Thursday, August 30, 2007

The Hillsborough County School Board

I know nothing more about this dispute than what I’ve read here, but this post (Making Sense of the Hillsborough County School Board Tension, by Matthew K. Tabor) is a hatchet job.

It is clear from the valuation, that while two members were critical of Elia’s performance, the remaining five were very strongly in support.

Tabor remarks, “The problems here, however, are less political than with members’ differing commitments to serving the district.”

But this isn’t shown at all in the post, no matter how many times he recites, pointlessly, “203,000 students and over 25,000 personnel.”

The debate is whether Elia is working with the board, or contrary to the interests of the board. Griffin states repeatedly in her comments that “she (Elia) has been unyielding in her dealings with the Board.” But she has the support of the Board - the evaluation makes that clear. There’s no need to be ‘yielding’ because there’s no demand to be yielding - except from Griffin.

Supporting his position, Tabor cites an excerpt from the evaluations, saying “there is no question that her (Griffin’s) reasoning has a solid foundation; she demonstrated that by explaining herself in full and citing relevant statutes to support her argument.” And you comment that it shows, “also the indifference of other board members.”

The small excerpt cited ay demonstrate indifference, but the much more detailed comments found in the full document displays anything but. Edgecomb in particular is volumous, and Olson discusses at length some areas of improvement.

Moreover, though Griffin cites statutes, she doesn’t do so usefully. She states, for example, that it is the duty of the Superintendent to “cooperate” with the school board. This she has evidently done, to judge by the evaluation. Griffin’s argument succeeds only if *she* is the school board - but the statute does not apply to Griffin personally, but to the board taken as a whole.

Griffin’s examples are petty. She complains that the Superintendent routinely presents only one option to the Board. She complains that, although implementation of a certain policy was stipulated in the contract, the Board should have been able to determine *how* the policy was implemented. Yet these - if they are actually a problem for the board (taken as a whole) are very easily dealth with by the board, which can simply vote to reject the proposal or to require two options. Griffin’s problem is with the other board members, but she is taking it out on the superintendent.

It is also - I might add - very demeaning and unprofessional to refer to the superintendent by her first name throughout the evaluation. The complaints read like schoolyard whining. “MaryEllen has displayed a pronounced tendency to conceive a plan with her closest advisors…” “MaryEllen’s approach… can only be described as ‘meeting your own agenda.’” “MaryEllen must learn to forsee the challenges her recommendation may create…” “MaryEllen tends to promote her own vision…” This isn’t criticism. It’s pouting!

The discussion, which occupies most of the second half of the post, of Jennifer Faliero relocation to another district, is so obviously off-topic that it reeks of a personal attack, whether or not Tabor knows any of the participants. It is irrelevant to the issue at hand and is introduced only to discredit one of the five people supporting the superintendent (that four untainted voices nonetheless remain is not considered in your post).

I don’t know what the issues were, I don’t know what the 6/7 plan or FCAT are, and I might well line up against the Superintendent - and with Griffin - politically. I have no idea.

But as I say, this post is not a fair treatment of the matter. It supports Griffin for no good reason - and the last coulple of lines suggest that the motivation was purely partisan, and not based in a reasonable assessment of the issues at all.

Tuesday, August 28, 2007

Interview About Learning 2.0

Ido Hartogsohn wrote:
* What is learning 2.0? How is it different from so to say elearning 1.0?
I discuss this topic in my article 'E-Learning 2.0' -

In a nutshell, the difference between 1.0 and 2.0 is that in 1.0 students are depicted as passive recipients or consumers of knowledge and information, where in 2.0 they are active participants in the creation of that knowledge and information.

In practical terms, the difference is between that of technology systems that lead and present - things like learning management systems and online courses, for example - and technology systems that engage and call for contributions - things like social networks and blogging software.
* How is learning today different from learning in the age before the internet?
The process of learning has not changed. That is to say, the same neural activities that took place before the internet continue to take place after the internet. To 'learn' is to develop a particular neural configuration that results in appropriate pattern recognition and appropriate actions and undertakings. The development of these neural structures is based primarily on sensory input, particularly when accompanied by corresponding actions (such as 'practice') or conscious thought ('reflection').
* How is the thinking of "digital natives" different from the thinking of older generations? Is is better is it worse or just different?
It is very likely that the substantially different experiences had by the younger generation has resulted in neural structures that are different from those developed by their parents. It seems evident, from reading and math test results, that there is less of an emphasis on formal thinking and abstraction by the younger generation. By the same token, younger learners have a much greater exposure to images and multimedia, and multiple simultaneous streams of input, which would result in their being more audio and visually based than their parents - more concrete - as well as more likely to multitask, to bring together diverse streams of input.

That said, I would challenge perceptions that the younger generation is anything like illiterate (though probably traditional texts, such as Dickens and Austin (let alone Shakespeare) probably read like old English to them - I hesitate to think of what they would make of Thomas Hardy without a film like 'Tess' to guide them. In fact, the language has changed substantially in just a few generations: from a complex syntax and expression used to support advanced reasoning in what was actually a very limited vocabulary, to a virtually limitless vocabulary, one that changes every day, and admits easily of new creations, which requires a much lesser role of syntax. It is as though English were morphing into Chinese, which has a symbol for every thought.

Take the lolcat for example: 'I CAN HAS CHEEZBURGER'. These are garbled and syntactically incorrect English phrases, frequently in ALL CAPS, superimposed on images, typically of cats or other animals. The expression is very simple and deliberately distorted, however, a lolcat is a complete expression of a thought. The 'original' lolcat is here: If you read the comments (102 of them as I type) you can see the concept expressed by the photo evolve - the cat is typically called 'happycat', there are overtones of hope and satisfaction, it is very funny, but at the same time commentary on temptation and restraint. And at the same time, it is also a commentary of grammar and expression. This response captures that perfectly: "egsllnt..nowz we uz da stikee ta goes to beginin n getz to see hapy kittah frum eziness!! 100+ chezbrgrz n tofubrgrz!!! =)" There are dissertations to be written (in old English) on lolcats.

I write more about this here:
* How does the net encourage critical thinking in comparison to the classroom?
Neither the net nor the classroom inherently encourage or discourage critical thinking.

I should also preface this response with the comment that there are wide differences of opinion as to what constitutes critical thinking. My own view is that it essentially encompasses the practices of comprehension and evaluation. I expand on these thoughts here:

That said, education, as it is typically conducted in the classroom, tends to be more in the presentation mode, as discussed in the first question above. This means that there is a tendency for students to be expected to be passive consumers of information. This tends to argue against the practice of critical reasoning. Obviously numerous exceptions must exist, and a quality teacher can foster critical thinking even in a generally presentation-bound environment.

Online, there is no pretense that there is only 'one way' to view an issue or a problem, and the reader is confronted with numerous and contradictory voices. This is true even in a relatively closed environment, such as an online course, where in addition to the presenter the student will be exposed to other students' expressions. In order to gain any comprehension from the online environment at all it is immediately necessary to assess points of view and to identify credible voices.

Online, as well, there is greater opportunity to present one's own point of view. This immediately exposes it to the expressions of other writers'; assessments, any of which will demonstrate the principles of critical assessment. Even poor critiques - such as though that attack a writer personally, misrepresent what is being stated, or change the subject - offer an object lesson in critical reasoning, as the writer comes to understand what ti feels like to be unfairly criticized. It is certainly true that some people - known commonly as 'trolls' - never advance beyond this low level of reasoning. But, as they say, the exception proves the rule.
* What is meaning making? How do net surfers study in a different way than people in the past?
In the roughest sense, 'meaning making' is the placing of perceptions or information within the context of a perspective, point of view, or world view. In other words, the 'making meaning' of something is to show or to understand how that something assists or contributes to one's understanding of the world.

Beyond that rough outline, the topic of 'making meaning' is fraught with dispute and conflicting accounts of 'meaning'.

The term 'meaning' is of semantical origin. The word 'meaning' traditionally applied to words. The idea of 'meaning' is that one thing - the word, or the 'sign' - stands for, or represents, something else - the 'signification'.

