A rebuttal: the coming civil war on general-purpose computing

Cory Doctorow gave a talk recently about how we are descending towards a dystopian future, which was based on an earlier talk with largely the same premise.  I doubt it.

The premise is sound enough: TPM is here to stay, and it’s important that we have TPM that is controlled by actual people, and not TPMs that are controlled by the bogeymen.  So far, so good.  Then he starts to conflate a bunch of unrelated things:

Say we try to secure our physical roads by demanding that the state (or a state-like entity) gets to certify the firmware of the devices that cruise its lanes. How would we articulate a policy addressing the devices on our (equally vital) metaphorical roads—with comparable firmware locks for PCs, phones, tablets, and other devices?

After all, the general-purpose network means that MRIs, space-ships, and air-traffic control systems share the “information superhighway” with game consoles, Arduino-linked fart machines, and dodgy voyeur cams sold by spammers from the Pearl River Delta.

And consider avionics and power-station automation.

This is a much trickier one. If the FAA mandates a certain firmware for 747s, it’s probably going to want those 747s designed so that it and it alone controls the signing keys for their bootloaders. Likewise, the Nuclear Regulatory Commission will want the final say on the firmware for the reactor piles.

This may be a problem for the same reason that a ban on modifying car firmware is: it establishes the idea that a good way to solve problems is to let “the authorities” control your software.

So he’s constructing the following slope:

• The bogeymen need to control the nukes, because it’s an obvious safety issue.
• The bogeymen need to control the planes, because it’s an obvious safety issue.
• The bogeymen need to control the cars, because it seems like a safety issue.
• We’re controlling everything else, might as well throw in computers.

No.  The slope’s not slippery.  It’s a sticky slope.

• Nukes are dangerous.  They’re so scary they’re controlled at the international level with so much paperwork it would make your head spin.
• Planes are less dangerous.  They’re controlled at the national level.  Some planes are scarier than others and are more regulated than others.  Planes are not held to the same standard of safety as nuclear warheads.
• Cars are less dangerous.  They’re controlled at the state level.  Your privacy rights in a car are a lot higher than in a plane (see Terry v. Ohio).  Cars are not held to the same standard of safety as planes.
• Computers are less dangerous.  They’re not really controlled at all.  Your privacy rights on a computer is at the highest possible legal standard (other than perhaps marital privilege).

Essentially his argument is that it is easier, technically, to control computers.  But it is not really any easier technically than it was when there were fewer computers and governments could keep an eye on them (anybody remember Clinton’s relaxation?)  And it’s certainly not any easier legally.  And even if it were easier, it doesn’t make it inevitable.

Skipping forward a bit, he makes a bunch of arguments that are similarly incomprehensible to me.  For example:

You are a minor child and your deeply religious parents pay for your cochlear implants, and ask for the software that makes it impossible for you to hear blasphemy.

Millions of parents do the analogue equivalent of this today.  If it’s bad to seclude your kid from what you perceive to be objectionable, then let’s prosecute the parents.  Maybe it’s time to look beyond simply giving kids a magical age of majority where they go from no rights to all-the-rights in a nanosecond.  But this isn’t a new problem.  Technology didn’t introduce this problem.  Giving your kid a filtering implant is no different than its analogue equivalent of secluding him from outside influences.

You are broke, and a commercial company wants to sell you ad-supported implants that listen in on your conversations and insert “discussions about the brands you love”.

Well, this situation is absurd on the simple basis that if you are broke, nobody wants to show ads to you, because you have no money to spend.  But accepting that this problem can be magically resolved for the sake of argument, it is not really different from the kind of legislation we have regulating other activities that disproportionally target the poor: the lottery, payday loans, etc.  As a society, we have some principles in place about to what extent it is acceptable to make “shark” deals with the poor.  I have every confidence that we will be able to meet new embodiments of this age-old problem.

Your government is willing to install cochlear implants, but they will archive everything you hear and review it without your knowledge or consent.

Again, this is not a new problem.  The government already wiretaps the conversations of millions of Americans.  If spying cochelar implants is wrong, so is wiretapping.  If wiretapping isn’t wrong, neither is spying cochlear implants.

You may say “Look, as a society we haven’t produced the necessary moral outrage about the wiretapping thing, and by extension I doubt we will produce the necessary outrange in the face of spying cochlear implants either.”  And that is a fine, legitimate, concern.  But on some level it is logically equivalent to “I don’t think the voting public adequately represents their own interests, because they haven’t successfully voiced their concerns about that which I think is important”, which is, in my view, an absurd proposition.

I summarize this whole set of arguments with the following analogy: it may be easier, technically, to kill people with the advent of things like machine guns, than it was before they existed.  I’m sure this was all very exciting the first time we had a murder trial involving a machine gun.  But murder is an old problem.  It is not a different problem when we add a machine gun to the mix.  All of these “problems” are old problems that do not magically transform when we add a few extra computers to the situation.

Moving on to statements like this:

What this means is that any thug who buys your debts from a payday lender could literally — and legally — threaten to take your legs (or eyes, or ears, or arms, or insulin, or pacemaker) away if you failed to come up with the next installment.

