Serendipitous altruism

Skimming an entirely unrelated article, I stumbled upon this gem:

Recently, a number of schools have started using a program called CourseSmart, which uses e-book analytics to alert teachers if their students are studying the night before tests, rather than taking a long-haul approach to learning. In addition to test scores, the CourseSmart algorithm assigns each student an “engagement index” which can determine not just if a student is studying, but also if they’re studying properly. In theory, a person could receive a “satisfactory” C grade in a particular class, only to fail on “engagement

This immediately reminded me of Neal Stephenson’s 1992 novel, Snow Crash where a government employee’s reading behavior has been thoroughly warped into simulacrum by a lifetime of overbearing surveillance:

Y.T.’s mom pulls up the new memo, checks the time, and starts reading it. The estimated reading time is 15.62 minutes. Later, when Marietta does her end-of-day statistical roundup, sitting in her private office at 9:00 P.M., she will see the name of each employee and next to it, the amount of time spent reading this memo, and her reaction, based on the time spent, will go something like this:
– Less than 10 min.: Time for an employee conference and possible attitude counseling.
– 10-14 min.: Keep an eye on this employee; may be developing slipshod attitude.
– 14-15.61 min.: Employee is an efficient worker, may sometimes miss important details.
– Exactly 15.62 min.: Smartass. Needs attitude counseling.
– 15.63-16 min.: Asswipe. Not to be trusted.
– 16-18 min.: Employee is a methodical worker, may sometimes get hung up on minor details.
– More than 18 min.: Check the security videotape, see just what this employee was up to (e.g., possible unauthorized restroom break).

Y.T.’s mom decides to spend between fourteen and fifteen minutes reading the memo. It’s better for younger workers to spend too long, to show that they’re careful, not cocky. It’s better for older workers to go a little fast, to show good management potential. She’s pushing forty. She scans through the memo, hitting the Page Down button at reasonably regular intervals, occasionally paging back up to pretend to reread some earlier section. The computer is going to notice all this. It approves of rereading. It’s a small thing, but over a decade or so this stuff really shows up on your work-habits summary.

Dystopian panoptical horrors were supposed to be cautionary tales – not specifications for new projects…

As one Hacker News commenter put it : in the future, you don’t read books; books read you !

Post-scriptum… Isn’t it funny that users don’t mind being spied upon by apps and pages but get outraged when e-books do ? It may be because in their minds, e-books are still books… But shouldn’t all documents and all communicated information be as respectful of their reader as books are ?

Remember the « ce n’est pas illégal, c’est a-légal » episode ? That is what the French government is claiming that the surveillance laws being voted are about : no new surveillance powers – just giving a legal framework to the existing illegal ones… Which are implicitly confessed by the way. So thanks – I guess we should feel happy that open bar surveillance will soon be done entirely legally instead of illegally !

By the way, there was no question of judicial oversight : “in the context of the antiterror fight, day to day, it’s impossible”… Using the T word to steamroll objections never gets old it seems – and judicial oversight is such a drag on productivity that we should be thankful for the savings that foregoing it will bring to the French budget.

That claim by intelligence agencies that judicial oversight would slow them too much to catch the bad guys  comes up every time, but it is just as exaggerated as the terrorist thread, as the White House’s “Report and Recommendations of The President’s Review Group on Intelligence and Communications Technologies” attests last week (page 104):

Our review suggests that the information contributed to terrorist investigations by the use of section 215 telephony meta-data was not essential to preventing attacks and could readily have been obtained in a timely manner using conventional section 215 orders.

Oh – and here is a picture of François Hollande expressing support to Brazil’s Dilma Roussef in her crusade against Internet surveillance. No, I don’t understand either.

When even the USians frame us as surveillance hypocrites, you know that some soul searching is long overdue.

Stumbling upon Thorvaldur Gylfason’s Democracy in Africa at VoxEU, I found the two following graphs interesting…

First, the impact of the end of the Cold War on governance worldwide:

Global trends in governance, 1800-2012. Source: Polity IV Project.

