A Privacy Threat Model for The People of Seattle

Some of us in the Seattle Privacy Coalition have been talking about creating a model of a day in the life of a citizen or resident in Seattle, and the way data is collected and used; that is the potential threats to their privacy. In a typical approach, we focus on a system that we’re building, analyzing or testing. In this model, I think we need to focus on the people, the ‘data subjects.’

I also want to get away from the one by one issues, and help us look at the problems we face more holistically.

Feds Sue Seattle over FBI Surveillance

The general approach I use to threat model is based on 4 questions:

  1. What are you working on? (building, deploying, breaking, etc)
  2. What can go wrong?
  3. What are you going to do about it?
  4. Did you do a good job?

I think that we can address the first by building a model of a day, and driving into specifics in each area. For example, get up, check the internet, go to work (by bus, by car, by bike, walking), have a meal out…

One question that we’ll probably have to work on is how to address what can go wrong in a model this general? Usually I threat model specific systems or technologies where the answers are more crisp. Perhaps a way to break it out would be:

  1. What is a Seattlite’s day?
  2. What data is collected, how, and by whom? What models can we create to help us understand? Is there a good balance between specificity and generality?
  3. What can go wrong? (There are interesting variations in the answer based on who the data is about)
  4. What could we do about it? (The answers here vary based on who’s collecting the data.)
  5. Did we do a good job?

My main goal is to come away from the exercise with a useful model of the privacy threats to Seattleites. If we can, I’d also like to understand how well this “flipped” approach works.

[As I’ve discussed this, there’s a lot of interest in what comes out and what it means, but I don’t expect that to be the main focus of discussion on Saturday. For example,] There are also policy questions like, “as the city takes action to collect data, how does that interact with its official goal to be a welcoming city?” I suspect that the answer is ‘not very well,’ and that there’s an opportunity for collaboration here across the political spectrum. Those who want to run a ‘welcoming city’ and those who distrust government data collection can all ask how Seattle’s new privacy program will help us.

In any event, a bunch of us will be getting together at the Delridge Library this Saturday, May 13, at 1PM to discuss for about 2 hours, and anyone interested is welcome to join us. We’ll just need two forms of ID and your consent to our outrageous terms of service. (Just kidding. We do not check ID, and I simply ask that you show up with a goal of respectful collaboration, and a belief that everyone else is there with the same good intent.)

Rogue One: The Best Star Wars Yet?

NewImageSomeone once asked me why I like Star Wars more than Star Trek. I was a bit taken aback, and he assumed that since I use it so much, I obviously prefer it. The real reason I use Star Wars is not that it’s better, but that there’s a small canon, and I don’t have to interrupt the flow of a talk to explain the scene where Darth Vader is strangling someone. But let’s face it, Star Trek was often better as science fiction. There are four or five bright lights that rank up there as some of the very best storytelling of the last few decades.

Trek at its most poignant was a transparent mirror to the world. The original series commented on Vietnam and race repeatedly in ways which let people see another way of looking at a situation. Moral nuance is easier to see when the ox being gored isn’t yours.

Rogue One is the first Star Wars with moral complexity. If you haven’t seen it, I find your lack of faith…disturbing. But when there’s a guy who cost you your limbs, your children, and threw the galaxy into civil war, throwing him in the reactor core isn’t a very complex choice. In fact, the whole “dark side” is a bit of a giveaway. In case you miss that, the Jedi were guardians of peace and justice throughout the galaxy. Are we clear yet? No? How about the Nazi uniforms? I could go on, but we’re gonna get to spoilers. My point is, the first four films were great action movies. Maybe we’ll see some moral complexity when someone finally gets around to filming the tragic fall of Anakin Skywalker, reputedly the core story of I-III. But I’m betting they’ll be action movies with talking teddy bears for the kids.

Speaking of morality, if you’re just now noticing that your political world resembles the Empire’s, or if you’re angry that the script seems to mock your party…maybe you should look at your world through that mirror and ask if you’re on the right side of morality or history. After all, that’s what makes for great science fiction. The opportunity to see the world through a new lens. And the fact is, the story was not substantially re-written. “Rogue One’s Discarded Dialog” and See 46 shots that were cut from Rogue One” show a story with a little less character, a little more army, but not a sympathetic, racially and species-diverse Empire. The movie wasn’t re-written as a commentary on 2016.

