Info Policy

[infopolicyanw-blog]

Social Physics: Hacktivism, Social Media, Crowd.

I am personally conflicted about the book. It’s great it touches on vast data about social media and how communities interact and propagate information, but it felt like a lot of fluff, despite some of the mathematics involved. I actually feel like I spent more time listening to the author talk about his research and activities than the actual “social physics.” I found the extra materials for the module far more interesting and touches upon more diverse subjects under this umbrella of “living laboratories.”

Hacktivism is a touchy subject. The groups and individuals who have hacked for what they deem “moral” reasons may not have the best intentions or the best sense of what exactly is moral. However, it’s hard to be completely upset, in my opinion, when some of the results cast light on otherwise ignored events. “Hacktivism: A Short History” has many examples I remember popping up in the news, but it’s a moral gray area when there are cases such as Anonymous helping expose a shushed rape case. But in cases where they’re not 100% sure, is it okay for them to be pointing out the identities of (warning: disturbing content) some girls chucking puppies into a river and posting such information on public forums? What about when Reddit tried to figure out who the Boston bombers were by scouring social media/released photos, got it wrong, and ended up slandering a kid who was missing and was later found dead? This abuse of social media and this attempt to do good with technical prowess can make matters worse, even with the purest intentions, if there is not enough discretion.

Groups that try to take matters into their own hands are dangerous in that they are vastly unregulated (eg. Anonymous, Reddit, etc.) and when they make a mistake, they are not held responsible. Then again - what about in the rape case when the Anonymous member who revealed the truth got more jail time than the actual rapists?

Perhaps I’m concentrating too much on this one topic, but I find hacktivism to be a constant battle of morality and raises really interesting questions.

[markmgray-blog]

Hacktivism is something that I have heard from both sides of the coin. In the case of the powerless unable to defend themselves against a stronger enemy, hacktivism can help them hit back. On the other hand you have a company, won’t mention on here but I worked with them this summer, that is doing its best to right a wrong, and any interference from a hacktivist group only disrupts the resolution progress. In some cases, said company told me about, hacktivists had broken into some networks that controlled critical aspects of the plant, and were able to destroy it by manipulating the regulators. These types of hacktivism are not moral and have the potential to lead to a loss of life. 

I don’t believe there is a clear moral answer to the question simply because it appears to be more situational and personal. There are some cases that the public eye is needed, and others where shielding people from the public can save their lives. I believe this type of social physics is a more negative one, but has the potential to be helpful under the right circumstances. 

[tbhartnett50]

Weekly Blog 10: Social Physics & Switch

Having perused Social Physics by Alex Pentland, I can’t help but think of Switch by Chip and Dan Heath. The Heath brothers wrote about five years prior to the publication of their book, but I think many of their recommendations in terms of business and social strategies for change make a lot of sense in terms of Peatland’s work. The Heaths recommend three things for producing change: ‘motivate the elephant’, ‘direct the rider’, and ‘clear the path’. ‘Motivating the elephant’ more or less involves waking the latent potential in everyone for change. ‘Directing the rider’ means generally to encourage the natural restraining tendencies to productively focus on the change hand rather than remaining in fear. ‘Clearing the path’ means removing obstacles that restrict the change process.

To me, Social Physics aligns nicely with these premises. Through the combination of effective social norms and incentives, we can ‘motivate the elephant’ to engage in new forms of engagement and information generation / sharing. We can ‘direct the rider’ to break out of his or her echo chamber or isolation to be more receptive to new information from networks of contrarians who might have strategies that run against the grain of common sense but have significant consensus for being reasonable solutions. Finally, and perhaps most interestingly, involves ‘clearing the pathways’ and providing new avenues for sharing that information and creating those same social incentives.

In the context of Pendland’s argument for social physics as a new sort of math that will enable us to develop more valuable social structures, I think this is truly where the rubber meets the road for information policy. Breaking down the obstacles to information sharing apparatus and designing more efficient, value creating enterprises is where information policy can have its best effect. Information policy, at best, should be an enabling capacity, and it can do this best through modes that remove obstacles and incentivizes strong social network performance.

Without getting too specific, but rather focusing on principles, I think we ought to look at information policy as a means rather than an end unto itself. When viewed from this perspective, the question becomes not “How can we make everyone’s data secure?” but rather, “How does this policy facilitate the secure transfer and storage of information so that we ultimately create a better society?” I think this is one of the best values in Pendland’s work, helping us to ask the right questions that identify the purpose of any information policy. If policies regarding the pitfalls and opportunities of data sharing techniques don’t somehow focus on the larger questions of bringing value to our social exchanges, we have constructed them too narrowly, and at best this represents a missed opportunity.

[markmgray-blog]

I found it interesting to see the different meanings behind the questions we are asking in class about information policy simply by rewording them. We have been largely focused on the negatives in class and attempting to describe the targeted ads as invasion of our privacy. We have attempted to craft overreaching policies that regulate and stem these flows of information, when we actually would be more comfortable and probably more productive with these flows wide open, but secure. I believe the big scare that we have in class is not necessarily only focused on what data is collected, but rather who is taking this data in and what do they plan to do with it. I know there are currently policies on the transfer of specific types of data, but an enabling information policy should be able to characterize all types of personal and non-personal data and specify a standard of security needed. 

The notion of a missed opportunity due to the wrong questions being asked seems like an all to familiar problem. One example would be a standard for all types of information flow. A standard syntax and key-value pairing specifically. This question would allow for the integration of data into a large scale data store (the one we talked about in class), but is not a question commonly asked because who thinks of the largest scope? Now we have many technologies using, ‘fname’, ‘firstName’, ‘name’, ‘first’ all to represent the same information. This is just one example of a time when a policy could have answered an overreaching question but instead appears as a missed opportunity. 

[markmgray-blog]

Social Physics

Physics happens...

