Category: Security

Ideas related to security and safety

Net voyeurs: a national resource?

If only we could utilize Internet voyeurs properly, how much could we get done?

[Finnish version: click here].

Recent tragedies in Finland have shown a gap between official communications and what is available on the Internet. Official communications are terse and protect the privacy of the people involved. The mainstream media, for the most part, does not publish the names of victims. However, any and all information can be found on the Internet. There are forums for everything, in good taste and bad. We haven’t yet gotten to the stage where crime scene photos are circulated, but that day may come. Petteri Järvinen summarizes this well in his blog (my translation).

“The Finnish police communicate very little about accidents and their victims. Names are withheld, based on privacy arguments or “tactical reasons”. The principle is good, but is it valid anymore in the Internet age? Net detectives can sometimes know more even than the police … Voyeurism is improper and insensitive, but it is an unavoidable consequence of the information society”.

That is true. Where transparency, there voyeurism. And especially now, with the recession, Finland is filled with thousands of people who have nothing better to do than sit at a computer. Net detectives have competence and time, and everything that can be found will be found.

The old-fashioned high-quality media does seem lost. Names are only published when everyone knows them already. Details are omitted, even when everyone knows them. Old-fashioned.

So? Why are professionalism and ethics a bad thing? Let it be old-fashioned. It is no one’s loss if the real media reports with professionalism and respect, and lets others dig in the dirt. After all, if all information is available elsewhere, then everyone can find a source that suits his mental level.

In fact there is no need for the media to lower itself, because the “bottom” is already raising itself. I admit (with shame) that I have followed (with interest) on the Internet as people have filled in the puzzles of these tragedies. The motives of these detectives are fuzzy at best, but there is one uncomfortable fact about them: they are good.

Not good journalists, but good intelligence operatives, as it were. Which begs the question: since the net detectives have the time and resources to find out things that the police cannot find, what could they achieve if they turned their energies to something socially useful?

Here is a concrete example whose details I have fuzzified (the exact information can be found on the Internet).

A Finnish city wants to expand its municipal waste landfill. The operator has tried to use a “light” approval process rather than the “heavy” one needed for all projects with a major environmental impact. The decision-makers did wake up, and are requiring the heavier process. Much of the information is secret, but public documents and information on the Internet can be used to piece together a rough picture.

The amount of waste is planned to increase by a factor of five. The heavy process is needed if certain thresholds are exceeded; perhaps by coincidence, all projected values are exactly below these thresholds. The application cites a change in the municipal waste strategy. This strategy, however, is not yet public (which only becomes apparent by searching through multiple sources).

Nothing illegal has happened, this may not even be in the grey zone, but it should still raise some alarm bells. In fact it has, and the situation in now being monitored (on the Internet). With near-zero resources, but monitored nonetheless.

There are hundreds or thousands of such cases. If even a fraction of the best Internet voyeurs put their energy into these issues, what would happen? A lot, I would claim. I am not an optimist, and I do not expect to see anything happen, but there is a lot of potential.

More on open monitoring: here.

Open monitoring: Can citizens be trusted?


Many citizens to distrust the authorities when it comes to monitoring pollution from industry.  Here is a reverse question that few ask but many should: why should the authorities place any more trust on the citizens?

Self-monitoring by industry is criticized, but is self-monitoring by citizens any more credible? I have been driving for “citizen monitoring” of pollution, and this question needs to be asked brutally.  Here is what I claim: if we require independence and transparency from the authorities, then we need to require it from ourselves also. I am thinking of some ways to make this possible.

At the grassroots level, I have been following the plans to build a new waste incinerator in Turku, fairly close to where I live. It is a heated local topic, which is no surprise. No sane person specifically WANTS to live next to an incinerator (personally, I am neutral about it, but then it’s not quite in my backyard even though it is close). This NIMBY effect is well documented everywhere.

What seems less well documented is the POSITIVE potential of people who live next door to these things. The people here have had decades of experience with the old incinerator, and they have local knowledge of both the surroundings and the incinerator itself. From persistent monitoring, they know what parts of the incineration process cause the worst emissions. They have followed the color of the snow and the water in closeby streams. They have made measurements of the pH levels in the emissions.  They know what environmental conditions cause the worst smells.

