Here we go again: another messaging app, more illusions of privacy and security

Post updated — see below.

Simon Davies has an interesting take on the fallout from Facebook’s acquisition of WhatsApp.

In one of the most persuasive displays ever of the market power of consumer privacy, Facebook’s recent $19BN acquisition of the popular messaging app WhatsApp appears to have been given the thumbs-down by millions of users.

While it may be too early to produce a conclusive analysis, there are solid indications that the trend of new sign-ups to messaging apps over the past two weeks has overwhelmingly favoured the privacy-friendly Telegram app and has shifted decisively away from WhatsApp. Telegram has reportedly picked up between two and three million new users a day since the purchase was announced just over two weeks ago.

Davies says that “Telegram has built a range of attractive privacy features, including heavy end-to-end encryption and a message destruct function. As a result, many privacy professionals regard the app as the market leader for privacy.”

Hmmm… Davies points out that a German product test group recently criticised Telegram, on the grounds that

Telegram ist als einzige der getesteten Apps zumindest teil­weise quell­offen. Eine voll­ständige Analyse der verschlüsselten Daten­über­tragung war jedoch aufgrund der nur partiell einsehbaren Software-Programmierung nicht möglich…

…which I interpret as a view that judgement has to be withheld because the Telegram code is not fully open source — and therefore not open to independent scrutiny.

Anyway, intrigued, I downloaded the IoS version of the Telegram App to see what the fuss was about. The download was quick and efficient. The interface is clean. To get started you enter your mobile number and Telegram sends you a code when you then enter to confirm that it is indeed your phone. It then asks for access to your phone contacts which, it tells you, will be stored in the Cloud in heavily encrypted form…

Oh yeah? Can’t you just imagine the hoots of laughter in Fort Meade!

LATER: A colleague who is less linguistically-challenged than me writes:

I’m not sure that Simon Davis or you got the right angle on that test.de report on WhatsApp and alternatives. It’s true that test.de didn’t like it much, but their point about open source in the part you quoted is actually quite positive – it’s saying saying that it’s the only one of the apps they looked at that was even partly open source. A translation of the bit you quoted would be something like , “Telegram is, at least, the only one of the apps we tested that is partly open source. However, because the programming is only partly transparent, a complete analysis of its encrypted data transmission was not possible.” And the next sentence goes on to say, “But the testers can rule out the possibility that it transmits data unencrypted.”

That’s actually more positive than what they say in the corresponding section about any of the other apps, where they generally say they aren’t open source so that the testers can’t be sure that some data are not transmitted in unencrypted form.

Obviously that’s not a killer point for the German testers, however, because the only app they didn’t regard as having important problems is Threema, which isn’t open source.

What they didn’t like about Telegram is that:
* You have to choose explicitly to use encrypted transmission by choosing the “Secret Chat” option.
* The app automatically stores all your address book (contact) entries without asking you or asking the other people in the address book.
* In their conditions of use, users agree that the software house can store the user’s address book entries. No official address details (‘Impressum’) are given for the software house and there’s no contact adrdess where you can ask questions about data protection.

He’s put his finger on the biggest problem, in a way, which is not just that the App’s owners require you to upload your contact information in the Cloud, but that by accepting this requirement you compromise all those contacts without their knowledge or consent. This is the point that Eben Moglen was making in his wonderful Snowden lectures when he pointed out that acceptance of Gmail’s Terms and Conditions allows Google not only to read your own mail, but also that of your correspondents, none of whom have consented to that. (Though no doubt a slick lawyer will try on the argument that anyone who emails someone with a Gmail address implicitly gives his/her consent.)

The impending STEM crisis

My Observer comment piece about what’s happening to postgraduate student numbers in UK universities.

Here’s an interesting fact: for the last five years in UK universities, foreign postgraduate students have outnumbered British ones. International student numbers have grown by 90% in the past decade while the number of homegrown students has fallen by 12% in the past three years. And this despite the best efforts of the government and the Border Agency to dissuade students from coming to the UK.

The disproportionate growth in foreign postgraduates is good news for UK universities (because overseas students pay hefty fees), but bad for the society that supports those institutions. And it looks as though the situation will get worse.

Read on

When are leaks legitimate?

Thoughtful review by Jack Shafer of Rahul Sagar’s Secrets and Leaks: The Dilemma of State Secrecy (Princeton University Press, 2013, 304 pp. $35.00).

