Links

The Code Book, Mozilla Debates Whether to Trust Chinese, and Facebook on Track for $1B Revenue This Year.

Cryptography

I’ve read this fabulous book on cryptography by Simon Singh, “The Code Book”. It’s easy to read and full of the little anecdotes and trivia nuggets that I love.

The book opens with the story of Mary, Queen of Scots. It’s a great story for illustrating the value and dangers of cryptography. Mary, as I’m sure you know, was sister to Queen Elizabeth and probably had the better claim to the throne. She misjudged the politics and showed up in England to get away from tetchy Scottish locals, only to be thrown in the Tower to keep her from making a play for the English throne.

While in the tower (or “whilst” as the Brits say) she entered into a conspiracy with plotters outside. This is in the days of Catholic vs Protestant and conspirators were plotting with Mary even as she was in captivity.

Not being stupid, they had invented a code to hide what they wrote and hid the messages in a barrel and smuggled them into and out of the country house where Mary was now being kept. So when Elizabeth’s aide, Walsingham, brought Mary to charge for treason, Mary felt safe.

He starts with this story because it shows all the important bits of cryptography. First, you’ve got “steganography”–the art of hiding messages. Smuggling them in via a barrel bung just one way–Ancient Greeks wrote their message on wood and then covered it in wax so that it looked like a smooth wax tablet. This is how Xenophon in Greece was able to get advance knowledge of an attack from Xerxes in Persia, according to Herodotus, and thus foil it.

Then you’ve got the code itself. He takes you through the different types of codes, beginning with jumbling up letters of the alphabet so every “a” becomes a “g”, and so on. This was the type of code that Mary had used, though she’d been a little more sophisticated and some words had become symbols, so “mine” was a kind of double S logo, and “in” became an italic “x”.

Codes revolve around a system and a shared secret. The system here is “replace letters and some words with other symbols”. The shared secret is exactly which letters and words get replaced by others–does an “a” become a “g” or a “q”?

And you’ve also got the codebreakers. Codebreakers are rarely portrayed as heroic, alas, because it takes far more time to break a code than it does to create it. So the poor codebreaker is often like Walsingham’s codebreaker, Thomas Phelippes, who is described as “a man of low stature, slender every way, dark yellow haired on the head, and clear yellow bearded, eaten in the face with smallpox, of short sight, thirty years of age by appearance”. He was a linguist who could speak French, Italian, Spanish, Latin, and German.

The techniques of the codebreaker remain the same. You can either exploit the fact that often a code leaves information that helps you break it, or simply to use some other means to learn more about the cipher and so make your decoding problem easier.

For example, in a later story Singh tell us about the Enigma machines of World War Two. The French Secret Service bribed the disgruntled brother of the head of the German Signal Corps to get the schematics for the machine. This told you how the machine worked, but the machine had settings — to decode messages the Allies still needed to know which settings were being used. The Poles figured it out first–the cipher wasn’t perfect and the Germans reused the settings all day, which gave you a lot of messages that were encrypted the same way. The Poles were breaking Enigma-encrypted messages until 1939 when the Germans changed the crypto system and made it stronger.

Then it was the Brits turn. At a place called Bletchley Park, which you can visit today as a museum, began applying themselves to the new Enigma. Thanks to the Poles they had the basic approach, but the German changes made it harder to crack. Fortunately the Brits had many more people working on it than the Poles did, so were able to read the encrypted German communications.

This is another technique we see today: “brute force”. When your mathematical analysis reduces the number of possibilities to a manageable number, you simply try each one. The more people you have working on this stage, each person trying one possibility, the more quickly you can break it. This is why the invention of computers has changed cryptography — computers can try the many different possibilities much faster than a person can, so we now don’t need as much mathematical insight to reduce a complex code to the point where you can just brute force the possibilities.

Anyway, back to Mary. Mary had received messages about a conspiracy, and they’d been intercepted and decoded. But Walsingham, Elizabeth’s Principal Secretary, really didn’t like Mary. He didn’t just want to deny her liberty, he wanted to get her red-handed plotting. So he waited, and eventually Mary acknowledged and endorsed the plot. He then had his cryptographer insert a PS onto the bottom of an outgoing Mary message, in code, asking to know the names of the conspirators and when the reply came, he had them arrested.

How’d it end? The conspirators were all “cut down, their privities were cut off, bowelled alive and seeing, and quartered”. Mary was beheaded. Score one for the Protestants over the Catholics. Never mind denying your atheist bus slogans, the 16th century knew how to deal with religious dissent.

