You Can't Be Tough On Big Tech While Killing Off Alternatives To It

from the decentralized-tech-can-help dept

The Biden administration has been talking a big game about being "tough on Big Tech" and Silicon Valley monopolies. But right now they're quietly defending a provision in the must-pass Infrastructure Bill that targets software developers who are building alternatives to the exact Big Tech systems the administration decries.

The administration has been pushing a "pay-for" measure in the bipartisan Infrastructure Bill that would expand US government surveillance of cryptocurrency-related or decentralized projects. The Electronic Frontier Foundation, Fight for the Future and 14 other civil society organizations have expressed grave concerns for the “vague and dangerous” digital currency provision of the bill.

This digital currency provision has been sold as being about taxes. But it's so poorly written that it would create reporting requirements demanding people like software developers and even volunteers within decentralized tech projects hand over data or conduct surveillance of their users. There are plenty of valid concerns around cryptocurrencies & ensuring that everyone pays their fair share of taxes. However, the provision in the Infrastructure Bill would demand data from people who don't have it—effectively crushing a wide range of decentralized projects under misguided regulations.

Destroying decentralized projects would be a disaster for global human rights, freedom of expression, and democracy. Cryptocurrencies and decentralized tech projects are among the most promising potential solutions to address the harms of Big Tech. Decentralization could help end the era of surveillance capitalism.

If the Biden administration is serious about taking on Big Tech, it shouldn't be actively trying to shut down communities of developers, volunteers, people who run nodes, and other participants in the very software projects that could one day help us escape the clutches of Facebook, Amazon, and Google. The original cryptocurrency provision in the Infrastructure Bill amounts to a dramatic expansion of government surveillance tacked on to a must-pass piece of legislation at the last minute. Policy that impacts human rights & the future of the Internet shouldn't be made this way.

Fortunately, Senators Wyden, Lummis, and Toomey have introduced an amendment that would fix the problematic language in the Infrastructure Bill. This amendment is a win-win: it ensures actual crypto brokers like Coinbase pay their taxes, but clarifies the measure can't be abused for broader surveillance or oppression of smaller decentralized projects. Now even Senator Portman, who teamed up with the White House to draft the original cryptocurrency surveillance proposal in the Infrastructure Bill, is supporting this common sense amendment. Sadly, Senator Portman, who teamed up with the White House to draft the original cryptocurrency surveillance proposal in the Infrastructure Bill, pulled his former support for this common-sense amendment and introduced his own amendment that is even worse than the original provision itself.

Weirdly, the Biden administration seems to still be pushing the original language and opposing this amendment to the law that would clarify small players won’t be targeted. The administration simultaneously claims two opposing facts:

First, that the current language doesn't target "small players" in the decentralization ecosystem at all.

Contrarily, the administration also states that the Wyden amendment would "put a dent" in the tax revenue generated—even though the amendment would just clarify that onerous reporting requirements don't apply to people who wouldn't even possess the surveillance data that this law would require to be turned over.

The White House can’t have it both ways on this. Either the language only targets actual cryptocurrency brokers, in which case the Wyden amendment would have no impact on the tax revenue generated—or the admin's "pinky swear" that it won't use this law to go after small players like software developers making wallets is false.

We can and should have real conversations about what types of policies should be in place to protect people, especially low income folks and communities vulnerable to surveillance, from cryptocurrency scams. We also need to ensure that giant corporations and millionaires pay their fair share of taxes. But if the Biden administration really cares about holding Big Tech companies accountable and giving people alternatives to Silicon Valley giants, they need to start getting smarter about how technology actually works, and advance policies that actually accomplish stated goals.

More than 10,000 people have called the Senate because the cryptocurrency surveillance provision in the Infrastructure Bill is a huge mess and a huge threat to digital innovation and human rights. The Wyden amendment will fix it. Democratic senators and the Biden administration should back off their hypocritical stance that calls for reining in Big Tech while also stifling any innovation that could replace it.

Evan Greer is an Executive Director and Lia Holland is Campaigns and Communications Director at Fight for the Future, a digital rights organization with 3 million members celebrating 10 years of defending human rights on the internet from malicious corporate interests and ill-informed legislators.

Filed Under: big tech, cryptocurrency, distributed computing, infrastructure, joe biden, ron wyden, surveillance

Distributed Search Engines, And Why We Need Them In The Post-Snowden World

from the easier-said-than-done dept

One of the many important lessons from Edward Snowden's leaks is that centralized services are particularly vulnerable to surveillance, because they offer a single point of weakness. The solution is obvious, in theory at least: move to decentralized systems where subversion of one node poses little or no threat to the others. Of course, putting this into practice is not so straightforward. That's especially true for search engines: creating distributed systems that are nonetheless capable of scaling so that they can index most of the Web is hard. Despite that challenge, distributed search engines do already exist, albeit in a fairly rudimentary state. Perhaps the best-known is YaCy:

YaCy is a free search engine that anyone can use to build a search portal for their intranet or to help search the public internet. When contributing to the world-wide peer network, the scale of YaCy is limited only by the number of users in the world and can index billions of web pages. It is fully decentralized, all users of the search engine network are equal, the network does not store user search requests and it is not possible for anyone to censor the content of the shared index. We want to achieve freedom of information through a free, distributed web search which is powered by the world's users.

