net.wars

In her new memoir, Life on the Road, the long-serving equity feminist and campaigner Gloria Steinem writes that decades of campaigning have taught her that, "Voting isn't the most we can do, but it is the least. To have a democracy, you have to want one."

Something similar could be said about privacy. Steinem never directly discusses it, but her many stories of collaborating with and listening to other people could provide lessons to any campaigner in any field. "Divide and conquer" works as well now as ever. That being the case, we might do better at achieving change if we define privacy less as individuals' boundaries and more as a collaborative social compact.

This came into focus for me because I was in the middle of Steinem's book when I saw The Power of Privacy, produced by Guardian, in conjunction with Silent Circle. Part of a series, the short film provides a quick introduction to the basics: data collection, hacking, surveillance, encryption, and future challenges such as the Internet of Things. It ends with an invocation that we should be more responsible about privacy and less...inert.

The problem is that the movie neither provides ideas for what "more responsible" would look like nor drives home why it matters. I know it's a short film, but like much privacy material it assumes that people will be creeped out just by seeing all the personal information about them that's being hacked into, collected, and ransacked by unknown strangers with uncertain motives.

"Sometimes you have to sacrifice a little convenience for safety," a hacker at Defcon advises presenter Aleks Krotowski, who has just been sufficiently willing to look stupid in public that she has unquestioningly inserted the USB stick he's handed her into her laptop's port. OK: don't take USB sticks from smiling strangers. Anything else?

The reality is, it's no longer sufficient to rely on the "yuck" factor. Today's world is a far more safety-conscious, closely monitored, and publicly shared environment than anyone over 30 grew up in. That doesn't mean younger people are all brainwashed , but "normal" has significantly altered. We see that Krotowski's computer has been hacked, and we see the reputation detective's phone book of data about her - but we don't see consequences accrue. What exactly is the harm?

This question matters because people do ask it, and we - privacy advocates - have to have some meaningful response ready for those who say, "I have nothing to hide", "They already know everything about me anyway", and "So? They just want to sell us stuff". To the first, bank statements have long provided a reasonable answer. Financial disclosure seems to be where everyone in most cultures draws the line. Even so, Malkia Cyril's response to that at last year's CFP seems much more true: "Everyone has something to hide because we all have lives".

Steinem also makes me dubious about another frequently heard claim, which also appears in the Guardian's movie. Privacy, Krotowski explains, was non-existent before the 1600s, when the chimney enabled people to live in their own homes instead of communally. This conflates privacy with physical space, isolation, and anonymity, not with mental freedom, tolerance for differences, or simply being beneficially ignored some of the time. The Japanese may lack a word for privacy, but they are masters of tacitly agreeing to block each other out. See also Manhattan subway cars, where the person plastered against you nonetheless maintains psychic distance by not speaking or meeting your eyes. I bet in those medieval villages, and even in the teepee-covered holes in the ground that I was told housed Native Alaskans for thousands of years, people found ways to create that same distance. As I said in 2008 of the movie Erasing David, privacy is about lack of fear, not isolation.

The second response is easily read as apathy or cynicism, but it's as reasonably a symptom of disempowerment (MP3): people who believe they have no ability to effect change figure they might as well lie back and think of England. Give them alternatives or usable tools that allow people to make genuine choices and then we'll see.

But it's the third question, which is really "where's the harm?". that's the hardest. We habitually invoke Orwell, the Nazis, and the Stasi, but these are all fading into the historical past. We need, as Steve Song wrote a couple of years ago, new metaphors.

Two possibilities that Song discusses are public health and environmental pollution. In both cases, as with privacy, each individual's decision has a wider social impact: your decision not to vaccinate your child may leave a vulnerable neighbor open to illness; my decision to operate a wood-burning stove forces you to breathe the resulting particulates and smoke. I like the public health one especially because you can enhance the analogy by imagining global air travel as the broadband that makes it scale.

I would never want to say that feminism or matriarchy has all the answers. But reading Steinem has made me consider that perhaps all those early 1990s gun metaphors (particularly about encryption) and rights-of-the-individual were a rhetorical wrong turn. It was easy to do, since we were responding to controls that saw these technologies as military weapons in the first place. Maybe instead of telling people about privacy we should be asking what it means to them. People will fight for the privacy they want.

Wendy M. Grossman is the 2013 winner of the Enigma Award. Her Web site has an extensive archive of her books, articles, and music, and an archive of earlier columns in this series. Stories about the border wars between cyberspace and real life are posted occasionally during the week at the net.wars Pinboard - or follow on Twitter.

