Things That Matter Most

Things That Matter Most

Guilty Until Proven Innocent

by

A political science professor I once had delivered a beautiful explanation of our adversarial legal system. Her point was allegedly part of the original basis of the age-old statement, “innocent until proven guilty.”

Our legal system is structured in an adversarial fashion in the hope of doing the least harm. It’s preferable that a hundred guilty individuals go free than a single innocent man or woman be sent to prison.

Beautiful as it was, I didn’t necessarily agree with this statement at the time. I’d seen plenty of obviously-bad people win their day in court and, despite their crimes, walk free as anyone else. Some even went so far as to flaunt how they’d beaten the system, which just added more insult to injury.

At the time, I felt very strongly that we needed better prosecution, stiffer penalties, and a way to ensure that no obviously-guilty persons got away with their crime.

Unfortunately, most people around me agreed.

Flash-Forward

Today, we’ve almost reached such a system, and to say I’m sorry for what a younger me wished for is an understatement.

We live in a world where air travelers are treated as suspected terrorists and intrusively searched for just wanting to take a trip. Americans stand in line to have their belongings x-rayed, their persons scanned, or to be patted down by a security official as if they’ve already done something wrong. Ironically, you can pay to bypass these screening requirements – your payment, a quick background check, and your promise to be a good citizen adds you to the list of people who can wear shoes, jacket, belt, hat, etc through a metal detector. Your laptop no longer needs to be removed from your bag, either. 1 You’ve now paid to be recognized as an innocent traveler.

We live in a world where police shoot to kill and then justify their action later by painting the deceased as a violent criminal without a trial to ascertain their guilt or innocence. Where police shoot at an unarmed man rushing to retrieve an emergency asthma inhaler for his 6-yr old daughter. When a 12-yr old with a toy is shot mere seconds after police arrive on the scene.

We live in a world where the above situations are all excused by the public as unavoidable consequences. Where individuals are tried in the minds of the police, have their guilt established without contest, and then used by said police to justify lethal action.

We live in a world where my biggest personal encounter with law enforcement’s new “guilty until proven innocent” mentality is having to remove my shoes to prove I’m not a threat to a plane. It’s a world where my friends feel unsafe walking at night with their hands in their pockets because they’re afraid a passing cop might suspect them of a crime and take the location of their hands to be evidence of a concealed weapon.

I’m angry that we’ve let our country get to this point. I’m also ashamed that my silence in the face of this injustice has let it continue to grow. I’m also ashamed of the way that I, too, have judged those around me and unjustly declared guilt.

Notes:

  1. Once my ticket was erroneously marked as Pre-check – I’ve never paid for the service – so I got the expedited treatment at the airport. They didn’t even make me hang up on my conference call. ↩

White Hat Documentation

by

The act of both finding and publishing information online is an interesting one.

On the one hand, sometimes I come across information I’m not supposed to have. When people discover I know something questionable, they get defensive and start trying to grill me for information about why I know this.

Case-in-point: I worked as an intern in Seattle and, one day, asked why we had several locked filing cabinets in the corner we’d never used. As it turned out, my boss had bought them at an auction for extra storage, but they came locked and without a key.

“If only you knew how to pick locks, Eric, then we could put them to use.”

“Actually, I do know how …”

A confused and slightly concerned look, and my boss gave me permission to bypass the cheap locks on the cabinets. A bent paperclip and five minutes of raking later, and I’d opened all four locks. The company had these cabinets in the office for over a year, but finally they were usable. Everyone was impressed, and my boss was happy I was good with both computers 1 and with physical jobs, too.

Until the next Monday, when I arrived to work and was met by a local cop standing at my desk. The back window to the office had been broken out, and every computer in the office except for mine was missing. As I’d recently shown my proficiency for less-than-reputable skills, my office mates suggested he ask me if I knew anything about the break-in. 2

Show you have a bit of knowledge, and everyone begins to question how you’ll use it.

Last week I wrote a piece on debit cards, security, and the risk you face by giving out information about your choice of banking institution too freely. The immediate response was “of course, we all know that.”

The response shortly after that was, “cool trick, can you show me how you cracked the number on a card? For … um … educational purposes.”

The final response was, “why are you writing these things that criminals can use to steal from honest people? You’re just as bad as the thieves!”

