net.wars

The untutored, asked how to handle a food crisis, are prone to suggest that everyone grow vegetables in their backyards. They did it in World War II!

I fell into this trap once myself, during the 2008 financial crisis, when I heard a Russian commentator explain on US talk radio that Americans could never survive because we were too soft and individualistic, whereas Russians were used to helping each other out in hard times, living together in cramped conditions, and working around shortages. Nonsense, I thought. Americans are quite capable of turning off their TVs, getting up off their couches, and doing useful stuff when they need to. Wishing for a Plan B, I thought of the huge backyard some Pennsylvania friends had, which backed onto three more similarly-sized backyards, and imagined a cooperative arrangement in which one family kept chickens and another grew some things, and a third grew some complementary things...and they swapped and so on.

My Pennsylvania friends were not impressed. "Is this a joke?"

"It's a Plan B! It's good to have a Plan B!"

It's not a Plan B.

A couple of years ago, at the annual conference convened by the Cybernetics Society, I learned it wasn't even a Plan Y.

"It's subsistence farming," Kate Cooper explained as part of her talk on food security. The grueling full-time unpredictability of that is is what most of us gave up in favor of selecting items off grocery store shelves once or twice a week.

The point about subsistence farming is that it's highly unreliable, highly individual, and doesn't scale to the levels required for a modern society, still less for a densely populated modern British society that imports almost all its food. Yes, people were encouraged to grow vegetables in World War II, but although the net effect was good for morale and for helping people better understand the foods they eat, it doesn't help anyone understand the food system and its scale and complexity. Basically, in terms of the problem of feeding the nation, it was a rounding error. Worth doing, but not a solution.

Cooper is the executive director of the Birmingham Food Council, a community interest company that grew out of efforts to think about the future of Birmingham. "It's our job to be an exemplar of how to think about the food system," she explained.

Two years later, with stories everywhere about escalating food prices and dangerous shortages, the interdependencies that underlie our food supply are being exposed by the intermingling of three separate crises, each of which would be bad on its own: the pandemic, Russia's invasion of Ukraine, and climate change. A source I can't recall calls this constellation a "polycrisis" - multiple simultaneous crises that interact to make them all worse. Plus, while the present government doesn't admit it, *Brexit* has added substantially to the challenges of maintaining the UK's increasingly brittle, highly complex system that few of us understand by fracturing trade relationships and pushing workers out of the industry.

As part of its research, the Council created The Game, a scenario-based role-playing game for decision makers, food sector leaders, researchers, and other policy influencers in which teams of four to six are put in charge of a city and must maintain the residents' access to enough safe and nutritious food.

I felt better about my own level of ignorance when I learned that one player's idea for combating shortages was to grow potatoes along the A38, a major route that runs from Bodmin, Cornwall, to Mansfield, Nottinghamshire. No idea of scale, you see, or the toxins passing automobiles deposit in the soil. (To say nothing of the inefficiencies of trying to farm a plot of land that's 292 miles long and a few hundred yards wide...) Another player wanted to get the national government to send in the army. Also not helping...but they were not alone, as many players found it difficult to feed their populations. People who had played it when the pandemic began forcing lockdowns and hourly changes to the food system. "Nothing had surprised [the people who had played The Game]", she said. Even so, the lockdowns showed the fragility of the food system and how powerless local officials are to do anything about it.

There are options at the national level. If you are lucky enough to have a government that has both the resources and the will to plan for the future, you can create buffer stocks to tide you through a crisis. You need a plan to rotate and resupply since some things (grain) store much better than others (fresh produce). Cooper has a simple plan for deciding which foodstuffs should be stored and which not: is it subject to VAT? That would lead to storing essentials - the healthy, nutritious stuff - and not candy, alcohol, caffeine, sugar, potato chips. Cooper calls those "drug foods", and notes that over 50% of most household budgets are spent on them, 6% of the potato crop goes to making Walker's potato chips, and a 2012 estimate found that Coca Cola's global consumption of water was enough to meet the annual daily needs of more than 2 billion people.

"Is this a sensible use of increasingly scarce land and water?" she asked.

Put like that, what can you say?

Illustrations: Kate Cooper. *Quote attributed to Alfred Henry Lewis, 1906.

Wendy M. Grossman is the 2013 winner of the Enigma Award. Her Web site has an extensive archive of her books, articles, and music, and an archive of earlier columns in this series. Stories about the border wars between cyberspace and real life are posted occasionally during the week at the net.wars Pinboard - or follow on Twitter.

Posted by Wendy M. Grossman at 1:23 PM | Permalink | Comments (0) | TrackBacks (0)

Three months ago, for a book Cybersalon is producing, called Twenty-Two Ideas About the Future, I wrote a provocation about a woman living in Heartbeat Act Texas who discovers she's pregnant. When she forgets to disable its chip, the "smart" home pregnancy test uploads the news to the state's health agency, which promptly shares it far and wide. Under the 2021 law's sanctions on intermediaries, payment services, travel companies, supermarkets all fear being sued as intermediaries, and so they block her from doing anything that might lead to liability, like buying alcohol, cigarettes, or a bus ticket to the state line, or paying a website for abortion pills.

It wasn't supposed to come true, and certainly not so soon.

As anyone who's seen any form of news this week will know, in a leaked draft of the US Supreme Court's decision in Dobbs v. Jackson Women's Health Organization, author Justice Samuel Alito argues that its 1973 decision in Roe v. Wade was "wrongly decided". This is not the place to defend the right to choose or deplore the dangers of of valuing the potential life of a fetus over the actual life of the person carrying it (Louisiana legislators have advanced a bill classifying abortion as homicide). But it is the place to consider the privacy loss if the decision proceeds as indicated, and not just in the approximately half of US states predicted to jump at the opportunity to adopt forced-childbirth policies.

On my shelf is Alan E. Nourse's 1965 book Intern, by Doctor X, an extraordinarily frank diary Nourse kept throughout his 1956 internship. Here he is during his OB/GYN rotation: "I don't know who the OB men have to answer to around here when they get back suspicious pathology reports...somebody must be watching them." In an update, he says the hospital's Tissue Committee reviewed pathology reports on all dilation and curettage procedures; first "suspicious" report attracted a private warning, second a censure, and third permanent expulsion from the hospital staff.

I first read that when I was 12, and I did not understand that he was talking about abortion - although D&Cs were and are routine, necessary procedures, in that time and place each one was also suspected, like travelers today boarding a plane. Every miscarriage had to be cleared of suspicion, a process unlikely to help any of the estimated 1 million per year who grieve pregnancy loss. Elsewhere, he notes the number of patients labeled "NO INFORMATION"; they were giving their babies up for adoption. Then, it was sufficient to criminalize the doctors.

Part of Alito's argument is that abortion is not mentioned in either the Constitution or the First, Fourth, Fifth, Ninth, or Fourteenth Amendments Roe cited. Neither, he says, is privacy; that casual little aside is the Easter egg pointing to future human rights rollbacks.

The US has insufficient privacy law, even in the health sector. Worse, the data collected by period trackers, fitness gizmos, sleep monitoring apps, and the rest is not classed as health data to be protected under HIPAA. In 2015, employers' access to such data through "wellness" programs began raising privacy concerns; all types of employee monitoring have expanded since the pandemic began. Finally, as Johana Bhuiyan reported at the Guardian last month, US law enforcement has easy access to the consumer data we trustingly provide to companies like Apple and Meta. And even when don't provide it, others do: in 2016, anti-choice activists were caught snapping pictures of women entering clinics, noting license plate numbers, and surveiling their smarphones via geofencing to target those deemed to be "abortion-minded".

"Leaving it to the states" - Alito writes of states' rights, not of women's rights - means any woman of child-bearing age at risk of living under a prohibitive regime dare not confide in any of these technologies. Also dangerous: insurance companies, support groups for pregnancy loss or for cancer patients whose treatment is incompatible with continuing a pregnancy, centers for health information, GPS-enabled smartphones, even search engines. Heterosexual men can look forward to diminished sex lives dominated by fear of pregnancy (although note that no one's threatening to criminalize ejaculating inside a vagina) and women may struggle to find doctors willing to treat them at all.

My character struggled to travel out of state. This was based on 1980s Ireland, where ending a pregnancy required a trip to England; in 1992 courts famously barred a raped 14-year-old from traveling. At New York Magazine, Irin Carman finds that some Republican politicians are indeed thinking about this.

Encryption, VPNs, Tor - women will need the same tools that aid dissidents in authoritarian countries. The company SafeGraph, Joseph Cox reports at Vice, sells location data showing who has visited abortion clinics. In response, SafeGraph promised to stop. By then Cox had found another one.

At Gizmodo, Shoshona Wodinsky has the advice on privacy protection my fictional character needed. She dares not confide in anyone she knows lest she put them at risk of becoming an attackable intermediary, yet everyone she *doesn't* know has already been informed.

This is the exact near-future Parmy Olson outlines at Bloomberg, quoting US senator Ron Wyden (D-OR): "...every digital record - from web searches, to phone records and app data - will be weaponized in Republican states as a way to control women's bodies."

Illustrations: Map of the US states with "trigger laws" waiting to come into force if Roe v. Wade is overturned (via M. Bitton at Wikimedia.

Wendy M. Grossman is the 2013 winner of the Enigma Award. Her Web site has an extensive archive of her books, articles, and music, and an archive of earlier columns in this series. Stories about the border wars between cyberspace and real life are posted occasionally during the week at the net.wars Pinboard - or follow on Twitter.

Posted by Wendy M. Grossman at 1:04 PM | Permalink | Comments (0) | TrackBacks (0)

"The airline probably needed to do a better job to make sure its pilots understood exactly what to do in case the aircraft was performing in a unique, unusual way, and how to get out of the problem," former National Transportation Safety Board chair Mark Rosenker tells CBS News in the recent documentary Downfall: The Case Against Boeing (directed by Rory Kennedy, written by Mark Bailey and Keven McAlester, and streaming on Netflix). He then downplays the risk to passengers: "Certainly in the United States they understand how to operate this aircraft."

Rosenker was speaking soon after the 2018 Lion Air crash.

Three oh-my-god wrong things here: the smug assumption that *of course* American personnel are more competent than their Indonesian counterparts (see also contemporaneous articles dissing Indonesia's airline safety record); the presumption that a Boeing aircraft is safe and the crash a non-recurring phenomenon; and the logical sequitur that it must be the pilot's fault. All that went largely unchallenged until the Ethiopian Airlines crash, 19 weeks later. Even then, numerous countries grounded the plane before the US finally followed suit - and even *then* it was ordered by the president, not the Federal Aviation Authority. The FAA's regulatory failure needs its own movie.

As we all now know, a faulty attack sensor sent bad data to the aircraft's Maneuvering Characteristics Augmentation System, software intended to stabilize the plane. The pilot did his best in an impossible situation. Even after that became clear, Boeing still blamed the crew for not turning off MCAS. The reason: Boeing didn't tell them it was there. In Congressional testimony, the hero of the Hudson, Captain Sully Sullenberger, summed it up thusly: "We shouldn't expect pilots to have to compensate for flawed designs."

This blame game was a betrayal. One reason aviation is so safe is that all sides have understood that every crash damages everyone. The industry therefore embraced extensive cross-collaboration in which everyone is open about the causes of failures and shares solutions. Blame destroys that culture.

