Werd I/O

Something in Anne-Marie Scott’s post about losing her love of what she does struck a chord with me. Not because I’ve lost the love of what I do - on the contrary, I’m lucky enough to have re-found it. But the way she describes the startupification of education sounds very familiar:

Access is a problem of scale at one level and I am committed to working on that but I increasingly hear reductive views of digital learning limited to students navigating personalised pathways through high-end content and teachers interpreting that learning through analytics. This seems devoid of any kind of good relations and community.

The need for high scale is a crater that has been dug in the fabric of civic life.

For a startup to be venture fundable, it must demonstrate that it is scalable: in other words, it can plausibly grow to be a billion dollar company without linearly increasing the size of its team. Or to put it a lot more simply: it has the potential to make exponential profit. Mint money. Make everyone involved incredibly rich.

And many of them have! Google and Facebook rule the world (figuratively speaking). A lot of founders and a lot of investors have become wealthy by turning startups into scalable flywheels. Venture funding isn’t the only way to fund a startup, but it’s certainly the way that’s caught the public’s and the industry’s imagination, and the result is that the notion of scalability has, too.

But not everything has to be scalable; not everything has to be venture scale. There are a lot of public services, technologies in the public interest, and fully-profitable businesses that benefit by not trying to reach scale. Relationships are the building blocks of society; eradicating those in favor of analytics, in education of all places, is counter-productive, to put it charitably.

The thing to understand about scale is that it’s the antithesis of intimacy. It’s possible to build a service that hits 10 people or 10 million people with the same team; it comes down to different design choices. But it’s not possible to build a service that serves those 10 million people with the same richness of understanding that the one for 10 people has the potential to reach. You can’t get to know each person; you can’t build up a real relationship of trust and 1:1 knowledge. The best you can achieve is a kind of rat-maze simulation of intimacy. How can you possibly hope to respond to a learner’s needs in that environment? And if the educational institution isn’t meeting a learner’s needs, that means someone else has to be - meaning that education at scale can only possibly serve learners who are privileged enough to have individual support at home.

It’s also used in public services under the mistaken assumption that running them like businesses will make them more efficient. Public services *aren’t* businesses, by definition. By making the bottom line a key performance indicator, rather than long-term learner outcomes across a range of inclusive lenses, school authorities are incentivized to trade 1:1 quality  off in favor of cost-effectiveness. That’s not how you get to an educated, creative society. And surely that’s the goal?

It’s been a while since I worked in education. The platform I co-founded, Elgg, was originally intended to support the kind of informal learning that happened in hallways and study groups, but remotely. I always said that if I thought it was going to replace or reduce in-person teaching, I’d shut it down tomorrow. I wish more EdTech projects would consider the same approach.

Covid kicked my ass for approximately four and a half days, and it’s still kicking my ass, but now at least I can read more than half a paragraph of text and string something approaching a complete sentence together. I’m still isolating, still contagious, still feeling like someone has come and sucked the energy from my body with a straw in one of the short windows at night when I’ve actually managed to get some sleep, but I feel a great deal more like me than I did. How I feel tomorrow depends greatly on how much sleep I manage to get tonight.

I’m lucky, of course: I have friends who have had narrow escapes from the ICU, and I know plenty of people who have lost loved ones. It’s a privilege to be able to claw my way online and complain about how much it sucks.

In a weird way, it’s been nice to have contemplative time, after a year that has felt like a whirlwind (which followed another year that felt like a whirlwind). It would have been better to have contemplative time where it didn’t feel like my body was disintegrating around me, so that’s a wake-up call that I need to build more solitary, quiet space into my life. That’s when I’m at my most creative, and I would like nothing more than more time doing more creative, self-driven work. I need more time by myself - and really, I haven’t had much of any over the last year or two - so I’ll find a way to make it.

Meanwhile, it turns out that writing this four-paragraph blog post has completely wiped me out. So I’m closing my laptop again and accepting that I’m not going to do anything productive until I’m much more rid of this virus than I am right now. Time for a dumb movie or something, or just some sleep.

