----- Forwarded message from Rich Kulawiec <rsk@gsp.org> ----- Date: Fri, 24 Feb 2017 11:12:08 -0500 From: Rich Kulawiec <rsk@gsp.org> To: liberationtech <liberationtech@mailman.stanford.edu> Subject: Re: [liberationtech] Facebook: Building Global Community - What's your response to Mark Zuckerberg? Message-ID: <20170224161208.GA24294@gsp.org> User-Agent: Mutt/1.5.23 (2014-03-12) Reply-To: liberationtech <liberationtech@lists.stanford.edu> On Sat, Feb 18, 2017 at 02:23:18PM -0800, Yosem Companys wrote:

To protect your privacy and security, stay off Facebook.

But, to build movements, create an account on Facebook (or Twitter or any other dominant centralized social network) and try to get as many people to join.

[ rhetorical "you" throughout ] I think this is a really bad idea: it's a trap. These aren't tools that exist to facilitate your cause: these are data harvesting and surveillance engines that will collect and collate every scrap of data and metadata your adversaries need. And once that corpus exists, it WILL be acquired: it's much too valuable and much too easily transmitted to have the slightest chance of staying in one place. This is obvious on inspection: every architectural decision, every design decision, every operational decision, every policy decision ever made by these operations supports the goal of data acquisition. It's what they were built to do. All the other stuff? Shiny distraction. Bait. Scam. Propaganda. Whether the data's acquired by overt contractual arrangement, whether it's acquired by force of law, whether it's acquired under the table, whether it's acquired by hacking, whether it's acquired via individual employees, it WILL be acquired. Nobody leaves that rich a source of actionable intelligence just sitting on the table untouched. So all that you will accomplish by using "social networks" is: (a) building the database your enemies need to destroy you and your allies and your cause (b) building it in a place where they can easily get it -- if they haven't already had it from the moment you created it. For example: If I were working for fill-in-the-blank, I would already have my own people in place at Twitter and Eventbrite and Meetup and Facebook and all the rest -- either full-time employees, or people I've co-opted via bribes, blackmail, or other means. They'd be there long before you were, just waiting for you to show up and start spending your time and your effort and your money handing them as much data/metadata as you possibly can. I would do much the same thing if I were a sufficiently-organized, sufficiently-funded group intent on propagating racism or fascism or poverty or pollution or any of the things likely to trigger opposition. Why not? It's cheap. It's easy. It's low-risk. It's sustainable. It's simple. It's deniable. It's scalable. In contrast to other spying/surveillance operations, which can be expensive, complex, and risky, this is a cakewalk *because they already built everything for me at their expense*. What possible reason would I have for not taking advantage of it? You'll give me data on your supporters, your allies, your movements, their movements, your family, their families, your friends, their friends, you employer, their employers, their spending habits, their operating systems, their web browsers and mail clients, your meetings -- and much more. I'm going to end up knowing far more about you and your people than YOU know. If you're trying to "liberate" someone or something, the first thing you need to do is liberate yourself from "social networks". You should be trying as hard as you possibly can NOT to generate this data/metadata at all, anywhere -- instead of not only doing so deliberately, but doing it in a place that you have zero control over and that your adversaries can access far more easily than you can. (Please don't even try to tell me stuff like "my Facebook group is private". The only possible response to a fairy tale like that is mocking laughter.) If you insist on blundering ahead with "social networks" anyway, because you're too stubborn to listen or too naive to think it can happen to you, then as soon as you become a problem for an adversary with the requisite resources -- that is, as soon as you become effective at annoying someone with money or power -- they're going to exploit this. ---rsk p.s. And as if this wasn't enough, in case you haven't noticed, the US is now demanding "social network" passwords from people entering the country. Howls of protest have gone up, and a joint letter from a coalition of human rights and civil liberties organizations has been penned. The combined impact of all this will be zero. This administration doesn't care for facts or reason or petitions or protests, only about imposing its will. All that's necessary is shouting "TERRORISM!" repeatedly and accusing opposers of weakness and lack of patriotism and supporting the bad guys: this is more than enough to get the stupid segment of the population -- which is the majority -- to support this nonsense. And by the time it's replaced with a sane one, IF it's replaced with a sane one, the damage will be done: this will be the new normal. See "the Overton window" for the archetype. And, as that letter observes, what the US does will be copied by other countries, so we're not far from a future where most countries demand exactly the same thing. And given that this is all being done under the guise of stopping the insignificant but easily hyped threat of terrorism, refusal isn't going to be a viable choice. This would be bad enough, even if the exposure was limited to the governments involved. But it won't be. These passwords have value. Therefore there will be buyers. Therefore there will be sellers. Border personnel (traditionally among the most corrupt public officials, since they have the most opportunity) will no doubt find it quite lucrative to acquire and market these to *anyone* who can pay: human traffickers, drug dealers, kidnappers, stalkers, organized crime, *anyone*. Why not? It's not THEIR data. You're not THEIR problem. And they have a combination of nearly unlimited authority backed by lethal force, accompanied by zero acountability and more than enough plausible deniability. The only way to win this game is not to play. -- Liberationtech is public & archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at companys@stanford.edu. ----- End forwarded message -----