Words can obtain meaning in numerous ways. Tarski's theory (which forms the heart of logical positivism) fixes the meaning of a term in what the term refers to. The famous phrase "'Snow is white' is true if and only if snow is white" expresses this idea. The 'meaning' of a sentence, therefore, constitutes the conditions under which the sentence is true. Expanded, this comes to be the theory - called 'verificationism' - that the meaning of a word constitutes the process by which the truth of the sentence is established.

But the meaning of a word (or sentence) may extend beyond what the words directly refer to. Frege captures this idea by distinguisging between 'sense' and 'reference'. Other writers speak of the distinction between 'denotation' (ie., what a word 'denotes', or refers to) and 'connotation' (ie., what a word makes you think about, or what a word is associated with). Such a distinction is necessary to understand metaphor. 'The early bird captures the worm' is either meaningless or false when understood strictly by reference, but understood as a metaphor, may well be true.

In either case, there is presumed to be a strong correlation between what a word means and the state of affairs in the world. The idea is that, without a corresponding state of affairs, a word is, literally, meaningless. This opens the way, substantially, to a way of understanding the world, by understanding how we describe the world. While logical positivists are willing to accept that the utterances of some people (specifically, priests and metaphysicians) are literally "meaningless", others are not willing to believe that what we say about the world comes from nothing, and hence, to find the larger sense of the world, through which to understand the meaning of our expressions of it.

This approach has a long tradition, stemming from people like Descartes ("I think," he says, "therefore, I exist,") to Kant to Husserl to Chomsky, who employs the 'poverty of the stimulus' argument to postulate the existence of a capacity for generative grammar innate in the human mind - the meaning he finds in language, which may or may not express a truth about the world, nonetheless inescapably expresses a truth about the self (and therefore, the world).

And this tradition has allowed writers to expand the domain of 'meaning' to expand w6ell beyond the semantical realm. Just as the utterance of words can sometimes constitute actions (cf JL Austin, speech acts) by the same token actions can have meaning. Sometimes an action - such as a protect or a fast or a self-immolation - can be symbolic, while in others (walking across a frozen lake (thus signifying a belief that the ice is thick) can be literal, or referential. This has in common discourse come to allow us to attach meaning to pictures, objects, works of art, to life itself. Only now, as often as not, people express 'the meaning' of something semantically, that is, with words. This, 'making meaning' comes to mean some sort of process of encoding or representation - the 'truth' lies in the understanding of the expression.

All of this is represented as a deliberate, intentional act, where there is a separation between the person and the 'meaning' being made (much less the signification). It creates a hierarchy of either (modernist) 'world-representation-self' or (post-modernist) 'self-representation-world' (where, in the latter case, 'world' is an optional, and highly individualized, construct). The relation between these entities is structured, logical (or, at least, can be understood, though some process (criticism, say) to be logical), syntactical, formal. Hence the idea of *making* meaning - no matter how one looks at it, whether as a modernist (realist) or post-modernist (idealist) the meaning can never simply *be*.

This is probably collapsing in online thought. If pressed, people would probably say that both the 'world' and the 'self' are constructs, things we create in order to understand the world. This is what writers like danah boyd are seeing when they look at things like MySpace, or for that matter what people say when they saw people trying on various identities in the old MUD worlds or today's 3D versions, Second Life and World of Warcraft. Our actions, our constructions of self and world, may be intentional, but we don't construct meaning, we *grow* it or (better) we *become* it. The recent work on the stimulation of disembodied experience is an example of the sort of work that could not be conceived in an earlier age - how can we create an experience where we are something other than what we are? How, indeed, unless our very existence is something we create.

We are not structured, syntactic, creatures. The sentences we create neither represent the world, nor are they represented by states of affairs in the world. We obtain a greater clarity of expression through the non-sentential, through the concrete figurative, like the lolcat. These things don't 'stand for' anything, they just are - their meaning is self-contained, and insofar as they have representational value to the viewer, it is in evoking an aspect of the web of connections that already exists in their own mind. The lolcat is a synthetic whole, that evokes different perceptions from different people, the meaning growing organically on the viewing, through recognition ('oh yeah, my cat has an expression exactly like that') rather than being created or constructed.

More and more, I think, processes that resemble 'making meaning' will be thought of and dismissed as 'phoney' and 'fake' by net generation viewers (the way a corporate blog is 'phoney' or 'fake').
* What is the importance of learning to learn in our information age?
It's like the importance of being able to swim (to navigate through a moving current of water) as opposed to being merely able to float (to be supported by the water).

Being able to learn allows a person to set their own direction. This is important in a world where things are constantly changing (but not exclusive to that world). Otherwise, one must depend on being taught, which place them in the hands of the teacher, unable to set their own direction or path in life.

People often depict 'being able to learn' as essential as a strategy for coping with change. It is not. People can be (and frequently are) swept along with change. Sometimes this works out well, other times it doesn't. But people - at least some people - survive. Being able to learn isn't about survival. It is about freedom. It is about being able to chose where and when change sweeps you. It allows you not only to adapt, but also to say 'no', and also to create a new environment, to which others will adapt.
* How is learning from blogs and social networks different than learning from a book?
First, the book is a presentation of a single, synthetic voice. It is (insofar as it represents multiple points of view, which it may not) the fusion of thoughts into a single, definitive, expression. It is a transmission of that expression. A person can interact with a book (by taking notes, by writing to the author, by arguing about it with friends) but cannot see the same point of view represented in multiple modalities, from multiple points of view. A conversation with a book is like a conversation with one person (a relentless, logical person, a Mr. Spock). By contrast, the process of learning from blogs and social networks will present a perspective from multiple (and often contradictory) points of view. There is no fusion; the combined content has not been processed into a consistent and homogenized whole. If there is a synthesis (and there might not be; the viewer may choose to identify with a certain perspective (we call these 'fanboys') it will be on the part of the viewer.

Second, the book is a logico-syntactical structure, a linear representation in abstract form of something (like, say, the world) that may be non-linear and non-abstract. The book therefore represents not only a particular perspective, it represents that perspective as a series of abstractions, as a series of instances of general principles. A book that reports 'The Cat in the Hat came back' reports on the event as 'An instance of the category 'Cat' instantiating an instance of the action 'wearing' an instance of the article of clothing 'hat', the whole instance of which is given the name 'The Cat in the Hat' (a clever use of definite description as nomenclature) is an instance of the infinitive 'coming back'...' Which is why the book has pictures. But in ever increasing contexts, the representation, by means of this abstract structure, is being seen as superfluous. It is seen, not as advancing our understanding of something, but rather, of obscuring it. The internet represents the decline of the universal, the decline of the infinitive - and hence, the decline of those modes of expression based on, founded on, and hence, dependent on, the existence of the universal. The lolcat isn't a universal anything. People understand that. It's just a funny picture.
* What about hypertextual learning such as surfing Wikipedia for learning. How is this different from reading a book? What are the advantages and disadvantages of that sort of learning experience?
In addition to the two things mentioned just above, the big difference is that a reader reading Wikipedia has the ability (and the obligation) to amend the text at any time, should it be necessary.

Though that said I should comment on the fact that Wikipedia has been slowly drifting toward the development of two castes of contributors, an 'author' caste, consisting of people who contribute, and an 'overseer' caste, consisting of people who remove contributions. The recently added ability to 'flag for deletion' of articles based on grounds such as relevance, completeness, significance, and the like, is creating a situation where the encyclopedia is created through a process of reference to (external) authority, rather than as an organic creation by its authors. The owners of Wikipedia should reconsider (or perhaps the authors of Wikipedia should fork).

The capacity to author the text, in addition to reading the text, places the reader into the perspective, for every sentence, that 'this sentence may be wrong' (or misleading, or poorly worded, or unclear, or offensive, and the like). It shifts the balance of power from that which is written to the person who is doing the reading. It changes the status of the content, from 'knowledge' or 'information' to 'perspective' or 'opinion'. It is not possible for an informed person to simply accept a Wikipedia article as a 'presentation'. The reader - even if he or she makes no changes - has become an active participant in its creation.

