• Home
  • About
  • Blog
  • News
  • Events
  • Media
  • Video
  • Glossary
  • Contact
  • Download
  • RSS

Are universities locking down their PCs?

March 24th, 2009  |  by jz  |  Published in Generativity, university  |  5 Comments

I’ve agreed to be a guest blogger for a little while at the Chronicle of Higher Education.  I’ll plan to cross-post here and there.  My opening question:

I’ve recently written a book about the Future of the Internet (the
paperback version comes out this week).  The argument it makes has a lot
of moving pieces.  One of the first is that the global network we use
offers a fabulous (and by no means necessary) sort of openness, a
“generative” quality that has allowed innovation from many corners and
from people with nicely varying motivations.  So too what has
traditionally been the most common device attached to it: the personal
computer.  Give a PC code and it will run the code.  This basic fact –
so easy to take for granted — is part of what allowed the Internet
revolution.  It meant, for example, that academics could write the first
Web browsers without having to persuade some skeptical gatekeeper of
their virtues.  (Compare with thinking of a new feature you think would
work well on, say, an Amazon Kindle.  Send in a comment card?)

But this openness also creates a special kind of vulnerability,
especially as a generative system goes mainstream.  Lots of people have
PCs without knowing the first thing about the code running on them.  Run
the wrong code and your machine is hijacked — a zombie that can attack
others, disgorge its owner’s personal data, or self-destruct.  And
running code is as simple as a few clicks on or near an icon somewhere
on a Web page.

Without a good defense strategy — one that tries to preserve the core
openness of the Net while still meeting the threat — we’ll see bad
defense strategies.  This is especially so if a worm like the
currently-circulating “Conficker” decides to wreak havoc on the millions
of machines it has compromised (and which silently await further
instructions), and people panic.  One of those bad (but still
rational) strategies is to lock down the PC or abandon it entirely in
favor of locked-down information appliances like Kindle, or hybrid
devices like the iPhone — which allow outside code but only with the
approval of the platform vendor.  We see this in many corporate
environments, K-12 computer labs, libraries, and cyber cafes: PCs that
can only run the software pre-installed by the IT department.  If Skype
isn’t already there, you can’t get it up and running.  Many places even
have Internet or Web filters: certain sites are placed off-limits.

So I’m curious: how much have university environments, normally more
freewheeling, either thanks to ideological commitment or because a lack
of funding makes it hard to hire an obsessive-compulsive IT staff,
started to lock themselves down?  From where you stand (well, type), are
you able to install whatever you want and answer to no one for it?

Responses

Feed
  1. Scott MacLeod says:

    March 24th, 2009 at 5:47 pm (#)

    Here’s the nascent World University and School Wiki – http://worlduniversity.wikia.com/wiki/World_University – a global, virtual/digital, open, free, {potentially degree- and credit-granting}, multilingual university & school
    where anyone can teach or take a class or course. It’s designed in an open way: add a course or take a course. It’s like Wikipedia with MIT Open Course Ware, potentially in all languages and subjects, and for the developing world (OLPC countries, first) and everyone.

  2. Beth says:

    March 24th, 2009 at 7:19 pm (#)

    Here at Oxford, the level of freedom seems to depend on who and where you are. You’re responsible for your own computer, but are expected to have up-to-date anti-virus (expected = the IT staff threaten to eat you, toes first, if you unleash anything onto their network).

    Computers that are owned by the Colleges/Departments, though, are usually pretty tightly locked down, in my experience. Installing anything new is a no-go without permission, and there are more or less strict web filters to block out, *ahem*, certain types of content. In some Colleges, these web filters extend to personal computers on the College network. There have also been blanket bans on things like Skype and iPlayer in many places. I think p2p is pretty comprehensively disallowed.

    You can kinda see the point, though. The average student/academic is very unlikely to know what they’re doing. I can just see some old Classics don thinking that a “Trojan Horse” would be a simply marvellous thing to have on his PC…

  3. Matthias Bärwolff says:

    March 25th, 2009 at 6:35 am (#)

    At MIT, so I am told, you’ll be thrown off the net should your Windows system not have the latest security patches — very reasonable. No issues with Linux systems that I know of. Plus, completely non-discriminatory wireless access for all visitors at CSAIL (save those unpatched Windows boxes).

    What is an PC, open or not, good for if you cannot access the internet without cumbersome registration? This is not so much a philosophical but a purely practical question. E.g., an outsider attending a talk at Berkman will by default not have free wireless access for his laptop whereas museums, etc. do. (Heck, even the MBTA commuter rail has free wireless.)

