The World's Most Expensive Newspaper

In 2006 technology writer Clive Thompson wrote an article about "Open Source Spying" for The New York Times. At the Gov 2.0 Expo panel with the same title and some of the same informants, many lamented that little had improved when it came to the use of collaborative technologies to speed and streamline information gathering.

For example, Lewis Shepherd talking frankly about the "glacial pace" of change in the intelligence community despite the enormous amount of taxpayer dollars invested. In generating threat reports or what has been called "the world's most expensive newspaper," the many writers and analysts working in the intelligence community are failing much like actual journalists are to adapt to technological change. When a questioner in the audience complained of being presented with a panel of white men to represent change, Lewis quipped that "we express our frustration, Caucasian or not." (Later several noted that many of the senior leadership positions in the intelligence community were occupied by women, a fact that my own interactions with these government agencies has confirmed.)

Chris Rasmussen described the efforts of those who worked on Intellipedia and Intellipublia, but complained of resistance from a "finished intel 3-ring binder culture" in the federal government. He also complained of the "it's always Nigeria" problem in which technical tools are never tested with high-risk, high-value intelligence operations, because of anxieties about "stopping the mail" and disrupting existing systems with established workflows that never have a down season like that experienced by the IRS. The "product-centered" approach invariably supported what invariably became for Rasmussen a "theological argument" in which invoking the soldier for patriotic purposes and his close engagement in the field obfuscated the advantages of aggregation at a distance by drawing on multiple sources.

Matthew Burton joined the chorus to express his frustration with censorship of the dissemination of new organizational ideas by public affairs people who don't want to see policy debated in the pages of Federal Computer Week. He also noted that analysts with ideas about collaborative technologies were often reduced to finding "microwave towers all day long" rather than using systems like Intelink to make change.

During the Q and A for the session there were questions about the other meaning that "open source spying" could have in a world in which much intelligence could be gathered from the open web in a world with sixty million Twitter users. I didn't take Rasmussen's advice to "put 'Facebook' and 'OPSEC'" in the title of a blog posting in order to garner a million hits.

Code Puce

Having written about the rhetoric of various parodies of the Homeland Security threat assessment color spectrum, I had to say something about this the Bad Actor Alert. It is also worth noting that the threat level itself, which was once prominently placed on so many government websites, has now been relegated below "traveler's redress" and "career opportunities" for the bureau.

Feature Creep

I've been thinking about the work of Virtualpolitik friend Chris Soghoian this week, as I traveled to Northern California for an all-day meeting about writing program policy in the UC system and Cal State. As I prepared to board my United flight, I noticed that Soghoian's complaint that online check-in boarding passes were never checked electronically at the same time that they were authenticated with IDs had finally been remedied. A machine that verifies the electronic information about the ticket holder had finally been installed at the head of the security line. Of course, on my return trip, it was clear that the machine wasn't in service.

While I was in meetings, I also thought about his point about "feature creep" and how authentication systems used for one context are often transported into another without reflection. The classic example is how social security numbers intended to keep track of social security benefits were reused by credit bureaus to track irresponsible creditors. Soghoian became famous for interrogating the use of boarding passes generated by commercial companies for airline security purposes under the purview of the federal government. Now educators in California are facing another form of feature creep with the Early Start program , which takes an instrument intended to be a placement test and turns it into a de facto admissions test.

Self-Policing

It is interesting to see how the online behavior of "JihadJane" is being evaluated by those who only knew her in her offline life. Accounts of her use of terrorist rhetoric also include the antics of self-regulatory groups that police the behavior of outliers and serve as "griefers" to those who cross boundaries of netiquette. These include the Jawa Report, the YouTube Smackdown Corps, and other groups that go after Internet jihadis.

Worming Your Way In

This Onion story beautifully parodies TV stories about computer security and cyber-threats and the role of experts in moderating public fear.

The View from Above

In "Google to enlist NSA to help it ward off cyberattacks," the Washington Post reveals that the leading U.S. search engine company, which has recently announced a "new approach" to China, has requested help from the once highly secretive National Security Agency in fending off and tracking down hackers who might be operating with the approval of the authoritarian government in Beijing. Given how civil libertarians at the Electronic Frontier Foundation have already expressed concerns about domestic spying by the NSA and how that group has also raised issues about the privacy policies of Google (in relationship to the company's e-books, desktop software, corporate philosophy, and search engine design), many critics are likely to be uncomfortable with this new alliance.

