Do We Really Need Technology Patents? Part II

OK, I really didn't mean to return so soon to the subject of patents.  It's not really on my my list of the most pressing issues facing society.  But sometimes something grabs your attention, and just won't let go until you take an opportunity to vent.

When I previously questioned the basis of patents, it was based on their value to society.  Today, I’d like to explore a different but related concept: Are they fair?

Of course, there’s no simple answer to that.  Fair is a cultural concept, and different people have widely different definitions.  Most people would have trouble in providing a useful and consistent definition of “fair”, but instead fit into the “I’ll know it when I see it camp”.  If enough people have a similar reaction, then that’s a reasonable approximation of “fair”, and I’ll go with that for now.

On 11/27/2011, the New York Times profiled an enterprising high school student named Katherine Bomkamp.  Inspired by visits with amputees at the Walter Reed Army Medical Center, she set about to build a prosthetic limb that would treat phantom pain.

Her idea, to treat the stump with heat (under the principle that the same treatment works on strained muscles) is brilliant in its simplicity.  This is not a new problem, and her solution does not involve new technology.  It’s simply a new idea that somehow eluded generations of doctors and inventors.  Assuming the tests confirm its effectiveness, and the patent search confirms no pre-existing technologies, then I will heartily agree that her case is exactly the sort of situation that patents were designed for.  I would consider it criminal if a major medical device maker simply took her idea without compensating her.

A patent in this situation fits my definition of fair.

But now, imagine you’re a talented electrical engineer named Elisha Gray.  You've spent an enormous amount of time and energy creating a revolutionary new device that is capable of sending the sound of somebody’s voice over electrical wires.  The implications are staggering.

You triumphantly take your idea to the patent office, only to discover that the same idea was filed a matter of hours before yours.  Not being awarded a patent is frustrating.  But infinitely worse is that you are now legally prohibited from using your own invention without paying royalties to somebody else.  I’ll leave the accusations of theft and conspiracy out of this for the moment.  People may differ, but I classify this as “not fair”.

If multiple people are inventing the exact same idea at the exact same time, then it’s not clear that it’s fair or beneficial to restrict one person’s rights in favor of another’s.  It's simply an idea whose time has come, and it would be hard to argue that a third or fourth person wouldn’t stumble onto the same idea in a fairly short period of time.  The question is, how frequently does this happen?  Aside from the invention of the telephone (and calculus), do we really have an avalanche of competing ideas all coming to light at the exact same moment in time?

I say yes, but don’t take my word for it.  Instead, let’s look at a recently passed, and heavily lobbied, law called the “America Invents Act” (passed on September 26, 2011).

One of the key provisions of this act is that it switches the U.S. patent system from a "first to invent" to a "first to file" system.  Many people have argued about which of these methodologies is more fair, but it certainly has the advantage of being simpler to manage.  Figuring out exactly when the process of invention occurred is an exercise in mind numbing frustration.  I'm personally not in the habit of keeping a full diary of every thought that crosses my brain as I shower each morning.  Trying to settle a dispute between multiple inventors, all of whom have spotty record keeping but huge financial incentives to win, is going to be arbitrary and capricious.  At least a filing at the patent office comes with a reasonably accurate timestamp.  Fair or not, at least it's closer to objective.

This was a very hot topic, and a lot of lobbying money was spent to get it passed.  The question is: would anybody have cared if most patents went uncontested?  Of course not.  The only reason why this becomes a hot button issue is that these types of collisions happen all the time.  We are living in a fast moving age, surrounded by ideas whose time has come.  Granting multi-year exclusivity to one person or organization because they were a day or two faster to file the patent application than somebody else with the exact same idea is not in the best interests of society.

And more than that, it’s just not fair.

Hackable Everything - Part II

Last week, I titled my blog post "Hackable Everything" and stated that everything is potentially hackable.  Some people asked me if perhaps I was being a bit melodramatic.  Just because there have been some recent news about security flaws, does that really mean that everything is vulnerable?

An interesting question.