Essentially he is proposing the literal “taking candy from a baby” scenario in order to garner sympathy.  But let’s break this down just for fun:

First, people who make things that are useful–yes even prosthetics–have the right to be compensated for them.  There is a fine argument to be made here that the cost should be in some sense socialized–whether through insurance, or through national healthcare socialization–by many people.  But whatever you think of that, the fact remains that the people who produce this equipment deserve compensation from someone.  And if they deliver this product, and a person utilizes the product and gets enjoyment out of it, and the original makers are not compensated, and they continue to not be compensated after pursuing the legally responsible party, then it is a very basic right that they should be able to recover the property and give it to someone else who is in need of a pair of legs.  That is what ownership means.  We’re talking about something that is older than the Magna Carta.  Yes, it is a sad and horrible picture of a man without legs sitting on the street corner, but the villain here is a society who thinks it is acceptable to have uninsured citizenry, not the manufacturer of a product that helps millions of people who expects compensation for their work, and the person to whom the pair of legs went instead.  To say that you cannot take the legs back is to say that you cannot really demand compensation for them.  I find this position reprehensible.

He continues:

Reposession [sic] of leased goods — cars, for example — are limited by procedures that require notice and the opportunity to rebut claims of delinquent payments.

When these laws are “streamlined” to make them easier for property holders, we often see human rights abuses. Consider robo-signing eviction mills, which used fraudulent declarations to evict homeowners who were up to date on their mortgages—and even some who didn’t have mortgages.

The potential for abuse in a world made of computers is much greater: your car drives itself to the repo yard. Your high-rise apartment building switches off its elevators and climate systems, stranding thousands of people until a disputed license payment is settled.

Sounds fanciful? This has already happened with multi-level parking garages.

First, he’s conflating legal streamlining and technical streamlining.  The fact that repoing a car is pushing a button instead of placing a phone call to the local repo man has nothing to do with how legal or illegal the thing is.  It will be just as legal (or just as illegal) as it was before.

And second, with these “robo-signing eviction mills”, wrongly accused consumers have been very successful in extracting large damages from these entities.  We have a legal system that is adequately prepared to remedy these situations.

Back in 2006, a 314-car Robotic Parking model RPS1000 garage in Hoboken, New Jersey, took all the cars in its guts hostage, locking down the software until the garage’s owners paid a licensing bill that they disputed.

They had to pay it, even as they maintained that they didn’t owe anything. What the hell else were they going to do?

This all sounds very scary and terrifying–halp, I can’t get to my car!!

Actually, there are a lot of things they could have done.  It may surprise you to know that this is not the first emergency dispute that has ever arisen in the United States:

• Not worked with a vendor that required ongoing licensing fees
• Paid better attention to warnings about license expiry
• Sued the vendor, gotten a temporary injunction ordering the reactivation of the software, pending the outcome of the lawsuit.  Hint: this is what temporary injunctions are for
• Paid the money to the vendor, than sued for its return
• Renegotiated licensing terms to purchase the software outright

Continuing this argument:

And what will you do when your dispute with a vendor means that you go blind, or deaf, or lose the ability to walk, or become suicidally depressed?

The negotiating leverage that accrues to owners over users is total and terrifying.

No, it’s not very terrifying.  Imagine if your landlord was able to kick you out of your apartment–merely because you failed to pay your bills!  Imagine if the utility commission was able to cut off your power simply because you cannot afford to pay for it!  Pure terror!!

The real terror is if we required landlords, power companies, food vendors, and everyone who provided “necessities” to foot the bill indefinitely for everybody unable to pay for those necessities.  To do so would disincentivize anyone to work in those industries, and greatly raise the prices for everyone.

If what Cory really wants to say is–we need some reasonable limits: you can’t get cut off until you’re two months late, you must send four written notices, etc., and then you can turn the hearing off, that seems perfectly reasonable to me, and is compatible with how we handle other necessities.  But that’s not what he says; what he’s written down is that we cannot turn the hearing off at all–which is equivalent to saying that the people who do the important work of making medical breakthroughs shouldn’t be compensated, that they cannot really demand compensation.

What happens when griefers, crooks, or governments trying to quell popular rebellion use this to turn heat off during a hundred year storm? Or to crank heat to maximum during a heat-wave?

The HVAC in your house can hold the power of life and death over you — do we really want it designed to allow remote parties to do stuff with it even if you disagree?

There are a lot of things that hold life-or-death over you: your local police force, the plane flying overhead, martial law, a semi truck on the highway, your state’s death penalty.  The problem I have with this stylized fear-mongering is that it reeks of the same kind of sensationalized fluff the local news is pushing: what hidden killer lurks in your house?  more at 10!  

Maybe having a remote control on your HVAC system is even a bad thing, I don’t know, but equating ‘HVACs with remote controls’ to pepper spray or guns or social control or tyranny or whatever is not just a poor analogy: it’s unethical writing, on the same level as those hooks on the local news or those headlines on the magazines in the checkout line.  Call the remotes bad, call them loss of control for the American homeowner, call them a symbol of society in decline–but don’t call them a killer.  This is how we ended up in a post-9/11 world: by worrying about the very safest things, while ignoring the many cancers and heart-diseases and car accidents in our midst.

But if your legs can decide to walk to the repo-depot without your consent, you will be totally screwed the day that muggers, rapists, griefers or the secret police figure out how to hijack that facility.

Let me say it again: throwing magically lojacking legs into the equation does not produce a new problem out of an old one.  If you have muggers, rapists, griefers, or the secret police controlling your legs, let me point you at the problem: the muggers, rapists, griefers, and secret police.

In fact, all things being equal, I think the situation has considerably improved.  I would much rather be attacked by a person who shut off my legs than a person brandishing a weapon.  In the second case, I am far more likely to die or be severely injured.

---

Want me to build your app / consult for your company / speak at your event? Good news! I'm an iOS developer for hire.

Like this post? Contribute to the coffee fund so I can write more like it.