Notes—Security and Privacy on the Internet

This breakout session focused on a) use cases in which secure data transmission is important and b) tools that are currently available to NGOs. After Sunil offered the group two cases, we discussed a number of questions and comments related to technologies (encryption) and secure practices/tactics.

We also discussed the opportunities and limitations of operating blogs within repressive societies: platform for outing negative behavior, risks associated with publishing such content, and the risks associated with hosting critical comments on your blog.

Full notes captured by Ben M:

Privacy and Security. Sunil tells two stories:

1. Malaysian blogger, Jeff (actually became a politician in the last election). In Malaysia, revealing information about environmental issues or corruption can land you in jail. Jeff has a network of informants to help him report on all issues. Jeff couldn’t authenticate this, however. So they started using GPG (open source information of PGP), asynchronronous authentication.

2. Human rights organizations in Burma maintain databases of violations. In Burma, if they find encrypted files on your computer they’ll beat you until you reveal the key. There’s a software package that allows you to hit a button to erase the database if an arrest is imminent.

Questions/Discussion:

Q: How well does Tor work in places like Burma?
A: Tor and Psyphon are two schemes for anonymmization . Every time you communicate with the internet, it’s encrypted in the browser (via plugin) and through a different proxy Tor server. So it’s client-server setup. Psyphon is a p2p alternative. But you need a peer somewhere else, and you’re at the mercy of the peer. You also put the benevolent peer at risk because they take over liability.

The downside with Tor is that it’s very, very slow. So the way to get around this is to disable Tor when you’re doing something non-sensistive. Another problem is that you can detect encrypted traffic (https:) and they’ll come knocking on your door.

Comment: at some point you’re just getting down to steganography.

Comment: tactics are more important than technology for grassroots organizations.

Comment: Burma censorship powered out of California corporation.

Comment: the biggest constituency of this stuff is pirates.

Comment: the Pirate Bay doesn’t even know where its servers are. Nick notes new efforts to open torrent trackers.

Comment: the problem with the Internet is jurisdiction.

Comment: Iranian customs checks your Facebook page to find out who your friends are.

Comment: HuffPo automatically filters criticism of Huffington.

Sunil: this reminds me of an NGO in Thailand that runs a blog. If someone comments on the blog and is slandering the king, the blog is liable. Now people are building commenting engines that are remote-hosted RSS feeds.

Tap: you could just create a botnet that just generates nonstop comments criticizing the king on every blog!

Conversation starter: Encryption can be really empowering from an individual perspective, but also very dangerous.

Notes from mapping break out session

•  Interests of people there:  Free culture Pt;  adapting maps so people can add information themselves; social entrepreneurship projects; mapping for activism – E. Timor, coop locations, etc.; environmental activism; artists working in maps; municipal govn. Desiring better local information;  connecting nat’l participants with local activists. 

•  How online mapping systems work:  openstreetmaps.org

o   There’s a Canvas; 24 tiles, open street maps
o   Hosting is very expensive
o   (comparisons with google maps – more detail.  Anyone can use google maps maker but downloading them for re-use is illegal).
o   Use vector data to locate coordinates and map beginning and end of an object.  Wiki.openstrteetmap.org
o   Use online or offline editor to edit maps, then enter data, system will render data (every 2 days)
o   Can download from open street maps from cellphone.  Geographic, routing, can add this sort of info. 
o   Don’t have easy way to add data – but do have “open layers” to create open layers on top of open street map.  ExAMPLES:  can add images to open street maps (analog to pin dots).  Still all vector based.  (openlayers.org)

•  Examples: 
o   Gallery.openlayers.org – lots of examples. 
o   “heat” maps where crimes have occurred.   
o   Disaster preparedness – what is mapped? 
o   Ex. Of open source activity (from red hat);
o   “walking-papers.org” – capacity building without GPS devices – annotate by hand! (not perfect data but easy).  Online editor for maps is called “Potlatch”.  Collaborative mapping of areas in Gaza that have been bombed – lots of people using handheld GPS. 
o   Brainoff technology – another mapping facility.

•  Annual conference – Copenhagen, recently.  Use car GPS devices and map them and then share data.  GPS devices sometimes illegal (Cuba; were illegal until recently in Egypt). 

•  Can go back in history and see history of map – just like wiki. 

Comment on how forms of authority deal with data from certain places – favela data dealt with differently by city government in Rio than data from other areas.

Useful Links from InformationDesign Software Opensource&More; break out session

http://www.data.gov/

http://flowingdata.com/

http://oakland.crimespotting.org

http://www.flickr.com/groups/geotagging/pool/map?mode=group

http://senseable.mit.edu/nyte/

http://eagereyes.org/

http://www.informationdesign.org/archives/cat_information_design.php

http://www.visualcomplexity.com/vc/

http://benfry.com/

http://www.tate.org.uk/intermediaart/entry15385.shtm

OpenSource Software Tools:

www.processing.org

http://vue.tufts.edu/

Inclusive Design

Things that exclude:
*Physical Barriers
**sound/video for blind/deaf/etc
**small type
**Mousing
*“I don’t belong here”
**Language
**Gendered Aesthetics
**Intimidating (Long forms, complex user experience)
**Cultural Biases (Whitespace)
*Access/Resources
**Little access to communication devices (computers)
**Lack of experience with computing (late bloomers)
**Firewalls/Net Filters/no plugins

Solutions?
Your ideas go here :)