I learn things because I’m interested in them. I teach about things because I’m interested in learning more about them. I write about things because I want those around me to be well-informed, in this case about basic security.

I do all of these things while wearing a white hat – I’m in it for personal education and to try to help make the world a better place. Keep in mind, though, that for every white hat in the market, there are a hundred (or more) black hats using the exact same information, knowledge, and techniques for nefarious purposes.

Notes:

  1. As the intern, I was responsible for most of the low-level data entry we handled. Sometimes I had the opportunity to interview customers or prepare final strategic reports, but the majority of my day-to-day job was manipulating spreadsheets or tabulating handwritten notes. ↩
  2. First of all, I’d be out of town visiting my parents all weekend. Secondly, the thief cut himself on the window as he broke it, and the police were able to quickly identify and arrest him (though he’d already sold all of the PCs). Finally, I’d proven I could pick locks and I had a key to the office; why would I break the window to enter? Not only that, I had the worst PC in the office. Why not get rid of my POS laptop so I could get a new one from insurance like everyone else? ↩

Ethical Quandary: iPhones and Encryption

by

Earlier this year, I did some brain-picking about a hypothetical new encrypted data storage system I wanted to prototype. My issue wasn’t so much whether I could build it, the question was whether I should.

While describing the project to a friend, we quickly moved beyond my potential use cases to the various uses others might find for my new system:

Our discussion moved quickly beyond movie pirates to even more dangerous criminals. Protected by the same veil of anonymity as the average consumer, anyone could store anything without fear of repercussions. Stolen movies. Stolen credit card data. Espionage. 1

Ultimately, I held off on building my application. Thanks to some great discussion from the savvy team at AgileBits, I solved my personal ethical dilemma. I have a use case in mind, and that’s the use case for which I’m building, optimizing, testing, and multiplying. If someone takes my software and uses it for other purposes, that’s entirely on them.

iPhones

With the latest version of iOS, Apple made waves by announcing how individual users could encrypt more data than before on their devices. More importantly, Apple could not unlock a phone for law third parties without the user’s consent and unlock key.

Apple was so bold as to explain how this impacted law enforcement. Officers could no longer ask Apple to unlock a device or open its data – even with a warrant – if the user wasn’t able or willing to provide an unlock key.

James Comey, the director of the FBI, has made it very clear how this negatively impacts his interpretation of law enforcement:

“The notion that people have devices… that with court orders, based on a showing of probable cause in a case involving kidnapping or child exploitation or terrorism, we could never open that phone? My sense is that we’ve gone too far when we’ve gone there.” 2

Comey is taking the same stance my friend took: assuming nefarious intent on the part of users from the onset rather than focusing on the use-cases and customers for whom a product is built in the first place. Face the facts, city parks can be used for drug trafficking. Cars can be catalysts for crime sprees. Craigslist can be used to orchestrate murder.

This doesn’t mean we close our parks. We keep selling cars. For some reason, people still buy and sell on Craigslist.

Will some use their iPhones while committing illegal activity? Yes. Does this mean we should open a backdoor on every single phone sold to law enforcement to curtail that activity? Absolutely not.

Two Reasons

First and foremost, citizens in America are to be treated as if they are innocent until they are proven guilty in a court of law. In order to have their persons or property searched, law enforcement must appeal to said court for a warrant indicating the persons and places to be searched and the evidence to be seized.

Apple’s change in encryption policy doesn’t impede this. In fact, it just enforces that representatives of the law actually follow the law while gathering evidence. All of those pesky rules that we put in place to prevent cops from knocking down random doors, seizing random cellphones, or eavesdropping on phone calls or emails to friends are there for a reason – to protect us from unreasonable search. Do they get in the way of police work? Not if the police are any good at their jobs.

Second, and the aforementioned article quoting Comey nailed this on the head, opening phones (or any devices) to a backdoor for police exposes additional avenues for hacks and exploits.

“You can’t have it both ways,” said David Oscar Markus, a Miami defense attorney with expertise in police searches and seizures. “If there’s a backdoor, it can be exploited.”

You have a right to conduct business online. You have a right to consume and publish media online or locally on your own devices. You also have a right to control who has access to this information. All Apple has done is stand up and say they agree with these statements and are taking steps to ensure they’re based in reality.

Can this new policy be abused? Absolutely. Should its potential for abuse keep it out of the market? No.

