RELIEF summary part II

Co-authored post from Ella and Willow

Yesterday, you read about Civil Air Patrol and the basis of RELIEF. We continue that conversation today into security and the complexities of mismatched cultural backgrounds.

On the security side, Rogue Genius’s George Chamales and Geeks Without Bounds’s Eleanor Saitta spoke with RELIEF attendees about their systems. While the military and agencies like the State Department have experience with security in other arenas, recognition of the importance of security in humanitarian assistance and disaster response situations is an ongoing process. Security often isn’t intuitive, even for development groups with mature products. Beyond that, the landscape is often changing rapidly, as evidenced by the current state of mobile security. Just like in all areas of security however, outcomes are what matter, more than any theoretical state of security.

One of the most concrete security outcomes of the event, from George, was the creation of a test install virtual machine image of many of the open source tools in the humanitarian space, which can now be distributed to security testers. This will allow testers to quickly jump in and find potential vulnerabilities without needing to learn how the tools are installed and configured, reducing the overhead associated with pro-bono testing. Efforts like this one will feed into the larger project of professionalizing the VTC community’s approach to security-centric peer review and testing.

In addition to the longer-term work on the community process, Eleanor and George both had a number of specific conversations with different teams present at the event about the security of their tools. Some of this was skill-sharing and some of it resulted in actionable guidance for both the product development teams and the operational field groups. Apart from the technical concerns, understanding the cultural difference between how government organizations think about security and how the more Internet-centric security community thinks about it was productive for all parties.

It’s no accident that the cultures of different communities keep coming up here. One of the most valuable parts of the RELIEF experience for GWOB was learning the culture and the language of the government attendees. This is a wildly different crowd than the sort of people Geeks Without Bounds usually associates with and supports. While it was great fun to try to persuade someone from DHS to let us take a picture of a #HOPE9 Hopeland Security patch next to the real patch on their shirt (“of course we won’t get your face in the photo”), that’s not an approach that a lot of folks will be comfortable with.

Learning how to speak each other’s languages doesn’t mean that the cultural mismatch will magically go away – GWOB’s decentralized, bottom-up approaches are still going unnerve someone coming from a culture that expects strict hierarchical oversight. However, it does mean that they’ll at least understand what’s going on. On our side, we’ll have more of a clue of what their alphabet soup means and where we can find room to act and cooperate. One of the big open questions for the humanitarian world is what happens when these two cultures work together. Does one eventually override the other, or do we both come to an accommodation where we can both be productive and our ethics and their orders can live with each other?

Figuring this out is vital to the future of humanitarian response. Whole systems approaches are critical in the face of more frequent and larger disasters with increasingly complex infrastructure, and this includes both the scope of the response and its form. We need tools and structures that break down the silos that response groups can fall into. More than that, we need to let people cooperate directly — to encourage true decentralized response, where all of the resources on the ground can be brought into play. We can’t afford to rely on solutions that don’t allow people to self-rescue when that’s possible, and we must bring in affected populations with deep local knowledge as peers in our efforts. On the other hand, at least for major disasters within the US, the DoD will be providing the majority of heavy lift and logistics response capability. We all have to live and play together.

RELIEF was a small but important step in this direction.

RELIEF summary part I

Co-authored post from Ella and Willow

This week, Willow Brugh and Eleanor Saitta represented Geeks Without Bounds at RELIEF at Camp Roberts in California, an event that’s a long way from our usual beat. A “Joint-Interagency Field Experimentation”, most of the people at RELIEF are from US military humanitarian response groups or agencies like FEMA or the State Department that do significant response work, or private sector groups experimenting with technology solutions for these groups. The event gives vendors a chance to see what their technology can do in the field and to experiment with how it works together informally, and it gives the responders a chance to try the tools out or see how it could meet their specific needs. It’s by no means all commercial, though — open source and VTC-centric groups also attend, but they’re generally groups that have mature, field-deployed solutions.

For a group like GWOB, the importance of an event like RELIEF lies in seeing potential routes in the lifecycles of our projects. At RELIEF, we got to spend time with a number of organizations that might be partners, customers, or peers when a project is deployed. On the vendor and VTC side, we got to see what successful projects in this space look like in an experimental setting. The sharing went both ways, too — for the commercial vendors and government agencies, GWOB was a chance to remember the roles that the ordinary folks have when they deploy and to start a more open dialog with the rest of the world.