I found it fascinating the idea of a model composed of social networks facilitates in the creation and transfer of ideas. This type of idea transfer and prediction was not possible prior to the explosion of social networks and the ease of connecting to one another. The book mentions the ability to track an entire community of people and using the collected data over the course of  multiple years, they mention this as a sort of “living lab.” The author goes on to mention that by studying past trends in social behavior they are able to accurately predict future behavior taken by an individual. One example they give in the book is a vast network of brokers communicating instantaneously with one another causing them to overreact to the responses of the other and ultimately converge into a heard. This caused many brokers to trade stocks in a very similar strategy and allowed for prediction of actions based on new inputs into the environment. The vast amount of data we have unlimited access to appears to lead many people to think the same way based on the social norm. I am abstracting away the use of tracking and predictive models from the equation and simply relying on social trends. Take for instance the Ice Bucket Challenge that was the internet rage a year ago. Some people didn’t hear about this from the original source (in fact probably most) but instead through the social networks they are involved with. This predictive model could use the fact that you have 50 IBC (ice bucket challenges) on your social feed and take the number that you have watched/liked and predict with a percentage of how likely you are to participate in the IBC.

The author talks about a social physics that expands beyond this level and analyses more information than just your social network feed. This involves communication with other people, locations visited, things interacted with, and information learned by monitoring GPS location, call length and to whom, and even what information is sought after. The author also mentions that the spread of ideas is beneficial to a certain extent. After a certain amount of ideas had accumulated the research started to show trends of something they called an “echo chamber” where the same few ideas were being re-echoed and causing less production than the idea diverse, but not isolated environment. They give an example with eToro and showed that as the rate of idea flow hit a certain amount the return on investment reached an optimal point. It was interesting to see the returns fall again once the idea spreading rate reached a high number. This appeared to be in part because of the herding effect they mentioned earlier in the book. It was interesting to read how the emergence of big data and social networking were able to create a social physics model that the author covers in the book.

I believe what he talks about we are only starting to see and use in recent years. We are getting to the point where we have the processing power to sift through this massive amounts of data and use it for a meaningful purpose. Now the question goes back to the reason for the class, does this type of analysis need a strict policy that governs it? Is it safe to create large predictive models for communities based on past behavior, or can these be exploited? With all the information that is out there it is not hard to imagine a predictive model used for malicious purposes.

[infoleib-blog]

When should the Internet be turned off?

In the section that discusses “The Dark Arts of Internet Governance”, the author highlights something very interesting: many governments (often times totalitarian ones) have turned the Internet off at certain times. More specifically, they have forced Internet service providers to withhold their services. While many of these occurrences have been to prevent unrest in times of mass turmoil (Egypt revolution, Iran election protests, etc.), we should still consider when it is appropriate or inappropriate for the government to force the Internet to shut down.

If we go by the argument we listened to during a previous week (that suggests the Internet is a human right), we would simply say “never.” I am curious, however, if there are times this would be appropriate within the context of national security, and if so, how we could prevent the government from abusing this power. The author gives a good example of a terrorist attack that is being coordinated via cellphones in order for it to be successful. Most people would say in a scenario like this that it would be fine to turn off the Internet as well as cell phone use. But this is an extreme example on the spectrum of possibilities. What if there were riots in a city? Should the government have the right to turn off Internet and cell phone access if this prevented looters from organizing? The obvious disadvantage (besides the government’s arguable abuse of power) is that it would be harder for people who are not rioting to ensure they are in a safe situation, and it would also be harder for an effective dispatch of emergency services. It is a tricky cost-benefit analysis to consider in many situations, but one that should be thought about in detail.

The government’s forcing Internet Service Providers to shut off their services also brings about another important topic (that is also discussed in the book), one that perhaps even has bigger ramifications because it is a more common situation: what responsibility do private companies have to comply with a government’s demands? As highlighted in the book, there’s really not much of a unified policy for this; rather, most companies have to address these issues on a case-by-case basis. I see this as becoming an increasingly tense situation between private companies and governments. The Edward Snowden leaks showed how many private companies were forced to give the government big chunks of their data. Important to note, many companies spoke out about how they felt uncomfortable doing so. Whether these companies were simply saying that to prevent a backlash against their brand, or whether they truly felt this way is up for debate. However, this highlights how the separation between private companies and governments (specifically with regards to personal data) is becoming increasingly blurred as governments are oftentimes strong-arming companies to comply with their demands.

[markmgray-blog]

I believe the example of a terrorist attack being prevented by shutting down the internet and cell service is a little outlandish to use as an argument for the right to stop communications. Considering this is going to occur with a very low probability it would still give the government the right (in argument) to shut down any communication in the name of preventing an attack. Likewise this is more of an intimidation argument than anything, implying that without this power the government wouldn’t be able to stop this threat. Maybe I am just looking at the negative side of things but it almost feels like that argument attempts to manipulate peoples opinion by directing them towards the worse case scenario. 

I agree that the demanding of information from companies is a complex situation and may be a good area for a new set of policies. Whether the government or the private sector should be the creator of these policies, I don’t know. I personally believe that the companies probably publicly stated that they did not agree with the regulations simply from a PR standpoint. They probably didn’t enjoy being told what to do by the government but I am not entirely sure they cared too much. This however is speculation and is entirely up for debate.

[tbhartnett50]

Weekly Blog 9: Global Internet Governance

Having finally gotten around to reading this today, my impressions remind somewhat of Number 2 from Austin Powers: “Countries don’t matter anymore, only corporations do.”

That being said, the nexus between government and internet coincide with some of my thoughts regarding cybersecurity. DeNardis points out that we are rapidly approaching a period in which government is no longer effective at regulating certain technologies, the internet being one of them. Much of the power rests now with private and nongovernmental entities. Her example of SOPA / PIPA shows just how inept our government has become with respect to carrying out any sensible regulation. SOPA and PIPA struck me as more of a problem of technical incompetence rather than intent; I’m not convinced that bad people were writing the legislation, but rather that they just couldn’t do it a way that made sense. In a similar fashion, the government is fairly proficient at securing its own networks (I’m sure only the bad news makes it out there, to be completely fair). But what happens when we get out there and try to protect civilian networks, and what are the ramifications for civil liberties?