So, good book, and it talks about a lot more: Navajo code talkers, and the “public key cryptography” that computers use today. But the basic systems of secrets, codes, interceptions, and breakers is largely unchanged today even though it’s all happening with computers and the code systems themselves are much more complex.

China

There’s really only one security system on the web. When you go to a website whose address starts with “https” and not “http”, you’re gong to a secure site. The communication between you and the server is encrypted and the identity of the other party is verified. This solves the Mary Queen of Scots problems where someone was listening in and even pretending to be one of the people communicating.

The site I linked to talks about the step where your browser verifies the identity of the other party. For example, I go visit ASB’s web site to do my Internet banking. My browser wants to be sure it’s talking to ASB and not to dirtyhacker.com who has rerouted traffic from ASB to their site.

To do this, ASB gives my browser a “digital certificate” signed by someone my browser trusts. There aren’t many places that browsers trust. The link today talks about how Mozilla is trying to decide whether to trust China’s official signing authority.

This is important because if China’s official signing authority becomes a puppet of the government, then dissidents might think they were communicating secretly and privately with a website when in fact all their communications could be overheard and decoded by the government.

It’s tricky politically, of course, because it’s not fashionable to stand up and say “the Chinese government can’t be trusted”. I’ll let you know how it comes out.

Facebook

And finally, Facebook. Facebook’s revenue has doubled every year since 2007: $150M then, $300M in 2008, $700M in 2009, and they’re on track to break $1B in 2010.

What’s interesting is where they make their money. It’s almost all coming from advertising. They know about what you like, so they can show you ads that you’re likely to like, so advertisers are happy and pay more for the advertising space. It’s Google’s idea but more personal–until recently, Google had no way for you to tell them how old you are, where you live, what interests you have, and so on. Despite that, of course, they’re still making a billion dollars every quarter, so it’s not too shabby.

People spend an hour a day on Facebook on average, which is much more than the 15m on average that people spend on TradeMe. Of course, if TradeMe could get you laid, maybe their average visit length would go up …

Today’s connecting them: life (Mary’s loss thereof), liberty (Chinese loss there off), and the pursuit of happiness (and Facebook’s monetisation thereof).

It seems bizarre at first, but the draft is laid out like a spreadsheet: one article per row and with three columns, one each for the US/Japan version, the EU version, and comments. Inside each sentence square brackets mark the attributed proposed alternatives for language. From this we can tell some very interesting things about the New Zealand position:

• NZ negotiators are keen on the wording “copyright and related rights and trademarks” rather than the US’s catch-all “intellectual property”. Richard Stallman has a well-written article on why “intellectual property” is a dangerous illusion. (Namely, it covers some very different pieces of law with different intents, terms, scope, and applicability)
• NZ negotiators are keen to keep the Copyright Tribunal option open. After Section 92a collapsed last year, the government consulted and has proposed a nuanced and good proposal that balances ease of complaint against risk of false accusation, giving the Copyright Tribunal the ability to hear complaints and award fines of up to $15,000. A 6-month suspension of Internet access and larger fines remain the domain of the courts. The US proposed language is all about “judicial authorities”, so New Zealand has proposed “competent authorities”. This is good–it shows that the government is serious about the Copyright Tribunal part of the new Copyright Bill and is not simply mooting it knowing that it will be overruled by ACTA.
• NZ negotiators are aware of the US desire to turn litigation into a revenue stream. They’ve opposed the US language “in the case of patent infringement, damages adequate to compensate for the infringement shall not be less than a reasonable royalty”, although interestingly NZ only supports this being stricken from the US proposal not from the EU proposal. The EU negotiators’ comments are fascinating: “The EU sticks on the concept that damage compensates all the prejudice but only the prejudice. Neither ‘punitive damages’ nor ‘future prejudice’ is acceptable”.
• NZ negotiators are keen to prevent the situation where someone joins a filesharing network, grabs an album, and is hit with a $100,000 penalty. Their wording supports flexibility when copyright damages are set: the authorities may consider lost profits (as opposed to the US wording shall) and NZ suggested the authorities consider retail price as well. The US wants each country to set up a system of pre-established damages and guidelines for calculating the penalties (oh, say, number of copies times profit we say we would havemade), and give the rightsholder the choice of using that formula instead of letting a judge award penalties. NZ wants this to be optional, not mandatory.
• Pirated or counterfeit items will be removed from sale or distribution, and NZ would also like them to be surrendered to the rightsholder (so Mattel get the knock-off Barbie dolls). The machinery used to manufacture the pirated or counterfeit goods is also forfeited, which NZ raises no objection to. It’s unclear to me whether this applies to computers used in copyright infringements.
• NZ supports deleting the article which says that when you’re found guilty of infringement, your identity and the identity of others involved in the infringement and distribution are turned over to the rightsholder.
• NZ is questioning the scope of the term “online service provider”. As we’ve seen with S92A, the term “provider” might cover cafes, hospitals, employers, apartment building body corporates, families, even sites like Google and TradeMe. Clarity is essential.
• ISP and website liability is a hot topic. Some countries already hold service providers liable for what happens on that service (e.g., Italy’s prosecution of Google executives) while others give safe harbour to such providers. Section 4 says “what we said for the physical world also applies for the online, but countries can place limits on the liability of service providers under certain conditions”. Switzerland wants this optional, NZ wants to know why search engines deserve safe harbour. I hope they got their answer–Google’s programs index billions of web pages and there aren’t enough humans on the Internet to read and pre-qualify pages before they go online.
• There’s an interesting clause that would prevent service provider safe harbours from being made conditional on proactive monitoring. That is to say, a country wouldn’t be able to say “oh sure, you can have safe harbour, but you have to be reading everything your users do and you lose it if you’re not searching all their traffic.” There’s a NZ objection here, but it’s unclear to me whether it’s to the whole provision or just the language.
• NZ is the white knight when it comes to anti-circumvention legislation. The ACTA draft contains proposed text saying that if you make or use a tool that breaks “technical protection measures” (DRM) then you’re breaking the law. The NZ negotiators point out that DRM is out of scope for ACTA, but even if it were in-scope there’s still public domain material locked behind DRMs and breaking such DRM shouldn’t be against the law. The paragraphs are beautiful. I quote them here:
  