First of all, let me point out that encryption algorithms today are actually very good.  There was a time when government agencies such as the NSA could apply massive computing power to break widely used encryption (typically 56 bit DES).  During the 1990s, as the Internet grew in popularity and interest in encryption became more widespread, the government tried to figure out how to keep their ability to decipher electronic communications.  The Clinton administration famously (or infamously) tried to mandate the use of the Clipper chip, which would provide encryption, but also provide backdoor access to government agencies.

They failed.  Today, we routinely use encryption algorithms and keys which are beyond the capability of any known computer or collection of computers to break.

How sure are we of this?  Couldn’t the NSA have some massive computer buried in a government bunker that blows away our estimates?

To grossly oversimplify things, let's note that for a well-designed, properly implemented encryption algorithm, the difficulty in breaking it is a function of the key size.  DES, once the most commonly used algorithm, used a 56 bit key.  Over time, computers grew in power to be able to defeat this using a brute force attack - that is, trying every possible combination until they found the key by pure luck.

How do you make a 56 bit key twice as hard to crack?  Double the key length to 112?  Nope.  You just have to add one bit to make it a 57 bit key.

As key sizes grow, the numbers grow so fast as to make your head spin.

An 8 bit key has 256 possibilities.  A child could crack this in minutes using pen and paper.

A 16 bit key has 65536 possibilities.  A pretty big number, but you can probably visualize it if you try.

A 32 bit key has 4.3 Billion possibilities.  This is roughly the number of seconds in 136 years.

A 64 bit key has 18.4 Quintillion possibilities.  This is roughly 468 million times greater than Warren Buffet’s fortune.

A 128 bit key has 340 Undecillion possibilities.  This is roughly 340 trillion times greater than the estimated number of stars in the Universe.

128 bits is pretty much the minimum key length used in symmetric encryption these days.  In 2008, 56 bit DES was demonstrated to be crackable within a day.  Assuming we could get this down to a second, cracking a 128 bit key would still take 149 trillion years.  I’m comfortable that the NSA doesn’t have a computer 149 trillion times more powerful than the state of the art, which could crack this in a year.  Bump the key size up to 256 or 512 bits just for fun, and you can’t even come up with metaphors to express the difficulty.  You can knock this down significantly by extrapolating Moore's law will continue developing more and more powerful hardware over the next several decades, but assuming you're not trying to keep data secure for a century, you're good.

So why then do I say that anything can be hacked?

First of all, note the requirement that algorithms be well designed and properly implemented.  The problem is, you never know whether this is the case, except in hindsight.  WEP was once considered to be unbreakable wireless security.  Then it was noticed that the very powerful algorithms it uses were implemented in a sloppy fashion, making it easy to step right around them.  Today, a script kiddy with minimal technical knowledge can download free programs to break WEP using a standard laptop.

OK, that’s a challenge, but with care and lots of testing, you can implement a pretty solid encryption algorithm with a high degree of confidence.  We have a number of algorithms and products that have been closely scrutinized by thousands of people.  They’re probably pretty good.

The second challenge, however, is more difficult to solve.  All security is built upon trusting something.  (Ask yourself how secure an encrypted transaction with Bernie Madoff would have been.)  Anything you have to trust is a potentially vulnerable point in your security infrastructure.

For example, most security on the Internet depends on "Certificates", which enable a person to unambiguously assert their identity, encrypt their data, and make sure any messages they send can be tied accurately back to themselves.  Certificates are the foundation upon which most everything else is based.  Having your certificate be compromised is like opening the back door to the castle - it simply doesn't matter how thick your walls are, or how deep your moat is, if people can enter freely.  Recently, a number of Certificate Authorities have been hacked, including Diginotar and KPN.  Once the Certificate Authority is breached, some Certificates (perhaps all) issued by that Authority are no longer secure.

Here's the scary part: check your browser, and see how many Certificate Authorities it considers to be "trusted".  The answer is close to 600.

600 companies, any of which might have a weak password, or a poorly implemented algorithm, or a single open port on a server, or a pissed-off employee who didn't get the raise they really thought they deserved.  Every one of which your browser is trusting 100% to keep you secure.  Do you have the detailed technical and organizational knowledge to know if this trust is justified?  Have you even heard of Izenpe S.A. (which I just found in my Certificate list in Firefox)?  Diginotar didn't tell anybody about their breach for many months.  Would you know if others have already been breached?