Additionally, are comfortable then with corporations running the show? I sense the uneasiness in the room whenever we discuss how much Google collects about each and every one of us. However, deep down, I almost always sense the ambivalence, including my own. More likely we’re like “I guess…?”

It’s a lack of practical solution in terms of global governance. Global governance schemes always sound good in theory; create some overarching body here and there, and have a body of law the community of nations will all adhere to. But then, you ask, would I want to be subject to the whim of a prosecution from actors from a rogue nation? I’m often reminded of the hypocrisy of having Mummar El-Gaddafi with a seat on the UN Human Rights Commission.

But an international consortium is even more threatening. Despite what DeNardis says regarding the focus on coding and architecture of the Internet as a way to get at governance issues, I’m convinced this amounts to much the same thing as a traditional body of law, only more subtle and less understandable to the lay person. This is what truly bothers me regarding internet governance.

[markmgray-blog]

I think it is interesting to see how the government and other entities have failed to regulate things such as the internet. I agree that it doesn’t necessarily stem from the fact that there are evil people at the helm driving us towards total anarchy but rather naive people driving us towards total anarchy. Ok, that previous statement may be a little over the top, but I do believe the origin of bad and failed policy is more simply created from a lack of knowledge about a subject that is being addressed. This is a topic we covered in class and I believe the professor even commented on how the people at Washington can’t create policy simply because they don’t understand what they are regulating. My first thought goes to any new technology that their are not currently regulations in place, like when Uber first started. No one knew what they were, how they would work, or the impact on the market they would bring. Thus legislation to protect the taxi cab industry was put in-place because they could take over that market due to light to no regulations. These policies make it legal to give an Uber driver a ticket if they pick up or drop off at certain locations (San Francisco airport arrivals). I believe the lack of knowledge in largely technical areas are the prime reason for poor policy and regulation. Likewise attempting to create an overreaching policy like you mentioned can only be more complicated and potentially contain more loopholes than ones that are split into sectors. 

[markmgray-blog]

Global Domination of Internet Policy

I found The Global War for Internet Governance to be very informative as to how the internet works and the different protocols that make it interoperable. The book also mentions how the internet was originally not interoperable, and consisted primarily or proprietary network protocols that required companies to purchase specific products to ensure interop within their network. This gave rise to the need to have a standard TCP/IP protocol that would allow all devices to communicate with one another. I mentioned in my previous week that currently we are on the IPv4 standard and this supports a 32 bit address space. The book mentions, like I did, that the rate at which the internet is expanding we will inevitably exhaust the 4 billion IP addresses we currently have. They also mention the slow adoption of IPv6 that was supposed to be completed several years back. With this foundation the book was able to go into more depth about the privacy and governing issues that the internet has spawned.

Being international it is hard to say who should ‘control’ the internet. One could argue that the US should have this power due to its creation and vast explosion of use there. Would that then mean that other governments would be subject to the US policies about how the internet should operate? This is not the case though, countries maintain their own connections to the internet and maintain the availability within their own nation-states. This creates the issues as to when are governments able to cut off their citizens’ communication with the rest of the internet? Should governments be allowed to have such control? The book gives examples of San Francisco’s BART blocking protestors cell service to avoid a riot. This gave rise to more outrage over the blocking of communication by a regulator. I personally believe that the internet and the interop that we receive through it are good things and that allowing companies the ability to block these communications is wrong. However, expanding it to the government is a little more complicated. I find myself torn between agreeing with it in the event of a national crisis, and being against it due to the possibility of privacy concerns.

It appeared to me as though each government had its own policies in place for the internet and that they self regulate themselves. In class many of us have advocated for a detailed information policy that would intern affect the internet as well and when we hear of cases like Egypt’s internet blackout we are outraged that that is even a possibility. Should we be careful in forcing our western views on foreign countries? Should the US and its private non-profit internet managing companies be able to create policies that all internet users should follow? I don’t believe these are easy questions to answer and I don’t have a definitive answer myself. I am eager to hear other views on the matter as I believe there will be a vast array of differences.

[infopolicyanw-blog]

Cyber Security and Cyber War

.Are we already at Cyber War? What would be an act of Cyber War? If it’s attempting to attack our government’s infrastructure, then that’s happening continuously every second. China alone is found attacking our systems consistently, and it dramatically increases during test periods for students. Are students being assigned real world applications for their computer expertise? Are their attempts a threat to our national security and should the US take action? Cyber War, in my opinion, is often a misnomer in its daily use, and acts of war by other countries are often hard to distinguish from non-state entities. Politicians will use “Cyber War” and “Cyber-Pearl Harbor” as an attempt to stir up the masses in realizing that our cyber security is extremely important.

What would be the impact of a successful cyber attack? The US government’s infrastructure is in no way modular. Vital systems are integrated with other vital systems and pieces that don’t need network access are completely accessible from online. To move away would be to migrate a huge legacy system and it would take years to do so. They don’t even need to attack our defense system. They can just mess up a city’s infrastructure - ruin the stoplight algorithm and there would be devastation on the streets. John Oliver talks about the security around our own nuclear warheads - which is shockingly thin.

I think there are interesting situations where we are attacked by a foreign entity and data is compromised. The Sony hack in 2014 was traced back to North Korea where tons of employee information, emails, salaries, etc was released. Social security numbers were amongst the 100TB stolen. North Korea also threatened action if the movie The Interview, a mockery of North Korea, was released. 

What did we do? We debated not releasing the movie, letting NK control our actions. But really, what action can we take? Data was compromised, but no one was, debatably, physically harmed. Was it an act of war? I think the issue is that there are gray lines everywhere on what constitutes an act of “Cyber War”, how to react, and against whom?

[markmgray-blog]

Interesting questions, I believe you are raising questions not many in the Info Policy class are asking. It is truly vague what they mean by “cyber war” and an “act of war.” These seem like policy questions that need to have solid and definitive answers. As it currently stands when someone steals information, but is not directly blamed it seems the victim is at the mercy of the thief. This was the case in the Sony and North Korea example you mentioned. 