I should point out that this perspective is (like all others) a learned perspective. People do not automatically become critical or evaluative readers, and they do not automatically become participants in the creation of something. This is expecially the case for people who have an authority-driven background in teaching and learning, for people who have been taught from an early age that learning amounts to listening and remembering. Such people will need to learn, through practice and example, that the act of learning through an interactive medium such as Wikipedia is different. That is why we have the phenomenon, today, of a person who can contribute to Wikipedia citing it uncritically. Sometimes contradictions are not evident to a person until they are pointed out or (more often) made manifest by the hard light of experience.

Monday, August 27, 2007

Pollution and Propaganda

Responding to Barbara Fister of ACRLog

I think it is unreasonable to vilify China for hiding environmental data when the American government is doing the same.

American government officials have engaged in a years-long campaign to deny global warming, a campaign that involved misleading and false research reports, funding for lobby groups posing as scientific agencies, and much more.

The United States has still not signed onto a global environmental treaty, preferring instead to preserve its polluting industries, the very ones it now criticizes China for running. Had the U.S. signed onto Kyoto, it might have had grounds to argue. However it did not, and in fact was its most vocal opponent.

The U.S. media has been engaged in a systematic campaign to discredit China for the last couple of years, and this article is another episode in this course of propaganda.

We've been subjected to a whole series of articles asserting that China has poison in its products and that Chinese exports are unsafe. Why now? Nothing in China has changed, and if anything its products are better than ever.

Although the New York Times apologized after the onset of the Iraq War for shamefully passing along government propaganda as news, it seems evident from articles such as this that nothing has changed.

As for the tradition of access to data and academic freedom in the United States, I would suggest that it's time for a good examination of what is actually happening.

To a large degree, academic output in the United States is driven by funding, and this funding frequently has an overt commercial agenda. There is no shortage of reports of research data being altered or suppressed in order to satisfy the demands of corporate sponsors.

There has also been a series of incidents where professors are harassed and even fired because of their political views. I read about the latest of these, the firing of Norman Finkelstein, just this morning.

In corporate offices and classrooms, access to a great deal of online content is blocked, only some of which is even arguably offensive. Criticism is stifled through the threat of lawsuits and copyright actions.

Access to the media in the United States is limited through an effective stranglehold over the industry by a small number of conglomerates. These agencies limit the perspectives offered and offer Americans a distorted view of the world. While corporate and political advertising is effectively unlimited, attempts by agencies such as Adbusters to buy commercial time have been blocked.

It is very evident from my perspective that Americans live in an environment where the news is tightly managed, where scientific data is manipulated, where academic freedom is abridged, and where an ongoing stream of propaganda manipulates the citizenry in a manufactured climate of fear.

Incredibly, Americans throughout all this continue to trumpet the virtues of their free press, and even more incredibly, their environmental record.

The world's major polluter always has ben, and continues to be, the United States. The statistics are available but you can be sure they are barely accessible to, much less known by, the average American.

Update: as of 12:00 this comment no longer appears on the ACRLog website. Presumably it has been deleted. Update Aug. 28 - barbara Fister comments (see below): "I checked with others at the blog - none of us saw your comment and we can't see any record of it. Please feel free to add your comment, since we welcome them." I submitted a second time; it does not appear on the site.

Friday, August 24, 2007

Freedom and Rules

Doug Noon writes "In We Make the Road By Walking, Friere said that freedom can only exist in conditions that are subject to authority. The student, he said, 'experiences freedom in relation to the teacher’s authority.'"

There's a danger of this sort of thinking becoming Hegelian, where 'freedom' is defined as what one 'would' do, where what one 'would' do just happens to be that which aligns with the system of constraints and regulations set out by the rulers. Thus any existing set of constraints and regulations becomes self-justifying. c.f. the Philosophy of Right

What is actually happening here, though, in my view, is a refutation of the idea that freedom is defined as being 'without constraints'. On such a model, every constraint or regulation becomes a limitation of one's freedom, and then must be negotiated, as in Hobbes or Locke, against a criterion of personal or social security. The idea that a constraint or regulation is inherently a negative thing is strongly enshrined in modern liberal and libertarian thought. But it is the opposite extreme, the idea that every removal of a constraint or regulation is inherently self-justifying.

But if freedom is neither the presence nor absence of constraint or regulation, then what is it?

Without trying to post The Definition, let me say that 'freedom' is something like the ability to develop to one's maximum capacity. That is, freedom is not (simply) the absence of restraints, but also the set of gifts, affordances and capabilities that allows one to (as Mill says)_ pursue one's own good in one's own way. Freedom becomes, not some natural state that remains after all else is cleared (or determined), but something that is grown, built, created, or forged for oneself.

When Rousseau says 'Man is born free' he means, not so much that freedom is 'the natural state', but that all of his hopes and dreams and aspirations lie before him, as yet unshackled by the appropriation of his gifts, the denial of his affordances, the usurpation of his abilities, that characterizes a modern society of authority and control

Freedom is the result of an emergent system, the result of a process that allows for maximal variability and complexity. But it is not *merely* variability within a bounded system. The example of the river delta is misleading; nobody would say that the river delta is 'free'. Noon argues "Rules in a complex system delineate limitations rather than setting forth a list of specifications" and that "limitations of rules and boundaries provide coherence for a system". The suggestion is that a complex system does not inherently have the capacity to achieve coherence. This is false.

When Davis and Sumara say “complex systems are rule-bound” the suggestion seems to be that the resulting system is defined by the rule system, made possible by the rule system, and would not exist without the rule system. Certainly, there is no doubt that the imposition of constraints can shape a complex system. But that is far from saying that the system would have no shape without the rules; it would, just a different shape. And it is difficult to argue that the resulting, constrained, shape is somehow the complex system developing to its maximal capacity.

I think there can be rules, and I think that rules can contribute to the development of potential, but those are rules that do not take away, do not constrain, but rather, those that provide capacity, provide potential and possibility. Of course, those are rules that place an onus on the governors, not the governed, making it a responsibility and a necessity to build and support capacity, rather than to limit it and take it away.

And I think this is a better sort of freedom. Because freedom, when it is merely the absence of constraint, always has an end point, an empty point beyond which no person can become more free, a point that, when attained, is discovered to be pointless and purposeless. A freedom defined by one's capacities, however, has no inherent limitation, and can be extended indefinitely, to the limits of our imagination.

I never think about the rules. The rules don't define me, and never will. I think only about what I can imagine, about what is possible, and what I could be. My freedom is defined by my looking up at the sky, not down at the ground.

Wednesday, August 22, 2007

Culture Wars and Canada

Responding to Scott McLemee:

To first addres the subject of ‘American’...

There is no continent called ‘America’. There is North America and South America, and together they are called the Americas. If you wish to denote continental identity, you should refer then to a ‘North American’.

People living in the United States long ago appropriated the word ‘American’ to refer to themselves (and we see it used in that context every day). They are welcome to keep it — and rather less than welcome to include Canadians under the umbrella of whatever constitutes ‘being American’.

As to the rest of the column...

Conservative pundits in Canada have long pined for a ‘national identity’ they could pin on everyone who lives here.

When people, like Cohen, express fears about “the elements of our character: the failure of memory, the weakness of citizenship, the tolerance of ethnic nationalism, the willingness to compromise one too many times” it is seen by the rest of us as code for wanting a nation that is “white, right and polite.”

Despite our occasional export of neo-cons like Conrad Black, David Frum, Mark Steyn, and others, it is very much a minority view, one that struggles for lip service even in Canada’s right wing Conservative Party.

The vast majority of Canadians have embraced a far different picture, one that not only includes our social programs (including public health care) and non-violence, but which also explicitly endorses a ’salad bowl’ model of society.

If there is a ‘culture war’ in this country, it’s more an American-inspired insurgency among those who have difficulty tolerating people who are different from themselves.

The rest of us take things like freedom of religion to heart. We encourage people to celebrate their heritage, whatever it may be. And that’s why you see things like gay marriage accepted in Canada (and not merely tolerated).

It’s a popular fiction, for some reason promulgated among Americans, that we have simply ‘fallen into’ our national character, and that we will continue to ‘muddle through’. Nothing could be further from the truth.

In a paper I wrote a few years ago, My Canada, I argue that our national character is one of deliberate choice and policy — that we chose to be open, diverse, peaceful and accepting — and that we built it into the fibre of our nation.