All of this could be a worked example in Jessie Singer's recent book There Are No Accidents: The Deadly Rise of Injury and Disaster - Who Profits and Who Pays the Price. Of course unintended injuries happen, but calling them "accidents" removes culpability and stops us from thinking too much about larger causes. "Accident" means: "nothing to see here".

With the 737 MAX, as press articles suggested at the time and the documentary shows, that larger cause was the demise of Boeing's pride-of-America safety-first engineering culture, which rewarded employees for notifying problems. The rot began in 1997, when a merger meant new bosses from McDonnell Douglas executives arrived, and, former quality manager John Barnett tells the camera, "Everything you've learned for 30 years is now wrong." Value for shareholders replaced safety-first. Employees were thinned. Planes were made of cheaper materials. Headquarters left Seattle, where engineering was based, for Chicago. The culture of safety gave way to a culture of concealment.

Aviation learned early the importance of ergonomic design to avoid pilot error. This is where the documentary is damning: Boeing's own emails show the company knew pilots needed training for MCAS and never provided it, even when directly asked - by Lion Air itself, in 2017. Boeing executives mocked them for asking, even though its own risk assessments predicted a 737 MAX crash every fifteen years. Boeing bet it could fix, test, and implement MCAS before it caused more trouble. It was wrong.

A fully-loaded plane crash makes headlines and sparks protests and Congressional investigations. Most of the "accidents" Singer writes about, however - traffic crashes, house fires, falls, drownings, and the nearly 840,000 opioid deaths classed as "unintentional injury by drug poisoning" since 1999 (see also Alex Gibney's Crime of the Century) - near-invisibly kill in a statistical trickle. One such was her best friend, killed when a car hit his bike. All these are "accidents" caused by human error. But even with undercounts of everything from shootings to medical errors, the "accidents" were the third leading cause of death in the US in 2019, behind heart disease and "malignant neoplasms" (cancer), ahead of cerebrovascular disease, chronic lower respiratory disease, Alzheimers, and diabetes. We research all those *and( covid-19, which was number three in 2020. Why not "accidents"? (Note: this all skews American; other wealthy countries are safer.)

Singer's argument resonates because during my ten years as the in-house writer for RISCS, then-director Angela Sasse argued repeatedly that users will do the secure thing if it's the easiest path to follow, and "user errors" are often failed security policies. Sometimes, fixes seem tangential, such as lessening worker stress by hiring more staff, updating computer systems, or ensuring better work-life balance, which may improve security because tired, stressed workers make more mistakes.

Singer argues that the human errors that cause "accidents" are predictable and preventable, and surviving them is a "marker of privilege". Across the US, she finds poverty correlated with "accidental" death and wealth with safety. The pandemic made this explicit. But Singer reminds that the same forces frame people crossing the street as "jaywalkers" and blame workers killed on factory lines for not following posted rules. Each time the less powerful is framed as the cause of their own demise. And so it required that second 737 MAX crash and 157 more deaths to ground that plane.

Illustrations: The Boeing 737 MAX (Boeing).

Wendy M. Grossman is the 2013 winner of the Enigma Award. Her Web site has an extensive archive of her books, articles, and music, and an archive of earlier columns in this series. Stories about the border wars between cyberspace and real life are posted occasionally during the week at the net.wars Pinboard - or follow on Twitter.

Posted by Wendy M. Grossman at 1:35 PM | Permalink | Comments (0) | TrackBacks (0)

"Someone ratted me out," a friend complained recently. They meant: after a group dinner, one of the participants had notified everyone to say they'd tested positive for covid a day later, and a third person had informed the test and trace authorities and now my friend was getting repeated texts along the lines of "isolate and get tested". Which they found invasive and offensive, and...well, just plain *unreasonable*.

Last night, Boris Johnson casually said in Parliament that he thought we could end all covid-related restrictions in a couple of weeks. Today there's a rumor that the infection survey that has produced the most reliable data on the prevalence and location of covid infections may be discontinued soon. There have been rumors, too, of charging for covid tests.

Fifteen hundred people died of covid in this country in the past week. Officially, there were more than 66,000 new infections yesterday - and that doesn't include all the people who felt like crap and didn't do a test, or did do a test and didn't bother to report the results (because the government's reporting web form demands a lot of information each time that it only needs if you tested positive), or didn't know they were infected. If he follows through. Johnson's announcement would mean that if said dinner happened a month from now, my friend wouldn't be told to isolate. They can get exposed and perhaps infected and mingle as normal in complete ignorance. The tradeoff is the risk for everyone else: how do we decide when it's safe enough to meet? Is the plan to normalize high levels of fatalities?

Brief digression: no one thinks Johnson's announcement is a thought-out policy. Instead, given the daily emergence of new stories about rule-breaking parties at 10 Downing Street during lockdown, his comment is widely seen as an attempt to distract us and quiet fellow Conservatives who might vote to force him out of office. Ironically, a key element in making the party stories so compelling is the hundreds of pictures from CCTV, camera phones, social media, Johnson's official photographer... Teenagers have known for a decade to agree to down cameras at parties, but British government officials are apparently less afraid anything bad will happen to them if they're caught.

At the beginning of the pandemic, we wrote about the inevitable clash between privacy and the needs of public health and epidemiology. Privacy was indeed much discussed then, at the design stage for contact tracing apps, test and trace, and other measures. Democratic countries had to find a balance between the needs of public health and human rights. In the end, Google and Apple wound up largely dictating the terms on which contact tracing apps could operate on their platforms.

To the chagrin of privacy activists, "privacy" has rarely been a good motivator for activism. The arguments are too complicated, though you can get some people excited over "state surveillance". In this pandemic, the big rallying cry has been "freedom", from the media-friendly Freedom Day, July 19, 2021, when Johnson removed that round of covid restrictions, to anti-mask and anti-vaccination protesters, such as the "Freedom Convoy" currently blocking up normally bland, government-filled downtown Ottawa, Ontario, and an increasing number of other locations around he world. Understanding what's going on there is beyond the scope of net.wars.

More pertinent is the diverging meaning of "freedom". As the number of covid prevention measures shrinks, the freedom available to vulnerable people shrinks in tandem. I'm not talking about restrictions like how many people may meet in a bar, but simple measures like masking on public transport, or getting restaurants and bars to information about their ventilation that would make assessing risk easier.

Elsewise, we have many people who seem to define "freedom" to mean "It's my right to pretend the pandemic doesn't exist". Masks, even on other people, then become intolerable reminders that there is a virus out there making trouble. In that scenario, however, self-protection, even for reasonably healthy people who just don't want to get sick, becomes near-impossible. The "personal responsibility" approach doesn't work in a situation where what's most needed is social collaboration.

The people landed with the most risk can do the least about it. As the aftermath of Hurricane Sandy highlighted, the advent of the Internet has opened up a huge divide between the people who have to go to work and the people who can work anywhere. I can Zoom into my friend's group dinner rather than attend in person, but the caterers and waitstaff can't. If "your freedom ends where my nose begins" (Zechariah Chafee Jr, it says hereapplies to physical violence, shouldn't it include infection by virus?

Many human rights activists warned against creating second-class citizens via vaccination passports. The idea was right, but privacy was the wrong lens, because we still view it predominantly as a right for the individual. You want freedom? Instead of placing the burden on each of us, as health psychologist Susan Michie has been advocating for months, make the *places* safer - set ventilation standards, have venues publish their protocols, display CO2 readings, install HEPA air purifiers. Less risk, greater freedom, and you'd get some privacy, too - and maybe fewer of us would be set against each other in standoffs no one knows how to fix.

Illustrations: Trucks protesting in Ottawa, February 2022 (via ΙΣΧΣΝΙΚΑ-888 at Wikimedia, CC-BY-SA-4.0).

Wendy M. Grossman is the 2013 winner of the Enigma Award. Her Web site has an extensive archive of her books, articles, and music, and an archive of earlier columns in this series. Stories about the border wars between cyberspace and real life are posted occasionally during the week at the net.wars Pinboard - or follow on Twitter.

Posted by Wendy M. Grossman at 1:21 PM | Permalink | Comments (0) | TrackBacks (0)

"One case!" railed a computer industry-adjacent US libertarian on his mailing list recently. He was scathing about the authoritarianism he thought implicit in prime minister Jacinda Ardern's decision to lock down New Zealand because one covid-positive case had been found in Auckland.

You would think that an intelligent guy whose life has been defined by the exponential growth of Moore's Law would understand by now. One *identified* case of unknown origin means a likely couple of dozen others who are all unknowingly going to restaurants, bars, concerts, and supermarkets and infecting other people. Put together the highly-transmissible Delta variant, which has ravaged India, caused huge spikes in the UK and Israel despite relatively high vaccination levels, and is vacuuming up ICU beds in vaccine-resistant US states, and the fact that under 20% of New Zealanders are vaccinated. Ardern, whose covid leadership has been widely admired all along, has absorbed the lessons of elsewhere. Locking down for a few days with so few cases buys time to do forwards and backwards contact tracing, 26 deaths, not tens of thousands, and an unstressed health care system. New Zealand has had months of normality punctuated by days of lockdown instead of, as elsewhere, months of lockdown punctuated by days of nervous attempts at socializing. Her country agrees with her. What more do you want?

The case was found Tuesday; lockdown began Wednesday. By Thursday, the the known case count was 21, with models predicting that the number of infected people was probably around 100. If all those people were walking around, that one case - imported, it now appears, from Australia - would be instigating thousands. Ardern has, you should excuse the expression, balls - and a touch of grace. I can't think of any other national leader who's taken the trouble to *thank* the index case for coming forward to get tested and thereby saving countless of his fellow citizens' lives.

Long ago - March 2020 - Ardern's public messaging included the advice "Be kind". This message could usefully be copied elsewhere - for example, the US, where anti-maskers are disrupting school board meetings andclassrooms, and anti-vaccination protests have left a man stabbed in Los Angeles. On Twitter and in other media, some states' medical staff report that among their hospitals'97%-unvaccinated covid caseloads are some who express regret, too late. Timothy Bella reports at the Washington Post that a Mobile, Alabama doctor has told patients that as of October 1 he won't treat anyone who is not vaccinated against covid. Alabama's vaccination rate, 36%, is the lowest in the US, the state is reporting nearly 4,000 new cases per day, and its hospitals have run out of ICU beds. His reaction is understandable. Useful motto for 2021: everyone is entitled to be anxious about the pandemic however they want.

Twitter has several "more of this, please"-type reactions. Tempting: there's the risk to other patients in the waiting room; the desire to push people to get vaccinated; the human reluctance to help people who won't help themselves to avoid dying of a preventable illness; the awareness of the frustration, burn-out, stress, and despair of hospital-based counterparts. And yet. This doctor isn't required by lack of resources to do triage. He just doesn't want to invest in treating people and be forced to watch their miserable, preventable deaths. I understand. But it's dangerous when doctors pick and choose whom they treat. Yes, barring medical contraindications, refusing covid vaccinations is generally a mistake. But being wrong isn't a reason to deny health care.

Ardern has - as she says - the advantage of being last. Working with less information, countries scrambling earlier to cope with new variants will inevitably make more mistakes. At the Atlantic, Howard Markel argues that we need to stop looking back to 1918 for clues to handling this one.

