Information Policy

[jakethefakesnake-blog]

Internet of Things

I have to say, this book was quite disappointing.  It was more of a pamphlet that aimed at getting across the basic ideas and potential of internet of things, but without delving into any of the issues surrounding it at all.  It did help to draw outlines of all the areas that are being talked about with IOT, but I couldn’t stand how Samuel Greengard would repeat sentences and little writing tics like “To be sure,” and the overall tone of the book felt like a Time magazine article.  I also thought the constant magazine style repeating of certain sentences in the large font was highly cheesy.

The potential of IOT is obviously fascinating to me, of course.  There’s just too many ways in which it can completely change our world. So I’m ok with the book being cheesy because the topic itself is so important.  It’s also in many ways a culmination of our whole course so far:

Interoperability:  all of the promised benefits of IOT are completely dependent on companies, the government and the public agreeing on a set of standards to use with RFID tech.  If there are competing standards, then we’ll have situations where consumers won’t know which of a competing set to buy, and the full set of potential can’t be reached. If we all decide on a suboptimal standard, of course, the sticky effects of lock-in will make it more difficult to eventually change to a better standard later.

Cyber War:  Obviously, Richard Clarke is terrified of IOT.  In his view it’s just one more area for us to be dependent on the network, and therefore more vulnerable to cyber assault. It’s hard to argue with him, because researchers and white hat hackers have already proven that they can access some people’s refrigerators, garage door openers, and even pacemakers.  

ICD4D:  I wonder what it will be like when some countries like the US have completely connected smart homes, every aspect of our lives studied and optimized, and other countries don’t have any IOT tech at all.  Will developing countries try to keep out IOT until they can see what happens with it in the US and Europe?  Will they invite it in without even as much limited protection as we have here?

Data Protection:  Ok, this is the big one.  We can do such amazing things with aggregate data analysis combined with behavioral economics.  We can organize cities in ways that make us happier and less likely to commit crimes, we can combine IOT tech with 3d printing to individualize consumerism, we can completely reform education in a more individual way than we’ve ever imagined.  But holy shit, as it’s currently happening, all of that data will basically just be Samsung’s.  Greengard barely touched on this, he was much more focused on the magical benefits that IOT might bring.  I also thought his examples of hypothetical families in the future were really banal and sort of stupid.  The changes in their lives, like closing the garage door through a smartphone, are completely miniscule and don’t really get at the huge changes that IOT could really bring through data aggregation.

[jakethefakesnake-blog]

Internet and the Developing World

Very interesting report, for a couple of different reasons - it called forth for action steps governments around the world should take, just like a couple of us are doing in our projects, and it assumed that the reader is already a supporter of the Sustainable Development Goals.  That second one is non-trivial, I think.  Probably all of us in the class agree with them as worthy goals for 2030, but it’s not too hard to think of a couple of governments that don’t want to support SDG # 5: Gender Equality, at all (Saudi Arabia, for instance).  And the priority list seems a little off to me, could definitely be argued over.

           I had a couple of real problems with the methodology of the report, especially the ridiculous graph showing the “Business As Usual” path (what does that even mean?) and how it wouldn’t be good enough to achieve the “Sustainable Development Goals” path.  That chart was completely meaningless and there was nothing to back it up.  I also didn’t like how the report called for action steps without any serious mention of the funding required to achieve them.  It’s a major oversimplification of the situation.  If governments spend money on the action steps called for by the report, that means that there is less money to spend on other projects.  Those opportunity costs need to be taken into account.  

           The biggest red flag for me was the potential conflict between SDG #s 7, 11, and 13 and the rest.  The Information and Communication Technology recommendations put forth by the report would, at least in the short term, drastically increase the carbon emissions and other environmental problems of the nations that adopted them.  Sure, the report points out that eventually fast technology sharing leads to increased efficiency in systems.  We’re about at that point in Europe and the United States, where appliances and automobiles are getting ever more efficient.  But there are problems that we haven’t even come close to solving yet, like what in the world are we going to do with these lithium ion batteries that are too toxic to safely put in landfills and that are quickly becoming one of the most ubiquitous items in our waste stream.  

I enjoyed one of the later links, the one to the State Department’s Technology Salon, a lot more. Articles on that page (when I read it) were about African women having access to broadband, and how that can be accomplished.  There was also an advertisement for a talk hosted by Wayan Vota on which medium to invest in for sustainable development, mobile phones or cheap laptops.  The headline, “Mobile Phones vs. Computers: a False ICT4D Choice?” implies that it doesn’t really matter, but I think that’s a straw man argument.  It’s gotta be laptops or desktops all the way, because laptops can be used for creation whereas mobile phones are designed for consumption.  I’m not much of a coder, but I know enough that it would be excrutiating to consider designing any piece of software, or even a web page, on a phone.  Remember that one of the theses of the ICT report is that greater access to communications technology helps everyone through sharing of ideas.  But women in Africa or any other developing region will need to be able to create their own content as well as access others.  To say otherwise, I think, is to risk devaluing their own potential contributions and propping up existing thoughts.

Also!  A little bit of a tangent here, but I thought you all would enjoy reading this article about social media ranking in China:  http://www.newyorker.com/news/daily-comment/how-china-wants-to-rate-its-citizens?intcid=mod-yml

Sample quote:  

   “Alibaba, the world’s biggest online shopping platform, creates an incentive for customers to use its own payment service (also part of Alipay) by raising the Sesame scores of those who do. The company makes no secret of its interest in accessing the payment history of its four hundred million users, to make judgments about their creditworthiness and character. “Someone who plays video games for ten hours a day, for example, would be considered an idle person, and someone who frequently buys diapers would be considered as probably a parent, who on balance is more likely to have a sense of responsibility,” Li Yingyun, Sesame’s technology director, told Caixin, a Chinese magazine. In some ways, Tencent’s credit system goes further, tapping into users’ social networks and mining data about their contacts, for example, in order to determine their social-credit score.”

[jakethefakesnake-blog]

Interesting City of Heroes study

Here’s an article about the study:

http://www.nola.com/news/index.ssf/2009/07/loyola_university_professor_be.html#4226607

And here’s the original published work:

http://static1.1.sqspcdn.com/static/f/280482/3533905/1247015307030/Myers_PlayPunishment_031508.pdf?token=zwPy4x7urfBCVqzwi2jRXpeIvwQ%3D

[aksullyopinions-blog]

The author of this book focuses a lot on the benefits that can come from “aggregating anonymous” data – but this data is mostly coming from cell phones. In today’s society, having access to our cell phone activity is essentially having access to the ins and outs of our daily lives. However, the author seems to frame it as if having access to this cell phone information is really a positive thing. I’m not so convinced.

