Tripped up

[Dave Birch] Many people have a real problem with the apparently anonymous nature of the interweb. I say "apparently" because, of course, unless you work really hard at it and really understand how the internet works, and really understand how your PC works, and really plan it carefully, you're not really anonymous in the proper sense of the word.

Our sense of anonymity is largely an illusion. Pretty much everything we do online, down to individual keystrokes and clicks, is recorded, stored in cookies and corporate databases, and connected to our identities, either explicitly through our user names, credit-card numbers and the IP addresses assigned to our computers, or implicitly through our searching, surfing and purchasing histories.

[From The Great Privacy Debate: The Dangers of Web Tracking - WSJ.com]

I'm surprised that politicians, in particular, who keep going on about how terrible internet anonymity is, don't understand a little more about the dynamics of the problem. If they did, they would realise that anonymity isn't what it seems.

You might think, after enough major stories about "IP addresses" hit the news wires, everyone in political life would be aware that "anonymity" on the Internet is limited.

But someone in Sen. Saxby Chambliss' (R-GA) office didn't get the memo. In the aftermath of this week's failed vote on the military's "don't ask, don't tell" policy, someone named "Jimmy" registered an account at the gay news blog Joe.My.God. just to say, "All Faggots must die."

[From Outed! Senate staffers, anti-gay slurs, and IP addresses]

In the general case, you are not anonymous on the interweb, but economically-anonymous, which I propose to label "enonymous", and that's not the same thing at all. If you threaten to kill the President, you will be tracked down, and the state will spend the money it takes on it. But if you call Lily Allen a a hereditary celebrity and copyright hypocrite (not my own views, naturally) then it's not worth the state's money to track you down. If Lily wants to spend her own money on tracking you down and taking a civil action for libel, then fair enough, that's the English way of limiting free speech. If the newspapers want to spend their own money on it, fine. For issues of great national interest, such as spurious death threats to the nation's sweetheart, Cheryl Cole, The Sun can step in.

Yesterday The Sun traced the sender of a chilling anti-Cheryl message that blasted her over Zimbabwean Gamu's TV exit. Wannabe rapper Sanussi Ngoy Ebonda, 20, admitted penning the sinister rant, which accused Cheryl of "da biggest mistake of your life" and included a threat to attack other girls sharing her name.

[From Cheryl Cole boosts security at mansion | The Sun |Showbiz|TV|X Factor]

So even though there's precious little anonymity, should we allow enonymity to be the norm? There are plenty of people who think not, and they're not all English libel lawyers. Surely common sense is on their side? Isn't it wrong to let people hide behind pretend names?

Let's focus on a specific and straightforward example. The comment pages on newspaper, magazine and other media web sites. Many such sites require registration but are still essentially enonymous. Is it right that enonymous commenters can say bad things about celebrities, politicians, business leaders? Would people be as horrible about public figures if they were forced to identify themselves?

Would the online debate among commenters be stifled by requiring commenters to sign their real names?

[From What did you say your name was? | Analysis & Opinion |]

The Chinese government certainly hope so.

China is considering measures to force all its 400m internet users to register their real names before making comments on the country's myriad chat-rooms and discussion forums, in a further sign of tightening controls on freedom of speech.

[From China to force internet users to register real names - Telegraph]

We already know this doesn't work, incidentally, because the Chinese already tried this for Internet cafes, supposedly to deal with the problem of young people spending too much time in virtual worlds. The only result was an instant, and profitable, black market in ID card numbers, whereby kids would get the ID numbers of people who weren't going to play in cybercafes (eg, their grandparents) and used them to log in instead of using their own. There was an alignment of economic incentives here, because the cybercafes would not make money by turning people away.

Cafés that did not ask for identification often still had a registration book at the front desk, in which staff members were seen to write apparently random identification numbers and names during their free time.

[From HRIC | 中国人权]

Incidentally, another large and well-known country closely associated with our economic future (albeit a virtual one) has just abandoned plans to try and force Chinese-style real-name registration after a revolt by citizens (well, subscribers):

Blizzard has reversed a controversial decision that would have forced thousands of Starcraft and World of Warcraft (WoW) players to use their real names on the company's online forums

[From Blizzard stands down over forum controversy | TG Daily]

I simply would not allow my kids to log in with their real names. I'm happy for them to log in using one of their multiple e-mail addresses. They've had pseudonymous e-mail addresses since they were old enough to go online. This isn't just paranoia about people grooming children for sexual exploitation (the UK takes this kind of thing very seriously) and such like. There are lots of really good reasons for not wanting to use your identity in online debate and comment. I wrote once before about being shocked by some hate e-mails I received when I once posted some comments in a discussion about interest rates ("interest is the work of the devil", "we know how you are" etc etc). Now, I still enjoy participating in online debates, but do so pseudonymously: my friends know who I am.

