Who Cares About Surveillance?

The Washington Post reported that most Americans don't care that much about recent surveillance disclosures. Perhaps this is because there is bipartisan agreement among Congressional leaders that everything being done is kosher and necessary, and because the president has also weighed in reassuring the public that nobody is eavesdropping on their phone calls. Perhaps it is because it is hard to get worried about anything you don't notice and whose effects you can't see. Perhaps it's because we are now too distant in history from European surveillance states; the fall of the Soviet Union was a long time ago from the perspective of a college student, and Nazi German is the stuff of old movies. (Do they even read 1984 in schools any more?) There is North Korea of course, but people think of that place as so remote and isolated as to be almost a joke (unless they have Korean relatives). As danah boyd has observed (meandering thoughts on the NSA scandal), activists care, but activists are the ones most likely to commit speech and thought crimes.

It seems not to be taken for granted by most Americans that whether the surveillance is unconstitutional is not a matter for consensus decision, since it involves infringement of the Fourth Amendment. As the Washington Post reports, "while it might be fine for your neighbors to let the government inspect their personal lives, it’s not okay for your neighbors to say it’s fine for officials to inspect you. 'The whole purpose of the Bill of Rights was to protect the minority from the will of the majority,' [Professor Lori Andrews] says."

The Washington Post and the Guardian may have muddied the waters by going to press too incautiously with reporting based only on the infamous PowerPoint presentation and on Edward Snowden's interview. The first version of the Post's reporting was walked back in significant respects with very little notice. Declan McCullagh, a respected digital-affairs reporter, has concluded that there is no evidence that the NSA has direct access to Internet service provider servers, as the Guardian and the Post declared and as Facebook and Google denied. Maybe those PowerPoint slides were the work of an overzealous marketing flak. If the newspapers that had the scoop got it wrong, it becomes easier for the public to be reassured that there is nothing creepy or improper going on.

Yet we still don't quite get how the surveillance systems work, and it is reasonable to mistrust what the NSA says since it plainly has misrepresented things in the past. Even if all that exists is the "metadata" log of all US telephone calls -- which could well have been lawfully collected -- that would surely be inconsistent with Director of National Intelligence James Clapper's Congressional testimony that the NSA does not hold any information on tens or hundreds of millions of Americans. (Not to mention last year's testimony that the NSA can't scan email of Americans because it does not have the technology to do so.) I for one think a version of Kerckhoff's Principle should be honored here: The system itself should be public knowledge, though not of course anything about what the system has revealed. Knowing how the system works will make us more secure, not less, because it will reduce the reliance on "security through obscurity." (Cf. Blown to Bits.) 

With so much about the surveillance system still undisclosed, I wonder if the following could be true. As I said in the Washington Post story cited at the top, it would be very cheap to record and store all US telephone calls. Audio is highly compressible; a back of the envelope calculation suggests the government could store a whole year's telephone calls -- all of them -- for a small number of millions of dollars, given the low cost of massive storage units. What is preventing the government from doing that is, presumably, wiretap law. Could the calls be lawfully be recorded by the government, but listened to only after issuance of an appropriate court order? Could the recordings be made by the telcos and held in dead storage, but turned over to the government in response to a narrow and specific court order? I am not a lawyer.

One hates to raise paranoid fears on the basis of a couple of unguarded statements, but consider these.

A CNN exchange on May 1, 2013 between interchange between Erin Burnett and a former FBI counterterrorism expert.

BURNETT: Tim, is there any way, obviously, there is a voice mail they can try to get the phone companies to give that up at this point. It's not a voice mail. It's just a conversation. There's no way they actually can find out what happened, right, unless she tells them?
CLEMENTE: No, there is a way. We certainly have ways in national security investigations to find out exactly what was said in that conversation. It's not necessarily something that the FBI is going to want to present in court, but it may help lead the investigation and/or lead to questioning of her. We certainly can find that out.
BURNETT: So they can actually get that? People are saying, look, that is incredible.
CLEMENTE: No, welcome to America. All of that stuff is being captured as we speak whether we know it or like it or not.

OK, let's not get too excited. But was this just a slip of Senator Feinstein's tongue, from today's New York Times? My emphasis:

Analysts can look at the domestic calling data only if there is a reason to suspect it is “actually related to Al Qaeda or to Iran,” she said, adding: “The vast majority of the records in the database are never accessed and are deleted after a period of five years. To look at or use the content of a call, a court warrant must be obtained.”

