Nathaniel Fruchter

Thoughts on risk communication

Sat, 22 Jan 2022 00:00:00 -0600

Risk communication

“…when [people] see experts failing, laypeople can effectively assert their desire to affect both personal and political decisions. These battles for control may not be quick or tidy processes. […]

Once specialists lose the trust needed to serve as credible sources, the public’s learning process becomes much more complicated. Laypeople no longer know where to go for information. Their interactions with risk specialists may be colored by emotional reactions by all parties.”

Sound familiar? Let’s take a minute to talk about communicating risk. The above quote isn’t a recent retrospective on the coronavirus pandemic. Instead, it’s from Risk Communication: A Mental Models Approach, a 2002 guide to the discipline.

With various regions in the US potentially going back under some sort of lockdown or “stay at home” order, there’s been a resurgence in people talking about openly flouting restrictions of various kinds. How did we get to this point?

To address the elephant in the room: we can’t ignore the many systemic failures of governance here in the US. For instance, the false choice between public health and the economy (partially driven by the lack of any substantial stimulus or financial backstop by the federal government) is a commonly stated reason to ignore restrictions. Cynicism and a lack of trust also contribute—”why should I comply,” you might ask, if our leaders are ignoring their own messages?

The original table, from Atman, C. J., Fischhoff, B., Bostrom, A., Morgan, M. G., Fischhoff, B. (2002). Risk Communication: A Mental Models Approach

What if we zoom in a bit further from these macro issues, though, and look at some other contributing factors? I think our risk communication shortcomings are certainly up there. Broader public health issues like supply chain failures and hospital capacity rightfully remain in the headlines.

But—and I believe equally importantly— discussion of risk communication has remained under the radar, generally limited to academic comment.

What missteps did we make along the way? Let’s revisit the risk communication guide I mentioned at the beginning. A table from the book, reproduced from an earlier 1995 article by Fischhoff, makes for a good place to start. It traces the evolution of a communication project over time. The examples in the table are framed around the acceptance of a risk, but the same principles work the other way around for our current pandemic moment. Let’s take a look at few of the “stages” he highlights in this process.

Stage 1

“All we have to do is get the numbers right.”

It’s February 2020. Those of us in the US are becoming more aware of the effects of the pandemic in China and parts of Europe, but the federal government in the US is downplaying the threat.

Similarly, the U.S. Surgeon General initially downplays the importance of masks at the end of February. Perhaps it was a misconception, or perhaps an effort to save supplies of critical PPE with a heavily burdened supply chain at the time.

As the table states: “If risks are well managed […] then no one may ever be interested in hearing about them.” With the benefit of hindsight, we know that this was wishful thinking and that critical time was lost.

The table goes on: “…if [the strategy] fails, then people may ask awkward questions about the long silence. Was something being hidden? Or did the experts just not care?” That’s, unfortunately, a bit more like it.

Stages 2 and 3

“All we have to do is tell them the numbers” and “All we have to do is explain what we mean by the numbers.”

Governor Cuomo’s slide briefings were actually a pretty bright spot when it came to communicating risk.

It’s March, April, and May. The pandemic has hit the US. It’s in full swing as the first wave sweeps across various parts of the US—first Washington and New York, then a quick progression elsewhere.

Political leaders emphasize the importance of doing your part for your city or state. We’re inundated by numbers and curves. Case counts, positivity rates, death rates, and hospital capacity statistics all come up as justifications for how we need to collectively respond. They’re explained by governors, mayors, and the rare federal spokesperson (basically, Dr. Fauci). Often, these numbers aren’t even risk assessments, but are instead raw statistics. Yet:

“Numbers alone do not tell the entire story about risks. Often, people need to understand how a risky process works, in order to devise strategies for dealing with it or to feel competent to follow public debate.”

Unfortunately, many communication methods are stuck here years later.

I’m no expert in the field and I don’t have any big ideas for those in our hospitals, governments, and newsrooms. However, I think we’d do well to consider our prior experience communicating about the pandemic—and, yes, our prior experience defining the entire field of risk communication.

On Facebook's most recent privacy debacle

Wed, 19 Dec 2018 00:00:00 -0600

The bottom line here: Facebook did curtail access to profile information after 2014 (see the Cambridge Analytica scandal). But — and this is a very important qualifier — they did so for developers with access to the public API. The breaking news from the New York Times is that “special partnerships” with other large tech companies were not subject to the same controls.

What does this mean?

Functionally, I think, we find ourselves in a similar situation to Cambridge Analytica — perhaps with better-intentioned actors on the other end. I’ll claim the real concern here is not that Facebook let this data go (it was bound to happen). Instead, it’s that the data is out there and we’re not really sure how to track its travel after it leaves FB’s metaphorical gates. We don’t know what exactly happened to the data once it arrived on the systems of Bing, Yahoo, Netflix, Spotify — and the 144 other companies that had partnerships.

Even if we put complete faith in all 150 companies and believe they never misused the data, we’ve seen that these savvy companies are not immune to security incidents or breaches. (On top of everything else, this is a pretty charitable interpretation of the problem; the Times cites data sharing agreements with “automakers and media organizations”, not paragons of good cybersecurity.)