It's certainly true that the 1918 model has led us astray in significant ways, chiefly consequences of confusing covid with flu. In the UK, that confusion led the government to focus on washing hands and cleaning surfaces and ignore ventilation, a mistake it still hasn't fully rectified 18 months later. In the US, "it's a mild flu" is many people's excuse for refusing masks, vaccines, and other cautions. The 1918 example was, however, valuable as a warning of how devastating a pandemic can be without modern tools to control it. Even with today's larger population, 100 million deaths is too significant to ignore. For them, masks, ventilation, and lockdowns were the only really available tools. For us, they bought time for science to create better ones - vaccines. What we lack, however, is societal and political trust (whether or not you blame the Internet) and the will to spread manufacturing across the world. In 1918, the future, post-pandemic and post-war, was a "roaring" decade of celebration. Our post-pandemic future is more pandemics unless we pay attention to public health and building pandemic resistance, especially as climate change brings new microbes into direct contact with humans,

Markel is a professor at the University of Michigan, and his uncomfortable message is this: we are in uncharted territory. No wonder we cling to the idea that the pandemic of 2020-present is kinda-sorta 1918: without that precedent we are facing conditions of radical uncertainty. Be kind.

Illustrations: New Zealand prime minister Jacinda Ardern campaigning in 2017 (Brigitte Neuschwander-Kasselordner, via Wikimedia).

Wendy M. Grossman is the 2013 winner of the Enigma Award. Her Web site has an extensive archive of her books, articles, and music, and an archive of earlier columns in this series. Stories about the border wars between cyberspace and real life are posted occasionally during the week at the net.wars Pinboard - or follow on Twitter.

Posted by Wendy M. Grossman at 12:10 PM | Permalink | Comments (0) | TrackBacks (0)

The first months of the pandemic saw a burst of energetic discussion about how to make it an opportunity to invest in redressing inequalities and rebuilding decaying systems - public health, education, workers' rights. This always reminded me of the great French film director François Truffaut, who, in his role as the director of the movie-within-the-movie in Day for Night, said, "Before starting to shoot, I hope to make a fine film. After the problems begin, I lower my ambition and just hope to finish it." It seemed more likely that if the pandemic went on long enough - back then the journalist Laurie Garrett was predicting a best case of three years - early enthusiasm for profound change would drain away to leave most people just wishing for something they could recognize as "normal". Drinks at the pub!

We forget what "normal" was like. London today seems busy. But with still no tourists, it's probably a tenth as crowded as in August 2019.

Eighteen months (so far) has been long enough to make new habits driven by pandemic-related fears, if not necessity, begin to stick. As it turns out the pandemic's new normal is really not the abrupt but temporary severance of lockdown, which brought with it fears of top-down government-driven damage to social equity and privacy: covid legislation, imminuty passports, and access to vaccines. Instead, the dangerous "new normal" is the new habits building up from the bottom. If Garrett was right, and we are at best halfway through this, these are likely to become entrenched. Some are healthy: a friend has abruptly realized that his grandmother's fanaticism about opening windows stemmed from living through the 1918 Spanish flu pandemic. Others...not so much.

One of the first non-human casualties of the pandemic has been cash, though the loss is unevenly spread. This week, a friend needed more than five minutes to painfully single-finger-type masses of detail into a pub's app, the only available option for ordering and paying for a drink. I see the convenience for the pub's owner, who can eliminate the costs of cash (while assuming the costs of credit cards and technological intermediation) and maybe thin the staff, but it's no benefit to a customer who'd rather enjoy the unaccustomed sunshine and chat with a friend. "They're all like this now," my friend said gloomily. Not where I live, fortunately.

Anti-cash campaigners have long insisted that cash is dirty and spreads disease; but, as we've known for a year, covid rarely spreads through surfaces, and (as Dave Birch has been generous enough to note) a recent paper finds that cash is sometimes cleaner. But still: try to dislodge the apps.

A couple of weeks ago, the Erin Woo at the New York Times highlighted cash-free moves. In New York City, QR codes have taken over in restaurants and stores as contact-free menus and ordering systems. In the UK, QR codes mostly appear as part of the Test and Trace contact tracing app; the idea is you check in when you enter any space, be it restaurant, cinema, or (ludicrously) botanic garden, and you'll be notified if it turns out it was filled with covid-infected people when you were there.

Whatever the purpose, the result is tight links between offline and online behavior. Pre-pandemic, these were growing slowly and insidiously; now they're growing like an invasive weed at a time when few of us can object. The UK ones may fall into disuse alongside the app itself. But Woo cites Bloomberg: half of all US full-service restaurant operators have adopted QR-code menus since the pandemic began.

The pandemic has also helped entrench workplace monitoring. By September 2020, Alex Hern was reporting at the Guardian that companies were ramping up their surveillance of workers in their homes, using daily mandatory videoconferences, digital timecards in the form of cloud logins, and forced participation on Slack and other channels.

Meanwhile at NBC News, Olivia Solon reports that Teleperformance, one of the world's largest call center companies, to which companies like Uber, Apple, and Amazon outsource customer service, has inserted clauses in its employment contracts requiring workers to accept in-home cameras that surveil them, their surroundings, and family members under 18. Solon reports that the anger over this is enough to get these workers thinking about unionizing. Teleperformance is global; it's trying this same gambit in other countries.

Nearer to home, all along, there's been a lot of speculation about whether anyone would ever again accept commuting daily. This week, the Guardian reports that only 18% of workers have gone back to their offices since UK prime minister Boris Johnson ended all official restrictions on July 19. Granted, it won't be clear for some time whether this is new habit or simply caution in the face of the fact that Britain's daily covid case numbers are still 25 times what they were a year ago. In the US, Google is suggesting it will cut pay for staff who resist returning to the office, on the basis that their cost of living is less. Without knowing the full financial position, doesn't it sound like Google is saving money twice?

All these examples suggest that what were temporary accommodations are hardening into "the way things are". Undoing them is a whole new set of items for last year's post-pandemic to-do list.

Illustrations: Graphic showing the structure of QR codes (via Wikimedia).

Wendy M. Grossman is the 2013 winner of the Enigma Award. Her Web site has an extensive archive of her books, articles, and music, and an archive of earlier columns in this series. Stories about the border wars between cyberspace and real life are posted occasionally during the week at the net.wars Pinboard - or follow on Twitter.

Posted by Wendy M. Grossman at 12:41 PM | Permalink | Comments (0) | TrackBacks (0)

The slight reopening of international travel - at least inbound to the UK - is reupping discussions of vaccination passports, which we last discussed here three months ago. In many ways, the discussion recapitulates not only the ID card battles of 2006-2010 but also last year's concerns about contact tracing apps.

We revisit so soon for two reasons. First, the UK government has been sending out conflicting messages for the last month or more. Vaccination passports may - or may not - be required for university attendance and residence; they may be required for domestic venues - and football games! - in September. One minister - foreign secretary Dominic Raab - says the purpose would be to entice young people to get vaccinated, an approach that apparently worked in France, where proposing to require vaccination passports in order to visit cafes caused a Eiffel Tower-shaped spike in people presenting for shots. Others seem to think that certificates of either vaccination or negative tests will entice people to go out more and spend money. Or maybe the UK won't do them at all; if enough people are vaccinated why would we need proof of any one individual's status? Little has been said about whatever the government may have learned from the test events that were supposed to show if it was safe to resume mass entertainment gatherings.

Second, a panel discussion last month hosted by Allyson Pollack raised some new points. Many of us have thought of covids passport for international travel as roughly equivalent to proof of vaccination for yellow fever. However, Linet Taylor argues that the only time someone in a high-income country needs one is if they're visiting a country where the disease is endemic. By contrast, every country has covid, and large numbers - children, especially - either can't access or do not qualify for covid vaccinations. The problems that disparity caused for families led Israel to rethink its Green Pass, which expired in June and was not renewed. Therefore, Taylor said, it's more relevant to think about lowering the prevalence of the disease than to try to distinguish between vaccinated and unvaccinated. The chief result of requiring vaccination passports for international travel, she said, will be to add extra barriers for those traveling from low-income countries to high-income countries and cement into place global health inequality and unequal access to vaccines. She concluded that giving the responsibility to technology companies merely shows we have "no plan to solve them any other way".

It also brings other risks. Michael Veale, and Seda F. Gürses explain why the computational infrastructure required to support online vaccination verification undercuts public health objectives. Ellen Ullman wrote about this in 1997: computer logic eliminates fuzzy human accommodations, and its affordances foster administrative change from help to surveillance and inclusion to exclusion. No one using the system - that is people going to pubs and concerts - will have any control over what it's doing.

Last year, Westerners were appalled at the passport-like controls China put in place. This year, New York state is offering the Excelsior Pass. Once you load the necessary details into the pass, a mobile phone app, scanning it gains you admission to a variety of venues. IBM, which built the system, is supposedly already investigating how it can be expanded.

As Veale pointed out, a real-time system to check vaccination certificates will also know everywhere each individual certificate hass been checked, adding inevitable intrusion far beyond the vaccinated-yes/no binary. Two stories this week bear Veale out. The first is the New York Times story that highlighted the privacy risks of QR codes that are proliferating in the name of covid safety. Again, the average individual has no way to tell what data is incorporated into the QR code or what's being saved.

The second story is the outing of Monsignor Jeffrey Burrill by The Pillar, a Medium newsletter that covers the Catholic Church. The Pillar says its writers legally obtained 24 months' worth of supposedly anonymized, aggregated app signal data. Out of that aggregated mass they used known locations Burrill frequents to pick out a phone ID with matching history, and used that to track the phone's use of the LGBTQ dating app Grindr and visits to gay nightclubs. Burrill resigned shortly after being informed of the story.

More important is the conclusion Bruce Schneier draws: location data cannot be successfully anonymized. So checking vaccination passports in fact means building the framework of a comprehensive tracking system, whether or not that's the intention..

Like contact tracing apps before them, vaccination passports are a mirage that seem to offer the prospect of living - in this case, to people who've been vaccinated against covid - as if the pandemic does not exist. Whether it "works" depends on what your goal is. If it's to create an airport-style fast track through everyday life, well, maybe. If it's to promote public health, then safety measures such as improved ventilation, moving events outdoors, masks, and so on are likely a better bet. If we've learned anything from the last year and a half, it should be that no one can successfully create an individual bubble in which they can pretend the pandemic is over even while it rages in the rest of the world,

Illustrations: China's Alipay Health Code in March, 2020 (press photo).

Wendy M. Grossman is the 2013 winner of the Enigma Award. Her Web site has an extensive archive of her books, articles, and music, and an archive of earlier columns in this series. Stories about the border wars between cyberspace and real life are posted occasionally during the week at the net.wars Pinboard - or follow on Twitter.

Posted by Wendy M. Grossman at 11:48 AM | Permalink | Comments (0) | TrackBacks (0)

It is shameful that the UK government has apparently refused to learn anything over decades of these discussions, and is now ordering GPs in England to send their patient data to NHSx beginning on July 1 and continuing daily thereafter. GPs are unhappy about this. Patients - that is, the English population - have until June 23 to opt out. Government information has been so absent that if it were not for medConfidential we might not even know it was happening. The opt-out process is a dark pattern; here's how.

The pandemic has taught us a lot about both upsides and downsides of sharing information. The downside is the spread of covid conspiracy theories, refusal to accept public health measures, and death threats to public health experts.

But there's so much more upside. The unprecedented speed with which we got safe and effective vaccinations was enormously boosted by the Internet. The original ("ancestral") virus was genome-sequenced and shared across the world within days, enabling everyone to get cracking. While the heavy reliance on preprint servers meant some errors have propagated, rapid publication and direct access to experts has done far more good than harm overall.