I thought it was only metadata, the phone numbers calling and called and the date and time and length of the calls, that were being logged.  Not the content of the calls.

It is hard not to wonder. It is easy to log all the metadata for all domestic phone calls and we now know it is being done. It would be easy and cheap to record all the phone calls being made in the U.S. If the government is not doing it, it's not because they haven't thought of it, and it's not because it would not be useful to do it. It can only because there are legal barriers, and with recent revelations about uses of the PATRIOT Act that have surprised even the bill's primary author, it is hard to be sure where the limits of existing laws actually are.

Some Thoughts about PRISM

I have been waiting to comment on the recently disclosed NSA surveillance programs until more facts came out, since what various parties were saying in the first days after the story broke seemed so irreconcilable. And the reports touch on so many issues covered in Blown to Bits it is hard to know where to begin. We know more now, and though some of puzzles remain, at least some of the questions have started to firm up.

How Does PRISM Work? We don't really know. What is "collected," where? The PRISM slides (the ones that have been released -- only a few of them) clearly state that the "collection" includes both "surveillance" and "stored comms." But stored where? Facebook and Google, two of the companies listed as part of the program, both are clear in their denials. Both Larry Page (Google) and Mark Zuckerberg (Facebook) deny giving the government "direct access" to their servers. (Some have suggested that this phrase needs definition; what about indirect access? But to be fair, arguably we all have indirect access to their servers.) Both also state that their companies respond only to specific requests, which are scrutinized individually and challenged if overly broad. Alex Stamos suggests that (especially given the low -- $20 million per year -- price tag for the program touted in the slides) PRISM may be just a code name for a view into data gathered through a variety of mechanisms. That is not the way Edward Snowden, the self-identified leaker, makes it sound. It seems to me that it is more likely that Snowden is exaggerating, and that the individual who made the cute graphics on the Powerpoint slides did not fully understand the system, than that Page and Zuckerberg would be flat-out lying when the truth might easily come out in another way.

Add to this the subtlety that in the DoD, "collecting" data does not mean what you might think. As the EFF explains,

Normally, one would think that a communication that has been intercepted and stored in a government database as “collected.” But the government’s definition of what it means to “collect” intelligence information is quite different than its plain meaning.

Under Department of Defense regulations, information is considered to be “collected” only after it has been “received for use by an employee of a DoD intelligence component,” and “data acquired by electronic means is ‘collected’ only when it has been processed into intelligible form.” 

In other words, the NSA can intercept and store communications in its data base, then have an algorithm search them for key words and analyze the meta data without ever considering the communications “collected.”

Director of National Intelligence James Clapper did not help matters when he point-blank denied any massive data collection in his Congressional testimony:

Sen. Wyden: "Does the NSA collect any type of data at all on millions or hundreds of millions of Americans?" Mr. Clapper: "No, sir." 

And then, when challenged after recent disclosures, offered a restatement:

"What I said was, the NSA does not voyeuristically pore through U.S. citizens' e-mails. I stand by that." 

Well, that is not what he said. Taking all the semantical gymnastics into account, I would conclude that the NSA is sifting automatically through lots of email and other content searching for for specific targets. It is what Phil Zimmermann, way back during the Crypto Wars, called "driftnet fishing": scoop everything up, and throw back what you don't want. Isn't that a violation of the Fourth Amendment rights of the rest of the fish?

I think what is going on here is that people think there is a big difference between a computer reading their email and a human being reading it. There isn't.

Questionable defenses. Perhaps the inconsistency can be reconciled by dicing the language yet more finely or by understanding better how the system actually works. But for some, there is no problem in any case. The Fourth Amendment, like the other enumerated rights, is not absolute. PRISM's collecting and sieving just represent a necessary compromise. Of course, because the program has been secret, its constitutionality has never been challenged. The courts like to be reassured that when the government infringes a civil right, the infringement is as limited as possible. The ACLU is hard at work preparing a challenge; maybe we will find out.

But others don't even care about the constitutionality. If PRISM prevents even a single terrorist attack -- and claims have been made that it did exactly that -- they don't mind the infringement of their privacy.

