies and break down of the different layers were interesting to consider.

Interoperability is especially important to me because it removes inefficiencies in my day-to-day life. Taking a second to save events sent to my Gmail inbox into my iPhone calendar is far more efficient than carrying a planner around manually adding events to it.  Having the ability to upload documents to Canvas saves times in comparison to having to drive to campus to turn in a homework assignment. One of the most exciting applications of interoperability for improving efficiency is the advent of the Internet of Things.  The authors touch on the applications of this with respect to energy savings.  Other applications could include avoiding homeowner liability issues – like turning off your fireplace or oven when you’ve left the house and have forgotten to do so.  New technologies also bring convenience to a whole new level, like Brita and Amazon’s partnership that provides a Brita filter that automatically orders new filters for itself.  However, the authors note that with this increased interoperability comes a potential loss of privacy: systems should be interoperable, but not to the extent that consumer data is flowing between systems unchecked.  

The issues surrounding Facebook’s privacy rules are particularly interesting to me, especially in respect to its incredibly accurate facial recognition technologies. Imagine if their datasets were publicly available and any security camera or photograph you stepped into could instantly identify you, just as Facebook is able to immediately suggest tags for uploaded photos. Are there any laws preventing Facebook from selling these datasets?  Could governments order Facebook to hand over these algorithms and datasets to help law enforcement efforts? Has this already happened?  This seems like a crucial place for United States government to step in with some regulations on when this data can be transferred.

I think in the case of consumer products, consumer pressure is generally sufficient to incentivize companies to pursue interoperability, and failing that, provide a market for third parties and/or open source technologies to bridge the gap between two non-interoperable pieces of software.  The example in the book about how government intervention caused European companies to use the same charger seemed like an exception and perhaps wasn’t necessary.  Now, consumers now seem more outspoken against companies taking deliberate steps that reduce interoperability.  For example, there was wide public outcry against Apple’s getting rid of its headphone jack in the iPhone 7.

However, as the authors note, we must also not be mired in past technologies just for the sake of interoperability.  In Apple’s defense, maybe they aren’t intentionally stepping away from interoperability but rather leading the charge towards a new technology that all others will adapt in time, just as they did getting rid of the disc drive. This situation does seem like a different case though, since people will always need some sort of portable external device to listen to their music whereas the need for CD drives has lessened with the ability to download software online.