Notes:

  1. Ethics in Software Development ↩
  2. FBI director: iPhones shields pedophiles from cops ↩

WordPress Core Proposal: Code of Ethics

by

The WordPress community has been abuzz recently about codes of conduct and behavioral standards – particularly at WordCamps.  It’s been an interesting conversation, filled with passionate arguments on both sides.

Huge generalizations have been made.  Polarizing blog posts have been written.  Not much progress has been seen at all, though.

The Root of the Issue

At its root, the conversation has been about misogyny 1 in the software community.

Not just the software community – the WordPress community.  My community.

I take umbrage when anyone challenges the integrity of a community of which I’m a part.  I defend it with everything I have and, on the rare occasion there’s a partial truth to a particular accusation, work diligently to fix it.

This time it’s not a partial truth.  We have a problem.

Unfortunately, it’s not a problem I feel particularly invited to address. 2

As a man, people typically jump to an assumption of where I stand on gender issues.  It’s frustrating, but any discussion in which I’m involved where I don’t agree 100% with my female counter-parts quickly devolves from a disagreement to an “oh, well of course, you’re a guy so you don’t understand.”

Over the past few months, arguments have arisen for:

I’m not saying these are particularly bad ideas; there are, however, issues I have with all of them.

Community Expectations

Any codified document can be as binding or unbinding as you want it to be.  If it’s binding, there’s little to no room for negotiation on potential exceptions – exceptions bore holes through the integrity of any community document and often render it useless.

If it’s not binding, then we’re wasting our time here.

Safety Officers

Having a designated individual through whom reports of harassment flow seems, on the one hand, like a good idea.  In practice it rarely works out, though.

I know. I’ve held this role before.

And yet, though I was the designated member of the staff to whom anyone was welcome to report issues, several women on staff refused to report to me.  They were more comfortable reporting issues to another woman than a man.

I can understand that – but I have a problem with needing to cater a role to the comfort level of everyone who might need to make a report.  Do we have a women-only safety officer?  A men-only?  A youth-only?  An English-as-a-second-language-only?

This slippery slope is exactly what we ended up with after falling down the safety officer rabbit hole.  It’s unsustainable and only replaces potential harassment with potential discrimination.

WordCamps for Women

No.

The day an “official” WordCamp explicitly or implicitly excludes any specific demographic is the day I leave the community.

Period.

Disenfranchisement

It’s obvious that women in the WordPress community feel disenfranchised and even threatened in certain circumstances.  Just a couple of quotes I’ve seen:

Being seen as an object compounded my existing lack of self-confidence and made me feel like a total fraud. I wanted to disappear.

Next time I’ll just not introduce myself to the men I don’t know and stick a little closer to the women.

This kind of feedback about any event I care about makes me question the quality and purpose of that event.  It makes me question my affiliations with the people involved.  It makes me question whether or not I want to continue to attend.

It turns my stomach that someone would look at me and, because I’m a guy, avoid meeting me at such an event.

I understand why the response to this kind of sentiment is to branch off.  To protect women in our community from men who would behave in such a way.  To set up rules so we can quickly do away with anyone who breaches our sense of “right behavior” in these settings.

But it’s not that simple.

It Happens to Men, Too

I have been offered casual hookups at every single WordCamp I’ve attended.  For the past two years, attendees at WordCamp Phoenix have offered me spare hotel keys at the bar with a wink and a smile.

After giving a detailed code talk during the day, I’ve had women (and a few men) explain quite graphically at the after party how turned on they were by my coding skills.  I’ve been made uncomfortable by several distinct individuals at all of the conferences I’ve attended – the few times I’ve brought it up it’s been brushed off. “Dude, you can handle it.”  “Come on, it’s a compliment.”

The issue here isn’t that WordCamps (or the WordPress community) are hostile towards women.  It’s that we have no sense of ethical responsibility towards the community.

Code of Ethics

The difference between of a code of ethics and a code of conduct is simple: A code of ethics deals with principles whereas a code of conduct deals with the behavioral implementation of those principles.

In the WordPress world, we already abide by a code of ethics when it comes to software.

