Digital Identity Digest (October)

By bryan short on September 29, 2016 | Tagged with Crap Detection, Digital Identity Digest, digital tattoo, Network Smarts, Online Safety, privacy, Protect

US citizens can register to vote within Snapchat application

In an appeal to its young audience, the popular and ephemeral video sharing application, Snapchat, is encouraging young people to vote by allowing them to register within the application. The campaign is in partnership with Democracy Works’ TurboVote, and its advertisements will automatically be displayed in Snapchat Stories for users who are 18 years old or older. Historically, the age group between 18 -34 has had a poor voter turn out (just 46% in 2012 according to Pew Centre research) and Snapchat is in a unique position to access this demographic (41% of all US 18-34 year olds use Snapchat on any given day, according to Nielsen data). The campaign uses 10 second videos that feature celebrities encouraging users to take 60 seconds and register to vote. It will be interesting to see if this campaign has an effect on voter turnout.

Yahoo announces largest ever data breach: 500 million users affected

Amidst an impending sale to Verizon, Yahoo announced that a “state-sponsored actor” had stolen data from 500 million of their users in 2014. Six US Senators have opened an official investigation as to what was the cause of the breach, what caused the substantial delay in discovering it, and what Yahoo will do to protect users’ privacy in the future. Two years is an unreasonable amount of time because it does not provide users with any amount of protection, the Senators claim, and argue that a window of 30-60 days within discovering the breach, is required to notify users that their data is at risk.

Americans growing more concerned about online privacy

New data out of the Pew Research Center indicates that Americans are becoming increasingly aware of the digital identities and concerned about the amount of information that exists about them online. In fact, 86% of internet users in the US have taken measures to conceal their identity online. Although they fear hackers and criminals most of all, advertisers are a very close second. Interestingly, 61% of these internet users want to do more to protect their identity online, but don’t know how. If you’re amongst this population, check out these tips from the Electronic Frontier Foundation, the leading advocate for digital privacy.

Update: German regulators block Facebook from changing the way that WhatsApp works

Facebook announced they were changing WhatsApp’s privacy policy, which compromises a lot of the security features that users look to within the popular messaging application. When Facebook acquired WhatsApp two years ago, they promised that they would protect the privacy of the application’s millions of users. But then they released a new Terms of Service that changed all that. However, the Hamburg data protection commissioner has issued an administrative order that disallows WhatsApp from sharing information with Facebook. Good news for Germans, but what about the rest of the world?

Read More | No Comments

Does technology help or hurt your productivity?

By bryan short on September 22, 2016 | Tagged with Digital literacy, Learn, Participation, success

I found myself standing against the back wall of a huge lecture theatre in the Earth and Ocean Sciences Building on UBC’s Vancouver campus. The auditorium’s seats were filled with hundreds of teacher candidates—an audience that I would have imagined to be quite aware of issues of concentration and attention. Yet, the lecture theatre was filled with distracted people.

These are people who will be addressing classrooms themselves, in a matter of months, and then going on to careers that are based upon the premise of standing before people and delivering information. But from my vantage point in the back of the room, looking down upon a sea of laptop screens and smartphones, I only saw a dozen or so people actually taking notes.

The rest of the audience were reading articles, browsing Facebook, and sending messages on their phones. Many were doing both at once. The same tools that enable them to absorb and discover new information were distracting them from the actual live presentation going on before them. They were consumed by their devices.

This is a scene that we’re all familiar with: the distracted pedestrian wandering clueless, gaze locked on their smartphone; the student who sits in front of you and browses Reddit through class—distracting not only themselves, but every person seated behind; and the constant multitasker, who sits before the television with their laptop and smartphone, accomplishing nothing in several different ways.

I believe that we should be making a conscious choice when we open our laptops, take out our smartphones, or use any other device that offers similar services, and that decision is: Will this device enable or hinder my productivity? Sure, you may be able to take notes faster on your laptop, but you’re also presented with the temptation to check your email and Facebook. If you can’t compete with this desire, your productivity is going to suffer.

How are you using your devices? Have you ever found that they’re using you?

Check out this article by New York Magazine about the modern dangers of technology.

Read More | No Comments

Digital Identity Digest (September)

By bryan short on September 5, 2016 | Tagged with Crap Detection, Digital identity, digital tattoo, facebook, Network Smarts, social_network

Facebook is changing the way that WhatsApp works

When Facebook purchased WhatsApp in 2014, there was a promise that the privacy of the popular messaging application’s millions of users’ wouldn’t be affected. That’s all changed with its new Terms of Service. The move is part of WhatsApp’s plan to monetize, and involves sharing phone numbers and analytical data with its parent company, Facebook. They’re also planning on allowing businesses to directly contact users through the app. This move is seen as threatening the digital privacy that WhatsApp has historically championed through introducing services like end-to-end encryption.