Sagar asks, when is it legitimate for an official to disclose secrets? His answer is both conventional and brave — because he must know how many readers will find examples that call his reasoning into question. Unauthorized disclosures of classified material should remain illegal, he writes, because no one official can know with any certainty which disclosures will ultimately serve the public interest. Having made the case for keeping the laws against leaking secrets intact, Sagar then sets five conditions a disclosure must meet before officials can disregard the laws: the disclosure must reveal real wrongdoing or the abuse of public authority, it must be based on evidence rather than hearsay, it must not threaten public safety disproportionately, it must be limited in scale and scope as much as possible, and the leaker must unmask himself and take his lumps to prove that he made the disclosure in good faith and not to gain advantage for himself or his allies.

The Snowden affair happened too late for Sagar to include it in Secrets and Leaks beyond a throwaway footnote, but it makes for an obvious and interesting test of Sagar’s framework. Snowden’s unilateral disclosures do not come close to clearing Sagar’s standard for legalization: as an NSA worker bee, Snowden was in no position to balance the public-interest repercussions of his acts. Nor do they clear Sagar’s first condition for justifiability: although the mass surveillance Snowden revealed may have come as a disconcerting shock to many of his fellow citizens, it might not have been illegal.

Shafer goes on to apply Sagar’s other tests to Snowden and makes some interesting points. He finds that some of them aren’t really relevant or useful. So we’re back to the intractable problem of how to deal with excessive secrecy in a democratic society.

Sagar devotes a chapter to why the regulation of secrecy can’t be turned over to the courts — they lack the expertise and the training to parse secrets, and they are supposed to be open institutions, doing their business in public. Nor can Americans expect Congress to do much better than the executive branch, he argues in another entire chapter. Congress can serve as a watchdog, but there is no reason to think it “will behave any more responsibly than the president,” especially when it knows that outsiders will not be able to second-guess its decisions. That leaves whistleblowers and the press to hold the president accountable for his handling of secrets. Sagar shuns this option. Although he approves of leaks that prevent abuses of power, he believes (along with many others in and around government) that journalists lack the necessary understanding of the big picture to responsibly pass unauthorized disclosures on to the public.

I disagree (but then, as a journalist, I would), because from where I sit, it seems the press has actually been quite conscientious in this regard — for example, in its reporting on the files stolen by the army private now known as Chelsea Manning. In January 2011, my Reuters colleague Mark Hosenball, a national security reporter, cited internal U.S. government reviews that assert that the massive leaks of diplomatic cables by Manning “caused only limited damage to U.S. interests abroad” and “made public few if any real intelligence secrets.” As with the publication of the Pentagon Papers, the leaks created more embarrassment than damage.

As for the Snowden leaks, it’s too early for journalists and others to discount the damage they may have done to U.S. national security. But rare is the leaker whose output unites almost half the House of Representatives, as well as the top Internet companies — Google, Microsoft, Facebook, Apple, Twitter, LinkedIn, Yahoo, and AOL — which issued a joint statement in early December protesting the government spying revealed by journalists working with Snowden.

This is a very good review which makes uncomfortable reading because it suggests that the ‘democratic dilemma’ of how to balance secrecy with accountability and openness might actually be insoluble. Some of the most vociferous establishment attacks on the Guardian‘s Editor, Alan Rusbridger, focus on the proposition that he is not in a position to judge whether a particular disclosure will endanger national security. But the weakness of that position is its assertion that only those who are within the secret circle are capable of making the judgement call. And, because of the necessity for secrecy, they can never explain their reasoning to us: in the end, that proposition boils down to “trust us”. But we have no idea if they are worthy of that trust, and sometimes they have clearly shown that they are not.

Kansas loses it, finally

Wow! You really could not make this up. Great post by Andrew Sullivan.

The bill that just overwhelmingly passed the Kansas House of Representatives is quite something. You can read it in its entirety here. It is premised on the notion that the most pressing injustice in Kansas right now is the persecution some religious people are allegedly experiencing at the hands of homosexuals. As Rush Limbaugh recently noted, “They’re under assault. You say, ‘Heterosexuality may be 95, 98 percent of the population.’ They’re under assault by the 2 to 5 percent that are homosexual.” As its sponsor, Charles Macheers, explained:

“Discrimination is horrible. It’s hurtful … It has no place in civilized society, and that’s precisely why we’re moving this bill. There have been times throughout history where people have been persecuted for their religious beliefs because they were unpopular. This bill provides a shield of protection for that.”