There are two problems with this line of logic, beyond the basic fact that the crime-stopping prowess of PRISM is disputed. One is that civil rights are not subject to popular consensus or majority rule. It may well be that most people don't like the Fifth Amendment; doesn't matter. We all get protection against self-incrimination even if most people don't want it for themselves or anyone else. Same goes with protection against unreasonable searches.

On top of that, I wonder why people feel so comfortable with email searching. Let's take an analogy. Suppose the government had the keys to all our abodes, and we knew it had mounted an anti-terrorism program called SPHERE. Under SPHERE, the police could go into our houses and apartments when no one was home and just look around, without disturbing anything. In fact, it turns out the program has been in place for years, preventing crimes, and none of us knew it existed until some high school dropout turned CIA operative spilled the beans and sought refuge in Hong Kong. How many of us would really say, great -- I have done nothing wrong so I have nothing to worry about?

How did Snowden get away with it? After the Bradley Manning Wikileaks fiasco, I should have thought that the government would deploy some extra software on the computers that had access to Top Secret information. It would know, or learn, the printing and file handling habits of everyone authorized to use these machines, and especially the low staff who have the most limited track records. When the software detected an unusual pattern of downloading or printing, it would ring a bell on the supervisor's desk, who would walk over and check on what the staffer was doing. I would hate this, but I'm not working with top secret information; if you have access to that kind of data you expect to be monitored. Why hasn't such software been deployed?

Enough for tonight -- more thoughts later, perhaps.

Congressional Math

Innumeracy is a serious problem in this country, especially when it afflicts our elected representatives. The phenomenon manifests itself in lots of ways, some of them deadly. Here is one from this morning.

Oklahoma Senator Tom Coburn was on Morning Joe today, dismissing the idea that Congress would have to help his state through the recovery from the tornado disaster. Existing FEMA funds would cover it, he said. No problem with that, nor with his opinion, voiced a few minutes later, that it should be up to Oklahomans to decide whether to regulate the construction of storm shelters in new buildings. It's what he said next that was the problem. The exchange begins at about the 5:00 point of this clip.

"If you're living in that area of Moore, in Oklahoma, the likelihood of being hit by another tornado is about zero, in terms of odds." The interviewer tries to correct him, explaining that being hit by tornadoes twice in fourteen years doesn't affect the odds of being hit again, but Coburn doubles down, finishing up by saying "You need to check your statistics class."

I find this astonishing, not because I expect members of congress to be good at math, but because I expect them--especially those from western states--to be good at gambling. Has Coburn played games with dice? Does he really think that rolling snake eyes once makes it less likely to happen again? I suppose that even experienced gamblers believe such things, but that is where we should hope for better from the people who are throwing billions and trillions of our dollars at real and imagined problems.

There is a joke about a corporate executive who asks the odds of being on an airplane with a bomb, and is given a number, one in a million. He then asks what are the odds of being on a plane with TWO bombs, and is told one in a trillion. "Great," he says. "From now on I'm taking a bomb with me wherever I travel." Perhaps the Senator will want to make the country safer by urging us all to follow that strategy.

Richwine and the FAS Hegemony over the PhD

I had never heard of Jason Richwine until I started reading the reports about his Harvard PhD thesis, on the IQs of immigrants and the policy implications for the US. The thesis itself (here it is, if you want to read it and make up your own mind) was presented in 2009. Apparently nobody noticed it, or thought it was worth complaining about, until Richwine worked its conclusions into the Heritage Foundation's report on the economic costs of US immigration policy. That blew up, and Richwine resigned from the Foundation.

The expected parties have taken the expected positions on academic freedom and so on. One interesting take is by conservative Ron Unz, who says he has independently researched the issues himself, and thinks Richwine is just wrong on the facts. Whatever one may think of either Richwine or Unz (and Unz has written some misinformed things about Harvard), this part of Unz's piece raises an interesting governance point.

Richwine’s doctoral work was performed at Harvard’s Kennedy School for Public Policy, which is separate from the main graduate school containing academic disciplines such as evolutionary biology, psychology, and sociology. The typical Kennedy School graduate receives a Masters Degree in Public Administration, and is often a mid-career government official, seeking to burnish his academic credentials. The three faculty members who evaluated Richwine’s dissertation—George Borjas, Richard Zeckhauser, and Christopher Jencks—are noted social scientists, but with the possible exception of Jenks, who was apparently a late addition, none seems to have a strong background in IQ issues; otherwise, they surely would have brought the facts I have cited above to Richwine’s attention and required him to properly address them. And once the media mob began baying for blood, Richwine’s advisors immediately backpedaled on any familiarity with IQ issues and quickly disassociated themselves from the dissertation they themselves had approved.

