Prompt: These dangers include child pornography, trolling, and vengeful ex-boyfriends who hound their former partners, just to name a few. Most recently, disinformation and Russian political meddling to fuel polarization have become prominent in our daily news. Often, the abusability of certain features stems from engineering decisions that optimize for profit. Ad-driven platforms are designed to maximize engagement metrics so they can sell more eyeballs to advertisers. This means the algorithm prioritizes clickable and shareable content—even if that content is harmful. But this sort of abuse can be harder to address than the vulnerabilities that come from technical flaws.

Response: Consider, for example, the way online content spread in the wake of the white supremacist terror attack in Christchurch, New Zealand. In March 2019, a gunman killed fifty-one people and injured fifty at the city’s Al Noor mosque. He livestreamed the first seventeen minutes of the attack on Facebook, sharing it on an 8chan imageboard favored by white supremacists. He also took steps to ensure his livestream would evade detection and removal. By inserting arbitrary spaces to break the link to his stream in his 8chan post, he forced people to manually reconstitute the URL rather than click through the link directly—a move that could alert Facebook to the source of the traffic. We can also speculate about other flaws he may have exploited, such as the way he talked for a period of time before initiating the attack, perhaps knowing that any content moderators reviewing the stream would then “snooze” it; or the way his head-mounted camera angle simulated the aesthetic of a first-person shooter video game, in a manner that may have been sufficient to trick a machine-learning analysis.  That the livestream went undetected for so long represented a colossal failure on the part of Facebook—and one that the traditional computer security industry would have little to say about. The problem wasn’t just technical, but social. It involved countless complex interactions within a stack of sociotechnical workings—“trust and safety” specialists, content moderators, machine learning algorithms, and so on. The result was disastrous: a white supremacist was able to broadcast a massacre around the world, his supporters were able to redistribute the video across the web, and the images he posted to various social media accounts—littered with Google-able keywords that would lead the curious to pro-white supremacist content—were amplified by subsequent media reports.  How can we begin to combat this sort of phenomenon? Stamos urged his audience to start tackling abusability with an interdisciplinary approach: to increase the representation of communities affected by abuse and to create more institutions—like the one he now heads at Stanford University—that enable technical security specialists to collaborate with social scientists.


Prompt: These are good ideas. Bringing in outside voices and experts to revamp the field of computer security is important. But it’s also important to recognize the limitations of the field itself. It’s not enough to broaden the scope of what security experts work on, or who a security expert even is. We also need to recognize how outsiders can identify issues, put them on the public agenda, and in doing so reorient our notions of what security is.

Response: The history of the computer security industry itself can help. To refocus security, we first need to revisit the story of how it came to be—how practices to address technical vulnerabilities originally emerged. Those practices sometimes provided valuable consumer protections, but they were also unsatisfactory to many. The computer security industry came to serve a narrow band of people and interests, creating norms about what kinds of security mattered, and for whom. Yet other possibilities were available, generated by quieter, countervailing strains that proposed different answers to the questions of whose security was worth taking seriously, and what it took to make them feel secure. By mapping out these alternative paths, we can better understand what a traditional technical security paradigm can usefully offer, and what must be discarded, modified, or challenged as we find new ways to face new threats.


Prompt: An Industry is Born Today, the computer security industry and its associated institutions are firmly established. Along with dozens of high-profile companies dedicated to diagnosing, fixing, and preventing breaches, many corporations hire specialized professionals to deal with a host of technical security issues. All of this activity adds up to a lot of money: analysts estimate the security industry to be worth about $170 billion.

Response: This industry hasn’t always existed, of course. It had to be built. And among the most important contributors were underground hackers who enjoyed breaking into systems and sharing what they found with their peers. In the early days of computing, security largely revolved around control of physical access to shared machines. Even the idea of passwords was, for a time, controversial. While engineers developed computationally secure systems like Multics in the 1960s and 1970s, they were eclipsed by the popularity of Unix. The advent of computer networking revealed the shortsightedness of some of the design decisions baked into Unix, as the choices made in a pre-networked era left critical vulnerabilities for later hackers to exploit.  Hackers gathered on dial-in electronic Bulletin Board Systems (BBSes) in the 1980s, swapping tips on how best to gain access to the different types of computers connecting to the nascent internet. Some joined underground secret societies, competing with each other for control of more computers. Others played cat-and-mouse games with systems administrators, who often lurked in the same BBSes, learning how to defend their users.  But in the mid-1990s, after a wave of high-profile arrests and the growing demonization of hackers in the media, some underground hackers began to shift their focus. Rather than hoarding their knowledge within select circles, they began to publicize it more widely. Upon discovering vulnerabilities, they would notify the company that made the software. Yet these vendors frequently reacted by dismissing the flaws as “theoretical,” while telling their users that the only threat to their security came from the hackers themselves.  In response, certain hackers set out to “make the theoretical practical,” as the tagline of the legendary hacker group the L0pht put it. Throughout the 1990s, they worked hard to force tech companies to take security seriously. Some put pressure on vendors by sharing the vulnerabilities on “full disclosure” mailing lists like Bugtraq and in hacker zines like Phrack. This move was risky—and controversial—since it potentially put exploits in the hands of malicious actors. But supporters of this approach hoped the risk would spur a rapid response from the vendor, while also empowering individual systems administrators to ensure their own organizations were adequately prepared.


Prompt: Other hackers developed tools that made the security holes in popular software unignorable, by allowing even the non-technical to crack passwords or control users’ machines remotely. Emblematic of this approach was a tool called Back Orifice. Developed by the Cult of the Dead Cow (cDc), it facilitated the remote control of Microsoft Windows machines—with or without the users’ consent. Around the same time, the L0pht released a tool that gleaned passwords from Windows systems. The stated goal was to help systems administrators recover lost user passwords. But its demonstration of Microsoft’s lax approach to password management was unmissable.

Response: Such strategies helped create media buzz about bad security. The tagline of cDc, “Global domination through media saturation,” made its mission clear: rather than simply hacking software systems, they were also hacking media narratives. “Was releasing Back Orifice to the public immoral? Microsoft would love for their customers to believe that we’re the bad guys and that they—as vendors of a digital sieve—bear no responsibility whatever,” wrote the cDc’s Deth Veggie in a 1998 “morality alert,” issued in response to a Microsoft press release. “We’ll frame our culture and actions against theirs, and let the public determine which one of us looks better in black.” At first, however, these efforts didn’t make much of a dent. Microsoft and other vendors responded by denying responsibility and vilifying the hackers. They insisted that their software would be secure if the hackers were held responsible—ignoring the obvious point that hackers didn’t create the weaknesses they revealed.  But the hackers didn’t only demonstrate insecurity from a distance. They began to remake themselves as trustworthy insiders as well. Some, like the L0pht frontman Peiter “Mudge” Zatko, started meeting with corporate executives and elected officials. They promoted a vision of ethical “grey-hat” and “white-hat” hackers who probed systems not for destructive purposes, but to gain insight into how best to secure them against malicious “black-hat” hackers.   Gradually, this message filtered into the mainstream. By the end of the 1990s, the dotcom boom was hitting its full stride. The Clinton Administration began heeding warnings of a future “cyber Pearl Harbor” that could cripple critical network-connected infrastructure. Between a booming tech sector and rising concerns about a new kind of national security threat, the stakes of computer security suddenly started to seem a lot higher.  By the early 2000s, many companies were chomping at the bit to hire hackers. Even Microsoft changed its tune, recruiting from the community it once antagonized. Throughout the tech industry, hackers joined in-house security teams, led “penetration tests” to probe systems for vulnerabilities, and conducted forensic investigations to ensure successful attacks couldn’t happen again. Hackers and vendors together crafted policies of “coordinated disclosure,” ensuring vulnerabilities would only be disclosed after they were fixed—or if vendors failed to take their responsibilities seriously.


Prompt: Many hackers were happy to take the lucrative jobs on offer. They could make a good salary doing the puzzle-solving research they loved, without the prospect of prison hanging over their heads. In 2000, the L0pht merged with @stake, a newly minted security firm that proudly touted its payroll of hackers—and which would go on to create a new generation of professional security experts, including Alex Stamos himself. After 9/11, several hackers began consulting for the US government and military. Mudge from the L0pht devoted himself to researching national security threats, joining a government contractor before ultimately taking a position as DARPA’s cybersecurity research program manager. The barbarians at the gate were now inside the walls, helping to guard them.

Response: Outside the Gates But not all hackers went pro. Others remained fiercely independent. They revolted against what they saw as co-optation, and instead laid the groundwork for a variety of oppositional currents, such as “hacktivism,” “anti-security,” and “digital security,” that challenged the notion that improving the security of machines, software, and networks is enough to really improve the security of those who use them—or whom they are used upon.


Prompt: First coined in 1995, the hacktivism label soon came to refer to a range of politically motivated hackerish pursuits, from technical support for activists to digital direct actions. For instance, the collective Electronic Disturbance Theater orchestrated acts of “electronic civil disobedience” to draw attention to the plight of the Zapatistas in the 1990s. They built a tool called FloodNet that, when used by multiple users, would “flood” a targeted website with traffic. The resulting “denial-of-service” attacks against Mexican and American government websites were used to spread awareness of the Zapatista cause. Many members of the hacking group cDc also took the hacktivist path, lending support to Chinese dissidents.  Other hackers took a different route, doubling down on their underground status. In the early 2000s, they coalesced around the banner of “anti-security.” A heterogeneous movement, anti-security was full of conflicts and contradictions. But participants shared a basic skepticism about the notion that public awareness of vulnerabilities was necessarily a good thing. Embracing a technocratic, even aristocratic outlook, many in the anti-security movement argued that only underground hackers should possess knowledge of technical exploits. As anti-security failed to slow the security boom, however, some of its members adopted more drastic measures: they encouraged their peers to hack the white hats as part of “pr0j4kt m4yh3m.” (“Project Mayhem” was a reference to the movie Fight Club, which had just come out.) They were so successful that white-hat professionals began to see getting hacked as a rite of passage.