The remedy for such a terrible threat is, however, state support for more discrimination. The law empowers any individual or business to refuse to interact with, do business with, or in any way come into contact with anyone who may have some connection to a gay civil union, or civil marriage or … well any “similar arrangement” (room-mates?). It gives the full backing of the law to any restaurant or bar-owner who puts up a sign that says “No Gays Served”. It empowers employees of the state government to refuse to interact with gay citizens as a group. Its scope is vast: it allows anyone to refuse to provide “services, accommodations, advantages, facilities, goods, or privileges; counseling, adoption, foster care and other social services; or provide employment or employment benefits” to anyone suspected of being complicit in celebrating or enabling the commitment of any kind of a gay couple.

As Andrew points out, if the Republican Party wanted to demonstrate that it wants no votes from anyone under 40, it couldn’t have found a better way to do it. “Some critics”, he writes, “have reacted to this law with the view that it is an outrageous new version of Jim Crow and a terrifying portent of the future for gays in some red states. It is both of those. It’s the kind of law that Vladimir Putin would enthusiastically support. But it is also, to my mind, a fatal mis-step for the movement to keep gay citizens in a marginalized, stigmatized place.”

He goes on:

It’s a misstep because it so clearly casts the anti-gay movement as the heirs to Jim Crow. If you want to taint the Republican right as nasty bigots who would do to gays today what Southerners did to segregated African-Americans in the past, you’ve now got a text-book case. The incidents of discrimination will surely follow, and, under the law, be seen to have impunity. Someone will be denied a seat at a lunch counter. The next day, dozens of customers will replace him. The state will have to enforce the owner’s right to refuse service. You can imagine the scenes. Or someone will be fired for marrying the person they love. The next day, his neighbors and friends will rally around.

If you were devising a strategy to make the Republicans look like the Bull Connors of our time, you just stumbled across a winner. If you wanted a strategy to define gay couples as victims and fundamentalist Christians as oppressors, you’ve hit the jackpot. In a period when public opinion has shifted decisively in favor of gay equality and dignity, Kansas and the GOP have decided to go in precisely the opposite direction. The week that the first openly gay potential NFL player came out, the GOP approved a bill that would prevent him from eating in restaurants in the state, if he ever mentioned his intention to marry or just shack up with his boyfriend. Really, Republicans? That’s the party you want?

Why the obsession with “coding” misses the point

My relatively mild column about the Year of Code fiasco has generated a fair amount of comment, and a good many emails, including some from friends who think I was too willing to give the YoC crowd the benefit of the doubt, and citing Andrew Orlowski’s characteristically caustic take on the matter.

Leaving aside the motives of those involved in the ‘initiative’, a bigger concern (for me at any rate) is that the obsession with “coding” has two significant downsides:

  • it misses the point of the new school curriculum (or which more in a minute); and,
  • it risks alienating the audience that the initiative urgently needs to convince — schoolteachers who are not techies and are probably very nervous about what lies ahead for them as they come to terms with the new computing curriculum.

In her disastrous Newsnight interview, Lottie Dexter (and indeed her tormentor, Paxman) both seemed to think that the only motivations for the ‘coding’ initiative are utilitarian and economic: it was, they seemed to think, about kids being able to get jobs, start companies and thereby boost the prospects of UK Plc.

It’s nothing of the kind. This is first and foremost about citizenship. Today’s schoolchildren will inherit a world that is largely controlled by computers and software. The choice that faces them is “Program or Be Programmed”, as Douglas Rushkoff puts it in his book of the same title. If we don’t educate them about this stuff, then they will wind up as passive users of powerful black boxes that are designed and controlled by small elites, most of them located abroad.

Preparation for citizenship in this new world requires an understanding of how software works, how it is created and controlled, and how it can be changed. We don’t want them to grow up as technologically clueless as the parliamentarians who are supposed to oversee GCHQ; or indeed as Paxman, who at one stage fell back on the old trope about not having to understand electricity in order to replace a light bulb. (The obvious riposte — that light bulbs don’t decide whether you get a mortgage, monitor your private communications or count your vote – was obviously beyond poor Dexter.)

The other aspect of this is that, while learning to program is desirable, it’s not the most important part — which is about having a good critical understanding of the technology. And much though I love Raspberry Pi, teachers can achieve a lot of what I would like to achieve without ever touching a piece of hardware — as the wonderful Computer Science Unplugged project in New Zealand demonstrates.

Startup myths and obsessions

The UK government’s worship of SMEs (they are the industrial equivalent of “hardworking families” in Cameron’s lexicon) is comical to behold. Likewise the devout belief of tech entrepreneurs (especially in the US) that the only thing they need from government is to get out of their way. So it’s nice to come upon a blog post by Professor Mariana Mazzucato which punctures some of these fantasies.