Are you feeling safe now?

The third point is even more difficult to come to terms with: data leaks.  No matter how secure the transmission is, it doesn't matter if somebody can read your data before it's encrypted at the end points.  Who cares if you use 1024 bit encryption if there's a keystroke logger installed on your machine which captures everything you do before it can be encrypted?

Or maybe they don't even need a keystroke logger.  Try sitting in a room where somebody else is typing.  Close your eyes, and listen to the sound of their keystrokes.  Do you notice how they don't all sound quite the same?  (If you're not convinced, ask them to touch type for a few minutes, then hit the same key over and over again with one finger.)  Depending on the location in the keyboard, each key strike has a slightly different pitch and timbre.  Researchers at Georgia Tech recently demonstrated how the accelerometer in an iPhone 4 could determine what was being typed on a nearby keyboard with 80% accuracy.  This was considered a much more interesting demonstration than simply using the microphone, because the accelerometer is much less secure – you usually get notified when the microphone is turned on.  How is  encryption going to save you from that?

Now granted, this iPhone exploit is not easily replicable - they needed the phone to be perfectly positioned, on the right type of table, and all sorts of other controllable factors.  But technology always gets better, and more pervasive.  How long before an iPhone can do the same type of detection from 10 feet away?  How long before somebody figures out how to do it using a laser microphone against your window from 300 feet away?  How long before the current proliferation of cameras and microphones in consumer, industrial and municipal devices means that you're always within range of some camera, somewhere?

When any one of them can potentially be hacked, how will you ever know that anything you say or type won't be monitored?

This all sounds like the stuff of spy movies.  You're probably thinking, "Sure, this could happen in theory.  But who's going to take the time and effort to go after me?"  That's probably true.  Until technology makes it so simple to do that your neighbor's kids can buy the necessary gear for less than $10.  Counterfeiting money was once the exclusive domain of organized crime.  Then we had a new generation of printers and copiers which could churn out perfect copies of dollar bills.  You'll notice our currency has gone through some significant redesigns in the last twenty years, adding many new security measures.  This wasn't to stop organized crime.  This was to stop the average consumer for whom temptation had become just a little too hard to resist.

This is the point where I'm supposed to editorialize, and point out that only with immediate action right now can we avoid calamity.  But I don't have any answers on this one.  If you do, I'd be interested to hear about it.  But first, find a venture capitalist and start a company to implement it, because security concerns are going to be one of the hottest topics of the twenty first century.

Hackable Everything - Part I

The internet was created on a dream.

What if computers could talk to each other?

It's easy to lose sight of what a revolutionary dream that once was.  There was a time when most computers were not sold with modems or network connections of any sort.  You transferred files by putting them on floppy disks.  If you were especially tech savvy, you hooked two PCs together through their parallel ports and were able to transfer files directly from one to the other.  It seemed like magic at the time.

Then Al Gore invented the internet, and suddenly computers all over the world could talk to each other.  This happened so suddenly that nobody knew what to do with it.  You think I'm kidding, but I'm not.  The first corporate websites in the 90s looked like they should be hanging on the walls of a third grade art class.  Take a look at some of these if you don't believe me.

Then we upgraded everybody to broadband, and figured out what to use the Internet for: just about anything you could do on a computer.  You could browse.  You could shop.  You could communicate.

Anything you could do on a computer.

What if we could connect to the internet without a computer?

Between shrinking chip sizes and mobile protocols such as wi-fi and bluetooth, this dream was barely formulated before it came to life.  Email on your cell phone?  Check.  Emergency service and navigation in your car?  No problem.  Bluetooth connectivity for your insulin pump?  Why not?

Maybe we should have tried a little harder to answer that last question.

Because the inventors were not the only ones dreaming.

What if any device with a network connection could be hacked?

Finding unintentional uses for computers is a past-time as old as computers itself.  One of the first demonstrations ever of a personal computer was done on a machine lacking a monitor and printer.  Lacking a formal method of output, the programmer timed the cycles of the CPU just right to cause the radio interference generated to play some simple songs from the static of a nearby radio.  Computers weren't designed to leak radio signals.  It was simply possible, and a really clever person figured out how to exploit it.