If you’ve ever organized, spoken at, sponsored, or volunteered with a WordCamp, you’ve seen an agreement that outlines some of the principles of the WordPress community:

  • no discrimination on the basis of economic or social status, race, color, ethnic origin, national origin, creed, religion, political belief, sex, sexual orientation, marital status, age, or disability
  • no incitement to violence or promotion of hate
  • no spammers
  • no jerks
  • respect the WordPress trademark
  • embrace the WordPress license; If distributing WordPress-derivative works (themes, plugins, WP distros), any person or business officially associated with WordCamp should give their users the same freedoms that WordPress itself provides: 100% GPL or compatible, the same guidelines we follow on WordPress.org.
  • don’t promote companies or people that distribute WordPress derivative works which aren’t 100% GPL compatible

I would expand this list to include the principle that anyone involved with WordPress should understand how their attitudes and behaviors reflect on the WordPress community as a whole.

The Bottom Line

We – the WordPress community – can do better.

We can hold events, both professional and social, without requiring signed behavior contracts for attendance.

We can hold events without needing to designate a chaperon for social interactions the after party.

We can hold events inclusive of everyone.

If we can’t … are we a community in the first place?

A code of ethics is a non-binding way to start the conversation.  Like every piece of open source I produce, the above list of ethical principles is freely available to all.  Patches welcome.

Notes:

  1. I use this word specifically because the conversation is specifically about women feeling uncomfortable in a male-dominated industry. ↩
  2. I have been singled out on many occasions, in this community and others, as being “not qualified” to even hold an opinion.  On women’s issues, I’m told to be quiet because I can only speak from an oppressive, male viewpoint.  I’ve was refused a job working with minority students because, as a Caucasian, the employer felt “little to no confidence that [I] could relate to their experience with a difficult and unfairly competitive workplace.”  I have been ignored because of my religion, my middle-class status, and my sexuality.  The fact is: I do have an opinion and this conversation does affect me, too.  As irresponsible as it would be to ignore my opinion based on any of the above qualifiers, it would be equally irresponsible for me to keep it to myself because I think it will be ignored. ↩

Ethics in Software Development

by

One of my favorite movie quotes is from Jurassic Park.  While discussing the new advances in genetic technology, Ian Malcolm exclaimed:

Yeah, yeah, but your scientists were so preoccupied with whether or not they could that they didn’t stop to think if they should.

I never thought it would, but someone posed nearly the exact same question to me this weekend.

The Technology

I love learning new things.  Lately I’ve been spending much of my free time studying cryptography.  Numbers are fun to me, and being able to apply advanced math to computer science helps make my job that much more interesting.

Also, cryptography involves a great deal of data security.  In a world still reeling from recent revelations in data security, understanding the implications of various cryptographic systems is huge!  In the past few months, I’ve even brainstormed a few interesting applications of my own.

One project in particular deals with anonymous, encrypted data storage in the cloud.  It would allow you as a consumer to put whatever you want on a remote server, anonymously, and with complete security.  No one would know what data you’d pushed up.  No one would even know who you are.  It’s the kind of world I dream about.

But the question remains, though I can build this system, should I?

An Ethical Quandary

As I explained the inner workings of this system to a friend, they immediately jumped beyond my planned use with mission-critical business data storage to media piracy.  Would this system allow video pirates to store whatever data they want in the cloud, securely, anonymously, and allow them to share this data with anyone they wish?

Yes.

Our discussion moved quickly beyond movie pirates to even more dangerous criminals.  Protected by the same veil of anonymity as the average consumer, anyone could store anything without fear of repercussions.  Stolen movies.  Stolen credit card data.  Espionage.

When I first devised this idea, I was thrilled that its potential applications were seemingly limitless.  Now, I’m terrified.

To Release, or Not …

Where do we, as software developers, draw the line?  Do we build software with the common good in mind and ignore the potential consequences of releasing such tools to the world?  Do we hold back potentially groundbreaking achievements because they could be misused by the wrong hands?

I don’t even know how to begin to answer that question.

One potential comparison is the US legal system: an adversarial system designed based on the assumption that people are, basically, good. No innocent man or woman should ever be treated as guilty without just cause and overwhelming evidence. Where we’d rather a hundred guilty people go free than a single innocent be locked behind bars.

Many would argue, though, this is a broken system.

Where would you, personally, draw the line?  To which ideal do you owe allegiance?  That advancements for the greater good should always be released?  Or that advancements with potentially devastating consequences should be silenced?

Personally, I’m on the fence and I’m hoping someone much smarter than me can offer a compelling argument one way or the other.