Topics in Information Policy

A student blog for the Information Policy course at The University of Texas at Austin in the fall of 2015.

[jakethefakesnake-blog]

Internet and the Developing World

Very interesting report, for a couple of different reasons - it called forth for action steps governments around the world should take, just like a couple of us are doing in our projects, and it assumed that the reader is already a supporter of the Sustainable Development Goals.  That second one is non-trivial, I think.  Probably all of us in the class agree with them as worthy goals for 2030, but it’s not too hard to think of a couple of governments that don’t want to support SDG # 5: Gender Equality, at all (Saudi Arabia, for instance).  And the priority list seems a little off to me, could definitely be argued over.

           I had a couple of real problems with the methodology of the report, especially the ridiculous graph showing the “Business As Usual” path (what does that even mean?) and how it wouldn’t be good enough to achieve the “Sustainable Development Goals” path.  That chart was completely meaningless and there was nothing to back it up.  I also didn’t like how the report called for action steps without any serious mention of the funding required to achieve them.  It’s a major oversimplification of the situation.  If governments spend money on the action steps called for by the report, that means that there is less money to spend on other projects.  Those opportunity costs need to be taken into account.  

           The biggest red flag for me was the potential conflict between SDG #s 7, 11, and 13 and the rest.  The Information and Communication Technology recommendations put forth by the report would, at least in the short term, drastically increase the carbon emissions and other environmental problems of the nations that adopted them.  Sure, the report points out that eventually fast technology sharing leads to increased efficiency in systems.  We’re about at that point in Europe and the United States, where appliances and automobiles are getting ever more efficient.  But there are problems that we haven’t even come close to solving yet, like what in the world are we going to do with these lithium ion batteries that are too toxic to safely put in landfills and that are quickly becoming one of the most ubiquitous items in our waste stream.  

I enjoyed one of the later links, the one to the State Department’s Technology Salon, a lot more. Articles on that page (when I read it) were about African women having access to broadband, and how that can be accomplished.  There was also an advertisement for a talk hosted by Wayan Vota on which medium to invest in for sustainable development, mobile phones or cheap laptops.  The headline, “Mobile Phones vs. Computers: a False ICT4D Choice?” implies that it doesn’t really matter, but I think that’s a straw man argument.  It’s gotta be laptops or desktops all the way, because laptops can be used for creation whereas mobile phones are designed for consumption.  I’m not much of a coder, but I know enough that it would be excrutiating to consider designing any piece of software, or even a web page, on a phone.  Remember that one of the theses of the ICT report is that greater access to communications technology helps everyone through sharing of ideas.  But women in Africa or any other developing region will need to be able to create their own content as well as access others.  To say otherwise, I think, is to risk devaluing their own potential contributions and propping up existing thoughts.

Also!  A little bit of a tangent here, but I thought you all would enjoy reading this article about social media ranking in China:  http://www.newyorker.com/news/daily-comment/how-china-wants-to-rate-its-citizens?intcid=mod-yml

Sample quote:  

   “Alibaba, the world’s biggest online shopping platform, creates an incentive for customers to use its own payment service (also part of Alipay) by raising the Sesame scores of those who do. The company makes no secret of its interest in accessing the payment history of its four hundred million users, to make judgments about their creditworthiness and character. “Someone who plays video games for ten hours a day, for example, would be considered an idle person, and someone who frequently buys diapers would be considered as probably a parent, who on balance is more likely to have a sense of responsibility,” Li Yingyun, Sesame’s technology director, told Caixin, a Chinese magazine. In some ways, Tencent’s credit system goes further, tapping into users’ social networks and mining data about their contacts, for example, in order to determine their social-credit score.”

[hunterk1516]

I think you raise some interesting points in your post.  First, I think your observation about the potential conflict between the climate change-oriented goals and the other stated goals (particularly, as I see it, #8: “Decent Work and Economic Growth” and #9: “Industry, Innovation, and Infrastructure”) is a good one.  China comes to mind when thinking about rapid industrialization and the possible side-effects thereof, and as we probably all know, environmental issues are certainly a challenge that is being faced there.  Really, unless we see major breakthroughs in battery, wind, and/or solar power over the next 15 years, I’m not sure I see any path around this potential conflict.  I hadn’t really thought about this dimension of the issue previously, so I’m glad you brought it up.

I also appreciated your perspective on the question of investing in mobile phones or laptops in the developing world.  I think your comment about the consumer/producer divide between these two technologies is on point, and I agree that possessing the devices with easily utilizable “creative” potential is an important step in helping to foster innovation.  If mobile phones continue to be the dominant source of connectivity, however, it will be interesting to see whether new creative platforms begin to emerge in unexpected ways in spite of this constraint.  Granted, I have a hard time imagining how an activity such as coding could ever be made as efficient (or enjoyable) on a small device like a mobile phone as it is on a laptop or desktop, but perhaps there is the potential for some “hack” or paradigm for the mobile environment that will help foster creative applications such as coding that we have just not yet unearthed due to a lack of necessity.  And who knows, perhaps cellularly connected tablets will end up winning the day by presenting a compromise between the benefits of phones and laptops.

[panamaluisito-deactivated201605]

Helping or Forcing...

Are Information and Communication Technologies (ICT) the catalyst necessary to bring the/ Sustainable Development Goals (SDG) to fruition by 2030. I believe that technologies like the mobile phone and other ICTs have definitely allowed for great progression throughout the world through the instant ability to communicate and share ideas. I think of when I was a younger lad, doing research involved going to the library, finding books, and digging through those books to find the answers to my questions. Today, with a quick Google search, I can get much more information than I got doing manual searches through books, in a fraction of the time. And now with ICTs like mobile devices, I do not even need to wait until I can get to a computer to do my research. If my phone is connected, I can do almost anything I can on my computer with my phone. The simplicity and ease of doing things made the advancements of ICT so appealing to those like me. The problem I see, and this view stems from the experiences I have had working in austere and less advanced countries like Afghanistan, is that there is a need to be motivated by the improvements and capabilities to truly want to adopt it to your everyday life. Whereas I love being able to do research on my phone, a family living in the mountains of Afghanistan holds value in being able to keep their family warm and looks at a computer as tinder or items that can keep their fire going. This is a bit off topic, but this also shows the brashness in believing that because a person doesn’t have the technological capabilities you do, that they are somehow deprived and unhappy. Some of the happiest people I have ever met were people who didn’t have a single computerized or electrical item to their name. Also, if you think about it, one of our main uses of these technologies is to connect to those we love: family or friends. But what if our family and friends lived in the same village and were a shouting distance away. Would we be as quick to spend a fortune on long distance connectivity devices? I digress…the reason for bringing this up is that I just think we have to be very careful making policies that assume that because societies or communities are not technologically advanced, they are somehow in desperate need of connectivity. We have to be careful in giving the message that you can only survive in the world by conforming to today’s technological standards. I understand that there are places that are struggling with healthcare issues or other issues that could greatly benefit from the connectivity and information provided by improving the telecom infrastructure and connectivity to the more modern world. I am not in anyway against these efforts, especially in some parts of Africa where there is an epidemic of HIV and the AIDs virus. I just think we need to be careful about identifying the line between helping and forcing.

All that said, I do think it is amazing to see the efforts being made by different organizations to assess the ICT capability of different parts of the world and the effort to find solutions for improvement. I find it fascinating to see the difference in approach with respect to the difference in the region of the world. I was glancing over the assessments done by the IDRC of the different regions of the world, and it was interesting to see how much the assessments between regions differed and where they saw the effort needed to be with respect to the needs of the region.