Crowdsourcing is also proving its worth: by collecting voluntary symptom and test/vaccination status reports from 4.6 million people around the UK, the Covid Symptom Study, to which I've contributed daily for more than a year, has identified additional symptoms, offered early warning of developing outbreaks, and assessed the likelihood of post-vaccination breakthrough covid infections. The project is based on an app built by the startup Joinzoe in collaboration with 15 charities and academic research organizations. From the beginning it has seemed an obviously valuable effort worth the daily five seconds it takes to report - and worth giving up a modest amount of data privacy for - because the society-wide benefit is so obvious. The key points: the data they collect is specific, they show their work and how my contribution fits in, I can review what I've sent them, and I can stop at any time. In the blog, the project publishes ongoing findings, many of which have generated journal papers for peer review.

The government plans meet none of these criteria. The data grab is comprehensive, no feedback loop is proposed, and the subject access rights enshrined in data protection law are not available. How could it be more wrong?

Established in 2019, NHSx is the "digital arm" of the National Health Service. It's the branch that commissioned last year's failed data-collecting contact tracing app ("failed", as in many people correctly warned that their centralized design was risky and wouldn't work,). NHSx is all data and contracts. It has no direct relationship with patients, and many people don't know it exists. This is the organization that is demanding the patient records of 56 million people, a policy Ross Anderson dates to 1992.

If Britain has a national religion it's the NHS. Yes, it's not perfect, and yes, there are complaints - but it's a lot like democracy: the alternatives are worse. The US, the only developed country that has refused a national health system, is near-universally pitied by those outside it. For those reasons, no politician is ever going to admit to privatizing the NHS, and most citizens are suspicious, particularly of conservatives, that this is what they secretly want to do.

Brexit has heightened these fears, especially among those of us who remember 2014, when NHS England announced care.data, a plan to collect and potentially sell NHS patient data to private companies. Reconstructing the UK's economy post-EU membership has always been seen as involving a trade deal with the US, which is likely to demand free data flows and, most people believe, access to the NHS for its private medical companies. Already, more than 50 GPs' practices (1%) are managed by Operose, a subsidiary of US health insurer Centene. The care.data plan was rapidly canceled with a promise to retreat and rethink.

Seven years later, the new plan is the old plan, dusted off, renamed, and expanded. The story here is the same: it's not that people aren't willing to share data; it's that we're not willing to hand over full control. The Joinzoe app has worked because every day each contributor remakes the decision to participate and because the researchers provide a direct feedback loop that shows how the data is being used and the results. NHSx isn't offering any of that. It is assuming the right to put our most sensitive personal data into a black box it owns and controls and keep doing so without granting us any feedback or recourse. This is worse than advertisers pretending that we make free choices to accept tracking. No one in this country has asked for their relationship with their doctor to be intermediated by a bunch of unknown data managers, however well-meaning. If their case for the medical and economic benefits is so strong (and really, it is, *when done right*), why not be transparent and open about it?

The pandemic has made the case for the value of pooling medical data. But it has also been a perfect demonstration of what happens when trust seeps out of a health system - as it does when governments feudally treat citizens as data serfs. *Both* lessons should be learned.

Illustrations: Asklepios, Greek god of medicine.

Wendy M. Grossman is the 2013 winner of the Enigma Award. Her Web site has an extensive archive of her books, articles, and music, and an archive of earlier columns in this series. Stories about the border wars between cyberspace and real life are posted occasionally during the week at the net.wars Pinboard - or follow on Twitter.

Posted by Wendy M. Grossman at 1:19 PM | Permalink | Comments (0) | TrackBacks (0)

This week, an update to the UK's contact tracing app (which, confusingly, is labeled "NHS" but is actually instead part of the private contractor-run test and trace system) was blocked by Google and Apple because it broke their terms and conditions. What the UK wanted: people who tested positive to upload their collected list of venue check-ins, now that the latest national lockdown is easing. Under Google's and Apple's conditions, to which the government had agreed: banned. Oops.

The previouslies: this time last year, it was being widely suggested that contact tracing apps could save us. In May 2020, the BMJ blog called downloading the app a "moral obligation".

That reaction was part of a battle over privacy. Step One: Western horror at the Chinese Alipay Health Code app that assigned everyone a traffic light code based on their recent movements and contacts and determined which buildings and public places they could enter - the permission-based society at a level that would surely be unacceptable in a Western democracy. Step Two: the UK, like France, designed its own app to collect users' data for centralized analysis, tracking, and tracing. Privacy advocates argued that this design violated data protection law and that public health goals could be met by less invasive means. Technical advisers warned it wouldn't work. Step Three: Google and Apple built a joint "exposure notification" platform to underpin these contact tracing apps and set the terms: no centralized data collection. Data must remain local unless the user opts to upload it. The UK, and France grumpily switched when they discovered everyone else was right: their design didn't work. Later, the two companies embedded exposure notification into their operating systems so public health departments didn't have to build their own app.

Make no mistake: *contact tracing* works. It's a well-established practice in public health emergencies. But we don't know if contact tracing *apps* work where "work" means "reduce infections" as opposed to work technically, are well-designed, or even reject these silly privacy considerations. Most claimed success for these apps seems to have come shortly after release and measure success in download numbers, on the basis that the apps will only work if enough people use them. The sole exception appears to be Singapore, where claimed download rates near 60% and authorities report the app has halved the time to complete contact tracing from four days to two.

In June, Italian biologist Emanuele Rizzo warned in the British Medical Journal that the apps are poorly suited for the particular characteristics of how the coronavirus spreads and the heightened risk for older people, who are least likely to have smartphones. In October, AI researcher Allison Gardner wrote at The Conversation that the worldwide average for downloading these apps was an inadequate 20%.

The UK was slow to get its contact tracing app working, and by the time it did we were locking down for the winter. Even so, last summer most UK venues posted QR codes for visitors to scan to log their visit. If someone tests positive in that venue it's reported to a database, from where your phone retrieves it and alerts you if you were there at the same time so you can get tested and, if necessary, self-isolate.

Of course, for the last five months nothing's been open. Check-ins and contact tracing apps aren't much use when no one is going anywhere. But during the period when people tried this out, there were many reported problems, such as that the app may decide exposure has taken place when you and the infected person only overlapped briefly. It remains simpler, probably overall cheaper, and more future-proof to improve ventilation and make venues safer.

Google's and Apple's action means, I suppose, that I am supposed to be grateful, however grumpily, to Big Tech for protecting me against government intrusion. What I want, though, to be able to trust the health authorities so this sort of issue only arises when absolutely necessary. Depending on the vagaries of private companies' business models to protect us is not a solution.

This is a time when many are not happy with either company. Google's latest wheeze is to replace third-party cookies with Federated Learning of Cohorts, which assign Chrome users to categories it then uses to target ads. EFF has a new tool that shows if you've been "FLoCed" (Firefox users need not apply). Google calls this setup a privacy sandbox, and claims it will more privacy-protective than the present all-tracking, by-everyone, all-the-time situation. EFF calls this "old tracking" versus "new tracking", and argues for a third option: *not* tracking, and letting users decide what information to share and with whom.

Apple, meanwhile, began blocking tracking via third-party cookies last year, with dramatic results, and rejects apps that aren't compliant, though some companies are finding workarounds. This year, new Apple rules requiring privacy labels that identify the categories of data apps collect have exposed the extent of data collection via Google's Chrome browser and search app.

The lesson to be drawn here is not that these companies are reinventing themselves as privacy protectors. The lesson to be drawn is that each wants to be the *only* one to invade our privacy. It's only a coincidence that the result was that they refused to accommodate government demands.

Illustrations: Empty central London in lockdown in November 2020.

Wendy M. Grossman is the 2013 winner of the Enigma Award. Her Web site has an extensive archive of her books, articles, and music, and an archive of earlier columns in this series. Stories about the border wars between cyberspace and real life are posted occasionally during the week at the net.wars Pinboard - or follow on Twitter.

Posted by Wendy M. Grossman at 1:35 PM | Permalink | Comments (0) | TrackBacks (0)

A couple of days ago, MSNBC broadcast a segment featuring a mobile vaccination effort in which a truck equipped with a couple of medical personnel and a suitably stored supply of vaccines and other medical equipment, was shown driving around to various neighborhoods, parking in front of people's homes, where the personnel would knock on doors. There was a very brief clip of a woman identified as reluctant. "What made you decide to take the vaccine after all?" the interviewer asked (more or less). "The convenience," she said, from behind her mask.

Wow.

It's always been - or should have been - obvious that all vaccine hesitancy is not equal. Some people are just going to be born rebels, refusing to do *anything* an authority tells them to do, no matter how well-attested the instruction is or how much risk accompanies ignoring it. Some have adopted resistance as a performative or tribal identity. Some may be deeply committed through serious, if flawed, assessment of the vaccine itself. Some have serious historical and cultural reasons to be distrustful. Others have medical contraindications. Some may actually even be suicidal. But some - and they may even be the majority - could go either way, depending on circumstances. As a friend commented after I told them the story, imagine a single mother with three kids, one or more jobs, and a long daily to-do list. Vaccination may be far, far down the list in terms of urgency.

Even knowing all this, seeing the woman state it so baldly was breathtaking because we've gotten used to assuming that anyone opposing vaccination does so out of deeply-held and angry commitment. The nudge people would probably be less surprised. For those of us who spend time promoting skepticism, the incident was also a good reminder of the value of engaging with people's real concerns.

It also reminds that when people's decisions seem inexplicable "the convenience" is often an important part of their reasoning. It's certainly part of why a lot of security breaches happen. Most people's job is not in security but in payroll or design or manufacturing, and their need to get their actual jobs done takes precedence. Faced with a dilemma, they will do the quickest and easiest thing, and those who design attacks know and exploit this very human tendency. The smart security person will, as Angela Sasse has been saying for 20 years, design security policies so they're the easiest path to follow.

The friction they add has been a significant reason why privacy tools have often failed to command any significant market share: they require exceptional effort, first because of the necessity of locating, installing, and learning to use them and second because so often they bring with them the price of non-conformance. Ever try getting your friends to shift from WhatsApp to Signal? Until the recent WhatsApp panic, it was impossible because of the difficulty they could foresee of getting all their other contacts - the school and church groups, the tennis club, the neighbors - to move as well. No one wants to have to remember which service to use for each contact.

One or another version of this problem has hindered the adoption of privacy tools for nearly 30 years, beginning in 1991 when Phil Zimmermann invented PGP in an effort to give PC users access to strong encryption. For most people, PGP was - and, sadly, still is, too difficult to install and too much of a nuisance to use. The result was that hardly anyone used encrypted communications until it became invisibly built into messaging services like WhatsApp and Signal.

The move away from universally interoperable email risks becoming a real problem in splintering communications, if my personal experience is any guide. A friend recently demanded to know why I didn't have an iPhone; she was annoyed that she couldn't send me messages on her preferred app. "Because I have an Android," I said. "What's that?" she asked. For her, Android users are incomprehensibly antisocial (and for new-hot-kid-in-town Clubhouse we are not worthy.)

On a wider canvas, that issue of convenience is most of the answer to how we began with a cooperative decentralized Internet and are now contending with an Internet dominated for most people by centralized walled gardens. At every stage from the first web sites, when someone wanting to host a website had to do everything themselves, to today's social media new companies succeeded by solving the frustrations of the previous generation. People want to chat with their friends, see photos, listen to music, and build businesses; anything like a technical barrier that makes any of that harder is an opportunity for someone to insert themselves as an intermediary or, as TikTok is doing now, to innovate. The same network effects that helped Facebook, Apple, and Google to grow to their present side make it difficult to counter their dominance by seeding alternatives.