Structurally, Rogue One is a war story, not an action story. It’s not about the hero’s journey, or Luke growing up. It’s a story about the chaos that follows a civil war, and it’s messy and has characters who make choices from a set of bad options.

When Cassian shoots the fellow so he can escape at the start? Galen Erso’s decision to work on the Death Star, delay it, and insert a flaw (or two?) These are perhaps the wrong choices in bad situations. We don’t see why Saw Gerrera and the Rebel Alliance split. We see the Rebellion at its worst — unable to take action in the face of imminent destruction, and then impulsively chasing Rogue One into battle. (What Rogue One Teaches Us About the Rebel Alliance’s Military Chops is a great dissection of this.)

But we can look to Galen Erso’s decision to work on the Death Star, and have a conversation about what he should have done. Gone to a labor camp and let someone else build it with a better reactor core? What if that someone else had put more shielding over the thermal exhaust ports? (Speaking of which, don’t miss “The Death Star Architect Speaks Out,” and perhaps even my commentary, “Governance Lessons from the Death Star Architect.” I think the governance questions are even more interesting now, if the Empire were to conduct a blameless post mortem, but we know they don’t.) We can use that decision to talk, abstractly, about taking a job in the Trump Administration with less of the horrible emotional weight that that carries.

That mirror on the world is what great science fiction offers us, and that’s what makes Rouge One the best Star Wars yet.

Electoral Chaos

[Dec 15: Note that there are 4 updates to the post with additional links after writing.]

The Green Party is driving a set of recounts that might change the outcome in one or more swing states. Simultaneously, there is a growing movement to ask the Electoral College to choose a candidate other than Donald Trump to be the next President of the United States. Some surprisingly serious people are publicly making arguments for the Electoral College taking an active role, including law professors Sandy Levinson and Lawrence Lessig. Lessig’s essay at the Washington Post starts:

Conventional wisdom tells us that the electoral college requires that the person who lost the popular vote this year must nonetheless become our president. That view is an insult to our framers. It is compelled by nothing in our Constitution. It should be rejected by anyone with any understanding of our democratic traditions  — most important, the electors themselves. (“The Constitution lets the electoral college choose the winner. They should choose Clinton,” Lawrence Lessig)

Lessig’s piece links to Federalist #68, written by the newly popular Hamilton. Having the electoral college not vote for Trump, after Clinton conceded, and after the current President met with him, seems problematic at best. Trump promised to respect the results if he was elected, but yesterday tweeted claims that “millions” had voted illegally, which might lead one to expect that some had voted illegally for him, adding legitimacy to a recount or re-evaluation of results.

A Electoral College outcome other than Trump will be labeled a “stolen election,” and there have already been threats of violence by surprisingly serious people. Some of those who might engage in violence are already are engaged in disgraceful and un-American attacks on their fellow citizens based on race, creed, color, gender, or sexual orientation. They seem to treat the election as a “great disinhibition.” However, as horrifiying as those attacks are, and as many as there are, there are people who would not engage in such attacks but would call the election stolen. That would further undercut the legitimacy of the Federal government. (Chaos and legitimacy is topic that’s been occupying my thoughts for a while, but I have relatively little to say which is new.)

My take: the Electoral College exists for a reason. (See the above-linked Federalist #68). The best choice from a very bad set of possibilities is a “caretaker” government. The country is roughly evenly divided in hating either Clinton, Trump, or both. We should select a President who will not push for large changes or mess things up, and can start to address the real class issues which were exposed by the election. A middle of the road Republican and Democrat might be less unpalatable than other options.

Some relevant and interesting links:

Please keep comments civil. Additional interesting links are welcome.

[Update Dec 2: This is a thoughtful, left-wing consideration of the election, which makes the point that no single explanation is dominant. “Everything mattered: lessons from 2016’s bizarre presidential election.” Also, seven electors are now looking to strike a deal: “Teen becomes seventh ‘faithless elector’ to protest Trump as president-elect.” By the way, there’s probably an interesting story in how a 19 year old becomes a member of the Electoral College. Lastly, the Economist has an article on “Why an electoral college rebellion would be a bad idea.”]