That, incidentally, may not be much of a protection, because the mapping of social graphs can soon locate you within a group of friends even if none of those friends disclose who you are. A determined third-party can learn very interesting things from those graphs and, unless everyone is anonymous or pseudonymous under certain conditions, figure out who you are.

Iran appears to be in two minds about whether to embrace or stymie technological progress. On the one hand, Twitter accounts helped the opposition mobilise demonstrations in the wake of last year’s contested presidential election... On the other hand, by monitoring Twitter traffic, Tehran was able to identify who was organising the protests.

[From FT.com / FT Magazine - Who controls the internet?]

As I've said before, in cyberspace no-one knows you're a dog, but no-one knows you're from the FBI either. Thus our government, the US government and many others are caught in two minds, just as the Iranians are. On the one hand, they are supposed to be in favour of free speech, but on the other hand, well, you know Danish cartoonists, criminals, child pornographers, terrorists, enemies of the state, dissidents, apostates etc.

Now, maybe you don’t care. You’re “not doing anything wrong.” Well, Hoder wasn’t doing anything wrong when he went to Israel and blogged about it in Farsi. But he’s serving 20 years in jail in Iran.

[From Emergent Chaos » Blog Archive » AT&T, Voice Encryption and Trust]

But back to online commenting in our democracy. It's not a simple issue, and "common sense" is not a good guide to anything in the virtual world, but it is clearly the case that in that virtual world some people behave inappropriately. You only have to read The Guardian newspapers online "Comment is Free" or Guido Fawkes, the UK's top political blog, to see how appalling, disgusting, racist, misogynist, anti-semitic and just plain thick the general public can be. I am one of those old-fashioned liberals who thinks that the response to bad free speech should be more free speech, not less. I think we should be wary about limiting the anonymity of people who comment online, even if we could think of a way of doing so.

The Nazareth District Court has upheld the right of the Walla Web portal to refuse to hand over the IP addresses of commenters accused of defaming a journalist.

"The good of online anonymity outweighs the bad, and it must be seen as a byproduct of freedom of speech and the right to privacy," Judge Avraham Avraham wrote in his ruling last week.

The court also said the critical remarks concerning Yedioth Ahronoth reporter Israel Moskovitz, posted online in 2008, were unlikely to harm his reputation since they were poorly written and appeared only once, and readers were not likely to take them seriously.

[From Uphold talkbacker's anonymity in defamation trial, court says - Haaretz - Israel News ]

Actually, for journalists to complain about online comments, criticism and even abuse is a tiny bit worrying, since their business depends on such.

It doesn't take long to find articles on CNN that quote anonymous officials. For them to rage against "cowards" who won't stand behind what they say, and then to regularly quote "anonymous" sources, seems pretty damn hypocritical. Phillips claims anonymity online is "very unfair." Phillips also attacks the media for "giving anonymous bloggers credit or credibility." But again, CNN quotes all kinds of anonymous sources all the time.

[From CNN Claims 'Something Must Be Done' About Anonymous Bloggers | Techdirt]

On balance, then, I think a free society not only permits certain kinds of anonymity but actually depends on them, because we need informed and honest public debate to function properly. This was well-put in the Washington Post recently.

For every noxious comment, many more are astute and stimulating. Anonymity provides necessary protection for serious commenters whose jobs or personal circumstances preclude identifying themselves. And even belligerent anonymous comments often reflect genuine passion that should be heard.

[From Andrew Alexander - Online readers need a chance to comment, but not to abuse]

I couldn't agree more. However, as the Post goes on to note, we have to recognise that people can be pretty horrible and we need a way to deal with that. Not banning anonymity, but managing the anonymousness (if there is such a word) in a better way.

The solution is in moderating -- not limiting -- comments. In a few months, The Post will implement a system that should help. It's still being developed, but Straus said the broad outlines envision commenters being assigned to different "tiers" based on their past behavior and other factors. Those with a track record of staying within the guidelines, and those providing their real names, will likely be considered "trusted commenters." Repeat violators or discourteous agitators will be grouped elsewhere or blocked outright. Comments of first-timers will be screened by a human being.