It did not have to come out this way; ISPs (and, later, others) could have chosen to provide tools and services to make it easy for us to own our own communities. For anyone trying to do that now it's a hard, hard sell. Those of us who want to see the Internet redecentralize will have to create the equivalent of a mobile vaccination van.

Illustrations: Houston Vaccines' mobile unit.

Wendy M. Grossman is the 2013 winner of the Enigma Award. Her Web site has an extensive archive of her books, articles, and music, and an archive of earlier columns in this series. Stories about the border wars between cyberspace and real life are posted occasionally during the week at the net.wars Pinboard - or follow on Twitter.

Posted by Wendy M. Grossman at 1:03 PM | Permalink | Comments (0) | TrackBacks (0)

In my lifetime there has never been a New Year that has looked so bleak. At 11pm last night, Big Ben tolled the final severance of the UK's participation in the European Union. For the last few days, as details of the trade agreement agreed last night become known, Twitter has been filling up with graphics and text explaining the new bureaucracy that will directly or indirectly affect every UK resident and the life complications still facing the 3 million EU citizens resident in the UK and the UK expatriates in the EU. Those who have pushed for this outcome for many years will I'm sure rejoice, but for many of us it's a sad, sad moment and we fear the outcome.

The bright spot of the arriving vaccines is already being tarnished by what appears to be a panic response pushing to up-end the conditions under which they were granted an emergency license. Case numbers are rising out of control, and Twitter is filled with distress signals from exhausted, overwhelmed heath care workers. With Brexit completed and Trump almost gone, 2021 will be a year of - we hope - renewed sanity and sober remediation, not just of the damage done this year in specific but of the accrued societal and infrastructural technical debt that made everything in 2020 so much worse. It is already clear that the cost of this pandemic will be greater than all the savings ever made by cuts to public health and social welfare systems.

Still, it *is* a new year (because of human-made calendars), and because we love round numbers - defining "round" as the number of digits our hands happen to have - there's a certain amount of "that was the decade" about it. There is oddly less chatter about the twenty years since the turn of the millennium, which surprises me a bit: we've completed two-fifths of the 21st century!

Even the pre-pandemic change was phenomenal. Ten years ago - 2010 - was when smartphones really took off, pouring accelerant on Facebook, Twitter, and other social media, which were over-credited for 2011's "Arab Spring" ("useful but not sufficient", the linked report concludes). At Gikii 2019, Andres Guademuz described this moment as "peak cyber-utopia". In fact, it was probably the second peak, the first having been circa 1999, but who's counting? Both waves of cyber-utopianism seem quaint now, in the face of pandemic-fueled social and economic disruption. We may - we do - look to social media for information - but we've remembered we need governments for public health measures, economic support, and leadership. The deliberate thinning of the institutions we now need to save us in countries like the US and UK is one legacy of the last 30 years of technology-fueled neoliberalism. Ronald Reagan, US president from 1980 to 1988, liked to say that the most frightening words in the English language were "I'm from the government and I'm here to help". Far more frightening is the reality of a government that can't, won't, or chooses not to help.

Twenty years ago - 2000 - was the year of the dot-com peak, when AOL disastrously merged with Time-Warner. The crash was well underway when 9/11 happened and ushered in 20 years of increasing surveillance: first an explosion of CCTV cameras in the physical world and, on the Internet, data retention and interception, and finally, in the last year or so, the inescapability of automated facial recognition, rolled out without debate or permission.

Despite having argued against all these technologies as they've come along, I wish I could report that investing in surveillance instead of public health had paid dividends in the Year of Our Pandemic 2020. Contact tracing apps, which we heard so much about earlier in the year, have added plenty of surveillance capabilities and requirements to our phones and lives, but appear to have played little part in reducing infection rates. Meanwhile, the pandemic is fueling the push to adopt the sort of MAGIC flowthrough travel industry execs have imagined since 2013. Airports and our desire to travel will lead the way to normalizing pervasive facial recognition, fever-scanning cameras, and, soon, proof of vaccination.

This summer, many human rights activists noted the ethical issues surrounding immunity passports. Early in the year this was easy pickings because the implementations were in China. Now, however, anyone traveling to countries like Canada and the US must be able to show a negative covid test within 72 hours before traveling from the UK. Demand for vaccination certificates is inevitable. Privacy International taken the view that " Until everyone has access to an effective vaccine, any system requiring a passport for entry or service will be unfair." Being careful about this is essential, because unfairness entrenched while we rebuild will be *very* hard to dislodge.

So, two big things to work towards in 2021. The first is to ensure that new forms of unfairness do not become the new normal. The second, which will take a lot of luck, even more diligence, and a massive scientific effort, is to ensure that one item on the Mindset list of 2040's 18-year-olds will be "There has never been a pandemic."

Happy new year.

Illustrations: New year's eve fireworks in London, 2014 (via Clarence Ji).

Wendy M. Grossman is the 2013 winner of the Enigma Award. Her Web site has an extensive archive of her books, articles, and music, and an archive of earlier columns in this series. Stories about the border wars between cyberspace and real life are posted occasionally during the week at the net.wars Pinboard - or follow on Twitter.

Posted by Wendy M. Grossman at 10:36 PM | Permalink | Comments (0) | TrackBacks (0)

Quick update to last week: the European Court of Justice has ruled in favor of Max Schrems a second time and struck down Privacy Shield, the legal framework that allowed data transfers from the EU to the US (and other third countries); businesses can still use Standard Contractual Clauses, subject to some conditions. TL;DR: Sucks even more to be the UK, caught in the middle between the EU and US demands regarding data flows. On to this week...

This week's Twitter hack is scary. Not, obviously, because it was a hack; by this time we ought to be too used to systems being penetrated by attackers to panic. We know technology is insecure. That's not news.

The big fear should be the unused potential.

Twitter's influence has always been disproportionate to its size. By Big Social Media standards, Twitter is small - a mere snip at 330 million users, barely bigger than Pinterest. TikTok has 800 million, Instagram has 1 billion, YouTube 2 billion, and Facebook 2.5 billion. But Twitter is addictively home to academics, politicians, and entertainers - and journalists, who monitor Twitter constantly for developments to report on. A lot of people feel unable to mention Twitter these days without stressing how much of a sinkhole they think it is (the equivalent of, in decades past, boasting how little TV you watched), but for public information in the West Twitter is a nerve center. We talk a lot about how Facebook got Trump elected, but it was Twitter that got him those acres of free TV and print coverage.

I missed most of the outage. According to Vice, on Wednesday similarly-worded tweets directing followers to send money in the form of bitcoin began appearing in the feeds coming from the high-profile, high-follower accounts belonging to Joe Biden, Elon Musk, Uber, Apple, Bill Gates, and others. Twitter had to shut down a fair bit of the service for a while and block verified users - high-profile public figures that Twitter deems important enough to make sure they're not fakes - from posting. The tweets have been removed, and some people who - presumably trying to follow standard practice in a data breach - tried to change their passwords got locked out - and some people must have sent money, since Vice reported the Bitcoin wallet in question had collected $100,000. But overall not much harm was done.

This time.

Most people, when they think about their social media account or email being hacked, think first of the risk that their messages will be read. This is always a risk, and it's a reason not to post your most sensitive secrets to technology and services you don't control. But the even bigger problem many people overlook is exactly what the attackers did here: spoofed messages that fool friends and contacts - in this case, the wider public - into thinking they're genuine. This is not a new problem; hackers have sought to take advantage of trust relationships to mount attacks ever since Kevin Mitnick dubbed the practice "social engineering" circa 1990.

In his detailed preliminary study of the attack, Brian Krebs suggests the attack likely came from people who've "typically specialized in hijacking social media accounts via SIM swapping". Whoever did it and whatever route they took, it seems clear they gained access to Twitter's admin tools, which enabled them to change the email address associated with accounts and either turn off or capture the two-factor authentication that might alert the actual owners. (And if, like many people, you operate Twitter, email, and 2FA on your phone, you actually don't *have* two factors, you have one single point of failure - your phone. Do not do this if you can avoid it.)

In the process of trying to manage the breach, Eric Geller reports at Politico, Twitter silenced accounts belonging to numerous politicians including US president Donald Trump and the US National Weather Service tornado alerts, among many others that routinely post public information, in some cases for more than 24 hours. You can argue that some of these aren't much of a loss, but the underlying problem is a critical one, in that organizations and individuals of all stripes use Twitter as an official outlet for public information. Forget money: deployed with greater subtlety at the right time, such an attack could change the outcome of elections by announcing false information about polling places (Geller's suggestion), or kill people simply by suppressing critical public safety warnings.

What governments and others don't appear to have realized is that in relying on Twitter as a conduit to the public they are effectively outsourcing their security to it without being in a position to audit or set standards beyond those that apply to any public company. Twitter, on the other hand, should have had more sense: if it created special security arrangements for Trump's account, as the New York Times says it did, why didn't it occur to the company to come up with a workable system for all its accounts? How could it not have noticed the need? The recurring election problems around the world weren't enough of a clue?

Compared to what the attackers *could* have wanted, stealing some money is trivial. Twitter, like others before it, will have to rethink its security to match its impact.

Illustrations:

Wendy M. Grossman is the 2013 winner of the Enigma Award. Her Web site has an extensive archive of her books, articles, and music, and an archive of earlier columns in this series. Stories about the border wars between cyberspace and real life are posted occasionally during the week at the net.wars Pinboard - or follow on Twitter.

Posted by Wendy M. Grossman at 12:14 PM | Permalink | Comments (0) | TrackBacks (0)

What I - and I suspect a lot of other people - would love to have right now is an online calculator into which you could put where you were going, the time of day, the length of time you expect to spend there, and the type of activity and get back out a risk estimate of acquiring coronavirus infection given various mitigations. I write this as the UK government announces that the "threat level" is dropping from "4" to "3", which tells me more or less precisely nothing useful.

Throughout the pandemic, the British government has explained every decision by saying it's led by the science. I'm all for following the advice of scientists - particularly, in our present situation, public health experts, virologists, and epidemiologists - but "the science" implies there's a single received monolithic truth even while failing to identify any particular source for it. Which science? Whose research? Based on what evidence? Funded by whom? How does it fit in with what we were told before?

Boris Johnson's government spent much of the early months avoiding answering those questions, which has led, as the biologist Ian Boyd complains to the characterization of the Scientific Advisory Group for Emergencies (SAGE) as "secretive". As the public trusts this government less and less, showing their work has become increasingly important, especially when those results represent a change of plan.

The last four months have seen two major U-turns in "the science" that's governing our current lives, and a third may be in progress: masks, contact tracing apps, and the two-meter rule. Meanwhile, the pieces that are supposed to be in place for reopening - a robust contact tracing system, for example - aren't.

We'll start with masks. Before this thing started, the received wisdom was that masks protected other people from you, but not you from them. This appears to still be the generally accepted case. But tied in with that was the attitude that wearing masks while ill was something only Asians did; Westerners...well, what? Knew better? Were less considerate? Were made of tougher stuff and didn't care if they got sick? In mid-March, Zeynep Tufecki got a certain amount of stick on Twitter for impassioned plea in the New York Times that public health authorities should promote wearing masks and teach people how to do it properly. "Of course masks work," she wrote, "maybe not perfectly, and not all to the same degree, but they provide some protection."