What catches my eye here is that none of the members of the dissertation committee is a member of the Faculty of Arts and Sciences. Borjas and Zeckhauser are economists, but neither is a member of the Economics Department; nor does Jencks seem to be a member of any FAS department. But the PhD is granted by the Faculty of Arts and Sciences; to be precise, it is the Faculty of Arts and Sciences that takes the ritualized vote on the Monday before Commencement to recommend to the governing boards that they award the PhD to the candidates who will be assembled on Thursday. In this case, the PhD is being granted in the subject of Public Policy (there is a separate PhD program in Social Policy, or rather, two of them).

FAS has insisted that only it, and not any of the other Faculties, can award the PhD degree. Philosophically, the point is that the PhD is a scholarly and not primarily professional degree. It has always been a worry that if the professional faculties could offer the PhD on their own, the value of the currency might be debased, for example if advocacy or skill-training were to eclipse the impartial pursuit of the truth.

So when it is proposed to create a new PhD program, jointly with another Faculty, it is the Faculty of Arts and Sciences that must discuss and approve the program (first in the Committee on Graduate Education, then in the Faculty Council, and finally in a vote of the full Faculty). I remember when the PhD in Education was approved a couple of years ago, part of the FAS discussion was about requiring that at least one member of every dissertation committee be a member of the Faculty of Arts and Sciences. I don't remember how that came out in the Education case, but that seems not to be the rule for the PhD in Social Policy. In the case at hand, a dissertation about the social policy implications of IQ was approved by a committee of social policy experts lacking anyone from the Psychology or Sociology department with professional expertise in psychometrics. In fact, while I haven't checked all the names on the Public Policy Standing Committee, it seems to have very limited (if any) FAS representation. By contrast, the list of Core Faculty for the PhD program in Social Policy includes a number of members of the Sociology and Government Departments, some of whom have the relevant expertise to critique a thesis on IQ.

Of course, sticking an arbitrary member of the FAS on a thesis committee does not guarantee that any high standard of scholarship will be met. But perhaps, if the people at Harvard with the right expertise share Unz's skepticism about the soundness of Richwine's psychometric findings, the question that needs asking is whether the governance over the many interfaculty PhD programs is strong enough to provide the quality control that is the rationale for the nominal FAS hegemony over the PhD degree. Because if Richwine's findings of fact are wrong, and the members of the dissertation committee did not see fit to pull in anyone with the relevant expertise to check the details, then this PhD is, in the words a colleague used to describe a different Harvard embarrassment, a stain on the uniform we all wear. Why, if the central facts of this dissertation are wrong, should the public trust that any of our PhDs mean what we claim they mean?

David Brooks on Leaks

From "When Governments Go Bad":

This scandal arises from a larger cultural virus: leakaphobia. Every administration centralizes power more tightly than the one before and is more paranoid about leaks than the one before. Every administration successively narrows the circle of debate, forsaking wide deliberation for the sake of reducing leaks (except the politically useful ones). Why do they do this? Because people who go into government not only have a tendency to want to control other people but also to control information.

…

People can only have faith in a government that self-restrains, and there’s little evidence of that now.

I have no idea why I wanted to post that. It must have reminded me of something else, but I can't quite put my finger on what.

More on Licensing MOOCs

After reading yesterday's post about MOOCs, a colleague asked me why I preferred BY-SA licensing to BY-NC-SA licensing. Now that looks like a technical question about lawyerly alphabet soup, but it is actually a basic question about what HarvardX is trying to accomplish. The faculty should be discussing the nature of the HarvardX intellectual property policy, and if we don't, we'll have another explosion like the one that happened this year when Harvard unwisely sent around detailed proposed revisions to its IP policies and then had to pull them back for reconsideration after a faculty explosion.