The core of this issue? We have no idea how the data — perhaps used to train machine learning models or generate features that make their way to advertisers — will trickle out in various transformed and aggregate forms. The relative difficulty of finding out where valuable pieces of data have gone—likes, messages, public and private communication—makes it hard to quantify the potential harms of this policy.

To be frank, I wouldn’t be surprised if the majority of data didn’t go anywhere: I’m sure most of the private messages that Spotify could theoretically access were never accessed and that much of the data they had for legitimate reasons has stayed on their servers. However, even if one subset of private data from an obscure automaker’s infotainment systems gets hacked or misused, there has been harm done. This is of the same fear that we had about CA: sure, they may have used it for unsavory political stuff, but we don’t know how they post-processed, combined, sold, or transformed our data afterwards. Did it get aggregated and further sold to advertisers? Perhaps peddlers of foreign influence? Or, more charitably, is it languishing unused on a server?

Facebook’s Response

There’s also the small matter of the Federal Trade Commission’s 2011 consent decree which barred Facebook from sharing user data without “explicit permission.” Facebook’s current argument is that partners are extensions of the Facebook platform and therefore sharing wasn’t subject to terms of the decree. In a recent blog post on the subject of partnerships, they state:

Our integration partners had to get authorization from people. You would have had to sign in with your Facebook account to use the integration offered by Apple, Amazon or another integration partner.

On the subject of access to Facebook messages, they also state:

[P]eople had to explicitly sign in to Facebook first to use a partner’s messaging feature.

They also discuss their Instant Personalization feature which allowed select partners to reference part of your Facebook social graph in their own products, calling it an ability for you to “see public information [your] friends shared” embedded in other services.

Across these contexts, I believe Facebook’s argument about the irrelevance of the consent decree is weak. While it’s true that users are taking a concrete action to link a service to Facebook when logging in with their credentials, I’m not convinced that this substitutes for affirmative consent. Users’ perceptions of their data flows does not always align with the realities of the underlying technical systems, and it’s not clear that users were made aware of the fact that data flowed through third parties—even if the data was never stored. With the right line of argument, this could certainly be argued in court as a violation of the consent decree.

Trust and Consent

I also believe that this is an indication that we need to be mindful when we discuss consent and data. Consent for handling of data is much different than consent for collection of data. Platforms—and users—have been conflating the two for a while. An unrelated story from Buzzfeed on the sharing of Facebook advertising identifiers touches on this:

A Facebook representative clarified to BuzzFeed News that while it enables users to opt out of targeted ads from third parties, the controls apply to the usage of the data and not its collection.

Is this the right model to be using for consent? The European Union’s GDPR approximates this split by differentiating between data controllers and processors, but we have no such definition here in the U.S. outside of certain specific sectors. I think there’s a lot of thinking and work to be done here, especially on the subject of these fine-grained consent questions.

Finally, there’s the matter of trust. This is their 4th or 5th major breach of trust in less than two years. I’m sure FB will always have a lot of staying power due to platform effects and its insane critical mass, but I have to wonder what the tipping point is. Will there be calls for regulation? Personally, I’m in favor of forcing Facebook to bust open its walled garden and forcing it to interconnect with outside systems on kinder terms. At the same time, though, others are calling for it to be broken up antitrust style — and I think they may have a point too.

Net neutrality, bots, and the FCC

Tue, 02 Jan 2018 00:00:00 -0600

Net neutrality, bots, and the FCC: a retrospective

Spoiler alert

December 14th, 2017: The FCC voted. There are 23 million comments on the docket. How has our conversation about net neutrality shifted? What lessons does that hold for our future? Here are some collected thoughts on three things: how we’ve talked about net neutrality, how we’ve misunderstood “bots”, and how the comment process may need to evolve.

(For those just tuning in, here’s a quick primer on what happened.)

Part 1: How We Talk to the FCC

1. What does net neutrality mean to us?

It goes without saying that the FCC’s actions have ignited a firestorm. Our discussion of net neutrality has far surpassed its original technical and legal context. Those talking heads on CNN weren’t arguing over the finer points of the Communications Act of 1934.

Instead, net neutrality has become a byword which means many things to many different people. In no particular order, it has become a stand-in for:

our abstract idea of the “Open Internet”
consumer dissatisfaction with telecom monopolies
job creation and infrastructure investment
support for entrepreneurship and American competitiveness
influence of money in politics
related battles over privacy, surveillance, and online freedom
fake news and “bots”
worry about Russian interference in United States affairs
pushes for government transparency
how the government and public interact
not least of all, an ugly proxy battle with a Trump Administration appointee (specifically, Ajit Pai)

The list goes on. We have to recognize that there are dozens of separate discussions occurring. First, we have the technical and legal issues surrounding Title II reclassification. Second (through tenth, or twentieth) we have these adjacent conversations about policy, economics, and politics. At the bottom of the stack, there remains the larger issue of how we engage with our policy process — and how the Internet is shaping that.

I believe that last one is a question that we’ll be returning to again and again.

2. How should we view the FCC’s comment process?

According Jeff Kao, “More than a Million Pro-Repeal Net Neutrality Comments were Likely Faked.” Or, from the Washington Post: “FCC net neutrality process ‘corrupted’ by fake comments and vanishing consumer complaints, officials say.”