The last thing I want to touch on is these Technology Salons. I think those small group collaborations about specific topics covering the “intersection of technology and development” is a novel idea. I am amazed at how I had never heard of these and I lived and worked in the DC area. I think that ideas like this, where the government (assuming this is a federal program) invites people who are well studied on a specific topic to come and discuss contemporary issues in the field. I do not know what the effectiveness of these meetings were to the State Department, but I am eager to find out. It seems like the articles in the link were from 2012, but I visit the site and they are still having these meetings quite frequently. I did not take the time to look into if this exist or not, but if these Tech Salons posted wrap-ups of their meetings so those who didn’t attend could get an idea of what was discussed, that would be great as well.

[hunterk1516]

I think you raise some good points about trying not to overreach when thinking about the power and promise of ICTs; this was definitely something that kept popping into my head as I was delving into this week’s materials.  As I’ve heard said elsewhere, we need to be very careful about becoming unintentionally “culturally imperialistic” in how we interface with developing nations and attempt to be of service to them--we can’t just assume because something is popular and important in our culture that this will necessarily transfer to other cultures.  Of course, like you, I also feel the need to balance this call for caution with the realization of how ICTs can be used to help in areas like healthcare and education.  I don’t believe there’s an easy answer to be found in exactly how to strike this balance; instead, we must try to move forward with sensitivity and thoughtfulness toward the potential side-effects of our actions.  I also liked your example regarding social networks--I think it encapsulates well the sort of questions we should be asking as technological advances come to the developing world.  Of course, I fully support empowering the people of these nations to make choices themselves; however, the very real role of the developed world in this matter requires careful reflection.

[hunterk1516]

ICTs for the Developing World

While browsing the various materials that were posted for this week’s reading, it was interesting to see the various initiatives utilizing information and communication technologies (ICTs) that are being undertaken in attempt to solve some of the most pressing issues in the developing world, such as access to education and healthcare information.  It’s also somewhat remarkable to me to hear about the very fast adoption rate of mobile phones in the developing world and how wireless technologies more generally are being used to solve the “last mile” problem in connectivity.  When you look at the situation, it makes a whole lot of sense, but as I once heard noted somewhere, it sort of breaks with our western intuition since it is not the path that countries like the United States took to connectivity and instead leapfrogs much of our earlier phase of wired connectivity.   

Also, in the ICT & SDGs document, I appreciated the discussion of how the timeline to achieving these sustainable development goals can be accelerated by effective use of technology; however, while I understand the value in setting stretch goals, I wonder how attainable the discussed target date of 2030 truly is.  I also appreciated their inclusion of a section overviewing some of the potential negative implications of interfusing these societies with ICTs.  I certainly believe that ICTs provide many great opportunities for the developing world (as evident in the materials for this week), but I’m leery about trying to frame it as a sort of “silver bullet” that will inherently improve all aspects of society.

Looking at the ICT4D policy issue site, one particular issue that was discussed was attempting to break down the language barriers for computer users in Asia, which is extremely diverse linguistically.  One example that was given was “NepaLinux,” which is a version of Linux that is constructed in the Nepali language and also contains a number of applications that have been similarly adapted to Nepali.  It’s this sort of development that shows how technologically privileged we are to simply understand English (and therefore much computer software) and underlines the breadth of the challenges that face more widespread adoption of ICTs in many places.

Another issue that was discussed in one of the site’s modules dealt with research and education networks (RENs) and the challenges that Africa is currently in facing in attempting to flesh out its own various RENs and interconnect them.  I was unfamiliar with this type of network, so it was interesting to hear about the impact that they have for universities in allowing an open flow of data.  It was disappointing to hear that the costs of such connections in Africa are much higher than they are in a place like North America, but it’s encouraging to hear of the various African RENs collaborating with one another in effort to drive down cost and achieve greater connectivity for their universities.

As I look at the various examples that were presented, it definitely helps to offer some perspective on the current global state of technology.  As we discuss policy, it is very easy to focus in so strongly on the current state of affairs in the United States and other more technologically developed nations that we forget to look at things from a broader perspective.  Within the developing world, there are certainly a number of challenges that are faced, but it is great to see how information and communication technologies have already begun and will continue to help present solutions to these challenges.

[jakethefakesnake-blog]

Social Physics

So here’s the first real example that we’ve seen so far in the class of the good side of Big Data.  Previously, our books either were terrified of the potential outcomes (Cyber War, Data & Goliath) or optimistic (Big Data, Yochai Benkler’s book) but they didn’t actually use datasets to solve any problems.  But Social Physics had a ton of interesting insights about the strength and type of interactions between people.

I’m studying complex adaptive systems in another class (remember Emergence?) and love the concept of studying situations in which agents can learn in unpredictable ways, interactions between those agents are nonlinear and cannot be modelled perfectly, and totally new or unpredictable things can emerge from the patterns between those agents.  In the lab, CAS scientists have been able to study the interesting things that can happen in complex adaptive systems by observing ants, or bees, or computer programs.  But humans are obviously a lot more difficult to use for large scale longitudinal studies.  Social Physics describes ways that that study can actually happen.  It’s amazing how difficult it is to design decent experiments in social science, because of all the nonlinear interactions that need to be accounted for, but the biometric data collectors Pentland describes could make experiments faster, cheaper, and easier to design for thousands of subjects at once.

BUT oh man is it creepy given the earlier content of our class.  Alex Pentland is relentlessly optimistic about the potential for data mining to add value to our lives, but the book gave pretty short space to his ideas for securitizing our privacy at the same time.  I guess this is a better question to the techies in our class:  How feasible and realistic is Pentland’s openPDS system?

I don’t have the expertise to really understand how his system works.  He certainly claims that it works, and of course I’m sure it would be an improvement over what we have now, but the only backup that he cites is when several teams from MIT were not able to re identify agents from the data.  Obviously, that’s not the most reassuring information, because we have no idea how and what methods they used, how hard they tried, or what their incentives were for success.  After all, Yahoo thought that their data was anonymized when they released millions of records in 2003, and they were proven wrong when researchers reidentified users within days.  Netflix thought so as well in 2008, and The New York Times reidentified a woman before the end of the week.  If we put the data from the openPDS studies out on the Web for companies to study, I’d bet a bunch of money that someone would re identify someone before the end of the month - and if Alex Pentland (who obviously knows a lot more than me about this) really believes that that wouldn’t happen, he needs to do a better job explaining why.

Like I said, I’m sure it’s preferable to what we have now, where companies barely even have to try to re identify us, and we don’t even get the full benefit of the potential for scientific research that has Alex Pentland salivating.  

[hunterk1516]

I think my reaction to this week’s reading has a lot of similarity to yours.  I thought many of the examples that the author provided regarding how data can be utilized for the betterment of companies, cities, etc. were interesting in how they showed the social pressures and dependencies that guide much of our day-to-day living, but like you, I couldn’t help but be concerned by the privacy implications of all of this.  As you mention, the author does address the topic of privacy in the book, but I also feel like this is an area that will require much more scrutiny if the author’s vision for a much more heavily data-driven governance model is to be pursued.  As I was reading, I also thought back to our big data discussions about the dangers of anonymized data being traceable back to its original source.

In order to be fair, I suppose I should say that in Appendix 2 the author does specifically mention this problem of “reidentification” as he makes his case for OpenPDS.  Reading about OpenPDS, it appears that some of the core principles of the system include keeping your data as local as possible and having all applications that require user data go through this centrally located store that exists locally on the device.  These certainly seem like good ideas, and in many ways, they seem like an extension of what iOS, for example, does today--applications must pass through a central manager provided by the OS in order to get access to your microphone, location data, etc.  Of course, the result of such a system is that all of your sensitive data becomes collected in a single place, which while perhaps better than the alternative of having it diffused to many different actors, still brings its own security concerns with it.

