Statement of Condemnation of U.S. Mass-Surveillance Programs [pdf]

http://www.cs.ucdavis.edu/~rogaway/politics/surveillance.pdf

by Nogwater • 13 years ago

318 59 13 years ago

cs.ucdavis.edu

tptacek2• 13 years ago

Wow does "UC Davis Professor" ever bury the lede here; Phil Rogaway is one of the most famous working cryptographers. He's also notable for having patented the best known AEAD scheme and granting a free license for all nomilitary use.

B-Con• 13 years ago

He's one of those people who's name you can't avoid repeatedly tripping over.

I took UC Davis's graduate Intro to Cryptography class from him. It was fun to see how much of crypto history he has been involved with.

Interestingly (given the subject matter of this post) he is also well known on campus for teaching a very good Technology Ethics class. (Sample material here.[1])

[1] http://www.cs.ucdavis.edu/~rogaway/classes/

Nogwater• 13 years ago

Apparently I can edit the link text, so I've done that. Normally, I'd just go with the title text, but that was was too long to fit, so I had to get a little creative. Thanks for the tip.

viraptor• 13 years ago

... and granting a free license for all nomilitary use.

I never thought about this. Maybe it would be a good idea to add such clause to applications I release. It wouldn't be compatible with GPL of course, but then again... not sure which one I care about more.

taneliv• 13 years ago

Uhh, how would you define "military"? I would guess you'd be ok software used on the DARPA created Internet... What about UN peace-keeping forces, or the customs, police and other armed forces (in various countries), in which functions would they be allowed to use such software?

Not to say which one is more important, but GPL (at least v2, haven't really studied v3 yet) is quite clear in its definitions and limitations. You'd do a good job defining "military" equally clearly and usefully for use in such licenses, but that might be quite a lot of work.

Incidentally, "do no evil" is not a very good license exactly for the lack of a definition of evil.

rob05c• 13 years ago

I completely agree, about the codes of conduct bit. Any software developer who's taken part in any of this, who's an ACM member, should be ousted for gross violations of the ACM Code of Ethics

http://www.acm.org/about/code-of-ethics

fnordfnordfnord3• 13 years ago

Codes of Ethics mean so little, this would be a good time to make them more than lip service.

skwirl2• 13 years ago

Wait... there are people who still think the ACM has relevance?

shadowfox• 13 years ago

When exactly did ACM lose its relevance?

D9u• 13 years ago

What does the relevance of ACM have to do with the ethical obligations of professionals, be they computing, or otherwise?

It's like the way the notion of Conflict of Interest has been marginalized as illustrated by no-bid contracts awarded to corporations which have strong ties to high level government employees.

http://www.cs.cornell.edu/gries/howbushoperates/haliburton.h...

http://www.cbsnews.com/2100-250_162-575356.html

It's like hiring a former Monsanto lobbyist to be the head of the FDA. It is objectionable.

Just because some (mostly) Saudi nationals allegedly hijacked some airplanes 12 years ago that doesn't mean we have to discard our ideals in the name of some fictional "war" on an ideology.

scott_s• 13 years ago

The ACM is very relevant for academics who publish and attend conferences.

javert• 13 years ago

I don't know how ACM works. I'm in IEEE.

I was basically coerced into joining, because if you pay $X to join, registration for IEEE conferences goes down by a much, much greater number.

Presumably, they have it set up this way because they ultimately make more money by selling your information to marketers (which they do).

So I would say that if the IEEE has a Code of Conduct, it completely lacks all legitimacy.

I hope some important IEEE people take note of this situation and correct it. Otherwise, I hope a more ethical organiziation arises that relegates IEEE to the dustbin.

biot2• 13 years ago

  "It is contrary to corporate responsibility for a company to
   assist in the creation of artifacts, such as server farms,
   routers, or analytic engines, intended for mass surveillance."

Is there a list of companies which supply equipment and/or services to the NSA?

samstave• 13 years ago

Some people on reddit started looking into this: https://pay.reddit.com/r/conspiracy/comments/1kno70/i_think_...

but they stopped looking perhaps...

If you look at the link to Crunchbase's profile for Paladin Fund - that company seems to be funding all the DOD contracting tech services companies....

Edit: Also - look at every investment In-Q-Tel has made.

bengrunfeld3• 13 years ago

Yes. Look at the slides Snowden released when he blew the whistle.

http://images.techhive.com/images/article/2013/06/prism_vend...

biot2• 13 years ago

Those are companies likely forced to cooperate. I doubt the NSA issues National Security Letters forcing hardware manufacturers to sell them products.

frob• 13 years ago

I am so very proud to be at UCD right now.

dandrews3• 13 years ago

I'd be interested in your (and Rogaway's) take on the UCD pepper spray incident, then. https://www.youtube.com/watch?v=yjXcaoEAkq4

tptacek2• 13 years ago

What a nauseating comment. How hypocritical of Rogaway to take a moral stand on any issue, it implies, living as he does on land stolen from Aboriginal Americans.

fnordfnordfnord3• 13 years ago

US Davis paid a little over $600k to the 21 students and fired John Pike. According to SFGate the students will receive about $30k each and a written apology from the chancellor. The ACLU will get 250k for representing the students. That sounds like a reasonable outcome to me.

http://www.sfgate.com/bayarea/article/UC-Davis-pepper-spraye...

maxk42• 13 years ago

Amen.

pekk2• 13 years ago

An appropriate response, since the politics of this have taken on such a dogmatic, black-and-white quality. In the same thread: calls for McCarthy-like blacklisting of programmers based on ideology. Never any nuance in these discussions: either say 'Amen' or Burn in Hell.

patcon• 13 years ago

I wish he'd just said "I agree", so that you didn't find yourself a soapbox so high up in the comments...

etiam• 13 years ago

"The hottest places in Hell are reserved for those who remain neutral in time of great moral crisis." — Dante Alighieri

rooshdi• 13 years ago

"Both US-persons and non-US-persons have a right to be free of routinized surveillance. This right does not spring solely from the US Fourth Amendment; it is a human and natural right as well."

