Internet Balkanization is here already, Mr. Schmidt.

In the technical community we like to say that the Internet is a network of networks, and that each network is independently operated and controlled. That may be true in some technical sense, but it far from the pragmatic truth.

Today’s New York Times contains an editorial that supports former Google CEO Eric Schmidt’s view that the Internet will balkanize into two – one centered around US/Western values and one around values of China, and indeed it goes farther, to state that there will be three large Internets, where Europe has its own center.

The fact is that this is the world in which we already live. It is well known that China already has its own Internet, in which all applications can be spied by the government. With the advent of the GDPR, those of us in Europe have been cut off from a number of non-European web sites because they refuse to comply with Europe’s privacy regulations. For example, I cannot read the Los Angeles Times from Switzerland. I get this lovely message:

Unfortunately, our website is currently unavailable in most European countries. We are engaged on the issue and committed to looking at options that support our full range of digital offerings to the EU market. We continue to identify technical compliance solutions that will provide all readers with our award-winning journalism.

And then there are other mini-Internets, such as that of Iran, in which they have attempted to establish their own borders, not only to preserve their culture, but also their security, at least in their view, thanks to such attacks as Stuxnet.

If China can make its own rules, and Europe can establish its own rules, and the U.S. has its own rules, and Iran has its own rules, can we really say that there is a single Internet today? And how many more Internets will there be tomorrow?

The trend is troubling.

We Internet geeks also like to highlight The Network Effect, in which the value of the network to each individual increases based on the number of network participants, an effect first observed with telephone networks. There is a risk that it can operate in reverse: each time the network bifurcates, its value to each participant decreases because of the loss of the participants who are now on separate networks.

Ironically, the capabilities found in China’s network may be very appealing to other countries such as Iran and Saudi Arabia, just as shared values around the needs of law enforcement had previously meant that a single set of lawful intercept capabilities exists in most telecommunications equipment. This latter example reflected shared societal values of the time.

If you believe that the Internet is a good thing on the whole, then a single Internet is therefore preferable to many bifurcated Internets. But that value is, at least for the moment, losing to the divergent views that we see reflected in the isolationist policies of the United States, the unilateral policies of Europe, BREXIT, and of course China. Unless and until the economic effects of the Reverse Network Effect are felt, there is no economic incentive for governments to change their direction.

But be careful. A new consensus may be forming that some might not like: a number of countries seemingly led by Australia are seeking ways to gain access to personal devices such as iPhones for purposes of law enforcement, with or without strong technical protections. Do you want to be on that Internet, and perhaps as importantly, will you have a choice? Perhaps there will eventually be one Internet, and we may not like it.

One thing is certain: At least for a while, won’t be reading the LA Times.

My views do not necessarily represent those of my employer.

* Artwork: By ProjectManhattan, CC BY-SA 4.0, https://commons.wikimedia.org/w/index.php?curid=39714913

Secret sauce and sentencing? Say it isn’t so!

Could you spend a long time in prison due to a software bug and not have the right to examine the software? Possibly.

One of the things that we in technology understand is that we make mistakes, a truth we don’t like to admit to customers. What happens, however, when a mistake can lead to tragic consequences?

Yesterday’s New York Times reports about a case that the U.S. Supreme Court may soon hear, involving a man who received a six year jail sentence, in part due to a computer program. The software known as Compas was supposedly developed by Northpointe Inc. (although a search seems to redirect to a Equivant) to provide a risk assessment of a person’s reentry into society. Such a data-driven analysis is vaguely reminiscent of the movie, Minority Report. In this case, the defendant Eric L. Loomis was not allowed to examine the software that assessed that he was a significant risk to the community, even though at least one analysis showed that the software may be programmed with some form of racial bias. The company argues that the algorithm used to make the sentencing recommendation is proprietary, and so should not be subject to review, and that if they release their algorithm to scrutiny they will essentially be giving away their business model, and they may have a point. Patents on such technology may be flimsy, and they eventually do come to a halt. To protect themselves, they make use of another legal tool, the trade secret, which has no fixed term of protection.

