Recently I met with Eben Moglen, the founder, Director-Counsel and Chairman of the Software Freedom Law Center, and David W. Levine, a researcher at IBM’s Thomas J. Watson Research Center and IBM representative to the Architectural Working Group, for an informal conversation that looked at many of the fundamental social, technological and legal questions of building 3D immersive online spaces like Second Life.
I live only a couple of blocks from the Software Freedom Law Center. And, as the opening sourcing of the Second Life Architecture is pressing forward, I decided I must at least try to get the thoughts of my neighbor who is the great advocate for the role of free software as a fundamental requirement for a democratic and free society.
I was delighted when Eben Moglen said that I could stop by and ask some questions. But he made clear, from the outset, that he wasn’t the optimistic advocate for immersive virtual worlds that I am. But the stage was set for what I felt could be a very important debate, so at the next Architectural Working Group meeting in Second Life I asked David W. Levine (a.k.a Zha Ewry in Second Life) if he was willing to come along and take part in this discussion. The photo of Zha below is by Noelani Lightfoot the proprietor of Quixotic Photography in Second Life (see her great Flickr stream here).
David is one of the most experienced architects, not from Linden Lab, involved in the Architectural Working Group’s efforts to open source the server side architecture of Second Life and develop open standards for virtual worlds. What followed was a fascinating and wide ranging conversation in which Moglen and Levine discussed how the choices we make about the design of virtual spaces and avatar interfaces in general can affect the whole path of human society.
Moglen and Levine explore, in depth, the problem of defining digital public space and issues of privacy on the internet, offering many suggestions on how to implement online privacy enhancing technologies and insights as to how we could design the next generation of these technologies in responsible ways.
A Conversation Between Eben Moglen and David W. Levine. (instigated and transcribed by Tish Shute, Ugotrade)
In this interview David Levine is speaking personally, not representing IBM’s official position on any of the issues under discussion. Also, neither Eben Moglen nor I (Tish Shute) represent or have any affiliation with IBM. We are all speaking from our own perspectives. And I apologize in advance for any errors I may have inadvertently introduced through faulty transcription and/or editing to the speech of Eben Moglen and David Levine.
David: This is entirely Tish’s idea, I’m tagging along to ask interesting questions and hear your insights.
Tish: Yes I roped David in because in terms of the Architectural Working Group in Second Life and the open sourcing of the server side architecture as he is one of the most experienced architects not from LL.
David: Yes IBM has an interest in promoting virtual worlds as standards based environments.
Eben: On the theory that avatar based interfaces have some broader purpose?
David: Right. Something akin to Second Life or variations of it in five or ten years is going to be deeply disruptive. Exactly which piece of it, I’m not making predictions actually, or exactly how it becomes disruptive.
I think it turns into the flavor of things like right now you go into Amazon, you go to book reviews. And there are 50 or 60 people who very carefully putting their opinions down and there are maybe ten other people who are curious about the author — who currently are thinking about buying their book. But you can’t see them on the web at all. But they’re there side by side pulling the pages reading the reviews commenting on them. But you have no chance of interacting with them at all. If in fact we can say now that you’re interested in talking about this author and this book, there are ten people happen to be in the internet context, interested in doing that.
Can we bring you together and have a conversation. You can ask a question rather than simply read someone’s written report. Why do you think the character is interesting? Was it because they do interesting things? Was it because their thought processes as described by the author interesting? What makes this a compelling book to you personally? And we can have a dialog rather than a static web.
Things like that, I think, are going to happen. Do they look like giant wolves wandering around freely through the Internet - which is half game space and half social a space, half social interaction spacee. Partially because in fact because Linden Lab didn’t set out to create that thing, people did, so I figure some of that meets human needs.
But the disruptive change is this weird blend between Wiki, comment pages, chat, talk, and 3D helps along with it. I’m deeply opposed to calling it 3D internet. I think you focus on avatars and visualization and you miss the fact that it’s a blend between what My Space does and classic internet chat that’s really exiting -which a lot of social community building.