From the experts: Lorrie Faith Cranor

Wired recently interviewed the director of Carnegie Mellon’s Cylab’s Usable Privacy and Security Laboratory, Lorrie Faith Cranor, about digital privacy. Today, the meaning of privacy, especially in relation to the internet and technology, has changed. It is no longer feasible to remain unseen and untracked as we navigate our lives in a digital age. For Cranor, digital privacy is not about staying invisible, it’s about taking control of the information about you that inevitably exists.

Basic password security is important, for everyone

This lesson was learned the hard way by an employee at Dropbox and, unfortunately, by the 68 million users whose passwords were leaked because of their negligence. The employee used a duplicate password for their credentials at Dropbox, and for their personal account at LinkedIn, which experienced a massive hack in 2012. The incident is a timely reminder of the importance of using different passwords for different services, and the negative repercussions that can occur when someone decides to take the easy route.

Worst offenders: health and fitness applications

According to a new study released by the Future of Privacy Forum, health and fitness applications are the worst offenders when it comes to not informing users about what information is being collected and how it’s being used. Despite the obvious and important implications about the data being collected, like heart-rate and sleep statistics, many of the applications, especially those that charge for their services, are not providing users with sufficient information about who this information is being shared with and why.

Digital Identity Digest (August 21 – 27)

By bryan short on August 28, 2016 | Tagged with Digital identity, Digital Identity Digest, digital tattoo, privacy

New Facebook application for teens presents privacy concerns

Facebook released a new video sharing application called Lifestage this week that is intended for users under the age of 21. The social media company has been losing market share to ephemeral applications like Snapchat, and has been looking for ways to engage the young users who favour its services. (Like introducing the disappearing ‘Stories’ feature to Instagram.) But the content that you share on Lifestage doesn’t go away. In fact, Facebook says:

“Everything you post in Lifestage is always public and viewable by everyone, inside and outside your school. There is no way to limit the audience of your videos. We can’t confirm that people who claim to go to a certain school actually go to that school. All videos you upload to your profile and record are fully public content.”

This is very troubling because Lifestage also asks for lots of personal information, like your telephone number and school. If Facebook is trying to compete with the hugely popular Snapchat, which they tried to purchase, then they’ve gone in the wrong direction with this one. The age demographic that most uses Snapchat, those under 21, have implicitly stated their preference for not sharing a lot of personal information, and having what they do share disappear. Lifestage is like an online record keeping service that uniquely connects your posts to you, forever.

End data caps in Canada!

OpenMedia is seeking to end data caps on all cellphone services in Canada by petitioning the Canadian Radio and Telecommunications Commission (CRTC).
They’ve observed that none of the big three wireless providers have packages that include unlimited data, which is something they’re arguing is unfair. As well, the incredible rates that the providers charge when a user goes over their data limits are not reflective of actual market value, and represent these large corporations taking advantage of individual consumers who don’t have any other options. It should also be noted that cellphone service providers in Canada operate under permits from the federal government that prevent competition and essentially allow a few companies to profit immensely, under the terms that they provide a certain level of equitable service to all Canadians. OpenMedia has already received 31,000 endorsements from Canadians, and large American telecommunications companies have begun offering unlimited data packages after relenting from consumer pressure, most notably T-mobile and Sprint.

The BBC and surveillance

Apparently the BBC has a history of surveillance. In the old days, the BBC employed “detector vans” that would crawl the streets of Britain looking for homes receiving their television signals, but not paying for their services. The BBC’s iPlayer allows devices to stream their content live, for a price. The thing is, not everyone using iPlayer is paying for it. Some newspapers have reported that the BBC will be enforcing, once again, payment for their service by sending out surveillance vans that can monitor home WiFi networks, decode their complex signals, and detect whether iPlayer is being used legitimately. But not only is that a very complex way of doing things, it also might be illegal. Unless the BBC already knows that a device is illegally accessing their services, and are simply looking for confirmation, they wouldn’t be able to employ a team of stealthy surveillance vans. However, according to the BBC, that doesn’t mean that there aren’t other ways of ensuring that everyone is paying for their services.