The author talks about his work on getting a “New Deal on Data” – which I commend because it focuses on the control people should have over our personal data. But he seems to view the cell phone collection as a regulated and essentially solved aspect and the internet a separate one. I don’t think either is a solved topic. As we’ve mentioned in previous classes, there are privacy concerns which are currently being ignored by private corporations and the government. In order to feel comfortable with social physics gaining ground using this type of big data, I’d want more laws and regulations in place to handle the collection and use of this data. I know the author felt that a lot of the collection was harmless and truly anonymous [such as with mapping out traffic congestion from cell phone GPS] – but that’s not that type of data being called for here.

The issue of how the data is collected aside, I think there needs to be a checks and balance on the way the data is handled as well. I think there are a lot of benefits to gain from analyzing this information as the book has highlighted – we now better understand how to work in groups, how to best share ideas from person to person. However, I think even tracking the “sick” can be a slippery slope. In theory, it’s a good idea to map out who has a high chance of being sick and thus reduce their likelihood of spreading the sickness. However, its not hard to imagine this information being abused and used to “punish” those who got sick.

I didn’t expect this book to tie into our “Big Data” topics, but in the end, I think those concerns can be raised here as well. It seems like the big studies that have a solid impact rely solely on Big Data. One of the big concerns we previously discussed with Big Data was how the analysis is performed and the interpretations people make of it. I think those concerns apply to this “social physics” topic when the experiments are rooted in Big Data.

Speaking of the experiments he outlined, I wouldn’t want to be a participant. For me, it felt like too much of an invasion of privacy. Granted I’d be aware of someone watching those aspects of my behavior, it still is unsettling for me to imagine. I’d definitely be opting out of a lot of the monitoring if the authors “New Deal on Data” ever came to be.

In the end, I think social psychics is an interesting topic and can lead to new discoveries about human behavior. At the same time, I’d feel uncomfortable being a participant in the study or having this information collected on me on a daily basis. I’m not sure where that leaves my opinion on the field but I’m curious to see what the future brings – and if it leads to any impact on privacy rights.

[infopolicyanw-blog]

I like that you draw the distinction between aggregated data that is truly harmless/anonymous and aggregated data that can still be exposing and invasive. I can tell there’s a conflict - as researchers and data analysts, people understand that more data is helpful but that there’s still a certain threshold before the populace notices a breach in their privacy. Does aggregation adequately obscure such connections? What kind of information is still extremely revealing?

I would feel the same way - it’d be unsettling to be involved in the experiments. I guess I’d be part of this free-rider problem. The trends and patterns found through such experiments can be utilized by many, including myself, but do I want to give up my private information for such benefits? I’m fine with other people, while kind of selfish/heartless, but it’s unsettling enough I’m skeptical when I’m personally involved. It reminds me of a recent study released about how people would feel if a self-driven car sacrificed its occupants to save a crowd. They were fine with it - as long as they didn’t own and occupy the car themselves. There’s a bit of a difference in comfort between being a part of an experiment for the benefits as opposed to just letting others get involved and still reaping the rewards.

[jakethefakesnake-blog]

I think that one of the interesting things about this course is how much some of the authors have disagreed with each other about factual statements like “data can be anonymized.”  In theory, that’s a testable factual statement, either correct or incorrect, but the field of data analytics seems to be moving so fast that I don’t think anyone knows or can test it easily.  Certainly organizations like Netflix and Yahoo have gotten it wrong in the past, like Bruce Schnier kept pointing out, but here you have Pentland claiming, essentially, that it’s really an engineering/execution problem and not a fundamental issue with data aggregation.  Who knows if he’s right - as I argued in my post, his fancy new openPDS system might be just a day away from being broken by a dataminer, or years.

Personally, I’d be ok with being involved in the experiments, because I’d find comfort in the agreement I signed at the beginning.  My issues are when I don’t knowingly give those rights, as in the Facebook experiments of 2013.

[infopolicyanw-blog]

Social Physics: Hacktivism, Social Media, Crowd.

I am personally conflicted about the book. It’s great it touches on vast data about social media and how communities interact and propagate information, but it felt like a lot of fluff, despite some of the mathematics involved. I actually feel like I spent more time listening to the author talk about his research and activities than the actual “social physics.” I found the extra materials for the module far more interesting and touches upon more diverse subjects under this umbrella of “living laboratories.”

Hacktivism is a touchy subject. The groups and individuals who have hacked for what they deem “moral” reasons may not have the best intentions or the best sense of what exactly is moral. However, it’s hard to be completely upset, in my opinion, when some of the results cast light on otherwise ignored events. “Hacktivism: A Short History” has many examples I remember popping up in the news, but it’s a moral gray area when there are cases such as Anonymous helping expose a shushed rape case. But in cases where they’re not 100% sure, is it okay for them to be pointing out the identities of (warning: disturbing content) some girls chucking puppies into a river and posting such information on public forums? What about when Reddit tried to figure out who the Boston bombers were by scouring social media/released photos, got it wrong, and ended up slandering a kid who was missing and was later found dead? This abuse of social media and this attempt to do good with technical prowess can make matters worse, even with the purest intentions, if there is not enough discretion.

Groups that try to take matters into their own hands are dangerous in that they are vastly unregulated (eg. Anonymous, Reddit, etc.) and when they make a mistake, they are not held responsible. Then again - what about in the rape case when the Anonymous member who revealed the truth got more jail time than the actual rapists?

Perhaps I’m concentrating too much on this one topic, but I find hacktivism to be a constant battle of morality and raises really interesting questions.

[markmgray-blog]

Hacktivism is something that I have heard from both sides of the coin. In the case of the powerless unable to defend themselves against a stronger enemy, hacktivism can help them hit back. On the other hand you have a company, won’t mention on here but I worked with them this summer, that is doing its best to right a wrong, and any interference from a hacktivist group only disrupts the resolution progress. In some cases, said company told me about, hacktivists had broken into some networks that controlled critical aspects of the plant, and were able to destroy it by manipulating the regulators. These types of hacktivism are not moral and have the potential to lead to a loss of life. 