Then the same, but for Africa only and focused on the 1960-2012 span:

African Trends in Governance, 1960-2012. Source: Polity IV Project.

No longer propped up by the major powers, autocracies everywhere have fallen with the end of the Cold War. But whereas they have globally mostly given way to democracies, in Africa they have not : anocracy is the dominant form.

So that is the word of the day for me: anocracy – it feels good to have a word to label the sort of mafia cartels that seem to rule most of Africa.

Extracts from “Facing the myth of Redemptive Violence” :

We have already seen how the myth of redemptive violence is played out in the structure of children’s cartoon shows (and is found as well in comics, video and computer games, and movies). But we also encounter it in the media, in sports, in nationalism, in militarism, in foreign policy, in televangelism, in the religious right, and in self-styled militia groups. What appears so innocuous in cartoons is, in fact, the mythic underpinnings of our violent society. The psychodynamics of the TV cartoon or comic book are marvelously simple: children identify with the good guy so that they can think of themselves as good.

[..] When the good guy finally wins, viewers are then able to reassert control over their own inner tendencies, repress them, and re-establish a sense of goodness without coming to any insight about their own inner evil. The villain’s punishment provides catharsis; one forswears the villain’s ways and heaps condemnation on him in a guilt-free orgy of aggression. Salvation is found through identification with the hero”
[..]
Once children have been indoctrinated into the expectations of a dominator society, they may never outgrow the need to locate all evil outside themselves. Even as adults they tend to scapegoat others for all that is wrong in the world. They continue to depend on group identification and the upholding of social norms for a sense of well-being.
[..]
No other religious system has even remotely rivalled the myth of redemptive violence in its ability to catechise its young so totally. From the earliest age, children are awash in depictions of violence as the ultimate solution to human conflicts

Uptodatepronto posted the results of the July 2013 poll of r/SyrianCivilWar opinions in the Syrian conflicts. With only 333 samples, a huge unknown self-selection bias and who knows what ballot stuffing, this data must be taken as anecdotal.

There were three questions :

1. Who do you support in the Syrian Civil War ?
2. Do you believe there can be a political solution to the conflict ?
3. Who, if anyone should the United States, France and Britain arm ?

The possible answers to the first question were quite sparse, so I decided to aggregate them to have large enough samples in each category… I’m sure that many will object to the mixed bag that I made of the ‘Government’ and ‘Rebels’ aggregates – did I mention that I’m a clueless foreign observer ?

I consider the first and third questions to be redundant : while a majority rejects foreign injection of weapons into the conflict, there is a strong correlation between support for a given side and desire to see it armed… Though two government-side supporters want arms for the FSA and one government-side supporter wants them for ‘anyone who opposes the Assad regime’ – remember what I said about the data  ?

Now, let’s perform the cross tabulation that I came here for :

From that chart lets graph the proportion of supporters of each aggregate party for the total of each political solution likelihood answer class :

From this representation, I make the following observations:

• Neutrals and supporters of factions aligned with the government are slightly more likely to believe in the likelihood of a political solution
• Kurds and other rebels are more likely to find a political solution highly unlikely

Those could be interesting hypothesis to test in a wider and more disciplined survey… So, more than ever, the real conclusion is : moar data !

The worksheet I produced this from is available here but,  again I must emphasize how lacking the raw material is.

Remember when I was writing about ‘hypocrisy all around‘ a few days ago ? This is what it was about… As if on cue, Le Monde revealed from unnamed sources that France operates its own mass interception infrastructure (for non-French speaking readers here is the Guardian’s paraphrasing of The World).

Le Monde’s article was of course published on the Fourth of July in honor of our American friends, thought leaders in mass surveillance.

That France had such capability at that scale had long been guessed by anyone with even a slight interest in surveillance technologies, especially since we make brisk business peddling that sort of stuff we to splendid chaps all around the world (no questions asked – don’t forget to wash your hands afterwards)… Now it is not just guesses and rumors anymore.