We are very proud to be Canadians — proud, not because we are all the same, but because we are all different, each of us with something unique and valuable to bring to the table, united by values of openness, sharing, and support.

The insurgency likes to depict Canadians as people who define themselves as not being American, but Canadians know better. Defining us in American terms distorts the picture; painting us in opposition to American values misses entirely the things that make us who we are.

The United States has ‘culture wars’, perhaps, but the same concept cannot be applied to Canada. There is no sense in which we expect one culture can reign supreme in this country — and it would be a very sad day for us all if one did.

Tuesday, August 21, 2007

Social Network Portability

Posted to the social-network-portability list, August 21, 2007.

From what I've been seeing thus far (and it has been great discussion) I'm seeing a set of three basic functionalities that need to be offered.

First, social network portability

Not coincidentally the name of this list. But what does it mean? Not an aggregation of all social networks in the world or anything like that. Think of a person's personal social network on, say, Facebook. A list of friends.

In the first instance, we want a consistent way of identifying those friends. That's what OpenID is for. Each person who is one of my Facebook friends should have an OpenID. Which means is that what we want is a way of associating existing accounts, such as a Facebook account, with an OpenID. From the perspective of Facebook, this probably means a plug-in application. Other social networks will roll this their own way. On my own site I simply ask people to log in with their existing account, and then (while still logged in) log in with their OpenID account.

Then, thinking of a social network as (essentially) a list of OpenIDs, we need the following:

a) a way to export this list from any social network. This means, in essence, a simple SN feed. Since OpenIDs are URLs, it could be as simple as an RSS feed or an OPML. I think of it in my own mind as RSSN (Really Simple Social Network) which looks exactly like RSS except the link element is an OpenID.

It could also be a FOAF feed (though I echo the comments about it being a pain to work with). Something like Anthony Romano's openfriendfinder/foaf would be a great tool to support this (until the various social networks supported it natively).

It should also support authenticated access (even though the whole userid password thing in RSS aggregators is a pain). Because the idea here isn't so much to broadcast one's social network to the world. That's a separate function. The object here is to have some way of allowing someone to get their own social network from a site.

b) (optional) a way to work with these lists. An RSSN or OMPL or whatever mix and match. Maybe a way to edit the thing by hand, if I want. A way to add attributes (that would be useful for OPML as well, so I could tag my RSS feeds as 'canadian' or 'British' or whatever - but I digress). The main thing is, I can aggregate one or more lists of OpenID URLs into a space, and then merge them and edit them as I wish.

c) a way to import this list into a new social network. This is the big payoff. I don't need to add my friends, one by one, into the new social network. I just import my list.

A few people have talked about the properties of these lists. Are they 'follow' lists, for example, or the names of people I am following? We could probably come up with some basic types, based on (say) communication capacities. 'People who can send me stuff (aka 'whitelist')'. 'People I want to send stuff to (aka 'subscribers')'. 'People who are both.' 'People I actively check for posts (aka 'feeds'). And so on.

But we don't need to define this. Different social networks export different kinds of lists, and we can lable them as we export them. Different social networks will deal with lables differently. This is how we differentiate between different social networks.

Some people have been talking about the (web-wide) social graph. That's not part of this. We don't need that for this. This is simply a matter of me being able to manage my own lists.

Second, attribute portability

We've seen discussion of this in the OpenID community under the heading of 'attribute exchange' which has been concerned mostly with fetch and response requests.

We also saw discussion on this list with the proposal for a 'Rich About Me' page for WordPress sites. And, of course, FOAF is not only about lists of friends, it's also a way of describing oneself. FOAF combines all this into a single document. But there's no need to do so; we could have several lists of OpenIDs (friends, enemies, lovers, etc...) and the URL for each list becomes an attribute.

Essentially, what we're looking at here is a profile generator that can work with OpenID providers. What would work best is a 'standard' profile generator that we can just shoot to a site when we do a one-off contact with it (like making a comment). This avoids the need for all the allow-deny dialogue. I have often thought of an RSP format (Really Simple People) that looks a lot like an RSS item - the basic elements (name, link (with is an OpenID, of course), description) plus a set of optional elements (how hard would it be to come up with a list? we don't even need a canonical vocabulary).

My list of people could use RSP for each person I'm in contact with. I could collect attributes about you. Not just the ones you send me (though that would be useful) but also attributes other people send me. (See my paper Resource Profiles for much more on multi-party metadata).

Personally, I think that among the most useful attributes will be service URLs. For example, suppose you comment on my website. If I want, I could require that you actually post the comment on your own site. What I would need to make this work is the address for your blog upload service. Then my application accepts your comment and sends it to your blog software's API. Or if you register for an event on my website, if I know the URL for your calendar service, my application accepts your registration and sends the notation to your calendar.

Third, network traversal services

In the discussions thus far people are thinking of nifty applications for social networks. Like message white-listing. Or a bookmark search service, that will go one, two, or whatever degrees away through (published) sets of connections.

These services are based, not on actual lists of friends, but on published lists of friends. Published lists are different from personal lists. For example, an 'RMail' service could work based on each person publishing a list of OpenIDs from whom they are willing to accept mail.

There may be more 'whole network' services, but for the most part, I think they will be the least important of the applications. Yes, there will always be a Google or a Technorati trying to create a view of the world as a whole. But I think the real power of social network portability will be giving us a view of our own neighbourhood - and letting people in that neighbourhood get a view of us.

I hope this was useful.

Visit Moncton

I live in Moncton, New Brunswick, a small city in New Brunswick, on the east coast of Canada, in some of the most beautiful country in the world.

I plan to do a nicer brochure-style post some time in the future, but I saw this video of Magnetic Hill in Moncton and thought I'd offer an interim 'Tour Moncton' post. Think of it as a progress report.

What prompted me to create this post is this YouTube video showing one of Moncton's feature attractions, the Magnetic Hill. Here it is:

I have been there and tried it. The hill looks and feels pretty steep. The car actually floats backwards up the hill.

Magnetic Hill. You may remember it as the place where the Rolling Stones played a couple of years ago.

Here's a few more videos, to give you a taste. We had Alan Jackson in the Country Rocks the Hill concert last year. The White Stripes were in town a month or so ago (here's some more). This year (in just a few days, actually) we have Faith Hill and Tim McGraw playing on the same site.

I have lived here for the last five years. I'm a natural tourist and have been all over the world. So it should not be a surprise that I have looked at Moncton from the perspective of a visitor. I've traveled through the whole region by bicycle and had the opportunity to visit some great spots.

More photos.

Take, for example, Parlee Beach in Shediac. This is a real ocean beach, on the Northumberland Strait, about 20 km outside the city. The water is quite shallow - you can walk out a long way - and so heats up quickly. As the tides come in and out it creates islands in the sand. The beach is very popular - on a warm summer day, arrive early.

More photos

Just north of Shediac along the Northumberland Strait is the little hamlet of Shediac Bridge. It's like a different world - cottages along the sea shore with hiking, fishing, canoeing and off-roading inland in the forest along the river.

More photos.

About a half hour drive the other way, you get to Moncton's other coast, the Bay of Fundy. We are one of the few cities to border on two major bodies of water. As you can see, this is a more rugged coast, and here, at the Hopewell Rocks, you can find the highest tides in the world. You can go down and walk on the seabed when the tide is out, and then kayak among the rocks when the tide is up.

More photos

As I've said, I've bicycled all over the region. Here's a photo from one of my recent trips of the beautiful Canaan River. It's about a half hour west of the city. The Caanan runs through a wilderness area north-west of Moncton and eventually flows into Grand Lake, in the centre of new Brunswick.

More photos, and evenmore photos

New Brunswick is known for its fall colours. I haven't done them justice in photos yet (I'll try again this fall). The best time to see the leaves turn is in mid-October (I have usually been traveling somewhere else then, which is why it's hard to get photos).

More photos, and more from my first year here.

Moncton can be as pretty as a postcard in winter. This photograph is from the first snowfall last year. Every year there's at least one snowfall like this; usually there's several. There's a lot to see and do in the winter, including cross-country skiing, snowmobiling, and watching the Moncton Wildcats play hockey.