[voyager307]

Social Physics or Social Engineering?

http://www.economist.com/news/leaders/21677198-technology-behind-bitcoin-could-transform-how-economy-works-trust-machine?fsrc=scn/tw/te/pe/ed/thetrustmachine

http://www.eoht.info/page/Social+physics

[hunterk1516]

I share some of your unease about the “social engineering” implications of all of this.  While I thought it was interesting to hear about some of the studies that the author (alongside others) had performed, a lot of this begs the question of how far is too far and at what point helpful guidance becomes manipulation.  Of course, cited objectives such as reducing poverty in cities or increasing productivity in a work setting are good things, and I understand the draw in trying to foster situations that help achieve such goals, but I do think that it involves walking a fine line in how we view and treat people.

There also exists the question of how ready people will be to accept such a shift in how we try to manage society.  I was reminded of a recent study by Facebook that received backlash for how it involved manipulating the positivity/negativity of the content on a person’s News Feed in order to study how people would respond to such changes (see here).  If such an experiment by a private company receives a good amount of backlash, then it seems likely that the state (with all of the power that it commands) will need to tread very lightly in how it tries to make use of these techniques.

[hunterk1516]

Where Do We Go From Here?

In The Global War for Internet Governance, Laura DeNardis outlines many of the complex policy issues that surround charting a path forward for the Internet.  These questions involve a diverse set of actors and require us to think not only about how the actions that we take will affect technologically developed nations but also those parts of the world with less mature network infrastructure.  Perhaps because I come from a computer science background, I appreciated the fact that the author delved into the technical details of these issues in a substantial manner, and I believe the author did a good job of overviewing in a balanced manner various policies that could be implemented.

I enjoyed reading early in the book about “critical Internet resources” and how they are managed and distributed.   Having taken a couple of networking classes in the past, I was already familiar with some of the basics of how DNS resolution is performed and how IP addresses function, but some of the technical detail was new to me, especially those details that occurred at a more macro level.  For instance, Autonomous System Numbers (ASNs) were an unfamiliar concept to me (even though they probably shouldn’t have been, given their importance).  I also appreciated the discussion of how ICANN, top-level domain operators, and other actors cooperate to provide a functional Internet, and more specifically, it was interesting to hear about the particular ways in which the United States (through the Department of Commerce) has held on to its historical governance role by use of the intermediary of ICANN.  I had read of the current tension in which other nations are pressuring for less U.S. influence over the Internet, but I never fully understood what this entailed.  At this point, I’m not exactly sure where I fall on the question of whether the United States should abandon its privileged role in Internet governance.  It makes a lot of sense that a truly global phenomenon should be managed by such an organization as the United Nations, but on the other hand, it doesn’t appear to me that the Internet has been hindered by this loose American oversight.  Consequently, I’m not sure if I see a burning need to destabilize the status quo; however, I recognize that if I were a citizen of a different nation I might see things differently.

As the book described how standards and protocols for the Internet have come to be, it highlighted the fact that the Internet Engineering Task Force (IETF) and the World Wide Web Consortium (W3C), which are crucial for the ongoing success of the Internet and the web, respectively, operate in a very “bottom-up” manner in which openness and voluntary contribution by members are key.  This is still somewhat remarkable to me that such a distributed process can have such successful results, and it’s this sort of result that makes me very hesitant to bring governmental (or UN) influence into considerations of Internet architecture.  For instance, one topic that the author addresses is how peering and transit agreements come into being between various network providers.  DeNardis makes the case that the well-established networks operated by Tier 1 providers have little to no reason to interconnect with newer, smaller networks on the basis of settlement-free peering agreements despite the fact that interconnecting might be the most sensible action from an overall technical perspective.  While I understand that governments need to perform some oversight and regulation of a utility-like structure such as the Internet, I think that in a case such as this I would be more inclined to let the free market decide the result rather than having a government issue some mandate for peering.  

Toward the end of the book, the author focused on the ways in which Internet governance can be made a tool for questionable purposes.  One specific technique that she mentioned was deep packet inspection (DPI) and how it may be used to control the type of content that passes through a network, such as is the goal when a government is wanting to censor its citizens.  Given the discussion in last week’s book regarding the potentiality of installing a real-time, wide-reaching DPI system across the the Internet backbone in the U.S., this mention by the author certainly provides a moment for pause and reflection about the potential implications of that action.  While I still feel that the idea of DPI for cyber-defense makes a lot of sense, I believe this section in The Global War for Internet Governance should remind us that we would need to be extremely cautious if such a system were to be implemented.  An abundance of transparency, checks, balances, and accountability would be absolutely essential. The potential for “mission creep” would be very real, and personally, I’m not even quite sure where exactly I would draw the line of acceptable vs. unacceptable use of such a system.  I don’t want Big Brother, but I do want adequate protection from cybercrime and cyberwarfare.  Striking that proper balance would be a difficult challenge, just as is the case for many of the issues lying in the realm of Internet governance.

[panamaluisito-deactivated201605]

Hold My Orange Juice...I’m About to Go to Fix Cyber

Every single book that I have read regarding Cybersecurity or Cyber Warfare always makes me feel like I would need depression medication. It is very easy to get lost in the magnitude of the concept or the domain that is Cyber Space. That said, Cyber is a very macro concept that entails a great deal of adjunct concepts that make it up. I believe that trying to look at the whole without truly understanding the pieces is a recipe for failure. Take the book Cyber Warfare: The Next Threat to National Security and What to do About It, written by Richard A. Clarke and Robert K. Knake. It is a great book that is well written. It does a good job of connecting with any audience reading, regardless of their expertise in Cyber. That said, it also quickly jumps from point to point because of the fact that there are so many points to cover. The way Mr. Clarke explains how the politicians in Washington were dealing with the issue of Cyber Warfare shows that the answer to this problem will not be a top down solution. Let me expound on this concept a bit more. One point that I think Mr. Clarke hit a home run with was the fact that we as a nation are far behind other nations when it comes to being able to defend the critical infrastructure of this nation. As Mr. Clarke mentioned several times in his book, the DoD has a system in place to ensure that the .mil domain is defended well. DHS has a system in place to ensure that the .gov domain can be defended under attack. But what about the .com, the .edu, the .net, and all the other dot somethings? Who is protecting those domains? Mr. Clarke also mentions the fact that many of our privately owned critical infrastructure, such as banking, gas, electric, etc…, are all under these domains the government is not responsible for defending. Mr. Clarke is absolutely right that this is a big vulnerability that needs to be addressed. Mr. Clarke is also correct in the fact that there are several entities that want to see the DoD and the federal government do a better job at defending ALL U.S. domains from attacks from other nation-state Cyber actors. What Mr. Clarke does not get into very clearly is why the government is not taking on this responsibility. I believe that this reason falls in the hands of two major players: money and privacy. Let me start with money. Although big corporations can spend the money needed to thwart attacks from competitors, hacktivist, and other relatively smaller scaled Cyber adversarial actors, they cannot take on the resources of nation-state backed Cyber actors such as China, Iran, or Russia.  In this case, Mr. Clarke mentions that the private sector feels that because it is a nation-state sponsored threat, the DoD or the Feds should be dealing with it. The question is, who is going to pay to construct the infrastructure the government would need to take on such a task? Who is going to forgo a Google or Microsoft salary to work as a GS-9 Cyber Warrior for the government. Notice I said GS-9, which refers to a civilian government employee. The Military is currently going through drastic cuts, so where is the manpower for such a force needed to take on the task of protecting the US owned portion of the Internet? It is easy to pass the buck, but are these corporations willing to also PASS THE BUCKS?