But, in spite of the amusingly conflicted public reactions, that is not where the real substance of Le Monde’s revelations lies : the problem with surveillance is not the capability but how it is used… And used it is : not only external intelligence but also internal intelligence and a host of other agencies who happily dip their fingers into the jam with an utter lack of adult supervision.

Is that so bad ? What about the children ? What about tax-evading Nazi terrorist pedophiles music sharers ?

Lets first remind ourselves about a basic principle : the distinct nature of external and internal intelligence. Like military and police, they handle different businesses : while the military exists to dominate designated external enemies by force, the role of  police is to keep our society in working order by enforcing the law. One is only subject to the law of the strongest and whatever can be gotten away with diplomatically, the other operates encumbered by strict rules that sacrifice efficiency and sometimes even the officer’s own security for the sake of lawfulness. Again, war and law enforcement are not the same – bad things happen when cops play soldiers, as the militarization of the police forces in the USA shows.

So spying is not the activity that requires attention – as long as we manage to get away with it diplomatically… Don’t get caught ! Spying on allies will certainly complicate relationships, but managing that is what diplomacy is for. Ignorance and hypocritical reactions will be plenty but the professionals will keep balancing themselves on the tightropes of international relations, in ways perfected during thousand of years of practice. This is not what I find disquieting – don’t let the cruel world of state to state relationships distract you from the actual scandal: mass surveillance of one’s own citizen in a democratic state.

We don’t yet know the extent of the communications surveillance apparatus revealed by Le Monde – but we already know what matters most : it operates outside of any legal framework. Some would say that it makes them illegal – but no law forbids it so an unnamed boss of a French intelligence agency declared them “a-légal” instead. Isn’t that cute ? Of course, nullum crimen, nulla poena sine praevia lege poenali – but those activities may actually fall under existing law:

Code Pénal, Article 226-15 (official English translation) :

Maliciously opening, destroying, delaying or diverting of correspondence sent to a third party, whether or not it arrives at its destination, or fraudulently gaining knowledge of it, is punished by one year’s imprisonment and a fine of €45,000.

The same penalty applies to the malicious interception, diversion, use or disclosure of correspondence sent, transmitted or received by means of telecommunication, or the setting up of a device designed to produce such interceptions.

Code Pénal, Article 226-18 (official English translation) :

The collection of personal data by fraudulent, unfair or unlawful means is punished by five years’ imprisonment and a fine of €300,000

Now, The French People vs. The French State – wouldn’t that make an interesting case ?

But anyway, whether past misdeeds are prosecuted or not is not the most important point. What is essential is that we now demand proper democratic oversight. The extraordinary privileges granted for security reasons require equally extraordinary control. Secrecy matters of course, but secrecy is no reason for lack of accountability. Secrecy is not even incompatible with a strong framework of laws and regulations consistent with human rights and ensuring adequate protection of the rights to privacy and freedom of expression.

The political divide about surveillance is about whether or not the ends justify the means. I believe they don’t, or rather that those who focus on the immediate benefits of surveillance are myopic to its other effects on society. Those people by the way are well meaning – always keep Hanlon’s Razor in mind : never attribute to malice that which is adequately explained by stupidity. What it means about surveillance is that we don’t need to have intent to create a fascist regime – we can just sleepwalk into it. Let’s wake up a few people !

While I happily keep giving the USA the bashing they deserve about mass surveillance of citizens, you won’t hear me cast the first stone about industrial espionage – for well-known reasons.

While direct evidence of my own country’s industrial espionage activities rarely surfaces, we sometimes hear echoes of what goes on under the tables – take for example the testimony of Orbital High-Technology Bremen (OHB) CEO, Berry Smutny to the US Embassy in Berlin on 2009-11-20 :

Smutny frankly said “France is the evil empire stealing technology and Germany knows this”, but Germany´s decentralized government is not willing to do much about it. Going on at length of his despise of the French, Smutny said French IPR espionage is so bad that the total damage done to the German economy is greater the that inflicted by China or Russia.