What followed at this point was a wide- ranging discussion on whether Virtual Worlds may effect fundamental aspects of human neurology -“Is this an interface that grows the mind or shrinks the mind?” - and underlying issues and problems with privacy on the internet. Two key questions Moglen raises are: “Is store it yourself fundamental to freedom in the 20th Century?” and, “Who gets the logs?” I touched on these questions in an earlier post, “If The Metaverse Goes Wrong….” And there is an excellent podcast of Eben Moglen speaking on these issues at the MySQL conference. Also see David F. Flanders blog.
To focus this post on some very practical suggestions re privacy and avatar rights that came up in this particular discussion, I begin the transcription where the discussion began to dig down, both conceptually and technically, into the architecture of digital public space.
Eben: When I teach about this with law students, I say there are three elements that are mixed up in privacy and we tend not to notice which one we are talking about at any given moment.
There is secrecy - that is the data should not be readable by or understandable by anybody except me or people I designate. There is anonymity which is the data can be seen by anybody but about whom it is should be knowable only by me or people that I designate. And there is autonomy which isn’t about either secrecy or anonymity but which is about my right to live under circumstances which reinforce my sense that I am in control of my own fate. And this form of privacy is actually the one we talk about in the constitutional structure when we talk about the right to get an abortion or use birth control.
The Supreme Court says this about the ability to make our own life choices about having control over the serious consequences of circumstances in our lives in which we make moral judgments. But in the original companion to Roe against Wade, Doe versus Bolton, which was the Georgia Law that was being challenged at the same time that the Texas Law was challenged, Mr. Justice Douglas wrote the opinion for the Supreme Court in which he talked about the freedom to walk, loaf, or stroll meaning that it was more than just a question of some particularly important life decisions.
There was a feeling of a constitutional liberty in making ones own decisions about all the matters in ones life, which I think is also the liberty interest that the court protects in a case like [[inaudible]?? The guy simply wanted to walk about LA in the night time and got tired of being asked to show his drivers license at every step because he was a six foot tall black man with dread locks. He sued over the right, which I thought we used to have in the US, to walk around without having to identify ourselves to people all the time which isn’t just an anonymity problem but becomes a problem because it forces certain kinds of choices on us.
I think that the real issue here is about the forcing on choices on us. I see again and again the ways in which people now find themselves unable to make certain life choices easily because there digital self has acquired an inflexibility that constrains their non-digital self.
Lets start with really simple stories of minor behavior.
A law student comes to me and she says: “I had this bad break up with my boyfriend. And I didn’t want to be on My Space all the time looking at all the photos of him with his new girlfriend. So I dropped out of My Space and I went away. But the problem was that I was the photo collector for my little circle of friends which wasn’t so little. And, I had eight thousand tagged photos that was everybody’s life in law school. And, I was the one who was the keeper of everybody’s photo album. And, when I dropped of My Space they couldn’t get to those photos anymore.
So this was a real cost to people and they were really pissed about it. And they needed to decide how to go ahead and persuade me to come back to My Space. But of course they had already graduated and spread out among law firms and cities in N. America. So they had to coordinate the campaign to get me to come back to My Space. So they made a make so and so come back to MY Space page, in My Space. And, they went and hashed out all this over their photos because they weren’t going to leave all their photos from law school in a place which they couldn’t get to them because of my break up with my boyfriend.
Now there is a point that a fundamental decision occurs that she feels pretty seriously about as an individual. But she is being subjected to a campaign of peer pressure to hold her in circumstances that she is not going to like in order to get the photo album back.
Oh we might say oh there are a million other ways to solve that problem you can upload them all to Flickr and get the hell out of there. But what is actually happening she wanted to leave town and she couldn’t.
We have got to understand that when she wanted to leave town and she couldn’t. The digital self was trapped by a fence that the physical self had no problem passing through and moving on from.
We don’t want that to happen to people. We understood when the Soviet Empire decayed that all over it were places where people felt trapped in webs of surveillance and betrayal and interaction that had a kind of sinister feeling even if there is no Gulag and there is no shooting. And many of us feel very uncomfortable with the changes in the society we live in the United States in the past several years where for us there is no Gulag, no shooting, no being swept away with out charges.