Posted by Wendy M. Grossman at 7:39 PM | Permalink | Comments (0) | TrackBacks (0)

"When your computers know you're out of town, they sulk," a friend of mine observed once.

Yes, they do. While I was away, my main desktop machine decided to freeze. The repair shop around the corner (how lucky to actually have one) said: needs new motherboard. Which also meant a new processor because: new and different socket. The new configuration turned out to refuse to boot the old version of Windows XP that had been running on the machine - or to repair the old installation, either of which would have been the quickest way to get back to work and forget the whole thing. Faced with reinstalling from scratch, I wrangled the machine back (naturally, they wanted to finish fixing it) and spent a weekend contemplating. "If it ain't broke, don't fix it" - but if it *is* broke do you want to restore the status quo or take advantage of the opportunity to try something new? It felt silly to be reinstalling XP in 2016. I never liked 7, 8 really needs a touchscreen to be tolerable, and I was never going to consider 10. It's penguin time!

I have long known that my operating system future would eventually be open source software. Philosophically, I should have adopted it exclusively at least 15 years ago. But for years I was paid to review Windows software, and by the time that stopped I had so much experience with it that switching seemed like emigrating into a foreign culture where I didn't speak the language. For years, I've been bucking Windows' idea of where I should put things and how I should operate in favor of habits that were defined in about 1992: these directory names, with these functions, that I back up in this way, and these programs easily launched with these mnemonic keys. Jumping off that familiar track onto a distantly parallel one seemed like a lot of effort. Of course, that distant line wasn't really parallel: more of an asymptote that's been coming closer all this time.

The good part: it took about 24 hours from first inserting the Ubuntu 14.04 disk to being able to do useful work on the machine with all the main functions enabled, albeit with much effort still required, chiefly in getting working some Windows software that I still need. That's a reasonable triumph for the open source community: it has come a long, long way. While user documentation is still limited by the fact that few professional writers can afford to do a lot of free work, the reality is that even apparently obscure problems can often be solved with an online search if you can figure out the right terms (searching on error codes is as effective as it is in the Windows world). This works for several reasons. One, enough people use all this stuff that whatever problem you have the likelihood is that someone else has already had it. Two, enough people who use Linux are geeky, chatty, and inclined to be helpful enough to post the solutions they've found. Three, the community is still small, homogeneous, and well moderated enough that the junk gets weeded out effectively or stopped at source. The quality of answers I've found has been amazing. This is all great stuff.

However, I'm not an entirely novice user. I've been using UNIX commands on the WELL for 20 years, and DOS before that. So not only am I less scared of garbled strings of letters that need to be typed into a terminal, but I can make a reasonable guess at what they mean; what's more difficult is translating the sometimes weird names for things that seemed logical to an interface developer without a marketing or usability department. A real newcomer - say, a 19-year-old who's grown up with an iPad and a smartphone - will struggle more than I have. As long as everything works, they'll be fine. As soon as something breaks...we're still talking about an uneven patchwork of software and information. In this effort, strict attention to dates and sometimes quite fine-grained version numbers is crucial. Otherwise, you find yourself downloading or trying to implement fixes for problems that have been fixed in the release you're running or trying to follow advice that was written several versions ago and has gone through an interface revision. Nonetheless, if you know how to search and read and follow instructions, the hit rate for finding fixes is very high, and for people like me there's real satisfaction in being able to find and successfully implement them - now that it's easier.

In the midst of all this, I discover that the Linux community is in the midst of an uproar. On January 15, the Linux Foundation, an association of both corporate and individual interest parties, presumably contributors to and users of the codebase, amended its by-laws so that individual members, who formerly had the right to vote in two board members, no longer have that right. Instead, the board will be made up solely of representatives of its corporate members. This seems a wrong move - and counter to the Foundation's stated mission. There are companies all over the open source landscape - but individuals still deserve a voice. Have a penguin.

Wendy M. Grossman is the 2013 winner of the Enigma Award. Her Web site has an extensive archive of her books, articles, and music, and an archive of earlier columns in this series. Stories about the border wars between cyberspace and real life are posted occasionally during the week at the net.wars Pinboard - or follow on Twitter.

Posted by Wendy M. Grossman at 6:29 PM | Permalink | Comments (0) | TrackBacks (0)

I have been baffled to read the more sensationalist headlines claiming that as a result of a case decided this week in the European Court of Human Rights employers now have the right to snoop on employees' messaging. Partly because employers have always had the *ability* even if they didn't have the right, and partly because it doesn't seem to this not-a-lawyer like the original complainant, a Romanian engineer named Bogdan Mihai Barbulescu, had much of a case to begin with.