  NZ: The paragraphs refer to “adequate legal protection” as well as remedies, which is inconsistent [with] the objective of ACTA to establish standards for the enforcement of intellectual property rights and the ACTA discussion paper. In particular, we note that the discussion paper refers only to parties providing “remedies against circumvention of technological protection measures used by copyright owners and the trafficking of circumvention devices.”

  New Zealand does not support protection being mandated against circumvention of TPMs where the underlying work is not protected by copyright. In particular, we do not support protection against circumvention of access control TPMs because access control is not an exclusive right given to copyright owners.

• There’s an odd section about preserving electronic rights management information. I assume it’s meant to preserve owner and license information, but I’m not really clear on the situations that motivated this section. NZ opposes extending protection of RMIs to cover information about performances or the producer of a phonogram.

On the balance this bit isn’t too bad–New Zealand is a good voice for sanity in the negotiations. I have to qualify my assessment in two ways, though:

1. I’m not a lawyer. I may have misread the complex document. I’m not intimately familiar with the current legislation, so I may have overlooked a situation where the negotiated text will throw out a freedom that we currently have (e.g., format shifting).
2. I haven’t spent a lot of time thinking about how specific technology might interact with the proposed treaty. For example, do I run foul of the Rights Management Information protections if I rip a CD and don’t add in title, composer, etc. information?

This treaty is going to need a lot of close examination from people who can read the legal language and yet who are intimately familiar with the possibilities and opportunities of technology. This is why negotiation in secret is a bad idea–our country won’t benefit from the knowledge of experts until the text is set in stone. We’ll get something that likely has flaws, but we’ll have to approve or reject it “warts and all”.

Computer Engineer Barbie, Digital Books and Your Rights, and A history of media technology scares, from the printing press to Facebook. The author of the latter writes the excellent Mind Hacks blog.