[From Andrew Alexander - Online readers need a chance to comment, but not to abuse]

This -- in essence, baby steps toward a reputation economy -- could be toughened up by using better identity infrastructure, but it's not a bad place to start. But there are areas where the better infrastructure is more of a priority. Newspaper comments are one thing, but there are businesses that depend on online comments, and a good example is the burgeoning group review sector.

There's a general problem with the review sites on the interweb. They are one of the things that the interweb can do well and they perform a very useful social function. But... you can't trust them. If you're looking at a hotel review on a travel web site, how do you know whether the review is "real"? Is it "astroturf", something that looks like a real review but has actually been posted by

Simply making people register their details would be a start, but it would undoubtedly lead to a sharp fall in TripAdvisor's user numbers and its revenue, so it is unlikely to be countenanced.

[From Tripadvisor reviews: can we trust them? - Telegraph]

Many sites (eg, Amazon and eBay) will only let you review things that you have bought through them, which is great, but that doesn't help in the general case, reviewing hotels or doctors or schools or MPs or movies or just about anything else. All of these would like to establish that same baseline (ie, you can't comment on some service unless you have consumed it) but can't figure out a way of doing that would protect privacy (because the reviews won't be honest if people think that they might be tracked down and sued for libel for complaining about shoddy service).

There is way to do this. Remember the old DigiCash technology? Why not build an extension to OpenID so that you can collect tokens from service providers. Then in order to post a review of some service, you have to present the token (in order to prove that you have consumed the service). But the tokens would be cryptographically-blinded.

Here's the marketeture for how to do it. I go stay at the San Francisco Hilton. I'm a member of their loyalty club, so I log in to their web site using OpenID or something. Once logged in, my plug-in generates a random number and blinds it. It then send the random number to Hilton. They know I've stayed, from my loyalty club number (or you could do it from a credit card or whatever), so they use their private key to sign the token, thus forming a digital certificate, which they send back to me. On receiving the certificate, my plug-in unblinds it. Now I have a digital certificate that proves I stayed at the San Francisco Hilton some time in 2010 (say), but no-one (not even Hilton) can link that token to me.

Now I log in to TripAdvisor using my OpenID plug-in. Up pops a menu (based on all of the certificates in my plug-in) asking me to rate the various things, one of which will be the San Francisco Hilton. TripAdvisor can now post the review knowing for certain that I did stay at the hotel. Now imagine this not only generalised -- to movies, doctors and everything else -- but also taken for granted as the way that things work: so that anonymity is valued part of the online interaction landscape.

The NSTIC proposal places no value on anonymity; indeed, it evinces an apparent lack of understanding of what anonymity really means. It takes for granted the need for authentication (if we pay in cash, why does a merchant, much less a common carrier or government agency, need to know about us other than that our money isn’t counterfeit?) and confuses a policy that purportedly restricts disclosure of our identity with actual non-knowledge of our identity.

[From Papers, Please! » Blog Archive » Public says “No” to national cyberspace ID proposal]

If we in Europe decide to develop our own kind of European Strategy on Trusted Identites in Cyberspace (ESTIC) then I think it should not only include both conditional and unconditional anonymity but should strive to make it clear that, like pseudonymity, these types of online persona will be the norm, not the exception.

These opinions are my own (I think) and presented solely in my capacity as an interested member of the general public [posted with ecto]

Comments

[Ian Brown]

Excellent stuff. Although, how do you give Hilton the incentive to do what you propose... Ultimately might require some intervention by the competition authorities.

[Dave Birch]

Yes I realise the barrier. I can't say I've got much further with the incentive problem at the moment, although I wonder if it might be possible to arrange something whereby service providers do this because otherwise they won't get any ratings -- good or bad. As the old saying goes, there's only one thing worse than being reviewed, and that's not being reviewed. Or to put it in Cory's words, it's impossible to monetise obscurity.

[Adam]

On the incentive problem, what if we make it explicit that information is money? Some thoughts at http://emergentchaos.com/archives/2010/10/money-is-information-coined.html

And incidentally, why is my email address required to comment? :)

[Dave Birch]

"why is my email address required to comment?"

I don't know, I'll have a look at the TypePad settings, but rest assured I am happy to respond to pseudonymous comments!