Is this a problem? Let’s examine why someone would think it is — or isn’t.

Viewpoint A: Public comment is working fine.

“As I said previously, the raw number is not as important as the substantive comments that are in the record,” Pai said. “We want to weigh all comments and make sure that we take a full view of the record, and again make the appropriate judgment based on those facts and the law as it applies.”

Why does the public comment system exist in the first place? The FCC is an expert agency and uses the public comment process to solicit alternative viewpoints and analyses it may not know about or have considered. Opportunity to comment during a Federal agency’s rulemaking process is a broad requirement of the 1946 Administrative Procedure Act.

The FCC makes a lot of rules, so most dockets are about relatively niche telecom issues. For example, take 17–239 “Inquiry Concerning 911 Access, Routing, and Location in Enterprise Communications Systems”: there are under 30 filed comments, all of which are from industry, government, or academia. This is the use case that the FCC built its comment process for. This is also the reason why Chairman Pai was able to factually state that the “raw number” of comments is not important: the FCC isn’t under any obligation to equally weigh the comments it receives.

In other words, the FCC’s comment system was not built to be a public opinion poll. It was built to solicit very specific types of feedback and analysis. It seems to be doing a fine job of that.

Viewpoint B: But it is a problem!

“Before my fellow FCC members vote to dismantle net neutrality, they need to get out from behind their desks and computers and speak to the public directly. The FCC needs to hold hearings around the country to get a better sense of how the public feels about the proposal.” — FCC Commissioner Rosenworcel

While the comment process may work in a narrow scope, we’ve seen a lot of issues manifest themselves on the net neutrality docket. We need to think about how the comment system can evolve to serve the public in new ways.

First, we have a gap in perception between how the FCC thinks the comment system should work and how the public thinks the comment system actually works. The FCC thinks that the status quo “expert alternative viewpoint” model is sustainable. However, the public thinks the process should be more like an opinion poll and reflect popular sentiment. Therefore, they feel like they’re being denied a voice in the process and that the FCC is turning a blind eye.

Second, we need to ensure that the FCC is not ignoring legitimate requests to correct the record or obtain information. The Commission’s reticence in dealing with the New York Attorney General’s fraud investigation and alleged reliance on technical inaccuracies in its regulatory argument are worrying. A flawed rulemaking process leads to flawed rules: this is something I hope we can agree on, regardless of ideology.

Finally — of course — we need to make sure that individuals’ identities aren’t being borrowed (to put it diplomatically) and attached to statements that aren’t their own. The fact that individuals or groups have done this throughout the comment process indicates they think sufficient commenting firepower will be sufficient to sway the public or media discourse about the subject. Whether or not that effect actually holds is up for debate. However, it does indicate we need to examine the incentives (and legality) around this kind of behavior.

3. So, has the comment process been “corrupted”?

The argument for “no”: The core mechanics of the FCC’s comment system have not been broken. If we agree that the FCC’s existing processes are sufficient for the specific purpose of providing alternative viewpoints into the rulemaking process, there has been no corruption of that process.

The argument for “yes”: It’s not corrupted, but it’s certainly fraying at the edges. Even if the process is working for the vast majority of issues, that’s not sufficient. We have a disconnect between how the public and FCC view the process. We also have bad incentives at play: It’s hard to claim that a process that allows for criminal impersonation is totally sound. Finally, we have institutional issues at play with the FCC if it does turn out that those technical inaccuracies are core to the logic of the current rule-making.

As issues of telecom and Internet policy loom larger in the public consciousness — and as they unavoidably become politicized — we need to find better outlets for engagement and opinion to filter into the FCC’s policy processes.

Part 2: Bots — A Quick Aside

The use of bots during the comment period has gotten a lot of play in the media. Are bots bad? And how do they affect how we think about the future of public comment?

1. What is a bot?

First, though, we need to clarify what exactly a “bot” is in this case and why it’s different from other bots you might be familiar with. Here, I’m going to define a bot as a “program designed to automatically post comments in bulk to the FCC’s systems.” Note there is no value judgment attached to this definition: it’s purely technical. Why?

Generally when we talk about bots, we think about automated actors playing in a space that was created for humans to interact in. Think about bots in online gaming or “fake news” bots posting on Facebook. In both cases, there’s the assumption that the (gamer / poster) is a human and that the person using the bot will gain an unwanted advantage in (winning / spreading information). Here, we agree bots are bad because you’re playing a human system with a computer that presents itself like other humans.

This is not the case with the FCC’s Electronic Comment Filing System (ECFS). The ECFS was designed from the outset with an API — an interface that lets programs automatically interface with the ECFS. In fact, the FCC conveniently provides documentation for developers to… wait for it… automatically file comments in bulk.

2. Are bots bad?

Technically, this is a bot. Run it in a terminal and you can file a comment.

The FCC’s API has very few limitations and a very light amount of internal rate limiting. Because of this, we’re working in a different space than Facebook or Counter-Strike where the platform was designed for humans first. It’s often said that a system’s design shapes the behavior of its users. In this case, FCC’s decision to tilt towards frictionless comment has enabled a whole host of unforeseen, automated uses of the system.

Not all bots are bad.