Barbulescu was fired for using his work Yahoo! Messenger account to send messages to his fiancée even though his employer had officially banned sending personal messages while at work. When the employer wanted to see the logs (which were supposed to be logs of corporate communications), Bartulescu said they were all work communications. They weren't: some were those aforesaid messages to his fiancée. The result is that the engineer remains fired, and the court held that it's not unreasonable for an employer to verify that employees are actually working. The key seems to be that the employer must be clear about what the policy is and how it will be enforced. Which leaves us...exactly where we were, I think.

My recollection is that concern about the possibilities that the arrival of computer systems would enable employers to monitor their employees in depth goes back to at least 1990; I thought I recalled first seeing it in the EU's directive on minimum safety and health requirements for work with "display screen equipment", but rereading the directive today, I can't find it there. The Public Privacy instead cites the 1995 Data Protection Directive, which gives "data subjects" (that's us) the right to be notified when their personal information is collected. So let's say this: I remember being startled sometime in the early 1990s by reading legislation that protected employees from secret monitoring via computer. I may remember wrong.

In any case, as I wrote in the Herald, even people who think they don't care about privacy because "I have nothing to hide" understand this as a loss of personal autonomy they do care about.

In an example of the kind of news we can expect from the Internet of Things, Google apparently deployed a buggy update to its Nest thermostats that caused the batteries to run down and a whole lot of people to get cold. How little we have learned since oh, probably 1960 and any one of dozens of other examples of badly managed software updates. It's tempting to rant about the incompetence of people who can't test things adequately, but the reality is that this particular bug took a couple of weeks to show up while the thermostats kept pointlessly trying to connect to their mothership. So the first mistake is not having a way for the thermostat to say, hey, no internet, and stop trying. The really bigger mistake is the complexity of rebooting these things once the battery has run down: the described nine-step procedure fails every imaginable usability test. So the big lesson here is to design for easy recovery from unexpected failure modes (along the lines of installing a fresh battery and hitting one button). The other lesson is to be smart enough people to buy *stupid* thermostats in the first place, at least until other people have debugged this generation.

In a different example of failure mode, we note an update on the bitcoin community crisis net.wars noted last September. Mike Hearn, one of the earliest (British) bitcoin developers, has quit the project, the currency, and the community, saying that it never occurred to him that the project could fall apart because of "fundamental political disagreements over the goals of the project". Now, it's just possible that bitcoin transactions may shudder to a halt for that reason.

Had Hearn read Nathaniel Popper's Digital Gold: The Untold Story of Bitcoin, he might have been less surprised. In telling the story of bitcoin, the book laid bare the many different motives people had for joining the movement. Some wanted to wrest currency out of government control; others love crypto and experimentation; and still others saw a business opportunity. When something is small, the divergence of motives doesn't matter too much because the immediate goal is the same: make it bigger. It's when a certain amount of growth has been achieved and further-reaching decisions have to be made that disagreement over goals and values kills. As we have written here so often, community does not scale. If Hearn but knew it, the fact that bitcoin has reached this point is actually a sign of some kind of success. However, it's not a sign that bitcoin as it was originally conceived will survive. Instead, as someone predicted a couple of years ago at the Tomorrow's Transactions Forum, the most likely is that the ideas - the blockchain - will be subsumed into our existing financial system.

The bitcoin community as it's been until now will splinter into its varying constituencies. I'd suggest that the present situation is roughly equivalent to the dot-com bust, in which trillions of dollars in market valuations of highly dubious companies disappeared. Even while it was happening, however, almost everyone in the business or technical communities thought the internet was going to a whole lot bigger ten years later. And so it was. I've been and continue to be highly skeptical about bitcoin as a currency - but even I can tell the ideas behind it are not finished, not by any means.

Wendy M. Grossman is the 2013 winner of the Enigma Award. Her Web site has an extensive archive of her books, articles, and music, and an archive of earlier columns in this series. Stories about the border wars between cyberspace and real life are posted occasionally during the week at the net.wars Pinboard - or follow on Twitter.

Posted by Wendy M. Grossman at 4:02 PM | Permalink | Comments (0) | TrackBacks (0)

"I always tell my students to write software assuming there's an adversary," the University of Pennsylvania professor Jonathan M. Smith said to me this week. That may not sound like much at first glance, but at work it's an exceptionally powerful principle.

