IT technology is infiltrating almost every area in our society, but there is one front where the progress is notably slow. Democracy. Why?
We still use representative democracy and elect politicians for several years at a time. This is largely done using pen and paper and the votes are counted manually. Processing the votes seems like a task well suited for computers. And why do we even need to elect representatives when we could vote directly over the net in the big and important questions? Representative democracy was after all invented thousands of years ago when people had to gather physically to hold a meeting. Then it made sense to send someone to represent a group of people, but now we could involve a whole nation directly using the net. So what’s stopping us from doing that?
Let’s first look at IT as an aid in representative democracy. First, voting machines have already been used for a long time in some countries, including the US. But there have been many controversies and elections have even been declared invalid by court (link in Finnish) due to problems in electronic handling of votes.
Handling an election seems like a straightforward IT problem, but it really isn’t. Let’s keep in mind the fundamental requirements for an election: 1. The identity of voters and their right to vote must be verified. 2. It must be ensured that no one votes more than once. 3. It shall not be possible to determine how a person has voted. 4. The integrity of the result must be verifiable. The big problem is that these requirements conflicts with each other. You must know the person who votes but still store the data in a way that makes it possible to verify the result but not identify the voter. This leads to complex designs involving cryptography. It’s no doubt possible to develop systems that fulfill these needs. The hard part is to verify the systems thoroughly enough to make sure they really work.
And here psychology enters the scene. We all know pens and paper well and we have learned to trust the traditional election system. There is a fairly large number of unclear votes in every election and we have accepted that as a fact. But people are a lot more suspicious against computerized systems. Most of us lack the ability to understand how electronic voting works. And the requirements described above causes complexity that makes it hard even for many professionals. Only crypto experts have the true ability to audit it. This makes it hard to build a chain of trust between ordinary people and the voting system.
Is our suspicious attitude justified? Yes and no. We should be suspicious against complex electronic systems and put them through thorough scrutiny before using them in elections. We must demand that their design is open and audited by independent experts. But we are at the same time forgetting the fact that traditional security measures are far from perfect. Written signatures is a very weak method to prove identity and a photo ID is not much better. A nice example is a friend of mine who keeps using an expired ID card just to test the system. The card is his own and he still looks like the picture. The only problem is that the card expired 11 years ago. During these years the card has only been rejected once! It has been used several times when voting in elections. Needless to say, an electronic signature would not pass even once. Despite this, people typically trust written signatures and ID cards a lot more than computerized security measures. The same attitude is visible when discussing electronic voting.
Another real reason to be suspicious against electronic voting is the computers’ ability to process massive amounts of data very quickly. There are always minor errors in the traditional voting systems, but massive manipulation of the result is hard. In a computerized system, on the other hand, even a fairly small glitch may enable someone to make a big impact on the result.
The other side of the coin is the question if we need representative democracy at all anymore. Should we have net polls about the important questions instead? Well, representative democracy has an important benefit, continuity. The same people are given at least some time to achieve results before people can decide if they should continue. But a four to six year term is really too short to change the big things and our politicians tend to focus on smaller and easier issues. Imagine how it would be if the people had a more direct say in decision making? That could lead to an even bigger lack of focus and strategic direction. Probably not a good idea after all.
But representative democracy can be complemented instead of replaced. Crowd sourcing is one area that is taking off. A lot of things can be crowd sourced and legislative proposals is one of them. Many countries already have a Constitution that allows ordinary citizens to prepare proposals and force the parliament to vote on them, if enough people support the proposal. Here in Finland a crowd sourced copyright act proposal made headlines globally when it recently passed the 50 000 supporter threshold (1,2 % of the voting population). This is an excellent example of how modern Internet-based schemes can complement the representative democracy. Finland’s current copyright legislation is almost 10 years old and is heavily influenced by entertainment industry lobbyists. It was written during a time when most ordinary people had no clue about copyright issues, and the politicians knew even less. For example, most ordinary people probably thinks that downloading a song illegally from the net is less severe than selling a truckload of false CDs. Our current copyright law disagrees.