We don’t actually think that like some poor lawyer in Oregon that our finger print is going to be misidentified as that of a suicide bomber’s accomplice in Spain. But we are aware that these webs of knowledge about us are beginning to control us because our digital persona is subject to leverage and to being interfered with in ways that matter.
I think that the question is there a power in projecting yourself into new environments in which you can meet people in new terms and in rich ways has no second answer, and there is no downside to it. But we owe it to people to build safe spaces.
When you said its Anaheim and they own it. We are touching on one of the really important problems for me as a lawyer which is these concepts of property.
I have just got done with guys who think protocols are property. Now I am going to have guys who think music is property. And after that I am going to have guys who think carriage is property. And at the other end is this sort of “you are on my digital island and I can look through your clothes if I want to because it is my island and that’s the way I make the rules.”
Now we have got a very strange notion here of property and we have a very unusual structure because most of the property that they could have in Anaheim is subject to governing. And even if it is Celebration Florida they still have only as much Home Rule as the Florida legislature will give them. And if there march against Alabama or even Logan Valley shopping center there’s rules that say what you can do in a company town about controlling people’s speech. I feel absolutely certain that when Google does it there will not be a guaranteed right to carry a sign that can be read by everybody in town explaining why Google sucks. It’s just not going to happen that way.
David: This is the “I write the TOS for people coming onto this public space. And there is no constitutional guarantees in this space.” Argument.
Eben: And I get the benefit of calling it a public space by which I actually mean my private space, real estate I invented.
David: Now in fact if you wanted to do something interesting there. This is to toss something into the tools to play with. And to toss it to you, in particular, because you are good at playing with these kind of tools. Which is, if I was going to attack that, I would go and attack that under common carrier. If you want to be a public space, if you want the benefits in law of being a common carrier then you have to accept these constraints on you behavior.
Eben: Well this is why this network neutrality thing rolled up out of nowhere. This is where this came from. The problem with this it is that it already begins by saying what you really like is innkeepers and stagecoach guys. This is an attempt to throw your selves 800 years in the past in order to come up with an analogy.
I think what we really want to say is something like this. If you are talking about a public space your talking about a thing that has not just a TOS contract but a social contract.
It’s a thing which has to do with what you get and what you give up in order to be there.
There ought to be two rules about. One: Avatars ought to exist independent of any individual social contract put forward by any particular space. And two: Social contracts ought to be available in a machine readable form which allows the avatar projection intelligence to know exactly what the rules are and to allow you set effective guidelines about I don’t go to spaces where people don’t treat me in ways that I consider to be crucial in my treatment.
Its one thing to say that the code is open source - let’s even say free software - it is another thing to say that that code has to behave in certain ways it has to maintain certain rules of social integrity.
It has got to tell you what the rules are of the space where you are it has to give you an opportunity to make an informed consent about what is going to happen given those rules. It has got to give you an opportunity to know those things in an automatic sort of way so I can set up my avatar to say, you know what, I don’t go to places where I am on video camera all the time. Self, if you are about to walk into a room where there are video cameras on all the time just don’t walk through that door. So I don’t have to sign up and click yes on 27 agreements, I have got an avatar that doesn’t go into places that aren’t clean and well lit.
David: So if I am going to walk into a space there is an “Ehum - you about to go into a space you really don’t want to go into.” So I can make an informed decision whether the trade off is worth it or not.
Eben: But that’s fine but you are going to have to go even further by saying here is the reason why you don’t want to go in there. Here is what you said in the past about why you don’t like places like this. You got to have an angel sitting on your shoulder - a code angel.
David: But before we can even do that we have to mark the world in such a way that I can make - that I can detect that I am making that choice.
Eben: That’s right you have to force the existence of social contracts in terms that are explainable. It is like I say to my students: “Should there be informed consent for My Space or Facebook?”