Showdown in Beijing

Virtualpolitik pal Siva Vaidhyanathan was a big part of today's big digital rhetoric story, and he has been posting his reflections about the showdown between the search engine Google and the government of China on his Googlization of Everything blog. Although the Los Angeles Times is trumpeting the idea that "Chinese Internet users praise Google's threat to exit," the New York Times summed up their more skeptical assessment with the headline "Google's Threat Echoed Everywhere Except China."

Much of what Vaidhyanathan is doing in his blog postings and interviews like this radio interview is clarifying two misconceptions that are common here in the U.S. where 1) we don't imagine Google not to be ubiquitous anywhere else, and 2) we still accept the Bush administration's view that privacy and security is a zero-sum game. First, Vaidhyanathan points out that Google has a much smaller market share than native-born search engine Baidu, which offers access its users access to more copyrighted works than the litigation-averse Mountain View company that must abide by U.S. law. Second, Google is citing both threats to its business model and to civil liberties in explaining its risky ultimatum.

Vaidhyanathan has been working out his general "thoughts on China" for a long time, certainly before the attention paid to Google's shift in policy and its recent threat to pull out of the country entirely, if it doesn't get its way. As he explains, however," in his statement on Google's concerns about "Cyber Attack," American news organizations have been overemphasizing the human rights rhetoric in their coverage: "It's commercial malpractice to back out of the largest market in the world on principle. Google must have some good business reasons."

Certainly the rhetoric on Google's official blog about "a new approach to China" uses the language of selflessness that often appears in its official communications to explain its dare to China:

First, this attack was not just on Google. As part of our investigation we have discovered that at least twenty other large companies from a wide range of businesses--including the Internet, finance, technology, media and chemical sectors--have been similarly targeted. We are currently in the process of notifying those companies, and we are also working with the relevant U.S. authorities.

Second, we have evidence to suggest that a primary goal of the attackers was accessing the Gmail accounts of Chinese human rights activists. Based on our investigation to date we believe their attack did not achieve that objective. Only two Gmail accounts appear to have been accessed, and that activity was limited to account information (such as the date the account was created) and subject line, rather than the content of emails themselves.

In one case, Google claims to be defending the interest of other U.S. companies and Western caitalism, and in the other it emphasizes the risk to democracy and human rights advocates of Chinese interference in network security, although it acknowledges that there are only two cases it can points to, both of them relatively minor.

Perhaps the most interesting question is the one being asked by Rebecca MacKinnon: "Will Google stand up to France and Italy, too?"

The Hand That Feeds Them

As this posting about the intimidation of bloggers by the Transportation Security Administration from Business Insider indicates, travel bloggers who posted new TSA directives issued after the foiled Christmas day bombing attempt have been threatened with being placed on the no-fly list, served them with subpoenas, and confiscated computers and other electronic equipment. Bloggers associated with sites like Flying with Fish and Elliot.org, which hardly seem politically subversive, found themselves harassed by agents who came to their homes in official vehicles.

Even those who follow the TSA blog can see the difficult position that government bloggers are in when representing federal agencies that serve as both regulators and content-creators of digital media. When "Blogger Bob" isn't posting horrible holiday poety, he's issuing mea culpas for possible improper posting of documents (followed by dozens of scathing comments about the myth of transparency) or just keeping mum and deferring to his betters.

At the most obvious level, the legal issues may seem to be about protecting the confidentially of sources in tracking down the person who disseminated the memo, but there also seem to be some interesting questions about what constitutes a secret document or one of national security significance. Furthermore, in an increasingly procedural society, what does it mean for certain procedures to be secret? If bloggers were to figure them out from observing the practices of security officers and airline personnel, would publishing those observations be a security breach?

I know from my own recent flying experiences in the days since Christmas that many of these security decisions have to do with the say of pilots rather than just TSA rules. Before boarding my United flight home to Los Angeles, I met a couple whose Tel Aviv to Newark flight had an unscheduled stop in Ireland because of the pilot's security concerns about a seemingly risky passenger. Then, literally just before taking off for LA, our own captain turned our plane back to the gate in Philadelphia to remove two passengers that he seemed to consider as objectionable presences. These decisions seem to represent a policy making body of one and reporting them says little about patterns of security vigilance, however.