  4. Andrew Martin says:

    March 25th, 2009 at 5:52 pm (#)

    Yes, I don’t see many locked-down PCs around Oxford. But it is very evident that the network is profoundly locked down in places. I have argued on the IT support list that if, say, Larry Page and Sergey Brin had been Oxford students, Google would have been strangled at birth. There’s no way you could shift through an Oxford college the sort of data they were putting through their dorm – without a summons to visit the Dean.

    I think this is much more problematic than any rise of tethered or locked-down devices.

    On the other hand, universities are in microcosm a picture of the challenge of engineering a right kind of Internet. Campus networks often embody net neutrality, despite carrying everything from IPTV to the student’s bedroom, super-valuable intellectual property from some science labs, finance and personnel data, voice, massive (multi-terabyte or larger) data sets for analysis, and so on. Doing that with good performance and adequate security is a significant engineering challenge. My strong expectation is that campus managers will start to segment networks sometime pretty soon.

  5. Seth Finkelstein says:

    March 26th, 2009 at 5:54 am (#)

    The answer is going to be “it depends”. Places with an experienced and skilled staff (e.g. MIT, Stanford) are likely to be much more open than others.

    This whole debate was gone around in great detail more than a decade ago when the Internet and computers first became common in universities. Go talk to Carl Kadie, who ran the “Computers and Academic Freedom” mailing list back then, if you’re really interested. He collected policies, reports, recommendations, etc.

Blog

  • The end draws near(er) for EchoStar DVRs
  • We’ve previously covered the drawn-out battle between EchoStar and TiVo over EchoStar’s DVR technology, which TiVo claims infringes its patents. The merits of the patent dispute are, as with most, Byzantine, but a jury has found that EchoStar has indeed infringed TiVo’s patents, and appeals courts have affirmed that finding. The key point from an FOI perspective is this: the trial court ordered without any apparent hesitation, by way of remedy, that all of the millions of infringing DVRs—DVRs that are already purchased, reposing in homes, and recording episodes of the Jersey Shore—be zapped via satellite to fix the infringement.  (A few are to be spared at random!)

    This is yet another example of appliances-as-services. The item that used to be yours when you brought it home from the store is now only contingently yours, subject to ongoing regulation. In some ways this is good—particularly if you believe in vigorous patent enforcement—but it seems hard on several million consumers here, and this is a remedy simply not realistically available before the Internet: the patent police don’t knock on your door to seize an infringing mousetrap inside.  Rather, the bad mouse trap company pays damages, as EchoStar is to do here — tens of millions of dollars.

    TiVo has its remedy; not clear what the consumers’ is when their DVRs are fried through the vector of a “feature update,” other than suing a probably-broke company. And, as discussed before, it’s worrisome that exactly this kind of control can be exercised so casually, and in a spectrum of ways beyond total destruction—spying, bricking as a punishment for certain consumer behavior, and so on.

    The latest development in the story, from last week, is that the Federal Circuit has again affirmed that EchoStar needs to destroy the DVRs. The court didn’t directly review the merits of the order, but rejected EchoStar’s narrower claim that the order should be construed to allow other remedies other than remotely disabling the DVRs.  EchoStar’s delay in implementing the bricking has resulted in a finding of contempt of court.

    What’s really striking about all the different court orders was how totally unconcerned they were with the novelty and arguable unfairness of the remote-disablement solution. The district court’s order just asserted, without discussion, that the disablement order was appropriate. (“The hardship of disabling DVR capabilities to Defendants’ DVR customers is a consequence of Defendants’ infringement and does not weight against an injunction…The public has an interest in maintaining a strong patent system.”) The Federal Circuit didn’t say much more, asserting that “We find the manner in which the disablement could be accomplished irrelevant to the issue at hand.” Moreover, the Federal Circuit actually rejected EchoStar’s argument that it could just remotely change the parts of the technology that infringed, leaving the DVR players intact generally—the court simply said that wasn’t the point of the disablement provision. One might understand why the Federal Circuit didn’t want to (or couldn’t) jump in with a broad equitable rewrite of the disablement order at this point, but the blasé treatment of a seemingly more reasonable solution was startling. The public may have an interest in a strong patent system, but we haven’t really had a chance yet to weigh whether that means innocent customers have their products disabled: that technology is still new.

    It’s worth noting, though, that EchoStar has thus far defied the disablement order, and has been hit with $90 million of contempt fines instead. Complex procedural rules make it difficult to predict how this will all turn out, but EchoStar could just hold out on this, paying contempt fines into bankruptcy. Or TiVo and EchoStar could negotiate a settlement. So we’ll have to watch to see whether any DVR units actually are fried. In the meantime, what I take away from this case is that we can expect more cases like this in the future, and for parties and courts to fully accept and exploit these characteristics of tethered appliances.