To begin with, we need some consensus on what we are trying to accomplish with HarvardX and with our membership in EdX. I think it is fair to assume that among our goals are (1) to extend our educational reach, that is, to spread learning to more of the world; and (2) to cover our costs and to make a profit that can be used to support our traditional educational, research, and scholarly functions. Harvard has articulated other goals, such as to develop tools, and data on teaching and learning that can improve undergraduate education, but I want to focus on the first two, which I don't think are in any way inconsistent with the others.

Now I am not sure some professors even realize that (2) is a goal. Some professors are diffident about any talk of "business models" and so on, but also bemoan the budgetary cutbacks they have experienced to their educational and scholarly efforts. HarvardX presents a potential new revenue source. Of course there are alternatives. Maybe some alum would want to pay the full cost of HarvardX and we would not have to worry about receiving revenues from it. Maybe Harvard could save some money elsewhere and use it to pay for HarvardX. Realistically, I think it makes more sense to try to get HarvardX to pay for itself and more, but that is an assumption. After all, Harvard could in theory decide that undergraduate tuitions should subsidize HarvardX in the long run, and not the other way around. So while I want to mark (2) as an explicit assumption which has not been explicitly stated as far as I know, I hope it will not be controversial.

And of course precisely what policies might work the best to achieve both goals (1) and (2) also depend on how big a profit, per (2), Harvard wants to generate from HarvardX. It's very unclear, to me at least, whether more revenue would come from trying to get a little bit of money from a lot of people or a lot of money from a few people. That is not the only consideration; the latter would, of course, be in tension with goal (1). Tradeoffs everywhere, and doubtless different MOOC providers are going to be experimenting with different approaches.

Now to the question of Creative Commons licenses. A BY-SA license lets other parties use the materials as long as they are attributed to the creator (Harvard in the case of a MOOC) and as long as the derivative materials carry exactly the same BY-SA license. This assures proper credit is given where it is due, and encourages others to add to the "creative commons," the wealth of publicly available raw materials that others can use to construct other creative works.

Now relaxing copyright in this way, it may be argued, carries some risks. Some professors might lose their jobs, the fear voiced by the philosophers at San Jose State University. That is an interesting moral question related to the frictionless information universe, about which I would love to hear Professor Sandel expound a bit more. But that is not today's topic.

Once we make our materials openly available, someone could do something with our creation that we don't like, and we would have surrendered our right of disapproval. True, that is part of the loss of control that comes with greater openness. But even without surrendering any of our copyrights, we are not immune against fair use by others, including harsh criticism and parody. Movie and book reviewers do not need studio or author permission to quote from a work in the process of ridiculing it. We should have enough confidence in the quality of our works to think that they will be used more for good than for harm if we relax control of them.

Another objection is that someone else might make money from some derivative of our works. That may be seen as somehow morally offensive: if anybody is going to make money from our works, goes our instinct, it should be us. That objection is addressed by a separate Creative Commons license, BY-NC-SA, that adds the following "noncommercial" clause:

You may not exercise any of the rights granted to You in Section 3 above in any manner that is primarily intended for or directed toward commercial advantage or private monetary compensation.

Why not use this license instead?

One problem with this language is that it is not clear what exactly it excludes. If materials under such a license get used by the profitable Extension School of Podunk University, is that disallowed, or is it allowed because Podunk U is a nonprofit even if its Extension School tries to turn a profit to be used by other programs of the university?

But another problem with the "NC" clause is that it is not clear why, morally, we should care whether the derivative use is commercial or not. Just to take two extreme examples: Would it really be morally good for our materials to be used by Ohio State University, whose president receives a salary of $1.9 million, plus use of a private jet and other amenities, but morally bad for our materials to be used by a small-scale Mongolian entrepreneur trying to offer a technical education to impoverished Mongolians by creating a private technical institute that charges modest tuitions and turns a small profit?

In fact, the whole element of moral indignation that leads to resistance of the simple BY-SA license is introducing into American copyright an element of "moral rights" that is part of the European, but not American, copyright tradition. Under the US Constitution, the purpose of copyright is not to guard the moral rights of the creator, but "To Promote the Progress of Science and the Useful Arts." And that, surely, should be Harvard's objective, per (1) above, in whatever license it cuts for use of its MOOCs.