Innovation-led “smart” growth has occurred mainly in countries with a big group of medium to large companies, and a small group of SMEs that is spun out from some of those large companies or from universities. These firms have benefited immensely from government funded research. Indeed, in my book I show how many firms in Silicon Valley have benefitted directly from early-stage funding by government, as well as the ability to build their products on top of government funded technologies. Every technology that makes the iPhone smart was government-funded (internet, GPS, touch-screen display, SIRI). Apple spends relatively little on R&D compared with other IT firms precisely because it uses existing technology. It applies its remarkable design skills to these technologies, effectively surfing on a government-funded wave. Apple, Compaq and Intel also all enjoyed the benefits of early-stage public funds (SBIC in the case of Apple, SBIR in the case of Compaq and Intel). As for America’s biotech boom (and the startups it has spawned), it was fuelled not by a random rise of genius and tinkering but by two fundamental factors: the 1980 Bayh-Dole act that allowed publicly funded research to be patented (which led to an exponential rise of spinouts based on such patents), and the massive funding of the underlying knowledge base. Between 1936 and 2011 the publicly funded National Institutes of Health spent $792 billion (in 2011 dollars), with last year’s budget alone totalling $30.9 billion. Small innovative firms benefit immensely from interacting with such an ecosystem. Left alone they get preyed upon by an increasingly short-termist financial system.

Her book is excellent, btw.

Dear Obama, spare us the press-freedom lecture

Good, robust column by Jack Shafer.

Wearing his best straight face, White House Press Secretary Jay Carney lectured China on press freedom yesterday. In a redundant official statement, he accused Beijing of restricting “the ability of journalists to do their work” and “imped[ing] their ability to do their jobs.”

If the Chinese cared about public opinion, they would have called a news conference of their own and read aloud from former Washington Post Executive Editor Leonard Downie Jr.’s comprehensive October report for the Committee to Protect Journalists, which cataloged the Obama administration’s hostility toward the press. Downie found that although President Barack Obama promised a more open government, his administration has prosecuted sources under the Espionage Act, imposed delays on and denials of FOIA requests, and closed its doors on reporters, systematically blunting the press. And recent revelations about mass surveillance by the National Security Agency and the secret subpoena of reporters’ phone logs and emails have contributed to a climate of fear in some newsrooms.

Whistleblowing Is the New Civil Disobedience

One of the things that has struck me most about Edward Snowden is how astute he seems to have been. Although he downloaded a lot of stuff, he seems to have been very discriminating in how he went about it. My reading of it is that he identified a number of practices that he thought/suspected were illegal/extra-legal/unconstitutional, then selected documents that would establish his case in each category, and downloaded those. And having done so, he seems to have been very canny in handling the subsequent media storm.

Now, more than six months on, people are beginning to see his modus operandi in a new light — as a template for new generations of whistleblowers. danah boyd has an interesting blog post about this, wondering whether whistleblowing might be the new Civil Disobedience.

People growing up with the internet understand that information is power. Those who’ve watched protests in recent years know that traditional physical civil disobedience doesn’t create the iconic narratives and images that it once did. And thus, not surprisingly, what it means to protest is changing. This is further complicated by an increased obsession with secrecy – secret courts, secret laws, secret practices – that make using the rule of law to serve as a check to power ineffective. Thus, questioning authority by leaking information that shows that power is being abused becomes a more valuable and notable form of civil disobedience. As with all forms of civil disobedience, there are significant consequences. But when secrecy is what’s being challenged, the biggest risk is not being beaten by a police officer for staging an event, but being disappeared or silenced by the institutions being challenged or embarrassed. And thus, as much as I hate to accept it, becoming a diplomatic incident is extraordinarily powerful not just for self-protection, but also as a way to make sure that the media doesn’t lose interest in the issues at play.

The ethics of Big Data

The smartest phrase I’ve heard about big data and ethics comes from my friend Sunil Abraham of the Bangalore Center of Internet and Society, who was involved with those conversations at OSF. He offers this formulation: “The more powerful you are, the more surveillance you should be subject to. The less powerful you are, the more surveillance you should be protected from.” In other words, it’s reasonable to both demand transparency from elected officials and financial institutions, while working to protect ordinary consumers or, especially, the vulnerable poor. Kate Crawford echoed this concern, tweeting a story by Virginia Eubanks that makes the case that surveillance is currently separate and unequal, more focused on welfare recipients and the working poor than on more privileged Americans.

From a typically thoughtful post by Ethan Zuckerman about a panel discussion on “Data and its Discontents” at Microsoft Research’s Social Computing Symposium