(By the way, I've started to earn a few snowglobes in the airport security game for iPhone, Jetset, and would recommend the game to Virtualpolitik readers.)

A Czar is Born

When watching the struggles of the Obama White House to implement policy, most eyes have turned to the health care debate or to the efforts to fight emissions linked to global warming, but there has been another negotiated milestone that has been months in the making: appointment of a cybersecurity "czar." Perhaps it is this week's scandal about how insurgents have managed to hack into video feeds of unmanned aircraft over Iraq that has brought the issue to the forefront, but this morning I received the following e-mail from John O. Brennan, announcing the appointment of Howard A. Schmidt for the position:

Dear Friend,

Cybersecurity matters to all of us. Protecting the internet is critical to our national security, public safety and our personal privacy and civil liberties. It’s also vital to President Obama’s efforts to strengthen our country, from the modernization of our health care system to the high-tech job creation central to our economic recovery.

The very email you are reading underscores our dependence on information technologies in this digital age, which is why it seemed like a fitting way to announce that the President has chosen Howard Schmidt to be the White House Cybersecurity Coordinator. Howard will have the important responsibility of orchestrating the many important cybersecurity activities across the government.

Howard is one of the world’s leading authorities on computer security, with some 40 years of experience in government, business and law enforcement. Learn more about Howard's background and approach to cybersecurity:

Howard will have regular access to the President and serve as a key member of his National Security Staff. He will also work closely with his economic team to ensure that our cybersecurity efforts keep the Nation secure and prosperous.

Moving forward we will use WhiteHouse.gov, this email program and our other communications tools to keep you posted about our progress in this important area.

Sincerely,

John O. Brennan
Assistant to the President for Homeland Security and Counterterrorism

P.S. You can play an important role in cybersecurity as well. Learn more about the issue and steps you can take to ensure your own security.

There is a link that introduces the white-haired corporate veteran with a background in the military and law enforcement, but I still have many question about Schmidt's appointment, his lack of a computer science background, and the possibility that he might offer only lukewarm support for cybersecurity research at universities, which often requires finding the vulnerabilities in proprietary software in ways that corporate shareholders don't like. I visited the website of the Information Security Forum that Schmidt has headed and saw a lot of material about licenses that support the current intellectual property regime and little about open source alternatives. (The phrase "open source" generated no results from their search engine, while "Microsoft" brought up eight links.)

As this story in the Washington Post indicates, the road to the appointment has been a bumpy one, with many first draft nominees who have turned the post down and key cybersecurity personnel who felt disadvantaged by their association with the Bush administration resigning in frustration as the search dragged on. That's certainly not an auspicious beginning.

The Rifled Faculty Mailbox

A recent New York Times article, "Hacked E-Mail Is New Fodder for Climate Dispute," details how the electronic mail exchanged on scientific mailing lists has become evidence to those who are global warming deniers. Hackers snatched almost two hundred megabytes of e-mail from the British Climatic Research Unit, which is suddenly receiving more traffic from the general public for open electronically published material on its servers as well. They attempted to upload the data to RealClimate.org, which published the following statement in response that provides an interesting commentary about digital rhetoric.

As many of you will be aware, a large number of emails from the Climate Research Unit (CRU) at the University of East Anglia webmail server were hacked recently (Despite some confusion generated by Anthony Watts, this has absolutely nothing to do with the Hadley Centre which is a completely separate institution). As people are also no doubt aware the breaking into of computers and releasing private information is illegal, and regardless of how they were obtained, posting private correspondence without permission is unethical. We therefore aren’t going to post any of the emails here. We were made aware of the existence of this archive last Tuesday morning when the hackers attempted to upload it to RealClimate, and we notified CRU of their possible security breach later that day.

Nonetheless, these emails (a presumably careful selection of (possibly edited?) correspondence dating back to 1996 and as recently as Nov 12) are being widely circulated, and therefore require some comment. Some of them involve people here (and the archive includes the first RealClimate email we ever sent out to colleagues) and include discussions we’ve had with the CRU folk on topics related to the surface temperature record and some paleo-related issues, mainly to ensure that posting were accurate.