A great example of this was the Civil Air Patrol ad-hoc session. CAP is the official civilian auxiliary organization of the Air Force. It operates as a volunteer organization similar to the Boy Scouts, and also has strong ties to FEMA. They operate a network of private light planes around the US. CAP gets the first aerial imagery after a disaster, allowing the incoming responders to know where their efforts would be best focused. Currently, it’s time consuming to figure out the spot on a map that corresponds to an image and to assess damage. The planes have GPS, but the GPS is for where the camera is, and unlike custom survey aircraft, they can’t take pictures straight down and don’t record camera angle.

We talked about changing the way deployment happens – pulling from things like Geo Commons and other social media platforms to help the commander set routes for the pilots. We started scheming how to standardize the way the camera is mounted, held, or tracked to make geocoding the image easier. Our working group also laid the foundation for automating image uploading and sending those images to be crowd-sourced for damage detection. We’ll talk more about it as it moves along, but it’s a big deal that these organizations are opening up to interacting (and even requesting assistance) from digital humanitarians and volunteer technical communities. Part of why groups like GWOB are valuable to RELIEF is bringing ad-hoc and community development to experienced groups, highlighting the best of both worlds.

Tomorrow, an entry on security and cultural legibility will follow this entry as its second part.

Breaking Down Silos

Interoperability is a *huge* issue in emergency management, humanitarian response, ..actually, in an awful lot of things. My hometown in rural Indiana didn’t even have a way for the fire department to speak to the police department, it was all done via 911 operators switching lines. Add on the issues of county lines, security clearance, multiple device platforms, and a long history of mishmashing protocols to make whatever exists works, and you have the current state of affairs.

Today at RELIEF I spoke to two groups that give me great hope for these issues being addressed. The first is MutualLink, which addresses the “ability” to speak to each other, and the second is VirtualAgility, which addresses a shared view of a developing situation.

MutualLink is already live in places like California, New Jersey, and Afghanistan. Deploying its router and black boxes mean taking in communications in whatever format it comes to a central stream. The important thing is beyond the cross-platform usability, though – it’s also about crossing city, county, state, and even country lines. Your responders are no longer seeing a forest fire disappear at the border, but are continuing to be in direct contact with the entire response group.

VirtualAgility addresses those people who can now talk to each other being able to “work” together as well. At its core a planning and task management system, but ultra adaptable, trackable, and sharable. It seems so simple, but it’s a really difficult challenge to support shared decision-making – how does someone in one secured silo let someone they’re working with in another secured silo know what’s the current status of a joint project? This is an incredible dynamic dashboard, and already adopted by some very large org, meaning it’s not redundant across existing models, but replacing them.

This is the infrastructure that everything else can run on.

HOPE and Awesummit

Spent the last three weeks away from Seattle – about a week on Playa, a week in NYC, a week in Boston. Was constantly surrounded by people I respect immensely and with whom I can’t wait to have continued interactions.

HOPE was incredible. I gave a talk with Diggz on Geeks Without Bounds. I sat on a panel about DARPA funding education and hackerspace programs. No chairs were thrown. It was pretty bitchin’. Saw the Byzantium project, and drank mate, and sipped whiskey with the No Starch Press folk. Went out for beers with an eclectic group of hackers and artists, talked about the future we were building, the holes that still exist, and how we might be less wrong.

I was blown away by the gender ratios (still not close to half, but far better, especially with the speaker line-up), and that the vibe was a bit less awkward and certainly less sexually charged than most of the other events I’ve been to. And the level of respect with which people approached each other in calling out inaccuracies, misrepresentations, and differences of opinion was phenomenal.

Exploried an old power plant with Borgatti. Nearly got caught. Knelt in the dark, breathing quietly, covered in brick dust and mud, and waited for people to pass by. Played Cards Against Humanity with some of my favorite humanitarians. Spent time with my Sunday Boyfriend and met his new cat. Made my way to Boston. Played in the park in bare feet, with a flask of whiskey, in the torrential downpour of heat finally breaking. Sat on a sea wall and ate breakfast, loosing track of time and wading back, coffee in hand and boots over my shoulder.