It’s no surprise that there are bots filing comments because that’s what the FCC wanted. In fact, it’s hard to argue that the open design of the ECFS hasn’t been good for advocates on both sides of the debate. Interest groups have created numerous websites that automatically file comments with the FCC creating an unprecedented level of engagement. You wouldn’t be seeing the explosion of “make your voice heard!” campaigns and sites without the underlying ECFS infrastructure.

Of course, the ECFS’ open design has also allowed researchers and other interested parties to download, analyze, and understand the comment process at a very deep level. This is a good thing.

…but they can be, depending on intent.

Remember the mention of the New York Attorney General’s Office and their investigation into fake comments? That came about because several researchers discovered a disturbing pattern: many individuals’ names and identities were being attached to comments that they did not make. This is undeniably a Bad Thing. Individuals’ names should not be on the public record attached to opinions that they did not state.

It’s important to remember: there is no technical difference between a “good bot” and a “bad bot” here. The same code that a developer uses to automatically file comments from an EFF or AT&T campaign could also be used to file fake comments with fake identities attached. It’s just a matter of switching out the database or spreadsheet.

Part 3: What’s Next?

The frictionless comment infrastructure that the FCC built has enabled bad actors to stuff that infrastructure with fake identities and fake documents. That’s not a sustainable path for public comment; I don’t believe so, the New York Attorney General doesn’t think so, and neither do dozens of Senators. At the same time, we don’t want to throw away the civic benefits of a platform that allows for open engagement.

We need to think about a core question: How do we disincentivize these bad-faith acts on the comment system while still maintaining an open-enough infrastructure to enable the good?

Good bot, bad bot? There were 7.5 million identical comments stating “I am in favor of strong net neutrality under Title II of the Telecommunications Act.” Those under the True column used a throwaway email domain. (log scale)

Striking the right incentive balance is a design and policy question that the FCC — and likeminded agencies — need to strongly consider as they create systems for public engagement. Should known bad comments be discarded, de-ranked, or ignored? Should there be a burden of proof for claimed identities attached to comments? How about not-good-but-not-bad grey areas, like the 7.5 million identical comments that used throwaway emails?

We may want to augment the existing comment process by equipping the FCC with the tools and expertise it needs to characterize the massive amount of comments it has received. This works towards the current “deluge of data” problem and embeds extra, necessary capabilities within the FCC’s institutional structure. It would also equip the FCC with the tools it needs to begin addressing the issue of stolen identities mentioned above.

On the other hand, augmentation presents a short-term solution to a long-term problem: we should be thinking more holistically about interaction with agencies like the FCC. Expert commentary and analysis is invaluable during the rulemaking process, we should make the effort to understand how the public can and should provide input into the process. Whether this is through existing mechanisms like public hearings and listening tours or through a more elaborate process, tweaks to the process deserve some thought.

This doesn’t sound familiar at all.

We also need to think about what lessons we might draw from the net neutrality comment process. A recent Wall Street Journal investigation found a large number of comments on a Department of Labor rulemaking were attributed to individuals whose identities were “borrowed” for the comment. These Labor proceedings aren’t on the scale of the net neutrality ones and contain thousands, instead of millions, of comments. However, the article lets us revisit the idea of incentives and system design. Someone was sufficiently motivated to file fake comments and the frictionless nature of the system’s design allowed them to with a minimum amount of fuss.

What about the comment system’s technical design allowed this to happen? What incentives were at play? Why did the commenter think that “stuffing the ballot box” with comments would help their position, either in the regulatory world or in the broader public discourse? As with the ECFS, these questions should be thought and investigated.

To wrap up, though: whatever the future of public comment holds, all of this drama surrounding the net neutrality comment process is quite telling. Whether it’s the FCC, Department of Labor, or something else, we’re not going to be going back to a world where these niche policy debates will be conducted on purely technical or legal terms. We — both as individuals and as our government — need to be prepared for that new reality.

The FCC is still getting a lot of automated net neutrality comments

Tue, 16 May 2017 00:00:00 -0500

The FCC is still getting a lot of automated net neutrality comments

Part 1 is here: https://medium.com/@nhf/whats-up-with-all-of-those-identical-comments-on-the-fcc-net-neutrality-docket-105835f59c3e

A quick update: I have pulled down more data, including all comments as of 6PM EDT on May 15th. If you’re feeling adventurous, data about real-vs-automated comparisons are welcome!

We can see that the FCC is still getting hit by the same automated comments (“…unprecedented regulatory power the Obama Administration…”).

There are now roughly 3.5 times more, about 440,000 / 1.48 million total, as compared to 128,000 on May 11th.

Here is an updated version of my heatmap. Compared to May 11th (the last time I gathered data), we can see not much as changed… except there isn’t a large hole around Maryland any more.

Obviously, the magnitude of comments that aren’t automated is still larger, hence the denser heatmap. (Bottom: identical anti net-neutrality comments; top: all others)

The batch posting of comments is also more clear now.

Top: automated comments. Bottom: other comments.

This unconventional scatterplot shows that automated comments were posted in large batches over time. Other comments are distributed more evenly (with the exception of site outages).

Still, crucial questions remain:

1. Who did the filings and why?

2. Where did they acquire the identities used?

3. Did people consent to the use of their identity?

a. Was use of the identities proper or legal?