Another issue lies with what it would take to actually defend even just the critical infrastructure of the U.S. When Snowden, the traitor, decided to leak classified information about NSA programs that involved massive bulk collection of telephonic metadata, the country went in an uproar about privacy and how the government was infringing on the privacy of all Americans. I understand that not all Americans had a qualm with the tactics of the NSA, but there was enough pressure to cause a drastic shift in strategy throughout the Intelligence Community. I am pretty sure a lot of you saw the congressional hearings where GEN Alexander was getting grilled by members of congress over the leaked information. If not click on the link. My point is, if NSA cannot bulk collect data for intelligence purposes, then what capability are we as a nation going to hand the DoD to defend domains that host critical infrastructure. The DoD is able to collect and defend the .mil and .gov domains because all systems connected to these networks are under a consent waiver that all users sign allowing the DoD entities the freedom to use all data going in and out of the aforementioned domains for defense and intelligence purposes. It would be infeasible to get everyone to sign off on allowing their systems to be monitored by the DoD or DHS. This is why I say that thinking about Cyber from a top level and trying to work down is not going to be efficient or effective. This is also why our current Cyber defense posture from a federal perspective is a reactionary one, where we have to wait for an incident to happen and wait for the organization the incident happened to to request help before the DoD can act (that is with respect to any non-.mil and .gov domains). As Mr. Clarke mentioned in the book, the capability to inspect traffic in real time along the backbones of the US is a reality. The question is, are we willing to allow the US government to have access to the data traveling across those wires in the name of defense. Mr. Clarke discusses many ways that we could eventually end up utilizing the traffic moving across the backbone for intelligence and defense purposes. I believe the real question is are the American people willing to give up some of their privacy in the name of Cyber defense of our nation’s critical infrastructure. Russia and China have very good Cyber defensive postures. They also have a government that controls their Internet and connectivity to the world. I am not saying that the only solution is for the feds to take control of anything. I am saying that we will not be able to even determine what our defensive posture will be until we address the issue of privacy. There is so much more I want to discuss, but I am well over my word limit so I will save it for discussion.

[hunterk1516]

I liked your comment regarding how you believe money plays a role in the lack of appropriate cyber-defense measures in America.  This is something I remember you bringing up when a group of us were discussing cybersecurity issues after class one day, and it makes a lot of sense that in some ways the government simply can’t compete with the lucrative opportunities that are often available in the private sector.

Regarding your comments about policy, I think you made a good observation regarding the correlation that exists between a nation’s cyber-defense capabilities and its capacity for control with respect to its citizens’ online presence.  This was one of the more thought-provoking components of this topic for me as I began to mull around the potential implications of performing government-mandated packet inspection on the backbone.  As I wrote in my blog for this week, I found this proposal by the author convincing, but the potential for abuse does still frighten me, even if stringent transparency measures were enacted.  This is partially why I liked the author’s proposal for a separate Cyber Defense Administration.  Now, of course, such an organization would still be ‘the government,’ and therefore would still foster many feelings of distrust by the general public that you bring up, but it seems to me like separating this power out so distinctly from other governmental functions might give greater opportunity for oversight and transparency.

[markmgray-blog]

Cyber War and the “Internet of Weapons”

Actual website: http://map.norsecorp.com/

I am proposing that we rename the “Internet of Everything” to the “Internet of Weapons.” After reading Cyber War by Clarke and Knake I can see this high level of interop resulting in various new vectors of attack. To backup my claim I want to cover some history of TCP/IP, specifically IPv4 our current routing system. IPv4 uses a 32-bit addressing schema to generate IP address for routing traffic all over the world. A 32-bit address space gives us 2^32 IP addresses to utilize. This means there are exactly 4,294,967,296 addresses to be used world wide. That sounds like an extremely large number. However, currently there 7.125 billion people on earth, close to doubling the number of IP addresses. Today there are 2 billion smartphones in circulation, and each of these has the ability to tie up 1 address. That is already half of the address space. You may be thinking, “so what, how does this turn connected homes into weapons?” In short, it doesn’t! The premise here is that creating an interconnected home will undoubtedly (at our current pace) exhaust our remaining address space. Ok, so we are going to run out of addresses for all of our devices what is the solution?

IPv6 is the latest version of the internet protocol (IP) and with it a whole new playground for cyber warfare. IPv6 supports a 128-bit addressing space (2^128 addresses) which is more than enough to support the internet’s infrastructure for the foreseeable future. Why do I state that it will open up new attack vectors in the word? Simply because it is new (in practice) and has not undergone the rigorous exploit attempts that have been performed on IPv4 since its beginning. IPv4 has been subject to many different exploits including the Ping of Death, DDOS, and system specific packet exploits. The ability to perform each of these attacks has been documented and in many cases there are firewalls in place to prevent them from happening again. In the “Ping of Death” attack a packet exceeding the 64 kilobytes of allowed data is sent to the destination server and causes the system to crash due to an overflow exception. This has subsequently been fixed in all known operating systems that were affected. This attack was crafted to target the Internet Protocol being used by the destination host. Thus moving to an entirely new system that has not been tested throughly will allow for these types of exploits to arise again. New systems come with new exploits and what these are we’ll just have to wait and see. It is not a far cry to imagine these exploits giving control of your connected house to a malicious user and thus causing the “Internet of Weapons.”

I want to comment specifically on one part of the book, that is when the author describes his vision of what a cyber attack would look like on a national scale. He describes trains running into each other, and power grids shutting down. These are not unlikely given an on-site hacker or intruder, but many of these systems are not connected directly to the internet. This is a common misconception and any company that has security as a relative thought creates separate networks within their company that many times do not talk. I worked for BP in their Digital Security and Counter Threat Unit over the summer and learned that all of their critical systems are behind strict security and do not have access to the internet. These systems require on-site users to operate, enable, and disable them. There are other ways that these can be infected, such as exploits in the applications, operating system vulnerabilities, and even unintentional installation of malware. It is not as simple as a hacker in Russia pressing a few keys in a terminal and disabling the entire Eastern seaboard. I can however see the Internet of Things giving hackers a way to simulate a power grid failure without actually disrupting power by taking control of home systems and rendering them inoperable on a large scale.

[hunterk1516]

As has already been noted in response to your post, that link you shared is fascinating--it’s quite mesmerizing to look at and helps make what is a fairly abstract concept a little more concrete.  It was interesting to see you approach this topic from the case study of the transition from IPv4 to IPv6 and how such a transition could leave vulnerabilities that will only have their effect multiplied as more devices and infrastructure gain Internet connectivity.  With respect to the transition to an updated IP protocol, I am at least somewhat optimistic that given the slow transition from IPv4 to IPv6, most of the glaring security issues will be (and perhaps already have been) encountered during this gradual buildup process before the protocol reaches deployment at extremely large scale.  That having been said, change certainly involves risk, and that should keep us vigilant moving forward.

