Cyberlaw: Difficult Issues Winter 2010 - User contributions [en]

Day 4 Thoughts

2010-01-08T11:47:01Z

128.12.147.187:

Sheel: The discussion on the BGP problem, although technical, was particularly interesting. Here's a question: if a full swap out of IP version 4 to 6 were to take place, could we then institute a full Secure BGP program at the same time? Perhaps I'm trying to combine two pieces of separate technical puzzles, but the point is this: perhaps we could focus on upgrading security at the same time as switching to IPv6.

Daniel: A key issue concerning cybersecurity seems to be the current lack of incentives for some actors to enhance security features of their products, services or practices on the internet. Do you envision a push for more control / oversight / monitoring to be exerted by platforms (Facebook, Amazon, eBay etc.) over developers that are constrained by their channels (developer kit, technical requirements for integration, framework for generating HITs and so on)? I can easily imagine users demanding such actions from aggregators of code or content, in progressive louder voices. In countries with a tradition of strong consumer protection, this is a step short of imposing liability over them. But would that move result in efficient solutions for internet "secure environments"?

Day 5 Predictions

2010-01-08T10:58:39Z

128.12.147.187:

Victoria: My prediction is that the speakers are going to be extolling the virtues of Wikipedia and explaining that although the site has gone under some transformations it is still a vibrant force. I would concede that I think it is. Most people I know still immediately turn to Wikipedia for a quick run down of a topic or an answer to a quick question. However, as time moves on the site is becoming less innovative and more standard. I would like to ask them about their understanding and personal experiences in trying to keep Wikipedia young. Moreover, having read that 85% of the contributors to Wikipedia are male I'd specifically love to ask Phoebe whether she feels that the articles are written from the male gaze and lack the other gender's perspective.

:: Sharona: Like Vickie, I was also struck by the statistics on the demographic breakdown, and I would love to hear their thoughts on whether they feel wikipedia really does represent a wide range of views, or more specifically (especially in the US) that of a white male. Another thing I think they will likely discuss - and probably not have a good answer for - is the question of privacy and defamation on wikipedia and other wikimedia projects. Can, or should, the website and/or its users or editors be held accountable if allegedly defamatory posts are not removed? Who makes that call? And what standards are used? It seems to me that there's no easy answer to this: while they may not run into strictly legal issues, it could definitely affect reader's trust in the information or fear that they too are vulnerable.

Bruno: I expect our guests to focus their comments on the strategies Wikipedia is adopting to address two of what seems to be the main problems of the project: (i) quality/accuracy of its articles, and (ii) issues concerning vandalism. After reading the materials, I was struck by the fact that Wikipedia doesn't seem to be worried about increasing its user base. The increasing amount of rules, the hostility of veteran users to newbies and the efforts to attract more scientists to participate in the project suggest that in fact they would be interested in less, but more qualified participation. Just like the attitude of our guest from CrowdFlower, perhaps a sort of procrastination to address a problem that is not yet so concrete might be operating here: with over 40 thousand contributors it's not clear when more means actually less.

:: Sheel: I'd be interested in hearing Wikimedia's reaction to this: what if people started using CrowdFlower or MechanicalTurk, if they don't already, to pay people 10 cents or so to go edit Wikipedia pages? I know they weren't okay with MyWikiBiz, but this is much more under the radar. Finally, I'd like to hear where the debate is on inclusionists v. exclusionists (meaning those who want to produce the 'integrity' of the encyclopedia and shy away from what may be deemed as frivolous by some portion of editors). My guess is that there is still no concrete answer---if enough editors are passionate about editing/creating a new page, then it'll stay.

Daniel: In addition to the topics above, I expect a discussion about the possible increase in vulnerability Wikipedia faces at the content layer, on par with a less dynamic environment. Since most pages are already done, at least in the English version, editors may feel less motivated to monitor existing, but seldom edited pages which are not on the "watch list". As a consequence, they can be more easily twisted by outsiders. In connection with that issue, I guess that our guests will raise the question "how does it feel to be a Wikipedian?" - and try to describe the community feeling from the perspective of insiders, and the challenges to bring more people in.