4. Did the FCC foresee abuse of their comment system?

5. Will the FCC handle the impacts of comment system abuse on their decision making process?

What’s up with all of those identical comments on the FCC net neutrality docket?

Thu, 11 May 2017 00:00:00 -0500

What’s up with all of those identical comments on the FCC net neutrality docket?

I don’t want to bury the good stuff, so click here for all 128,946 identical comments in a GitHub repository.

[5/16] I guess this is a series now. See part 2 for more data: https://medium.com/@nhf/the-fcc-is-still-getting-a-lot-of-automated-net-neutrality-comments-c7dff56d2563

——————

Ars Technica says:

The FCC this week has received hundreds of thousands of new comments on its proposal to dismantle net neutrality rules, and more than 128,000 of them are identical comments calling for the reversal of the Obama administration’s “power grab.” It seems likely that the influx of anti-net neutrality identical comments is coming from a bot, but the FCC hasn’t addressed the matter publicly yet.

The FCC’s electronic comment filing system (ECFS) has been going up and down like a rollercoaster ever since John Oliver encouraged viewers to file comments in support of net neutrality. However, if it is up, you can verify this statement for yourself:

Yes, those are all the same.

The words themselves may have come from a conservative think tank, but the group denies filing comments under the names of others. At this point, I was itching to find out more about this. Where did all the fake identities come from? Some of them have email addresses; all of them have postal addresses. Was the phrasing identical in all of the docket filings? Could there be another explanation?

Luckily, the ECFS has an API (thanks, Obama!) that I could use to search the docket and grab all filings that matched the boilerplate. Here’s the code for doing it. (You’ll need your own API key, which is free.)

Let’s answer some questions

Are all the filings identical?

Pretty much. There are 30 unique filings that contain the boilerplate within a larger text (most of them were, not surprisingly, complaining about spamming of the boilerplate). The rest are substantively the same. If you want to get technical, there are 128830 with the boilerplate and 120 with the boilerplate with added newlines.

Was the bot dumb enough to file thousands of comments in alphabetical order by first name?

Yes.

A substantial chunk were filed alphabetically by first name on May 9th within milliseconds of each other. They even sorted out uncapitalized names from capitalized names!

This consists of roughly 53,000 filings (40%).

Were there multiple “waves” of filings?

Yes. I can eyeball about 8, but I’m not sure how distinct they are. If you look at the CSV file on GitHub, you can see that the “alphabetical by first name” filings stretch from 2017–05–09 5:32PM up to about 04:00 AM the next day. A very non-scientific histogram over time gives you a sense.

Sorry about the lack of axes. My software is horrible.

Are these real people?

Most are, almost certainly. However, it’s also pretty certain that most didn’t send comments (ZDNet corroborates by contacting a few of the people). The question becomes: where did the data come from? The short answer is “I don’t know”, but here are a few thoughts.

Commercial or public marketing lists are possible: All the addresses seem to be real. A quick Google of some names and addresses seems to agree. For example, someone with a listed university address seems to go to that university.
Black market lists of identities: Checking a small sample of emails from the filings on https://haveibeenpwned.com/ shows about 90% are on a list of some sort. Maybe this is just a high base rate, though.
Preprocessed, bought list: Almost certainly. All of the addresses are nice and clean, all the email addresses are uppercased, and the filer names seem to be all formatted properly (with a few notable cases that could be data entry errors). In addition, all street addresses seem to be standardized according to USPS convention (Road -> Rd, etc).

How do I make my own FCC spamming bot?

It seems to be pretty easy, seeing as there’s an API call for that. A simple Python script or curl command could send off your own thousands of filings. [updated: 5/20] There are no publicly stated authentication or rate limiting provisions whatsoever besides the API key requirement. (Tweets from the FCC’s CIO indicate there may be internally-determined limits which are not disclosed to developers.)

Go forth and create your own bot! It’s that easy.

What should we make of this?

A net neutrality opponent, or someone working for them, got their hands on a list of people. They took advantage of the FCC’s no-friction comment filing API to blast hundreds of thousands of comments over the last few days. Almost all of them were automated and used false identities. They were sloppy about it, but it worked anyways.

I’d be interested in tracking down who did the bot spamming and where they sourced their identities from, but I have no idea where to start with that unfortunately.

Now what?

Go file your own comment or get informed about the debate. Play with the data if you want.

Bonus content!

Location of all the ZIP codes of supposed filers.

Pro-Trump Twitter bots tweet about… Ambassador Vitaly Churkin?

Tue, 21 Feb 2017 00:00:00 -0600

Pro-Trump Twitter bots tweet about… Ambassador Vitaly Churkin?

On Twitter, Eliot Higgins astutely noted that a bunch of pro-Trump Twitter bots all sent out the same tweet about Russia’s UN Ambassador passing away today.

This is the worst game of Connect Four I’ve ever played.

It’s not really a big conspiracy that there exists a large, pro-Trump bot network out there. However, this presents an interesting excuse for me to play with the Twitter API and find some basic info about these bots. This is an elaborated version of my personal notes.

I used tweepy and Python to search for the headline, which was cribbed from Russia Today (RT). Notably, the tweets never mentioned RT or @mentioned the RT Twitter account, making filtering a bit easier. I gathered about 1200 tweets in total.

