The article I chose to review, Friction, Snake oil, and weird countries: Cybersecurity systems could deep global inequality through regional blockingby Anne Jonas and Jenna Burrell, has a simple premise: fairness. Let me first answer the rubric questions using parsimony before I delve into my thoughts.
How does the topic relate to social science principles? Inequality, discrimination, behavior
What are the research questions/hypotheses? How do developers determine fairness, which is modeled after western consumers, within machine learning when systematic social and political conditions produce differential behaviors online and may contribute to discrimination and unequal treatment based on geolocation?
What methods were used in the article? Use of a qualitative and inductive approach with observation, interviews, and archival public user complaints.
What were the types of data and analysis that were done? Analyzing traditional cybersecurity practices, field notes from conferences and events relevant to the topic, previous research.
How does the article relate to concepts from class? Relativism – region blocking is a result of unfair machine learning. Determinism – region blocking leads/increases unwanted behavior from blocked regions. Diversity – region blocking inhibits growth and innovation. Victimization – active/passive precipitation. Neutralization theory- condemnation of condemners. Motives – revenge, money, political, multiple reasons. Behavioral theories and cyber offending – environmental influences, the family, peers, mass media.
How does the topic relate to challenges, concerns, and contributions of marginalized groups? Discrimination based on group association. Suppression of wanted online behavior. Diversity of innovation.
What are the overall societal contributions of the study? Outliers exist and should not be representative of the whole. As such, developers of machine learning must take societal and political conditions into account when creating fraud detection algorithms to avoid discrimination of aberrations.
My thoughts:
As companies increase their digital footprint and expand their services to a variety of users, they employ controls and mechanisms to protect themselves. However, in doing so they also exacerbate the very behavior they, again, are trying to fend off. The entirety of the article can be summed up with fairness; a theme which the authors focused heavily on. There is also a plead for security professionals to incorporate a mindset wherein systemic social and political conditions of the region are considered when calibrating machine learning to determine if a request is legitimate or illegitimate. Companies make an effort to focus on minimizing their attack surface by blocking “high risk” regions as a control.
The mechanism at the center of the article is region blocking which is the restriction of access to services based on the user’s geographical location which is associated with a range of IP addresses. Region blocking is used by security centers as a way to minimize threats that are historically from the region they are blocking. The rationale for the block includes un-updated/vulnerable systems, contrast to western ideas of normative behaviors, regulatory requirements, minimize risk. It is worth noting that blocking a region based solely on IP address range alone may be inaccurate as the range in question may no longer be associated with the location. Doing this technique would result in unjustly preventing services to someone in a non-region blocked location. I get that the return on investment is not optimal when only a few users are legitimate and the illegitimate ones wreak havoc to the point where it is easier to block off a region, but the point the paper is trying to make is that the legitimate users will not grow because there is no chance for them. This inhibits wanted behavior as there is no choice the user can make because the options of good and bad have been reduced to encourage bad.
The control at the center of the article is region blocking which is the restriction of access to services based on the user’s geographical location which is associated with a range of IP addresses. Region blocking is used by security centers as a way to minimize threats that are historically from the region they are blocking. The rationale for the block includes un-updated/vulnerable systems, contrast to western ideas of normative behaviors, regulatory requirements, minimize risk. It is worth noting that blocking a region based solely on IP address range alone may be inaccurate as the range in question may no longer be associated with the location. Doing this technique would result in unjustly preventing services to someone in a non-region blocked location. This is where machine learning and artificial intelligence can make the difference.
The limitations of AI and ML are that the developers/programmers have a western mindset that might flag users’ behaviors as aberrations, threats, or false positives when they are in fact legitimate. One interviewee described how their system of fraud detection system uses probability to flag potential illegitimate users which is an injustice to the user as they might just be an outlier and not necessarily bad actors. One suggestion to improve fraud detection for online services would be to have anomalous users “…consent to massive amounts of surveillance.” This invasion of privacy request is not only unfair and discriminatory but disproportionate to “favorable” regions.
With these limitations and restrictions in mind, users look to alternatives which then leads to more blocking of legitimate users. VPNs, for example, are a way for region blocked areas to access websites that are blocked. However, because of the association of VPNs with malicious behavior, users that utilize VPNs as a source of legitimate protections are now subject to being flagged for illegitimate behavior. As workarounds increase the sanctions imposed on the legitimate user increase, a self-fulfilling prophecy.
This article helped me to realize the pitfalls of region blocking. Initially, region blocking made sense to me as a form of minimizing threats but upon reading and reflecting I can see how collective punishments only perpetuate or increase unwanted behavior as there is no incentive to be good. A one size fits all approach to controls and mechanisms is not always the best approach as it alienates those that want to be legitimate. I feel that people will more often than not choose good when given a choice between good and bad. However, when the option to be good is taken away from the equation, people will engage in what is leftover.