This cannot be overstated. Americans are no better than the rest of the world. If anything, being the masters of mass surveillance makes us worse. We're creating the big brother blueprint.

dalek_cannes2• 13 years ago

As a non-US citizen, I've been repeatedly asking this about news stories emphasizing the collection of domestic communications as the bad thing. I thought your declaration of independence say that all humans are endowed with inalienable rights...

ClashTheBunny• 13 years ago

One big misunderstanding is that the Declaration of Independence is a legally binding document today. It was a declaration of war on the British Empire; it didn't really matter anymore than a statement of values of people who started the war once it was done with that.

I would look to treaties that we have signed to see what we currently legally state as human rights Treaties in Force [1]. Specifically this treaty: International Covenant on Civil and Political Rights [2]. Just make sure to check if your country is one of the countries that have agreed to the treaty and that the government who signed it is still in power.

[1]: Treaties in Force - http://www.state.gov/s/l/treaty/tif/index.htm

[2]: ICCPR - http://www.ohchr.org/en/professionalinterest/pages/ccpr.aspx

gaius• 13 years ago

This is why the Founding Fathers weren't actually keen on a Bill of Rights. They feared that citizens would come to believe that their rights were granted by the document, rather than just been non-exclusively enumerated in it.

bengrunfeld3• 13 years ago

Like everyone, I've read a lot about the aftermath of Snowden's disclosures. This is the first time I've read an official condemnation from an industry leader. Amen.

chopin• 13 years ago

Bruce Schneier is pretty bold as well.

hannibal5• 13 years ago

He joined EFF Board of Directors this year. He has clearly changed his tone after Snowden leaks.

https://www.eff.org/press/releases/renowned-security-expert-...

asgard1024• 13 years ago

Where can I sign it? (Would love to, although I am a mere non-US programmer. He should turn this to a petition.)

marcuspovey• 13 years ago

I would love to see everyone in the IT industry take a similar pledge.

If enough of us do we can choke off the oxygen supply to these organisations, especially if we make it an unattractive career prospect for undergrads.

geertj• 13 years ago

"It is contrary to the ethical obligations of cryptographers, computer scientists, and engineers to participate in the development of technologies for mass surveillance. It is also a violation of professional codes of conduct."

I agree. All of us developers have obligations that are higher than achieving personal wealth, or being a family breadwinner. We are the literate elite of our times. This status gives us the potential for great monetary benefit doing something we like, but it also comes with its social responsibilities.

jacquesm2• 13 years ago

Finally someone who actually gets it that mass surveillance is wrong in principle even when it does not have US citizens as subjects.

Thank you professor Rogaway.

RyanMcGreal• 13 years ago

This right does not spring solely from the US Fourth Amendment; it is a human and natural right as well.

As a "non-US-person", I found myself particularly moved by this line.

w_t_payne• 13 years ago

I used to work for Sophos, the Anti-Virus & computer security company.

It was made very clear to me when I joined that they did not want to employ anybody who had ever had anything to do with hacking or writing malware, and that any hint of this would be grounds for immediate dismissal.

It was also made very clear that any such individuals would be black-balled by the industry as a whole.

I can only presume that this scheme would cover cases of hacking or espionage by government employees, or other such abuses of trust.

Whilst I acknowledge comments that raise the spectre of McCarthy-esque witch-hunts, and I share the concerns, I do think that it would be entirely appropriate for this scheme to extend to other technology companies that bank on a trustworthy reputation, and who need to prove beyond doubt that they have not been infiltrated by individuals with a history of abusing privacy and subverting technology for malicious purposes.

To an extent, this is already covered by the codes of conduct required by institutions such as the ACM, IEEE, IET, BCS and so on. I wonder if they will step up to the plate and enforce their codes of conduct (and if necessary, update them in light of recent developments).

Also, employers do not normally require their programmers to be members of these institutions, and the level of membership is very low. I wonder if this should change, or if we should set up a new institution for this specific purpose?

androtheos• 13 years ago

I would love to have been a fly on the wall when the director of the NSA is meeting with the president telling him that the only way to ensure national security against terrorism is to start these mass surveillance systems.

"Okay", says the president. "I guess if it's the only way then I'm sure the people will understand it's in their best interest" slight chuckle escapes his lips at the end.

When it should have gone something like this.

"Bullshit! I will not sacrifice the freedoms that are the foundations of America, simply to make your job easier on you. If you can't do the job without destroying the very freedoms you should be protecting, I'll damn well find someone who can!"

Director of NSA: while stuttering "Well actually we could work together with the CIA and FBI as well as foreign intelligence to garner the necessary intel that would give us actual probable cause to start monitoring someone by legal means with a warrant and everything."

JonFish85• 13 years ago

So presumably the author is OK with whatever surveillance the UC school system has? Unless the U.C. school system doesn't have network monitoring installed? Is he OK with with students torrenting terabytes of information of questionable legal origin? Because I guarantee that the UC IT department has some sort of network surveillance going on. Scanning emails, possibly. Monitoring bandwidth usage by specific MAC addresses. And probably much more than that.

aet• 13 years ago

Will this department stop taking DoD money?

Statement of Condemnation of U.S. Mass-Surveillance Programs [pdf]

Related Stories