A bit about the bots

Histogram of tweet times. Each bar is a 15 second bin. The spike is n = 66 accounts.

Here’s a histogram of tweet times from the first tweet to 45 minutes after (times in UTC). It’s easy to see the spike at left (around 5:13PM), followed by the long tail of organic user activity. It’s obvious there’s some coordination behind that.

Twitter client: Given the larger number, there are one or two real accounts caught in the spike. These can be easily differentiated because they use consumer clients, such as Twitter’s iPhone or web app. Every other tweet in the spike was sent from dlvr.it, a piece of corporate social media management software.

Handles: They are almost all obviously pro Trump, with references to Trumpian phrases like “deplorable”, “MAGA”… and, well, “Trump”. Other common references include “conservative” and “America”.

Profile appearance: Profiles are also formulaic. Names usually reference similar themes to the handles. Many contain emoji, such as 🇺🇸Daniel 🇺🇸MAGA. Pictures are usually stolen from somewhere else (easy to reverse image search). Many are scantily clad women.

Location and language: Most of the accounts list random states or cities. Curiously, Twitter’s API returns a user’s timezone, and most are listed as Pacific Time. A few are listed as Caracas, though. The API also returns the user’s default language and most are listed as es, or Spanish. Huh.

Bot outliers

Four accounts don’t fit this mold, which are “Anonymous News, SVN Magazine, Russia Today News” and “Web Guru”. SVN and Web Guru are linked to http://svnmagazine.blogspot.nl/, a spammy looking news site that mostly reposts stuff from Russia Today and Alex Jones’ Infowars. A page on the site links to a Facebook group called “‎Samensterkvoornederland”, or “Together for the Netherlands”.

Anonymous news links to another news site which has much the same content, except it’s plastered with the 4chan/Anonymous logo. Russia Today News has no site, but tweets out many of the same articles as the other three outliers. All four outliers tweet the same material with few exceptions.

Who’s doing it?

I didn’t start with the aim of finding out, but a few clues did pop up. Most accounts are a stream of auto-posted news stories. Some like this account link to news through a xxx.twittcloud.com domain, which seem to be an advertising-serving redirect using adf.ly, a link monetization service.

Twittcloud’s site is currently a placeholder page in Spanish, but Googling for Twittcloud turns up a Facebook page which advertises “Easy Control, Quick response, fast followers”. My guess is Twittcloud is one of many Twitter follower or account-buying services. The WHOIS data for Twittcloud shows it’s registered to “Day Torin” in Barquisimeto, Venezuela. That would explain the Caracas thing.

Questions

Is it simple spam and monetization using popular, controversial topics? Is it a giant propaganda conspiracy? (If so, they’re pretty sloppy about it.) Why is there a guy in Venezuela involved with this? Is this a bot network hired by pro-Russia forces, or is this a byproduct of autotweeting RT?

I wish I had the data to find out.

Some thoughts on Confide

Thu, 16 Feb 2017 00:00:00 -0600

Some thoughts on Confide

Secrecy in the White House has always been a hot topic. However, a recent Washington Post article highlights use of the Confide app:

Staffers, meanwhile, are so fearful of being accused of talking to the media that some have resorted to a secret chat app — Confide — that erases messages as soon as they’re read.

Some have expressed concern about how this could be a breach of the Presidential Records Act, or how the use of Confide means that national secrets could end up flowing through Confide’s servers and/or the public Internet. I’m not here to make claims about legality though (although I do have strong opinions on this, and many other things). The following attempts to answer a few simple questions about Confide that I hope helps you draw your own conclusions.

It’s a web app!

So, what’s up with Confide?

I go into more technical detail below, but here’s the quick version:

Confide is decently confidential and secure for a certain threat model: casual intrusion, over-the-shoulder snooping, and other things of that level. It’s a definite upgrade from unencrypted email.
Of course, all bets are off if an attacker has access to your machine. It’s trivial to disable “screenshot protection”, secretly record messages before they are deleted, and find a conversant’s private key.
An attacker with network access will be able to see some metadata, but might not be able to access conversation contents.
Finally, I don’t have enough knowledge to say what happens to messages once they hit Confide’s servers. There are no guarantees of deletion.

So, to sum up: better than Snapchat. Good for sharing personal secrets, or maybe even sharing some sensitive material in the corporate world. Certainly not ideal for government secrets. But that should have been obvious.

Why do this?

Well, I was bored. But also—Confide is a for-profit company which makes claims about security, but their methods and application source code have not been audited. On the other hand, the Signal protocol which underpins WhatsApp, Signal, and a few other applications, has undergone a formal audit (PDF). This doesn’t necessarily mean that Confide is good or bad. I’m not a cryptographer and I’m not doing protocol analysis. It’s just that we know basically nothing about the app at this point.

Looking at Confide’s claims

I’ve highlighted a few phrases from the Confide home page that I’ll examine.

“Protecting your messages from screenshot attempts”

Look, it’s a screenshot.

This is done through a piece of native “helper” code which interfaces with the macOS graphics system to draw a grey rectangle on top of the window when a screenshot event is detected. However, the helper code interfaces with JS through a JS module. Judicious editing of the module’s exported functions completely disables this protection. You could also just take a picture of the actual screen with your camera.