I don’t believe there is a clear moral answer to the question simply because it appears to be more situational and personal. There are some cases that the public eye is needed, and others where shielding people from the public can save their lives. I believe this type of social physics is a more negative one, but has the potential to be helpful under the right circumstances. 

[jakethefakesnake-blog]

Exactly for the example you bring up, Mark, is why I’m against the idea of hacktivism.  There’s no way for the hackers - vigilantes, really - to know the full story of any situation before they try to solve it through illegal means.  The company you mentioned might be doing it’s best, or not, and the hacktivist group has no idea whether any delay in progress is due to malicious intent or simply the slow gears of life.  

If we replace the hacker’s tools with any physical ones like guns or wrenches, it becomes quite clear what they are - vigilantes, hotheads taking the law into their own hands, terrorists, guerilla fighters, etc, depending on their cause.  Very cool to watch movies about, but repugnant in real life.  If they’re not willing to help justice happen through legal means, how will the legal system ever get better?

[jakethefakesnake-blog]

Social Physics

So here’s the first real example that we’ve seen so far in the class of the good side of Big Data.  Previously, our books either were terrified of the potential outcomes (Cyber War, Data & Goliath) or optimistic (Big Data, Yochai Benkler’s book) but they didn’t actually use datasets to solve any problems.  But Social Physics had a ton of interesting insights about the strength and type of interactions between people.

I’m studying complex adaptive systems in another class (remember Emergence?) and love the concept of studying situations in which agents can learn in unpredictable ways, interactions between those agents are nonlinear and cannot be modelled perfectly, and totally new or unpredictable things can emerge from the patterns between those agents.  In the lab, CAS scientists have been able to study the interesting things that can happen in complex adaptive systems by observing ants, or bees, or computer programs.  But humans are obviously a lot more difficult to use for large scale longitudinal studies.  Social Physics describes ways that that study can actually happen.  It’s amazing how difficult it is to design decent experiments in social science, because of all the nonlinear interactions that need to be accounted for, but the biometric data collectors Pentland describes could make experiments faster, cheaper, and easier to design for thousands of subjects at once.

BUT oh man is it creepy given the earlier content of our class.  Alex Pentland is relentlessly optimistic about the potential for data mining to add value to our lives, but the book gave pretty short space to his ideas for securitizing our privacy at the same time.  I guess this is a better question to the techies in our class:  How feasible and realistic is Pentland’s openPDS system?

I don’t have the expertise to really understand how his system works.  He certainly claims that it works, and of course I’m sure it would be an improvement over what we have now, but the only backup that he cites is when several teams from MIT were not able to re identify agents from the data.  Obviously, that’s not the most reassuring information, because we have no idea how and what methods they used, how hard they tried, or what their incentives were for success.  After all, Yahoo thought that their data was anonymized when they released millions of records in 2003, and they were proven wrong when researchers reidentified users within days.  Netflix thought so as well in 2008, and The New York Times reidentified a woman before the end of the week.  If we put the data from the openPDS studies out on the Web for companies to study, I’d bet a bunch of money that someone would re identify someone before the end of the month - and if Alex Pentland (who obviously knows a lot more than me about this) really believes that that wouldn’t happen, he needs to do a better job explaining why.

Like I said, I’m sure it’s preferable to what we have now, where companies barely even have to try to re identify us, and we don’t even get the full benefit of the potential for scientific research that has Alex Pentland salivating.  

[jakethefakesnake-blog]

China Unable To Recruit Hackers Fast Enough To Keep Up With Vulnerabilities In U.S. Security Systems

BEIJING—Despite devoting countless resources toward rectifying the issue, Chinese government officials announced Monday that the country has struggled to recruit hackers fast enough to keep pace with vulnerabilities in U.S. security systems.

Thought this was amusing and relevant given last week’s topic.

[hunterk1516]

Where Do We Go From Here?

In The Global War for Internet Governance, Laura DeNardis outlines many of the complex policy issues that surround charting a path forward for the Internet.  These questions involve a diverse set of actors and require us to think not only about how the actions that we take will affect technologically developed nations but also those parts of the world with less mature network infrastructure.  Perhaps because I come from a computer science background, I appreciated the fact that the author delved into the technical details of these issues in a substantial manner, and I believe the author did a good job of overviewing in a balanced manner various policies that could be implemented.

I enjoyed reading early in the book about “critical Internet resources” and how they are managed and distributed.   Having taken a couple of networking classes in the past, I was already familiar with some of the basics of how DNS resolution is performed and how IP addresses function, but some of the technical detail was new to me, especially those details that occurred at a more macro level.  For instance, Autonomous System Numbers (ASNs) were an unfamiliar concept to me (even though they probably shouldn’t have been, given their importance).  I also appreciated the discussion of how ICANN, top-level domain operators, and other actors cooperate to provide a functional Internet, and more specifically, it was interesting to hear about the particular ways in which the United States (through the Department of Commerce) has held on to its historical governance role by use of the intermediary of ICANN.  I had read of the current tension in which other nations are pressuring for less U.S. influence over the Internet, but I never fully understood what this entailed.  At this point, I’m not exactly sure where I fall on the question of whether the United States should abandon its privileged role in Internet governance.  It makes a lot of sense that a truly global phenomenon should be managed by such an organization as the United Nations, but on the other hand, it doesn’t appear to me that the Internet has been hindered by this loose American oversight.  Consequently, I’m not sure if I see a burning need to destabilize the status quo; however, I recognize that if I were a citizen of a different nation I might see things differently.

As the book described how standards and protocols for the Internet have come to be, it highlighted the fact that the Internet Engineering Task Force (IETF) and the World Wide Web Consortium (W3C), which are crucial for the ongoing success of the Internet and the web, respectively, operate in a very “bottom-up” manner in which openness and voluntary contribution by members are key.  This is still somewhat remarkable to me that such a distributed process can have such successful results, and it’s this sort of result that makes me very hesitant to bring governmental (or UN) influence into considerations of Internet architecture.  For instance, one topic that the author addresses is how peering and transit agreements come into being between various network providers.  DeNardis makes the case that the well-established networks operated by Tier 1 providers have little to no reason to interconnect with newer, smaller networks on the basis of settlement-free peering agreements despite the fact that interconnecting might be the most sensible action from an overall technical perspective.  While I understand that governments need to perform some oversight and regulation of a utility-like structure such as the Internet, I think that in a case such as this I would be more inclined to let the free market decide the result rather than having a government issue some mandate for peering.  