If I were doing this as a University project - if I was setting this up inside Columbia University - and building one of these space, and if we were going to have people there, volunteers, I would have to go to the IRB. I would have to explain why this was permissible human subjects research. And I would have to show the IRB an informed consent disclosure that showed what the risks were and allowed people intelligently to decide whether they wanted to run them.
Now I have got libertarian colleagues around the university, in the Law School in the Philosophy Dept in other universities who think this IRB stuff is creeping totalitarianism because it is inhibiting the rights of researchers to find out about the world.
And I understand their point of view. Just as I also understand why we have decided that there is some unethical human subjects research conducted in the past of which we consider so abhorrent that we won’t allow researcher to use those numbers. We consider that data to be the fruit of the poison tree. Not even to save our own pilots shot down in cold water will we use the studies about what happens when you put people in freezing water because we think that evidence comes from experiments you shouldn’t be allowed to conduct.
Now I look at these immersive experiences for children that the Times was writing about last week where you have four and five yr olds buying virtual gear in immersive spaces. And I think that is unethical activity. I think that the rules about children television are weak and not very important. But they are way stronger than that would let you get away with that kind of stuff on TV.
I think that is really serious screwing around with children’s wiring to explain to them that they have to be consumers of stuff that doesn’t exist where the only reason that they can’t have what they want is because the software is programmed not to give it to them unless they pay.
That’s a fundamental education in control of life by unfree software so elegant that Stallman probably doesn’t even know it is there because it is so horrible. But that is another perfectly imaginable outcome of this stuff. We create these things we create beautiful 3D amusements parks. We sell children rides for actual money extracted from real parents because the ride won’t go unless you put another nickel in the slot. And we going say - well its ….Disney Land.
Tish: Yes the children’s worlds can be very extreme….
Eben: Well Disney Land is a little extreme. When you go to Disney Land they open a file on you and they follow you through life. Disney buys everything that is can buy about all those children who have ever been to Disney land and they have got a reason which is bringing them back.
The average number of visits to Disney Land by people brought to Disney Land as children is four in a lifetime. Disney’s goal over the next 20 years is to make that six. And in order to make that six all they have to do is keep buying everything they can buy about all those people they opened a file on as children looking for opportunities by data mining to find an opportunity, like the oncoming 65th birthday of a parent or an oncoming retirement or a this or a that. They just have to play the siblings off against one another - you’ve never been to Disney Land but Johnny has. … They are going to do what they can do to create feelings around that person that says remember what it felt like being in Disney land when you are child - do that again.
Tish: So what can we do about this - for example now we have an architecture working group - a community group - that is working with Linden Lab on creating an open architecture that aims to get away from the current model - the one that you are talking about right now that is currently the model for LL and everyone ….
David: And Linden Lab are better than most in that they are actually relatively explicit.
So, for instance one of the things that came up in their kick off for doing their next generation of architecture was what are the Avatars Bill of Rights what things do we prevent the technology from letting happen to avatars. They actually had that discussion.
And Lessig who was relatively enlightened about this had some comments about “Well we don’t want to force going to a public space that somebody else hosts other than Linden Labs to be a way of taking away rights from avatars explicitly.” Which is good. But none the less the model for 90% of the service providers is always going to be: “We have got you’re data. We have got your chat stream, we may have your voice stream, and we have your action stream. How much do you realize we data mine?”
Tish: Is the architecture group thinking about these issues?
Eben: One way of imagining that business …is that there is a “screen” and somebody is going to get it. Another way of looking at it is there may be some element in which the avatar projector is itself the guy who has a part of the screen.
If you want to be really aggressive about it lets assume we have infinite processing power and can slow things down to a crawl. We can take that screen and split it up in a shared secrets manner so that you could reconstruct the screen out of the data held by all of the people who were there. You could even reconstruct the screen if you had opt in co-operation from say 4/5ths or 5/6ths of the people who were there but no one person who was there could reconstruct the whole screen.
This is the sort of thing which cryptography was designed to make it possible to do. Its how escrowing systems in the high security world are supposed to work.