“Messages disappear forever”

The fancy “redacted” effect is all done in CSS / JavaScript. Data remains in the app page’s DOM tree as HTML elements. This isn’t bad — it’s good UX and effective against “shoulder surfing” and so on.

Like I mentioned earlier, all bets are off if you have machine access. Since the UI is a web page, a few lines of JavaScript are all that’s needed to preserve messages as they pass through the app after decryption. This is made doubly easy by the fact that the app doesn’t check the integrity of its own files, meaning edits could go unnoticed.

“Military-grade end-to-end encryption” and “Transport Layer Security”

Military grade: What does this even mean? It sounds good in marketing material, so I guess I’ll give them a pass on this.

End to end: Messages are encrypted using the node.js “crypto” library’s functions, which is good—they’re not rolling their own software. The nitty gritty: messages are represented as a JS Object, turned into JSON and base64 encoded, encrypted with a private key with the aes-256-cbc cipher and a 32 bit initialization vector.

Looks like they’re doing some sort of standard key exchange based on ECDH, with ephemeral keys. Beyond that, I can’t tell much.

Transport security: The app does indeed use TLSv1.2, a secure and accepted standard for encrypting data in transit. Communication with the server happens over HTTPS and SSL WebSockets with certificate pinning. To get specific, the cipher suite is TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256. This is all reasonable.

Now, what if you man-in-the-middle yourself? (Or get man-in-the-middled by an adversary, or White House IT?) Well, without the private key, you can’t look at the goods—but you can see some metadata from the WebSocket, including who a new message is to/from and whether the user is using the app at that moment. There does seem to be some basic MITM detection based on comparing fingerprints of the WebSocket server with a hardcoded hash, but it’s not quite HSTS / certificate pinning.

Other stuff: API, etc

There’s a big cipher password just hanging around in the source. I don’t know what it’s for, but it doesn’t really inspire confidence. Probably innocuous though.

The application’s API seems pretty simple and looks to be based on JSON through WebSockets, with a HTTPS GET/POST based fallback (or alternate). Key exchange, message-getting, notifications, and all app communication happen through this API. There is also some sort of “access token” tied to each session, which renews. Keys seem to be ephemeral and look to be tied to this access token. Tokens are refreshed on request from the server and at the start of each session.

Note on analysis

Confide is closed source and I have no access to its source code. Luckily, the desktop client is written using the Electron stack with HTML, CSS, and JavaScript/React. In other words, it’s a really fancy web page wrapped in a stripped down browser. Unlike compiled programs, web pages are pretty hard to hide or scramble beyond a certain point. I won’t post any code here for copyright reasons, but it’s safe to say that if you know your way around a macOS app bundle and the Electron archiving format, you will *quickly* find what you’re looking for. That’s that.

The rest of my information has been gleaned from monitoring network traffic off my computer. To get at some of the encrypted traffic, I used the wonderful Charles debugging proxy to man-in-the-middle myself.

So, where does this leave us?

Maybe their marketing is overreaching a bit. Confide is good for hiding stuff from your boss or keeping a certain type of low value secret hush-hush. However, we don’t have information on their full client or server implementation (not open source), and since all data is going into Amazon’s (US-East-1), we have no guarantees on the confidentiality or integrity of information passing through the app.

Confide is a cool app with good UX. The engineers were obviously competent, they didn’t roll their own crypto, and they have a few weaknesses.

I don’t think it’s good enough for sharing information in the White House, though.

Is there a right way to assess the impact of fake news?

Wed, 25 Jan 2017 00:00:00 -0600

A new working paper from the National Bureau of Economic Research has been released and is titled “SOCIAL MEDIA AND FAKE NEWS IN THE 2016 ELECTION” (Allcott and Gentzkow, 2017).

The authors use survey data, web browsing data, and a simple statistical model of voter persuasion to draw five main conclusions:

A. Social media had an impact, but was “not dominant” in being a source of election news (14% of their survey called it their most important source).

B. Drawing from the sample of fake news stories archived on fact-checking websites, there were 30 million Trump-positive shares and 8 million Clinton-positive shares.

C. An average American from their sample remembered 0.92 Trump-positive fake stories and 0.23 Clinton-positive fake stories.

D. A little over half who recalled seeing fake stories believed them.

E. One piece of fake news would have needed the persuasiveness of 36 campaign TV ads to have swayed the election.

I’m really happy to see work like this being done. However, I think fake news may have had more sway — it’s just a question of how to use empirical methods like these to correctly quantify it. Why?

This is not a rigorous critique or an academically sound paper review, but I’d take these conclusions with more than a few grains of salt.

The authors use Alexa and comScore to measure “the share of traffic on news websites that come from social media vs. other sources.” Notably, both “do not include mobile browsers and do not include news articles viewed within social media sites.” This provides a flawed view of the sharing ecosystem.

Mobile browsers

As of Q1 '16, Facebook reported 894 million mobile-only monthly active users, indicating that, theoretically, more than half of the service’s user base hasn’t been observed in this sample.

There are also confounding issues as a lot of external Facebook links are routed through the app’s in-app browser which can mess with many existing trackers and browsing metrics.