Response: Then, around 2010, the philosophy of anti-security and the tactics of hacktivism began to combine. One offshoot of the hacktivist group Anonymous paid direct homage to the anti-security movement, adopting the name AntiSec. The new crews exploited technical vulnerabilities in order to exfiltrate documents in the public interest and shame governments and corporations for their lack of transparency. Crucially, they didn’t shame them for their failure to take security seriously. Rather, they targeted these entities because of how they deployed security technologies—namely, to extend the reach of corporate and state surveillance.


Prompt: Important also was the work of groups like Citizen Lab. Created in 2001 by a University of Toronto researcher partly inspired by cDc, Citizen Lab enlisted computer security techniques such as auditing, threat modeling, and penetration testing in support of civil society—an approach sometimes called “digital security.” Its research put abuses of power by states and corporations on the security agenda. After the organization conjectured that private security companies were helping governments commit human rights abuses by selling them hacking tools, a hacktivist named Phineas Fisher hacked and leaked documents and source code from the offending companies, making the theoretical practical and focusing public outrage.

Response: Unlike in the 1990s, it wasn’t enough for organizations to take technical security seriously. Security research was now being weaponized to promote forms of insecurity—helping governments crack down on dissidents, for example. Building on the earlier ideas of the anti-security movement, these watchdog hackers made clear that identifying vulnerabilities and passing the information along to the authorities was far from sufficient to improve everyone’s security—in fact, it could be actively harmful. Security for some could mean insecurity for others.


Prompt: Together, these alternative hacking communities challenged the idea that security was best served through the corporate and state securitization of communities and computer systems. They presented a different vision, where security meant something more than only technical considerations, and all people, not just the powerful, had a right to it.

Response: Security for All So what can this historical gloss teach us about how to confront the problem of abuse? To flesh out some thoughts along these lines, let’s return to the Christchurch shootings. In the aftermath of the attack, a debate emerged about the role of both Facebook and a company called Cloudflare in enabling the spread of the shooter’s message. 8chan, the site where he shared his livestream, used Cloudflare to provide network redundancy in order to ensure it could handle heavy traffic loads. Viewed another way, 8chan relied on this service to protect itself from the kind of denial-of-service attacks first pioneered by hacktivists in the 1990s, and since adopted as a standard weapon of cyberwarfare. More than a few hacktivists—and plenty of non-technical people as well—wanted 8chan off the web. But so long as the site used Cloudflare, it was protected against denial-of-service attacks. So a growing chorus of individuals and organizations began calling for Cloudflare to sever its ties.  Questions about the nature of Facebook and Cloudflare's services and business model—as well as broader debates about corporate responsibility, free speech, and regulation—ricocheted throughout the public sphere, including in the hacker community. Following the attack, Alex Stamos joined security researcher Patrick Gray on the popular security podcast Risky Business. Gray insisted that Facebook remove white supremacist supporters and that Cloudflare, as a private company, exercise its right to drop 8chan as a client.  Stamos was hesitant, pointing out that Cloudflare had previously removed ISIS content only after being legally compelled by the government. He wanted to see companies embrace standards for determining the intentionality behind content, barring clear legal guidance or capacity. But for Gray, the moral case from the court of public opinion was clear enough. Echoing the 1990s-era hacker philosophy of accountability, Gray said, "I think we need to turn this to a discussion of brand protection, and if Facebook wants to be associated with stuff like that…”  Both Gray and Stamos may have wanted the same outcome, but they saw different means to achieve it.


Prompt: The case of Cloudflare clarifies the stakes of choosing different paradigms for security. At some point, technical questions about how vulnerabilities are identified and mitigated collide with questions about how technical security relates to other forms of security. When is a site like 8chan benefiting from technical security that enables its members to make other communities less secure? Drawing on the insights of hacktivists, anti-security hackers, and digital security advocates, we always have to ask who security works for—a sociotechnical line of thinking that computer security professionals, often keen to avoid anything that might be seen as political, may find uncomfortable.  We also have to foreground the role of the profit motive in making platforms prone to abuse. Data mining, corporate ownership of user data, targeted advertisements, design and policy decisions to maximize user engagement—these can all create opportunities for bad actors to cause harm. Put simply, in many cases the business model itself might be the foundational vulnerability. But such fundamental product and business issues are generally outside the scope of what technical security researchers working for these organizations are paid to identify and remediate.

Response: After two more 8chan-linked shootings, Cloudflare ultimately caved to public pressure and cut ties with the site. But a million similar issues are raised on a smaller scale every day, where the question isn’t whether to host a single site, but how to treat a particular piece of content, or a feature that allows that content to be promoted to a particular person. These issues can’t be adequately addressed simply by tweaking interaction algorithms, removing “like” buttons, or developing better content moderation protocols.  A reassessment of what is involved in “security” is required. And, as with the 1990s hackers, this notion of security must be built, at least in part, by people who aren’t afraid to pick a fight. What made an earlier generation of hackers so effective wasn’t just their technical expertise but their willingness to antagonize the big software vendors. It was through their efforts that we now enjoy a modicum of technical security. Standards and protocols that protect consumers and citizens from harms like infrastructural sabotage, identity theft, and commercial fraud exist because hackers aggressively drew attention to corporate incompetence and demanded accountability.


Prompt: But, as many of these same individuals entered industry in the 2000s, they lost their oppositional edge. To ensure security serves more than just corporate or state interests, this sort of adversarial spirit must be expanded. Stamos’s call for the inclusion of sidelined expertise in computer security is important, but it needs to be accompanied by the adversarial work of activists, civil rights groups, and inquisitive tinkerers.

Response: This work is currently being done by a range of groups, including Citizen Lab and other organizations engaging in digital security activism like Equality Labs and Access Now. This work can also take a variety of forms. In 2016, investigative journalism outfit ProPublica exposed how Facebook’s targeted advertising algorithm can be used in “digital redlining” practices to exclude certain demographics from ads for housing. In 2019, computer scientist Jeanna Matthews and her interdisciplinary collaborators reverse-engineered proprietary software for DNA testing that is used in criminal trials, demonstrating its worrying propensity to deliver false positives. In 2020, Elizabeth Warren’s presidential campaign deliberately lied in a Facebook ad in order to shame the company for refusing to fact-check political ads.


Prompt: These are only a few examples. Taken together, however, they suggest the role that outsiders who “make the theoretical practical” can play in demanding a more people-centered definition of security—one that involves keeping everyone safe. After all, outsider pressure helped shape our ideas of technical security. Outsiders can reshape them.

Response: In early 2012, San Francisco taxi drivers began to raise the alarm at organizing meetings and city hearings about “bandit tech cabs” pilfering their fares. “I’ll sit at a hotel line, and I see one of these guys in their own car come up, hailed by some guy’s app, and they’ll turn down my fare,” Dave, who had been driving a taxi for fourteen years, said at a meeting that April. “They steal it. It’s insulting.” Other cabbies said they were seeing the same thing, and that their income was suffering as a result. “I think I made 20 percent less last week than normal,” one driver lamented. He wanted city officials to know; surely, they would put an end to it.


Prompt: These taxi workers were experiencing the very earliest stage of a global re-organization of private and public transportation, fueled by billions of dollars of financing from venture capitalists. Under the shadow of the Great Recession, in a period of high unemployment and slow job growth, Uber, Lyft, and their erstwhile competitor Sidecar used this technocapital to begin offering almost anyone with access to a car a way to make money by driving people around San Francisco. The companies aggressively marketed themselves as disruptors of the transportation industry; consumers and commentators, seduced by on-demand, technology-fueled mobility and the prosocial promise of what the companies called “collaborative consumption,” enthusiastically adopted their narrative.

Response: Cabbies, however, saw Uber and Lyft as well-financed corporate continuations of the taxi companies that had long subjugated them. “This isn’t about technology,” Mark, a long-time taxi worker and advocate told me in 2013. He explained that, for the previous few years, San Francisco taxi drivers had already been using an app called Cabulous, which essentially did what Uber and Lyft were doing. “They claim they’re innovative and new, but we already have this technology,” he went on. What was different, Mark described, was that Uber and Lyft had “a new exploitative business model,” though it was just “one step removed from the leasing model that the taxi companies have been using for years.”  Since 2012, much of the positive discourse around Uber and Lyft has continued to regurgitate the notion that these are companies built on technological innovations that brought new forms of transportation to people and places who needed them. Meanwhile, critiques of these companies, and of the gig economy as a whole, have typically seen Uber and Lyft as breaking sharply from earlier modes of employment to create new forms of precarity for workers. In both cases, the public discussion tends to see these companies as creating major discontinuities, whether of technology or of labor models. What Mark pointed out, however, is that Uber and Lyft are in many ways not as different as we tend to think from the taxi companies that prevailed until 2012.  In 2020, almost a decade after the advent of Uber and Lyft, we seem to be at another turning point. The ride-hailing industry is facing a wave of militant self-organizing and claims to employment status by drivers. So far, the most significant mobilization has been the fight over AB5, a California assembly bill that was signed into law in September 2019, and which makes it much clearer that drivers should be treated as employees of Uber and Lyft. The companies have fought this reclassification in myriad ways, and some drivers fear that it may cause them to lose their flexibility. But those who have welcomed the passage of AB5 hope it will deliver them many of the benefits—from healthcare to a guaranteed minimum wage—that Uber and Lyft have so far denied them. On all sides of the issue, no one doubts that we are at a critical juncture in the history of labor and urban transportation.