It’s also good to hear that companies such as BP are being very intentional in their security measures, but even if BP has managed to achieve high security, I still wonder how much this extends across private industry more generally.  It’s troubling to me to hear the author relate the example of how cyber security auditing firms reported being able to gain access to an electrical grid control system in under an hour.  In that example, while the control system may have not interfaced with the Internet directly, the penetration testers were able to use the company’s website to hack into the company’s intranet, and from from this intermediary location, they were able to access the controls.  In other instances, the book says that testers hacked into the VoIP phone system that was present inside of the control room and used this as the foothold that they needed for gaining access to the grid.  While I understand that citing a few examples does not necessarily mean that the conditions are uniformly poor across private industry, I do tend to take a fairly pessimistic of private industry’s preparedness when reading of such cases.  It all ties back to the magnitude of the classic challenge faced by the defender--realizing that you are only as strong as your weakest link.

[hunterk1516]

Defense in a New Century

Cyber War: The Next Threat to National Security and What to Do About It was a great read--probably my favorite book that we have read in class thus far.  The wealth of first-hand experience and vivid stories that the authors provided painted a picture of cyber war that was both fascinating and unsettling as they identified the many ways in which the United States remains extremely vulnerable to cyber attack.  I appreciated how the authors explored the ways in which the new battlefield of cyberwarfare destabilizes the current global balance of military power by giving the ‘little guy’ an opportunity to exploit the dependence of the US (and other developed countries) on the Internet and other computing infrastructure.  Along these same lines, it was interesting to hear just how imbalanced the United States currently is in its offensive cyber capabilities as compared to its defensive capabilities, and it was sad to hear the chronicling of how in recent administrations this issue has not been significantly addressed in actuality.  Granted, it would probably be good to hear a ‘rebuttal’ from the government if they disagree with the analysis given by Richard Clarke, but it seems likely to me that given his experience he is able to give a pretty fair description of the current state of our preparedness.

A hypothetical that the authors asked the reader to engage involved what the national response would look like if we found out that Chinese operatives were going around and strapping C4 to electrical grid equipment across the US.  The authors say that obviously there would be outrage, but they note the contrast to this hypothetical reaction with the current general lack of awareness and concern to the fact that others have likely placed malicious code within our electrical grid infrastructure.  The authors attribute this to the simple lack of experience of the general public with cyber issues, and I find it a convincing illustration of the sort of strange place we find ourselves in with respect to these issues.  The dangers have been identified but haven’t  “sunk in” yet at either a policy or popular level.  When reading this book, I remembered a 60 Minutes piece I had seen years ago that dealt with dangers related to cyber vulnerabilities (see “Sabotaging the System”).  When being interviewed about the vulnerabilities of the power grid, Congressman Jim Langevin, who formally investigated these issues, went so far as to say:

"I look at this as, like, a pre-9/11 moment. Where we identify a problem, we identify a threat, we know it exists, we know it's real, and we don't move quickly enough to fix the problem."

To be sure, those are strong words, but I believe the content of this book should at least give us pause before dismissing them too quickly.

Given this importance of securing our cyberspace, I really appreciated the “Defensive Triad” that the authors suggested in terms of policy priorities moving forward, and I thought the first component of this triad, securing the Internet backbone in the United States, was perhaps the most thought-provoking of the three.  The proposal involved having Tier-1 Internet providers, such as Verizon and AT&T, be responsible for performing deep-packet inspection for the traffic moving across their information superhighways.  The authors point out that such a filtration system would help alleviate a lot of the need to harden many ‘endpoint’ network users individually.  I have to say that I really like this proposal, and from a glance, it doesn’t seem like it would be super costly to implement, at least in proportion to how much is spent for other defense-related endeavors.  However, as the authors freely admit, such a system would inevitably raise privacy concerns that the government would be tempted to use it to filter or scan for more than it was originally intended.  The book discusses checks that could be put in place to help assure that it is only used for appropriate filtering, but it seems to me that in our post-Snowden climate, this may very well be an impossible argument to sell.  Personally, as long as there is a transparent process for letting the public know what types of materials the government is allowed to scan for (perhaps even having quarterly reports released by the ISPs themselves about the types of content they have been asked to scan for) and some type of oversight board (as the authors suggest), it seems to me like the benefits of Tier-1 ISP monitoring outweigh the potential cost.

Later in the book, the authors suggested the creation of a Cyber Defense Administration to coordinate these protective efforts.  While creating one more agency does run the risk of just adding another layer of bureaucratic complexity and cost to the situation, this does seem to me like a niche that makes sense to be filled by a dedicated organization.  I agree with their point that it probably doesn’t make sense to give this job to the NSA due to the image problem the organization is currently facing, but even more basically, it seems to me like a militarily-affiliated organization shouldn’t be given the day-to-day job of monitoring our civilian infrastructure (echoing to some extent the argument Schneier made in Data and Goliath, albeit in a slightly different context).

In summary, I really appreciated the perspective that the authors brought to this subject, and I feel that it is one issue that deserves much more attention than it currently receives in our political discourse.  What about you?  Do you think that the government needs to play a larger role in accomplishing cyberdefense of civilian infrastructure?  Did you find the “Defensive Triad” to be persuasive?

[musingsoninformationpolicy]

Interop

The core idea of the book “Interop: The Promises and Perils of Highly Interconnected Systems”, is interoperability. The idea is a simple one, and it has been around, at least in the field of computer science, for a long time. In my mind, this is how I look at it - how can we make different things function together synergistcally? And, can we do so in a cost-effective way that makes it worthwhile?

Interop is an idea that is not limited to the tech domain. The railroad example from the book illustrates this very well. Automobiles are another example - if you know how to drive a car, you can probably drive any car. Most of the essential functions and features of a car are probably built in a standard way, independent of the manufacturer. There are probably regulations that require carmakers to do this. Was it always so, though? After cars were invented and started becoming common, I imagine there was a period where different manufacturers did different things with their cars before things became standardized. I also feel like we will go through another such phase when self-driving cars become an everyday thing.

Talking about software interoperability, the idea remains the same. The core requirement of interop is some form of standardization that allows different people to build different things that will be able to talk to each other and function together with little to no extra effort, by virtue of the standardization. Low-level communication protocols at the network level are already standardized - TCP/IP is the backbone of the internet. Now that our systems are starting to collect and process big data, the ideas of standardization and interoperability are being applied at a higher level of abstraction. SQL queries are a standard way to interact with any relational database, regardless of which specific database is being used in an application. Hibernate is an Object/Relational Mapping framework for Java which allows code to be written in a database agnostic way, and only requires some configuration files to make everything work. These things have existed for a while now.

With the backdrop of things becoming more and more connected, I’d like to talk about three things. First - the open source movement seems to be a step in the right direction for interop, and with the exception of Apple, tech companies which follow an open source development philosophy generally seem to be doing better than companies which do things the proprietary way. Second - at my previous job, I worked on a team that built proprietary frameworks to allow client-server applications to be written in any programming language and work seamlessley together. While these frameworks worked very well, we started having problems because code was not compatible with RESTful web services, which is pretty much the standard way of building client-server applications now. Third - I believe that the cloud computing industry will go through a period of upheavel because, as of now, there’s no standard way of interacting with cloud servers provided by various Infrastructure as a Service (IaaS) providers, with Amazon WebServices being the biggest player. Given that it already has a large market share, there is no motivation for Amazon to standardize it’s APIs, but other, smaller companies are pushing for standardization to allow them to try to capture a larger market share. I’ve heard of companies attempting pseudo-standardization by writing a wrapper that internally maps commands to the specific cloud implementation, not unlike Hibernate for databases.

Talking specifically about data interoperability, with the rise to prominence of schemaless / NoSQL databases like MongoDB and Cassandra, and standard ways to transmit / receive documents like XML and JSON, we’re already well on our way. It may seem counter-intuitive that the key to data interoperability was not more structure, but less structure.