Since emails are normally intended to be private, people writing them are, shall we say, somewhat freer in expressing themselves than they would in a public statement. For instance, we are sure it comes as no shock to know that many scientists do not hold Steve McIntyre in high regard. Nor that a large group of them thought that the Soon and Baliunas (2003), Douglass et al (2008) or McClean et al (2009) papers were not very good (to say the least) and should not have been published. These sentiments have been made abundantly clear in the literature (though possibly less bluntly).

More interesting is what is not contained in the emails. There is no evidence of any worldwide conspiracy, no mention of George Soros nefariously funding climate research, no grand plan to ‘get rid of the MWP’, no admission that global warming is a hoax, no evidence of the falsifying of data, and no ‘marching orders’ from our socialist/communist/vegetarian overlords. The truly paranoid will put this down to the hackers also being in on the plot though.

Instead, there is a peek into how scientists actually interact and the conflicts show that the community is a far cry from the monolith that is sometimes imagined. People working constructively to improve joint publications; scientists who are friendly and agree on many of the big picture issues, disagreeing at times about details and engaging in ‘robust’ discussions; Scientists expressing frustration at the misrepresentation of their work in politicized arenas and complaining when media reports get it wrong; Scientists resenting the time they have to take out of their research to deal with over-hyped nonsense. None of this should be shocking.

It’s obvious that the noise-generating components of the blogosphere will generate a lot of noise about this. but it’s important to remember that science doesn’t work because people are polite at all times. Gravity isn’t a useful theory because Newton was a nice person. QED isn’t powerful because Feynman was respectful of other people around him. Science works because different groups go about trying to find the best approximations of the truth, and are generally very competitive about that. That the same scientists can still all agree on the wording of an IPCC chapter for instance is thus even more remarkable.

It is interesting to analyze how these assertions operate and the implications they contain: that old-school listservs are better suited to scientific debates than blogs, that there exist private spheres as well as public ones, and that the Internet fosters conspiracy theories rather than a recognition of dissensus.

From the perspective of what my colleague Mark Marino calls "Critical Code Studies," perhaps the ClimateAudit attempt at reading lines of code is perhaps most interesting and their assumption that a simple comment annotation serves as the "smoking gun" rather than more sophisticated black box algorithms.

Calling the Kettle Black

The four-part story on NPR The End of Privacy largely focuses on discrete platforms, such as Facebook, cell phones, digital records, and online data, rather than the British model of the more integrated surveillance society, which also includes public surveillance cameras in the mix. It also caused the station to find itself justifying its own cookie policy on the grounds of the code's preservation of anonymity, a claim that privacy advocates might find dubious, given how easily it is to use web surfing data to tie behavior to an individual.

As one commenter points out, the network's explanations are highly suspect:

The cookies that Mr. Robinson pointed out in his comment are third-party tracking cookies. They are used by advertising companies to profile users and their habits across the internet for marketing purposes; they have nothing whatsoever to do with the usability or functionality of NPR's website. NPR's "response", rather than addressing the issue raised by Mr. Robison, instead tries to shift the attention to first-party cookies -- those which ARE legitimately used for website functionality. NPR does not in any way address the third-party tracking cookies.

It's ironic and angering that on a series having to do with personal privacy and the internet, NPR tries to whitewash their own practices. NPR, of all organizations, ought not to underestimate its audience's intelligence.

Slumber Land

As "Experts Puzzle over How Flight Overshot Airport" in the case of the Northwest flight to Minneapolis that lost contact with airport traffic controllers after Denver and traveled one hundred fifty miles past its destination before communication was resumed in Wisconsin. Many believe that the pilots fell asleep, and from IT safety expert Markku Häkkinen, who has done research on auditory warning systems in airplanes, I learned that having pilots nod off is more common than many travelers would like to believe.

In a posting called "Siren's Song," I described some of Häkkinen's work, but over dinner at the ISCRAM conference I learned that he has also compiled studies about sound systems for waking up pilots. The challenge for companies like Alertness Solutions, of course, is how to create a wake-up signal that encourages alertness rather than sense-overwhelming confusion. And, obviously, an alarm loud enough to be heard in the cabin might panic passengers. Besides, as Häkkinen points out, sometimes we actually tune out alarms in the higher volume ranges. Apparently, according to Häkkinen, some researchers are experimenting with having the voice of a loved one be programmed into the cockpit, should a wake-up call be needed.