Sure, this quote being in the context of sales by OHB to the US government, it is likely to be biased toward exaggeration – but such open expression of defiance from very close allies of France is nevertheless a strong hint that righteous outrage from French sources about industrial espionage is laughably hypocritical.

In addition, industrial espionage should be kept in perspective : it is not even comparable to mass surveillance – let’s not dilute the evil of mass surveillance by amalgamating them ! While corporate actors are strong enough to thrive on their own in a state of information warfare, citizens are not – they need political diligence toward a strong framework of laws and regulations consistent with human rights and ensuring adequate protection of the rights to privacy and freedom of expression.

Remember : the reason for rule of law is to protect the weak – the strong already take good care of themselves, though the European Union might want to upgrade its defense to a level more compatible with its international status…

On the 13th June, Fleur Pellerin (French Minister Delegate for Small and Medium Enterprises, Innovation, and the Digital Economy) gave a vibrant speech during the inauguration of the Mozilla Foundation’s new office in Paris.

I don’t recall any French politician at minister level so plainly taking side with free software :

Free software is a crucial asset for our economy, in more than one way. First, it enables the struggle against technological dependance upon actors who own our everyday computing tools – it is therefore a true guarantee of digital sovereignty. Furthermore, as we see today and contrary to popular myth, free and open source create jobs. Original business models have been invented and they are important factors in productivity and competitiveness for both private and public sectors who can in this way better control their holdings and concentrate their efforts on their specific value additions. Finally, free software undermines rent-seeking behaviours adverse to innovation, and therefore aids in the emergence of new economic champions.

Will the bold ideas instantly translate into action ? No one expects magic – but with policy laid out so clearly, there is reason to believe that the French government is headed in the right direction.

Let’s take note of those good intentions, keep an eye on the actions that should follow, spread the word that free software is a crucial economic asset and vote for those who understand that !

I took the EFF and Tor stickers as corroborating material in support of Snowden’s appearances of good character, but not everyone saw them that way… Interviewed by Time’s Andrew Katz, former security clearance investigator Nicole Smith explains that sympathy for online rights activists is a sign that a candidate may not be fit for Top Secret clearance:

In a photograph posted online after Snowden revealed himself, his laptop displays a sticker touting the Electronic Frontier Foundation, a longstanding advocate for online rights and staunch opponent of government surveillance. That would have been enough of a warning sign to make it into his file, Smith says, but investigators wouldn’t have come across it because clearance interviews aren’t performed at their homes: “You’re not around that person’s personal belongings to make any other additional observations about that person’s characters”

Self doubt ? Ethical questioning ? Interest in social issues ? Affinities for dissenting viewpoints ? No – that is not useful nor even compatible with secret work… Better fill the ranks with yes-men who will follow superior orders to the bitter end – that worked so well in the past…

Anyway, thanks to Smith, the authorities now know what to watch for – open display of affinities with the EFF is enough of a warning sign to make it to file. Take this NSA agent for example, performing devious agitprop in official EFF attire :

Uh – hello General Alexander ! Doesn’t the Director of the National Security Agency look swell in that T-shirt ? Better in my opinion than in his stiff official portrait… But that warning sign shall certainly cost him an entry in his file – he’ll have some serious explaining to do when his clearances come up for review ! Maybe he should have just ordered an EFF sticker for his home laptop instead.

In a message I got through Glyn Moody, Mikko Hypponen noticed this claim from German intelligence agencies :

„Ist die eingesetzte Technik auch in der Lage, verschlüsselte Kommunikation (etwa per SSH oder PGP) zumindest teilweise zu entschlüsseln und/oder auszuwerten?“

„Ja, die eingesetzte Technik ist grundsätzlich hierzu in der Lage, je nach Art und Qualität der Verschlüsselung“

My rough translation of these sentences of the article he linked :

„Are the current techniques capable of at least partially deciphering encrypted communications such as SSH or PGP ?“

„Yes, the current techniques are basically capable of that, depending on the type and quality of the encryption“

Of course, the weakness of weak keys is not exactly news… But it is always interesting when major threats brag about it openly – so this is nevertheless a pretty good refresher to remind users to choose the most current algorithms at decent key length and expire old keys in due time.