[Update Dec 8: “Dump the electoral college? Bad idea, says Al Gore’s former campaign chairman.,” which includes the argument “it forces candidates to campaign in a variety of closely contested races, where political debate is typically robust.” Despite that, Texas Republican Elector Christopher Suprun has written “Why I Will Not Cast My Electoral Vote for Donald Trump.”]

[Update Dec 12: Videos: from one of the Hamilton Electors, Tucker Carlson vs. 2 Electors. “Electors demand intelligence briefing before Electoral College vote.”]

[Update Dec 15: “Virginia congressman calls for delay in electoral college vote,” and the open letter “Bipartisan Electors Ask James Clapper: Release Facts on Outside Interference in U.S. Election” now has over 50 signatures, and NBC is reporting that “Putin Personally Involved in U.S. Election Hack,” and that has to play into questions about legitimacy and the choice of Electors.]

Happy Independence Day!

Since 2005, this blog has had a holiday tradition of posting “The unanimous Declaration of the thirteen united States of America.” Never in our wildest, most chaotic dreams, did we imagine that the British would one day quote these opening words:

When in the Course of human events, it becomes necessary for one people to dissolve the political bands which have connected them with another, and to assume among the powers of the earth, the separate and equal station to which the Laws of Nature and of Nature’s God entitle them, a decent respect to the opinions of mankind requires that they should declare the causes which impel them to the separation. [Ed: That article is jargon-laden, and interesting if you can wade past it.]

So, while it may be chaotic in the most negative of senses, there’d be some succor should we see a succinct success as England secedes from the United Kingdom. Of course, London, West-Virginia-style, secedes from said secession. Obviously, after this, the United Kingdom of Scotland, Northern Ireland and London should remain a part of the EU, dramatically simplifying the negotiation.

Or, perhaps, in light of the many British who were apparently confused about the idea that Leave meant Leave, or the 2% margin of the vote, it would be reasonable and democratic to hold another election to consider what should happen. A problem with democracy is often that a majority, however slim, votes in a way that impacts the rights of a minority, and, whilst we’re waxing philosophic, we would worry were the rights of that minority so dramatically impacted as the result of a non-binding vote. Perhaps a better structure to reduce chaos in the future is two votes, each tied to some super-majority. A first to negotiate, and a second to approve the result.

It doesn’t seem like so revolutionary an idea.

Chaos and Legitimacy

At BruCon 0x06, I was awoken from a nap to the sound of canons, and looked out my window to see soldiers marching through the streets. It turns out they were celebrating the 200th anniversary of the Treaty of Ghent. As I’m sure you’ll recall from history class Wikipedia, the Treaty of Ghent ended the war of 1812, and was the second war between Great Britain and the less Canadian parts of its North American colonies.

Treaty of Ghent Anniversary Celebration

Lately, I’ve been thinking a lot about that and what it tells us about Iraq, ISIS and more recently, Ferguson, and I want to write some of it down to see if it makes sense.

Much of our policy in Iraq and Afghanistan seems to operate on a model of history which goes something like this: after the revolutionary war, town meetings coalesced into the Constitution, and we all lived democratically ever after. It’s an ahistorical view that forgets the Articles of Confederation, the Whiskey Rebellion, Shays Rebellion, and what some in the American south still call “the War of Northern Aggression.” It takes time to develop the institutions of a functioning democratic society.

Is it any surprise that after years of dictatorships, torture of dissidents, children growing up under sanctions (in the case of Iraq), occupation, and civil war, the people of Iraq are not using democracy to solve their problems? That they fight over how to run their country?

While each has a unique history and set of circumstances, it appears to me that there is, across Afghanistan, Iraq, Syria, a crisis of legitimacy. The people who live in those areas have disagreements about not only who should lead them, or what policies should be in place, but about the process for selecting their leaders or governments, and the powers those governments should have.

Their disagreements are strong enough that many people are willing to take up arms rather than acquiesce to other visions. Our understanding of these disagreements is muddied by use of terms like “militia”, “the legitimate security forces” or “the so-called Islamic State.”

The Islamic State, with territory, an army, and a currency, is in many ways, no more or no less legitimate than the army and currency of Prince Assad of Syria. (He is a prince in all but name, having inherited power from his father, that literal inheritance of power being the defining feature of princes.) Assad has taken the step of staging a Potemkin village election, because he understands that legitimacy (rather than power) comes from the consent and agreement of the governed.