More photos

The winter offers a wide variety of weather. Here's a mist we had on Christmas Day, 2003. It was surreal, walking around through Victoria Park and looking at the old homes in the mist in my neighborhood in the city.

More photos

In the first week of April the sap runs and so the bunch of us at the office went to visit the Trites Sugar Camp about five minutes north of the city. In addition to being able to tramp around the forest and look at the operation that makes maple sugar and maple syrup, we had all the pancakes and syrup we could eat in the rustic restaurant.

More photos

Later that same spring, Andrea went to the Corn Hill Nursery, about a half hour west of the city (we took the Acadian bus to Petitcodiac and then paid a local to drive us the remaining 10 kilometers or so to the Nursery). The Nursery specializes in roses of all sorts, but also excels in lilies and irises. We also bought a Belle de Moscow Lilac from them last year.

More photos

Last year, instead of taking the bus, I cycled to the nursery. This allowed me to visit the town of Petitcodiac, on the Petitcodiac River (pictured above). Also on my way back I saw motorcycle racing at the the River Glade Speedway.

More photos

People really enjoy motor sports in Moncton. You can see this at the Atlanticade annual motorcycle show, but nowhere is this more evident than at the Atlantic Nationals, a car show that attracts hundreds of cars - and tens of thousands of people - every summer. The downtown is closed off for the showcase and outdoor concert, and then the show moves to Centennial Park for a leisurely two days of barbecuing and bartering.

More photos

Moncton's transportation history is evident at the Train Museum in Hillsborough, about 15 minutes south of the city (you can visit it on your way to the Hopewell Rocks). The bicycle ride to Hillsborough is a series of beautiful hills overlooking the Petitcodiac inlet, and when you get there you can look at the old houses and have a coffee in the Tea House overlooking the bay.

There's a lot I haven't covered here. Like the tidal bore, pictured above. This is what happens when the tide comes in and the Petitcodiac River begins running backward through the city. The tidal bore used to be more spectacular, before a causway was built over the river. We're getting rid of that, and the river will flow free through the city again.

I also didn't mention the new mountain bike trail in the wilderness part of Centennial Park. It was just built by mountain bikers (with the support of the city) this summer. I enjoy biking though Centennial Park, but I'm a little too old to be messing around with the trails jumps and ramps. Or, for that matter, with the city's skateboard park on the waterfront.

I have also not mentioned the city of Dieppe, which is right next to Moncton, or the region's colorful French Acadian heritage. The original French settlers of the region were deported by the English in 1755, with many of them being sent to Louisiana - and becoming Cajuns. Many were able to flee and hide, however, and today we have a strong and spirited Acadian nation living alongside the English and other residents of Moncton.

Similarly, I haven't biked further north of Shediac Bridge, where I would be able to visit Bouctouche and the Le Pays de la Sagouine, a hub of Acadian culture and architecture along the sea, and Kouchibouguac National Park just north of that. I haven't mentioned Sackville, about a half hour to the south, home of Mount Allison University. Nor have I mentioned comedy at Yuk Yuks, shopping at the largest mall in Atlantic Canada, the University of Moncton, and much much more.

Monday, August 20, 2007

The Blogosphere is a Mesh

I said
You say "Wrong both descriptively - it's not what the blogosphere actually looks like... What we are more like ... is a mesh, and not a hub-and-spokes network."
I'd be very interested to know the evidence for that statement.
My evidence is that this is what I see, and that if you looked at it from the same perspective, you would see it too.

Yes, you could measure it 'empirically' via a formal study, but (as I have commented on numerous occasions) you tend to find whatever you're looking for with such studies.

For example, you could do a Technorati sort of survey and list all of the blogs that link to each other. From this, you could construct a social network graph. And that graph would show what the link cited in this thread shows, that there is a power-law distribution and therefore a hub-and-spoke structure.

And thus you would have found what you were looking for.

And yet, from my perspective - as a hub - I see remarkably little traffic flowing through me. How can this be?

The edublogosphere - and the wider blogosphere - isn't constructed out of links. The link is merely one metric - a metric that is both easy to count and particularly susceptible to power-law structuring. Links play a role in discovery, but a much smaller role in communication.

We can identify one non-link phenomenon immediately, by looking at almost any blog. After any given post, you'll see a set of comments. Look at this post of Will Richardson's. There's a set of 25 comments following. And the important thing here is that these comments are communications happening in a social space. They are one-to-many communications. This forms a little cluster of people coimmunicating directly with each other.

Now look at any social network, say This tool was ranked second on a list composed mostly of inputs from edubloggers. People link to each other on social networks. Each person keeps his or her own list of 'buddies'. Here's mine. Empty; I don't use much. Here's someone else's network. Edubloggers are using dozens of networks - Friendster, Bebo, Facebook, Myspace, Twitter and more.

But that's not all. A lot of the chatter I see going on between people I'm connected to is taking place via email, Skype, instant messaging, and similar person-to-person messaging tools. People put people on their 'buddy lists' that they want to call and to hear from. They collect email addresses (and white-list them in their spam filters).

Communications maps are typically clustered. Like so:

The result is also observable. You get a clustering of distinct groups of people with particular interests. In the edublogosphere, for example, I can very easily identify the K12 crowd, the corporate e-learning bloggers, the college and university bloggers, the webheads (ESL), and various others.

This diagram is well known: it charts linkages between books read by bloggers:

This chart is semantic; that is, it depicts what the people talked about. This tells you about the flow of ideas, and not just the physical connections. And when we look at the flow of ideas, we see the characteristic cluster formation.

The network of people who talk about engineering is, similarly, a cluster:

Another way to spot the blogging network is to look at conference attendance. You can again find these clusters. I don't have diagrams of the edubloggers, but this conference attendee network of Joi Ito's is typical:

If we focus, not on a single physical indicator, but on the set of interactions taken as a whole, it becomes clear that the bloposphere is in fact a cluster-style network, and not a hub-and-spoke network. Bloggers form communities among themselves and communicate using a variety of tools, of which their blogs constitute only one.

Saturday, August 11, 2007

Why Not CC-By?

Responding to David Wiley.

This post goes a long way to explain the genesis of the OEL. However, significant questions linger.
First, the OEL is not meant to be “the license” that replaces all other licenses...: CC By-NC-ND, CC By-NC-SA, CC-By-ND, CC By-NC, CC By-SA, GFDL, CC By, (OEL goes here)... Public Domain is impossible to put at the end of this list.
The U.S.-centric nature of Creative Commons has long been a problem, and this is most clearly evidenced by its attitude toward public domain. So I accept the idea that there needs to be a license to the right of the list.

But why is it called the Open Educational License? Why not just call it the 'Open License'. Or 'CC-Open' Or some such thing that does not tell readers that educational content is Open for Business?
Second, there is a major mechanical problem with the way CC By is used by people. The Attribution requirement of all CC licenses, including CC By, states “You must attribute the work in the manner specified by the author or licensor.”
This problem is generated by an equivocation on the word 'specified'.

I 'specify' my attribution on every page of my site. At the bottom where I say 'Copyright 2007 Stephen Downes'. The attribution to me would be as I have specified it, 'Stephen Downes'.

But of course you are interpreting the word 'specified' to mean 'citation instructions'. What good grounds are there for this interpretation? Especially given that 99 percent of CC-By resources do not provide 'instructions'.

This problem is the sort that doesn't exist until a lawyer finds it. It is a case of using the letter of the license to act against the spirit of the license. This is far too common in the world of law and licenses. It is certainly not a problem specific to CC-By.
Third, in the preface to the draft I described a family of scenarios in which the requirement for Attribution is effectively a form of discrimination against people and groups of people.
Of course, as you say, "political and other messages could be embedded in Attribution requirements." I would even go so far as to suggest that political and other messages might be embedded in the content itself! But I digress.

If the requirement of posting content is to post a message contrary to your own interests, then don't post it. It seems farfetched to expect that the creation of another license will change the intent - and the tactics - of organizations intending to put political messages into their licenses.
Fourth and finally, in the context of open education we don’t need an attribution requirement embedded in the license. We have a citation culture... Attribution is a social norm in the academy (as well as a matter of policy), and we can depend on this social norm and existing policies to encourage proper citation.
That's a noble sentiment but demonstrably false.