Prompt: But in order to sort through the arguments surrounding AB5 and grasp the significance of this moment, we must do something that the discourse around ride-hailing has failed to do: situate ourselves historically, tracing both the continuities and the discontinuities that the cabbie Mark pointed to. Our present moment is largely the product of two neoliberal shifts in the taxicab industry—and, in a certain sense, in US society as a whole—that occurred in the late 1970s and the 2010s. Understanding the reasons for these shifts can help us get beyond the easy assumptions made on different sides of the debate: that employee status is an unalloyed good or ill, that innovation made the rise of Uber and Lyft inevitable, or that the issues raised by the sector are matters of technology rather than politics.

Response: Few people understand those reasons better than the drivers themselves—though, like other workers, they rarely have their voices centered in public discourse. By listening to drivers’ accounts of how their industry operates and has changed, we can come to understand how and why, despite some fears and ambivalence, they are using employee status to create a much-needed friction in the wheels of technocapital.


Prompt: Leasing as Liberation Typically, mainstream observers see two defining features of the business model of Uber and Lyft. The first is that the people who drive “on” their platforms are treated not as employees of the companies, but rather as independent contractors using those platforms to run their own personal taxicab businesses. In the US, direct employment increases corporate costs by roughly one-third, so classifying workers as independent contractors significantly increases profitability. (This is essentially the labor arrangement underlying the entire gig economy, from people delivering food and groceries to those performing rote tasks for Amazon’s Mechanical Turk.) The second defining feature is the technology—the apps and the various pricing and dispatching algorithms behind them—that the corporations use to exert enough control over drivers in order to provide a more or less on-demand service. In both cases—the non-employment model and the technologies—Uber and Lyft share more in common with the previous generation of taxicab companies than many people understand.

Response: The independent contractor model that underlies today’s gig economy first developed in the taxicab industry in the late 1970s, as the United States shifted towards a neoliberal conception of society in which almost everything was to be subjected to the forces of competition. Workers and households were reimagined as entrepreneurial concerns, sole proprietorships that should fend for themselves in the tumult of the great American marketplace. Embodying this logic, the taxicab industry was one of the first among US businesses to slough off the costs and liabilities—minimum wages, healthcare benefits, disability insurance, among other things—associated with direct employment.  Taking advantage of rank-and-file discontent with traditional unions, as well as an existing carve-out for independent contractors in labor laws, cab companies all over the US reorganized their business models in this period, claiming to “free” their drivers from the imagined restraints of employment. In San Francisco, taxi companies approached drivers in 1976 and asked if they would like to “lease” their taxis on a shift-by-shift basis, so that the companies could rid themselves of the expenses and risks associated with employing workers, including unemployment insurance, workers’ compensation, and a guaranteed commission that taxi drivers had previously been paid.


Prompt: Although the Chauffeurs’ Union, which had represented drivers since before the New Deal, discouraged workers from accepting these contract terms, many drivers were interested in the leasing model, which emerged within a tightly-controlled regulatory regime won by the union. In the early twentieth century, the union had successfully fought for municipal regulation of fares and restrictions on the number of taxis operating in the city. This helped to more or less ensure that drivers earned a living wage, even absent formal income guarantees.  Cabbies who chose to lease rather than work as employees continued to benefit from these laws. Many believed they could use their knowledge of the city and business acumen to earn more than they had as employees. Many hoped to be liberated from the companies’ direction and control. Some had also grown distrustful of the Chauffers’ Union, which took a politically conservative and dues-driven approach to the workforce. “The union was even worse” than the taxi companies, recalled Markos, a driver who had emigrated from Africa and signed a lease contract in the late 1970s, when I spoke to him in 2010. “They take your money and they say, ‘Thank you and what can we do for you?’—and they didn’t do nothing.”  Markos and other drivers had also been frustrated by the union’s positions on any number of political issues. Those who had embraced the civil rights movement or protested the Vietnam War had been ignored. Drivers who protested US interventions abroad by refusing to say the Pledge of Allegiance, which was recited at the beginning of union meetings, were ejected from the meetings. Dissident workers with long hair, whose left politics were in opposition to the union’s, were even punished: ostensibly for their appearance, but more likely, for their political positions and agitation for a more radical union.

Response: Though not all drivers initially embraced this shift, the decision was eventually made for them. When Yellow Cab, the biggest taxi company in San Francisco, went bankrupt and re-opened in the late 1970s, the company utilized a leasing model to contract with a workforce who, as independent contractors, did not have the right to union representation. Drivers who hoped to stay employees, particularly those with families, were alarmed. For the first time since the early twentieth century, taxi drivers in San Francisco were operating without a union contract and the safety nets associated with employment. Employment was “the only course for the working man if you want to have any kind of security, in the taxi industry particularly,” Bill Williams, a thirty-nine-year-old driver with two young children told a local reporter at the time. “You can’t afford the benefits individually … Your income varies, so you have to have a group plan, which is the union.” In response to this heightened insecurity, many cabbies organized and became increasingly engaged in city politics. For the next three decades, working without a union contract, taxi workers and activists formed informal worker organizations to lobby local politicians to maintain a regulatory environment that enabled a stable income. Drivers began regularly attending municipal meetings, and won a number of important victories for the taxi workforce, including getting a cap on how much the taxi companies could charge them to lease a cab. When workers’ advocacy attempts were rebuffed—as in 2008, when drivers lobbied the city to institute a centralized dispatch system to improve service—they persisted. Many independently adopted the Cabulous ride-hailing app, which was strikingly similar to Uber and Lyft, so that riders could have access to the entire fleet (and not just the taxis at one company) when calling a cab.


Prompt: Although drivers lacked any legal mechanism to collectively force companies to the bargaining table, workers continued to exert control over their income by opposing the issuance of new taxi medallions (thereby restricting competition) and lobbying for occasional fare increases. While some drivers, particularly the most vocal activists, wanted to fight for renewed employee status, the issue was contentious among driver groups. So, from the 1990s to 2010s, they avoided it.  As Ruach, a taxi worker and activist, complained to me about drivers’ mobilization in this period: “We have to negotiate every fucking thing in our universe in public with the politicians and in the ballot box because we can’t have a union because we can’t have a contract because we are so-called ‘independent contractors.’ ” Remote Control When Uber and Lyft began to eat into their income in the spring of 2012, San Francisco taxi drivers were relatively certain that they could rein in the “bandit tech cabs.” Uber and Lyft were unequivocally violating both state and city laws. So, through organizing and advocacy, cabbies thought they could force the city government to enforce the laws and protect their interests, as they had done in previous eras.  And without even a fraction of the resources of technocapital, collectives of cab drivers put up an impressive fight. Between 2012 and 2014, in addition to organizing a number of demonstrations to protest the bandit tech cab companies, and writing and submitting sophisticated legal memos to regulators, taxi drivers also created a crowdsourced database of license-plate images of personal cars engaged in illegal ride-hailing. “We have tracked thousands of these cars,” Barry, a key organizer in this endeavor, explained to me at the time. “We’ll share this with the SFMTA”—the local taxi regulator— “and insurance companies, because you know these guys are operating in violation of their personal insurance contracts.”  But these worker efforts were no match for the neoliberal political evolutions emerging in the US at the time. In the throes of the Great Recession, the individualizing, entrepreneurial logic that had emerged in the late 1970s intensified. For example, while the federal minimum wage remained unchanged, the Obama administration poured money into small business loans, with the hope that individuals taking on personal risk would reignite the economy. Rather than finding well-paying jobs, US workers were implicitly told to create them. Following this reasoning, in the taxi industry, state officials and politicians embraced the narrative that Uber and Lyft, in the name of micro-entrepreneurship, “freed” workers—not just from employment, but also from the taxi industry regulations (namely, vehicle caps and fare regulations) that had long kept their incomes stable.

Response: But Uber and Lyft were taxi companies, just on venture capital steroids. The startups quickly created a loyal rider base by offering investor-subsidized prices and deceptively marketing themselves as a safer and more community-oriented service than regulated taxis. Though the companies were operating their ride-hailing services illegally, city regulators refused to intervene, citing the promise of technological innovation and a much-needed supply of jobs during the Great Recession’s slow recovery.  Although less widely acknowledged, the regulatory pressure that Uber and Lyft exert—and the laws they flagrantly flaunt—is also a defining feature of their business model. In the early 2010s, by pouring money into California political campaigns (particularly that of Ed Lee, then the mayor of San Francisco) and hiring nearly every lobbyist in the state—including at least one who was later charged with illegal lobbying—the companies weaseled their way out of century-old regulations on fares, vehicle caps, and licenses in just a few months. They convinced state regulators to allow them to operate and then to carve them out of existing regulations by creating a new regulatory category, Transportation Network Companies (TNC).  Scandalously, the first TNC rules, adopted in September 2013, closely resembled those written by the companies themselves. “They got exactly what they wanted,” Brad, a taxi driver said to me about the companies on the day the TNC regulations were released. “They wrote the laws themselves.” Indeed, the state regulations, which preempted local municipal regulations, seemed to inscribe the companies’ preferred business model into law. For example, even consumer safety regulations tied to professional licenses and state-monitored vehicles were conspicuously absent; instead, these safety oversights were outsourced to the companies themselves. Most critically for drivers, the new regulations lacked both any restraints on driver competition—in the form of vehicle caps—and state control over fares. The regulations were also explicitly silent on all labor issues, including work flexibility, a wage floor, the amount of time drivers could spend working per day, and most centrally, employment status.