Toward the end of the book, the author focused on the ways in which Internet governance can be made a tool for questionable purposes.  One specific technique that she mentioned was deep packet inspection (DPI) and how it may be used to control the type of content that passes through a network, such as is the goal when a government is wanting to censor its citizens.  Given the discussion in last week’s book regarding the potentiality of installing a real-time, wide-reaching DPI system across the the Internet backbone in the U.S., this mention by the author certainly provides a moment for pause and reflection about the potential implications of that action.  While I still feel that the idea of DPI for cyber-defense makes a lot of sense, I believe this section in The Global War for Internet Governance should remind us that we would need to be extremely cautious if such a system were to be implemented.  An abundance of transparency, checks, balances, and accountability would be absolutely essential. The potential for “mission creep” would be very real, and personally, I’m not even quite sure where exactly I would draw the line of acceptable vs. unacceptable use of such a system.  I don’t want Big Brother, but I do want adequate protection from cybercrime and cyberwarfare.  Striking that proper balance would be a difficult challenge, just as is the case for many of the issues lying in the realm of Internet governance.

[jakethefakesnake-blog]

I agree with you with regard to continuing to give the free market leeway in coming up with most of the protocols and architecture of the Web.  It’s been a success story in most areas, but with the obvious exception of physical infrastructure, where last mile access is usually dominated by market monopolies or duopolies.  That’s the only area that gives me pause.  However, the large scale shift to a lot of computing capability over mobile and satellite connections is reassuring, as those services tend to be a lot more competitive.

I would still be ok with a widereaching DPI system, because security of not just physical electrical infrastructure but financial and privacy as well is important.  I would trust the government with my data with a DPI system, if that system substantially reduced the risk of a criminal network hacking into my data instead.

[markmgray-blog]

Global Domination of Internet Policy

I found The Global War for Internet Governance to be very informative as to how the internet works and the different protocols that make it interoperable. The book also mentions how the internet was originally not interoperable, and consisted primarily or proprietary network protocols that required companies to purchase specific products to ensure interop within their network. This gave rise to the need to have a standard TCP/IP protocol that would allow all devices to communicate with one another. I mentioned in my previous week that currently we are on the IPv4 standard and this supports a 32 bit address space. The book mentions, like I did, that the rate at which the internet is expanding we will inevitably exhaust the 4 billion IP addresses we currently have. They also mention the slow adoption of IPv6 that was supposed to be completed several years back. With this foundation the book was able to go into more depth about the privacy and governing issues that the internet has spawned.

Being international it is hard to say who should ‘control’ the internet. One could argue that the US should have this power due to its creation and vast explosion of use there. Would that then mean that other governments would be subject to the US policies about how the internet should operate? This is not the case though, countries maintain their own connections to the internet and maintain the availability within their own nation-states. This creates the issues as to when are governments able to cut off their citizens’ communication with the rest of the internet? Should governments be allowed to have such control? The book gives examples of San Francisco’s BART blocking protestors cell service to avoid a riot. This gave rise to more outrage over the blocking of communication by a regulator. I personally believe that the internet and the interop that we receive through it are good things and that allowing companies the ability to block these communications is wrong. However, expanding it to the government is a little more complicated. I find myself torn between agreeing with it in the event of a national crisis, and being against it due to the possibility of privacy concerns.

It appeared to me as though each government had its own policies in place for the internet and that they self regulate themselves. In class many of us have advocated for a detailed information policy that would intern affect the internet as well and when we hear of cases like Egypt’s internet blackout we are outraged that that is even a possibility. Should we be careful in forcing our western views on foreign countries? Should the US and its private non-profit internet managing companies be able to create policies that all internet users should follow? I don’t believe these are easy questions to answer and I don’t have a definitive answer myself. I am eager to hear other views on the matter as I believe there will be a vast array of differences.

[jakethefakesnake-blog]

I’m generally ok with government having more control over internet usage - planned outages in the case of riots, deep packet inspection for viruses, etc - as long as these controls are made according to the rule of law.  I’m always worried about executive branch overstepping boundaries without congressional or judicial approval.

That may seem like a trivial aspect, but I don’t think it is.  Once a judge agrees to a warrant for DPI, for instance, that agreement is part of the public record.  Journalists can access the warrant request and let the public know.

Basically, my conceptual stance can be summed up as:  if government is going to place constraints or surveillance on the free and open internet, let that constraint or surveillance be known as freely and openly as possible.

[jakethefakesnake-blog]

The Global War for Internet Governance

As I first started reading this dense, technical book, I wondered why Professor Newell had waited until this week to assign it.  It seems like the type of fact based book that would have been crucial to understanding the “Code is Law” type of discussions we read.  But reading it after Richard Clarke’s Cyber War was actually perfect.  I kept relating every technical detail I read to ways that Clarke would plan to attack it.

When DeNardis described the differences between the Tier 1, 2, and 3 traditional (and outdated) classifications, I just remembered how each of the exchange points between them are both potential weaknesses of the system (for logic bombs that could disable the connection entirely) as well as spots for defense (by using the exchange points as borders to perform deep packet inspection, as Clarke outlined in his plan for cyber defense).

Also, when I read about the CDN networks, which were slightly familiar to me because of general knowledge about how Google manages to search so quickly across the world, I realized that CDNs are making distributed denial of service attacks more difficult.  If a hacker wants to attack a public site with a DDOS, the CDN mirroring that site will simply mean that correspondingly more computers and routing requests will be necessary to take it down.  If CDNs are growing over time, and especially if they are following the same exponential growth rate as transistors or other data areas (the book didn’t elaborate, but it seems likely), then eventually DDOS attacks will become more and more impractical and difficult to pull off without serious resources (or a highly successful worm).  This will reduce the likelihood of those attacks until they are just the domain of governments or elite hacking groups.

The discussion of the physical nature of the internet also helped me put corporate internet control in perspective.  When content providers like Facebook or Google are used, they not only control the virtual website but also (through IXP connection) actually own membership in the internet routing itself.  That’s a very different concept than the pure content provider role I had had them slotted in my mind.  

I don’t agree with all of DeNardis’s assertions, especially regarding internet freedom in her conclusion.  It seemed like she was expecting too much what is, after all, only a neutral medium of information.  She wrote in the last paragraph of the book:  “From a global 21st century perspective, Internet freedom is not yet achieved.  The same exact technologies that increase possibilities for economic and communicative freedom are also used by governments and private industry to restrict those freedoms.”  