The sentiment requires the isolation of an academic culture from the wider, more commercial, culture that surrounds it. But in the internet era, these cultures are thoroughly mixed. Academic content is considered fair game by people poised to copy - with or without attribution - for commercial profit in exclusive markets.

Moreover, if attribution is the norm in the academy, then posting a requirement that use of my work be attributed is, in fact, the norm. It should not change any academic use of my work.

And again I iterate that the only people harmed by CC-NC-By are commercial exploiters who seek to cordon off the market foracademic content as their own and to systematically loot it for their own benefit and at the expense of people who most need free - and noncommercial - content.

Tuesday, August 07, 2007


This is my contribution to the creativity panel at the AECT Conference coming up this October in Anaheim:

To be creative is to create, which is in turn to bring into existence something that did not previously exist. This conjures the idea of 'something from nothing' or some other miraculous practice, the creative being the act of the specially gifted, or at the very least, a creative class. Such a description is misleading. We do not get something from nothing, which means that every act of creation is in some way an act of remixing, repurposing, or reviewing. We begin as we can only begin, with our experiences, and beyond that, one's capacity to create depends on the availability of tools and the ability to use them. Creativity does not require special people, just specialized abilities and tools and an environment in which their application is fostered and encouraged.

The writer, for example, does not stare at a blank page and bring forth from nothing a new novel or self-help book. The writer searches through his or her experiences to find a story, or the elements of a story, that can convey a message that is relevant today. The having of experiences – the seeking out of experiences – is essential to this process. Consider how Bruce Sterling explored the Turkish Republic of North Cyprus before turning it into the setting for his Millennium novel Zeitgeist. Or Arthur C. Clarke drawing on his knowledge of Sri Lanka to write The Fountains of Paradise. It seems to me that one of the bases for Richard Florida's argument that diverse communities are creative communities is that diverse communities provide a much wider base of experience for the aspiring artist or artisan. The topic of reflective and self-aware perception is greater than can be described here, but it is this that is probably the first and most important aspect of creativity.

The second aspect is the tools. True, it is not strictly necessary to have a tool in order to create – one can be a mime, for example – but it is typically the tool that defines the nature of that which is created. The tools of the carpenter will produce one sort of thing, those of the artist something quite different, and those of the computer programmer something else still. The tools create a space of possibilities, an expectation of what can be. Just so, we do not expect to create a set of bookshelves out of Fortran, or an oil painting out of bricks and mortar. Understanding the tools, therefore, is essentially a combination of understanding what one wants and of understanding what one is capable of producing. Tools are the mediation between need and necessity.

It is important to understand that tools are not merely physical objects. This becomes most clear when we think of the third component of creativity, one's ability to use the tools. The writer uses the pen or the keyboard, but the writer's tools include all the possibilities inherent in language. A good writer will have a good grasp of grammar, for example, because grammar makes it possible for a writer to create something from his or her experiences. In a similar manner, the computer programmer will have hard disks and internet connections, but also the principles of logic and computation. And a carpenter has not only the saw and the drill but also the principles of structural engineering and geometry. A tool is compose of the physical object and the knowledge or skill that informs the use of that object.

Thus construed, creativity may be thought of as the manipulation of one's experiences using the tools at one's disposal. The tools – whether computational, linguistic or logical – create a language, in which our experiences are the words, through which one expresses oneself, as a part of an ongoing conversation with those others who, in one way or another, express their perceptions of the world.

Distance Learning

A reader writes,
I've just changed jobs and am now supporting the development of a distance learning module delivered almost entirely online.

Experiences of distance learning - my own, those of my friends and colleagues, has always been disappointing but the team with whom I'm working are enthusiastic to try new things and see if we can come up with something exciting and engaging rather than the usual isolating, dispiriting experience. We're exploring Second Life and other social networking tools but we'd also be very interested to know how others are resolving this issue outside of the UK.
My response:

I'm not going to have any fool-proof advice for you because a lot of the success or failure of e-learning lies outside the technology itself.

One thing that stands out in particular is that e-learning is often used to support adult learning. It is well known that adult learning needs to be structured differently than learning directed toward children. In particular, adults expect to have more control over their own learning environment and expect to be able to bring more of their prior knowledge and experience to bear. However, a lot of online learning is designed as though for children or younger university students. So adults find such learning dissatisfying.

It is worth noting that, because the technology gives users more freedoms than traditional environments, the effects of such dissatisfaction can be magnified. A person whose attention may waver in a classroom would nonetheless not pull out a radio and start listening to it alongside the lecture, nor open up a newspaper and start reading the sports section. But in the privacy of one's own home, even during synchronous sessions, learners are free, without even a social constraint, to do all of this and more.

I think this is important, because I think that different learners have very different motivations and needs. With some learners, the conversations they have with their instructor and fellow students are of central importance. This is why Athabasca University used - and still uses - audio conferencing. In some cases, it's the having of a person to report to that creates motivation; in others, it's the support and shared experience. Presence, as Terry Anderson describes it. Conferencing systems like Elluminate have been successful in creating this interaction. Skypecasting and Skype conferencing, as they do on ed Tech Talk, can also support it.

On the other hand, other learners neither need nor want this sort of interaction. The time constraints imposted by synchronous learning are an inconvenience, and they find the spoken work a clumsy and inefficient means of transferring information. They can engage with other students, but for one reason or another they want and prefer the distance of asynchronous discussion boards. Though people talk about learning being a social experience, a not-insignificant number of people don't want to become part of a group - this is especially the case with highly motivated people who have already built their own independent networks for support and information exchange.

These factors - and other factors, such as varying comfort levels with technology, differences in bandwidth, differences in literacy level, etc. - have in my own mind argued against the possibility of coming up with a single approach that will interest and engage everyone in a class of students. So I think that while an attempt to increase synchronous interaction - using, say, Second Life - will thrill some students, it will annoy others, especially those who are busy, results-driven, have slower bandwidth, who are poor typists, or who have weaker computer skills.

One of the problems with the contemporary approach to online learning is that there is almost no escape from this sort of dilemma. You write that your are "now supporting the development of a distance learning module delivered almost entirely online." What this tells me is that you are supporting a specific unit of training for a specific group of people. Thus you are locked into a class-and-content model by default. You have to design one thing for a group of people - you are at best going to design an ideal solution for only some of them and at worst are just guessing about the target population and will design what works for few of them.

The success stories I've been hearing have a lot less to do with designed learning and a lot more to do with what might be called informal learning. I think of my own website, for example, as a significant success - it is an important (some say vital) part of the learning environment for thousands of people. I see teachers - like Clarence Fisher, Darren Kurowapta, and Konrad Glowgowski - using technologies like blogging in their classes with excellent results. Ed Tech Talk is, in my view, an unqualified success. Public discussion boards - things as varied as Yahoo Groups and EdNA groups - and mailing lists - DEOS, ITForum, TALO, and many more - have been lifelines to people. Everywhere I look, this - and not deliveries of modules of instruction to predefined groups - is what is defining successful instruction.

It's easy to focus on the technology, but what's important comes before the technology:

- the learners choose their own technology - whether blogs, discussion boards, audio feeds, or whatever - and the mix of synchronous and asynchronous interaction is up to each individual (nobody is required to join some group from a chat, nor are they excluded from being able to join some group for a chat)
- the content is not imposed on them, but is rather self-selected, which means that it is available on an as-needed basis (hence the popularity of Google search) and also as a feed or a stream (hence the popularity of RSS and blogs, as well as podcasting)

These are the things that I think are essential.

Now can this be done in an institutional environment - a corporation, say, or a university? Ironically, it's probably more easily done in the former, as there is not the expectation that there will be pre-defined classes and course content. In a corporation, the challenge is different: moving the organization from being an information desert, where communication is thought to occur is staccato bursts of 'learning', to an information-rich environment, where learning is the normal state of affairs.

In a university environment, I fear, the best that can be done is to mitigate the disadvantages. Basically, what this means is throwing a lot of stuff out there and letting people craft their own course out of it.

- Audio lectures are great for people who have commutes or exercise routines. The Stanford Lectures on iTunes are a good example. Funny story - because I have tinnitus I often listen to my iPod while I sleep, to cancel out the ringing in my ears. I woke up last night and playing on the iPod was a Hubert Dreyfus lecture from his existentialism course. This is the first time a lecture has actually woken me up!