The world is chock full of really clever people.  Not all of them have good intentions.

The problem is, we still don't really understand our connected, online devices, any more than we really understood the internet back in the 90s.  We still expect them to act like old fashioned devices, just better.  Hacking an insulin pump?  Whoever heard of such a ridiculous notion?  When security researcher Jerome Radcliffe demonstrated that he could issue unauthorized commands to his insulin pump over bluetooth, the manufacturer, Medtronic, just laughed.  They issued a dismissive statement saying: "...there has never been a single reported incident of wireless tampering outside of controlled laboratory experiments in more than 30 years of use."  Because we haven't seen this before, it couldn't happen now.  Go away, and trust us.

Then McAfee reproduced the hack.  And improved it, so it could work from 300 feet away.  And demonstrated how easy it would be to request the pump to deliver a lethal dose of insulin.  Medtronic isn't laughing anymore.

On November 14th, the New York Times published an article discussing Google's top secret research labs, where researchers are figuring out, among other things, how to put just about anything on the internet.  Garden planters.  Coffee pots.  Refrigerators.

What happens if Google succeeds?  Could a clever hacker figure out how to shut your freezer off for a few days while you were away from home, then turn it back on, causing you to unknowingly eat spoiled and possibly lethal food?  How about turning on your furnace full blast in the middle of an August heat wave?  And God help us if they ever figure out how to hack one of Google's driverless cars.

We live in a brave new world.  Everything is going online.  Everything is potentially hackable.  Unimaginable opportunity.  Unimaginable risk.

Anybody who claims to know how this will play out is selling something.

Technology Dreaming

Dreaming about technology can be extremely seductive, because it can make the impossible suddenly very possible.  I'm not even talking about the big dreams like healing the sick, or feeding the hungry.  I'm talking about the very mundane details of how to run a business, which are anything but mundane if it happens to be your business.

Imagine if we could deliver a package anywhere in the world overnight.

Imagine if customers could withdraw money from the bank without needing a teller.

Imagine if we could order inventory just in time and massively shrink our warehouse.

The trouble with dreaming about technology is we forget that it is not always possible to achieve the impossible.  History is littered with failed ideas that seemed just within our reach.

Imagine if we could achieve a paperless office.

Imagine if we could predict the stock market.

Imagine if we could automatically deliver baggage in the Denver International Airport.

Netflix is a great example of a company that was swept up by the promises and perils of technology dreaming.  It started with a brilliant idea.

Imagine if we could rent videos without video stores.

This is a killer concept.  I've never reviewed the financial statements of Blockbuster (remember them?), but I'm pretty confident that if I had, I would have found the vast majority of their capital was tied up in real estate.  Other than a couple big warehouses and data centers, Netflix has no real estate.

Netflix combined this killer idea with superb execution, and became a juggernaut in an insanely short period of time.  David Pogue raved about their service even after he'd given up his membership.  They attracted global attention when they offered a ten million dollar bounty for an algorithm to improve their video recommendations, saving themselves many times that in R&D costs.  It was almost a perfect business.  They had almost no need for capital, except for their inventory of DVD disks.

Those pesky, irritating disks.

Imagine if we could get rid of the disks.

It's such a fine line between stupid and clever.

But let's get things straight.  Starting a movie streaming business to give your customers better and faster options is clever.  Positioning yourself for a future when disks may go out of fashion is clever.

Jettisoning a popular business because you like the idea of streamlining your operations, without regard to how you're enraging your customers, is stupid.

Many customers registered their displeasure, and cancelled their subscriptions.  Many investors registered their displeasure, and sold their stock, wiping out roughly $8 Billion in market capitalization. (It has since regained a bit of ground, but nothing close to what it lost.) The fact is that technology isn't yet ready for totally disk free viewing for everybody.  Movie studios aren't yet willing to license all their content for streaming.  Broadband connectivity can be flaky.  And even when it's reliable, many people are still on DSL, which provides image quality about equivalent to a VHS - not as good as DVD, and a long shot from Blu-Ray.  And sometimes you're not completely done when the movie is over, and want to see some of the specials, which are not yet available on streaming.