Went to the #awesummit, saw what opt-in taxes might look like. People who understand they are a part of a larger whole – giving their excess to things which don’t just entertain them, but also enhance the rest of their community.

It was *so cool* to sit in a room with people whose shred ideologies are so meta we often lacked the language and pattern recognition to pin it down. That we couldn’t say all the projects we supported were even the same sort. That the trustees were not all of a similar demographic, background, what have you. Not even our giving patterns were the same. Only one thing was shared – the word “awesome,” and the aspect of sharing, of facing outwards. To have a group of people that varied come together to talk about what we *were*, if anything, and what that *meant*, if we were something or if we weren’t. It was wonderful. There were a few moments of tension, mostly around the idea of trademark. It reminded me a lot of the conversations in hackerspaces. What do we all share, when we are so fiercely grass roots? What does it mean to share a vision but not a praxis? What is the value of making ourselves legible to the rest of society, or is that something we should actively avoid?

And my drawings ended up on the MIT Civic Media blog, which is kind of amazing.

All that was topped off by a dinosaur-themed party with cookie checks and cake. Saw massive ink pipes and the three-story press at the Boston Globe, bifurcated paper and quixotic diagrams. A private tour with a new friend through back doors and stalled robots and stressed editors. Taking the green line back to my dear college friend’s home, walking the last mile slightly buzzed, T-Rex balloon bouncing, happy.

Continued conversations around what comes Next, what are we building, how are we helping each other. I continue to be in constant awe of the amazing folk around me, humbled that they invite me into their community and projects. And to return to Seattle, to smiles and mangos and all of the hackathon planning ever.

Hacking Humanitarian Technology Before the Bad Guys Do

From George, about the RELIEF efforts Diggz and I speak about at times:

Event:  JIFX-RELIEF Field Exploration
Location:  Camp Roberts, CA
Dates:  August 22-23, 2012

In the last 18 months there have been a steady increase in attacks by
hostile groups against citizens and response organizations utilizing
communications and Internet technologies.  Those attacks include
custom malware targeting activists in Syria, harassment and
infiltration of civil rights monitoring groups in Egypt, and the
murder of citizen reporters in Mexico.

The JIFX-RELIEF Field Explorations are acknowledged to be the premier
venue for creating interoperable civil-military systems for
Humanitarian Assistance / Disaster Response (HA/DR) operations.  This
year’s RELIEF experiments will bring together members of the security
community to evaluate the security strengths and weaknesses of several
technologies that are being deployed in hostile environments.

Participants from the security community will have the opportunity to:
* Support the development of lifesaving emergency and humanitarian technologies
* Meet a variety of groups working in the humanitarian and government
technology space
* Interact with other members of the public and private security community

The security evaluations will take part over two separate days and
security experts are invited to take part in one or both:

August 15th:  Tour of the different experiments taking place and
discussions with the owners and operators of those technologies to
provide the security expert’s view of the strengths and weaknesses of
the technology.

August 16th:  Penetration testing of a set of those technologies as
they are being deployed to simulate attacks they will face when
fielded in hostile environments.

The attached document contains more information on the experiments
that will be taking place and the organizations involved.  If you are
interested in taking part in the security assessment on one or both
days please RSVP to george@roguegenius.com by August 1st.

Thank you for your time and interest in supporting the development of
secure technologies for use in crisis and disaster response
operations.

george

Outfits from spaaaace

I got to show off some of my favorite pieces during the SpaceApps challenge this past weekend.


With Cristina on Friday night. (ref)

With Ron on Saturday. (ref)

Making waffles Sunday morning in an Apollo bow tie. (ref)

Tights are from Black Milk (thanks, Nathan!), dress from All Saints, necklace and earrings were made for me by the always amazing Libby Bulloff, tie and bow tie are from Cyberoptix, vest is from Last Wear.

I’ll actually tell you about the event over on GWOB.org, but I really wanted to flounce for a moment.

Berlin and Vienna

Oh man, having so much fun in Berlin and Vienna.

Gave a talk at 28c3. (also love these two talks.)