- I think online synchronous chat sessions are worthwhile, though I would hesitate to make them mandatory. Elluminate has worked very well for this, though I would watch for very rapid changes in this area of technology. These should be less like lectures and more like talk radio. MP3 audio recordings should be available.

- I think a course blog - or something that provides a focal point for resources, discussion, etc. - is essential. Having a course blog allows the person to put something into the students' RSS feeds, thus delivering the material to them. I would also use an RSS-to-email service for those students who aren't yet using an RSS reader regularly.

- there should be a content area for the course. How this is set up can vary widely - it could just be a set of links from the blog posts, it could be a wiki co-authored and organized by the students, it could be a common set of tags - I would discuss this with students and try to find out what would work best for them.

- there should be some sort of course community. Again, participation should be voluntary. The community could be a discussion list, a mailing list, or individual student blogs - or a combination of these (does everybody have to use the same thing? No, not if you aggregate from all of the different things and present them in the course blog). I wouldn't require that students join some sort of social network like Facebook - students should be free to make (or not make) their own social connections.

As for the actual content - I would try to keep design to a minimum. Rather than trying to create something all in advance, and then deliver it, I would try to have a set of resources on hand, available as needed, and to then think of it as content being streamed, where the instructor and the students are as responsible for the shape of the course as the designer, indeed, more so. Think of it as being like one of those reality TV series, where you throw things into the mix, but where the participants sort ot all out for themselves. A course is not an object, not a project - it's a live improve event, and so design consists essentially of having props ready to be pulled onto the stage as needed.

I hope this helps.

Thursday, August 02, 2007

Privacy, Security and Trust: Challenges for the Intangible Economy

Summary of a talk by Jim Robbins, EWA Canada, at the IFIPTMA Conference in Moncton.

Let me outline what I would like to talk about.

1. Near-term opportunities. How do I as a paranoid security person deal with all the baggage I bring to the discussion? But also, where we are, where we're going, how this affects our economy.

2. Identity. I see identity management as the real issue that is going to link security and privacy. I cannot engage most security professionals in discussions about privacy. And vice versa.


Part One

Personal baggage - I have a defence and security background. DND used to be our primary customer, but now it's global industries. I like to think of ourselves as a 'trusted third party'. But there are various definitions of trust.

The real advancement in the discussion is going to come from the privacy advocates, not the security advocates. Having said that, there is still a need for companies like yourselves. We never talked to media - but when we did we have seen increases in attacks on our site. My home was robbed. It gets very personal, so we don't want to talk about what we're doing.

Recently we have been talking about the need to share. That's primarily between companies. But that's also migrating back to 'need to know'.

Trust: someone said 'trust implies a willingness to be vulnerable'. That's the soft side. 'Trust but verify'. That's more where we are. What is the definition of 'trusted third party'? ISO standard. There are accreditations we have as a company. ISO/IEC 21827. Also ISO 25. Communication Security Establishment (CSE) common criteria. Cryptographic Module Validation Program (CMVP) - they test our people in a random question and answer type session. Personal Identity verification program (FIPS 201). Also Visa and Mastercard testing. It costs us money to go through these exercises - they all charge.

We haven't really talked about organized crime. We see evidence of that on an almost daily basis. Hardware and software attacks. It's not generally known in the community. ("You can't handle the truth!" audio excerpt - funny - "you have the luxury of not knowning what I know.") That is sort of the extreme. Leaning towards that though are a lot of people who are in the security and intelligence field. But how do we take that and create some dynamic tension with the people in the privacy world.

When I interact with people in the blogosophere some of these issues come up. That's where identity comes into it. Identity theft is some of the criminal activity will cement some of those issues. We have to talk about identity, lawful access. We have to talk about an environment where the wrong technology is being proposed by government, eg. drivers' licenses. We need people to know what RFID is, what it does. We need to better inform people.

I found an interesting definition in a discussion of the industrial age. We have moved beyond the information economy and into the intangible economy. How do we talk about what we want to do in relation to knowledge assets, intangible assets, etc?

We've talked all week about the proliferation of sensors and where they're connected and so on. Where we're at. There's been a number of predictions, red pill blue pill, how we're going to connect to this matrix we've built around us. All of this is reality, our buildings, cars, and the like. We're being protected probably in ways we're not even aware of.

There's a migration of startegic focus. The first question was, how do we protect mainframe computers. It was just a matter of checklists. When we moved into client-server, these checklists didn't work. Nobody understood what they meant. We're now in the network era. We have blogs, podcasts, Facebook. It has moved from orgnization-centric to technology-centric to individual-centric.

How we've moved up the stack. We used to do a lot of work in network security, database security. More and more it's application security.

We've got laws. The whole notion of compliying with these laws has in many minds lowered security rather than increased it. That fear of penalties has chanegd attitudes to laws. I'm not sure it's the right approach.

Homeland security - they talk about cyber-infrastrcture, physical infrastructur, critical infrastructure. The financial sector - this whole area is taking on a dramatic change. The roll-out of second-generation standards for credit cards in Europe. This is new. North America is an isolated area, it doesn't have these standards. Personal identity is key infrastructure again.

eCommece crimes are moving from cybercrime to breach of trust. We trusted Matha Stewart, we trusted Conrad Black. Trojans. There is a formula that predicts whether someone will commit a cybercrime. If the money is enough, people will do it. 60 percent of hackers targeted financial institutions in 2003. But there are other gains. We are seeing religions motivations, political motivations. People are seeing fraud as 'not wrong'. If the rewards are enough, then fraud is OK. The vicious circle of cybercrime (image).

Part Two

I wrote, 'Will identity Management be the 'Tipping Point'"? We talk about cybercrime and all that but nobody's paying attention.

There is a Bi-National Planning group (Canada-US). Homeland security and public safety in Canada. Recommendations about security, planning, training, etc. Their big problem is that there is no over-arching vision between the two countries.

There is the NIAP CCEVS Policy letter about U.S. purchasing policies - there must be testing for cryptography standards, CCEVS evaluations. Canada is considered part of the U.S. defense industrial base. Testing has to occur in the U.S. or Canada. That's great for industries in Canada.

Homeland Security directive 12 - revamping the way individuals are identified for government. Looks like it's going to be accepted. Ontario, for example, is adopting a system. Smart card technology - very well known in Europe and Asia, not sure whether people are bing taught about that in Canada. I do know we're testing them now. Products with smart card sensors in them. We should be building that, but the applications are all coming from overseas.

Government - in the U.S. they've been adding acquisition as part of the solution. We have to have something that's a bit more responsive, some way to train our acquisitions people to know about security and privacy requirements. There's going to be a lot of money spent in Canada to support these programs over the next 20 years. You don't have to be involved in the defense industry to take advantage of this. See the irb website

We collaborate with a number of labs. There are 47 common criteria labs globally. 24 countries accept them and 12 countries have the labs. The payment card industry has 8 labs in 7 countries. Interact. FIPS identity management, 8 labs including 2 in Canada. These labs exist because products are coming from various countries to service the U.S. market. And there's no such thing as a single-country company any more. We have global countries testing for global markets. Some countries are providing incentives to build and develop evaluative products. I don't think many organizations even know that protection profiles exist. I would exncourage academic to look at the language of the common criteria - it's horrible!

Chip migration - there will be rollout problems. Rejection of mag stripes. We won a contract regarding the payment card industry in canada. There is room for other CAs to support fianncial institutions across the country. Also credit institutions like Home Depot, Canadian Tire.

We mention semantic technologies and ontologies - moving from security to semantic engineering. Bridging the gap from data to information to knowledge. Bottom line, you should be looking in that area. The semantic web is not web 2.0, it's something entirely different. Gathering meaning from unstructured text.

There's a lot of work going on in this area, especially for the intelligence community. See the National Center for Ontological Research at the University of Buffalo. Drowning in data but dying of thirst. Semantic Web Intelligence Group. Common Sense Knowledge Base. 'We need adults in the semantic world.' Report: Objects in the Mirror are Closer than they Appear.