It is also a reminder that today’s cyphers will be broken tomorrow: encryption is ephemeral protection… Secret communications require forward secrecy & anonymity – for example, XMPP chat may use a server available as a Tor hidden service, with the clients using Off The Record messaging.

Main Core is the code name of a database maintained since the 1980s by the federal government of the United States. Main Core contains personal and financial data of millions of U.S. citizens believed to be threats to national security.

The existence of the database was first reported on in May 2008 :

According to a senior government official… ”There exists a database of Americans, who, often for the slightest and most trivial reason, are considered unfriendly, and who, in a time of panic, might be incarcerated. The database can identify and locate perceived ‘enemies of the state’ almost instantaneously” … One knowledgeable source claims that 8 million Americans are now listed in Main Core as potentially suspect.

Putting this level of paranoia in perspective, Stalin’s Great Purge hit 1% of the population. 8 million is 2.5% of the USA’s population – or about 3% if you exclude children under 15 year old. If you think that 3% of the adult population may be out to get you, then you should probably be very carefully considering the possibility that the problem is actually you.

Dating back to the 1980s and known to government insiders as “Main Core”, the database reportedly collects and stores — without warrants or court orders — the names and detailed data of Americans considered to be threats to national security.

One former intelligence official described Main Core as “an emergency internal security database system” designed for use by the military in the event of a national catastrophe, a suspension of the Constitution or the imposition of martial law.

Putting aside the question of what actions are appropriate in catastrophic circumstances, should anyone believe that such a database will never be misused ? Secrecy trebles the probability of abuse.

Since 2008, no news has surfaced about Main Core – there is no reason to believe that it is not still maintained, probably under a new code name.

Remember Eisenhower’s 1961 warning against the military–industrial complex in his farewell speech ?

“In the councils of government, we must guard against the acquisition of unwarranted influence, whether sought or unsought, by the military-industrial complex. The potential for the disastrous rise of misplaced power exists and will persist”

It is still valid today – and in current news in the guise of the  intelligence-contractors complex where the consequences of financial corruption also go much beyond mere massive waste of public funds.

The challenge that faces us is not an arms race in communications privacy – hardening helps but it is a tactical countermeasure that does not address the problem systemically.

The way forward is political : democratic control must be reasserted over those entrusted with exceptional means. It is easier said than done, considering the entrenched interests that will obstruct the path ahead – but ignoring the political nature of the challenge will only ensure the continuation of a state of information warfare between the people and the state that used to represent them. A better way exists !

A few reflections from my notes of public reaction to last weekend’s events.

Advertising is the main source of revenue for publishers on the Web, including the lords of sharecropping empires such as Facebook and Google. Revenue from advertising varies hugely with how well the message targets the audience. Targeting requires getting to know the target – which is the business that Facebook and Google are in : getting the user to find them useful and trust them so that he willingly provides them with their raw material.

I used to enjoy giving the publishers a lot of data in return for personalization and services – even considering the risks. Yes, we knew the risks – but they are the sort of risks that we are notoriously bad at evaluating. Most of us have probably read at least a dozen different tales of Orwellian dystopias – yet our productive relationship with service providers let us convince ourselves that betrayal won’t happen. We were so complacent that it might be argued that we asked for this.

So why are we surprised ? The surprise is in the scale of the abuse. Corruption always exists at the margins of any system that is sufficiently slack to let alternative ways thrive and supply the mainstream with fresh ideas. A society with no deviance at its margins is totalitarian – so we live with that some antisocial behaviour as a cost of doing business in a society that values individual freedom.

But today we find that the extent of corruption is not restricted to the margins – we find that most of what goes on there among people we entrusted with extreme power at the core of the state entirely escapes oversight and drifts into mass surveillance which is known to asphyxiate societies. That much corruption was a risk that we were warned against, but seeing it realized is still a nasty surprise.