Issues like this can easily become a politically hot potato that no one want to touch. Here the crowd sourced initiatives comes in really handy. Other examples of popular initiatives in Finland are a demand for equal rights for same-sex couples and making a minority language optional in the schools. Even Edward Snowden has inspired a proposal: It should be possible to apply for political asylum remotely, without visiting the target country. Another issue is however that these initiatives need to pass the parliament to become laws. The representative democracy will still get the final word. Even popular crowd sourced initiatives may be dismissed, but they are still not in vain. Every method to bring in more feedback to the decision makers during their term in office is good and helps mitigate the problems with indirect democracy.
So what will our democracy look like in ten or twenty years? Here’s my guess. We still have representative democracy. Electronic voting machines takes care of most of the load, but we may still have traditional voting on paper available as an alternative. Well, some countries rely heavily on voting machines already today. The electronic machines are accepted as the norm even if some failures do occur. Voting over Internet will certainly be available in many countries, and is actually already in use in Estonia. Direct ways to affect the political system, like legislative proposals, will be developed and play a more important role. And last but not least. Internet has already become a very powerful tool for improving the transparency of our legislative institutions and to provide feedback from voters. This trend will continue and actually make the representative democracy blend into some kind of hybrid democracy. The representatives do in theory have carte blance to rule, but they also need to constantly mind their public reputation. This means that you get some extra power to affect the legislative institutions if you participate in the monitoring and express your opinion constantly, rather than just cast a vote every 4th year.
Not good enough. That's the assessment of the Parliament's Joint Committee that has been investigating the Draft Investigatory Powers Bill, which will set the guidelines for how the UK carries out intelligence gathering in this era when terror and cyberthreats are merging. And our Cyber Security Advisor Erka Koivunen who testified in front of the committee, agrees. "Sharper, clearer definitions are required in order to protect both the privacy of citizens and viability of the British tech industry," he said after reviewing the 198-page report. Legislators hope to pass the bill before the Data Retention and Investigatory Powers Act 2014 expires in December of this year. A few major problems stood out for Erka. "The committee’s case for Equipment Interference, known by some as 'hacking,' is persuasive and also give voice to the equally persuasive critics of the Government having the power to intrude upon communications in way that lawfully captures evidence," he said. "However, there appears to be little discussion about collateral damage caused by bulk equipment interference activities. We’ve seen in the Stellar Wind and Belgacom cases that equipment interference activity on non-terrorist and non-combatant organizations can be used to create stepping-stones to the intended targets, or as way to hide the intelligence traces that would point the operation back to GCHQ." Limiting the scope of investigations is key, along with allowing developers that ability to preserve the integrity of their products. "We support Mozilla and the open source community in the insistence that all vulnerabilities should be identified and fixed, regardless of who put them there," Erka said. The committee made a strikingly straightforward case for bulk collection of data, noting that search tools can make such information relevant. "However, the justification for such powers -- 'why would the authorities request the bulk powers if they didn't believe them to be effective' -- is simply naïve," Erka said. "It has been demonstrated many times over that GCHQ and NSA have invested lots of time and resources in bulk collection. It is only natural for them to defend their investment and seek to continue their work without interruption. Doing otherwise would put past conduct under scrutiny and future activities in question." Privacy advocates generally agree that the bill should not become law in its current form. "It needs more than mere tweaking, it needs to be fundamentally rethought and rebuilt," said Lord Paul Strasburger, who was on the committee. "Like the other two committees, [we] found the Bill to be sloppy in its wording and short on vital details," he said. Erka notes that the clock is ticking quickly. "The 'sunset clause' now forces the UK Government to work against the clock as the old RIPA authorities will cease to exist in the near future. Talk about "going dark!'" The threat of a complete lapse in surveillance will be wielded by proponents of a purposely vague and broad law. That should not happen, especially given the abundance of input the government has. "The bill, as written, fails to address our concerns about the potential for abuse and lack of oversight. We applaud the committee for addressing these shortcomings—and encourage the Government not to use the rush to pass the law as an excuse to pass a flawed bill." Photo: GCHQ/Crown Copyright/MOD
