Showing posts with label censorship. Show all posts
Showing posts with label censorship. Show all posts

Thursday, March 05, 2009

The end of Surveillance State

For the last year and a half, I have published a blog over at CNET, focusing on security, privacy and technology policy. Well, as of March 4, that business relationship is now over.

As my regular readers will know, for the past few months, I have been hammering the Obama Administration for its close ties to Google/YouTube. Starting back in November of 2008, I called for the "separation of Google and State," and urged the then President-elect to find a more pro-privacy way to deliver his video messages.

Looking back through the posts I have published in the past few months, nearly every single one is focused on this issue. These include:

Why Obama should ditch YouTube
Dear Obama: Use BitTorrent for your Fireside podcasts
White House exempts YouTube from privacy rules
White House acts to limit YouTube cookie tracking
White House yanks 'YouTube' from privacy policy.

While this might seem like an insane obsession, I strongly believe that my writing helped to bring a significant amount of attention to this issue, and thus lead to real change. Consider the following:

  • In the first five days of the Obama Presidency, his web-team changed their privacy policy three times, addressing issues first highlighted on my blog.


  • Before Obama had even moved in the White House, his lawyers had written up a waiver for the YouTube cookie issue (although they still refuse to release it), addressing concerns that I had raised in November of 2008. YouTube was similarly used by several agencies during the Bush Administration, although no such waiver was felt to be necessary.


  • Within days of Obama's inauguration, his web-team rushed out a partial fix to the cookie issue for people who didn't click "play", and then shortly after, a link to the White House privacy policy was added below each embedded video on the White House Web site.


In the past six weeks, the White House web team has devoted a significant amount of time towards fixing privacy problems on the site. If the issue wasn't a priority for them when they started in late January, it certainly is now.

"The White House Dumps YouTube"

On Monday, I published a story documenting the fact that the White House had, with its latest weekly video address, opted to not use an embedded YouTube video on the official White House Web site.

The story set off a minor shit-storm in the blogosphere, which eventually lead to a New York Times story, and official denials by both the White House and YouTube.

Feeling the pressure, my editors at CNET rewrote the headline on my blog post, and then added a comment to the top stating that my story "significantly misconstrued the White House's policy on and use of YouTube."

The next day, I was notified that our business relationship had been terminated, and that CNET would no longer be requiring my blogging services.

Ouch.

Looking at the denials in depth

It is clear that Google (and to a lesser extent) the White House needed to issue denials, if just to save face. However, rather than addressing the specific statements in my blog post, they denied things that I never actually claimed.

Rather than actually comparing the denials to the text of my blog post, the media willingly published Google's spin-heavy version of the story.

In an effort to set the record straight, particularly with regard to CNET's statement that I "significantly misconstrued" the facts, consider the following:

Writing on the Google Policy Blog, Steve Grove wrote:

[Chris's] report is wrong. The White House decision does not mean that the White House has stopped using YouTube. The White House continues to post videos to its YouTube channel, as do other agencies like the U.S. Department of Education and the State Department.


However, my original story never claimed otherwise:

The White House is still posting copies of the videos to its official YouTube channel.


Likewise, consider the statements made by the White House to the New York Times:

Now the White House is denying that it has changed its policy on videos from YouTube, which is owned by Google, or other third parties. While it chose to host President Obama’s weekly radio and video address on WhiteHouse.gov, rather than embed a video from YouTube on its site, the change was simply an experiment, said Nick Shapiro, a White House spokesman.

“As the president continues his goal of making government more accessible and transparent, this week we tested a new way of presenting the president’s weekly address by using a player developed in-house,” Mr. Shapiro said in a statement. “This decision is more about better understanding our internal capabilities than it is a position on third-party solutions or a policy. The weekly address was also published in third-party video hosting communities and we will likely continue to embed videos from these services on WhiteHouse.gov in the future.”


Again, back to my original blog post:

It is unclear whether this switch away from YouTube marks a permanent shift in policy for the White House, or whether the Oval Office geek squad is merely testing an alternate video provider. While the latest video is served using Akamai's servers, the older videos remain as embedded YouTube files.


Looking back

While CNET goes to great lengths to state that the people writing in its Blog Network are not CNET employees, that detail often gets lost on members of the public. As a result, when I would blog something, it would be written up by other media outlets as "CNET reported that."