On another note, I believe many of the infrastructure systems within a city are still run on closed networks and are not publicly accessible on the internet. This is the first and most effective line of security for a process control network. It is worth noting, that many times security flaws don’t come directly from the software, but rather from someone incorrectly setting up the software. In particular, someone setting up a process control network may leave port 443 open to use the HTTPS control panel remotely while they are setting it up, but then forget to close it when they are finished. Now someone simply has to scan the open ports on that IP/Network to find the access point. 

I wonder if there is a policy that could be used within the United States that gives guidelines to how the nation views an act of cyber war and gives it a more formal definition. This could go as far as to include the possible repercussions of such acts. This would require a lot of expertise both from the technology portion and from the traditionally war room.

[musingsoninformationpolicy]

The Art of War

Information and espionage have been an integral part of warfare right from the beginning of time - be it the Trojan Horse the Greeks used in the fall of Troy, or the courageous use of fake documents to rescue American hostages from war torn Tehran (as depicted in the Ben Affleck film Argo). If you know the enemy and know yourself, you need not fear the result of a hundred battles - this is perhaps the most famous quote from Sun Tzu’s ancient treatise on military strategy, ‘The Art of War’. The fact that this was written over 2000 years ago and is still considered essential reading on military strategy gives me one clear message - even though our weapons and the scale at which we conduct war have changed, the basic ideas behind warfare essentially remain the same.

Information is the basis of warfare, and it has been so for millennia. Whichever side is successful in hiding more of its own information while at the same time acquiring accurate information about the enemy’s plans typically wins the war. This is what happened during World War 2 - the Nazis were winning the war until the Enigma cipher was finally broken at Bletchley Park, and the tide finally turned in favor of the allied forces.

I decided to write such a detailed introduction to the importance of knowledge in military strategy because on reading the introduction to “Cyber War: The Next Threat to National Security and What to Do About It”, I got the sense that the authors wanted to impress upon their readers how much things have changed in terms of how war is waged, even since the days of the cold war. I disagree with this point of view - war is still about the control of information and resources.

While the authors bring out some interesting talking points, and definitely succeed in raising general awareness about the issue, the writing of the book is a bit too dramatic in my opinion. An event such as a cyber-9/11, something that brings death and desolation in its wake, seems a bit far-fetched. Our cyber systems have been in existence for a number of years now, and they’re surely only getting better, as vulnerabilities keep getting discovered, and more secure software written. Is software perfect? Pick up any high profile security breach from the last 2 years, and you’ll have the answer to that question. It’s an emphatic no. But, are we aware of the danger? Yes. And, are we getting better at cyber security? I believe so.

To me, the essence of the discussion on cyber war is this - the core principles of war remain the same, but in today’s world war is being waged on multiple, new battlefields. The key takeaway is that we need to be able to defend ourselves against threats in the cyberspace, while also being capable of mounting our own offensive on these new battlefields.

[markmgray-blog]

Quoting Sun Tzu, I approve! There is nothing fundamentally different about how war is waged now as it was then. The differences are simply the tools we use and the scale at which we are capable of destroying ourselves and our enemies. I also agree that a cyber-9/11 is an unlikely event, not simply because our systems are being improved daily, but for the fact that the base-line security in many regards is not elementary to begin with. I understand how a group of wanna-be hackers could crash a government site by using a botnet to DDoS the hosting server, but this is simply and inconvenience. The truth is many of our critical systems, such as the power grid, are not on a public facing network. This in and of itself would be a security risk! As for your key takeaway, I believe we are able to do both of those. We were able to plant Stuxnet in the Iran nuclear program and thwart their efforts to gain a nuclear weapon. While also able to protect ourselves from many zero-day viruses that have been found.

[markmgray-blog]

Cyber War and the “Internet of Weapons”

Actual website: http://map.norsecorp.com/

I am proposing that we rename the “Internet of Everything” to the “Internet of Weapons.” After reading Cyber War by Clarke and Knake I can see this high level of interop resulting in various new vectors of attack. To backup my claim I want to cover some history of TCP/IP, specifically IPv4 our current routing system. IPv4 uses a 32-bit addressing schema to generate IP address for routing traffic all over the world. A 32-bit address space gives us 2^32 IP addresses to utilize. This means there are exactly 4,294,967,296 addresses to be used world wide. That sounds like an extremely large number. However, currently there 7.125 billion people on earth, close to doubling the number of IP addresses. Today there are 2 billion smartphones in circulation, and each of these has the ability to tie up 1 address. That is already half of the address space. You may be thinking, “so what, how does this turn connected homes into weapons?” In short, it doesn’t! The premise here is that creating an interconnected home will undoubtedly (at our current pace) exhaust our remaining address space. Ok, so we are going to run out of addresses for all of our devices what is the solution?

IPv6 is the latest version of the internet protocol (IP) and with it a whole new playground for cyber warfare. IPv6 supports a 128-bit addressing space (2^128 addresses) which is more than enough to support the internet’s infrastructure for the foreseeable future. Why do I state that it will open up new attack vectors in the word? Simply because it is new (in practice) and has not undergone the rigorous exploit attempts that have been performed on IPv4 since its beginning. IPv4 has been subject to many different exploits including the Ping of Death, DDOS, and system specific packet exploits. The ability to perform each of these attacks has been documented and in many cases there are firewalls in place to prevent them from happening again. In the “Ping of Death” attack a packet exceeding the 64 kilobytes of allowed data is sent to the destination server and causes the system to crash due to an overflow exception. This has subsequently been fixed in all known operating systems that were affected. This attack was crafted to target the Internet Protocol being used by the destination host. Thus moving to an entirely new system that has not been tested throughly will allow for these types of exploits to arise again. New systems come with new exploits and what these are we'll just have to wait and see. It is not a far cry to imagine these exploits giving control of your connected house to a malicious user and thus causing the “Internet of Weapons.”