Honestly though, what was she expecting?  Print media has been used to help information spread as well as propaganda.  Television brought the world closer and has also furthered institutional racism and sexism.  Radio ushered in new eras of music and also is used to broadcast blatant lies in North Korea.  Any information medium could have been substituted for “Internet” in the above quote and the sentence would have worked.  It just seemed to me that DeNardis was lamenting that the Internet didn’t get to the utopian ideals hoped for by early Internet thinkers we discussed in the beginning of the semester, and the emotion and idealism was at odds with the dispassionate breakdown approach exemplified by the rest of her book.

[markmgray-blog]

Cyber War and the “Internet of Weapons”

Actual website: http://map.norsecorp.com/

I am proposing that we rename the “Internet of Everything” to the “Internet of Weapons.” After reading Cyber War by Clarke and Knake I can see this high level of interop resulting in various new vectors of attack. To backup my claim I want to cover some history of TCP/IP, specifically IPv4 our current routing system. IPv4 uses a 32-bit addressing schema to generate IP address for routing traffic all over the world. A 32-bit address space gives us 2^32 IP addresses to utilize. This means there are exactly 4,294,967,296 addresses to be used world wide. That sounds like an extremely large number. However, currently there 7.125 billion people on earth, close to doubling the number of IP addresses. Today there are 2 billion smartphones in circulation, and each of these has the ability to tie up 1 address. That is already half of the address space. You may be thinking, “so what, how does this turn connected homes into weapons?” In short, it doesn’t! The premise here is that creating an interconnected home will undoubtedly (at our current pace) exhaust our remaining address space. Ok, so we are going to run out of addresses for all of our devices what is the solution?

IPv6 is the latest version of the internet protocol (IP) and with it a whole new playground for cyber warfare. IPv6 supports a 128-bit addressing space (2^128 addresses) which is more than enough to support the internet’s infrastructure for the foreseeable future. Why do I state that it will open up new attack vectors in the word? Simply because it is new (in practice) and has not undergone the rigorous exploit attempts that have been performed on IPv4 since its beginning. IPv4 has been subject to many different exploits including the Ping of Death, DDOS, and system specific packet exploits. The ability to perform each of these attacks has been documented and in many cases there are firewalls in place to prevent them from happening again. In the “Ping of Death” attack a packet exceeding the 64 kilobytes of allowed data is sent to the destination server and causes the system to crash due to an overflow exception. This has subsequently been fixed in all known operating systems that were affected. This attack was crafted to target the Internet Protocol being used by the destination host. Thus moving to an entirely new system that has not been tested throughly will allow for these types of exploits to arise again. New systems come with new exploits and what these are we’ll just have to wait and see. It is not a far cry to imagine these exploits giving control of your connected house to a malicious user and thus causing the “Internet of Weapons.”

I want to comment specifically on one part of the book, that is when the author describes his vision of what a cyber attack would look like on a national scale. He describes trains running into each other, and power grids shutting down. These are not unlikely given an on-site hacker or intruder, but many of these systems are not connected directly to the internet. This is a common misconception and any company that has security as a relative thought creates separate networks within their company that many times do not talk. I worked for BP in their Digital Security and Counter Threat Unit over the summer and learned that all of their critical systems are behind strict security and do not have access to the internet. These systems require on-site users to operate, enable, and disable them. There are other ways that these can be infected, such as exploits in the applications, operating system vulnerabilities, and even unintentional installation of malware. It is not as simple as a hacker in Russia pressing a few keys in a terminal and disabling the entire Eastern seaboard. I can however see the Internet of Things giving hackers a way to simulate a power grid failure without actually disrupting power by taking control of home systems and rendering them inoperable on a large scale.

[infoleib-blog]

I am very happy to hear that most of the crucial infrastructure we worry about is completely unconnected from the Internet for security reasons. That said, you bring up a really good point about the Internet of Things and the danger it poses. While we have not reached the “Internet of Things” unit yet, I wonder if it is really as inevitable as we say it is given that there are so many inherent security risks (not to mention privacy risks). More simply, will it be embraced as something where the good outweighs the bad, will it not be widely adopted due to reasonable fears, or will there be something in between?

It is interesting that in our quest to make things efficient, we often times also make things more vulnerable. That said, redundancy can be employed as a safeguard to make a system more rugged, but it also obviously can make a system less efficient as well.

Your comments about IPv6 make me hope that a lot of people are trying to rectify this, but I guess there is only so much that can be done under a short time frame where we had to switch over quite quickly because we simply ran out of IP addresses.

[jakethefakesnake-blog]

Hasn’t IPv6 been around since the 1990′s?  By “around”, I don’t mean widespread, but it has been available and certain entities have been using it (often along with IPv4) for twenty years.  https://en.wikipedia.org/wiki/IPv6 

That gives me a lot more hope that a significant amount of security associated with the system is already well established.  According to wikipedia (yes, I know),  “ IPv6 has been implemented on all major operating systems in use in commercial, business, and home consumer environments.”  So sure there will be new and scary exploits, but it wouldn’t be the all at once new technology you imply.

I do agree with your larger point about IoT technology opening us up for much more vulnerability.  Not sure about policy regarding it, but in my personal life I’ll be taking it slow with that particular tech adoption.

Also, INCREDIBLE WEBSITE MARK!  That blew my mind.

[infoleib-blog]

Cyber War: Who should we be scared of?

Clarke’s book on cyber warfare is one of my favorite readings for the class so far. It was written in 2010, so obviously I assume a lot has changed since the book was written. That said, I still think the book is very relevant. What struck me more than anything was Clarke’s insistence that although the Internet makes it very easy for a “lone wolf” to do a lot of damage, these are not the people we should be worrying about the most. Rather, we should be concerned about other countries that are not our closest allies. I wonder how much has changed since he published this book 5 years ago (many of the updates I assume are classified), but I will address his concerns assuming that other countries are the biggest threat.