    —By EO + JZ

  • FOI Topics and Links of the Week
  • A roundup of happenings that bear on the issues in The Future of the Internet –

    Canadian Android Carrier Forcing Firmware Update. A Canadian carrier wanted users to download a firmware upgrade that fixed a glitch prohibiting users from dialing 911, so it made the upgrade mandatory. Seems reasonable. But it bundled in an update that “prevent[ed] users from ever gaining root access to their phones.” Sneaky—one more way that contingent generativity really is contingent, even for savvy users.

    Biggest Mobile Operators Join Forces On App Store Project. A few dozen mobile operators have come together to try to create a mobile developer’s dream: a set of standards for applications that would work across phones and mobile OSes, and a single app store (with a single approval process) in which to sell those apps. This could be a good thing if it worked—developers might have more say in big-picture application development, and single carriers or hardware manufacturers would have less ability to be a development chokepoint. (It would also be nice for consumers, generally making the smartphone world look more like the PC world.) I’d be more excited if efforts to create uniform mobile standards weren’t so difficult and historically so unsuccessful.

    Demand for Android Phones Makes “Monstrous” 250% Jump. Another developer’s dream (perhaps), Android, is seeing significant growth. “Android has finally caught consumer interest,” according to a research firm. Also, Android users are almost as happy as iPhone users with their phone (72% to 77%).

    Big Brother Is Here, Families Say. This story is so bizarre, I don’t know what to make of it. A school in Philadelphia gave out laptops without telling the students or their families that the cameras could be remotely activated. The idea was to use the cameras if the laptops were stolen, but one family claims a camera was used to spy on a student. If true (details are cloudy), that would (a) be mind-bogglingly dumb on the school’s part, and (b) reminiscent of this (ubiquitous cameras) and this (remote activation) in the book. Check out the Onion’s take here.

    Microsoft takes the StopBadware Approach Further. Last week, MS obtained a restraining order to deactivate 277 domain names it had linked to the Waledec botnet. Severing the connection between drones and the mothership goes beyond tactics employed by the Google/StopBadware Project.  It effectively makes the targeted websites invisible, instead of slapping a prominent warning label on them. Although MS attempted to cut off only addresses used exclusively for spam, it appears that the single U.S.-based target may be a legitimate site, if a hapless drone.  While owners have the opportunity to reclaim their addresses, MS’s actions raise questions of proportionality and whether cooperation and information-sharing between prominent Internet denizens, such as MS and Google, if possible, would result in more efficient and just solutions. Their approach also highlights the tension between the need for secrecy to effectively attack the spam network and the notice usually required prior to legal action.

    One step behind. Thesixtyone.com, a site that allows the public to listen to, rate, and buy largely indie music, is looking for a hacker that can break up the bot-powered voting rings seeking to game their democratic rating system.  A laudable goal, but one spammers have already begun to circumvent by using real people instead of bots.

    Passing through the cloud. Katherine Boehret recently reviewed Pogoplug, a device that makes files web-accessible without actually storing them in the cloud.  While this type of solution doesn’t address data-portability concerns surrounding extraction of personal data in usable form – to allow seamless transition between social networking sites, for example – it does let the user to maintain more control over data instead of entrusting it entirely to the cloud.  This control prevents third parties from holding data hostage and from losing, allowing government access to, selling, or mining personal information; but users can still access their files from almost anywhere.

    Please think twice. A website launched last week illustrates the risk of publicly sharing information online.  Pleaserobme.com aggregates Twitter posts that contain location-sharing information from Foursquare in a chronological list to show the potential for exploitation by Internet users with malicious intentions.  While it’s probable that only a small set of burglars will take advantage of this information, the site is an example of a grassroots campaign to raise awareness of potential problems for users who don’t recognize how the information they freely give can be mined.  Whether this awareness leads them to alter their behavior or simply “get over it” is up to the individual.

    Facebook messaging glitch. A subset of Facebook users experienced firsthand the risk of entrusting control of personal messages to third parties.  Last Wednesday, FB accidentally sent the private messages of a “small number” of users to strangers instead of the intended recipients.  Unlike well-publicized security breaches of credit card companies and banks, the misdirected messages were largely personal in nature and contained little identifying information, so the risk of actual injury is low.  But that may not be very comforting to those who had intimate details divulged to strangers.  Some of the accounts indeed provoke a gut-level enquiry as to how privacy violation should be measured.  On the flip-side, the occasional misrouting of a letter by the Post Office doesn’t give rise to much concern – and in that case the sender is usually clearly identifiable – so why should electronic mail be afforded greater scrutiny?