Update: CNN reports that the "stray jet's pilots were on laptops," which may intensify current debates about balancing responsibilities to passengers with access to ubiquitous computing technologies in a complex attention economy that has already been at issue in train and metro transportation. Now the New York Times says that an impromptu tutorial about the scheduling system being implemented after the Northwest-Delta merger on a laptop was to blame.

Oh, You Mean That List

This weekend, as I traveled on Southwest airlines, I couldn't help but laugh at the way that the famed "no-fly list," which has been the bane of privacy and security experts for a number of years, is clearly so disregarded. As I watched a female airline employee circumvent the no-fly list barrier, it was obvious that the boarding agent little cared about the no-fly designation, beyond recommending to her colleague that she go through their employer to try to have her name removed in a supposedly new appeal system.

Check It Out

I wish I could tell you that I didn't know anything about threatening to kill the president.

But I have a schizophrenic cousin who did federal time for menacing the Commander in Chief two decades ago. It apparently involved state lines, a vehicle, and some actual weapons.

When Harper's literary editor and Virtualpolitik friend Ben Metcalf declared his intention to murder the son of the man my cousin had threatened to assassinate, his stunt in the name of free speech was only dubbed a "hissy fit," and Metcalf stayed out of jail.

If anything, Metcalf was probably more capable of carrying out the act before being detected by the authorities, but the context of his announcement made his violent sentiments seem more benign.

Recently New York Times columnist Thomas Friedman has argued that the poisonous atmosphere of death-threat rhetoric toward Obama could be compared to the environment in political discourse around Israeli Prime Minister Yitzhak Rabin before he was killed by an ultra-nationalist extremist. One of the pieces of evidence that Friedman points to is a Facebook poll.

What kind of madness is it that someone would create a poll on Facebook asking respondents, “Should Obama be killed?” The choices were: “No, Maybe, Yes, and Yes if he cuts my health care.” The Secret Service is now investigating. I hope they put the jerk in jail and throw away the key because this is exactly what was being done to Rabin.

In "Secret Service investigates Obama poll on Facebook," the Los Angeles Times presents a somewhat more complex account of how the poll might have been received by Facebook users, given the tone of satire in many polls and quizzes on the popular social network site.

But officials also said that tasteless comments or idle bluster are probably not enough to trigger legal action. The agency seeks to determine whether the person who made the threats had some intent to carry them out or to otherwise incite violence against the president.

Facebook members had their own quick response Monday. A second poll was launched asking whether the creator of the first poll should be arrested.

I would probably vote "no" on that poll, given the fact that it would be relatively easy to argue that this kind of fake interactivity that a Facebook poll represents is an obvious vehicle for parody, particularly of the kind of simplistic binary thinking being exploited by the president's most virulent opponents.

En Garde!

I've written before about the proliferation of government domain names not tied to particular federal agencies and the silliness of long URLs like AStrongMiddleClass.gov and MakingHomeAffordable.gov and FoodSafetyWorkingGrop.gov. Now the federal government has brought its citizens OnGuardOnline to advise them about computer security and its associated consumer protection issues. In addition to a series of online videos about phishing, the site also offers a suite of online games.

There is Follywood Squares, an easy tic-tac-toe game about online medical claims, which stars characters like "Larry Logo," "Pamela Pils," and "Ms. Naturals" who offer their speech balloons to canned music and a laugh track while directing players to sites run by government agencies and nonprofites. Invest Quest chooses a board game/game of life display to encourage a similar level of skepticism about online economic opportunities.

However, compared to the ACLU's Facebook quiz about Facebook applications that gets at the heart of issues about trust and marketing, FriendFinder shows its inferiority by displaying a predictable game about simple cybersafety that emphasizes denying contacts and protecting privacy at the most obvious level. And correct answers to only five true-false questions allow you to win Invasion of the Wireless Hackers, so it isn't much of a game.

There is more true-false testing in ID Theft FaceOff in which correct answers about preventing identity theft can restore the facial features to your character's visage.

When playing the games, I couldn't help but notice that the phrase "Stop - Think - Click" on the site was trademarked and wonder why government websites continue to feature content that makes intellectual property claims rather than material that is clearly in the public domain.