This is why Churchill said that democracy is the worst form of government, save all those others that have been tried. No one really thinks that asking a bunch of people who can’t be bothered to vote who should lead them is a great way to get the best people into government. But democracy is a unique way to give people a voice, and in that voice, get their consent. The form democracy, that everyone has a voice, is what gives it its legitimacy. Another way to say that is it’s the ballot or the bullet. (If you haven’t listened to Malcom X give that speech, it’s really an outstanding use of your time. Ballot or Bullet Part I, Ballot or Bullet Part II. In two parts from 100 American Speeches, not sure why it’s two-parted.)

Developing legitimacy requires both institutions and time. The institutions must show that they are reliably better than other choices, or people will pursue those other choices. When Federal grand juries return indictments in 162,000 out of 162,011 cases brought to them, it is reasonable to question if they are a worthwhile or trustworthy institution, or act simply as an instrument of power. From that same 538 Story, grand juries in Dallas reviewed 81 shootings by officers, and returns a single indictment. It is easy to think something is out of whack.

What I think I see in Ferguson is that the institutions of justice have failed, again and again. They didn’t just fail when Darren Wilson shot Michael Brown. Police officers can and will make bad decisions. But afterwards, they continued to fail. The medical examiner didn’t take photos because the battery in his camera died. The prosecutor led Darren Wilson’s testimony.
The institutions didn’t just failed in the moment, they couldn’t be made to work under an intense spotlight. The figures about grand jury indictments indicate that they system is failing victims of police violence. (Although Law Proffesor Paul Cassell makes a case that the grand jury did the right thing, and Wilson had a strong self-defense claim.) However, the institutions didn’t fail completely. A grand jury met, its activity was transcribed and the transcript was released. These elements of transparency allow us to judge the system, and find it wanting. But even while wanting, it’s better than judgement in the ‘court of public opinion,’ and its better than mob justice or lynchings.

These failures may lead reasonable people to ask what alternatives to violence exist? It may lead people to think that violence or destruction is their best option. Perhaps the democratic bargain as a whole is no longer sufficiently legitimate to the people protesting or even rioting in Ferguson. To be clear, I don’t think that the violence or property destruction will improve their lives. In fact I believe that violence and property destruction will make their lives worse. I also think that the people rioting, if they would sit down and talk it through might even agree that burning their own community won’t help. But they’re living in a system where things are more arrest warrants than people.

The chaos in Ferguson, like the chaos in Boston in 1776, like the chaos in Iraq, like the chaos in Syria, may be stopped, for a time, by more violence. But violence will not correct the underlying issues of legitimacy.

(There’s a whole related history of the use of offices to enrich office-holders, including the sale of military commissions, the sale of tax collection jobs, etc. I think that’s too complex for me to work into a single blog post. But briefly, the idea that positions were held as a public trust was an important development. We’ve lost it to the idea that because
officials will sometimes act in their own interest, we should only expect them to act that way. In no longer holding people to an ideal, we’re losing something.)

Emergent Chaos: Romney/Ryan for America!

We here at Emergent Chaos have long been frustrated with the Obama Administration. Their failure to close Guantanamo, their failure to prosecute war crimes including torture, their choice to murder American citizens (never mind without due process), their invocation of the state secrets privilege, their persecution of whistleblowers, their TSA running rampant, the list of disappointments runs long.

But we’ve been waiting to see real evidence of a decisive and predictable leadership style from Mitt. We’ve been waiting for a real and demonstrated commitment to civil liberties. Now, with the combination of Paul Ryan and Clint Eastwood, we think he’s over the top.

We know that a vote for Romney/Ryan may leave many folks wondering what they’re voting for. Are they voting for mandatory health care for all that Romney passed in Massachusetts, leading the state to legalize gay marriage or are they voting for the Romney who rails against his plan being taken national with Obamacare? Or are they voting to put Ryan and his voucher-ization of Medicaid one heartbeat away from the Presidency? It’s rare that we see this kind of chaos emerge at the top of a ticket.

Chaos like that is close to our hearts, and four years ago, that was enough to win us over.

But stakes are higher today, and we’ve seen a scary degree of staying on the latest message from Mitt and his advisors. So we needed a high-stakes decision, one taken at a moment of obvious gravity and impact, one taken at the very top, to really help us judge if the velvet glove has forged Willard Mitt Romney into the sort of man we want commanding the most powerful military ever seen on the planet.