...

The resulting decentralized web search currently has about 1.4 billion documents in its index (and growing -- download and install YaCy to help out!) and more than 600 peer operators contribute each month. About 130,000 search queries are performed with this network each day.

Another is Faroo, which has an interesting FAQ that includes this section explaining why even privacy-conscious non-distributed search engines are problematic:

Some search engines promise privacy, and while they look like real search engines, they are just proxies. Their results don't come from their own index, but from the big incumbents (Google, Bing, Yahoo) instead (the query is forwarded to the incumbent, and the results from incumbent are relayed back to the user).

Not collecting logfiles (of your ip address and query) and using HTTPS encryption at the proxy search engine doesn't help if the search is forwarded to the incumbent. As revealed by Edward Snowden the NSA has access to the US based incumbents via PRISM. If the search is routed over a proxy (aka "search engine") the IP address logged at the incumbent is that from the proxy and not from the user. So the incumbent doesn't have the users IP address, and the search engine proxy promises not to log/reveal the user IP, while HTTPS prevents eavesdropping on the way from the user to the search engine proxy.

Sounds good? By observing the traffic between user and search engine proxy (IP and time and size are not protected by HTTPS) via PRISM, Tempora (GCHQ taps world's communications) et al. and combining that with the traffic between search engine proxy and the incumbent (query, time, size are accessible by PRISM), all those seemingly private and protected information can be revealed. This is a common method know as Traffic analysis.

The NSA system XKeyscore allows to recover search engine keywords and other communication just by observing connection data (meta data) and combining them with the backend data sourced from the the incumbents. The system is also used by the German intelligence services BND and BfS. Neither the encryption with HTTPS, nor the use of proxies, nor restricting the observation to meta data is protecting your search queries or other communication content.

Unfortunately, unlike YaCy, Faroo is not open source, which means that its code can't be audited -- an essential pre-requisite in the post-Snowden world. Another distributed search engine that is fully open source is Scholar Ninja, a new project from Jure Triglav:

I’ve started building a distributed search engine for scholarly literature, which is completely contained within a browser extension: install it from the Chrome Web Store. It uses WebRTC and magic, and is currently, like, right now, used by 42 people. It’s you who can be number 43. This project is 20 days old and early alpha software; it may not work at all.

As that indicates, Scholar Ninja is domain-specific at the moment, although presumably once the technology is more mature it could be adapted for other uses. It's also very new -- barely a month old at the time of writing -- and very small-scale, which shows that distributed search has a long way to go before it becomes mainstream. Given the serious vulnerabilities of traditional search engines, that's a pity. Let's hope more people wake up to the need for a completely new approach, and start to help create it.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: distributed computing, privacy, search engines

School Tech Guy Fired For Running SETI@Home?

from the not-quite dept

SETI@Home, one of the earlier and (still) largest distributed computing projects was launched more than 10 years ago, and it's still pretty common for lots of folks (geeks and non-geeks alike) to run the screensavers and work through the mounds of SETI data. That's why it's a bit surprising to find a News.com writeup by Chris Matyszczyk, about a guy fired for running the software written up as if SETI@Home were some sort of wacky new project by UFO enthusiasts. Basically, it sounds like the guy installed the SETI@Home software on a bunch of computers at the school, and that upset school officials. This isn't the first time we've seen this sort of thing. Five years ago, we wrote about a similar firing of an employee by the state of Ohio.

Still, if you look at the details of this particular firing the situation seems a lot different than the News.com report suggests (or than even the article from AZCentral suggests). There's actually a criminal investigation going on, but the bigger issue (even though it's downplayed in the article) is the fact that the school district claims the guy stole 18 computers from the district and had them in his home (turned up by a warrant). That seems a lot more understandable as an offense leading to termination. Separately, it appears he did not complete his job duties -- such as installing firewall software that never showed up (oddly, the article never actually defines the guy's job title, but it sounds like some sort of IT job). The whole SETI@Home stuff just seems exaggerated. This includes the claim, made in the article, that the guy's actions cost the school district between $1.2 million and $1.6 million. While some of this may be tied to the missing computers, the article implies that much of it is from running SETI@Home, which the school claims was a burden on the computer systems. While he probably shouldn't have been running the software on those machines without permission, that alone is hardly that big of a deal. It seems like most people at the school district and the writers of the articles linked above don't understand how SETI@Home works, which seems to create an awful lot of confusion.

Filed Under: distributed computing, fired, seti@home