It isn't, of course, how we normally think. Most of us are pretty trusting of other people most of the time. We walk on city streets and wait on railway platforms generally confident that none of the people around us is likely to suddenly decide to push us into the path of oncoming vehicles. In fact, many people are now so trusting about the lack of threats on the street that they willingly block one of their most essential senses for spotting danger - hearing - while diverting all their visual attention to their phones. Evolutionarily speaking, they're great prospects for the Darwin Awards. Similarly, all of the drivers piloting tons of machinery at high speeds on highways assume that none of their fellow road users is suddenly going to turn their vehicle into a weapon of motorway destruction. Ove time, as these things don't happen, we become increasingly secure in our assessment of the situation.

When you apply this habit of mind to today's big issues of surveillance and monitoring, the fact that so far most people haven't suffered much beyond unwanted advertising makes many of us complacent - unfortunately so. In a lengthy talk, The Moral Character of Cryptography last December, the UC Davis computer scientist Philllip Rogaway noted the gap between academic cryptographers' idea of cryptography as a series of challenging but neutral mathematical puzzles and activists' and governments' assessment of it as an important political tool. While discussing this problem, Rogaway notes that "History teaches us that extensive government surveillance becomes political in character." In other words, no matter the intentions of today's large companies and governments in collecting so much data about each of us, the eventual outcome can be confidently predicted.

Rogaway argues in favor of applying personal values to such decisions as what to work on and whom to take funding from. He also recommends avoiding the now-common idea that the problem of mass data collection can be solved by controlling access and use. The mere fact of the collection turns people into shallow conformists (he writes), and chills political action, whether or not the data is seen to be used.

Which brings me back to Smith's principle. In comments I submitted to the committee considering the draft investigatory powers bill, I focused on the "hacker's charter" portion of the bill - that is, the part that would grant GCHQ the right to perform "bulk equipment interference". The bill talks about "computers" and "smartphones" without ever making plain that a computer is not what most of today's Parliamentarians probably think it is. A car is 70 computers on a wheelbase; even lightbulbs are computers now. So the bill's proposals grant GCHQ and potentially the police far greater and more wide-ranging power than I suspect most MPs would imagine: not just sneaking into your browsing history to look for jihadist websites, but querying your car's GPS to find out where you've driven and your child's toy to see what it's heard. The risk that scares me is that since even the best hackers make mistakes, other results could include 100-car pile-ups on the M1. It is a huge mistake to think the investigatory powers bill is just about *data*.

This is why Smith's principle is so important. Anyone in the IT industry knows any product might be hacked. But car and light bulb manufacturers do not think this way, and neither do the makers of myriad other devices that are now becoming "smart" - that is, "open to attack". If everything is fair game for state-sponsored hackers, then everything has adversaries; it doesn't matter which state or what their motives are.

It's tempting to grab at a sports metaphor: say, the difference between figure skating and tennis. Both are competitions against others, but in tennis the adversary is on the court with you trying to frustrate you and use every move you make as an opening they can use to get past your defenses. We must assume that even a washing machine is now playing tennis.

Much of security is traditionally reactive, patched as holes reach significance. We lock our houses because others' houses have been burgled. We hire regulators to ensure that restaurants, drugs, and electrical appliances are safe because others have had food poisoning, been sold snake oil, and died in fires. And yet: some risks we conveniently stop seeing. The flu kills more people than terrorists but we fear it less; even without adversaries at the wheel 32,000 people a year die in car crashes. Instead, we now need to think ahead.

The driver's education I took as a teenager included a segment on defensive driving: assume at all times that the drivers around you might do something stupid or unexpected. This habit is even more important in cycling, where the balance of power between you and the other vehicles on the road is much less in your favor. So what we need, by extension, is defensive computing. Only for "computing" write "design", because increasingly everything is software-driven.

Wendy M. Grossman is the 2013 winner of the Enigma Award. Her Web site has an extensive archive of her books, articles, and music, and an archive of earlier columns in this series. Stories about the border wars between cyberspace and real life are posted occasionally during the week at the net.wars Pinboard - or follow on Twitter.

Posted by Wendy M. Grossman at 6:31 PM | Permalink | Comments (0) | TrackBacks (0)

I like neither large crowds nor loud noises, but I can't help feeling sad about the number of places - Brussels, Paris, Munich, Moscow - that felt the need to close down or limit New Year's celebrations. Not London or New York: they're deploying extra police and carrying on. Sometimes capitalism wins: with a captive audience of 1 million, Times Square restaurants got to charge extra hundreds of dollars per meal, and who would dare to try to stop them?