We’re starting to cross a threshold, and very soon the Internet of Things will be all pervasive - everything will be connected, devices constantly transmitting and receiving, exchanging data. This may lead to privacy concerns, because the same data can be accessed in multiple ways, with automatic authentication. However, I believe that the benefits outweigh the risks, and we’re heading towards a better, safer world.

[hunterk1516]

I think that you bring up some good examples of how the tech community has already benefitted from interoperability, such as SQL for database querying and XML or JSON for the serialization of data.  Also, it was interesting to hear about the lack of standardization that currently exists within the cloud computing/IaaS world.  As the authors described in the book, there seems to be a general pattern with regard to interoperability in which industry leaders are initially resistant to standardization but eventually relent.  Given this observation, what can an industry as a whole do to try to speed up this process?  Short of a governmental mandate, is there anything that the ‘little guys’ in cloud computing can do convince a behemoth like Amazon to standardize?  I’m not sure that there is--it may just need to be organically driven by the customer base over time.

I also liked your comments about the open source movement. I’m beginning to gain a better appreciation of the true power that lies in open source software, and as you said, it is interesting to see how a lack of structure can actually lead, at least in some cases, to increased interoperability.  I suppose this sort of ties into the authors’ point that there is no ‘magic formula’ for interoperability--solutions can look very different for different spaces.

[voyager307]

Interop: Striking a balance between the promises & perils of interconnected systems

[hunterk1516]

I also found the provided example of electronic health records to be very interesting--it’s the sort of issue that seems overwhelming to even know where to start.  It’s great to hear that apps like Medlio are beginning to emerge to fill this niche and empower the individual to more effectively manage his or her health data.  Personally, however, I’m somewhat conflicted about this brave new world of medical record interoperability.  Like the authors stated, there seems to be so much to gain by streamlining our system in this way, and I’m all for that in principle, but at the same time, I would still feel fairly uneasy having such personal information so easily accessible on my phone.

I think that my tipping point of unease comes when this electronic information becomes stored by a third party, rather than a hospital or other medical institution.  That having been said, I’m not sure that it’s completely valid for me to assume that a hospital would be more adept at protecting my data than a tech company would, and I’m not even sure hospitals will want the responsibility (and liability) of hosting the data themselves.  (Also, a quick glance on Google seems to confirm that EHR hosting will be a business of its own.)  So perhaps my unease is just not properly aligned with the reality of the situation on a few different fronts.  However, as I’ve begun to read in next week’s book about the currently lacking state of cyber-defense with respect to civilian infrastructure in our country, these general qualms about data security certainly seem validated.  Anyway, despite all this uncertainty, it will be interesting to watch this develop over the next few years.

Final Note: I also liked your comment noting both how apps such as Medlio may have never emerged if not for a government mandate helping to ensure them a market and how this represents well the balanced approach that the authors attempt to strike in considering how to achieve optimal interoperability in a given scenario.  

[hunterk1516]

An Interconnected World

Throughout Interop: The Promise and Perils of Highly Interconnected Systems, the authors do a solid job of demonstrating the importance, challenges, and nuance that the concept of interoperability entails in today’s world.  For me, interoperability is one of those ideas that seems so foundational that I don’t often think about it until its absence affects me negatively. Therefore, it was interesting to see the authors be able to form such a detailed treatment of the topic.  In their discussion, the authors discuss interoperability, or interop, from the perspectives of data and technology, which is what someone like me from a computer-science background is likely to think of first, but they also extend this discussion to a higher level in pointing out the human and institutional layers that interoperability also encompasses.  This holistic view of interop does a good job of framing the discussion, and I appreciated the respect that the authors gave to the idea that the highest amount of interop is not necessarily the optimum amount of interop—their more nuanced view of the concept seems both correct and more challenging.

Throughout the book, the authors make use of a number of examples to show both the current ways in which society utilizes interoperable systems and how the concept may be applied in the future.  One such example that I find particularly interesting is that of the air traffic control system.  The enormous complexity of this global system is incredible to me, and I was surprised to learn that a universal language for the world’s air traffic controllers (English) had been only implemented in the past decade.  It was also interesting (and slightly disappointing) to hear that a much-improved system is conceivable but that the “lock-in” effect stymies that possibility.  As can be seen in this example, the book does not avoid the difficult questions about the potential drawbacks of interop, in this case the ‘lock-in’ effect.  The authors also address the potential threats to security and privacy that interoperability can represent, but they make the case that these dangers can be managed effectively.  I thought that their example of ATMs being highly interoperable among different banks yet still very secure backed up this claim well.

A forward-looking example that the authors explored was that of how to preserve digital texts into the future and avoid knowledge becoming lost or inaccessible due to technological compatibility issues.  Like the concept of interoperability itself, this seems like one of those issues that isn’t often at the foreground of the conversion but could nevertheless have very negative consequences if it were not addressed appropriately.  I liked the authors’ idea of creating central repositories that house books in a flexible, open, and agreed-upon format, and as the authors suggested, this seems like a great job for the Library of Congress.  It seems like there would be so little barrier to publishers giving, at the very simplest, an ASCII-based version of their books (at least those written in English) to such an entity as the Library of Congress—even if a promise had to be made that such books would not be made available to the public in their current simplified forms.  At the very least, a more all-encompassing digital archive could begin to be amassed, even if it were left to the future to decide exactly how to utilize it.  One interesting note is that while the authors mention the current Internet Archive project, they state that they don’t view it as fulfilling the full archiving function that is needed in the digital world.  I visited this organization’s website, and their collection of “text” documents has grown significantly over the past few years—approaching 10 million as of 2013.

While the book does a good job of overviewing many interoperability-related issues, one other such issue that I find intriguing is that of vehicle-to-vehicle communication.  I find all of the talk about self-driving cars to be fascinating, and vehicle-to-vehicle (V2V) communication is often discussed along with that topic, so I decided to do a little browsing and see the current state of V2V communication.  Essentially, V2V communication would enable vehicles to communicate crucial information like location and speed with nearby vehicles (see here for more information).  Consequently, vehicles become more aware of their surroundings and are therefore better prepared to sense danger and keep their occupants safe.  This is both an excellent example of a technology for which a powerful “network effect” would exist (as described in the article linked to above) and a technology for which interoperability among the signals emitted by cars from various manufacturers will be crucial.  The government is very much behind this effort, so hopefully this technology will be widely deployed before long!

What are some other interoperability issues that you see society needing to address in the near future?

[infopolicyanw-blog]

Data and Goliath

<psa>

I have to make a comment on the introduction itself of this great book. It talks of the bargain we make with our phone, that to have the ability to make calls, I’ll forsake my privacy. Recently, I realized just how creepy this was. Of course, I always understood it was creepy. But I got goosebumps. Take a look:

Our iPhones track our location history. From the moment we leave home to the moment we go to work to the moment we visit family. I looked at mine and it was scary accurate at recording how many times I went to work, went home, etc. You can turn this off, but it’s automatically on first.

</psa>

The book makes me realize just how many tools there are out there that track, help track, etc. and build a huge amount of data around a single person. In the hands of a dangerous person, this is frightening. Supposedly, this is to protect us. Is it worth the loss of privacy? That the government sees I’m not a threat but recognizes so-and-so who has suspicious activity is? Can I trust them to recognize suspicious characters without resorting to biases or racism or Islamophobia? Schneier recognizes that data leads to stability, however, in certain situations. In governmental dealings, knowing the other side can help with negotiation.