Prompt: Wanting to avoid treating drivers as direct employees, Uber and Lyft nonetheless had to find ways to subtly exert control over them. Rather than just tell drivers what to do and how to do it, which would trigger employment status, Uber and Lyft use “psychological inducements” derived from social science and deployed remotely through algorithms to influence when, where, and how long their drivers work. Instead of directly employing the millions of drivers whose work produces the company’s primary value, Uber hired hundreds of social and data scientists to shape driver behavior. (For example, using findings from social psychology and video game technologies, Uber notoriously tricks drivers into working at undesirable hours and locations.) The success of Uber and Lyft in restructuring the taxi market and securing a legal environment that suited their interests emboldened venture capital to pour more money into the tech cab companies and to other on-demand labor platform start-ups, such as DoorDash and UberEats. As the technocapitalists celebrated these victories, a seemingly unlimited supply of drivers and declining commissions quickly devastated driver incomes across the entire taxi and ride-hailing economy. Almost overnight, full-time drivers made roughly 65 to 80 percent of what taxi drivers had made in 2012.  And that was only part of the wreckage. Over the next few years, hundreds of taxi drivers who had taken out large “balloon loans”—which typically have low interest rates but involve one large payment due upon maturity—to purchase medallions went bankrupt or teetered on the edge. A few died of the intense stress caused by loss of income and long hours. Others continued driving, but lost their housing, spending the night in their taxi or on the couches of friends. Some, desperate for work, began driving for Uber and Lyft, even as the companies were quickly slashing wages. These drivers, especially those for whom driving had been a lifetime profession or who owed money on a vehicle they had purchased for work, felt trapped. In one of the most expensive places in the world, drivers in San Francisco worked long hours with no control over their earnings. And within months, this legalized system of low pay, debt, and devastation was replicated the world over.

Response: Beginning in 2016, without access to municipal regulators, fare controls, or vehicle caps, Uber and Lyft drivers turned to the only places left: the courts and each other. Like cabbies before them, ride-hailing drivers began to self-organize and form drivers groups. Some even worked with plaintiff-side employment attorneys to sue Uber and Lyft for millions in back wages and vehicle reimbursements. Uber alone faced dozens, and eventually hundreds, of lawsuits and complaints alleging that they were misclassifying their drivers as independent contractors.  But Uber and Lyft, even though they were unprofitable, had unprecedented sums of venture capital funding with which they could aggressively litigate such cases and confidentially settle them, sometimes for more than what the plaintiff would have received had they won at trial. The companies used these ungodly streams of capital along with legal acrobatics—both settlements and arbitration clauses—to avert a conclusive finding on the central issue: were drivers employees or independent contractors? By avoiding a legal decision at either the district or appellate level, the companies continued to get away with treating their workers as independent contractors.


Prompt: Samy, an Iranian refugee who emigrated to California in the 2000s, described the terrible conditions that he and many of these “independent contractors” face. Unable to afford the Bay Area, he lives a hundred miles away from San Francisco, and rather than commute to the city daily, he sleeps in his car between shifts, sometimes not returning home for several days in a row. “We have no freedom,” he told me. “I sleep in my car. I eat in my car. I work in my car. That is not freedom. That is not flexibility.” Because he has to make a certain amount each day to make ends meet, Samy hypothesizes that Uber has used the data they have on him to systematically lower his wages, forcing him to work harder and longer to earn that same amount.

Response: Back in Iran, Samy, who is a highly skilled carpenter, ran a small construction business. “In Iran, I had some guys, they were working for me… I took care of them,” he said. “I was giving them breakfast, lunch, and I even paid for their dinner. In America, it’s something different than all over the world.” He said he hadn’t heard of another country where workers were required to have their own tools to work for a company, and then not considered employees on that basis. “It makes no sense.” Finding Friction  In the post-union, post-employment decades leading up to the appearance of Uber and Lyft in 2012, taxi driver advocates in San Francisco had largely avoided organizing around employment status. Because the issue was contentious among drivers, San Francisco taxi worker activists had relied mostly on policy advocacy to improve their working conditions, lobbying regulators to ensure the economic security of taxi drivers and their families. With the legalization of the Uber and Lyft business models in the mid-2010s, an industry of workers who had long understood themselves to be “independent” began to build and leverage collective labor power, not just policy advocacy, to demand changes to both the industry business model and the regulatory environment. Drivers of all kinds—full-time and part-time, Uber and Lyft and taxi—took to collective activity, including direct actions, which came to a head in 2019.


Prompt: As Uber and Lyft approached their IPOs early that year, the companies noted in their public SEC filings that the classification of their drivers as independent contractors remained key to their future profitability. Uber and Lyft drivers quickly ascertained that their status was the companies’ most painful pressure point. Moreover, the fact that the companies—whose executives made millions—were relying on avoiding paying minimum wage and overtime to the drivers for the companies’ profitability enraged drivers. As one driver explained to me in the summer of 2019: Four years ago, there is no way anyone would have [supported] employment. People were getting what they needed, and they felt loyalty to the company. But now we can’t survive. And did you see that [Uber co-founder] Garrett Camp bought a seventy-one-million-dollar home in Beverly Hills? That is our money. That is some bullshit. I know people living in their cars. And he bought a seventy-one-million-dollar home. We made him every dollar he has.

Response: Until this moment, driver organizers had avoided the potentially divisive issue of employment status. But in response to the IPO, a changing legal landscape, and fury rooted in their extreme economic vulnerabilities, drivers adjusted their tactics to direct their energies at technocapital’s Achilles’ heel.  On May 8, 2019, a coalition of Uber, Lyft, and taxi drivers, led by the New York Taxi Workers Alliance and the California-based Rideshare Drivers United (RDU)—whose members had been self-organizing and protesting for better regulatory oversight of the industry for over two years—called the first ever global strike against Uber. In the weeks leading up to the strike, the demands focused on fair pay and an appeals process to deal with terminations, yet they conspicuously lacked the word “employment.” But during the strike action in front of Uber’s headquarters on Market Street in San Francisco, drivers were beginning to talk about AB5.


Prompt: The bill, which had been introduced in the California State Assembly just a few months earlier, drew upon a recent state Supreme Court decision to change the test for employment status. Rather than examining how much control a putative employer exerted over workers, the decision called for the presumption of employment status. If a company wanted to use independent contractor labor, they had to pass an exacting “ABC test” which asked, among other things, if the workers were occupied in a line of work that differed from the company’s core business. AB5 constituted a striking revision in California employment law and strongly favored extending basic protections like minimum wage, overtime compensation, workers’ compensation, and unemployment insurance to gig economy workers.  Two days after the strike, Uber went public, and driver organizers with Rideshare Drivers United began to talk more publicly about AB5 and the possibility of employment status. If it passed, it would be the first time since Uber and Lyft’s founding that drivers had a law on the books that could support their struggle against the companies. They decided, in spite of some fears, to throw their support behind the bill’s passage.

Response: Still, in private, drivers were ambivalent about formally becoming employees. “We get behind this law because we have to show the companies we have power,” Soleiman, a full-time Lyft driver, told me privately, after an organizing meeting. “But what does it mean for me and other drivers?” Though worried about the consequences, he and other Uber and Lyft drivers had advocated loudly for AB5, putting their fears to one side and leveraging collective action to fight for the one thing that companies most wanted to avoid.  In a truly unexpected turn of political events, AB5 passed. The California legislature, which had previously shown great deference and affection for technology companies, sided with the workers on the issue of employment status. The Assembly’s speaker, Anthony Rendon, went so far as to call the so-called gig economy “fucking feudalism” in announcing his own support of the law. Upon its passage, AB5 was celebrated by driver advocates the world over and signed into law by Governor Newsom in September 2019. It was the first sign in over eight years that, perhaps, worker power could fracture technocapital’s tight grip over lawmakers.  But like Soleiman, many drivers did not fully understand the implications of the new law—not because they were ignorant of the statute, but because so much was left in the company’s hands. What would it mean to be an “employee”? Most centrally, would the companies take away whatever degree of flexibility the drivers had? Could Uber and Lyft cap their potential earnings or push them off the app? Or would the law facilitate exactly what precarious workers in the economy needed: a wage floor, access to the safety net, and a pathway to unionization? While debates about the impact and efficacy of AB5 and the ABC test roiled over social media and in courtrooms—Uber and the food delivery service Postmates sought and lost a preliminary injunction against the law, while simultaneously arguing that the law did not apply to them—workers privately debated what to do. The law was supposed to go into effect on January 1, 2020. The day came and went and, conspicuously, nothing changed. When it became clear to workers that neither the city attorneys nor the state attorney general was going to force Uber to end its practice of misclassification, drivers decided to take matters into their own hands.