But we had to go on arguing about it back and forth. There is says Snopes, no real consensus on how effective they are. Nonetheless, it seems logical they ought to help, and both WHO and CDC now recommend them while mayors of crowded cities are increasingly requiring them. In this case, there's no obvious opportunity for profiteering and for most people the inconvenience is modest. The worst you can suspect is that the government is recommending them so we'll feel more confident about resuming normal activity.

Then, for the last four months we've been told to stay two meters from everyone else except fellow household members. During the closures, elves - that is, people who took on the risks of going to work - have been busy painting distancing indicators on underground platforms, sidewalks, and park benches and sticking decals to train windows. They've set up hand sanitizer stations in London's stations, and created new bike lanes and pedestrian areas. Now, the daily news includes a drumbeat of pressure on government to reduce that recommended distance to one meter. Is this science or economics? The BBC has found a study that says that standing one meter apart carries ten times the risk of two meters. But how significant is that?

I'm all for "the science", but there's so much visible vested interest that I want details. What are the tradeoffs? How does the drop in distance change R0, the reproduction number? The WHO recommends one meter - but it assumes that people are wearing masks - which, in London, on public transport they will be but in restaurants they can't be.

Finally, when last seen, the UK's contact tracing app was being trialed on the Isle of Wight and was built in-house using a centralized design despite the best efforts of privacy advocates and digital rights activists to convince NHSx it was a bad idea. Yesterday, this app was officially discarded.

The relevant scientific aspect, however, is how much apps matter. In April, an an Oxford study suggested that 60% of the population would have use the app for it to be effective.

We should have read the study, as MIT Technology Review did this week to find that it actually says contact tracing apps can be helpful at much lower levels of takeup. It is still clear that human tracers with local knowledge are more effective and there are many failings in the tracing system, as the kibitzing scientific group Independent SAGE says, but *some* help is better than no help.

"The science" unfortunately can't offer us what we really want: certainty. Instead, we have many imperfect but complementary tools and must hope they add up to something like enough. The science will only become fully clear much later.

Illustrations: London's Paddington station on June 13.

Wendy M. Grossman is the 2013 winner of the Enigma Award. Her Web site has an extensive archive of her books, articles, and music, and an archive of earlier columns in this series. Stories about the border wars between cyberspace and real life are posted occasionally during the week at the net.wars Pinboard - or follow on Twitter.

Posted by Wendy M. Grossman at 1:09 PM | Permalink | Comments (0) | TrackBacks (0)

As a friend with greater experience with lockdowns might have said, when you see one coming be careful not only who you get locked down with, but where. People with strong local neighborhoods and personal relationships with independent local shops have had a vastly easier time through the last couple of months than most others.

My lifetime has seen everything progressively centralize. In the 1970s, someone living in Ithaca, New York, population about 30,000, could visit the phone company and negotiate billing with the same woman they dealt with several months previously. The guy who came to read the electric meter this month was the same guy you saw every month. And when you called the telephone operator to check on a phone number, they would confirm the address and speculate with you how to get there because they knew your town. Forty years later, if you *can* make a call to a utility company you're probably dealing with someone to whom your town is a dot they can't find on a map...

...which all brings me to this week, when a Twitter account that seemed to be from the National Health Service posted a note to the effect that we might get a message or call from "NHS" and if we did we should follow the instructions. The tweet also published the number we could expect to hear from. Because the immediate follow-up was a few people saying they would immediately block the number, I commented that the smart thing to do seemed to me to be to put the number in a phone's contacts so the call would be recognized.

But, the security folks reminded: SIM spoofing. True. Hello, phishing attacks.

Does the NHS employ no security experts?

Here are the NHS's published instructions for what to do if you're contacted. Note what's missing: a way to verify the call is genuine. Sure, they tell you they won't ask for bank details or other accounts, payment, or ask you to call premium rate numbers or set up a password or PIN over the phone. But they still miss the main point; that is, like a celebrity they still assume that because any call they make will be genuine, any call you get will be genuine. This is Ravenous Bugblagger Beast of Traal reasoning. I recommend wrapping a towel around your head.

As others have pointed out, you could quite effectively mount a denial-of-livelihood attack on someone by reporting them as an exposed contact so they are required to self-isolate for 14 days. Even 30 years ago the world contained people highly skilled at the kind of social engineering that would enable someone to pose effectively as a contact tracer. The NHS needs to do the obvious: publish a number people can call back to verify.

The press appeared to understand the possibilities, and had this exchange with the deputy chief medical officer for England, Jenny Harris:

A question about how to know if a track and trace call is genuine, one person asks. Harries says there is a lot of confidentiality and it will be unlikely you will be contacted by someone with other motives. She says it will be clear that they are genuine - they are professionally trained individuals.

I don't know how to rate the ignorant stupidity of this comment. The satirical magazine Private Eye, however, managed (see above).

This gathering of power to the center was on display elsewhere this week, as Jacob Rees-Mogg, the leader of the House of Commons, pushed to end remote participation and voting in Parliamentary debates. No one is saying that remote participation is ideal, but it *does* permit MPs to represent their constituents who shouldn't be traveling and taking health risks. Even more ridiculous is Rees-Mogg's refusal to countenance electronic voting, with replacement arrangements so absurd and time-wasting that one can only assume he fears losing control otherwise.

Contact tracing is one area where staying local makes all the difference. Anyone who lives in my little area, for example, would know to ask a senior testing positive whether they've been to the local club that (normally) provides classes (dancing, Pilates, photography), social lunches, and entertainment to hundreds of people, chiefly seniors. They know the local independent shops are community hubs as well as sources of essential items and would ask which ones the infected person uses. And they know the spot where homeless people who might struggle to find testing are often to be found selling The Big Issue. The local council, which UK epidemiologists have repeatedly said has the necessary contact tracing expertise, knows all this. Serco certainly doesn't.

We've written before about the dangers of centralizing the Net. What we've previously failed to recognize is how dangerous it can be when combined with politically convenient stupidity.

The UK government, which has been gathering power to the center ever since Margaret Thatcher disbanded the Greater London Council, is outsourcing contact tracing to Serco, which has proved so inept as to be genuinely dangerous. The result is to treat contact tracin contact tracing as if it were calls to customer service at a phone company an to mistake efficiency for effectiveness. Centralization was bad for the Internet. It's even worse for real life.

Illustrations: Private Eye explains contact tracing.

Wendy M. Grossman is the 2013 winner of the Enigma Award. Her Web site has an extensive archive of her books, articles, and music, and an archive of earlier columns in this series. Stories about the border wars between cyberspace and real life are posted occasionally during the week at the net.wars Pinboard - or follow on Twitter.

Posted by Wendy M. Grossman at 10:05 PM | Permalink | Comments (0) | TrackBacks (0)

Around 2010, when smartphones took off (Apple's iPhone user base grew from 8 million in 2009 to 100 million in early 2011), "There's an app for that" was a joke widely acknowledged as true. Faced with a pandemic, many countries are looking to develop apps that might offer shortcuts to reaching some variant of "old normal". The UK is no exception, and much of this week has been filled with debate about the nascent contact tracing app being developed by the National Health Service's digital arm, NHSx. The logic is simple: since John Snow investigated cholera in 1854, contact tracing has remained slow, labor-intensive , and dependent on infected individuals' ability to remember all their contacts. With a contagious virus that spreads promiscuously to strangers who happen to share your space for a time, individual memory isn't much help. Surely we can do better. We have technology!

In 2011, Jon Crowcroft and Eiko Yoneki had that same thought. Their Fluphone proved the concept, even helping identify asymptomatic superspreaders through the social graph of contacts developing the illness.

In March, China's Alipay Health got our attention. This all-seeing, all-knowing, data-mining, risk score-outputting app whose green, yellow, and red QR codes are inspected by police at Chinese metro stations, workplaces, and other public areas seeks to control the virus's movements by controlling people's access. The widespread Western reaction, to a first approximation: "Ugh!" We are increasingly likely to end up with something similar, but with very different enforcement and a layer of "democratic voluntary" - *sort* of China, but with plausible deniability.

Or we may not. This is a fluid situation!

This week has been filled with debate about why the UK's National Health Service's digital arm (NHSx) is rolling its own app when Google and Apple are collaborating on a native contact-tracing platform. Italy and Spain have decided to use it; Germany, which was planning to build its own app, pivoted abruptly, and Australia and Singapore (whose open source app, TraceTogether, was finding some international adoption) are switching. France balked, calling Apple "uncooperative".

France wants a centralized system, in which matching exposure notifications is performed on a government-owned central server. That means trusting the government to protect it adequately and not start saying, "Oooh, data, we could do stuff with that!" In a decentralized system, the contact matching us performed on the device itself, with the results released to health officials if the user decides to do so. Apple and Google are refusing to support centralized systems, largely because in many of the countries where iOS and Android phones are sold it poses significant dangers for the population. Essentially, the centralized ones ask you for a lot more trust in your government.

All this led to Parliament's Human Rights Committee, which spent the week holding hearings on the human rights implications of contact tracing apps. (See Michael Veale's and Orla Lynskey's written evidence and oral testimony.) In its report, the committee concluded that the level of data being collected isn't justifiable without clear efficacy and benefits; rights-protecting legislation is needed (helpfully, Lilian Edwards has spearheaded an effort to produce model safeguarding legislation; an independent oversight body is needed along with a Digital Contact Tracing Human Rights Commissioner; the app's efficacy and data security and privacy should be reviewed every 21 days; and the government and health authorities need to embrace transparency. Elsewhere, Marion Oswald writes that trust is essential, and the proposals have yet to earn it.

The specific rights discussion has been accompanied by broader doubts about the extent to which any app can be effective at contact tracing and the other flaws that may arise. As Ross Anderson writes, there remain many questions about practical applications in the real world. In recent blog postings, Crowcroft mulls modern contact tracing apps based on what they learned from Fluphone.

The practical concerns are even greater when you look at Ashkan Soltani's Twitter feed, in which he's turning his honed hacker sensibilities on these apps, making it clear that there are many more ways for these apps to fail than we've yet recognized. The Australian app, for example, may interfere with Bluetooth-connected medical devices such as glucose monitors. Drug interactions matter; if apps are now medical devices, then their interactions must be studied, too. Soltani also raises the possibility of using these apps for voter suppression. The hundreds of millions of downloads necessary to make these apps work means even small flaws will affect large numbers of people.

All of these are reasons why Apple and Google are going to wind up in charge of the technology. Even the UK is now investigating switching. Fixing one platform is a lot easier than debugging hundreds, for example, and interoperability should aid widespread use, especially when international travel resumes, currently irrelevant but still on people's minds. In this case, Apple's and Google's technology, like the Internet itself originally, is a vector for spreading the privacy and human rights values embedded in its design, and countries are changing plans to accept it - one more extraordinary moment among so many.

Illustrations: Alipay Health Code in action (press photo).

Wendy M. Grossman is the 2013 winner of the Enigma Award. Her Web site has an extensive archive of her books, articles, and music, and an archive of earlier columns in this series. Stories about the border wars between cyberspace and real life are posted occasionally during the week at the net.wars Pinboard - or follow on Twitter.

Posted by Wendy M. Grossman at 11:46 AM | Permalink | Comments (0) | TrackBacks (0)

Individual humans surprise you in a crisis; the curmudgeon across the street turns into a tireless volunteer; the sycophantic celebrity abruptly becomes a helpfully trenchant critic of their former-friend politicians. Organizations - whether public, as in governments, or private, as in companies - tend to remain in character, carried on by inertia, and claim their latest actions are to combat the crisis. For climate change - "greenwashing". For this pandemic - "viruswashing", as some of the creepiest companies seek to de-creepify themselves in the name of public health.