However, Schneier points out also that this is not just for security. Our data is money. Third parties get a hold of our search history or our Facebook likes or our purchasing habits and they suddenly have a great view of who we are so that they can better advertise and sell. Do we want entities to have that much power? It’s difficult. I do end up getting targeted advertisements that are more applicable to me, but what’s the cost? When I accept the terms of service to a flashlight application without reading, I may be unknowingly giving my location information to the creators. It could be argued it is my fault for not reading through the dense terms-of-service, but I don’t believe flashlight applications need that density in the first place. The study from the Pew Research Center on Privacy and Cybersecurity shows that people recognize their data is not safe and there should be further regulation on how their information is handled. I agree if that means further transparency with data management.

Data is important. I recognize that. With enough information, it can be used for amazing purposes. It can recognize flu outbreaks, save people from dangerous criminals, and so on. Consumers, however, should know where their data is going and how it is being utilized. Surveillance systems do exist, but users shouldn’t be having to use a friend’s shopping card to avoid being dangerously tracked by Safeway. Instead, the consumer should have a clear idea of what it would mean to continuously shop with their own card and how their purchasing data would be used or distributed.

I personally believe if there is to be a change, a massive amount of people need to be educated on how their smart phones are tracking them or their private information is being sold off and so on. Enough voices may mean policy is improved enough to the point where we don’t necessarily have to trade off our ability to call loved ones for our own privacy.

[hunterk1516]

That Location History feature for iPhones is both interesting and unsettling.  I just tried it on my phone, and sure enough, it’s working.  A few weeks ago, I had my first experience in which my phone sent me an Apple Maps notification predicting my estimated drive time without ever having received any sort of request from me for the information--and yes, it was correct in guessing my destination.  I believe this sort of functionality has been present in Google Now for a while now, but I still marveled a little when seeing it firsthand on my iPhone.

The link that you provided to the Pew study on privacy certainly underscores well that consumers are beginning to feel the lack of data privacy--even if they may not be active in seeking change.  I find particularly interesting the statistic that 64% of Americans believe that the government should place more limits on the behaviors of advertisers; it’s surprising to me that there is already as much of a ‘mandate’ as there is.  Also, I agree that there is a need for the structure provided by governmental policy in this very important aspect of our lives, but I still grapple with the same questions that have floated around since the discussion of big data--how do we do this without stifling innovation and hindering some of the amazing applications of data to problems like the ones you listed?  I tend to be leery about imposing strict governmental controls on business, but at the same time, I obviously value the protection of civil liberties, so I’m conflicted about how exactly we should proceed in terms of concrete steps.

[aksullyopinions-blog]

Data and Goliath: The Hidden Battles to Collect Your Data and Control Your World

“We tolerate a level of electronic surveillance online that we would never allow in the physical world, because it’s not obvious or advertised.”

This point really resonated with me.  I’m software oriented and I feel like I keep informed about current topics. But between the last two books I really feel like I’ve personally been ignorant. Sure I knew about the mass government surveillance, that your computer does not really “delete” things until it needs to be overridden, that anonymous data often isn’t and that cookies existed. However, these books really drive home the sheer amount of data out there about us and how it’s being used.

One thing I really enjoyed [and was disturbed by] was the examples used throughout the book.  And while pointing out the hypocrisy from CEOs who focus on eliminating privacy yet they want privacy for themselves is amusing, many of the examples just highlight the abuse that can take place. For instance, the book revealed how the FBI used information collected on MLK to try and get him to commit suicide. It’s easy to grasp that this type of psychological manipulation would be much easier these days because of the data gathered from our online activities.

“We don’t lie to our search engine. We’re more intimate with it than with our friends, lovers, or family members. We always tell it exactly what we’re thinking about, in words as clear as possible.”

It’s certainly a pessimistic viewpoint to assume abuse will happen, but I don’t think we have nearly enough [or really any] safeguards in place to prevent abuse. As the author even mentioned, there are benefits of big data and there is a need for surveillance. However, the current lack of laws or regulations in the US to protect citizens is unacceptable.

The battle does feel daunting the more you learn about what is being collected about our online activities and the many ways that information is being used. But I think part 3 of the book hits home a good point – this battle isn’t over and we need to start pushing for the changes before it actually is too late. It still won’t be easy because of the current status quo, but the future of internet privacy isn’t set in stone just yet.

“One way to improve the security of collected data is to make companies liable for data breaches.”

One of my professors once said, “A bank can’t secure a single number, my credit card number, but the affordable care act wants my personal and medical information to be stored electronically.” It’s a statement that has always been in the back of my mind. Having your credit card stolen is a pain, but one that isn’t insanely difficult to resolve. Often times, your bank knows before you do. You just outline which charges aren’t yours and wait for a new card in the mail. [And hopefully no one actively shops with a debit card.] But what happens when it’s more than just a credit card that someone gets a hold of?

This summer, I interned at the Naval Research Laboratory. In order to work there, you have to obtain a security clearance. As you can expect, tons of personal information gets outlined in them. In addition, you have to list personal information about friends and relatives. Well as it turns out, the information was stored electronically, and subsequently hacked into. 

Now the government is offering identity theft protection for free to the 22.1 million people who were compromised for the next 5 years. You can’t help but wonder what can happen when someone has your SSN, your life history, your passport number and so much more. I had to turn over the information to get the internship I wanted, but I never asked for it to get stored electronically and hacked.  Thankfully, the government is offering identity theft protection and credit monitoring, but there is nothing that would force them if they choose not to. 

The book outlines how - as a whole - companies have no incentive to focus on protecting our data. And its true although Target is settling for 10 million dollars. However, there are plenty of companies that get financial information hacked and don’t end up getting sued for compensation. So I agree with the notion that there needs to be a legal/financial incentive for companies to protect the information they so willingly collect on all of us. Especially when its not just a credit card number.

I also liked this notion of “opt in” and just, in general, more transparency with what data is collected and how its used. I want to know what is being collected about me and how its used. I want to know if its getting sold to 3rd parties. I want to know if the government is requesting my information. And I want an end to the “opt out” defact status of data collection that has continued to allow many of us to ignorantly go about our days unaware of the trails of data we have been leaving behind. 

[hunterk1516]

I like that quote from your professor--it certainly shows the respect we need to have for the gravity of digitizing such intimate information as one’s health records.  Also, I agree with you that it would be positive if a shift could be made within the tech industry toward “opt-in” for data collection, rather than “opt-out.”  At the same time though, I wonder if this will ever be a realistic course for the Googles and Facebooks of the world--would there business models starve without the instant firehose of information that an “opt-out” policy (or even data collection with no user choice) provides?  It seems likely to me.  If a governmental policy were to be handed down requiring such a change, I wonder what we would see such companies do in effort to incentivize our giving permission for data collection.  Would we start to see a distinct two-tier system emerge across these services, in which only the “opted-in” user gets access to the fuller set of functionality?  If so, would we reach a point at which the user is essentially forced to opt-in, despite the option existing to the contrary?  Also, given that a lot of privacy awareness issues relate to the fact that privacy policies can be difficult to decipher, I wonder whether it would be possible to legislate regarding the readability of these policies.  Could a sort of “Privacy Facts” description be required on websites that collect data (in a somewhat similar way to how food often comes with a quick-reference “Nutrition Facts” section today)?

[hunterk1516]

Privacy in a Digital World

Data and Goliath: The Hidden Battles to Collect Your Data and Control Your World by Bruce Schneier was both a fascinating and somewhat unsettling read--as he intended it to be.  Of course, the fact that much data is collected about us by a multitude of sources is not a new revelation to those who are paying attention, but seeing example after example of how this plays out in modern society certainly raises many questions and highlights the high importance on bringing discussions about privacy into the public spotlight so that we as a society may decide how to proceed in an informed manner.