Password or freedom, your choice

In Canada, you can go to jail for not giving Border Agents the password to your cellphone. Whether or not that’s constitutional, is another question. The laws surrounding issues of digital privacy and the Canadian Border Services Agency are mirky because there’s contradictory legislation from the Supreme Court of Canada: personal privacy rights “are reduced in the context of border searches” but “the privacy interest in electronic devices is extremely high.” Despite the incongruity between these two rulings, we do know that people have, and most likely will continue to be, arrested for not giving Canadian Border Agents the passwords to their personal devices. And even if you’re not arrested, the Border Agents can still detain your electronics.

Read More | No Comments

Blackboard Connect: Exposed (Part 5)

By bryan short on August 26, 2016 | Tagged with Connect, Connect series, Digital identity, learning analytics

An open book with the Connect and UBC logo and a history of the LMS.

The 30 business days that FIPPA allows for a public body to provide personal information expired on August 19^th, 2016. I reached out to the University Office of Counsel and asked them when I was going to receive my data, and was informed that because of the “large volume of responsive records” that they’re dealing with, they’ve opted to extend the deadline by an additional 30 business days. There’s not too much I can do but continue waiting.

To me, this is another reflection of a broken system. Throughout this process I’ve met resistance because of the measures I choose to exercise in my search to understand what data Connect is collecting and retaining, and I’m interpreted as a meddling, bothersome nuisance. And perhaps I am. But it isn’t my fault, or really even my concern, if there isn’t functional protocol in place to address the requirements of privacy legislation. The system was broken before I got involved; I’m just the person who leaned on it and made it topple.

In the meantime, I’ve been researching the history of Learning Management Systems (LMS), how they came about, why, and where they might be going. (I credit a comment on my last Connect blog post for pushing me in this direction. And I find a great deal of solace in knowing that my criticisms of the LMS agree with larger conversations taking place in the community.) Historically, Universities were the first sites of the internet. In the mid-1990s, people began connecting over the web at Universities all across North America. The first websites were often faculty and student pages, and some of the first Wikis were launched at Universities and encouraged open collaboration between the local academic community and people from around the world.

But, as the internet began to grow beyond University campuses and extend itself into the public sphere, privacy concerns emerged. There was a growing worry that the information being shared by students was too accessible to the public, and there was a sense of fear about where this information was being stored, and what private corporations might be doing with it. Privacy laws formed that protected student data, and Universities were somewhat forced to insulate themselves from the public sphere of the internet. Instead of students and faculty collaborating on public websites, Universities created internal, online spaces that mimicked the external tools available.

The need for these services was two-fold: Universities felt pressure to protect student data and couldn’t actively encourage students to use resources that were privately held and collected personal information; but they also wanted to continue collaborating and using the tools that were created on the external internet. The software market sensed this conflict and offered a solution: The LMS was born. It offered to safely provide the public tools from the external internet on an internal network so that students and faculty could continue collaborating in a safe, sterile, and legal environment.

In theory, it was a great idea. But in practice, the end product couldn’t compete with the resources available on the public internet. How could it? No amount of funding is equal to the drive found in private industry and the innovation of open-source software. The LMS manufacturers made grandiose promises to Universities about the capabilities of their product to encourage learning through data collection and predictive analytics. However, all these features amounted to was creating an environment where students were heavily monitored and policed, not supported or encouraged. And the resources available, which supposedly emulated the public tools created by companies like Google and Microsoft, were watered down, ineffective, and inefficient. The LMS didn’t and doesn’t encourage learning; it only helps to meet privacy regulations.

And so we’re stuck here. Paying ridiculous amounts of money for the license to a product that doesn’t accomplish what’s freely available on the internet, doesn’t accomplish any of the associated learning objectives that might separate it from these free services. Its only benefit is that the data it collects is stored onsite to meet legal requirements. However, if this data is essentially useless, then what’s the point in recording it? Which means: Its sole benefit is entirely lost.

Students are likely already sharing and collaborating through free tools available on the public internet, anyways. Do you have a Google email account? Do you store documents in its Drive component and collaborate with peers using its Document feature? How about forums? I bet that students are more likely to post to Reddit than to any forum available on Connect. And I’d suspect, especially after reading this blog series and understanding the surveillance capabilities of Connect, that students are more comfortable sharing information on the public internet than they are on the LMS. And who could blame them: the LMS’s primary function is surveillance. Weren’t these the exact measures that the LMS was created to avoid?

So with this understanding of where the LMS comes from, I ask: Has it completely lost its purpose? If students are already engaging in these external resources and don’t have concerns over privacy, then shouldn’t Universities return to embracing these technologies instead of competing against them?