Romney decided he wanted a surprise at the convention, and chose Clint Eastwood. Now, as a rock-ribbed, gun-totin’, pro-abortion, pro-gay-marriage, pro-ERA Republican, we think he’s the sort of libertarian Republican who should be making the attendees’ days. He’s the sort of Republican who should be addressing the convention, hearkening back to the big-tent party that Ronald Reagan led.

But, traditional thinking in politics has become that conventions are tightly managed. That’s why RNC Chairman Reince Priebus changed the rules on the convention floor to lock out Ron Paul’s delegates. He wanted to show that the GOP stands fast in its commitment to the rule of law and the importance of democracy, not running a convention where anyone who just happened to have committed delagates can show up and hope to win their party’s nomination.

That’s the sort of strategic thinking that led Romney’s most senior advisors to not ask Clint for a rehersal. And, apparently, their commitment to free speech led them to just toss him a list of talking points and not worry about it. (No, really, go read it, and consider what it means about decision making.) And that’s the sort of emergent chaos that we can’t help but nervously endorse.

So months from now, if you want chaos in the financial markets or chaos on the international stage like we saw chaos on the convention stage, the choice is clear. If Romney/Ryan can let chaos like that into their moment to shine, just think about the chaos that will happen when they’re blindsided. So if you want more leadership like that, if you want to live in interesting times, vote Romney/Ryan. We’re not sure what we’ll get, but we’re confident it will be exciting.

It's a Lie: Seattle Taxpayers Will Pay for a Staduim

The Seattle Times carries a press release: “Arena plan as solid as it looks?

The intricate plan offered for an NBA and NHL arena in Sodo hinges on the untested strategy of building a city-owned, self-supporting arena, without the aid of new taxes, and with team owners — not taxpayers — obligated to absorb any losses.

This not only a lie, it is a blatant lie, contradicted by statements later in the article:

…Seattle and King County would finance $200 million — likely in bonds — to cover construction costs. The city would recoup its money through lease payments and the taxes on everything from tickets to concessions from the arena.

Let me translate that into plain English. The taxpayers of Seattle and King County would sign a bond. We’d be obligated to pay it back if or when the Supersonics new team leaves town. Also, let me comment that the use of “would” is inaccurate. The word that the writers sought and were unable to come up with is “might”, as in: “the city might recoup its money…”

One more quote:

It’s hard to argue against the idea of an arena that pays for itself.

It’s even harder to guarantee it, though.

Actually, it’s easy to guarantee that the arena pays for itself, or at least that the taxpayers don’t pay for it. The builders finance the arena. See how easy that is? They issue the bonds, they reap the profits. Then the people of Seattle and King county are guaranteed to not be on the hook.

Pretty simple, if the Seattle Times would stop relaying lies about who’s on the hook for bonds issued by Seattle or King County.

Look, while I’m opposed to having to sit in traffic for yet more sporting events, I shouldn’t have a say in how these folks spend their money. The arena backers should feel free to spend their money, plus as much as anyone will loan them, to build a stadium, buy a team, or hold a parade. That’s what freedom is about. But the people of Seattle should not carry any of the risk. The money should be entirely private.

Maybe the plan can’t work without Seattle bearing some of the risk. If that’s the case, that’s because this isn’t the sure thing that its backers want us to think. It means that the bankers see this as a risky thing, and want to transfer that risk to some sucker. I don’t want to be the sucker who’s paying for a failed deal. Do you?

The Pre-K underground?

Not my headline, but the New York Times:

Beyond the effort was the challenge of getting different families to work together. When matters as personal as education, values and children are at stake, intense emotions are sure to follow, whether the issue is snacks (organic or not?), paint (machine washable?) or what religious holidays, if any, to acknowledge. Oh, and in many cases, forming a co-op school is illegal, because getting the required permits and passing background checks can be so prohibitively expensive and time-consuming that most co-ops simply don’t. (“The Pre-K Underground“, The New York Times, December 16)

Read the whole thing, and then give some thought to how effectively those policies, combined with the drug war, are de-legitimizing governments, and convincing people that to live their lives involves avoiding government rules. Eventually, even legitimate and necessary functions of government like courts will fall apart.