The authorities turn a blind eye to these results. And — I hate to put it this way — perhaps that is the right thing to do. Even if one fully trusts the people, the scattered measurements simply do not fulfill scientific criteria. Since they are not fully documented, it is impossible to audit the results for credibility.

To me, the fundamental problems lie with confirmation bias. Locals are likely to measure only when something has happened, for example there is a particularly bad smell. Few people think of photographing the color of the snow on days when there are no problems. Or to mark down days on which there are no smells. These citizen measurements certainly give an indication of what the situation is on the worst days, but they are not calibrated and do not give much of an indication about average conditions.

This is NOT conscious manipulation! It is a psychological necessity. On those days when things are fine, it is important to forget the problems. Constant worry is more likely to lead people to early graves than any pollution.

To face these problems, I have two suggestions, one trivial and one less trivial.

A. Trivial suggestion

The trivial suggestion is to automate everything as far as possible. However, even with improvements in technology, there are major limits to what can be done. Real air quality measurements, for example, are expensive and difficult to make accurately.

A suitable user interface for odor measurements? Picture: YLE / Karoliina Hult

In cases where an accurate measurement cannot be made, for example with smells, there could be clever ways to measure near-automatically. One solution I am thinking about is to use “like buttons” next to peoples’ front doors (see picture). The face corresponds to subjective air quality.  Pressing the correct button will take half a second. The process would very quickly become automatic. And once the process is automatic (nearly sub-conscious) it will start creating credible time series of odor levels. These can be correlated with micrometeorological weather data measured by a weather station in a neighbor’s yard.

B. Non-trivial suggestion

The second, less trivial suggestion is that the people doing the analysis should be more or less indifferent about the results. In other words, any analysis of the data needs to be done at a completely different location than the measurements, preferably so that there is no personal contact between the observers and the analysts. Emotions should not exist.

There is a clear precedent for this in the human rights arena: Amnesty International members generally do not work on human rights issues in their own countries. This improves the impartiality of the organization (and also the personal safety of the members).

In exactly the same way, citizen monitoring of industry should be scattered geographically, and there should be a firewall between the people who measure and the people who analyze. The firewall cannot be perfect in practice, as each location is different, and the locals are best aware of the things that should be measured. Locals thus need to be involved in setting up the measurement systems, and they of course need to do the actual measurements, but they should be cut off from the analysis.

This suggestion goes against human nature in just about every possible way. Locals should agree to be lackeys of someone else, and measure what is asked without knowing why? They should potentially pay for instruments without knowing what they are used for? And they should trust that someone “out there” knows and will do right? I personally cringe at the idea.

However, it could be doable. In Finland, analysis of the Turku incinerator could be done from Lappeenranta, which has a university that specializes in waste management — perhaps student labor could be used? And conversely, locals from Turku could help set up the measurements in Vaasa, since Turku locals have the most experience on incinerators (the old Turku incinerator was for many years the only one in the country). People here could absolutely have the competence to know what to measure.

I suspect that the psychological obstacles may be the biggest obstacle. Local observers are motivated to monitor local conditions, since it is their environment and their health that is at stake. If someone is already stressed and exhausted about the situation in Turku, why would he care about the situation in Vaasa?

And what about the money, the resources, the leadership, the responsibility? I have no idea. The technology is not the chokepoint (challenging though it is). Human and political issues are.

More on open monitoring: here.

SMOS: Humanitarian Patent Pool

What would it take take to actually, truly start  a “Humanitarian Patent Pool” like Timo Tokkonen suggested in a posting last week? The idea being to collect certain patents in a non-profit “pool” to keep patent trolls away from ruining humanitarian efforts.  The question was inspired by humanitarian catastrophe communications (see SMOS web page). But there could be other areas.

Is HPP even vaguely realistic? Patents are powerful, but not all-powerful: the Doha Declaration allows developing countries to bypass existing patents for medicines when public health is threatened. A concept similar to HPP, defensive patent aggregation, exists in the commercial world, but to my knowledge not in a non-profit setting.