Schneier did a good job of explaining how the economics of surveillance have changed over the course of time.  He discussed how much of the cost associated with surveillance now comes at the outset, and consequently, once a given surveillance system or tool is in place, the subsequent ‘unit cost’ of surveillance becomes miniscule compared to its historical value.  Later in the book, he also connected the idea that the technological shifts in how people communicate have led to a loss of a awareness in the ways and extent to which we are observed in our daily lives--our common sense has not kept pace with technology.

As Schneier delves into the workings of the NSA, the subject of Edward Snowden and his revelations inevitably arose and played a central role in much of the book.  While I’m sure a lot could be written about PRISM and the other particular programs that are detailed, I will instead focus on Schneier’s view of what reform would look like for the U.S. intelligence community.  I found very intriguing his proposal for breaking up the NSA and redistributing many of its responsibilities into other organizations; for instance, many of the NSA’s domestically aimed efforts would be absorbed by the Department of Justice.  While I would want to hear a response given from the opposite position before forming a solid opinion, I found the argument that he provided to be pretty compelling, and I liked his call for a return to a more traditional, judicially based warrant system with regard to the technological surveillance that would endure.  Along these same lines, toward the end of the book, Schneier discusses how he rejects the idea that the times that we live in somehow make “everything different” with respect to the balance between civil liberties and security, and he mentions examples of when such thinking went awry in American history.  I think this perspective deserves more airtime in our current political discourse.  Finally, his advocation for permitting whistleblowing as a legitimate legal defense in cases like that of Edward Snowden made a whole lot of sense to me.  I agree with Schneier that this seems like a necessary step for enabling better transparency and accountability.

Schneier also discusses how closely we are being watched every time we open a web browser: In addition to the government, companies also take great interest in monitoring our actions in an effort to monetize them.  With regard to these corporate ‘surveillance’ efforts, I find them slightly unsettling, for like most, I want to know where data about me is going.  However, I don’t have a strong opinion as to exactly how this should be addressed in terms of policy.  I would prefer greater control of my data and transparency in general, but like the book touches on, I also want companies to be able to leverage Big Data to foster innovation.  If the United States stays on its current “Wild West” approach in this area, it will be interesting to see how its outcomes differ from those in the EU.

As so much of the incentive for tech companies in tracking their users comes in the ability to more effectively serve them ads, it’s interesting to see the current discussion regarding iOS 9 and its option of installing third-party ad blockers within one’s browser.  Articles like this one discuss the fact that while this functionality prevents annoying ads (and the privacy concerns that originate from ads tracking you across websites), it also undermines the ad-based business model of many of those websites.  This article also deals with the subject.  It was written after one developer willingly removed his popular ad-blocking app from the app store due to personal ethical concerns about its use, and the article similarly approaches the issue as a moral question.  What do you think?  Do you use an ad blocker?  Do you think that any ethical dilemma exists?

[sarap2015-blog]

[hunterk1516]

I did not realize that Negroponte had been involved in the “one laptop per child” program that has been publicized, and it’s interesting to hear that it ran into difficulties due to a lack of sensitivity to the context in which the system was being deployed.  This seems like it will be forever a challenge during efforts like these, and it reminds me of an essay within the Governance in the Information Era book that I read during our big data class module.  In the essay, the authors are discussing the possibility of utilizing simulation tools within the educational system for trying to understand what effects policy changes may have, and one of the topics they address is the issue of education policy efforts floundering due to a lack of appreciation for the local context in which the efforts will be deployed.

Concerning cloud computing, I agree that it was interesting to see the parallels drawn between computational power and utilities like electricity, especially the example of the steam-powered factory (with internal power generation) ultimately giving way to an externally supplied system.  I also liked your comment about the potential power of people like John Oliver really diving into other issues within information policy such as data privacy and therein driving these issues into the foreground.  As I have begun to read the book for next week’s discussion, it certainly seems to confirm that we need more public awareness and discussion of that particular issue of data privacy.

[infoleib-blog]

How Cloud Computing Changes Our Concept of Ownership

The YouTube video on cloud computing gave a solid argument for why this new technology is a major turning point for both computing and the Internet (computing power has become a utility). Something to think about: computing power as a utility creates a lack of permanent tangible ownership over things that are vital to who we are. This can best be illustrated with an example: Take digital music. All of the world’s music basically exists in the cloud now, and as a result, streaming is replacing the mp3 as the way to access music. While I assume there will always be some people who hold out (enough for there to be a market, albeit a small one, for tangible music such as mp3’s, cd’s, cassettes, vinyl, etc.), most people who listen to music will eventually only experience it through streaming. A huge percentage of the population will never own a song that they love.

This by no means needs to be seen in a dystopian light: one can see the cloud as analogous to the Library of Alexandria, a great library where someone can access anything he or she wants. But what happens if all of a sudden a certain thing is removed from this place? We are left with nothing. Case in point, Many PlayStation 4 games that were discontinued through their online portal just disappeared: there was no way to buy a version of the old game (besides buying a PS4 console that had already downloaded the game). This also creates problems for archivists: how do they preserve and explain history, if things can simply just disappear?

On the one hand, the need for ownership has its downsides: it is not particularly efficient, and it can also create a collector mentality that has potentially unhealthy ramifications (i.e. hoarding). There’s something very liberating about not having to own anything. But the downside is that many things that we care about will be increasingly ephemeral. Think about how much of our lives (and of our very identities) has become digitized: our movies, our music, our books, our photographs, our correspondences with friends… the list goes on. If all of these things end up existing solely in the cloud, what happens if they go away? Just because something is in the cloud, it certainly doesn’t mean that the the material will stay there forever. Perhaps there will be backup hard drives to always use as safeguards, but I assume hard drives will become few and far between as we feel that all of our data can effectively be stored on the cloud.

To be fair, the cloud can indeed be seen as a safer alternative to ownership: there’s more chance that your hard drive will crash than your data will get lost in the cloud (For example, if you write a Word doc and save it to your computer, there’s a much higher chance that the data will be lost than if you write the same document in an email and Gmail somehow loses it). However, when the past does not leave a trace through its residue of old and obscure artifacts, then we are left with only what exists now, and therefore it is harder to remember the way something once was.

[hunterk1516]

I think that you raise an interesting point regarding the new questions that the cloud-computing revolution will have on the ideas of ownership and preservation.  Even prior to the rise of cloud computing, digital music was already subject to increased usage restrictions over CDs and prior formats (here is one article I found discussing this), and the cloud seems to only strengthen this trend of weakening the concept of true ownership regarding what we purchase and use.  We are becoming a world of digital apartment tenants, rather than digital homeowners.  In some ways, being a tenant is much easier--much of the work of preservation/upkeep can be offloaded to others, but we lose the expanded freedoms of the homeowner.   With regard to the concept of data preservation that you mention, I find myself thinking somewhat similarly.  I am slightly unsettled by the lack of tangibility of some of our most valued possessions but still understand that perhaps, paradoxically, this lack of materialness may actually help them to persist.

In some ways, I think there this topic has parallels to the discussion being had (in its early stages) regarding autonomous vehicles.  Will traditional car manufacturers succeed in creating self-driving cars that become the new standard for car ownership, or will companies like Uber upend the entire system with their autonomous-vehicle research by creating a “cloud” of ever-available autonomous cars that can be summoned at any moment and that therein reduce the need to even own a car in the first place?  Will the cloud-based (or “utitility”) mindset extend to include so fully the inherently physical activity of transportation?  It will be interesting to see.