Prompt: “We cannot wait for the city or state to enforce this law,” Nicole, a Lyft driver and organizer in California, said to me over the phone, weeks after the law had gone into effect. “We have to do it ourselves.” On February 5, 2020, members and supporters of RDU marched together to the Labor Commission’s offices all over California, collectively submitting individual claims for back wages and vehicle reimbursements against the companies. The roughly 150 drivers who filed claims against Uber and Lyft that day calculated that together they were owed up to $4 million dollars for the last three years of underpayment. AB5 was not an end in itself, RDU organizers explained to the press and to their fellow workers, but a route to collectively achieve much-needed security, a law they could use to stabilize income and aid driver organizing efforts.  “Look, the companies can threaten us all they want,” Chris, a Bay Area Lyft driver and RDU organizer told his fellow workers at an organizing meeting. “They can keep sending us emails and these in-app messages. But what employment status means is we can organize together. We can build power. We can build a union. And then we can force them to bargain over our working conditions. And then they can’t take away our flexibility if we won’t let them take it away.” For Chris and others, employment status created a path through which workers could organize and maybe even get a federally-recognized union. Talk of a union, which had been stymied for three decades in the taxi industry by the reality that taxi workers without a union contract could still use the municipal regulatory regime to eke out a living under the leasing apparatus, has become a live issue once again.  While taxi companies had pioneered independent contracting in an earlier moment, technocapital’s flamboyant forms of neoliberal risk-shifting have catalyzed a powerful resistance to both the corporate practice of eschewing direct employment and worker reliance on state structures for security. The second neoliberal turn brought on by Uber and Lyft eradicated both municipal regulations and the limited sense of agency that workers had over their livelihoods. Ironically, this purge of state structures in the 2010s that drivers could leverage stirred new—but old—forms of collective activity. For the first time since the early 1980s, employment status—and more importantly, shared worker power built through the threat of employment status—has become a way for ride-hailing drivers to resist extreme economic insecurity and to collectively imagine better futures.

Response: Workers are turning to one another to build power and effect change. Through protests, strikes, and other direct actions that have emerged through the fight for employment in California, drivers have found a much-needed source of friction that can stop, or at least slow, technocapital’s assault on their lives: solidarity.


Prompt: T. Candice Smith was driving to work in the express lane of a Las Vegas freeway in 2012 when her car suddenly malfunctioned. Her steering wheel froze and the car shut off. When it rolled to a stop, she and her friend got out and pushed the car to the shoulder. Once she was out of the way of traffic, she noticed a chirping sound coming from inside her dashboard. It was coming from a machine installed by her auto lender: a “starter interrupt device” (SID) that was programmed to make that sound before it disabled her car as punishment for missing a payment. It was then that she realized why she had almost died in a car crash: her lender must have tried to remotely disable her car. So she sat in the immobilized, chirping vehicle on the side of the freeway and called him.

Response: Having her car break down on the freeway was terrifying. Having to wait on the phone with her lender to get her car operable again made her feel even more helpless. When she told him what had happened, the lender insisted that the device wasn’t meant to stop a moving vehicle, only to prevent it from starting, and refused to admit any responsibility. Her lender went on to disable her car at least four more times, including once again while she was driving, and then took her to court for not making payments—which later investigations showed the company had actually received but had failed to put in her account. In reality, Smith was never more than a couple of days late on her payments, and never even close to defaulting, which Nevada state law defines as being thirty days past due. And even though it’s illegal for creditors in Nevada to repossess a car before the borrower defaults, disabling a car via SID didn’t clearly count as a repossession because it doesn’t technically “seize” the collateral.


Prompt: A year after her near-crash on the freeway, Smith testified about her experience to the Nevada Assembly Committee on Commerce and Labor. Her testimony sparked a wave of national media coverage on SIDs. Calling them “kill switches” and invoking “Big Brother,” reporters from the New York Times and Mother Jones highlighted the cruelty of lenders who would disable a car after just a day without payment. Even the Daily Mirror proclaimed, “Heartless creditors LOCKED T. Candice Smith's steering wheel and stopped her engine as she drove down a busy Las Vegas highway.”  Smith’s testimony was crucial for exposing SIDs to people outside of the auto finance industry, which had already been using them for more than a decade. But her experience was somewhat unique: she was fortunate enough to be able to make the majority of her payments on time, and she experienced an absolutely indefensible near-death collision because of her SID. For these reasons, the media was particularly sympathetic to her.    But there are over two million drivers with SIDs in their cars today, and most of them are not in Smith’s situation. They can’t always afford to keep up with their payments, and their experience with SIDs aren’t nearly as dramatic. Their stories rarely make the headlines, yet these are the people we need to focus on to understand how SIDs really work, and the insidious problem they represent.  SIDs are not just a potential safety hazard—they are also ruthless tools of financial extraction. Lenders prey upon an increasing number of vulnerable borrowers who can’t pay back a loan, but who can be squeezed for irregular payments under the coercion of a device that can shut off their car. Lenders see themselves as providing a utility like a phone company, but if anything they’re more like the mob. As one dealer remarked, “It’s amazing how people manage to pay when they know their car won’t start.” There’s an App for That SIDs debuted in the world of auto lending in the late 1990s under the name On Time, offered by a company called Payment Protection Systems. Mel Farr, a running back for the Detroit Lions who became a well-known businessman, helped make On Time devices famous, using them in thousands of his business’s auto loans. At its peak, his group of fourteen car dealerships grossed nearly $600 million annually. Farr’s business was divisive: he was praised by then-president Bill Clinton for building the nation’s largest Black-owned business and “[bringing cars] to every community in this country,” but also criticized by others, like consumer protection activist Ralph Nader, for charging incredibly high interest rates—even on cars with the On Time devices.

Response: At the time, the devices followed a simple schematic. There was a small computer, about the size of a billfold wallet, connected to a switch between the ignition and the starter motor, with a voltage monitor on the engine, and small keypad. The computer was preprogrammed with a schedule and a list of numeric codes, which borrowers would receive from the lender when they made their weekly or bi-weekly payments. If they didn’t enter an acceptable code, either a light would flash or a sound would play, signalling that the car would soon be disabled. The voltage monitor on the engine was supposed to ensure that the car wasn’t in motion before the computer switched off the starter. In August 1999, On Time’s creator, Frank Simon, estimated there were about 15,000 to 20,000 of these devices on the road.


Prompt: The next generation of SIDs arrived in the mid-2000s, which is when the technology really took off. In 2006, Stanley Schwartz, cofounder of a competing SID company PassTime, filed a patent for a combined SID-GPS device. It took advantage of newly robust GPS infrastructure following the launch of the first modernized GPS satellite in 2005. The updated SIDs also utilized a wireless modem, which meant that lenders could communicate with the device in real time through an online portal—and later, on a dedicated smartphone app. Lenders could now disable cars outside of the set schedule, and could even set up geographic boundaries outside of which the car would automatically have its ignition disabled. By 2013, PassTime had sold 1.5 million of these devices—a hundred times as many as the old model.   The new SIDs made disabling a car incredibly easy, both logistically and emotionally. One collections agent told the New York Times that he could monitor the location of 880 borrowers’ cars from his computer or phone, and that he once casually disabled someone’s car from his phone while he was shopping at Walmart.

Response: What about the claim from borrowers like Smith that the SID stopped their car while they were driving? There is no simple answer. But car engines can stall, and if the starter motor is off, then the engine can’t restart. Considering the low quality of cars usually offered by no-credit-check used car dealers, it’s not hard to believe that the SID could trigger latent engine issues. Or the SID itself could be faulty or improperly installed. Of course, there’s a huge legal incentive for lenders to deny these possibilities so they can continue using the devices, because electronically disabling equipment is only legal when it doesn’t cause physical harm.


Prompt: Target Acquisition  Ever since Mel Farr helped popularize the first generation of SIDs, lenders have stood by the claim that SIDs allow them to fill the crucial role of extending credit to people who would otherwise not qualify for the cars they desperately need to get to work—the so-called “subprime” market. According to Mother Jones, in 2016 about 70 percent of these loans used “payment assurance” devices, which includes SIDs in their early and later forms, as well as GPS trackers without SIDs.

Response: This is a multi-billion-dollar market. Auto dealers target these millions of borrowers with low or non-existent credit scores for loans even without SIDs because, despite the potential for default, they can still make money both by inflating car prices and by charging high interest rates. And the market is growing: In 2019, a record seven million Americans were over three months late on their auto payments, largely due to the increasing number of subprime borrowers.  Theoretically, SIDs could benefit borrowers by helping reduce these interest rates, which should be based on the risk for lenders. But in reality, interest rates are “not [reduced by] installation of the [SID],” according to testimony by Sophia Romero of Legal Aid of Southern Nevada. Instead, SIDs encourage lenders to offer larger loans on higher value vehicles, with the highest possible interest rates. In a 2012 survey of 1,300 dealers, “nearly 70% of respondents indicated that they believed the use of devices allowed them to sell higher value… vehicles with less risk.” This belief comes from the fact that lenders can continually threaten to remotely disable the vehicle while keeping drivers in their cars, paying for as long as possible until they default—at which point, the lender can quickly repossess the car and sell it to someone else. And in the background, lenders package and sell these predatory loans as asset-backed securities to banks. This should sound familiar—in housing, it’s what caused the 2008 financial crisis. And just like in 2008, it’s the borrowers, not the banks, who suffer.  So, it’s true that SIDs reduce risk so lenders can extend credit to borrowers who otherwise wouldn’t get it. But SIDs have nothing to do with someone’s actual ability to pay, which means borrowers’ pockets are drained while lenders jump indiscriminately from one borrower to the next. Keeanga-Yamahtta Taylor describes a similar dynamic in the housing market as “predatory inclusion,” where mortgage lenders in the 1960s targeted previously excluded, mostly Black borrowers, with home loans that were federally insured to reduce lender risk. Instead of actually supporting these borrowers, they raked in as much money as possible until borrowers—who were portrayed as unintelligent and irresponsible—foreclosed.