Here are some back-of-the-envelope estimates on how the HPP might work.  Bear with me if there are ludicrous errors, and please propose improvements.

The core purpose of the HPP must be to eradicate patent trolls in humanitarian areas. The purpose is not to hinder legitimate players. (This is immediately a controversial goal. Idealists will want to eliminate patents from the humanitarian field altogether. I feel it is sufficient to eliminate just the rabid dogs, and let the healthy ones thrive).

The HPP needs to be a non-profit foundation. It should be international in scope, but it might be sufficient to restrict it to the USA because that is the home of the patent trolls.

The key function of the HPP is to collect ownership of “bad” patents. By “bad” I mean something that is not being used to create anything, but can be used by a troll to stop development. A much more refined definition is obviously needed.

The main category of “bad” patent is one which is too broad and should never have been granted in the first place. Another category are patents for a technical solution which has become obsolete, but which a lawyer can stretch to cover some other technology. Such patents are lethal weapons in the hands of a troll. But they could also be lethal weapons in the hands of the HPP.

There are two key strategies.

  1. Containment and decay. Collect patents that are allowed to expire as soon as possible. The purpose here is to prevent trolls from making claims, and to create strong prior art against future spurious patents. These patents should for the most part be collected through donations.
  2. Active deterrence. Patents that can and will be used in litigation against trolls. In some cases, the HPP might consider paying for these. The cost of filing a patent is > 10 kEUR, so the HPP might be willing to consider buying them at cost.

The HPP should be aggressive, not defensive. Unless the HPP is willing and happy to go to court against trolls, it will have no deterrence effect.

Since the USA already has a well-oiled machine in the Electronic Frontier Foundation, it would make sense to tie the HPP in very tightly with the EFF, especially its Patent Busting Project.  On the other hands, in terms of funding, the HPP could have wider appeal and hence be independent.

The working principle needs to be absolute transparency. For strategic reasons, if preparing for an attack, the HPP may require secrecy. But even there things need become public when fight is over. As far as I can see, the HPP cannot ever accept secret agreements or settlements.

The focus areas for active deterrence must be chosen very tightly. They should be restricted to those areas in which humanitarian damage can be massive, and in which trolling activity seems to be particularly easy. Catastrophe communications would certainly be one such area.

The budget of the HPP simply cannot be kept small. Even if using only donated patents, there are legal costs associated, even if the patents are allowed to expire immediately. A reasonable minimum estimate is 1 kEUR per patent. Since there must be hundreds to thousands of patents in the pool, this easily results in a budget of hundreds of kEUR per year.

If some key patents are bought with hard money (though at cost), the cost per patent could be 10 kEUR. The number of truly crucial patents will be small — court cases are typically litigated over just a handful of patents — but knowing which ones a critical requires buying more.

The cost of stockpiling and maintaining the patents will easily climb to a million EUR per year. Unlike projects like the EFF’s patent-busting project, there is no meaningful way to crowdsource the idea. It needs hard money.

If the HPP goes to court, the legal costs are unpredictable, but the HPP must be able to handle them. This is where my reasoning becomes completely fuzzy. Could this work on a pro bono principle? If courts find trolls’ patents spurious, might they willing to force the trolls to pay costs? I find this highly problematic.

Is there any way for the HPP to make some profit to recoup all its losses? In principle, yes, by licensing to legitimate businesses. However, trying to make a distinction between non-legitimate and illegitimate players would add costs and make enforcement difficult.

And, more crushingly, the HPP would risk turning into a patent troll of its own. (“He who fights monsters should see to it that he himself does not become a monster”). It is difficult to see any way to make the HPP self-sufficient.

So where would the funding come from, then? I have no real idea. This was as far as I was able to get in one sitting.

So is the HPP idea even vaguely realistic? If not, would be worth developing from some other angle? If not, do we just have to adapt to life with the trolls?