I want to comment specifically on one part of the book, that is when the author describes his vision of what a cyber attack would look like on a national scale. He describes trains running into each other, and power grids shutting down. These are not unlikely given an on-site hacker or intruder, but many of these systems are not connected directly to the internet. This is a common misconception and any company that has security as a relative thought creates separate networks within their company that many times do not talk. I worked for BP in their Digital Security and Counter Threat Unit over the summer and learned that all of their critical systems are behind strict security and do not have access to the internet. These systems require on-site users to operate, enable, and disable them. There are other ways that these can be infected, such as exploits in the applications, operating system vulnerabilities, and even unintentional installation of malware. It is not as simple as a hacker in Russia pressing a few keys in a terminal and disabling the entire Eastern seaboard. I can however see the Internet of Things giving hackers a way to simulate a power grid failure without actually disrupting power by taking control of home systems and rendering them inoperable on a large scale.

[infopolicyanw-blog]

Interop: The Promise and Perils of Highly Interconnected Systems

Standardization is extremely important. When companies, entities, etc. can agree on a standard, the system itself expands as its network isn’t bound by a conflict amongst pieces. However, as the book mentions, connectivity can be overwhelming. A lot of data flows through these systems and introduces vulnerabilities.

In other situations, having better connectivity can be efficient and useful. For example, I was able to go to the Consumer Electronic Show in January 2015 and saw huge systems, touting the Internet of Everything idea. Qualcomm, Intel, LG, and GE were all advertising their newest tech that involved connecting to your phone, your other appliances, etc. Lowe’s had a huge display which was literally a house built inside the convention hall. They had a system that interconnected almost everything in the home. It was overwhelming, a bit reminiscent of Skynet, but still the innovation was exciting. However, Lowe’s does not work with Qualcomm’s, Intel’s does not work with LG, and so on. Therefore, while their own proprietary systems have a large amount of connectivity and interoperability amongst themselves, they do not have it amongst the different companies. It makes it a huge risk, therefore, to adopt one company’s system when it may go out of business or doesn’t get updated if a competitor is doing better in the market. However, if users were able to connect the different company’s pieces, it wouldn’t be such a risk.

I find the case studies to be quite interesting. They touch on various innovations that we take for granted and how standardization affected its development and adoption. How many amazing ideas were crafted and were subsequently dropped because they didn’t tap into the benefits of interoperability? Then again, how many products felt forced into a standard to be adopted by consumers?

[markmgray-blog]

Not only does the amount of data introduce vulnerabilities, but the pipe that carries the data becomes more attractive for attackers to target! I think the Internet of Things is a great example for interop. You bring out some good points too concerning connectivity between products. Likewise, it makes it difficult for someone to build an entire house without exclusively using one companies system. I worked with a guy over the summer that had outfitted his house with this type of system. He was able to use their API’s to build a self-made app that allowed intricate control over the entire house from any iPhone that had his app on it. This solution doesn’t seem nearly as practical when you apply it to the mass of non-technical people that they will be marketing to. However, there is a small layer of interop where a user created application can control products from different companies through company specific APIs. 

I feel that with the separation of interop between large companies may allow for a niche business that patchwork stitches them together to create a unified customer experience. Maybe that would be a good Information Policy project, application that you can control your Internet of Things products from various companies with.

[barelyopinionated]

A Little on Interop in Modern Computing:

The book Interop by John Palfrey and Urs Gasser is a fascinating book. I will admit that a lot of my interest came from reading about technologies that were very popular three to five years ago and pretty much no longer exist. Reading about AIM, VHS, iPods supplied a healthy amount of nostalgia. It also shows how fast technology is moving. A book written less than 5 years ago (2012) is talking about technology and programs that are hardly used now and have been largely replaced by other technologies. That technologies and popular programs change so quickly yet still are interoperable is a very impressive feat. One of the fastest changing areas is in mobile computing. Also, this is an entertaining story on a software programmer’s perspective on the AIM vs. MSN Messenger interop fight. It’s sad this doesn’t seem to happen more often now.

Interop in mobile technology has become an interesting battle. It seems we have 3 companies that are moving to high vertical interop for mobile devices: Apple, Google, and Microsoft. Apple is very vertically integrated and doesn’t support other operating systems and devices very well compared to its own products. Google started off very horizontally interoperable but seems to be becoming less so as it moves core parts of the android OS into its Play Store. Android currently seems to be the most horizontally interoperable system. Microsoft seems to be moving toward vertical interop but at the same time is has been making steps to support other systems such as Office being available on both Android and iOS or recently open sourcing parts of its .NET environment. It will be interesting seeing how these different companies handle interop on a hardware and software level. I think this is an example where it isn’t clear how interop will affect innovation. As a consumer, I’d definitely prefer more interop, though.

There is another extreme to interop: Linux. Recently I’ve fallen into using open source software and I can’t get out. Linux is highly interoperable. You can find a program or configuration that will let you do almost anything. Recently for my work, I have been experimenting with automation tools. I’ve found out that I can automate tasks on my computer with simple commands. The downside to this is though there is high interop, there is also high complexity. For each tool available, I seem to learn a new programming language. I can do almost anything with the system but figuring out how to do it can be difficult. I’m pointing Linux out because it has thrived on high interop among its various programs. Because a lot of the programs used on Linux are open source, other programmers can write programs which interact nicely with existing programs or even build improved versions of existing programs. The internet is largely run on Linux and a large part of that is probably its high interoperability (well being free to use is nice).

[markmgray-blog]

I agree the feeling of when my code works, especially first time, is glorious! That being said I think there is very limited amounts of interop coming from companies like Apple in a certain aspect. They have high interop between their own family of products, but extremely limited amounts of it when concerning other operating systems. Microsoft’s movement to include more operating systems in its scheme of things appears largely based on necessity to preserve their place in the market. People are still buying Windows machines, but not buying Windows phones, or tablets. Supporting higher interop across systems does allow for better customer satisfaction regardless of the systems used. 

In the technology field 5 year old technology is essentially ancient. Tech moves forward at an alarming rate and I would argue that in several areas we don’t maintain as high of a level of interop than would be preferred. I think this was more prevalent with the onset of the technology revolution and is becoming more controlled the more we learn from our mistakes. Give us another 5 years and everything we use now will be obsolete and hopefully we will have an even higher amount of interop than before.