One can’t say that a mistake is being made in the case of Mr. Loomis, nor can one authoritatively state that the program is formally correct. The Wisconsin Supreme Court argued creatively that much like college admissions, so long as the software is one input combined with others, the software can be used. Is it, therefore, any different from a potentially flawed witness giving evidence? The question here is whether those who wrote the software can be cross-examined, to what extent they may be questioned, and whether the software itself can be examined. Mr. Loomis argues that to deny his legal team access to the source is a violation of his 14^th Amendment right to due process.

We know from recent experience that blind trust in technology, and more precisely, those who create and maintain it, can lead to bad outcomes. Take for instance the over 20,000 people whose convictions were overturned because a chemist falsified hair analysis results, or other examples where the FBI Crime Lab just flat got it wrong. Even Brad D. Schimel, the Wisconsin attorney general, conceded before the appeals court that, “The use of risk assessments by sentencing courts is a novel issue, which needs time for further percolation.” But what about Mr. Loomis and those who may suffer tainted results if there is a software problem?

While the Supreme Court could rule soon on the matter, they will only have very limited avenues, such as permitting or prohibiting its use. Congress may need to get involved in order to provide other alternatives. One possibility would be to provide the company some new intellectual property protection, such as an extended patent with additional means of enforcement (e.g., higher penalties against infringement or lower thresholds for discovery) in exchange for releasing the source. Even if they do, one question would be whether or not defendants could then game the system so as to score better on sentencing. How great a risk that is we can’t know without knowing what the inputs to the algorithm are.

It is probably not sufficient for the defendant and his legal teams to have access to the source, precisely because more research is needed in this field to validate the models that software like Compas uses. That can’t happen unless researchers have that access.

Removal of privacy protections harms service providers

Removing privacy protections harms consumer security AND service provider business prospects.

As the media is reporting, the administration has removed privacy protections for American consumers, the idea being that service providers would sell a consumer’s browsing history to those who are interested. Over time, service providers have looked for new and novel (if not ethical) ways to make money, and this has included such annoyances as so-called “supercookies”.

Why, then, would I claim that removing consumer privacy protections will harm not only consumers, but telecommunications companies as well?

In the new world that is coming at us, our laptops, cell phones, and tablets will be a minority of the devices that make use of our home Internet connection. The Internet of Things is coming, and will include garage door openers, security systems, baby monitors, stereos, refrigerators, hot water heaters, washing machines, dishwashers, light bulbs, and lots of other devices. Many of these systems have been shown to have vulnerabilities, and the consumer does not have the expertise to protect these devices. The natural organization to protect the consumer is the telco. They have the know-how and ability to scale to vast quantities of consumers, and they are in the path of many of communications, meaning that they are in a position to block unwanted traffic and malware.

The consumer, on the other hand, has to be willing to allow the service provider to protect them. Why would would consumers do that if they view the service provider as constantly wanting to invade their privacy? Rather it is important the these companies enjoy the confidence of consumers. Degrading that confidence in service providers, therefore, is to degrade security.

Some people say to me that consumers should have some choice to use service providers who afford privacy protections. Unfortunately, such contractual choices have thus far not materialized because of all the small print that such contracts always entail.

What is needed is a common understanding of how consumer information will be used, when it will be exposed, and what is protected. The protections that were in place went a long way in that direction. The latest moves reverse that direction and harm security.

Trump and Ryan’s healthcare failure doesn’t mean they will fail in the future

Just because President Trump and and Speaker Ryan lost the Healthcare battle doesn’t mean they’ll lose the coming tax overhaul battle.

Over the last twenty-four hours many people have been talking about who should take the “blame” for the failure of the Republican healthcare bill. Some say it is President Trump, others say it is Speaker Ryan, others say it is the so-called Freedom Caucus and yet others astonishingly others blame Democrats. They are all wrong.

It is the American people who did not want the Republican healthcare plan. According to at least one poll, only 18% of Americans wanted the bill to pass. Many of the rest of us were vocal in our opposition on the Internet, in town halls, writing letters, and calling our Congresspeople because the bill would directly affect us and those who we love.

The pundits are saying that the failure President Trump’s and Speaker Ryan’s plan will complicate their agenda, moving forward. They say this because the healthcare plan was supposed to pay for the massive tax overhaul that the president has in mind. These people who say these things are underestimating both the president and the speaker, and in particular Steve Bannon.