Lets just go ahead and finish this up. For every one of these that is built in the non secret world there is going to be one built in the secret world. So in the Government world we are going to have secure structures. One possible way of having secure structures is there is a trusted server and that will work for intranet kinds of use.
But lets just imagine for a moment what I think of for a conceivable reason for having this stuff is for the conduct of diplomacy, actual meetings. There is a whole lot of stuff that diplomats do because which is very expensive to do because it involves sitzplatz.You send guys to Vienna and they meet every week for thirty years for no good reason . You could do a lot of that in other ways - some of it by video conference - but lets us just for a moment assume that there are things you could do by means of certain kinds large meetings that occur in a neutral environment.
You could set it up so that no one party at the negotiating table actually has a record of what happened. Only by cooperation of multiple parties is the record of what happened there reconstructable. Because the way the space works is that it automatically divides all of the stream data up amongst the avatars and gives it to them in a shared secret structure. So without the cooperation of avatars you don’t have a reconstructable event.
At the moment, I am talking about technology that I can spec but it would be a little bit burdensome in performance terms to implement. But that doesn’t mean anything if we just keep doubling the speed of the chips.
David: Presumably if any of us get together and we have a conversation at my client end I see everything that is said, in some form. The question is how you prevent me from keeping that stream.
Eben: yes right we are going to be living inside an encrypted environment ..
David: Yes right and right down to the eyeballs of course because at some point the digital stream is there and I can capture it…
Eben: maybe although but remember the data mining isn’t just have having the chat stream…
David: No I agree, so the question is how much can you reconstruct - you can reconstruct a lot of it. I can pretty well capture the stream of everything my avatar saw. I can’t see what the other people had in the background conversation without their cooperation. But I can do everything that is said in public.
Eben: Yes, of course, and the most important thing is that, that is as much as the space manager can see too. And the space manager can see no more than what happened in public which is usually what we are concerned about.
David: So one set of reasonable desiderata here would be that stuff that we build enable a lot of that - which is to say that assets held by private individuals it should be possible to put them on private servers and pair wise or group wise discussions should be securable in and of themselves.
Eben: The protocols ought to be agnostic) But, it would be enough if the protocols were agnostic with respect to how that collection occurs. If the protocols of operation don’t necessitate that the data of operation wind up in any particular place then you got a protocol consistent with both what is now the familiar model and the less familiar model where more information stays at the end place.
David: Right now every single bit of data that’s in Second Life is owned by Linden Labs because you put it on their server and they fetch it back out.
One thing we are going to do for lots of good reasons is go to a web centric model where lots of the assets get pulled on to web servers traditional old fashioned web servers. At that point there’s absolutely no reason why I can’t say these are my assets I will let people come to me and ask for permission to see them. And many of them I will share freely, because the clothing I am wearing is the clothing I want them to see the clothing I’m wearing. But the contents of my pocket, my wallet, I’m not going to be so eager to give them. And it ought to be possible to have this office in a virtual world in which you say…
Eben: My filing cabinet is locked.
David: Right! The furniture, everything in here is public. But I’m going to pull out this document in which I’m going to show you some really cool ideas about this law suit we’re engaged in, and you can read it here, and you can walk away with what I gave your client to read. But you can’t find out the rest of my file cabinet at all because it’s safe in my machine.
And you may not even be able to take that document off the island as it were, out of the office. You may be able to take the pages you’ve read from it. The other thing that’s equally important is can I do the chat pier to pier rather than through the central server. Is there any reason why Instant Messaging as opposed to public chat gets dragged through public space. It certainly shouldn’t be.
Eben: Right. The protocol design ought to take as a feature that there is no requirement for intermediation of any communication among parties.
David: Right. Other than that which we need to do to actually get the consensual state. What we’re doing is taking my word, your words, Tish’s words, putting them into one spot and then sending them back out.
Eben: There are things we can agree to do together, but once we are together there are things we can agree to do apart.
David: Right! But there is some core tapping. If we were each sitting on a computer 500 miles apart, in order to have this discussion we do have to bring the space together and spread it back out. But we don’t have to let the guys over there see it unless we want to.