[markmgray-blog]

Interop: Benefits and Tradeoffs

(Internet of Things related image) 

Interop is an interesting concept and this book touches in many key benefits and concerns. It was very interesting to see how something that appeared so technological as having deep roots in history all the way back to the transcontinental railroad. The idea of making large scale projects work collaboratively based on a standard rather than uniformity describes many of the non-technical systems we have today. However, with the fast emergence of technology we have thrown many of those interconnectable systems out the window for many systems. Maybe we did this out of necessity to keep up with the changing trends of technology and the vast number of companies that are attempting to compete rather than collaborate in many sectors. As he points out the benefits of Interop are huge, but they don’t come without some downsides. These downsides come in the form of privacy and security. Creating all data to be interoperable would allow for large companies to compile vast amounts of information on market trends and users and create more in-depth profiles about people and eventually predict their behavior based on their past. 10 years ago I would have scoffed at this idea but seeing the ever increasing amount of storage and data retention of companies it is already happening and the more accessible the data, the more detailed the profile can become. He advocates that smart interop strategies by technology companies and users could mitigate this risk. From a software development point of view you never put the trust in the user. You have to design a system assuming the user will not utilize it correctly and that it needs to be robust enough to protect itself and the user (or their information) from harm. However, he does push for urgent action to creating interop policy and I do agree that the sooner we can get a solid foundation in place the better. We have gone over in class several different companies that use our data for a multiple of different ventures without our know, including monetizing it!

(You can track your dog in the Internet of Things!)

The argument for this type of interop of data is the ability it will create to answer the hard questions we face today such as climate change and the smart grid. These questions need a lot of information from many different sources to be answered. One would need to know the greenhouse emissions from all the automobiles on the road (possible with today’s interconnected cars), the contributions from power plants, and oil refineries. Some of this data is already available but may not be in a standardized form that makes for ease of use. The implementation of policies could require that data be organized in a standardized fashion and used for a common good. Greenhouse emissions don’t sound too invasive to my privacy, but the second push is for a “smart grid” system. One that can increase or lower the power funneled to a location based on the necessary amount of energy needed. How do they get to the point where they know the power I am going to need at any given time? Simple, by collection past data on my energy usage and predicting my schedule. With the Internet of Things on the rise many of the products I could use in my home will be able to track their energy usage, and potentially send that information back to the cloud. Now they potentially know what products I use in my home and at what time they are on or off. If this information was to be used against me someone could determine the most likely time for me to not be home, and the length of time I am typically away.

I will close by saying that I am not against interop, but like many of us in the class, I am skeptical of putting my information in other people’s hands without the proper assurances through security and policy that it will be safe and not used against me. We discussed health insurance companies potentially gathering Fitbit data and using that to raise rates or deny insurance to individuals. With a sound policy and accountability I believe that interop between all data would help us solve the hard questions that the author poses it could.

[sarap2015-blog]

Big Data

[markmgray-blog]

I agree part 1 of the book was an amazing eye-opener for me. Seeing how much metadata is collected and the context that goes along with it. The “data for services” is the mainstream business model in society today. When setting up my MacBook I had to disable several of these options that simply relayed my data back to Apple. Maybe we don’t notice this data being tracked and therefore we simply take a naive stance on its value.

The idea of a clean slate is a good one, but implementation, from a computer science perspective, would be almost impossible. How can we get all corporations to agree to such a drastic removal of valuable information about a person? Maybe this is where laws and regulations can be more easily passed? Tell the companies they need to create a remove-my-data feature into their products that mimics this clean slate request for each individual service. 

There is definitely a need for strong policy in regards to governmental entities, in my opinion. The book describes how the authors knowledge of what the NSA was doing expanded further than the actual congressmen. The ones that pass the laws! This is unacceptable and we have a right to know what the government is doing with our information. 

There is a lot of opportunity out there to shape policy due to the explosion of technology. We have reached this level of data storage and processing power so fast that we hardly had time to blink. 6 years ago my phone was a Motorola flip phone, 5 years ago it became a Blackberry, and now they have become an obsolete company. My point is simply this, technology moves at a staggering absurd pace and those who cannot keep up get left in the dust of 1′s and 0′s. I believe this is what happened to Information Policy as well...

[musingsoninformationpolicy]

Should we be more concerned about online data privacy than government surveillance?

I feel that the book “Data and Goliath: The Hidden Battles to Collect Your Data and Control Your World” builds on some of the readings we’ve been doing so far this semester, and especially on some of the discussions we’ve had in class. While many of us hold different opinions about how much data about us internet companies and the government should be allowed to collect, I believe most of us generally agree that we’re not comfortable with the extent to which this has progressed.

One of the most interesting points the author made was about the surveillance data being collected about us every being “incidental” data. We don’t intend to enable this data collection, but by virtue of us living in this day and age, data collection is a side effect of our everyday actions. If you own a smartphone, your location is tracked 24/7. If you use an Android phone, you can, in fact, look at your own location history for the past few years (just search “Android location history” on Google). If you use the “In Drive: Drive Safe and Save” program offered by State Farm Insurance (or any similar program offered by other insurance agencies), the location of your vehicle is continuously being monitored and collected. This location data is collected with a surprising degree of accuracy, and if it made its way into the wrong hands, someone could pinpoint your location and your daily movement patterns and use this information with malicious intent. And this is just location data. Websites (with the help of cookies) are collecting all sorts of data about us every day - our online behavior patterns and our buying choices being the most obvious ones.

I’ve mostly been oblivious to this, and I believe this is because of two reasons - (1) as an end user, I don’t really care; and (2) the companies and agencies that are collecting this data seemed to have ramped it up behind the scenes, without anyone realizing it. This data is collected through devices and services we use every day - our smart devices, free email servers, online shopping, social networks, and so on. Every once in awhile, there is a change in the privacy policies of these services. Most of us don’t read these privacy policies, but by agreeing to them, we’re basically permitting our data to be collected. It’s interesting to note how all of these things are turned on by default, and while it is possible to opt out, there is no easy way of doing so. Most normal users would have a hard time making any modifications to their privacy settings on Facebook.