If we are to assume that countries remain the biggest threat on the cyber warfare front, whom should we truly be afraid of? Clarke discusses several countries that he is concerned about: China, Russia, Iran, and North Korea. I will discuss each of these nations in turn. First, to our more clear “enemies”: Iran and North Korea. I simply do not believe that Iran is capable of conducting a high level attack at this time. Furthermore, while the Iranian government has hateful rhetoric to the U.S. government, I also believe they are actually much more rational behind the scenes, and they see no reason to instigate a confrontation with America. It is important to note that Iran is traditionally not an “offensive” country in the sense that it almost never begins wars with other countries (although it promises extreme retribution if another country attacks it). As long as we do not attack Iran, I do not see them as a significant threat.

North Korea, on the other hand is much more unpredictable. In fact their dictatorship relies on it. Because other countries do not view North Korea as a rational actor, it is harder for these other countries to employ effective strategies to deal with North Korea. That said, North Korea is one of the poorest countries in the world. I think they would much rather steal intellectual property from the United States and sell it on the black market instead of trying to attack our country. The one threat I do see from North Korea is this: they could (and most likely do) steal military secrets from us in order to sell them to more powerful countries such as Russia or China.

Although China is often seen as one of the main traditional military threats to America, I simply do not agree with this notion. Our two countries are two economically interdependent for China to ever see it in its best interest to fight a war with us. Thus, economic interdependence can be a major method of stabilization between two countries. I assume China will continue to steal intellectual property from us, but I do not see them instigating an actual cyber war with us.

Out of the four main countries that Clarke discussed, I see Russia as being the biggest threat to America in terms of cyber warfare. Russia is a once powerful nation that has been in rapid decline over the past few decades, and it has not taken this decline well. Understandably, it is humiliating for a once great power to realize that they are not as powerful as they once were. However, Russia does still have a very strong military, and it has increasingly asserted its dominance in the Eurasian region over the past ten years (engaging in wars with local states and taking a more antagonistic doctrine on the world stage in general). I do believe that Russia is not suicidal, but they are still a country that could escalate a cyber war with America due to deep distrust and misunderstanding between the two nations, an increasingly antagonistic Russian foreign policy, and not enough economic interdependence to act as a major deterrent.

While I am hopeful that America (and the rest of the world) can devise safeguards in order for the worst-case cyber war scenarios to ever manifest, I also found Clarke’s book to be incredibly frightening, and it made me realize that perhaps cyber warfare is one of the biggest threats to our nation’s safety.

[jakethefakesnake-blog]

I think your view of China being too economically interrelated with us for cyber war is a little simplistic.  Clarke’s point wasn’t just that China might beat us in an actual cyber war or battle, but also that the balance of power between the two countries has shifted since cyber war became a valid method of defense/offense.  We have negotiations with China (and other countries) all the time: on trade relations, on the portion of national debt they hold, on intellectual property, and for decades, an unspoken part of those negotiations has always been the United States’s unparalleled military dominance.  (As a pacifist, I don’t necessarily like that about us, but there’s no denying that it plays a soft power role in every foreign policy interaction we have).  Clarke’s point that China has prepared more thoroughly than us on aspects of cyber warfare simply takes away a little more of that soft power.

I don’t see it ever leading to warfare; I see it leading to some corresponding negotiation in the future going a little less the way we want it: maybe an exchange rate set a tenth of a yuan higher or lower than before, maybe a poorer outcome for one of our allies like in Clarke’s Vietnam example.  Over time, that stuff adds up, and if it’s avoidable through a decent cyber defense policy, we should set that policy.

[jakethefakesnake-blog]

Cyber War

Well, this book was absolutely terrifying.  I’ve known since the start of class that I’m a technical dummy compared with most of you (my background is in nonprofit education) but it’s hitting home just how much I don’t know.  

Fittingly, I was reading the section where Clarke outlines the potential destruction of a cyber war while flying on a plane to Washington, DC last week.  The sentence “Aircraft are literally falling out of the sky as a result of midair collisions across the country” wasn’t much fun to read in that scenario.  

At first, the book seems to outline something very different than the information policy topics so far. Security is something endorsed and at least given lip service by the federal government, and its not like we really need a policy change there, right?  Just execution problems.  But then Clarke made clear how the distributed nature of the internet, and how especially the server farm nature of cloud computing, means that we can’t afford to let companies just decide for themselves how important to take security. Problems with one company’s systems can quickly be used to launch ddos attacks on many others.

From a policy standpoint, utility companies should be easy to mandate security for, since they are already highly regulated.  Ditto for transportation and other “critical infrastructure” companies like banks and health care.  But the more politically difficult targets will be the large private retailers – not even Amazon, but traditional brick and mortar stores like Staples or JC Penney. Those stores don’t have expertise or core competence in online operations, but have added them in piecemeal over time.  In addition, they’ll have a fiercest defenders from free market and no government advocates, since there was little regulation in those industries previously.

I quibbled with Richard Clarke in an important area of the United States’ cyber warfare fitness, though. While pointing out that our lead in cyber offense is more than counteracted by our high dependency and low rank for defense, he advocated strengthening defense because “It is impossible to reduce our dependence on networked systems at this point.”  That just seems wrong and a little last decade-y. Recently, there has been a movement among young people towards self-sufficiency, including back to the land efforts like farming or community gardens as well as a growing push to rooftop solar.  If a sizable percentage of residential homes can generate their own electricity without relying on utilities at all, wouldn’t that be a reduction in our network dependency?  Likewise, isn’t a community garden a (tiny) example of a helpful stopgap measure in the case of cyber war?  Both of those examples are not at scale, of course, but they point to another way to defend ourselves in addition to increasing defenses.   Those unplugging efforts could take place at the institutional or corporate level as well. For instance, train and plane companies could have manual override functions just in case things go horribly wrong with the computers (it’s crazy to me that they already don’t).  It should be relatively easy to build these options in, since they are lower tech and cheaper than the automated alternatives.

[infopolicyanw-blog]

Interop: The Promise and Perils of Highly Interconnected Systems

Standardization is extremely important. When companies, entities, etc. can agree on a standard, the system itself expands as its network isn’t bound by a conflict amongst pieces. However, as the book mentions, connectivity can be overwhelming. A lot of data flows through these systems and introduces vulnerabilities.