Yesterday, the Supreme Court overturned Roe vs Wade, undoing fifty years of the right to an abortion in the United States. Here’s The 19th’s continually-updated list of what abortion laws look like across the country. And here’s what might happen next.

On a personal note, at the end of the day I also tested positive for Covid. It’s frustrating, because all I’ve been doing is clearing out a house to move out of it, and I’ve had little to no contact with other people. I have no idea where or who I got it from. It’s a good reminder that the pandemic is not over, and you should be careful, test often, and isolate yourself immediately if you test positive.

We know from a leaked draft decision that over the next few days, it’s likely that the US Supreme Court will issue a ruling in Dobbs vs Jackson that will eliminate federal abortion protections.

Here, from my colleagues at The 19th, is what abortion laws look like across the US right now. Many states have trigger laws on the books that will take effect as soon as federal abortion protections are eliminated. Notably, states like Texas make it illegal to help someone get an abortion, and allow anyone to sue someone for doing so. Abortion travel bans are also looming: untested laws that would prevent someone from traveling to another state to get an abortion.

It’s remarkable that these sorts of restrictions should be placed on a woman’s right to choose what she does with her body in a democracy. It’s more remarkable still to see vigilante laws go into effect, and to see states weigh up legislation that denies people the right to choose whether to travel to a different state where abortion is legal. (These restrictions don’t exist for assisted suicide, for example, after a Constitutional challenge.)

For most people on the internet, their information journey begins with a service like Google or Facebook. On these services, your search history and other activity can be subpoenaed, meaning that if you go to court, perhaps because someone sued you for trying to get an abortion, it can be used against you. Pro-life organizations are already using Facebook to learn more about potential abortion payments. Earlier this year, a data broker was found to be selling data about people who visited Planned Parenthood.

So what happens if you do need an abortion? What kind of security stance should people take?

The Electronic Frontier Foundation has a guide that sensibly describes compartmentalization, community agreements, and safe browsing. This is really important, smart advice, but it doesn’t go far enough in a world where your cellphone’s location data may reveal that you went to a clinic.

A lot of location data is derived from the apps you use, and it’s usually not obvious which apps send information where. A few years ago, it was discovered that a Muslim prayer app shared information with the US military. It’s not inconceivable that an app wouldn’t, or isn’t, sharing data with law enforcement: although the Supreme Court ruled that law enforcement needs a warrant to get wireless carrier location data, it can buy location data from brokers.

Abortion isn’t the last stop for this kind of legislation or approach: gender affirming care and even marriage equality may be on the docket. Even more broadly, we should all consider whether we want to live in a world where our every private action can be tracked and used against us. Miranda rights state that “anything you say can and will be used against you in a court of law”; we’ve built a reality where anything we do can, too, whether or not we’ve been made aware.

The most effective protection would be a legislature that is in favor of an individuals’s right to choose and to privacy. A group of Senators is seeking a ban on the sale of health location data, following a letter that was sent to Google CEO Sundar Pichai urging the same. But failing legislative protection, pro-choice advocates need to begin building grassroots infosec skills and tools if they want to prevent this data from being used against abortion-seekers. Today, there is very little out there to help.

A few days ago, I asked the question: Who is doing the best work on infosec for women who may be seeking an abortion? As of now, there are no good answers.

Photo by Manny Becerra on Unsplash

FIDO is a new authentication technology intended to supersede passwords. Here, passwords are replaced with a biometric input: for example, FaceID or TouchID on Apple devices. iOS, Android, macOS, and Windows are all getting this soon due to an alliance between Apple, Google, and Microsoft.

I think it’s unequivocally great: an open standard that provides better security for end users while simultaneously providing a better user experience. Yay!

But spare a thought for the fintech industry. It’s an open secret that the US financial industry widely uses screen scraping to enable data sharing integrations between entities. As a sector, it’s been incredibly slow to adopt open APIs and other mechanisms that would protect user safety.

Last year, Protocol wrote about screen scraping’s widespread use to integrate payroll systems:

Davis of Atomic said the company has used screen scraping "when user-permissioned APIs are not available." One example is when Atomic needs to connect with state unemployment systems, which typically don't have API connectivity. A Plaid spokesman said the company uses "a combination of API access and screen scraping at the direction of customers."