It's interesting to ask why Netflix is still in the doghouse.  They've cancelled their unpopular plan to spin off the DVD business.  And their prices are still competitive to where they were before the streaming business ever existed, and Netflix was still wildly popular.  The problem is that customers also dream.  They dream about a company that treats them right, and puts their interests over short term profits.  For a while, Netflix seemed to be that company.  Then the dream was shattered.  It will take a long time to rebuild that dream.

So go ahead and dream about technology.  Dream up the next killer idea that will transfer your business.   Transcend the impossible.

Just try not to cross that fine line that separates stupid and clever.

IP Everything

A few weeks ago, I noticed (barely) that the New York public radio station, WNYC, now has it’s own iPhone App.  Listeners now have the option of hearing a live stream of the station online, and podcasts of recent shows.  This is such a “me-too” story that it barely qualifies as news.  I’m still not sure why I took the time to read it.  Everything is already podcasted these days, isn’t it?

Still though, it made me stop and think a bit.

What exactly is radio?  The World English Dictionary (as available at dictionary.com) defines it as “an electronic device designed to receive, demodulate, and amplify radio signals from sound broadcasting stations”.  If you’re listening to it over IP instead of over radio signals, is it still really radio?  Or is it a podcast?

A pedantic and pointless question.  At least if we leave it at that.

Suppose your transcribe it and put it online.  Is that a web page (or blog)?  Or is it still radio?

Suppose you have a speech to text program, and you automatically put your radio program online.  Now suppose you have a text reader for your website.  Are you reading a radio program, or listening to your website?

Suppose you have an electronic book.  It’s a legal rather than a technical limitation whether your kindle can read that book to you aloud.  What is the difference between your book and a radio podcast?  And what if your book includes multimedia such as sound and video, as is slowly starting to happen.  Is it still a book?  Or has it become a movie, or TV show, with lots of text?  Or a radio show with visual augmentation?

There used to be very clear lines drawn between movies, TV shows, books, newspapers, and radio.  Maybe a small amount of blurring of the lines, such as when somebody published a newspaper in book format to make a point, but it was usually pretty clear what you were talking about.  But as everything goes online, all our previous classifications of media are going to merge into an indistinguishable mass.  We might keep some conventions about timing and primary format due to historical considerations, but we’ll have a really hard time explaining to our kids what the point of those conventions were.  And so much of our language is going to have to evolve as media becomes fluid and interchangeable.  There’s a certain subset of the population that gets  upset when people say they’ve “read” an audiobook.  Am I allowed to call Felicia Day a TV star?  Or must I refer to her as a star of online media?  Perhaps at some point we won’t even know what the original source of media was, because we’ll so seamlessly move back and forth from audio to visual in multiple formats.

We live in interesting times.

Feature Creep, or Sour Grapes?

Last week, Andy Rubin, Senior Vice President of Google’s Mobile division aimed some criticism at Apple’s new Siri software, stating “I don’t believe your phone should be an assistant.  Your phone is a tool for communicating.  You shouldn’t be communicating with the phone; you should be communicating with somebody on the other side of the phone.”  Is this a legitimate criticism, or just an attempt to fling mud at Android’s chief competitor?

Mr. Rubin does have a point that is often valid.  Products often get worse as you add things to them, instead of better.  If you’ve spent any time on the Long Island Sound, you may have seen a hybrid vessel that is half sailboat, half motorboat.  I am not alone in the opinion that they combine the worst attributes of each, and the advantages of neither.  Fred Brooks in his landmark book The Mythical Man-Month shares the observation that great architecture comes not from adding feature upon feature, but sticking to a spare elegance.  Bruce Lee expressed similar sentiments when he developed the core principles of Jeet Kune Do.

Mr. Rubin adds emotional depth to his argument when he points out the proper recipient of communication is not the device itself, but people through the device.  This conjures up images of armies of socially isolated users, using their phones as a pathetic stand-in for real human interaction, presumably because they have no friends and can’t get a date.  Most of us know some people for whom this image has some resonance.  The idea that it might spread like wildfire to all iPhone customers is chilling.