Seeing that so much of our data is already being collected, perhaps we should start looking beyond government surveillance when thinking about privacy concerns. The kind of data internet and telecom companies are collecting about us can pretty much be considered a form of surveillance. At least government surveillance has a perceived benefit - peace and public safety.

[markmgray-blog]

Do you feel more safe knowing that this level of surveillance is being done on you? Especially now that you know it is happening? I agree that as the end user most of us don’t care to know what is being collected or stop to think about what we are agreeing to when we sign up for services. This is one of the main points of the books is to create a new policy that requires privacy policies to be much more concise (maybe 2 paragraphs instead of 10 pages). They are currently so obfuscated that understanding them requires knowledge of the subject bordering expert. I would argue that to a certain extent there is no opting out. You may tell companies that you don’t want to send them information, but when you use any application on your smartphone or computer, it is logged and many times not only on your device. 

The book also argues the validity of government surveillance, and points out that many of the perceived benefits from widespread surveillance is minimal at best. Large scale catastrophes already have an extremely small probability of occurring and surveillance doesn’t decrease this by much. Humans inherently overestimate the chance of low probability events occurring and this makes sacrificing privacy for security, no matter how little, seem attractive. This is a simple cognitive fact and may be part of the reason we are so willing to give up our privacy.

[markmgray-blog]

Don’t be afraid, they already know...

^^ How I feel reading privacy policies.

Assuming sacrificing privacy increases security then we all have nothing to fear. If there is truly an inverse relationship between the two and we have already given away an extreme amount of privacy then in turn we should receive absolute security. This however is not true, and Data and Goliath by Bruce Schneier will tell you the same thing. Schneier points out that with the drastic amount of information and privacy we give up we only increase the power of the entities that are currently in charge. He calls for a different approach moving forward, one where the power difference between institutions and private individuals is lessened. This is done by increasing personal privacy, and decreasing institutional privacy. This goes back to the question of who watches the watchers? We the people are supposed to take on that role. We gave these institutions the power in the first place. However, the vagueness of laws and the misleading idea of security costs privacy have blinded many of us and as Schneier pointed out many of Congress as well!

There is an excellent example in Schneier’s book, many justifications for this type of surveillance is in the form of “the risk of a nuclear bomb going off in New York is just too great.” This is an absurd statement, but why do people bite? The same reason people purchase insurance or gamble at a casino. As humans many of us overestimate the potential of a low probability event occurring. However, when we are presented with an opportunity to lower those chances even further (despite how negligible) we go for it. Likewise allowing surveillance on a mass scale will only slightly reduce the chance of that catastrophe occurring. Currently many of the systems we use are designed to make information easily obtained, why not turn the systems that are readily used to track us into more secure systems that protect us? He advocates that “it makes far more sense to design all of these systems for the majority of us who need security…” Does it not make more sense to protect the majority from the evil rather lump them all together and sort through the mess?

I want to close by commenting on how absurd the amount of information is collected on each individual when one does anything from taking a photo to getting directions from an app. The content of what was being done is not the most telling part of a story. The image you just took may show someone what you were looking at, but the metadata underneath shows where you were. This data isn’t protected and it is argued to be less important than the actual data. The actual data in a phone call is what was said, but the metadata is simply between whom the call took place, how long, what time of day, and other minute details. String the metadata together across two weeks and you have piece of context about someone. The Stanford experiment mentioned in the book is a hauntingly good example of that. Does this make you feel safe and secure, knowing that someone is able to piece together different parts of your daily life and create an accurate assumption about what you are doing? After reading Data and Goliath, I can say with certainty that I now take a second look at anything I am about to google. Does the sacrifice of privacy really increase security? Has it stopped many significant tragedies from occurring? Would we all be better off with our own privacy? It looks to me like before the digital age police were able to do their jobs just as well by getting court approval and executing an investigation.

[infopolicyanw-blog]

Net Neutrality & The John Oliver Effect

I remember watching that episode of John Oliver and realizing something big was happening. They always say, “Don’t feed the trolls,” and I wasn’t exactly sure if his “feeding” was going to hurt or help. In the end, John Oliver shut down the FCC comment site after it was DDOS’d by viewers. It was brilliant and it felt like justice was served. ISPs like Comcast and Time Warner have become the most hated companies in their attempts at merging and implementing a two-tier system. I personally don’t like squandering business unnecessarily so - which data-tier charging would do to companies like Netflix and Amazon. There’s already a “Netflix tax” in Chicago, a hub in the middle of a state renowned for its political corruption (see the spectacle that is Blagojevich).

An argument is posed that the internet is already differentiated, discriminated, and made of multiple networks. I can see how Comcast may need to charge Netflix for its extra data, clogging up its infrastructure, but allowing ISPs to have free reign over their user’s data and charging both customers and providers just feels… gross. Also, as the article states, the FCC is “lacking in deep technical understanding” that regulation powers lying with it would feel like putting the responsibilities with an entity that may not understand what is the correct first step.

John Oliver has become an amazing icon for social issues. After the episode on Net Neutrality and his other moving segments, a new term was coined: the John Oliver effect. But it doesn’t just take him to move a bunch of people. It takes a cause and motivation. The people of the US are not as gullible as one would believe, but present a topic that the public can get behind, put a witty host in front of it, and watch the world burn (in a good way). In my opinion, that’s the John Oliver effect that could be utilized so much more to take boring issues and turn them into viral media.

So do we, as humans, have a basic right to the internet? I think of the alternative and go from there - a government or company restricting certain groups from accessing the web. Do they have the right to do that? Are they infringing on my basic human liberties?

There are cases like Egypt and Burma where a large percent of the population lost access when ISPs followed the government’s orders to halt connections. It was shocking, as many believe the internet to be a magical entity that anyone can connect to whenever. To take it away on a mass scale was though improbable. Even in India, WhatsApp mobile messaging was shut down (which news reported as “mobile internet turned off,” interestingly enough) after large deadly riots. Was that warranted? How could such things be happening in 2015?