A quote from a book about the importance of students in universities.

Posted on UBC President Santa Ono’s Twitter in August, 2016.

And to provide some further context for the image above: UBC President Santa Ono uses this image to remind himself of the true values a University should have. I believe that the adminstrators who are responsible for Connect, and the lawyers who drafted its Terms of Use, would benefit from considering the sentiment contained within this image, to be reminded of whom the LMS should serve.

The Blog Series

The Connect Exposed blog series documents my inquest into data collection on Blackboard Connect, the difficult process of obtaining my data from UBC, and privacy concerns around the collection of student information.

Blackboard Connect: Exposed (Part 1)

Blackboard Connect: Exposed (Part 2)

Blackboard Connect: Exposed (Part 3)

Blackboard Connect: Exposed (Part 4)

Blackboard Connect: Exposed (Part 5)

Blackboard Connect: Exposed (Blog 6)

Blackboard Connect: Exposed (Blog 7)

Blackboard Connect: Exposed (Video)

Digital Identity Digest (August 14 – 20)

By bryan short on August 21, 2016 | Tagged with Digital Identity Digest

Hackers targeting medical records

For most of us, our largest concern relating to digital security is exposing our banking information to cybercriminals. Whether it’s our credit card numbers our private chequing or savings account information, we’re willing to endure safeguards like chip and pin protocols and highly secretive passwords. However, and perhaps because of all these security measures, online hackers have begun targeting our medical records over our banking information. The personal information contained within medical records is a rich source for cybercriminals looking to commit identity theft because they contain “social security numbers, addresses, phone numbers, [and] next of kin”, which is probably why over 100 million medical records were compromised by hackers last year.

Canadian privacy laws and Jeopardy!

Canadians might have been rejected from competing in television game show Jeopardy! because of Canada’s Anti-Spam Legislation (CASL) and Personal Information Protection and Electronics Document Act (PIPEDA). According to the Financial Post, our nation’s CASL may have gone too far in punishing companies when it comes to sending out commercial electronic messages, which if shown to be in violation of CASL, can cost up to $10 million. This might have caused Jeopardy! to fear litigation and become unwilling to send electronic messages to potential contestants. This is just one example of U.S. companies being wary of stringent Canadian legislation and forgoing electronic communication with their neighbours to the North. But good news for Jeopardy! fans: the show has overcome its issues with CASL and PIPEDA and will be welcoming Canadian contestants again soon.

Google’s new tool

A statue looks ashamed as a magnifying glass hovers over its face and the Google logo is displayed in the corner.

Europeans have been able to alter their digital identity for quite awhile with the Right to be Forgotten, but recently Google brought some of these same advantages to North America. Google’s new tool allows a user to view their browsing history in much more detail than what an internet browser’s internal history tool allows because it’s not limited to one computer. The information shown on Google’s new tool is linked to your web browsing history on every computer that is connected to your Gmail or any other identifying accounts, like YouTube. Removing something with this tool won’t delete it from the internet forever, Google has a takedown policy for that, which can be used in some circumstances. Some argue that there’s disadvantages to deleting all of your information from the internet, like losing out on targeted advertisements and all of your stored settings. As well, now that all of this information about your web habits is gathered in one place and openly available for you, it also makes it more susceptible to hackers.

Guess who just got hacked? The National Security Agency

The hack reveals the tools that the NSA is using to monitor individuals, organizations, and governments around the world. It also lends credibility to Apple’s fight against the FBI. Apple insisted that a tool that could decode encrypted iPhone data wouldn’t be safe anyone’s hands. Luckily, Apple never gave or created those tools for the FBI because, as this NSA leaks shows, those tools truly aren’t safe anywhere. The leak also reveals how clean government hackers are: when a conventional, or amateur, hacker breaks into a private computer to steal some documents or perform some surveillance, there will be signs that they’ve been there, like, to use the metaphor of traditional burglarly, the door will be broken and left open and their tools will be scattered about the place; but the professional hackers at the NSA will spend the time to repair and close the door, remove any trace of their presence, and disappear without leaving a trace.