Prompt: Privacy-Respecting Predators So what should we do about SIDs? To date, the legislative responses have been woefully inadequate. They have failed to address the deeper issues of economic justice, and have largely accepted the lenders’ basic argument that expanding access to credit is necessary even as it becomes predatory.

Response: For example, in 2017, the FTC started investigating a number of finance companies on their use of SID-GPS tracking devices in the name of consumer privacy. The same year, Nevada passed SB 350, which is one of the strongest state bills regulating SIDs in the country to date. Initially written as a complete ban on SIDs as “deceptive trade practices,” the bill was amended to allow SIDs as long as lenders follow certain rules. These rules include requiring written consent from borrowers and certifying proper installation, banning vehicle disablement until thirty days of overdue payment or of operating vehicles, supplying emergency restarts for consumers, and deleting GPS data once it’s 180 days old.  These regulations mainly address security, safety, and privacy—which all must be addressed if SIDs are on the road. But they’re not nearly enough to prevent lenders from using SIDs to scale their operations beyond people who can reasonably pay.  One solution would be to force more risk back onto the lenders. For example, states could require lowering interest rates in conjunction with the SIDs. Another would be to restrict their usage overall. States could ban SIDs as a condition for granting a loan—which California actually did, but only for GPS devices, not SIDs. There’s also the model of the Consumer Financial Protection Bureau’s Payday Lending Rule, which has been indefinitely stalled after its introduction in 2017, but would have required lenders to determine whether a borrower is reasonably able to pay back a loan before granting it.  The path forward is not simple or obvious. Ultimately, the problem with SIDs is that they broaden and intensify a predatory system, so even with laws like SB 350, vulnerable borrowers will still end up trapped in cycles of debt or declaring bankruptcy. As one woman interviewed by CBS News about her experience with SIDs explained her reason for taking out an auto loan at a predatory dealership: “I had to get to dialysis. I have to get there or I don’t live.” We can imagine a world without SIDs, but it’s harder to imagine a world without the system they belong to. Even if we banned the devices, people would still depend on credit for access to life’s necessities—and that dependency will always attract lenders trying to make quick money.


Prompt: Introducing better privacy protections for the data they gather, or ensuring they are safely installed, will do nothing to prevent that. Perhaps we need to “rethink credit as social provision” as the scholar Abbye Atkinson argues, and develop more direct ways of fulfilling people’s needs. Perhaps we need to reduce our dependence on cars by providing better public transportation services that make mobility a social right. The fact that people need cars to get to work or the doctor shouldn’t be an argument for letting lenders rip them off. It should be a sign that we need a renewed program of investment in our social and physical infrastructure, one that supplies kinder and more creative solutions.

Response: Technologists try to make digital experiences frictionless. Mirroring the mythical efficiency of a perpetual motion machine, the goal is to advance users from screen to screen with ease. As a result, standard design practices call for masking complex technical systems beneath simple interactions.  Yet this becomes difficult to do within the context of online security. Security requires friction, such as “strong” but difficult-to-remember passwords. Complexity becomes a feature, not a bug. And this complexity tends to increase over time, thanks to the cat-and-mouse nature of security: bad actors develop new tactics that result in high-profile hacks, which in turn demand ever more elaborate countermeasures.


Prompt: These countermeasures create friction for everyone—but especially for people with disabilities. Indeed, online security can be a nightmare for disabled people. Take the common security practice of converting letters to asterisks (*) in password fields. The screen readers used by visually impaired people try to mirror this practice by replacing every occluded password letter with the word "star” or calling the entire field “concealed text.” Imagine for a moment typing in your password, and hearing either “star” repeatedly or complete silence. This makes it difficult to review what letters have been typed, leading to mistakes and frustration.  Another example is facial recognition for devices, like Apple Face ID and Windows Hello. In addition to performing inconsistently for underrepresented groups, facial recognition creates new challenges for blind users. “Ninety-five percent of the time the camera can’t see me,” says Lucy Greco, the web accessibility evangelist at UC Berkeley. “I know where to touch the fingerprint sensor because it’s the same spot every time. But I don’t know why it’s not seeing my face.”  These kinds of difficulties cause many disabled users to opt out of security measures entirely. “I have noticed that many people who are emerging technology users—who are blind, visually impaired, or have other disabilities—they'll get a lot of assistance to set up their phone,” says Chancey Fleet, assistive technology coordinator at the New York Public Library. “Often they decide, or have the decision made for them, to skip the passcode,” she continues. “Because when you're new and everything’s hard, entering the passcode is hard. And that lack of passcode will linger for months, or even years, and become habitual.” The result is a crisis. We are creating a digital world where the most desirable path for disabled people is to leave themselves unprotected. This means that as the level of security rises among the nondisabled, disabled people are becoming more vulnerable to digital threats, deepening disparities. And these disparities affect an immense share of the world’s population—over a billion people have some form of disability, according to the World Health Organization. Furthermore, this number is constantly growing: disabilities are correlated with age, and lifespans are increasing. We will all be disabled in one form or another during the course of our lives. It's just a matter of time. So when those of us who are (currently) nondisabled contemplate accessibility, we aren’t just serving our fellow humans with disabilities in the present—we’re also serving our disabled selves in the future.

Response: Fortunately, there’s nothing inevitable about a digital world that fails to protect disabled people. Academic researchers are proving that it's possible to rethink authentication for disability, synthesizing perspectives from the realms of both security and accessibility. Their efforts offer a glimpse of what our technology could look like if it aspired to keep everyone safe.


Prompt: Open Sesame To help disabled people remain secure online, academics are exploring solutions involving gestures, haptics, and even “mind reading.” Consider the “passthought,” proposed in 2005 by computer scientists at Carleton University. Passthoughts involve thinking a silent and inherently unobservable thought. In lab studies, researchers provide instructions to subjects such as, “Imagine that you are singing a song or reciting a passage for ten seconds without making any noise.” Detected by sensors, the brainwave signals emitted from this thought can log users into services or devices.  How does this work? Prior to authentication, users are asked to think the passthought repeatedly. Their digitized brainwave signals—the “training data”—are then processed to extract a set of features that best encode a user profile and remain consistent over time. Finally, this set of features is used to build a "lock" that only opens for the specified user performing the specified passthought.  Passthoughts hold promise because they provide two factors of authentication in a single step. Knowledge, or the secret thought, is one factor; the user’s brain is the other. Given that each of our brains is uniquely differentiated by genetics and environmental conditions, our brain waves have a kind of biometric signature. But unlike fingerprints or faces, passthoughts can be changed if they are compromised. And even if the attacker knows the content of the passthought, it can’t open the lock without the user’s brain. This makes passthoughts relatively robust against impersonation and better protected from social engineering attacks, where the user is tricked into revealing their password.  Despite these advantages, passthoughts still have practical limitations for real-world use. In an exploratory study with blind people, researchers found that authenticating via brain-computer interface was less accurate and took longer than entering a PIN. Moreover, the sensor-embedded headsets that are required for brainwave authentication can be awkward, uncomfortable, and stigmatizing to wear. Researchers have explored discrete, in-ear alternatives, but many involve bands that wrap around the neck and place electrodes along the scalp, while more robust models resemble a swim cap. These headsets can also cost hundreds of dollars and so may be out of financial reach for many people.

Response: Another creative approach is PassChords, developed in 2012 by Cornell professor Shiri Azenkot and her colleagues. “These researchers recognized that if you're using a screen reader in public on your smartphone, people might be able to hear you enter your password,” explains Cynthia Bennett, a researcher at the University of Washington. “So they came up with a gesture-based system that was silent.” Entering a PassChord involves tapping several times on a touch surface with one or more fingers, reminiscent of playing a musical sequence. A study with sixteen blind participants found that using PassChords was as accurate and significantly faster than entering an iPhone passcode with a screen reader, taking about a third of the time.


Prompt: While passthoughts and PassChords have the potential to improve the lives of millions of disabled users, it will be hard to make them mainstream. Academic researchers are constrained by limited resources. They can build novel prototypes, but they often don’t have the capacity to bring those prototypes to a mass audience. “PassChords is heavily cited, it’s well known in the community, and in user testing, people say great things about it,” says Yang Wang, a professor at the University of Illinois at Urbana-Champaign. “I don’t think it’s widely deployed though.”  Without an expensive marketing campaign, how can a product find users? And without a business model, how can operating costs be sustained? Maintainability is another challenge: projects like PassChords need to be continually updated as browsers and operating systems change. This is hard to do, especially as the students who write the software for these academic projects graduate. Furthermore, in the absence of a revenue stream, projects can’t hire people to maintain the software on an ongoing basis.  Academia’s distance from industry is thus a double-edged sword: while academics have the freedom to prototype projects that are insulated from market forces, this also limits the scale of their impact. Solutions like passthoughts and PassChords are only available to a select group of users, often for a limited amount of time. They remain in beta indefinitely and are rarely released to the wider public.