I don’t believe we’d get to the point where the US government would be able to tell the large ISPs to shut down without massive repercussions, but it’s a thought when other large countries are doing just that.

I think there’s a slippery slope that would lead to over-regulation and discrimination in internet usage. John Oliver may have delayed it and called the public to arms, but it’s a topic that, as the article notes, will result in a ridiculous number of lawsuits and sticky policy debates.

At the very least, someone actually did something about the trolls.

[markmgray-blog]

I agree that the internet should not be regulated by the providers like Comcast, Verizon and Time Warner. This smells like a clever plot to squeeze more money out of the average user without the need for providing a better service. I also think many people vastly underestimate the complexity of the internet and the mass of information and access out there. Regulating this entity would require more than just the expertise of one governing entity. 

In reference to allowing the government to shut off an portion of the internet, I think it is up to interpretation as to whether martial law can be applied to an entire population of people. This will definitely need to be discussed in more in depth. I believe that this issue will not come to light until a national emergency makes it a necessity. I don’t think that the ability to completely shut down the internet in any country is completely out of the question. Remember we have a part in our government system that allows the government to arrest and detain people without cause in extreme situations. This may be expanded to include restricting access to potential national security risks.

As for John Oliver’s show, I find it entertaining and his views on many social issues very enlightening. Mentioning the gullibility of the American people, make sure you know that all the “best by” dates on products are best guesses and don’t actually tell when a product will go bad. Just watch the episode about food waste from “Last Week Tonight” with John Oliver. We may be more gullible then we think.

[panamaluisito-deactivated201605]

Shut Off That Pipe...You Ain’t Paying for Bandwidth Around Here!

After reading the article Net Neutrality: The Good the Bad and the Ugly, my eyes were opened to the mess that is Net Neutrality. First off, I want to mention how it is funny that the argument always seems to boil down to who is paying for it? As I was thinking about what I would write for this post I realized that my perspective is based on my experiences and my career. I know there is nothing novel about this except the fact that some of the experiences that shape my thoughts on this I cannot discuss. That said, I will do my best.

Throughout my career, I have been in several instances where a lack of being able to communicate could lead to loss of life. In a previous position I held, I was responsible for all aspects of the communications of several thousands of Soldiers, Sailors, Airmen, and Marines spread out over the entire nation of Afghanistan. My biggest challenge was ensuring that every single personnel in my element – from the smallest element in the austere areas of a very undeveloped country, to elements with hundreds or thousands of personnel with established networked communication infrastructure – could communicate with each other at any time. The penalty for failure to ensure established communication was far more serious than not being able to stream the latest episode of Orange is the New Black on Netflix. Let me be clear, I in no way shape or form mean to diminish the services provided by organizations like Netflix. I understand that different people place importance on different things. I only mentioned the gravity of ensuring communications were up because this was the leverage I used when I was having issues with my service providers. Now lets keep in mind I am not talking about the service providers like Comcast and AT&T. I am referring to the Military Units that play a similar role and are responsible for our pipe out to the Department of Defense Information Network (DODIN). I was able to vastly improve the connectivity of elements all over our area of operations due greatly to explaining the repercussions of not having a connection. This sounds much more simple to relay than it was – as I was not the only customer these service providers had utilizing the same rationale for connectivity – but in the end, the service providers understood the necessity and were able to appeal to the importance in the mission of our organization to justify an addition or adjustment to their infrastructure. Let me interject here to say that I am not trying to compare my experiences with my unit and the Military service provides I dealt with to the magnitude of the issue that the ISPs and companies like Netflix are dealing with when it comes to Net Neutrality. I am only trying to establish a difference in the mind state. With most of the debates I have seen on Net Neutrality, the argument always boils down to money, who’s paying for it? The problem with money being the base of the problem is that money cannot account for all necessities, and I fear that a time will arise where doing things for the purpose of good will slowly be too expensive. You see this in all facets of life. In professional sports, the love of the game is greatly overshadowed by establishing the next precedence for how much a player gets paid for playing a position or sport. Never mind the fact that the average athlete is getting paid a ridiculous amount more money than the average working man. The end of the article mentioned the concerns that Mr. Farber has with the regulations imposed on Open Internet and reclassifying the ISPs to common carriers under title II by the current administration. One of his main points was that the ISPs will not simply absorb the costs to expand their networks to meet demand. They will pass those expenses on. I said it before, and will say it again, its all about the money.

Let me give my succinct opinion on the matter of net neutrality. I can see both sides and take none. I can see the perspective of the ISPs. I understand that if a company like Netflix provides a service that drastically increases the traffic on my network, causing me to have to improve or upgrade my infrastructure, they will argue, why should they pay for this by themselves. On the other hand, the average Joe sitting at home feels pretty bad about having to pay 100 bucks a month for fast internet, but because his neighborhood has grown drastically over the last year, his fast internet is now slow internet. The growth in neighborhood size is not his fault, so should he have to pay for the ISP to provide a better pipe to that area, or is that on the ISP to provide what they promise.

As I mentioned, I have no opinion other than I hope when the time arises and the matter is grave enough, we error of the side of doing for good over doing for money.

[markmgray-blog]

I agree 100% that it is at its base about the money. I mentioned that the costs are almost never absorbed by the company when they can simply be passed to the customers. There is no logical business model out there that absorbs infrastructure costs. Look at the movement from 3G wireless networks to 4G. Many companies had an unlimited/unthrotteled data connection, but when more and more 4G phones came out that began to saturate the new 100mbps network connection enjoyed by all customers. Following this carriers needed to expand and improve their ‘new’ infrastructure to meet these demands, and one of their responses was to remove the ‘unlimited’ data plans that they had offered. This gave them the ability to pile fees on high data users and in a roundabout way pay for the improved network. 

I personally feel that it is a poorly placed hope on the idea any company would choose doing good over the more capitalistically sound decision based on the money to be made or lost.