As world problems go, cancelling fireworks is small beer - although the right to assemble was important enough to put in the US First Amendment - but it seems emblematic of a year that began with the Charlie Hebdo murders and ended with any and all attacks, no matter how small, being characterized as "terrorism" and examples of the radicalizing power of the internet.

With only 30 days to go before the Iowa caucus kicks off the US presidential primary season, it's reasonable to hope that people won't really need the Chrome extension offering Donald Trump-free browsing. Mr Schlonged has known exactly how to play a media looking for a circus clown to liven up proceedings. Of course, the petition to ban Trump from entering Britain, signed by 566,949 (at last count) won't go anywhere because, as the submitter notes, rich and powerful people are not considered likely to cause social harm. With so many refugees entering Europe, even Sweden might have less room for him than they used to.

Despite myriad efforts to increase surveillance and data collection on all of us, privacy had some good moments. Long pending, the data protection reform package was finally agreed in mid-December. In September, Austrian law student Max Schrems won a European Court of Justice ruling that the Safe Harbor agreement under which so much data was transferred to US servers, was invalid. In July, UK courts awarded a win to the MPs Tom Watson and David Davis in the case they brought against the UK government over the Data Retention and Investigatory Powers Act.

Even so, that same week heralded the new frontier of computer dangers, that increased software control over the physical world also provides new ways of bypassing the law, when Volkswagen was caught programming its cars to cheat on emissions tests. The case was just one of several examples of the move of traditional net.wars topics into the physical world. In April, John Deere and General Motors tried to claim that the software embedded in vehicles means that repairing your own tractor is illegal under the Digital Millennium Copyright Act. In the world according to John Deere - and, we found in December, Philips light bulbs - we're just licensees. Expect much more of things not working and refusing to play with each other as the Internet of Things takes shape.

US owners of drones are now required to register with the Federal Aviation Authority, whose new, widely criticized rules also create a no-fly zone around Washington, DC, thereby shutting down a dozen or two drone clubs that have operated without trouble for years. (One such group, the DC Area Drone User Group, spoke at Computers, Freedom, and Privacy in 2013 and 2014.)

According to November's Surveillance Camera Commissioner's report (PDF), shrinking budgets are causing local authorities to move away from 24/7 CCTV monitoring. However, some are moving to public-private partnerships to finance this and saving money by replacing knowledgeable managers with less-skilled operators. The report also notes that the central, police-accessible Automatic Number Plate Recognition database adds 30 million reads a day from its network of 8,300 cameras. Some police want to raise the time this data is kept from two years to seven years.

Other 2015 watershed moments: the NASDAQ made its first bitcoin trade. Usability pioneer Donald Norman and Mac designer Bruce Tognazzi accused Apple of abandoning usability in favor of aesthetics - and inspiring many other companies to do the same, giving us a web filled with poor-contrast grey text. Ad blockers became institutionalized. Governments adopted magical thinking. Finally, the Open Addresses project that looked so promising back in April was killed by the digital cholera that had been plaguing it all along.

For 2016 here are two (sadly) easy predictions.

The dispute between governments and the laws of mathematics will continue. Microsoft has said it will notify users when state-sponsored actors hack into their data. Legalizing such hacking is one plank of Britain's draft Investigatory Powers bill; David Cameron has indicated that will be illegal to tell users when they're being monitored. A lot more about this will be discussed at the tenth Scrambling for Safety event, scheduled for January 7. Come to learn more about surveillance, privacy, technology, and the investigatory powers bill.

The amount of money spent in this election cycle will set yet another record. Last time - 2012 - was the first trillion-dollar election. What do we get for all that? The money will repair no bridges, rescue no one from poverty, do nothing about climate change. Instead, the money will pay for millions of interrupted dinners, phone messages, emails, and TV/radio ads...and eventually deliver a severely compromised president and Congress that half the country viscerally despises. Ain't democracy grand?

Happy new year, folks.

Wendy M. Grossman is the 2013 winner of the Enigma Award. Her Web site has an extensive archive of her books, articles, and music, and an archive of earlier columns in this series. Stories about the border wars between cyberspace and real life are posted occasionally during the week at the net.wars Pinboard - or follow on Twitter. Our apologies that comments here are shut down because of spambots.

Posted by Wendy M. Grossman at 4:26 PM | Permalink | Comments (0) | TrackBacks (0)