There are two forces in play. Speaker Ryan and many Republicans want to see the tax system overhauled. While Speaker Ryan would like to see overhaul come in revenue neutral, when push comes to shove, he will be willing to deficit spend in the short term, and make cuts later, with the logic being that the government has swam in red ink before, and a little more for a bit longer won’t hurt; and that Republicans will eventually stem the bleeding by simply forcing the issue.

Steve Bannon has a different logic. He would just assume see the government bleed to death. If destruction of the federal government is brought about faster due to the tax overhaul, that would be more than fine with him. Those same Republicans in Congress who nearly caused the government to default might play this game.

The reason this is likely to work is that the tax overhaul will be a gigantic give-away, and everyone will make money in the short term. Nobody will be screaming at Congressmen in town halls. Nobody will be worried about how this will hurt them personally.

It will be our children and theirs who pay for this policy.

Finding REAL News as Opposed to Fake News

Here are three simple tests to determine whether a site is a trustworthy news outlet. Are there multiple sections? Does it have multiple news bureaus? Does the site post corrections?

The great New York Senator Daniel Patrick Moynihan famously said that everyone is entitled to his own opinion, but not his own facts. Unfortunately, our democracy is being undermined by a combination of an epidemic of fake news and people being willing to believe the drivel.

What, then, are trustworthy news outlets? To start with, they have to have paid reporters. Determining the truth requires investigation with feet on the ground. It requires document searches, interviews, and research. That costs money.

Still, a well funded propaganda outfit could pay (or claim to pay) for “reporters”. How to tell the difference? Be suspicious of any site is primarily focused on national politics or any single issue.

Here are a three tests to guide someone as to whether a news outlet is likely legitimate for daily consumption. The tests themselves aren’t perfect, but they’re pretty good.

1. Does the outlet have many news bureaus?

A real newspaper will have at least one regional bureau for the region they are covering, and will often have an additional bureau for a state capital or for Washington. Fake news sources may not have any bureaus. A simple test is to type the name of the site and then “news bureaus” into a search engine and examine the results. Note that a regional paper will tend to have only a few bureaus outside their region. That’s okay, so long as they stick to news where they have those bureaus and more importantly reporters.

2. Does the outlet have multiple unrelated sections?

Real news sources will have sections such as weather, sports, obituaries, arts, finance, and region, as opposed to just politics. They may not have all of these sections: for instance, the Wall Street Journal doesn’t have a weather section, but their finance section is unparalleled.

3. Does the outlet ever publish corrections?

Even if the answer to the first two questions is “yes”, no one is perfect. But a good news outlet will recognize their imperfections and always seek to report the truth, no matter how embarrassing it may be. A good measure of an outlet’s trustworthiness is how regularly they correct themselves.

Let’s Test

Given these parameters let’s see whether a web site is a good source for news.

Source	Multiple Bureaus?	Unrelated Sections?	Corrections?
The New York Times	Multiple, throughout New York, US, and the world	NY region, sports, weather, obits, arts	Regularly at the bottom of an article online, or in a section in paper.
Fox News	Multiple affiliates	Sports, weather, numerous regions	Not too often.
Breitbart	Four bureaus	no	Very rarely
Wikipedia	No	Yes (vast)	Entries are continually edited
The Daily Caller	No	No	Never
NPR	Many regional affiliates along with international bureaus	Numerous	Regularly online and on radio
The Wall Street Journal	Strong presence in financial capitals	Finance, Travel, even some Sport	Regularly at the bottom of articles
Politico	Primarily national, with a few state and international bureaus	No	Very Rarely

Trust, of course, is not a binary. That’s why it’s important to get information from multiple sources, maybe not every day, but regularly. Also, just because something is not marked as a trustworthy news outlet doesn’t mean their lying. It does however, mean, that they’re something other than a trustworthy news outlet. A blog, perhaps, or an analysis site. Wikipedia is an interesting case because nobody gets paid, but the information tends to be reasonably trustworthy (or at least transparent).

All of this doesn’t get people off the hook from using their common sense. RT would easily pass the above tests, and yet they are a well known and well funded propaganda arm of Vladimir Putin. Probably not a good news source. Most blogs aren’t so well funded.