Was on the Queer Geeks panel.

Wrote about Metalab.

Found out that Vittana ad from my last post has been airing on Hulu and such. That’s kinda weird.

Seriously big things afoot with GWOB. Kind of terrified about that. But excited. It’s really hard to contribute to the field of humanitarian response without also further complicating things.

Adoring being around my postgeographic tribe for so long. Almost teared up when I overheard Skytee at the bar say I was part of the Tribe here. Also so much time with Dan, Rubin, Fin, Meredith, Jimmie, Fabienne, Astera, Stephan, M@, etc. Getting to know Arthur and Isis and Miloh. So so so spoiled. But I miss my Seattle. I miss robot hands and hair dye parties and dinosaur truck adventures.

Able to type with both hands again. The scar is healing up. 1 plate, 3 screws on each side, and 1 extra screw holding my bone to itself. But physical therapy is going well. So that’s… cool.

Learning python, working with wireshark, learned about GPG, doing my German lessons. I am excited about my brain being full up of things.

And here is a video I cannot stop watching / song I can’t quit listening to:

Importance of Security in Communications

If any of you know me personally, you know one of my main investments in the ideals behind GWOB are those of propagating security. Being in Berlin this past week for Chaos Communications Camp was a true joy – European hackers, specifically those from Berlin – tend to have a highly-tuned sense of geek social responsibility. I could go into (at great length) my theories on the historical basis for this, but let’s just dive right in.

At-risk populations using telecommunications systems must be secure in doing so. If a tool is created which further jeopardizes their well-being, kittens die. And so I was filled with joy when people I have the honor of knowing stood up for those at-risk populations and broke something — fast. In fact, they broke it before breakfast. Fluid Nexus is (was) a tool specifically designed for activists to use for off-grid communications. While a noble idea, it completely failed to shield its target user base from security attacks.

Additionally, the ownership of a message is attributable when the client’s database is dumped.  On an Android phone, *any* application with access to the SD card can dump the database in this way, making trojans trivial to implement.  Further, this database column does nothing to benefit the users of the software, putting them at risk for no reason.

pro% sqlite3 ~/.FluidNexus/FluidNexus.db
SQLite version 3.7.4
Enter “.help” for instructions
Enter SQL statements terminated with a “;”
sqlite> select title from messages where mine;
Run
Martians know cryptography!
Things change.
Evidence against me.
sqlite>

The full (incredibly snarky) write-up can be found on pastebin, I highly encourage the read.

That said, it is incredibly important that people continue working on creating and improving tools for situations in which communications break down. It is equally important to request feedback from people who live in this discipline – will your tool use more power than readily available? Is it possible to use with a different native language? Is it secure? It’s better that people who care break things and help to improve them than The Bad GuysTM doing it live. Get started with this Software for Activists overview.

Credit/Mad Props and Mate to Eleanor Saitta (@dymaxion), Meredith Patterson (@maradydd), and Travis Goodspeed (@travisgoodspeed) for the break; Stephan Urbach (@herrurbach) for the overview; Fabienne Serriere (@fbz) and Skytee Haas (@skytee) for the Hacker Hostel (@hackerhostel); and my own self (@willowbl00) for the crepes.

Hackers and Humanitarians

We are geeks who care to use our skills to solve more than just #firstworldproblems. In doing this, we imbue the response tools we build with the values we hold. For instance, crisis mapping is built around the ideas of crowd sourcing and open source. Anyone can post, anyone can edit, and through the trends which emerge, outliers who might attempt to skew the results towards their own ends are swallowed up. Open Source communitites and participants building tools for disaster response means the people in need of assistance also gain some autonomy. The response itself is still a huge logistical and financial endeavor which must be supported by governments and other large organizations. However, the ability for us to connect to each other as *individuals* in OS lends dignity to those most in need. The people building the response tools do so because they care about both the process of tool creation and the purpose the tool will serve. The creators’ values are then hugely manifest in the tools themselves. This then affects the people using the tools.