    —By Jennifer Halbleib and Elisabeth Oppenheimer

  • FOI Topics and Links of the Week
  • AppMakr Transforms App Store Landscape, Enables Anyone To Make Their Own iPhone App. Gagan Biyani raves about AppMakr, a product that allows anyone to make a simple RSS-based iPhone app for $199. The company will even submit the app to the App Store. (So, for instance, Biyani put together an app that aggregates all of MobileCrunch’s offerings.) The comments on the article are worth reading — one person says that “these types of startups definitely bridge the gap between idea people and actual phone developers,” and others consider how this will change the App Store.

    Mike Petrucci’s AppMakr Saga. Mike Petrucci decided to use AppMakr to put together an app aggregating his Twitter, blog, etc, feeds…only to have Apple reject it because it wasn’t of general interest. That’s a big difference between iPhone apps and, say, web apps (blogger has definitely never rejected someone for being of limited interest). It’ll be interesting to see what line Apple decides to take on this, and how AppMakr and similar companies push them.

    Apple orders Android mention scrubbed from App Store. Speaking of Apple…they order a developer to take “Finalist in Google Android’s Developer’s Challenge!” out of the description of its app. Just silly.

    In Europe, Challenges for Google. Much attention has been paid to Google’s business in China, but Europe (particularly Italy) poses difficulties, too—different copyright laws, different privacies laws, and different free speech traditions.

    Google Buzz Privacy Issues Have Real Life Implications. However, Google has more pressing privacy concerns to worry about this week, with the rollout and reaction to Google Buzz. Google generally does just fine releasing a half-baked product and cleaning up the details later, but that’s a terrible idea when the rollout includes auto-sharing previously private information. It’s disturbing that this concern made it past however many rounds of internal testing Google did.

    —Elisabeth Oppenheimer

  • JZ on the iPad
  • JZ has recently pondered the iPad in a column in the Financial Times. Some excerpts of his thoughts…

    First, he begins with a quick history of the subtle but massive shift between the Apple II and the iPhone:

    In 1977, a 21-year-old Steve Jobs unveiled something the world had never seen before: a ready-to-program personal computer. After powering the machine up, proud Apple II owners were confronted with a cryptic blinking cursor, awaiting instructions.

    The Apple II was a clean slate, a device built – boldly – with no specific tasks in mind. Yet, despite the cursor, you did not have to know how to write programs. Instead, with a few keystrokes you could run software acquired from anyone, anywhere. The Apple II was generative. After the launch, Apple had no clue what would happen next, which meant that what happened was not limited by Mr Jobs’ hunches. Within two years, Dan Bricklin and Bob Frankston had released VisiCalc , the first digital spreadsheet, which ran on the Apple II. Suddenly businesses around the world craved machines previously marketed only to hobbyists. Apple IIs flew off the shelves. The company had to conduct research to figure out why.

    Thirty years later Apple gave us the iPhone. It was easy to use, elegant and cool – and had lots of applications right out of the box. But the company quietly dropped a fundamental feature, one signalled by the dropping of “Computer” from Apple Computer’s name: the iPhone could not be programmed by outsiders. “We define everything that is on the phone,” said Mr Jobs. “You don’t want your phone to be like a PC. The last thing you want is to have loaded three apps on your phone and then you go to make a call and it doesn’t work any more.”

    The openness on which Apple had built its original empire had been completely reversed – but the spirit was still there among users. Hackers vied to “jailbreak” the iPhone, running new apps on it despite Apple’s desire to keep it closed. Apple threatened to disable any phone that had been jailbroken, but then appeared to relent: a year after the iPhone’s introduction, it launched the App Store. … But the App Store has a catch: app developers and their software must be approved by Apple. If Apple does not like the app, for any reason, it is gone.”

    This blog has covered many of the apps that Apple has axed: the countdown to Bush’s departure, the app with information about health care, BabyShaker, religious spoofs, and programs to redirect calls, Google Voice, and I am Rich, among many others.

    But the lingering question is, so what? Is the world really worse off because we can’t pay $999 for an app that does nothing (I Am Rich), especially given that Apple’s screening system does get rid of many apps with security problems? Is this like First Amendment absolutism — a preference for open systems that doesn’t take into account actual costs and benefits?

    In response, JZ tries to imagine what we would have lost had the PC been as appliancized as the iPhone:

    To be sure, many rejected apps will not be missed. (Only eight spendthrifts bought I Am Rich before it disappeared.) And users can be protected from harmful software from suspect sources. But consider: the world wide web started as, and remains, an app. Its first versions were written by Tim Berners-Lee, a British computer scientist who was unaffiliated with any software or hardware vendor. How worthy of approval would Wikipedia have seemed when it boasted only seven articles — dubiously hoping that the public would magically provide the rest? How threatened might today’s content publishers feel by peer-to-peer apps that let iPhone users trade data from one phone to another? We know the answer to that: enough that they have persuaded Apple to exclude all such apps from the App Store.