In other situations, having better connectivity can be efficient and useful. For example, I was able to go to the Consumer Electronic Show in January 2015 and saw huge systems, touting the Internet of Everything idea. Qualcomm, Intel, LG, and GE were all advertising their newest tech that involved connecting to your phone, your other appliances, etc. Lowe’s had a huge display which was literally a house built inside the convention hall. They had a system that interconnected almost everything in the home. It was overwhelming, a bit reminiscent of Skynet, but still the innovation was exciting. However, Lowe’s does not work with Qualcomm’s, Intel’s does not work with LG, and so on. Therefore, while their own proprietary systems have a large amount of connectivity and interoperability amongst themselves, they do not have it amongst the different companies. It makes it a huge risk, therefore, to adopt one company’s system when it may go out of business or doesn’t get updated if a competitor is doing better in the market. However, if users were able to connect the different company’s pieces, it wouldn’t be such a risk.

I find the case studies to be quite interesting. They touch on various innovations that we take for granted and how standardization affected its development and adoption. How many amazing ideas were crafted and were subsequently dropped because they didn’t tap into the benefits of interoperability? Then again, how many products felt forced into a standard to be adopted by consumers?

[jakethefakesnake-blog]

The interesting potential here is for companies to ignore interoperability with each other, and just focus on interoperability with smartphones or PCs as the central hub in the home.  That’s something that I wish the book had touched on more - sometimes systems are better off with one universal interop standard, and everything else can connect to that instead of each other.  English has emerged as the language of the business world because someone from Germany and someone from Manila can communicate with each other using English as the common bridge.  

Phones are quickly becoming that area for a lot of functions.  In the house example, if you had half Lowes and half Intel devices, you would have to use two different apps to control them...but it wouldn’t be long before a third party simply created a managing platform to put them both on the same screen.  

[hunterk1516]

An Interconnected World

Throughout Interop: The Promise and Perils of Highly Interconnected Systems, the authors do a solid job of demonstrating the importance, challenges, and nuance that the concept of interoperability entails in today’s world.  For me, interoperability is one of those ideas that seems so foundational that I don’t often think about it until its absence affects me negatively. Therefore, it was interesting to see the authors be able to form such a detailed treatment of the topic.  In their discussion, the authors discuss interoperability, or interop, from the perspectives of data and technology, which is what someone like me from a computer-science background is likely to think of first, but they also extend this discussion to a higher level in pointing out the human and institutional layers that interoperability also encompasses.  This holistic view of interop does a good job of framing the discussion, and I appreciated the respect that the authors gave to the idea that the highest amount of interop is not necessarily the optimum amount of interop—their more nuanced view of the concept seems both correct and more challenging.

Throughout the book, the authors make use of a number of examples to show both the current ways in which society utilizes interoperable systems and how the concept may be applied in the future.  One such example that I find particularly interesting is that of the air traffic control system.  The enormous complexity of this global system is incredible to me, and I was surprised to learn that a universal language for the world’s air traffic controllers (English) had been only implemented in the past decade.  It was also interesting (and slightly disappointing) to hear that a much-improved system is conceivable but that the “lock-in” effect stymies that possibility.  As can be seen in this example, the book does not avoid the difficult questions about the potential drawbacks of interop, in this case the ‘lock-in’ effect.  The authors also address the potential threats to security and privacy that interoperability can represent, but they make the case that these dangers can be managed effectively.  I thought that their example of ATMs being highly interoperable among different banks yet still very secure backed up this claim well.

A forward-looking example that the authors explored was that of how to preserve digital texts into the future and avoid knowledge becoming lost or inaccessible due to technological compatibility issues.  Like the concept of interoperability itself, this seems like one of those issues that isn’t often at the foreground of the conversion but could nevertheless have very negative consequences if it were not addressed appropriately.  I liked the authors’ idea of creating central repositories that house books in a flexible, open, and agreed-upon format, and as the authors suggested, this seems like a great job for the Library of Congress.  It seems like there would be so little barrier to publishers giving, at the very simplest, an ASCII-based version of their books (at least those written in English) to such an entity as the Library of Congress—even if a promise had to be made that such books would not be made available to the public in their current simplified forms.  At the very least, a more all-encompassing digital archive could begin to be amassed, even if it were left to the future to decide exactly how to utilize it.  One interesting note is that while the authors mention the current Internet Archive project, they state that they don’t view it as fulfilling the full archiving function that is needed in the digital world.  I visited this organization’s website, and their collection of “text” documents has grown significantly over the past few years—approaching 10 million as of 2013.

While the book does a good job of overviewing many interoperability-related issues, one other such issue that I find intriguing is that of vehicle-to-vehicle communication.  I find all of the talk about self-driving cars to be fascinating, and vehicle-to-vehicle (V2V) communication is often discussed along with that topic, so I decided to do a little browsing and see the current state of V2V communication.  Essentially, V2V communication would enable vehicles to communicate crucial information like location and speed with nearby vehicles (see here for more information).  Consequently, vehicles become more aware of their surroundings and are therefore better prepared to sense danger and keep their occupants safe.  This is both an excellent example of a technology for which a powerful “network effect” would exist (as described in the article linked to above) and a technology for which interoperability among the signals emitted by cars from various manufacturers will be crucial.  The government is very much behind this effort, so hopefully this technology will be widely deployed before long!

What are some other interoperability issues that you see society needing to address in the near future?

[jakethefakesnake-blog]

See, I disagreed with the book about the necessity of choosing a standard for compatibility in e-books.  The central example of why it was important - the straw man argument of the information buried in 3.5 inch floppies being inaccessible - was just not thought through so well.  It’s actually quite easy to get information from floppies, an external floppy drive with a usb input can be bought for twenty bucks.

The same argument holds for backwards compatibility with e-readers.  The book was describing how difficult it is to get apple and kindle devices to sync...but it was again using straw man arguments.  It’s difficult to get an apple ebook to play on the kindle device itself, but all current types of ebook publications can be easily read or standardized on a PC.  There is no need to spend large amounts of public money on ereader compability when there will be and already are easily usable conversion programs for books, emulators for old video games, external converters for old storage programs, etc.

[jakethefakesnake-blog]

Interoperability

The amazing thing about this topic is how easy it is to relate most examples to our own lives.  Just in the past week I’ve dealt with frustrations resulting from lack of interoperability between institutions (different schedules for McCombs and LBJ), between software (upgrading from Windows 7 to 10), and between legal systems (getting my Chinese Visa for studying in Shanghai this spring).  It made reading the book a personally understandable and rewarding experience.  And I’m sure I’m not the only one who was thinking of this classic the whole time reading the book:

 For me, I think the security and stability issues associated with interoperability are overblown.  I cast my lot pretty firmly with the “more interoperability is usually better” crowd. Why?  Because it has already been strongly demonstrated that, at least in the realm of cyber networks, hackers can fairly easily jump between different networks whether or not they were designed to work together or not.  A computer science classmate of mine in another class, Vismay, told me about the first automatic translator for code.  That means that programs written in different software languages will soon be able to be translated to another language.  In normal speech, as we already learned in Big Data, self learning algorithms have workable instant translations for dozens of languages already, and they’re working on hundreds.  So our world is rapidly getting more and more connected in most ways.  It’s not a case of whether we’ll make systems more interoperable, it’s how.