Security and privacy convergence: building a document that describes how all the standards come together. ISO SC 27 changed to identity management and privacy technologies. Keith T. Hall - enterprise security architecture. Surveys various architectures. Recommends one. We wrote a paper on mapping security and privacy frameworks. If you're a systems engineer, here's how to think of this as an integrated activity from the very start.

Part Three. Next Steps

The intangible economy
- knowledge assets - what people know and put into use
- collaboration assets - who people interact with and create value
- engagement assets - level of energy and commitment of the people - why not a national centre for ontology here in NB?
- time quality - value for people in the short term - how quickly value is created

We need an Industry Canada led initiative to...
- have academic support the development of international standards in privacy and security
- a near-term focus on leveraging work that is underway
- focus on research that is relevant to the global security industry
- reinstate R&D as one of the cyber security strategy components - it was removed last month, I don't understand why
- a political awareness campaign - our politicians know little about the issues
- a vision without funding is an illusion - what are the financial implications of policies? eg. who pays the doctor for reporting

Wednesday, August 01, 2007

PHI Meets PST: A PST Framework for Personal Health Information

Summary of a talk by David A. Townsend (Professor of Law, UNB) at the IFIPTMA Conference in Moncton.

Legislation tends to form in a pyramid state, with the statute at the top, with subordinate legislation (standards, rules, orders). They both have the status of law.

Now I'm going to talk about the normativity, the values in Personal Health Information (PHI). PHI, imbued with PST values - what would it look like? What would it look like if we took our values and put them into legislation?

We are in a period of reform on this issue, with a task force, and are expecting a comprehensive report some time next month. Most people want and expect that the report will be harmonized with the PHI legislation in other provinces.

I don't want to see us harmonized.

Here's an example of two recent controversies. One, where a passing driver accidentally intercepted a (wirelessly transmitted) video of a person providing a urine sample in a washroom - the client had agreed to be videoed, and a company provided the tech. The second, a laptop was stolen with personal information from the Hospital for Sick Children.

The thesis of the presentation is:

- the current legal framework for safeguarding PHI is about 10 years old now.

- But PHI has evolved from physical records to digital data

- the needs and the risks have change considerably

- modern PST must inform any such policy for protecting personal health information.

Healthcare in Transition

Today, health care is provided by teams of specialists. NB was a leader in this, for example, the idea of moving sub-acute care out of the hospital, other health care being provided by public and private health care providers (there are many private sector providers all integrated into the public system).

Medical devices are being networked with other devices, teams, other health data.

The management of health care is getting smarter and smarter. All the provinces and territories are working on electronic health record (EHR) systems.

Advances in health science are creating more and more varied information, eg. genetic coding. The Globe and Mail wrote about the genetic marker for MS. his is private information, think of what happens if it becomes known.

Many health care providers are using wireless technologies. Eg. a camera that you swallow that sends its images wirelessly.

Health care providers are more frequently require to report data - from child abuse to gunshot wounds to certain head trauma injuries - to external agencies. We have more and more providers and players in the health care industry, more and more private companies all getting access to people's health care data.

We still have physical records, but that is the exception rather than the norm. We used to do a lousy job protecting the records from physical access. Now most personal health information is in digital format. Now clinical data is being merged with management data, reporting data, research data - all various players.

The idea of 'one-patient one-record' has always made me uncomfortable. It seems that it's one-patient all-records. But it shouldn't be all records.

Status of PHI Legislation

Four provinces (Alberta, Manitoba, Saskatchewan, Ontario) have dedicated PHI legislation.

Quebec has extensive PHI sections in the Health Services and Social Services Act (not separate legilsation). They are the closest to the PST legislation I would want.

The remaining provinces are using a mix of the federal PIPEDA and their own privacy and access statues.

New Brunswick and Newfoundland are currently involved in PHE reform.

The basic framework was cast 10 years ago. It has been shared by the provinces extensively, a model act that was supported by some companies. They are preoccupied with unauthorized disclosures, but mostly concerned with doctors, thus de-emphasizing sanctions, very little dedicated to oversight. And no anticipation of wireless being deployed.

Privacy Defined

The important part is that we give the individual control over the collection, use, disclosure, excahnge, retention, accuracy, etc., of personal data.

Privacy in PHI

The statue must be patient-focused. Individual dignity and personhood are paramount. Manitoba has a patient-focus in its preamble - I'd love to see NB adopt that.

The Supreme Court (1992) ruled, the record may belong to the caregiver, but the information belongs to the patient.

So the individual must be given direct control over use, disclosure, exchange, retention and accuracy.

All consents must be knowledgeable - even if they are implied (who would they reasonably be expected o share it with - a knowledgeable extension of the first consent). There must be an option to opt-out or hold back parts. Someone said this, the right to opt out ios a basic dignity.

And there should be an inclusive definition of 'health care custodian'. I am concerned about people who aren't poviding health care that hold quite a bit of PHI - for example, your employer.

Security Defined

The main point: the confidentiality, integrity and availability of the data.

Security in PHI

Everybody recognizes that PHI is probably the most sensitive information you can hold about a person. The custodians have to be responsible for the privacy, security and integrity of PHI - and again, we need to have the two levels of 'custodian'.

We need to shift from the old notion of computer security and move to health informatics.

We have to move from 'non-disclosure' to 'managed exchanges' - in order to support this network of service delivery. These exchanges will be increasingly national and international - eg. someone in the Yukon might consult with someone in the United States. And we have a mobile population these days.

An amended scheme should put legal responsibilities on the requester - to request only those things they need and have a right to. And to put penalties on them if they exceed that. And there should be legal requirements of service and equipment providers.

The reason I like Quebec's model the best so far is that it includes enabling provisions - ways to implement, enforce, standards, rules and protocols. International ISO standards are currently created, about 35 of them. A security-enabled model would include security provisions much the way we enforce communication standards.

It has to have serious compliance elements to it - there are so many people with their hands on the data. People probably don't mind.

Trust Defined

Trust involves a willingness to be vulnerable. To achieve trust, privacy and security needs to be reasonably safeguarded and process need to be transparent.

Trust in Healthcare

Trust is a fundamental precondition for successful health outcomes. People often have to divulge very personal information. The Hippocratic Oath mentions it.

You're going to have to have transparency, you're going to have to have comprehension of privacy rights - regular people must be able to know and understand their rights and custodian obligations.

There has to be sufficient resources for an independent complaint mechanism. We have ombudsmen - the people are great choices - but they work with minimal resources. NB spends the second-least per capita for ombuds offices. We spend 14 cents per capital - Manitoba spends 88 cents, Alberta $1.35.

Consent forms have to be comprehensible. When requirements first came out, providers created this super-complex form. "As long as we get a signature somewhere." But that's not what consent is about. The average NBer reads at a grade 6 level. How do you get a knowledgable consent with this user base? And the literacy rate in NB is not much less than the national average.

There needs to be a legal requirement to disclose all breaches. Right now only Ontario has that requirement. There should be a private right-of-action so people who have been harmed can bring their own suit, because prosecutions are not always likely. There need to be impact statements and reporting statutes.

Example - Checklist for Video Surveillance

- conduct a privacy assessment
- confirm that privacy and security requirements are explicit in procurement precesses
- confirm that the signal cannot be received.

I looked at the four existing statutes - they all required some sort of recordation - if it wasn't recorded it wasn't PHI. But the wireless system isn't recorded. Is it? But still you have all kinds of systems where it's just a sensor and transmitter. We're not covering these, and we should.

A disclosure should be by any means, including interception. Manitoba had it, but you had to stretch it. Ontario, it was only when they were services that were custodian to custodian.

Outsourcing contracts with 3rd parties do not anticipate wireless deployments.

Right now, wireless standards are a low priority for standards authors. We looked at existing standards - we found many problems. There aren't good models for wireless standards yet.

Concluding Comments

The existing framework that people think we should use is seriously out of date. It doesn't address current needs. NB and Newfoundland are in a position to do something bolder.


Comment - supportive of the idea of notification regarding the transfer of personal information, or even requiring permission - the point here though is to ensure patients can be knowledgeable about permissions given.

also - If you're an active patient, the information isn't in one place any more, it's all over the place - and I don't think I'd want it in one place.