Again, this is not about lawful surveillance under democratic oversight, which is as acceptable as ever – this is about the dangerous nature of massive untargeted surveillance outside of democratic control. But public opinion reeling from the shock will probably be blind to the difference – it is now likely to be wary of anything that even remotely smells of surveillance.

Of course, not everyone has yet realized the tradeoffs that modern communications entail and that they have always been making, even if unwittingly – public awareness of privacy issues is not going to arise without continued evangelism anytime soon. But a host of users has awoken to realize that they were sleepwalking naked on Main Street. What will they do now ?

Considering how mainstream audiences have long happily kept gobbling up toxic information from the mass media, I am not holding my breath for a violent phase transition – but a new generation of privacy militants might just have been given birth and I wonder how much they will nudge the information industry’s trajectory. In any case, they will not make the Internet more welcoming to it.

“Back in 2007, Obama said he would not want to run an administration that was “Bush-Cheney lite” He doesn’t have to worry. With prisoners denied due process at Gitmo starving themselves, with the C.I.A. not always aware who it’s killing with drones, with an overzealous approach to leaks, and with the government’s secret domestic spy business swelling, there’s nothing lite about it“.

Maureen Dowd, New York Times, 8th June 2008

Via John Naughton’s Memex 1.1

Do you remember who said this ?

“This Administration also puts forward a false choice between the liberties we cherish and the security we demand. I will provide our intelligence and law enforcement agencies with the tools they need to track and take out the terrorists without undermining our Constitution and our freedom.

That means no more illegal wire-tapping of American citizens. No more national security letters to spy on citizens who are not suspected of a crime. No more tracking citizens who do nothing more than protest a misguided war. No more ignoring the law when it is inconvenient. That is not who we are. And it is not what is necessary to defeat the terrorists”.

Hint – it was in August 2007. Yes, he may have changed his mind since then…

Yes we (probably) can ! (your mileage may vary; this message does not reflect the thoughts or opinions of either myself, my company, my friends, or alter ego; terms are subject to change without notice; this message has not been safety tested for children under the age of 3; any resemblance to actual persons, living or dead, is unintentional and purely coincidental; do not remove this disclaimer under penalty of law; for a limited time only; this message is void where prohibited, taxed, or otherwise restricted; message is provided “as is” without any warranties; reader assumes full responsibility; if any defects are discovered, do not attempt to read them yourself, but return to an authorized service center; read at your own risk; text may contain explicit materials some readers may find objectionable, parental guidance is advised; keep away from pets and small children; some assembly required; not liable for damages arising from use or misuse; may cause random outbursts of extreme violence, or epileptic seizures; actual message may differ from illustration on box; other rules may apply; past performance does not predict future results; see store for details).

In the wake of the Prism debacle, Google CEO Larry Page and Facebook CEO Mark Zuckerberg, among others, published reactions full of outrage, strong denials of specific allegations (“direct access”, “back doors”) and technically correct truth… But ridiculously inadequate in the face of the awesome shitstorm that Edward Snowden kicked up, as they won’t admit willful cooperation or even awareness of possible abuse of privileges lightheartedly granted to the NSA.

Meanwhile, the Director of National Intelligence issued a fact sheet stating that PRISM was conducted “under court supervision, as authorized by Section 702 of the Foreign Intelligence Surveillance Act (FISA) (50 U.S.C. § 1881a)”. Among other things, that fact sheet states that :

Under Section 702 of FISA, the United States Government does not unilaterally obtain information from the servers of U.S. electronic communication service providers. All such information is obtained with FISA Court approval and with the knowledge of the provider based upon a written directive from the Attorney General and the Director of National Intelligence.

Above emphasis is mine – “not unilaterally” and “with knowledge of the provider”. Hello, Larry ? Zuck ? Feeling lonely there ? Have you just been hung out to dry by your friend the DNI ?