Day 4 Predictions

2010-01-07T18:28:59Z

128.12.147.187:

Amanda: I am very interested to hear Chuck's take on the relationship between the government, large corporations like Microsoft, and the defcon-attending hacker community (like the L0pht group mentioned in the Wired article). Is the government receptive to both groups? I imagine the relationship specifically between the hacker community and the government can become tense because the interests of both groups is not exactly aligned and is sometimes conflicting. Have they been able to successfully work together around a common threat like cybersecurity? While I imagine the government often tries to recruit from the hacker community, and I'm interested to hear where they draw the lines legally as far as subversive behavior within the hacker community (ie do they bend the rules for the sake of potential advances in cybersecurity?).
:Of course there are great advances yet to be made in the relationship between white-hat hackers and corporations like Microsoft. Skepticism abounds from both sides for obvious reasons, as well as entrenched interests and preconceptions based on past interactions ("Hackers are simply criminals", or on the other side "Microsoft is The Man").

:Tyler: To follow up on the above predictions, I am interested in hearing Chuck describe what he feels is the proper balance between government and private corporations dealing with cybersecurity. This may be an actual allocation of roles, or more of a question about how much of private industry's culture of innovation and rapid change can be transplanted into the government. Professor Goldsmith painted a picture where the government is not, and is unable to, secure the cyber-interests of the United States so when we hear that 90% of US military traffic runs through private networks, are we shocked that this number is so high or that it is not closer to 100%?

Vickie: I'm going to dovetail from Amanda's comment and say that I think Chuck is going to speak more specifically about the ID program he was talking about the other day as a possible solution to cybersecurity. Just as in the Wired article - identification solves a large percent of the problem, mostly through accountability. However, this seems too Orwellian for my blood. Unlike a passport that is shown in person - a computer ID is never going to be checked person to person. The computer will always be the intermediary. Moreover, this type of program may deter people from doing things on the Internet that they normally would do - if it wasn't anonymous. Visit certain political sites, fetish sites etc. etc. At what point is our fear balanced by our need for an Internet that is not being surveyed.

:Ramesh: I wonder what Chuck would say are the benefits to anonymity on the internet, and whether they are outweighed by the security risks. It seems like there could be a creditable argument saying just that. Also, I wonder about problems in scaling up ID programs -- one would assume that many countries would not participate, but if desirable content could only be accessed by an ID, perhaps consumers would then demand their nations also issue internet IDs.

Hector: Some of Chuck's points from his remarks on Tuesday that stuck with me most were the strengthening of internet identification and alternative networks that use something else than TCP. I hope that he elaborates on the possible applications of the latter.

Lien: I'm very interested to hear (i) what Chuck thinks the biggest cybersecurity risk is that Microsoft and other simular major private companies face and (ii) how the company is prepared for attack on its system and will react on it. I however predict he's not gonna answer that question...

Reuben: On Tuesday we spent a great deal of time on the attribution problem of cybersecurity which is related to deterrence and retaliation. I'd like to hear more about that, but I'd also like to hear about how we shore up our own defenses and incentivize security. I'll be interested to hear who Chuck thinks should be responsible for security. There is a dilemma for a company like Microsoft that may not want to have the burden of cybersecurity thrust upon them, but may also resist government mandates and control. I think Chuck will probably recognize that both public and private sector have a role to play, but he will emphasize the need for government to provide more leadership in the area.
: Daniel: If Chuck details public and private strategies, I expect him to talk much more about what Microsoft has proposed to other industry players than about governmental talks. My guess is that he will also reiterate a preference for diplomatic cooperation between firms, stressing the limitations of naming and shaming (as with GNI, when nobody discussed the tainted past of the companies that were not present on Tuesday). Finally, I would bet a lesser amount on his discussing long-term solutions for users to be more aware of security risks and more reactive to perceived security flaws / reports that do not harm primarily that specific user.

Jason: Especially since we have already had some discussion on the security issue, I think the class will be able to offer some interesting solutions for problems that exist pretty high-up in the stack, like user behavior, software, ID schemes, and other things that happen at the end node. But I predict that we'll be somewhat flummoxed about what's going on and what to do about the fundamental nature of the network, like the implications of the stuff that Clark was talking about in [http://www.ischool.berkeley.edu/newsandevents/events/sl20090304 his talk] that we listened to. I certainly am - though hopefully we'll make a bit of headway in class.