Technically, it’s not a great solution: by definition, screen scraping requires storing a user’s financial system passwords in clear text. Nonetheless, you can bet that every system that integrates with payroll systems, and almost every system that integrates with banks (at a minimum), uses the technique. The US has badly needed open banking style standards for years.

FIDO is likely to bring an end to this practice: when financial services use FIDO passkeys for authentication, screen scraping becomes impossible. Based on their historical precedent implementing new technologies, it may take years before financial services adopt the standard for authentication. But when they do, it will become impossible for third parties to access those systems without the service provider’s consent.

At this point, one of two things will happen: a set of open APIs for integration will appear and begin to reach adoption, or a whole generation of startups will die. It might be both!

If I was a fintech startup, I’d be establishing a set of open source APIs, forming an alliance with other fintech companies and financial institutions, and doing whatever I could to get traditional financial companies to adopt it before they transition away from password authentication. If I was a fintech investor, I’d be bankrolling this endeavor. If I was the government, I would be enacting strong legislation to force the industry forward (which may require lobbying from companies, investors, and consumers alike). Because otherwise, greater security and a better user experience for consumers looks a lot like an existential threat.

Juneteenth is not the commemoration of the Emancipation Proclamation, when President Lincoln declared that all slaves in the Confederacy were free. (Some Union slaves weren’t free until the passage of the 13th Amendment.) Instead, it celebrates the event, two and a half years later, when emancipation finally reached Galveston, Texas. Ending slavery in the US was a long and drawn-out process.

Arguably, though, not every form of slavery ended. The US still employs slave labor through its prison system, which disproportionately incarcerates people of color and forces them to work for rates as low as $0.23 to $1.15 an hour. Some states, like Texas, Georgia, and Florida, don’t pay prisoners at all.

As the End the Exception campaign by Worth Rises describes it:

Passed in 1865, the Thirteenth Amendment to the U.S. Constitution is celebrated for abolishing slavery and involuntary servitude. However, to the surprise of many, the Thirteenth Amendment includes an exception clause that has been understood throughout history to allow slavery and involuntary servitude to be used as punishment for crime. During Reconstruction, this understanding encouraged the criminalization, incarceration, and re-enslavement of Black people.

Worth Rises maintains a report of corporations that use slave labor, which was last updated in 2020. As part of the report, you can download a filterable Excel spreadsheet of over 4,100 corporations that take advantage of prison labor.

Here are companies I found in the dataset from the internet / telecoms industry which take advantage of this labor, whether through profit or direct use. While I am not responsible for the dataset, any omissions to this list as I filtered from the main dataset are mine and purely accidental. These are names that jumped out to me; I recommend reviewing the whole dataset. It would also be worth considering which of these companies have advocated for Black Lives Matter and similar racial equity movements that seek to dismantle systems of oppression while continuing to engage in these systems.

Some of these were a complete surprise to me: for example, Adobe, Snap, Zoom, ESRI, Rackspace, and Google. They might surprise you, too.

Accenture
Adobe Systems
Akamai
Amazon
AT&T
Blackberry
Blackstone Technology Group
Blue Tech
BMC
Capgemini
Chainalysis
Charter Communications (dba Spectrum)
Cincinnati Bell
Cisco Systems
Deutsche Telekom [which owns 48.4% of T-Mobile]
Dun & Bradstreet
ESRI
Frontier Communications (formerly Citizens Utilities Company)
Google
IBM
Konica Minolta
Kyocera Group
MTM Technologies
NetApp
Nexcom
NTT Data
Onix
Oracle
Palantir
Polycom
Rackspace Government Solutions
Salesforce
SAP Concur Technologies
Snap
Softlayer
Symantec
T-Mobile
Time Warner Cable (dba Spectrum)
TransUnion
UNICOM Global
Venture Netcomm
Verizon
VMware
Zoom Video Communications

Updated to note that these companies may profit from the prison complex rather than use slave labor directly. Photo by Hédi Benyounes on Unsplash.