Under a simple BY-SA license, any for-profit that made a derivative work using Harvard materials would have to acknowledge that they came from Harvard (but then wouldn't most students prefer to get the materials from their original source?), and would also have to make their modifications and enhancements available to others, commercial or noncommercial, on the same basis. I doubt that for-profits would see taking Harvard materials as a viable business model on those terms. But if one did, and somehow produced educational products that were so superior to ours and could make them available so much more cheaply that it could overcome the natural market resistance to picking Unknown Corp's products over Harvard's, well, more power to them. We shouldn't be using legal barriers to win a game we can't win on the merits.

I expect that a lot of lawyerly thought has already gone into the license terms and business models. I have no real expectation that Harvard will go with a BY-SA license; probably it will come up with its own license terms. But the faculty here and elsewhere are only now coming to grips with the force of the MOOC tsunami, as I suggested in yesterday's post. Since they are not merely actors in this drama but the actual agents of change, they should be engaged in a realistic conversation about the program's means and ends, and what they think about hypotheticals like the ones I have posed.

MOOCs, and MOODs?

There is a drive-by quote from me in Nathan Heller's good New Yorker article about Massive Open Online Courses. Reading the story reminds me how hard this kind of writing is -- I spent a long time with Heller, and tried to sell him on the idea of CS20 as an anti-MOOC, but our conversation got reduced to one line about students sleeping through class.

It is interesting to see the MOOC euphoria being replaced by MOOC dread. The best articulation of the worries is that of Prof. Bob Meister of the UC Santa Cruz, after the University's decision to import Justice, Michael Sandel's MOOC course on moral philosophy. It is now becoming apparent, here at Harvard and elsewhere, what is implied when it is said that the Internet will result in disruptive change to higher education. Universities facing crushing budgetary cuts will try to save money. There is no question that the learning experience will change at places like the UC Santa Cruz; the only question is how. The members of the philosophy department do not want to be Prof. Sandel's remote teaching assistants, and Prof. Sandel does not want to be an agent of downsizing philosophy departments elsewhere. Fine, but the UC governors also have the option of not teaching philosophy at all, or drastically consolidating departments, as Rick Scott proposed for anthropology departments in Florida.

So what is Harvard's responsibility in all this? It is a very, very tricky question.

Quite likely the world of MOOCs and other Internet-enabled higher education will recapitulate the history of the Internet. Once information transmission and storage become free, goods that are free or nearly so will undercut the revenue model for information institutions that have been crucial to democratic societies. Nobody involved in the development of the Internet wanted to destroy the newspaper industry, but it is hard to see what they could have done to prevent the havoc that has resulted from the free flow of information even if they had seen coming everything that has happened. -- short of building into the Internet architecture a set of locks and chains that would have been devastating to innovation and entrepreneurship.

In the case of MOOCs (or other ways of chunking online instruction), Harvard could impose burdensome licensing rules in an effort to protect the scholarly professionals elsewhere. (Just as the Wall Street Journal is now Online but hardly Open.) But of course UC would then utilize someone else's product, resulting in lower quality instruction at UC, perhaps at a higher price. Would we at Harvard then sleep better, knowing that if any philosophers had been laid off in California, it was not because of OUR MOOC?

And then there is the fact that in Computer Science, there is no oversupply of academic scholars nor undersupply of teaching jobs. The economic impact of providing CS50X on loose licensing terms would seem to be a huge social win for the world. Perhaps different subjects could be treated differently?

My personal preference would be for Harvard's courses to remain as open as possible, with licensing terms as relaxed as possible, on the theory that we should produce the best materials we can, try to recover our costs and a bit more, but not prevent others who can be even more creative that us from utilizing what we have to offer. Personally I like the idea of a pure Creative Commons Attribution-ShareAlike license. I am convinced Harvard could do fine financially on that model and could maximize its impact on the world. (There is as much chance of that happening as of a snowball surviving hell, but that can be for another day.)

In any case, there is no doubt the train is leaving the station. Yale signed onto Coursera today, and Georgia Tech announced an entire Massive Open Online Masters Degree program (hence my MOOD acronym in the title). Which of these institutions will prove to be contestants in a race to the bottom? I don't know, but everybody is going to have to be a lot more candid with each other. Universities should be clear about their revenue ambitions (just to cover costs, or if more than that, to plow the profits into what?). And the faculty are going to have to come to grips with the consequences, good and bad, of openness, and decide whether it really is more noble to be restrictive with its intellectual property than to risk any adverse consequences of sharing its educational creations with a generous and liberal spirit.