 

SMOS: The Kiss of Death of IPR – another view

Since the publication of SMOS last week, we have had several discussions with different people about patents – whether patents are essential and does it really matter for a small company to have patents or not. The answer is, of course, yes and no. But even with yes, it is not always as clear as one might expect as Jakke presented in his previous blog.

What is today’s IPR about? It is about litigation, and litigation itself is a game of power and strategy. But even those rules are changing.

I believe that Jakke was a bit optimistic when he was looking at patents from their utility aspects. In practice they are much more.

I may be harsh with my statement, but to some degree patents are like weapons. They are everywhere and can be used both for good and evil. But when one is manufactured, you never know whether it will harm someone someday. For gun exports and trade, and ultimately war, we have regulations. But for using and transferring patents, and eventually litigations, not so much. I am not a lawyer, but for a small company or a single entrepreneur the unwritten rules of the game are quite literal.

Let’s take an example that company LetterZ finds out that company SillyNumber is infringing one of its patents. What will LetterZ do? Most probably it does its homework to know their own position and carefully document everything that works for them. And most probably it plans counter measures if SillyNumber has something against them. If SillyNumber is a small company, LetterZ can wait for it to grow. It is not good business to pay lawyers to sue companies that do not have money. Basically it is a time bomb that only company LetterZ knows exists.

Just like in warfare, the company can plan its strategy carefully over time before striking. With SMOS we would have had no idea who we might have been eventually facing. It would be polite to let the one infringing know and give a chance to change their approach, if possible. But as said, this is more about power and influence than being right. It is warfare.

Traditionally biggest headlines have been written about clashing titans. One party will either pay a lot and/or case ends in cross-licensing. During the last 10+ years there has been other, new type of development. Some companies acquire licenses after careful studies that someone (lucrative enough) is infringing exactly those patens. For the most successful suing companies it is enough to threaten the infringing party to keep the case out of courts. Some of such companies, patent trolls, don’t actually produce anything else than money.

Recent tactics has been to move away from the frontline clash of titans towards guerilla wars. Instead of suing the provider, suing e.g. individual hotels and restaurants for 5000 USD each, there is decent money to be made out of hundreds or thousands of cases. The sum has to be small enough that it definitely will not cover litigation and lawyer fees. Many companies may end up paying without putting up a fight, regardless of the actual case details. The threat and uncertainty are much bigger.

As courts may decide the compensation based on the number of devices made or sold that include infringing technology, corporations are separating their manufacturing and patents. Patents are turned into the hands of portfolio companies, who “do not have anything” to do with the originating company. There is only a licensing agreement, but no other relationship what comes to potential damage based on production numbers. Patents are truly becoming intercontinental missiles of the cold war era.

In August 2011 US Patent Office granted its 8 millionth patent. Two days ago, May 1st 2012, patent number 8 170 000 was granted. That is in the USA alone since the 18th century. There the growth of granted patents has been exponential since the early 1900s. It is a fact that nobody can tell what exactly has been patented and what other prior art exists around all those ideas. In principle all inventions are equal, big and small. We as people have just built and ended up with this kind of a system we face today. It probably is better than anarchy, but can it survive? Is it ultimately so that elephants have the right of way in traffic what ever the highway code says?

There are some efforts to change the status quo, for example https://www.eff.org/patent-busting, but there is much more to patents than corporations and litigation. It still is a possibility for the tiny to have their rights protected. Just as humans as a species have decided. To our knowledge ants do not have proprietary rights for certain lifting techniques, but people may have.

For an individual company patents may be crucial when seeking investments or selling the business. But should the system be reviewed and changed accordingly and be more than a weapon of distraction/destruction?

Do we need a common database of free ideas that are exempt from official patents that may be used for humanitarian purposes and collectively against patent trolls? Yes, I know I am reinventing patenting process just as labor exchanging communities are reinventing money.

But if data wants to be free, could some inventions be agreed to be free as well? It is for our own benefit after all.

SMOS: The Kiss of Death of IPR

For once I will be blunt: I now feel that with crisis communications hardware, the first whiff of IPR (patent) issues will cause the effort to crash and burn.  My opinion on this was certainly different before we started the SMOS project (see SMOS web page).