In the last month, Privacy International's surveillance legislation tracker has illustrated the usual basic crisis principles. One: people will accept things on a temporary basis that they wouldn't accept if they thought they'd be permanent. Two: double that for scared and desperate people. Three: the surveillance measures countries adopt reflect their own laws and culture. Four: someone always has a wish list of surveillance powers in their bottom drawer, ready to push for in a crisis. Five: the longer the crisis goes on the harder it will be to fully roll things back to their pre-crisis state when we can eventually all agree it's ended.

Some governments are taking advantage. Trump, for example, has chosen this moment to suspend immigration. More broadly, the UN Refugee Agency warns that refugee rights are being lost. Of 167 countries that have closed their borders in full or in part, 57 make no exceptions for asylum-seekers.

But governments everywhere are also being wooed by both domestic and international companies. Palantir, for example, is working with the US Centers for Disease Control and Prevention and its international counterparts to track the virus's spread. In the UK, Palantir and an AI start-up are data-mining NHS databases to build a predictive computer model. Largely uknown biometric start-ups are creating digital passports for NHS workers. The most startling is the news that the even-creepier NSO Group, whose government clients have used its software to turn journalists' and activists' phones into spy devices is trying to sell Western governments on its (repurposed) tracking software.

On Twitter, Pat Walshe (@privacymatters) highlights the Covid Credentials Initiative, a collaboration among 60 organizations to create verifiable credential solutions - that is, some sort of immunity certificate that individuals for individuals. Walshe also notes Jai Vijayan's story about Microsoft's proposals: "Your phone will become your digital passport". Walsh's commenters remind that in a fair number of countries SIM registration is essential. The upshot sounds similar to China's Alipay Health app, which scores each phone user and outputs a green, yellow, or red health code - which police check at entrances to areas of the city, public transport, and workplaces before allowing entry. Except: in the West we're talking a system built by private, secretive companies that, as Mike Elgan wrote last year at Fast Company, are building systems in the US that add up functionally to something very like China's much-criticized social credit scheme.

In Britain, where there's talk of "immunity certificates" - deconfinement apps - my model history of ID cards, which became mandatory under the National Registration Act (1939) and which no one decommissioned after World War II ended...until 1952, when Harry Willcock, who had refused to show police his ID card on demand, won in court by arguing that the law had lapsed when the emergency ended and the High Court agreed that the ID cards were now being used in unintended ways. Ever since, someone regularly proposes to bring them back. In the early 2000s it was to eliminate benefit fraud; in 2006 it was crime prevention. Now immunity certificates could be a wedge.

Tracking and tracing are age-old epidemiologists' tools; it's natural that people want to automate them, given the speed and scale of this pandemic. It's just the source: the creepiest companies are seizing the opportunity to de-creepify themselves by pivoting to public health. Eventually, Palantir has to do this if it wants to pay its investors the kind of returns they're used to; the law enforcement and security market is just too small. That said, at the Economist Hal Hodson casts nuance on Palantir's deal with the NHS - for now.

Obviously, we need all the help we can get. Nonetheless, these are not companies that are generally on our side. Letting them turn embed themselves into essential public health infrastructure feels like accepting letting a Mafia family use the proceeds of crime to buy themselves legitimate businesses. Meanwhile, much of the technology is unproven for health purposes and may not be effective, and basing it on apps, as Rachel Coldicutt writes, is a vector for discrimination

The post 9/11 surveillance build-up should have taught us that human rights must be embedded at the beginning because neither the "war on terror" nor the "war on drugs" has a formal ending when powers naturally expire. While this specific pandemic will end, others will come behind it. So: despite the urgency, protecting ourselves against permanent changes is easiest handled now, while the systems for tracking and tracing infections and ensuring public safety are being built. A field hospital can be built in ten days and then dismantled as if it never was; public health infrastructure cannot.

Illustrations: The Wicked Witch of the West and her crystal ball, from The Wizard of Oz (1939).

Wendy M. Grossman is the 2013 winner of the Enigma Award. Her Web site has an extensive archive of her books, articles, and music, and an archive of earlier columns in this series. Stories about the border wars between cyberspace and real life are posted occasionally during the week at the net.wars Pinboard - or follow on Twitter.

Posted by Wendy M. Grossman at 2:31 PM | Permalink | Comments (0) | TrackBacks (0)

The international comparisons that feature in every chart of infection curves are creating a new habit. Expatriates are unusually prone to this sort of thing anyway, as I've written before, but right now almost everyone appears to have some form of leader envy. Eventually, history will judge, but for now the unquestioned leader on the leader leaderboard is New Zealand prime minister Jacinda Ardern, who this week followed up her decisive and undeniably effective early action by taking a 20% pay cut in solidarity with her country's workers. Also much admired this week - even subtitled! - is Germany's Angela Merkel, whose press conference explaining that small margins in infection rates make huge differences when translated into hospital beds over time, was widely circulated for its honest clarity. Late yesterday New York state governor Andrew Cuomo appeared to have copied it for his own presentation.

Cuomo's daily briefings have become must-see-TV for many of us with less forthcoming leaders; they start with facts, follow with frank interpretation, and end with rambling empathy. Cuomo's rise - which has led many to wonder why he wasn't a presidential candidate - is greeted more cautiously among New York state residents and by those who note the effectiveness of governors Jay Inslee (Washington) and Gavin Newsom (California)). On Sunday's edition of Last Week Tonight, John Oliver said, "I never really liked Andrew Cuomo before this, but I will admit he's doing admirably well, and I can't wait to get to the other side of this when I can go back to being irritated by him again.". He may already have his chance: yesterday evening Cuomo announced he'd signed up McKinsey to plan a strategy for ending the lockdown. Meanwhile, in a tiny unrepresentative sample of local contacts "what world leader do you wish you had in this crisis?", the only British leader mentioned was Scottish first minister Nicola Sturgeon. Only the US federal vacuum can make us feel better about our present government.

One unexpected entertainment in this unfolding disaster is the peeks inside people's homes afforded by their appearances on TV or Zoom. I am finally getting to browse at least a small portion of the bookshelves and artwork or admire the ceiling cornices belonging to people I've known for decades but have never had the chance to visit. How TV commentators set themselves up is revealing, too. Adam Schiff appears to unfortunately dress his broadcast corner like a stage set. And one MSNBC commentator sits in an immaculate kitchen, the expanse of whiteness broken only by a pink dishtowel whose movements are fun to chart. Presumably, right before broadcast someone goes through frantically cleaning.

This year appears to be the Year of New York. Even before the pandemic, the first Democratic presidential primaries were (however briefly) dominated by three 70-something New Yorkers: Michael Bloomberg, an aristocrat from Manhattan's Upper East Side (even if he was nominally born in Boston), whose campaign ads were expensive but entertaining; Bernie Sanders, whom no amount of Vermont-washing can change from an unmistakable Brooklyn Jew; and Donald Trump, the kid from Queens. In the Washington Post in February - so long ago! - Howard Fineman highlighted this inter-borough dispute and concluded: "The civil way to settle this is to put Trump, Sanders, and Bloomberg on a Broadway park bench and let them argue politics while they feed the pigeons." Two months on, the most visible emerging US leaders in the pandemic are Fauci, Brooklyn-born of Italian descent; Cuomo, Queens-born, also of Italian descent; and Trump.

Fauci was already a familiar name to readers of what a friend calls "plague books". He has been director of the National Institute of Allergy and Infectious Diseases since 1984, and played a crucial role in the AIDS crisis (see Randy Shilts' 1987 book, And the Band Played On) and ebola epidemic (see Laurie Garrett's 1995 title, The Coming Plague), and on and on to today. When he emerged as a member of the White House task force, the natural reaction was, "Of course" and "Thank God". And then: "How old is he, anyway?" He is 79 and looks incredibly fit. Still, one frets. Does he have to be kept standing there mute for two hours? He could be sleeping. He could be working. He could be...well, doing almost anything else, more usefully. We are all incredibly lucky to have him and he should be treated as a precious resource.

The loss of things to go to that provoke ideas for things to write about has me scrambling around the Internet looking for virtual stand-ins. For those interested in net.wars-type issues (and why else would you be here?), the Open Rights Group is hosting a weekly discussion group on Fridays at 16:30 London time (that is BST, or GMT+1), and ORG offshoots such as ORG Glasgow are also holding virtual events. I can also recommend the Meetup group London Futurists, which is hosting regular discussions that sound crazier than they actually are. Further afield, I'm sampling events in New York at Data & Society, and in California, at UC Berkeley's Center for Law & Technology. Why not? Anything with live humans trying to think about hard problems, and I'm there. Virtually.

Illustrations: New Zealand prime minister Jacinda Ardern campaigning in 2017 (Brigitte Neuschwander-Kasselordner, via Wikimedia).

Wendy M. Grossman is the 2013 winner of the Enigma Award. Her Web site has an extensive archive of her books, articles, and music, and an archive of earlier columns in this series. Stories about the border wars between cyberspace and real life are posted occasionally during the week at the net.wars Pinboard - or follow on Twitter.

Posted by Wendy M. Grossman at 12:23 PM | Permalink | Comments (0) | TrackBacks (0)

With so much insecurity and mounting crisis, there's no time now to think about a lot of things that will matter later. But someday there will be. And at that time...

Remember that health workers - doctors, nurses, technicians, ambulance drivers - matter just as much every day as they do during a crisis. Six months after everyone starts feeling safe and starts to forget, remind them how much we owe health workers..

The same goes for other essential services workers, the ones who keep the food stores open, the garbage and recycling being picked up, who harvest the crops, catch the fish, and raise and slaughter the animals and birds, who drive the trucks and supply the stores, and deliver post, takeout, and packages from Amazon et. al, and keep the utilities running, and the people who cook the takeout food, and clean the hospitals and streets. Police. Fire. Pharmacists. Journalists. Doubtless scores of other people doing things I haven't thought of. In developed countries, we forget how our world runs until something breaks, evidenced by Steve Double (Con-St Austell and Newquay), the British MP who said on Monday, "One of the things that the current crisis is teaching us is that many people who we considered to be low-skilled are actually pretty crucial to the smooth running of our country - and are, in fact, recognised as key workers." (Actually, a lot of us knew this.)

Stop taking travel, particularly international travel, for granted. Even when bans and lockdowns are eventually fully lifted, it's likely that pre-boarding and immigration health checks will become as routine as security scanning and showing ID have since 2001. Even if governments don't mandate it the public will demand it: who will sit crammed next to a random stranger unless they can believe it's safe?

Demand better travel conditions. Airlines are likely to find the population is substantially less willing to be crammed in as tightly as we have been.

Along those lines, I'm going to bet that today's children and young people, separated from older relatives by travel bans and lockdowns in this crisis, will think very differently about moving across the country or across the world, where they might be cut off in a future health crisis. Families and friends have been separated before by storms, earthquakes, fires, and floods - but travel links have rarely been down this far for this long - and never so widely. The idea of travel as conditional has been growing through security and notification requirements (I'm thinking of the US's ESTA requirements), but health will bring a whole new version of requiring permission.

Think differently about politicians. For years now it's been fashionable for people to say it doesn't matter who gets in because "they're all the same". You have only to compare US governors' different reactions to this crisis to see how false that is. As someone said on Twitter the other day, when you elect a president you are choosing a crisis manager, not a friend or favorite entertainer.