Think I’m exaggerating?

“There’s a fairly stringent code and byzantine process for getting certified and code-compliant,” said City Councilman Brad Lander, a Democrat from Brooklyn, whose office held a meeting over the summer for any co-ops interested in pooling their resources and securing permits. “Some are genuinely for the safety of kids, and some are more debatable.”

There’s a city councilman driving doubt over the system. What does that do to the legitimacy? What happens to the social contract?

Will the war on coop kindergardens join the war on drugs?

What's Wrong and What To Do About It?

Pike floyd
Let me start with an extended quote from “Why I Feel Bad for the Pepper-Spraying Policeman, Lt. John Pike“:

They are described in one July 2011 paper by sociologist Patrick Gillham called, “Securitizing America.” During the 1960s, police used what was called “escalated force” to stop protesters.

“Police sought to maintain law and order often trampling on protesters’ First Amendment rights, and frequently resorted to mass and unprovoked arrests and the overwhelming and indiscriminate use of force,” Gillham writes and TV footage from the time attests. This was the water cannon stage of police response to protest.

But by the 1970s, that version of crowd control had given rise to all sorts of problems and various departments went in “search for an alternative approach.” What they landed on was a paradigm called “negotiated management.” Police forces, by and large, cooperated with protesters who were willing to give major concessions on when and where they’d march or demonstrate. “Police used as little force as necessary to protect people and property and used arrests only symbolically at the request of activists or as a last resort and only against those breaking the law,” Gillham writes.

That relatively cozy relationship between police and protesters was an uneasy compromise that was often tested by small groups of “transgressive” protesters who refused to cooperate with authorities. They often used decentralized leadership structures that were difficult to infiltrate, co-opt, or even talk with. Still, they seemed like small potatoes.

Then came the massive and much-disputed 1999 WTO protests. Negotiated management was seen to have totally failed and it cost the police chief his job and helped knock the mayor from office. “It can be reasonably argued that these protests, and the experiences of the Seattle Police Department in trying to manage them, have had a more profound effect on modern policing than any other single event prior to 9/11,” former Chicago police officer and Western Illinois professor Todd Lough argued.

Former Seattle police chief Norm Stamper gives his perspective in “Paramilitary Policing From Seattle to Occupy Wall Street“:

“We have to clear the intersection,” said the field commander. “We have to clear the intersection,” the operations commander agreed, from his bunker in the Public Safety Building. Standing alone on the edge of the crowd, I, the chief of police, said to myself, “We have to clear the intersection.”

Why?

Because of all the what-ifs. What if a fire breaks out in the Sheraton across the street? What if a woman goes into labor on the seventeenth floor of the hotel? What if a heart patient goes into cardiac arrest in the high-rise on the corner? What if there’s a stabbing, a shooting, a serious-injury traffic accident? How would an aid car, fire engine or police cruiser get through that sea of people? The cop in me supported the decision to clear the intersection. But the chief in me should have vetoed it. And he certainly should have forbidden the indiscriminate use of tear gas to accomplish it, no matter how many warnings we barked through the bullhorn.

My support for a militaristic solution caused all hell to break loose. Rocks, bottles and newspaper racks went flying. Windows were smashed, stores were looted, fires lighted; and more gas filled the streets, with some cops clearly overreacting, escalating and prolonging the conflict. The “Battle in Seattle,” as the WTO protests and their aftermath came to be known, was a huge setback—for the protesters, my cops, the community.

Product reviews on Amazon for the Defense Technology 56895 MK-9 Stream pepper spray are funny, as is the Pepper Spraying Cop Tumblr feed.

But we have a real problem here. It’s not the pepper spray that makes me want to cry, it’s how mutually-reinforcing up a set of interlocking systems have become. It’s the police thinking they can arrest peaceful people for protesting, or for taking video of them It’s a court system that’s turned “deference” into a spineless art, even when it’s Supreme Court justices getting shoved aside in their role as legal observers. It’s a political system where we can’t even agree to ban the TSA, or work out a non-arbitrary deal on cutting spending. It’s a set of corporatist best practices that allow the system to keep on churning along despite widespread revulsion.

So what do we do about it? Civil comments welcome. Venting welcome. Just keep it civil with respect to other commenters.

Image: Pike Floyd, by Kosso K