So why doesn’t that bother me in terms of security and stability?  Because security problems exist whether or not systems are compatible.  I’m jumping ahead a little bit here, but Richard Clarke describes some pretty serious doomsday scenarios in his book Cyberwar (that we read next week), and the interoperability between systems seems to be child’s play compared to the coordinated attacks possible in cyberwarfare.  Basically, anything connected to the internet in any way is vulnerable, no matter what.  Clarke says: “The only way in which [cyber experts] were able to prevent their network from being pillaged was to disconnect the organization from the internet…If you are connected to the Internet in any way, it seems, your data is already gone.”  Well guess what.  Most of our critical infrastructure is already connected to the internet, and I’m not sure any more connections would make a difference.

I might seem to be exhibiting a case of what Alyssa called learned helplessness, where the problem is so complicated that I can’t bring myself to care.

And sure, I do have a bit of that.  But I also think that the more coordinated our systems are, the more we can actually defend from attacks.  Our institutional systems are not unprotected because of their compatibility with other systems, they are unprotected because no one bothers to protect most of them.  At least if we really start connecting our systems (like in the smart grid case or health care) there might be enough attention paid to the staggering dangers of security breaches that we at least start to prioritize security on a large scale.

E

[lavieenlinternet]

Talking about Goliath here

Any other T-Mobile customers out here who were vulnerable in this attack? I can at least sort of appreciate the timing coinciding with reading this book and writing this blog.

At the end of Data and Goliath Schneier proposes solutions addressing the federal government, private corporations, and us as citizens. He writes a very simple clear directive that spurred many policy analyst thoughts inside my brain:

When addressing the government:

I whole-heartedly agree with educating more members of Congress on tech issues – this is an area where true expertise is lacking and currently the Open Technology Institute is instituting a fellowship program that will serve this technological famine. I think this will lead to smarter, more involved deliberations in the Congress regarding all things technological – which, in turn will lead to more intentional congressional oversight of the NSA. I do think though, and Schneier addresses this somewhat in the citizens chapter that cyber laws won’t be pushed through the Congress until it’s something appealing enough that we the citizens want to hold our legislators accountable for. It’s a topic that needs to be brought up in every political campaign because it’s so pervasive in our lives as the entire book points out. The glamorous issues – the ones that attract public attention and gain public support– currently toe the ideological line. The congressional branch has authority over the executive branch in many ways – and striking down executive orders is among them. Once this becomes an important enough issue in the Congress I think it will affect the executive branch in most of the ways Schneier is clamoring for.

I like Schneier’s idea of separating the duties of the NSA into separate agencies. However, without a strong executive president and buy-in from each agency’s leadership this will likely prove to be an administrative disaster. Successful implementation of this plan will require more than just citizen and congressional support. Someone call in the most successful public managers and consultants!!

When addressing the citizens:

I personally disliked that “advocate for political change” was not the very first part of this section. In my opinion, this is the most important thing we can do as scholars, military members, and citizens. Period. If we decide this is something we care about, that everyone cares about, and we demand something get done you’ll start to see change. It’s a great time to start these conversations with the upcoming 2016 election (and not just for the presidency either).

 Instead, the very first thing mentioned in this chapter is how to avoid/block surveillance patterns. To me, this mirrors advice and commentary found in sexual assault conversations that are framed on making victims (or potential victims) responsible for what happens. I shouldn’t be told what kind of clothes to wear or how I might subconsciously act to invite unwanted advances and I shouldn’t have to waste time adding extra google searches, borrowing neighbors’ loyalty cards, or any of the other suggested methods. The responsibility I have is to decide with my fellow data producers how we want our data to be stored, secured, and used – and demand it from corporations and government representatives. I don’t mind this as an included section, but I’m a little offended it’s the first thing Schneier suggests I do as a private citizen. Yes means yes – in data collection and in the bedroom.

[aksullyopinions-blog]

I completely agree that the book could have addressed the “what can we do as citizens” section much better. I did not make the sexual assault conversation connector though. For me, it just read as trying to work around the problem without actually addressing the problem. I don’t see how it can really solve anything. Already, we are seeing how companies are trying to work around adblockers by trying to get laws passed to prevent their use. Recently, a big adblock software switched hands and now will have aids that companies can pay to have pass their filter. If a tool is stopping the government or a company for collecting information in bulk, they are naturally going to look for a way around it. And if they find one, then a new tool will need to be developed that circumvents the efforts of those trying to collect information - starting the cycle all over again. 

Meanwhile, in comparison, calling for political action is downplayed. But if we really want to restrict the current level of surveillance, then we will need the law makers on our side. The only way to get that done, is to generate enough public awareness for the issue that there is pressure on law makers. A lot of the companies that actively engage in bulk collection of data also lobby/throw money at congress. Citizens aren’t going to match the monetary incentives companies provide, but we can chose to elect someone else. Yet, no congressman is going to feel that pressure over the issue of internet privacy when most people either don’t know or aren’t engaging politically over the issue. So I agree, I’d love to see internet privacy become one of the topics for the 2016 election - but 

[jakethefakesnake-blog]

I felt the same disgust you felt, lavieenlinternet, about the victim blaming that Schneier engages in near the end of the book.  The idea of searching for random people on facebook as some kind of “defense” against surveillance didn’t really make any sense.  Overall, he framed the lack of privacy characterizing our current system a little too much like a battle and not enough like an economic system for me.  

That’s not to mention that the kind of tactics he wrote about - refraining from using Google Calendar, for instance - are practically useless according to his own anecdotes earlier in the book.  He wrote about unbelievable feats of data mining resulting from things like anonymized Netflix data or the scrubbed AOL data in the mid 2000′s, and all the things companies can find out from our email accounts.  Compared with that, refraining from using an online calendar seems like the worst sort of advice:  meaningless while still making it seem like the action makes any difference.