Remember the importance of government and governance. The US's unfolding disaster owes much of its amplitude to the fact that the federal government has become, as Ed Yong, writing in The Atlantic, calls it, "a ghost town of scientific expertise".

Stop asking "How much 'excess' can we trim from this system?" to asking "What surge capacity do we need, and how can we best ensure it will be available?" This will apply not only to health systems, hospitals, and family practices but to supply chains. The just-in-time fad of the 1990s and the outsourcing habits of the 2000s have left systems predictably brittle and prone to failure. Much of the world - including the US - depends on China to supply protective masks rather than support local production. In this crisis, Chinese manufacturing shut down just before every country in the world began to realize it had a shortage. Our systems are designed for short, sharp local disasters, not expanding global catastrophes where everyone needs the same supplies.

Think collaboratively rather than competitively. In one of his daily briefings this week, New York State governor Andrew Cuomo said forthrightly that sending ventilators to New York now, as its crisis builds, did not mean those ventilators wouldn't be available for other places where the crisis hasn't begun yet. It means New York can send them on when the need begins to drop. More ventilators for New York now is more ventilators for everyone later.

Ensure that large companies whose policies placed their staff at risk during this time are brought to account.

Remember these words from Nancy Pelosi: "And for those who choose prayer over science, I say that science is the answer to our prayers."

Reschedule essential but timing-discretionary medical care you've had to forego during the emergency. Especially, get your kids vaccinated so no one has to fight a preventable illness and an unpreventable one at the same time.

The final job: remember this. Act to build systems so we are better prepared for the next one before you forget. It's only 20 years since Y2K, and what people now claim is that "nothing happened"; the months and person-millennia that went into remediating software to *make* "nothing" happen have faded from view. If we can remember old movies, we can remember this.

Illustrations: Dooley Wilson, singing "As Time Goes by", from Casablanca (1942).

Wendy M. Grossman is the 2013 winner of the Enigma Award. Her Web site has an extensive archive of her books, articles, and music, and an archive of earlier columns in this series. Stories about the border wars between cyberspace and real life are posted occasionally during the week at the net.wars Pinboard - or follow on Twitter.

Posted by Wendy M. Grossman at 12:59 PM | Permalink | Comments (0) | TrackBacks (0)

Sometime last week, Laurie Garrett, the Pulitzer Prize-winning author of The Coming Plague, proposed a thought experiment to her interviewer on MSNBC. She had been describing the lockdown procedures in place in China, and mulling how much more limited actions are available to the US to mitigate the spread. Imagine, she said (or more or less), the police out on the interstate pulling over a truck driver "with his gun rack" and demanding a swab, running a test, and then and there ordering the driver to abandon the truck and putting him in isolation.

Um...even without the gun rack detail...

The 1980s AIDS crisis may have been the first time my generation became aware of the tension between privacy and epidemiology. Understanding what was causing the then-unknown "gay cancer" involved tracing contacts, asking intimate questions, and, once it was better understood, telling patients to contact their former and current sexual partners. At a time when many gay men were still closeted, this often meant painful conversations with wives as well as ex-lovers. (Cue a well-known joke from 1983: "What's the hardest part of having AIDS? Trying to convince your wife you're Haitian.")

The descriptions emerging of how China is working to contain the virus indicate a level of surveillance that - for now - is still unthinkable in the West. In a Huangzhou project, for example, citizens are required to install the Alipay Health Code app on their phones that assigns them a traffic light code based on their recent contacts and movements - which in turn determines which public and private spaces they're allowed to enter. Paul Mozur, who co-wrote that piece for the New York Times with Raymond Zhong and Aaron Krolik, has posted on Twitter video clips of how this works on the ground, while Ryutaro Uchiyama marvels at Singapore's command and open publication of highly detailed data This is a level of control that severely frightened people, even in the West, might accept temporarily or in specific circumstances - we do, after all, accept being data-scanned and physically scanned as part of the price of flying. I have no difficulty imagining we might accept barriers and screening before entering nursing homes or hospital wards, but under what conditions would the citizens of democratic societies accept being stopped randomly on the street and our phones scanned for location and personal contact histories?

The Chinese system has automated just such a system. Quite reasonably, at the Guardian Lily Kuo wonders if the system will be made permanent, essentially hijacking this virus outbreak in order to implement a much deeper system of social control than existed before. Along with all the other risks of this outbreak - deaths, widespread illness, overwhelmed hospitals and medical staff, widespread economic damage, and the mental and emotional stress of isolation, loss, and lockdown - there is a genuine risk that "the new normal" that emerges post-crisis will have vastly more surveillance embedded in it.

Not everyone may think this is bad. On Twitter, Stewart Baker, whose long-held opposition to "warrant-proof" encryption we noted last week, suggested it was time for him to revive his "privacy kills" series. What set him off was a New York Times piece about a Washington-based lab that was not allowed to test swabs they'd collected from flu patients for coronavirus, on the basis that the patients would have to give consent for the change of use. Yes, the constraint sounds stupid and, given the situation, was clearly dangerous. But it would be more reasonable to say that either *this* interpretation or *this* set of rules needs to be changed than to conclude unliterally that "privacy is bad". Making an exemption for epidemics and public health emergencies is a pretty easy fix that doesn't require up-ending all patient confidentiality on a permanent basis. The populations of even the most democratic, individualistic countries are capable of understanding the temporary need for extreme measures in a crisis. Even the famously national ID-shy UK accepted identity papers during wartime (and then rejected them after the war ended (PDF)).

The irony is that lack of privacy kills, too. At The Atlantic, Zeynep Tufecki argues that extreme surveillance and suppression of freedom of expression paradoxically results in what she calls "authoritarian blindness": a system designed to suppress information can't find out what's really going on. At The Bulwark, Robert Tracinski applies Tufecki's analysis to Donald Trump's habit of labeling anything he doesn't like "fake news" and blaming any events he doesn't like on the "deep state" and concludes that this, too, engenders widespread and dangerous distrust. It's just as hard for a government to know what's really happening when the leader doesn't want to know as when the leader doesn't want anyone *else* to know.

At this point in most countries it's early stages, and as both the virus and fear of it spread, people will be willing to consent to any measure that they believe will keep them and their loved ones safe. But, as Access Now agrees, there will come a day when this is past and we begin again to think about other issues. When that day comes, it will be important to remember that privacy is one of the tools needed to protect public health.

Illustrations: Alipay Health Code in action (press photo).

Wendy M. Grossman is the 2013 winner of the Enigma Award. Her Web site has an extensive archive of her books, articles, and music, and an archive of earlier columns in this series. Stories about the border wars between cyberspace and real life are posted occasionally during the week at the net.wars Pinboard - or follow on Twitter.

Posted by Wendy M. Grossman at 10:31 PM | Permalink | Comments (0) | TrackBacks (0)

It's interesting to speculate about whether our collective approach to cybersecurity would be different if the dominant technologies hadn't been developed under the control of US companies. I'm thinking about the coronavirus, which I fear is about to expose every bit of the class, race, and economic inequality of the US in the most catastrophic way.

Here in Britain, the question I'm most commonly asked has become, "Why do Americans oppose universal health care?" This question is particularly relevant as the Democratic primaries bed down into daily headlines and pundits opining on whether "democratic socialist" Bernie Sanders and Elizabeth Warren, who both favor "Medicare for All", are electable. How, UK friends ask, could they not be electable when what they're proposing is so obviously a good thing? How is calling health care a human right "socialist" rather than just "sane"? By that standard, Europe is full of socialist countries that are functioning democracies.

I respond that framing health insurance as an aspirational benefit of a "good job" was a stroke of evil genius that invoked everyone's worst meritocratic instincts while putting employers firmly in the feudal lord driving seat. I find it harder to explain how "socialist" became equated with "evil". "Socialized medicine" apparently began as a harmless description but in the 1960s the American Medical Association exploited it to scare people off. I thought doctors were supposed to first, do no harm?

Of course, a virus doesn't care who's paying for health care - the real crux of the debates - but it also doesn't care if you're rich, poor, upper crust, working class, Republic, Democrat, or a narcissist who thinks expertise is vastly overrated and scientists are just egos with degrees. The consequence of treating health care as an aspirational benefit instead of a human right is that in 2018 27.5 million Americans had no health insurance. As others have noticed, uninsured people cluster in "red" states. Since Donald Trump took office, however, the number of uninsured is slowly regrowing.

Some of the uninsured are undoubtedly people who are homeless, but most are from working families. They work in gas stations and convenience stores, as agency maids and security guards, as Uber drivers, and...in food service. Skeleton staffing levels mean bosses penalize anyone trying to call in sick; low wage levels make sick days an unaffordable "luxury"; without available child care, kids must go to school, sick or well. Every misplaced incentive forces this group to soldier on and to avoid doctors as much as possible. The story of Ozmel Martinez Azcue, who did the socially responsible thing and got himself to a hospital for testing only to be billed for $3,270 (of which his share is $1,400) when he tested negative for coronavirus, is a horror story deterrent. As Carl Gibson writes at the Guardian, "...when you combine a for-profit healthcare system - in which only those wealthy enough to get care actually receive it - with a global pandemic, the only outcome will be unmitigated disaster".

This is a country where 40% of the population can't come up with an emergency $400, for whom no vaccine or test is "affordable". CDC's sensible advice is out of reach for the nearly 10% of the population whose work requires their physical presence; a divide throroughly exposed by 2012's Hurricane Sandy.

Sanity would dictate making testing, treatment, and vaccines completely free for the duration of the crisis in the interests of collective public health. But even that would require a profound shift in how Americans understand health care. It requires Americans to loosen their sense that health insurance is an individual merit badge and exercise a modest amount of trust in government - at a time when the man in charge is generally agreed to be entirely untrustworthy. As Laurie Garrett, the author of 1994's Pulitzer Prize-winning The Coming Plague, warned last month, two years ago Trump trashed the pandemic response teams Barack Obama put in place in 2014, after H1N1 and Ebola made the necessity for them clear.

If the US survives this intact, Trump will take the credit, but the reality will be that the country got lucky this time. Individuals won't, however; a pandemic in these conditions will soon be followed by a wave of bankruptcies, many directly or indirectly a consequence of medical bills - and a lot of them will have had health insurance. Plus, there will be the longer-term, hard-to-quantify damage of the spreading climate of fear, sowing distrust in a society that already has too much of it.

So back to cybersecurity and privacy. The same type of individualistic thinking underlies computer and networking designers who take the view that securing them is the individual problem of each entity that uses them. Individual companies have certainly improved on usability in some cases, but even the discovery of widespread disinformation campaigns has not really led to a public health-style collective response even though pervasive interconnection means the smallest user and device can be the vector for infecting a whole network. In security, as in health care, information asymmetry is such that the most "virtuous patient" struggles to make good choices. If a different country had dominated modern computing, would we, as Americans tend to think, have less, or no, innovation? Or would we have much more resilient systems?

Illustrations: The map of uninsured Americans in 2018, from the US Census Bureau.

Wendy M. Grossman is the 2013 winner of the Enigma Award. Her Web site has an extensive archive of her books, articles, and music, and an archive of earlier columns in this series. Stories about the border wars between cyberspace and real life are posted occasionally during the week at the net.wars Pinboard - or follow on Twitter.

Posted by Wendy M. Grossman at 12:46 PM | Permalink | Comments (0) | TrackBacks (0)