Read More | No Comments

Blackboard Connect: Exposed (Part 4)

By bryan short on August 17, 2016 | Tagged with Connect, Connect series, Digital identity, digital tattoo, learning analytics

A security camera with the word Connect written on it

As I continue waiting for the return of my data from UBC’s Office of Counsel, I’ve begun examining the structure of the Connect system. For a Learning Management System, Connect effectively manages the amount of information that students can learn from it. The The three roles within Connect are displayed in a graphic: Administrator, Instructor, and Student. system is divided into three roles: that of the student, who creates the majority of the data but can only view a minority of the analytics, like grades; that of the instructor, who can view much more of the analytics than a student can, but is limited to the students within the courses they teach, and those analytics that reference the specific courses that they’re teaching; and that of the administrator, who can view all of the student and instructor data across all of the courses on Connect. It would seem to me that Connect serves to benefit the administrator most particularly.

Unequal Terrains

The graphic on the above right represents the hierarchy of access created by the Connect system. It is biased towards the administrator, illustrated in blue, who can access all of the student data across every course for an indefinite amount of time. The instructor, like the student, has a limited capacity of access. They can only view data that pertains to the students currently enrolled in their course(s) and their timeframe of access is limited to the period when that course is in session. The student, who is represented in red and creates the vast majority of the data in the Connect system, has very limited access to the analytics. In fact, the only data that is viewable for students is likely the grading area, where a student can view the grade they’ve received for a particular assignment, and perhaps view how assignments are weighted towards their final grade. In this way, the architecture of the Connect system is similar to the panopticon, an institutional design intended mainly for prisons, where inmates are spread in a circular formation and monitored from a single tower at its centre. Because the prisoners are unaware of when the tower is occupied, and where the guards limited attention is focused, they feel as if they are always under surveillance, despite not necessarily being constantly watched, and thus, conform their behaviour accordingly.

A Machine Shrouded in Secrecy

How do you feel about being such a small cog in a big machine? If the Connect system is supposedly encouraging learning and helping students, then shouldn’t students have some access to the analytics that instructors and adminstrators are viewing? Learning Management Systems operate at a huge expense under the pretense of encouraging learning, yet Jesse Stommel, the executive director of the Division of Teaching and Learning Technologies at the University of Mary Washington, has this to say about them:

“The LMS can’t ensure that students will learn … [it] will, however, ensure that students feel more thoroughly policed … How will learning be changed when everything is tracked? How has learning already been changed by the tracking we already do? When our LMSs report how many minutes students have spent accessing a course, what do we do with that information?”

Mr. Stommel is asking the same questions that I am. Just because we can do something, doesn’t mean that we should; just because technology has advanced to a point where mass surveillance and data collection are possible, doesn’t mean that we have to monitor and record everything, like the online behaviour of students. There are risks in collecting and storing this data that far outweigh the current benefits, which might be none. It’s tough to say how valuable this data might be because we’ve never seen it before. But stick around, I’ll be revealing everything that the Connect system collects in the next couple of weeks.

“Blind Cogs and Pinions”

I’d like to close with two more quotes, the first is provided by Mr. Stommel and is from the 1915 book, Schools of To-Morrow, by John Dewey:

“Unless the mass of workers are to be blind cogs and pinions in the apparatus they employ, they must have some understanding of the physical and social facts behind and ahead of the material and appliances with which they are dealing.”

We as students are the “blind cogs and pinions” and the “apparatus they employ” is Connect. We don’t know what information is being collected, we don’t know why it’s being recorded, we might not even know that it’s happening, and, most frighteningly, we might not even care. If the system is going to provide any benefit to us as students, then we must have some understanding of its workings, if not for the production of meaningful consent, then for the functioning of its stated goal: to encourage learning.

The final quote is by David Cameron, former prime minister of the United Kingdom, who asked this question in 2009 about the power of government surveillance and data collection:

“How have we got ourselves into the position where there is such a marked imbalance of power between the citizen and the state?”

At UBC, we’re not being monitored to the same extent as the international security measures that Mr. Cameron is remarking upon, but the power imbalance is very much the same. We as students take the role of citizens in this analogy and the state is UBC’s administration: we don’t know why or what is being tracked and we’re told that it is for our own good. This rhetoric is eerily similar to what the United States’ National Security Agency might tell a concerned citizen who voices an objection about how the Patriot Act is infringing on their personal freedoms by performing wiretaps and invasive search and seizure measures. It is also reminiscent of the dystopian future that George Orwell predicted in his novel 1984. We cannot passively trust that Big Brother is watching and looking out for our best interests; we must actively ensure that our best interests are being protected in this new era of digital surveillance.

If you missed them, check out my blog posts on what Learning Management Systems are capable of, how Connect seems to be breaking BC’s privacy laws, and how Connect’s Terms of Use are an unethical means of producing consent. Now that you understand a little bit more about the roles within Connect, how does it feel to be a part of it?