Does his point make sense here?

In order to analyze this more objectively, we need to take a closer look at what Siri actually does, and figure out if those are truly features that belong on our smartphones, or if they are examples of inappropriate feature creep.  Siri is versatile, so it’s difficult to pin down the features with any level of precision.  However, we can get a reasonable view by taking a look at the examples that Apple provided in the “Introducing Siri” video that was released with the iPhone 4S (http://www.apple.com/iphone/features/siri.html).  In this video, we see people:

-Checking messages

-Sending texts/emails

-Setting a reminder

-Playing music

-Checking traffic

-Checking weather

-Looking up basic facts

-Setting a timer

In almost every case, this is functionality which already existed in the iPhone, via the Operating system or the browser.  They also exist in Android.  The counter-examples might be the reminder feature, which is a recent addition to iOS 5, and the timer.  However, there has been a thriving market for personal organization software for iOS for quite some time – it’s the main reason I bought my iPad, so the reminder feature is really nothing new.  I’ll go out on a limb and say that neither is the timer.  So I feel justified in saying that Siri doesn’t really add any new functionality to the iPhone.  What it adds is a new interface.  The video also points out that this new interface makes the iPhone much more usable to the visually impaired.

So Mr. Rubin is really criticizing is the addition of a new interface to existing functionality.  It’s hard to make a serious case that this detracts from the elegance or usability of the phone.  There are certainly times when it won’t be of use, especially in areas with high background noise, or where speaking aloud is socially unacceptable.  But there are also numerous times when a user’s hands are otherwise occupied, and this becomes a way to use the iPhone when it would not have otherwise been usable.

So sorry Andy, I’m not buying it.  Adding a new, optional interface to my device doesn’t mean I’m spending all my time talking to my phone, it means I’m accomplishing the same tasks I was before in a more convenient way.  Now if only Apple would release Siri for my iPad…

And then what?

On October 10th, the hacker group Anonymous failed to take down the NYSE website.  Whether they ever made a serious go at it is unknown.  While there are some advantages to being a fully decentralized organization, it's limits include a lack of ability for anybody, including itself, to ever know its full agenda or action plan.  Insofar as it ever existed, the planned attack was apparently an attempt to show solidarity for the "Occupy Wall Street" protesters.

I will confess that I remain confused over the ultimate aims of the Occupy Wall Street protesters, and especially about how anybody (including themselves) will know if they've "won".  But I'm especially confused about the purpose and presumed benefits of executing a denial of service attack on the NYSE website.  What, exactly, is the point?  If it succeeded, NYSE might be forced to buy a couple extra servers to beef up their capacity.  Maybe they'll dream up some additional security measures, although there's really not too much you can do against this type of attack.  Some system administrators would be mildly inconvenienced (although they'd also gain some additional job security), and life would go on.

I'm not opposed to protests and revolutions.  But I'm a big picture guy, and a systems thinker to boot.  I'm wildly unpopular at cocktail parties, because I refuse to concede that the ills of the world can be accurately summarized in a few sweeping generalities.  If you knock down an existing system or institution, that immediately raises the question "And then what?"   If you believe that our country is being compromised by a network of good ole boys in a system of "crony capitalism", then I can appreciate that.  But if you think that you can change that system by taking down the website of the NYSE, then that's pathetic.  What you need is to have a deep understanding of the economic, social and psychological factors that have created that system.  Certainly there is much that might be done by addressing legal issues such as corporate governance, director accountability, accounting standards, capitalization ratios, and financial transparency.  You might choose to tinker with the minimum wage, or campaign finance law.  But a denial of service attack?  Come on.

The American revolution was won on the battlefield.  But it's a critical mistake to believe that victory in war created a new nation.  The nation was born in the painstaking hours of drudgery spent in Philadelphia and elsewhere as delegates from across the colonies argued complex points of philosophy, law and history to create the compromise that became the legal framework of the United States of America.

So tell me your manifesto, what you think the problem is, and prove to me that you understand the complex system that has created it and perpetuates it.  I may or may not join you.  But I'm not going to believe you’re worth joining unless you can, at a minimum, answer the question "And then what?"