We can see signs of a disturbing trend. Nowadays there is a built-in update process in almost every software product, and the automatic updates are essential for our devices’ security. The main driver to implement them was to be able to reach out quickly when vulnerabilities are discovered. And most users got the message. We understand the need for updates and let them be installed promptly. This is great from security point of view. So I’m very sad to see increasing misuse of users’ trust in the updates. Apple is making headlines right now with the “Error 53 scandal”. In short, upgrading to iOS 9 may brick your device, that is render it totally useless, if the new system detects that an unauthorized repair has been performed. The official reason is that Apple wants to protect the user’s data against attacks involving tampering with the device. The new functionality does however smell to high heaven. Apple has already a bad reputation for keeping its ecosystem closed and tightly managed, and this incident just feeds that reputation. It doesn’t take a genius to figure out that a move like this also benefits authorized Apple service companies over unauthorized. Bashing Windows 10 is also popular right now. I’m not going into all the security and privacy issues here. But I think the way Microsoft is pushing out Windows 10 to users of previous versions is disturbing. Yes, the automatically distributed upgrade is convenient, if you want to upgrade. And as said, upgrading is usually good from security point of view. But people may have tons of valid reasons to postpone the upgrade, and this is where things get nasty. Several gigabytes are downloaded anyway and use up disk space in vain. Language in the upgrade dialog suggests you have to upgrade. And it starts all over even if you decline, clean up and disable the updates. Even worse, now the upgrade may even start automatically without your consent! People are raging over these incidents because they cause major inconvenience and interferes with your ability to use a product you have purchased. But another at least equally severe side effect is that every case like this undermines peoples’ trust in update services. I bet people with a bricked iPhone will be hesitant to install new versions of iOS in the future. And my opinion about Microsoft’s update service has definitively changed while defending a touch-screen computer with Windows 8.1 from the upgrade. Yes, I have tried Windows 10 on it. No, it didn’t work properly so I had to roll back to 8.1. So to conclude. Rapid updates are more important than ever. Therefore it is very sad to see companies misuse the update channels to roll out features and versions that are designed mainly to boost their own business. The outcome may be that people to a larger extent decline updates or try to block update systems that can’t be disabled. Permanent damage has been caused in that case. Micke PS. There’s some good news for people who want to stay on their previous Windows versions. There is a registry setting that can be used to prevent the upgrade. See MS Knowledge Base Article 3080351 for more details. Image by Nick Hubbard
Today is Safer Internet Day – a day to talk about what kind of place the Internet is becoming for kids, and what people can do to make it a safe place for kids and teens to enjoy. We talk a lot about various online threats on this blog. After all, we’re a cyber security company, and it’s our job to secure devices and networks to keep people protected from more than just malware. But protecting kids and protecting adults are different ballparks. Kids have different needs, and as F-Secure Researcher Mikael Albrecht has pointed out, this isn’t always recognized by software developers or device manufacturers. So how does this actually impact kids? Well, it means parents can’t count on the devices and services kids use to be completely age appropriate. Or completely safe. Social media is a perfect example. Micke has written in the past that social media is basically designed for adults, making any sort of child protection features more of an afterthought than a focus. Things like age restrictions are easy for kids to work around. So it’s not difficult for kids to hop on Facebook or Twitter and start social networking, just like their parents or older siblings. But these services aren't designed for kids to connect with adults. So where does that leave parents? Parental controls are great tools that parents can use to monitor, and to a certain extent, limit what kids can do online. But they’re not perfect. Particularly considering the popularity of mobile devices amongst kids. Regulating content on desktop browsers and mobile apps are two different things, and while there are a lot of benefits to using mobile apps instead of web browsers, it does make using special software to regulate content much more difficult. The answer to challenges like these is the less technical approach – talking to kids. There’s some great tips for parents on F-Secure’s Digital Parenting web page, with talking points, guidelines, and potential risks that parents should learn more about. That might seem like a bit of a challenge to parents. F-Secure’s Chief Research Officer Mikko Hypponen has pointed out that today’s kids have never experienced a world without the Internet. It’s as common as electricity for them. But the nice thing about this approach is that parents can do this just by spending time with kids and learning about the things they like to do online. So if you don’t know what your kids are up to this Safer Internet Day, why not enjoy the day with your kids (or niece/nephew, or even a kid you might be babysitting) by talking over what they like to do online, and how they can enjoy doing it safely.