Eben: What we have is both point to point and many to many kinds of conversational modalities and that there shouldn’t be any intrinsic reason to block them off. Now there may be situations since that famous parental controls system. I don’t actually want people sideling up to my children and whispering in their ears in public places. I’m content to let my children be publicly addressed in public places because transparency is an opportunity to avoid certain kinds of misbehavior. And there may be locations which are transparent locations. And if you enter a transparent location, that should be something known to the avatar in a technical way as an entry point and it should be possible for avatars to either seek or avoid such spaces.
I think the goal here is to confine the conception ‘property’ to meaning something like traditional right to exclude and not let property in the form of the greater includes the less since it’s my property I may define everything that goes on here, and I may make whatever rules I please here. There is some community of communities which defines ’states’ which it is OK for places to be in.
There was a story in the New York Times a day or two ago, about a public park in Oregon that had gone bad. It was written in a slightly frivolous but not entirely frivolous way. It’s an ex-urban park, meant originally as a kind of highway rest stop park, far enough from everybody else that bad things began to happen.
People began to have sex in public, there are child molesters who pitched tents there and lived there, and so over time it becomes more a locus of crime than a locus of recreation. And what the parks authority of Oregon does is they shut it down. They close it up. They chase everything away from it. And now they’re in what they think of as a sort of rebooting period for the park. And then it’ll come back and a different community will be attracted to it and it will be a different park.
This is an example of ’space gone bad’ in meat space places. You can certainly imagine renegade space in a immersive world. Places where operators are not following the rules. Places where the operators are taking advantage of the free software nature of space building to build spaces which are deceptive about how they look.
They seem to be spaces of type X and they’re actually spaces of type Y. That should be at least a regulatory interaction if not a crime. That should constitute socially actionable misbehavior. Making spaces that don’t behave the way they seem to behave, that don’t give you what they seem to give you. And if we come out of all of this saying the FTC will occasionally make an order about this, I’m going to feel very dissatisfied.
David: There are a couple of interesting things lurking there again, one of which is, in the web today we don’t generally think of it as having two parts. There’s the very public part of the web, where you go to a page like CNN and you get the content and it’s assumed to conform to fairly common broad norms. And then there’s a different part of the web where people know that that’s not true. All pornography and large portions of adult community which are not necessarily pornographic but have some content of theirs that’s restricted and they tend to have click throughs often. So you get something that says you need to be informed at some level that something’s happening.
At the moment none of that interestingly enough is in the protocols, there’s nothing in http that says I have to mark my page as mature, or I have to mark my page as you might not want to bring your child here.
Eben: Right. And as you may recall Larry was himself a big believer in picks and the idea of privacy platform standards built in the web pages. In the end the theory was look there’s a big first amendment problem with making people grade their web pages.
Sandra Day O’Connor went for this theory of doors and locks and walls in cyberspace in the first child decency case. Larry realized he had started the United States Supreme Court down a very dangerous crooked highway and to climb back out again, it’s never happened. And Tim Burness Lee and the others weren’t enthusiastic to say the least, so it never occurred.
Now here it’s a little bit different and the reason it’s a bit different is your public accommodation law kind of aspect. You’re making a public space OK? We’re not telling you grade your web pages, we’re telling you if you’re going to have a public space you’ve got to obey the fire code. You have to post maximum occupancy. You’ve got to avoid chaining the fire doors shut.And you can’t put a surveillance camera in the ladies room. You can’t do it! And that’s sense. Not it’s my space I can do whatever and if you don’t want to take a piss in my monitored men’s room, you don’t have to. That’s not going to fly.
David: Right. There’s a series of layers here just like we say look there are certain things that you can never do in your public space or even in your private space. We don’t allow you to say this is my 5000 acre ranch therefore I can shoot people. We say there are limits to your right to use your space as you desire. Even if you have your Celebration – home rule ends with the norms of the state.
Eben: You can even own a city but you can’t own a city which is an island in space all by itself. It’s got to be part of the rule of law it has to acknowledge sovereign power
David: Except for Mogda Dishu perhaps.
Eben