• Networking is important—often there are other groups doing similar things that are happy to piggy-back on projects or contribute resource. Before you start, understand your resource requirement and allow for growth, especially if updating/collecting info for the community. It’s easy to contact and update for 60 organisations, a lot harder for 3,000.
• Depth of relationship allows for more engagement and vulnerability.
• Keep raising the bar!
• “Personal” rewards from community involvement translates to professional reward and back again.
• Always have a back-up person—don’t be your own single point of failure.
• It can be important to reward people for participating in your online community.
• Go where your community already is, rather than expect them to come to a new ‘community’ that you just set up.
• Forums take 6+ months to establish momentum.
• Wikis suck.
• Comments at the bottom of pages of content fail to engage passive readers.
• Whatever you’re doing—whether it be in the online or offline world—you need to provide an “authentic” experience or voice for your audiences and community.
• You need strong reasons to make building a community worthwhile. It can take a lot of time and resource.
• I like the idea of incentives for users. e.g., points and rewards. For example, in our wiki originally we got a lot of new users to contribute through making the stats viewable. They could view numbers of changes made by users and a top 10. This lead to a competitive environment, especially with the boys. I had forgotten about that so am thinking how we can get that going again. Am interested in Shelley’s “submit a tag”, how that works. A problem we have is meaningless tags.
• I learned that preparation and planning should play a more important role than technology.
• Exposure to a wide range of online communities can teach us a lot about how people interact online.
• We had great success and learned a lot by piloting community interaction with small self-selected groups before trying to interface with the wider community. Benefits: tools are tested and tweaked; people from the pilot are great at kicking the wider community off.
• Be very proactive about responding to criticisms/suggestions by pointing out ways that the commenter/critic can get involved in doing something with their suggestion and solving their problem.
• Why? Social capital; information; value; connections. How? Authentically; where they already hang out; on their terms; multiple (appropriate) platforms. Who? By the community; for the community …
• Go to where your community are already hanging out to engage with them.
• Decentralise your community management by using your community.
• Who the customer is, what they want, what they need is key. Once the purpose is clear, that drives every other decision.
• Do you really need to do this? What will work best for your users? When will you stop if it isn’t working?
• Take-away: you need a community manager; build it and they won’t come!

Thanks to everyone who took the time to write down their advice!

1. First, I have to applaud the industry getting together to try and figure out how it can help the rest of NZ grow. The most exciting conversation at the short-lived Digital Development Council was when agriculture and manufacturing and other industries had an honest conversation with representatives of the ICT industry without being sidetracked into the failures or benefits of particular products or vendors.
2. Second, I applaud the idea that ICT can contribute to the lift in national economic performance that the government wants. Lately I’ve been thinking that there are three critical parts to NZ’s industries doing better: (1) make better use of ICT, (2) develop a global focus so our businesses don’t plateau once they get comfortable in the domestic market, (3) lift the skills of the people in leadership and management so that they can deliver on (1) and (2) without shitting on their feet as has happened all too often in the past. The report addresses (1) but I’d say that all three must be tackled together.
3. I don’t like the high-level generalities of the NZICT report. It’s their first report and in many ways is a stake in the ground to say “we’re here, we’re doing good things, we’re on the right side”. That would explain the vague parroting of political objectives (“step-change” is the new “sustainability”). The report is cannily aligned with political objectives (broadband, more efficient public sector, education, R&D) but many of the recommendations are little more than “we will work with you on what you’re already doing in these areas”. Government needs to be shown specific opportunities (e.g., “look to open source database alternatives in these situations”), and there are precious few specifics here.
4. And where there are specifics, they’re not great. For example:
   

   There  has  been  a  move  to  a  more  centralised  approach  to  Government  ICT strategy  managed  by  the Government Technology Services  group  within  the Department  of  Internal  Affairs. NZICT supports this centralised planning approach. It should clarify the strategic objectives of Government ICT spend, and enable consequent research and development opportunities for the industry to take. 

   NZICT proposes that the Government make an “Annual Statement of ICT Priorities”. This will enable transparency, certainty and direction of public sector ICT spending for all stakeholders involved. It will also encourage private sector investment, including research and development. This will stimulate ICT based innovation within the economy.

   Some problems with this: (1) annual is not a timeframe for strategic thought, it’s tactical; (2) annual is not a R&D timeframe, it’s a sales cycle; (3) it’s unclear that an annually-changing long-term strategy would provide any more certainty to investment than exists now; (4) the problem that this would solve isn’t clearly defined. This last failing is near-universal. Very few of the paper’s many recommendations come with a problem statement, and solutions to unknown or poorly-specified problems often turn out to be timebombs, turkeys, or turds.

5. I’m also aware that NZICT is an industry lobby group and as such its offers and advice should be taken with a grain of salt. New Zealand has precious few independent economic voices (New Zealand Institute has served admirably in the past), and NZICT is not one of them. “NZICT  will  establish  a  working  group  with  the Government Technology Services group of the Department of Internal Affairs to develop a programme for improving public sector ICT efficiency, including operational and process cost reduction to an agreed plan and targets” could be read by a cynic as “NZICT members will have privileged access to centralised government IT planners and buyers, bypassing or rendering moot a procurement process that attempts to provide a level playing field”.

So, like most things, it’s a mixed bag. I’d give them 6/10 for speaking with a single voice in such tight harmony with the government’s stated policies. There’s still work to be done in producing something that’s useful, rather than a positioning paper, but this is a promising first step from a new industry lobby group.