    The web, Wikipedia, p2p — that’s a lot to lose. And at the same time we lose those benefits of generativity, as JZ points out, we give companies (and through them, governments) unprecedented censorship power. But the iPod, Pad, and Phone aren’t going anywhere. JZ concludes:

    Hope lies in more balanced combinations of open and closed systems, such as that embodied by the traditional Apple Mac – or phones based on the Android operating system from the Open Handset Alliance, a consortium of hardware, software and telecoms companies. Android Market is the approved counterpart to Apple’s App Store but, in this case, users are also free to go off-roading, installing any code they like. Android is a canary in the digital coal mine: will its more open model survive should people load suspect apps and find they cannot make calls any more?

    Mr Jobs ushered in the personal computer era and now he is trying to usher it out. We should focus on preserving our freedoms, even as the devices we acquire become more attractive and easier to use.

    —By Elisabeth Oppenheimer

  • FOI Topics and Links of the Week
  • The Extraordinaries Haiti Earthquake Support Center. A followup post on the Extraordinaries’ efforts to use ubiquitous human computing to help find missing people after the Haiti earthquake — a positive vision inspired by JZ’s nightmare scenario of crowdsourced secret police work. Did they succeed? “Yes and no”—but, as they detail, there’s obvious potential for future disaster relief.

    Amazon Cracks Open the Kindle. Amazon is opening the Kindle to outside developers who can market their products in what sounds exactly like an App Store, down to the 70-30 revenue split and and light policing of apps. (One difference is that developers have to pay for wireless delivery.) It’s seeming like this is *the* model for the next few years. Speaking of which…

    Computers Should Be More Like Toasters. The sale of the Apple Tablet could mark an important moment for generativity. Computers have been shrinking and phones have been growing—but the critical difference has been that anyone could still code for a computer, until now. The Tablet looks more like a computer than a phone, but will Apple will prescreen apps they way it does for the iPhone? Farhad Manjoo thinks that would be a good thing, but there are clear generativity costs.

    The Splinternet means the end of the Web’s golden age. Josh Bernoff points out that, as we switch to appliancized computers and smart devices instead of PCs, the web becomes a “splinternet.” Websites show up and operate differently on each device. He thinks about how to handle this from a business and marketing perspective, advising: “Here’s what not to do: panic and try to unify things again. The shattering cannot be undone.”

    Technology Changes “Outstrip” Netbooks. Meanwhile, the BBC considers the convergence among netbooks, smartphones, and tablet notebooks, and who the short- and long-term winners are likely to be.

    Apple censors Dalai Lama iPhone Apps in China. An interesting look at how censorship works on iPhones in China. (The story was written pre-Google announcement, so some portions are out of date.) Apple, complying with local law, appears to be removing apps related to the Dalai Lama in the Chinese App Store, and a search for Falun Gong apps freezes the search page. On the other hand, it’s possible to access YouTube through an iPhone app, which isn’t always possible on a PC.

    And in the crystal ball dep’t — from JZ’s book:

    Imagine entering a café in Paris with one’s personal digital assistant or mobile phone, and being able to query: “Is there anyone on my buddy list within 100 yards? Are any of the ten closest friends of my ten closest friends within 100 yards?” Although this may sound fanciful, it could quickly become mainstream. With reputation systems already advising us on what to buy, why not have them also help us make the first cut on whom to meet, to date, to befriend? These are not difficult services to offer, and there are precursors today.

    As usual, there’s an app for that… the “datecheck” app allows you to enter a name, phone number, or email address, and get information on your date. The categories are “sleaze detector” (check of criminal convictions & sex offenses), “$$$” (home ownership, etc), “interests” (gleaned from social networks), “living situation” (who they live with), and “compatibility”—although unfortunately, the “compatibility” check is still just a check of astrological signs. Now all they need is friends’ feedback rankings.

    —By Elisabeth Oppenheimer

About Jonathan Zittrain

jonathan zittrain

Jonathan Zittrain is Professor of Law at Harvard Law School and co-founder of the Berkman Center for Internet and Society at Harvard Law School

RSS Tweets from Z

  • An error has occurred; the feed is probably down. Try again later.

Blog Archives



Creative Commons BY-NC-SA Jonathan Zittrain unless otherwise noted.
Powered by WordPress using Gridline Lite.