Response: Hack the Planet Unfettered by the resource constraints of academia, tech companies could pick up these projects and deploy them at scale. So why don’t they? Because the industry largely considers people with disabilities to be anomalies—a niche and “non-normal” subgroup of users. By this logic, it seems unprofitable to develop specialized features that appear to benefit only a select few. When businesses do prioritize accessibility, they often do so for two reasons: to avoid discrimination lawsuits and to generate positive publicity. The benefits of either are difficult to measure, however, while the costs of building features for disabled users are concrete and non-trivial.  But there is another urgent reason that industry should care about accessibility: security. When companies create bad accessibility features, it can result in more than just bad user experiences. It can also introduce new security risks, impacting systems and individuals alike. And these risks can lead to breaches that inflict real damage to the company’s bottom line.


Prompt: A good example is CAPTCHA, or the Completely Automated Public Turing test to tell Computers and Humans Apart. Designed as a challenge to prevent bots from spamming a system, CAPTCHAs were first introduced as images of distorted character strings. Typing the contents of this image into a text field would effectively prove one’s humanity and allow a user to proceed onto the next webpage.  However, the original CAPTCHA was soon revealed to exclude people with visual impairments, effectively deeming only those who could see images as “human.” Including descriptive “alt” text in the source code of the website could solve this problem by making CAPTCHAs accessible to screen readers—but at the cost of also making CAPTCHAs legible to bots, which could then pass for human. Enter the audio CAPTCHA, which was introduced as an “accessible” alternative—though it still excludes people that are deafblind. It reads the contents of a visual CAPTCHA aloud without relying on alt text, and it adds background noise or distortion that makes it harder for bots to understand.  While visual CAPTCHAs have evolved to more robust cognitive tasks—like selecting all the traffic lights in a given image—accessible CAPTCHAs haven’t progressed nearly as far. Meanwhile, advancements in speech recognition technology are approaching human performance, giving hackers enhanced capabilities to decipher audio CAPTCHAs even with significant noise or distortion. After obtaining and preprocessing the audio, attackers can now automate the submission of these recordings to speech recognition services, and then plug the transcriptions into the web form. The result is new system-level security risks: in a 2017 study, researchers at the University of Illinois at Chicago found that off-the-shelf speech recognition services could be used to hack the most common audio CAPTCHAs, breaking Google’s reCAPTCHA with a 98% success rate.  Accessibility done badly can make the internet less safe for everyone. If companies can’t be convinced to protect disabled users because of ethical and legal reasons, perhaps they can be motivated by the security risks that result from serving disabled users poorly. Moreover, the potential impact of these risks is growing as accessibility permissions are used in unexpected ways: to deliver new features, rather than expanding access. Even the nondisabled may therefore be unwittingly using accessibility features—and bearing the associated risks.

Response: For instance, Dropbox users are asked to turn on accessibility during setup on Mac computers. Yet how this helps people with disabilities is currently not discussed in the documentation; the explanation emphasizes that turning on accessibility will enable added functionality. “Mac shoehorns a million different things into accessibility permissions,” says an anonymous commenter on r/MacOS. “You might grant a window manager accessibility permission to move windows around, but then the window manager could, if it wanted to, read your keystrokes.”  Moving Targets So what is the way forward? Ideally, we could foster partnerships between academia and industry that combine the interdisciplinary prototyping of the former with the funding of the latter. Even under the best arrangement, however, a deeper difficulty will remain: both security and disability are moving targets. What one needs to be secure online is constantly changing—and so is what defines one as disabled. As a report from the AI Now Institute notes, “the boundaries of disability… have continuously shifted in relation to unstable and culturally specific notions of ‘ability.’”  Security and disability are fluid, and this will always create challenges for technologists trying to design for either—let alone both. Much creative experimentation will be needed, but the goal should always be the same: to keep as many people as possible safe, even if it means overhauling our technologies. As Bennett, one of the authors of the AI Now report, explains, “Disabled folks are not vulnerable because of our inherent bodyminds, but because systems are not set up to protect all people equally. That's what creates the vulnerability.” In 2017, when a National Security Agency (NSA) whistleblower wanted to extract classified government documents from her work computer, she sought refuge in the printed page. Maybe she thought physical paper would be safer from digital surveillance than an email. So she printed the documents at her office and then mailed them to The Intercept, which broke the news with the headline, “Top-Secret NSA Report Details Russian Hacking Effort Days Before 2016 Election” on June 5th, 2017 at 3:44 p.m. eastern time. A few hours later, the US Department of Justice officially announced their arrest of Reality Winner, a former US Air Force officer and NSA contractor.


Prompt: What happened? The Intercept contacted the NSA on May 30th asking them to verify the documents. But by sending the scanned images that included each page’s wrinkles and folds, as opposed to retyping the information, the journalists shared more than they intended to: they sent the NSA the pale yellow tracking dots that are embedded in every piece of paper that is printed by a color laser printer. The dots form rectangular grids of rows and columns, with each dot’s position corresponding to the value of a date, time, or printer model. Together, the rows and columns constitute a machine-readable bitmap known as a machine identification code (MIC). MIC grids repeat across the page so that even if only a shred of a page is recovered, the MIC on that shred can still be decoded and traced. While neither the Justice Department’s nor the FBI’s statements about Winner’s arrest mentioned MICs, security experts strongly suggested that they played a role in helping the agencies identify her and, at the very least, corroborated other evidence linking Winner to the leak.  Winner’s case spurred a renewed interest in laser printer tracking dots and other techniques for embedding hidden messages in plain sight, also known as steganography. The development and deployment of these techniques comes out of a long-running secret relationship between governments and printer manufacturers in multiple countries. It sounds impossibly paranoid: every piece of paper that's printed by a color laser printer anywhere in the world is marked with invisible grids that make it possible for governments to trace when that exact page was printed and by what printer model. But in 2004, a Dutch journalist revealed the existence of the dots. In doing so, he sparked an ongoing arms race between privacy activists on the one hand and printer companies and intelligence agencies on the other.

Response: Printing Money For as long as commercial printers and copiers have existed, their manufacturers have been enlisted by US intelligence agencies to help track down whistleblowers. In 1971, the grassroots direct action group, Citizens’ Commission to Investigate the FBI, raided a small FBI field office in Media, Pennsylvania and sent copies of the documents they found there—which first exposed the existence of COINTELPRO, the FBI’s notorious program for sabotaging leftist organizing in the US—to news outlets across the country.  At the FBI’s request, Xerox helped the FBI determine that the Xerox 660 was the specific make and model of the copier used to disseminate the leak. Xerox also provided the FBI with a list of customers who leased the 660, but ultimately “decided at the very highest level” to not cooperate further with the bureau, according to Xerox PR manager Gerald A. Mulligan. Xerox’s noncooperation stonewalled the FBI’s investigation. Even with over 200 agents on the case, the FBI never prosecuted anyone for the raid. Xerox’s stand against intelligence agencies would be the last of its kind.


Prompt: As personal computers, printers, and copiers became more readily available, intelligence agencies sought deeper inroads with printer technology companies in order to combat what they saw as a growing threat of currency counterfeiting. Japan was the first government to require traceable codes embedded in laser printouts and Fuji-Xerox, the joint Japanese-American printing venture, developed the first iteration of tracking technology—the yellow dots—in the mid-1980s. Other countries, including the US, quickly followed suit. Although there was no law in the US mandating that printer manufacturers incorporate MICs into their machines, industry insiders reported that the US government and intelligence agencies made clear to printer manufacturers that the lack of traceable markings could make it difficult to sell their products in the country. Soon, every major manufacturer implemented their own tracking codes. Not a single one revealed this “feature” to its customers.  By the 1990s, the desktop publishing revolution was well underway and central banks around the world took notice. In January 1993, central bankers and banknote printers from the G-10 countries convened a steering committee called the Special Study Group 2 (SSG-2) to assess the threat of laser printers to currency integrity. A 1995 SSG-2 memo describes a system for tracing counterfeit banknotes back to a specific copier. The SSG-2’s next steps were to research “whether the technologies developed for copiers could also be used for scanner and computer systems”—with the goal being complete traceability for any given sheet of paper from any commercially available copier, scanner, or printer. A 1998 SSG-2 report remarks on the success of the tracing system and notes that “manufacturers will continue to provide assistance in identifying specific copiers at no additional cost.”  Still, the details remained secret until 2004, when the Dutch journalist Wilbert de Vries broke the story of the tracking dots. In a brief article originally for the online IT publication Webwereld, de Vries cites anonymous sources with the Dutch Railway Police who confirm that they are using tracking dots to identify members of a counterfeit ticket printing gang. Privacy activists were appalled by the disclosure since the same technology that makes counterfeiting harder also subjects every single person who prints a piece of paper with a color printer—the vast majority of whom are not printing fake money or railway tickets—to non-consensual tracking. In the aftermath of de Vries’s discovery, the Electronic Frontier Foundation (EFF) condemned the practice of using tracking dots and began collecting data on which manufacturers implemented them, including submitting FOIA requests to the US government regarding its involvement. Much of what we know about the history of printer steganography is due to their work.