Thanks to Ian Bogost for the link!

Playing for Attention

It is interesting that UC Irvine's Center for Unconventional Security is honoring Playing for Change with its Human Security Award. Given how the term "security" functioned in the rhetoric of the Bush White House, it is certainly an attention-getting rhetorical choice to redefine the term to encompass a group that I've written about before here on Virtualpolitik. Playing for Change emphasizes collaborative music-making and recruiting musicians with the distributed social networks of the Internet.

Trade Offs

There is an interesting piece that argues that "Web users will trade off privacy for security and convenience." I've been thinking a lot about how privacy is imagined as a zero-sum with other values in computational culture for a while, and I'm not sure that security and convenience often come bundled together for consumers.

Privacy issues are also being raised by the ACLU, which has designed a Facebook privacy quiz that shows the site's users how third parties can easily get access to private information when Facebook friends take any of the site's proliferation of online quizzes. After the interactive experience of taking the quiz, Facebook users are encouraged to sign an online petition objecting to the way that Facebook acts can harvest information from users without their knowledge or consent.

Security Blanket

Earlier this week I wrote about the Government 2.0 conference and how its corporate hype and Web 2.0 enthusiasm ignored the need for legislative participation and systems of authentication that make political participation possible between trusted parties. Last month there was a conference, also in Washington D.C. for the Cyber Leap Year Summit, which was oriented toward much more substantive issues about how questions of provenance and trust could be negotiated. Of course, the conference reflects the Obama administration's continuing interest in developing a comprehensive "cybersecurity" policy, but it much more accurately reflects the concerns of policy makers and the anxieties of the public about infrastructure and privacy than the Gov 2.0 congratulatory get-together, even if the metaphor of "game changing" in these documents does seem somewhat trite.

The hosting agency, Federal Networking and IT research, which has its own .gov domain, deals with questions involving large scale networking, human-computer interaction, high confidence software and systems, and other issues that could make transformative e-government actually attainable and sustainable.

Securing the Perimeter

Questions of authentication have been very much on my mind of late, as I think about how contracts have traditionally required seals, signatures, or other proofs of identity that become much trickier to produce in online environments. So it was with great interest that I saw electronic screens advertising the advantages of GlobalEntry.gov, a system of kiosks to automate passport control functions by using bar read

ers and scans of biometric data. The catch with such a system, of course, involves what its tolerances would be. I know that one Christmas Eve, one of my son's European friends ended up in immigration limbo because the fingerprints left by his guitar-playing calloused hands didn't quite match their fingerprints on record. With this fifteen-year-old facing a holiday spent in detention, rhetorical appeals to live minders were required when automated systems got authentication wrong.

I also learned about GetYouHome.gov, an RFID-based system for "Western Hemisphere" travelers within North America to allow drive-through access.

The Customs and Border Protection agency that hosts both programs still has a relatively conventional government website with little integration of Web 2.0 technologies.

Fail.gov

The government website for the "Cash for Clunkers" program, Cars.gov, has had a number of problems with its back-end functionality and front-end public rhetoric since its launch mere weeks ago. First it suffered from periodic system crashes, and now it has become a focus in right-wing conspiracy theories about government surveillance.



What's interesting about the anxieties about malware and cookies expressed on Glenn Beck's show on Fox is that the host credits his crowd sourcing techniques among his viewership as the source of this story about the fine print in user agreements. In this case the verbiage in the legalese was particularly baroque.

"This application provides access to the DOT CARS system. When logged on to the CARS system, your computer is considered a federal computer system and is property of the United States government... users have no explicit or implicit expectation of privacy."

"Any or all uses of this system and all files on this system may be intercepted, monitored, recorded, copied, audited, inspected and disclosed to authorized CARS, DOT and law enforcement personnel, as well as authorized officials of other agencies, both domestic and foreign."

"By using this system, the user consents to such interception, monitoring, recording, copying, auditing, inspection, and disclosure at the discretion CARS or the DOT personnel."


Update: Yet again the Obama administration shows that it responds to criticism of its websites in the blogosphere, whether it comes from the left or right. Just as they responded to criticism from Chris Soghoian's Surveillance State within hours, Beck has announced that the language is being revised by the Department of Transportation.