Unmeasured engagement

Anecdotal evidence from 2014 and 2016 indicate that embedded newsfeed advertisements have a clickthrough ratio in the 1% to 5% range depending on whether the ad is seen in the mobile or desktop feed (1, 2). Let’s assume that engagement on “real”, non-advertising content is much higher than ads—even 10x higher. Even still, it’s entirely in the realm of possibility that less than half of the fake news links shared on Facebook were clicked through and viewed in a mobile or desktop browser.

However, a large proportion of engagement with Facebook stays within Facebook’s “walled garden”, making measurement notoriously difficult. This is somewhat addressed by the use of Facebook share data, but ignoring the mobile and newsfeed segment is still a rather large hole.

Twitter

“…we do not record shares on these other sites because the number of Facebook shares is orders of magnitude larger.”

While it’s hard to map alternative forms of engagement on Twitter onto this link-sharing based approach, it’s important to note that a lot of fake news engagement happens on Twitter.

Here is an example of Clinton-negative fake news which was organically created and shared within the Twitter ecosystem. Its conclusions spread to other sources (perhaps including some of the fake news articles measured and shared on Facebook), but tens of thousands of engagements occurred solely on Twitter.

This also bypasses the issue of emotional and incidental engagement with Trump-positive “troll” accounts and unsourced snippets of fake news which take the form of tweets.

In conclusion: I think this work is a step in the right direction, but the conclusion it makes are too strong for the data underpinning the work. Many forms of influence and engagement aren’t likely to be solely captured using desktop Alexa data, comScore, and Facebook-only shares. I think this might understate the effects found in the paper.

Why is the Red Line delayed?

Sun, 11 Dec 2016 00:00:00 -0600

Every city loves to pick on their transit agency, but that’s doubly true for the T here in Boston. (Look no further than the wonderful MBTA…

Why is the Red Line delayed?

Every city loves to pick on their transit agency, but that’s doubly true for the T here in Boston. (Look no further than the wonderful MBTA Excuses page.) These past few weeks have been especially bad for the Red Line, one of the most heavily used transit corridors in the Boston area. Just go ask Reddit.

Given the weather lately, I think all bets are off for the sun rising in the east too.

Anyways, with the recent uptick in Red Line issues, I got to wondering: are there any interesting underlying patterns in the failures? While I didn’t have time to do anything fancy with the data, I did manage to assemble some and do a bit of basic poking around.

The Data

The first order of business is obtaining information about delays. I wasn’t able to find a comprehensive database of the MBTA’s Alerts archived anywhere. There is a “MBTA Performance Dashboard”, but they only provide data on an abstract metric of reliability, which isn’t as granular as I was hoping. My solution was to scrape the last month or so from their Twitter feed. I filtered out everything except Red Line related tweets. I then used a combination of automatic and manual tagging to note:

The action: a DELAY or a RESUME in normal service
The reason: such as “disabled train” or “police action”
The station or range of stations affected

I also noted time of day, whether the alert was an update to a previous issue, and whether the alert was what I’m calling a “hangover” (delays due to a previous delay).

This got me 175 entries from October 14th to December 9th (56 days). There were 85 initial delay actions, with 20 hangovers and 90 updates. That’s 1.51 initial delays per day (not counting updates).

So What’s Going On?

I’m not drawing any strong conclusions from this data. Here’s some fun stuff to look at though.

Vice Presidential motorcade? Thanks, Joe.

Here’s the initial distribution of reasons. Not surprisingly, disabled trains and signal problems head up the count. Emergency services, power, track problems, and Joe Biden round out the list.

Next question: are there issues that are more common depending on the location? Looks like disabled trains are pretty common throughout, but signal problems are concentrated on the Red Line’s northern few stops.

Harvard used to be the north end of the line before the extension to Alewife in the ‘80s.

Delays can also occur on stretches of track that span multiple stations. I calculated the number of stops between each station for these instances. Not surprisingly, delays from disabled trains propagate through a wide range a large stretch of stations up and down the line.

If an alert says “between Alewife and Porter”, the delay span would be three stations.

Time of Day

Does time of day have anything to do with it? The short answer: probably not. A delayed train can strike at any time! There seem to be more issues in the afternoon and evening rush, but maybe that’s just a consequence of more trains being run.

Looking at station by time of day, we can also see that afternoons and evenings are more problematic.

We can see that Harvard is most problematic during mid-day. This is a good excuse to never go to Harvard.

Finally, did things get worse after a certain date? It looks like we had more signal problems lately, but the trains have been pretty uniformly abysmal. Also, there have been only two weeks in the past two weeks where there hasn’t been an issue at Alewife!

Left: week and station. Right: week and delay reason.

Other Miscellaneous Thoughts

What incidents cause the most delay hangovers? Disabled trains (7), followed by track work (5).
Which week sucked the most? The one before Halloween with 16 delay actions. Worst single day? 11/15 with 5 separate delay actions.
There were 52 “minor” delays, 24 “moderate” delays, and 7 “severe” delays.

Not all incidents were given a severity by the MBTA.

Have we had a week with no delays? Of course not! :(

That little spike is 11/15 with 5 delays.

Want to play with the data? I’m seeing if I can get a larger set from the MBTA, but until then: https://gist.github.com/nhfruchter/ba0a4bd17da54c743e3c83f5912b2533

EDIT: Bonus content by Reddit request.