As an activist, this gives you a very powerful tool, since you effectively get to speak with the voice of the mainstream media. My blog gave me a soapbox which hugely amplified my voice, and permitted me to pillory companies and the government whenever I thought they were doing something they shouldn't.

In several cases, I was able to use the CNET blog to significantly shape the public debate on various issues -- such as with Google's so called "anonymization" of search log data, TSA's policies towards flying with no ID and the disclosure of identifying customer information by Internet Service Providers.

I suppose that what surprises me the most is that CNET let me editorialize on their site and with their brand for as long as they did.

Moving on

While I am clearly a bit sad about the loss of my soapbox, there is probably a silver lining in this. I am a PhD student in my third year, and I really need to start working on my dissertation soon. Blogging, even once or twice a week, takes a significant amount of time, at least when you are trying to write detailed and original analysis. It'll be nice to be able to refocus those 10 hours a week or so back on my studies.

It's likely that I'll still blog here once and a while, but now that I'm no longer contractually obligated nor paid to do so, it is likely that I'll be writing far less frequently.

Those of you who had subscribed to the CNET RSS, please re-subscribe here. And those PR hacks who keep pitching stories in the hope that I'll post your press release to CNET, please stop.

Wednesday, February 07, 2007

Un-SAFE Behavior

Update:

Source code pulled until I chat with a couple legal minds. It's only 15 lines of perl, so it's not too tricky to create.

----


DISCLAIMER: I do not support child porn. I think it's sick, twisted, and should not be tolerated in our society.

However, I think that government surveilance and censorship are even more evil. I do not want to make life easier for child pornographers - but the threat of feature creep in anti-child porn systems is far too dangerous. One day it targets child porn, the next week it targets images of Mohammad (P.B.U.H.), and the week after, copies of the Anarchist Cookbook. No thank you.

----

Declan reports that Senators McCain and Schumer have proposed the SAFE act, which would create a national database of child porn images - or I'm guessing, simply require that the FBI make their own database public. ISPs would be given access to this database, and would be required to screen traffic and alert the authorities of any user who transmits/hosts an image that matches a fingerprint in this database.

For obvious reasons, they aren't going to give ISPs access to an actual database containing child porn. Thus, they're most likely going to give them a list of hashes of known child porn. The ISP's will then have to compare all sent/received attachments in emails and hosted files to this database of hashes. If they get a positive match, the ISP will be required to tell the G-Men.

I'm against this kind of thing for so many reasons. I don't want my ISP monitoring the traffic that passes through their network. I don't transmit any child porn, but this sets a very bad precident. Once the infrastructure is in place for them to compare hashes of child porn, it won't be too difficult for them to start comparing hashes of music, copies of dissident literature, photographs of dead soldiers in Iraq, anti-Scientology documentation, or anything else that someone with their hand in a Senator's pocket doesn't like.

Moreover, this law would also covers obscene images of minors including ones in a "drawing, cartoon, sculpture, or painting." (The language warns that it is not necessary "that the minor depicted actually exist.") This is not a good thing.

Lets get technical now...

MD5/SHA1 hashes are a very very bad way to compare images. If one single pixel in the image changes, the fingerprint completely changes.

There are significantly better methods to compare images to see if they are the same - which can withstand resizing, any number of slight modifications in Photoshop, or the modification of a few pixels - the problem with these, is that they are slow. If an ISP is going to run a comparison against every image that crosses its network, it needs to be super fast - which is why they'll probably end up using MD5/SHA1.

To combat against this evil intrusion into our private Internet behavior, I now introduce 'broken glass'. Apologies for the shoddiness of my code. This has been whipped up in a few minutes.

It is a perl script that when given an image file, will change 1 pixel's red component by +/- 1. It's not enough for the human eye to see, but it will make the MD5/SHA1 hash fingerprint of the image be completely different.

The perl script can be downloaded: *Removed*

It was developed on a Linux Ubuntu system. You may need to install imlib's perl bindings. On ubuntu, this can be done by issuing the following command:

apt-get install libimage-imlib2-perl


Just in case my server falls over, I'm including the relatively short source code here too:

#!/usr/bin/perl

# Chris Soghoian
# Feb 7, 2007.
# Licenced under the GPL. Find it via Google.

# Broken glass
# v. 0.1
# Modify a one pixel of an image by +/- 1 of its R (of RGB values).
# This will break any MD5/SHA1 comparison of images.


*EDITED*