It’s a matrix of involvement and influence. And once it’s understood, it leads to a deep sense of responsibility and awareness.
This is the reason I’m currently at DEFCON. Also because it’s a totally rad time and I adore the people here. But the culture of hacking in the United States has long been Hacking For The Sake Of Hacking. And we can do better than that – we can Do What We Do *With Purpose*. When people in crisis (or just in crap situations) are requesting help and must declare their whereabouts, name, phone number, and possibly identifying information; they should not have to worry about any repurcusions outside the actual recieving of help.
People in traditional response have this idea of Risk Management. There will always be risk. It is up to us to make the things that *cannot* fail be secure. The last thing someone who has just survived a disaster needs is their life jeapordized in more consciously malicious ways.
This is especially interesting when we get into things like protesters and refugees. I’m not asking people to pick sides (at least not in a public forum associated with my jorb), but I am asking the hackers and security kids of the world to take a look at some of the applications and services associated with humanitarian efforts and explore how they might be improved. Many of these tools have been made by enthusiastic amateurs and/or people who expect the best out of humans. We need your help.
Push your imaginary hats a little more to the #FFFFFF side. Yes, I know it’s an arbitrary term, but it sums up the idea well in this case. Play a game with a tool which will later make response more efficient and effective. Because nothing is more aggrevating than things being on fire and the door being locked from the other side.
I was interviewed on NBC about all this. It goes live on tomorrow’s Nightly News. My thoughts on it are over on my personal blog.

Hackers and Humanitarians

We are geeks who care to use our skills to solve more than just #firstworldproblems. In doing this, we imbue the response tools we build with the values we hold. For instance, crisis mapping is built around the ideas of crowd sourcing and open source. Anyone can post, anyone can edit, and through the trends which emerge, outliers who might attempt to skew the results towards their own ends are swallowed up. Open Source communitites and participants building tools for disaster response means the people in need of assistance also gain some autonomy. The response itself is still a huge logistical and financial endeavor which must be supported by governments and other large organizations. However, the ability for us to connect to each other as *individuals* in OS lends dignity to those most in need. The people building the response tools do so because they care about both the process of tool creation and the purpose the tool will serve. The creators’ values are then hugely manifest in the tools themselves. This then affects the people using the tools.

It’s a matrix of involvement and influence. And once it’s understood, it leads to a deep sense of responsibility and awareness.

This is the reason I’m currently at DEFCON. Also because it’s a totally rad time and I adore the people here. But the culture of hacking in the United States has long been Hacking For The Sake Of Hacking. And we can do better than that – we can Do What We Do *With Purpose*. When people in crisis (or just in crap situations) are requesting help and must declare their whereabouts, name, phone number, and possibly identifying information; they should not have to worry about any repurcusions outside the actual recieving of help.

People in traditional response have this idea of Risk Management. There will always be risk. It is up to us to make the things that *cannot* fail be secure. The last thing someone who has just survived a disaster needs is their life jeapordized in more consciously malicious ways.

This is especially interesting when we get into things like protesters and refugees. I’m not asking people to pick sides (at least not in a public forum associated with my jorb), but I am asking the hackers and security kids of the world to take a look at some of the applications and services associated with humanitarian efforts and explore how they might be improved. Many of these tools have been made by enthusiastic amateurs and/or people who expect the best out of humans. We need your help.

Push your imaginary hats a little more to the #FFFFFF side. Yes, I know it’s an arbitrary term, but it sums up the idea well in this case. Play a game with a tool which will later make response more efficient and effective. Because nothing is more aggrevating than things being on fire and the door being locked from the other side.

I interviwed with NBC this morning about geek social responsibility. I don’t know how they’ll edit me down or what clip they’ll use from our conversation, but I bet it won’t be my response to their question about government organizations hiring on hackers. They asked how people feel about others who approach these recruiters. I told them it’s a relationship that could happen if the government starts doing what it is supposed to, so far as protecting and supporting people. There are some things that are easier to do if you have a long history of knowledge, rigid structure, and lots of money and expertise. But until the government starts doing its job, we’ll be looking out for people instead. “So are hackers good citizens?” she asked. So I tried to explain to someone who is in TV that anyone who takes an active role in their own lives and in their surrounding communitites instead of sitting around doing nothing IS a good citizen. So yes, a hacker is by the very definition a good citizen.
If you want to watch, I’m told it with be on NBC tomorrow for the Nightly News.