The idea of combining humanitarian technology and intellectual property sounds uncomfortable. After all, humanitarian activities are supposed to be humanitarian. Nevertheless, there were perfectly valid reasons to consider IPR issues with SMOS.
1. Protect the idea in order to make at least a minimal living from it.
2. Prevent others from destroying or profiting extortionately from the idea.
3. Improving interoperability with telecommunications providers by playing with the same rules (rather than adopting a “hacker mentality”).

I am a deep skeptic about IPR, but do not consider it fundamentally “evil” — it may have its place.  However, I am coming  to the conclusion that for the specific case of crisis communications, IPR is the kiss of death.

The numbers

Since we pursued the possibility of patenting quite heavily, I learned some ballpark figures.

  • To file and get a Finnish patent: 6000-8000 EUR. Most of this goes to the patent agency handling the application. There is no practical way to survive without a patent agency.
  • In Finland, a decision is usually rendered within a year. There may be interim decisions which require using a patent attorney, pushing up the price.
  • After being granted, the annual cost of maintaining a patent is small for the first three years, but starts rising rapidly after that.
  • To file and get a European patent, the cost is approximately twice of a Finnish patent. Maintenance costs are also roughly double.
  • A US patent requires using a patent attorney in the US. Overall cost is comparable to a European patent. In the US, a decision can take 5-10 years.
  • I have no idea what the costs would be in countries such as China or India.
  • A figure of 20,000 USD (or EUR) per patent is often used a lifetime cost, at least within a single country. However, for a catastrophe communications system, protection would be needed in multiple countries, some without an advanced IPR culture.
  • → If I had to give a single number, it would be 50,000 EUR per patent.

Realize, however, that a single patent has no practical value. To protect an idea in any significant sense, a dozen or more patents may be needed. If the IPR route is chosen, a cost of half a million just to file patents is realistic.

Note also that filing patents does not in itself guarantee anything. Anyone can infringe on a patent, and it is up to the patent owner to sue. Even minor court cases can eat up six-digit sums of money, and can be decided on the basis of a comma in the wrong place, even if the most expensive lawyers are used. Going the litigation route means risking millions on what is in effect a roll of the dice.

Even worse, in this particular case litigation is a no-win situation. If the other side is a local company in a developing country, it can (and most likely will, and perhaps should) take the role of a victim being bullied by large Western IPR interests and inhibited from trying to save lives. There is no real way to protect one’s public integrity in such a case.

We had one major rationale for the IPR route: we felt that by making hardware along commercial lines, it would be easier to arrange interoperability with operators. I am now highly skeptical about this. Interoperability would simply cause operators to view SMOS as a potential competition. It would take a major player 15 minutes to dig up enough patents from its patent thicket to make our life impossible. Whether those patents are relevant is completely irrelevant. The threat is enough.

The implications

I draw a harsh conclusion: any whiff of IPR will cause a humanitarian crisis communications project to crash and burn.

On the other hand, proceeding without a thought for IPR is troublesome for funding, since venture capitalists want to recoup their investments within a few years. Without IPR, there is less to recoup.

In the traditional way of thinking, having no IPR protection would be unthinkable because of the competitive issues. However, I believe I have demonstrated above that IPR does not actually give any benefit in this specific technology case.

What to do about this then? I am certainly not saying that crisis communications hardware projects are hopeless. However, it would be wise to pursue such projects with the (perhaps unwritten) attitude that IPR is the enemy.

An open-source approach seems appealing, and has been done successfully with software (for example Sahana). But hardware?  It is only possible to go so far with a “hacker mentality”; if there is a desire to use cellular telecom interfaces, then there is a need to cooperate with commercial providers as a commercial entity.

One of the few ways to actively defend a project of this type against patent trolls is to have a strategy of defensive publishing. In other words, publish all ideas as soon as someone blurts them out, ideally in the form of a permanent Creative Commons-licensed blog. This means that the blog becomes prior art, and the ideas can no longer be patented by anyone.

Other than that? Perhaps the best advice I can give is to look at the material on the SMOS project page, study what we tried to do in SMOS, and then try to not do that.

Translate »