Response: EFF researchers were quickly overwhelmed by the sheer scale of the operation. They concluded that all major printer companies were implementing MICs in laser printers in some fashion. With the help of volunteers, they were able to decipher portions of the yellow dot tracking codes in use by a popular laser printer, the Xerox DocuColor. Each row of the grid was given a numerical value of a power of two—so the value of the bottom-most row would be one, the value of the next row up would be two, the next row up would be four, and so on up to sixty-four. Each column of the grid represented part of the printout’s date or time or the printer’s serial number. Specifically, columns 11 through 15 designated the printer’s serial number. So if column 11 had a dot in row 32, plus a dot in row 16, the first digit of the serial would be 32 plus 16, or 48. The dot matrices produced by other printers looked completely different. Canon, for instance, arranges their dots in a spiral. Ultimately, Xerox abandoned their original grid pattern, making the EFF researchers’ decoding tools obsolete. Newer printers presumably use a different system to encode metadata in the dots.  Following the Dutch revelations, printer manufacturers scrambled to justify their invasive and secretive technology. Xerox, for the first time, publicly admitted to using tracking codes and spun them as a positive, consumer-friendly feature to enhance the security of their printouts. As a result, they found themselves under the scrutiny of the EU Commissioner for Justice, Freedom, and Security, who stated in a 2008 official memo that such tracking "may give rise to the violation of fundamental human rights, namely the right to privacy and private life.” Disrupting the Dots I run an independent press based in New York City. After learning of the pale yellow dots, I wanted to know if I could find them in the books, magazines, and chapbooks I had made over the years. When I scanned the pages into the computer and inverted the colors of the scans, I found that nearly all of them had the simple arrangement of dots that bound me up within a global surveillance apparatus. One of our recent publications—Salty Wet, a visual essay on political resistance in Hong Kong—was covered in Xerox tracking codes. I wondered if there was any way to remove them, or if being trackable was simply the cost of printing in color.


Prompt: In 2018, a group of researchers at the Technical University of Dresden made a breakthrough to that end when they released DEDA: the Dot Extraction, Decoding, and Anonymization toolkit. Analyzing over a thousand printouts from over a hundred printers, they developed an algorithm to detect and decode the tracking dots of four grid patterns that were used across eighteen manufacturers. Finally, there was a way for regular people to pry the dots out of the hands of corporations and intelligence agencies, and commandeer them for ourselves. The DEDA toolkit allows anyone to anonymize documents by removing the tracking dots at the software level, actively inhibiting the process and giving non-governmental entities the ability to disrupt their printer’s surveillance mechanisms. It also enables users to hijack the MICs for their own purposes by creating user-defined secret patterns. Seemingly innocuous blank sheets of paper could now be used to convey information between any parties—not just central bankers, printer manufacturers, and intelligence agencies—so long as each party had access to the decoding key.  When I set up the toolkit on my laptop, I found that the anonymization and user-defined pattern tools worked right out of the box. It was thrilling to be able to manipulate the corporate tracking systems I had never consented to and create my own MIC. But when I attempted to decode the yellow dots on a piece of paper printed commercially from a Xerox PrimeLink C9065, DEDA came up empty. I tried another piece of paper from a smaller Xerox DocuColor printer and, again, DEDA found nothing, even after I had manually confirmed with a UV light that the page was marked with tracking codes.   Perhaps the toolkit is a victim of its own success. At the time, DEDA was a revelation. But security is not a steady state. The fanfare from the cybersecurity press that accompanied the toolkit’s release may have caught the eye of printer companies and intelligence agencies, and maybe they tweaked the encoding schemes they were using. It is also possible that the printers I tested use a MIC that hasn’t yet been catalogued by DEDA. According to the EFF, engineers employed by major manufacturers have hinted at the existence of a new generation of tracking mechanisms. It's been posited by researchers that tiny discrepancies in the spacing between words or even the kerning of letters could be used to encode information. But little is known about these alternative tracking measures aside from vague warnings by industry insiders.

Response: The rationale behind building surveillance mechanisms into laser printers laid the foundation for more far-reaching forms of surveillance that we encounter in our devices today. The modern internet is full of invisible tracking mechanisms that, like MICs, are marketed as beneficial at best and harmless at worst—as long as you have nothing to hide. Compared with the sprawling digital behemoth of the web, yellow tracking dots may seem trivial. But the efforts by intelligence agencies to keep tabs on printed documents are a grave, if obscure, threat to our privacy. And the history of those efforts reminds us that what might at first sound like a conspiracy theory is actually true: that in the name of preventing crime, government and industry collude in secret to track us all.


Prompt: In late July 2017, a twenty-five-year-old hacker named Luigi Gubello emailed the staff of Rousseau to tell them that he had found a security vulnerability in their software. Rousseau is the online platform that one of Italy’s most popular political parties, the Movimento 5 Stelle, or Five Star Movement, uses to engage its supporters. Five Star claims to be at the forefront of digital democracy, allowing its members to vote online for everything from its policies to its political leaders. If Rousseau were compromised, Five Star’s candidates for the Italian parliament could theoretically be selected by rogue actors, from lone hackers to foreign governments.  Gubello is a “white-hat” hacker, breaking into IT systems to highlight their vulnerabilities, not to exploit them. Gubello explained in his email to Rosseau staff that he had infiltrated the platform using SQL injection, a well-known type of vulnerability in which a data input field—username, say—is used to send commands to a database program, allowing a hacker to change or delete data entries, or download an entire database. It was the same sort of attack that played a major role in the famous hacking of Heartland Payment Systems in 2009, which caused hundreds of millions of dollars in losses to companies around the world, but it’s also the sort of attack that a precocious high schooler might have launched in the early 2000s to boost her grades.

Response: In his email to Rousseau, Gubello explained why the vulnerability was dangerous and how to resolve it. Shortly afterwards Gubello received a reply from Rousseau’s staff thanking him, and claiming to have fixed the problem. The following month, in August 2017, Gubello, concerned about the continued vulnerability of Rousseau, went public with his findings in a blog post and urged the platform’s users to change their passwords. “Hacker reveals: M5S’s Rousseau site is not secure,” declared La Stampa, the Italian newspaper.  At the time, Five Star was approaching one of its most consequential votes ever, to determine who would be the leader of the party and its de facto candidate for prime minister going into the following year’s Italian general election. If the party triumphed then, this person could become the leader of the entire country.  On September 21, 2017, shortly after Five Star opened voting for its leadership election, the Rousseau servers stalled. Scores of members were unable to cast a ballot, and the party was forced to extend the voting until noon the following day. The party claimed this was due to the sheer numbers of people taking part, but of Five Star’s 140,000 members, little more than 37,000 voted.


Prompt: More than 80 percent of those voters selected a thirty-two-year-old politician named Luigi di Maio. It was a “world record,” claimed a euphoric post on the party’s blog: “the first leader of a political force chosen and voted for entirely on the Net.” But then, just after voting finished, a malicious “black-hat” hacker named rogue0 began tweeting that they had compromised the election.

Response: “Think of it like a house with many open windows,” Gubello said of Rousseau when we spoke recently. “I saw only one open window”—the vulnerability he used to deploy his SQL injection attack—“and they closed it. But rogue0 found another one.”  Open Windows Among the tweets that rogue0 sent that night were screenshots of multiple votes he had generated for Luigi Di Maio, the winner of Five Star’s leadership contest. The party claimed that every vote had been authenticated using text message confirmations, but rogue0 poured scorn on this. “Rest assured, Luigi Di Maio has already won, dozens of my certified votes assure you,” the hacker tweeted. Even after the warning of Gubello, Rousseau—and Five Star’s purported digital direct democracy—had been left exposed.


Prompt: Another series of screenshots rogue0 posted appear to show the hacker signing into the accounts of various senior members of Five Star. In the subsequent hours and days, rogue0 also published some of the login details he had scraped from the Rousseau database; several of Five Star’s leaders and digital operations staff had laughably basic passwords, such as their birthdays. “Seriously I can continue all night long this way,” rogue0 tweeted at one point. Eventually, the hacker dumped the entire database into a publicly accessible pastebin.

Response: Gubello suspects that rogue0 accessed the login details using another SQL injection attack that swiped an admin password from the database. Fabrizio Carimati, an Italian internet security expert, agreed. “In reality, Rousseau's website was simply badly written, so everyone suspects that rogue0 used basic techniques,” Carimati told me. He added that the chances of the hack being a SQL injection attack were “99 percent.” Rousseau was vulnerable in part because it was built using a proprietary content management system based on a version of the Movable Type software released in 2008. The upshot was that Rousseau had to be maintained in-house, and was only as secure as its best programmers could make it.  Other digital parties use more robust systems. Spain’s left-wing Podemos utilizes an open source and blockchain-based system for its online voting which claims to be tamper-proof; it also allows for external verification, which Five Star didn’t have in place until 2018. The Pirate parties of Northern Europe, which, broadly speaking, advocate direct democracy and internet freedom, use open-source software such as LiquidFeedback and Loomio, which can be security-tested and improved by almost anyone; similarly, organizations such as Occupy Wall Street and city governments in Reykjavik, Barcelona, Madrid, and Paris have adopted open-source voting tools.


Prompt: It’s difficult to say exactly why Five Star relied on old, self-maintained software. Perhaps it was simply a legacy system with high switching costs. But its proprietary nature also fit with the general culture of the people running the party. Though Five Star has presented itself as a populist movement empowered by digital tools, the reality is that Rousseau is controlled by a private firm, Casaleggio Associates, which operates with a great deal of secrecy and has exerted a significant amount of control over the movement.  A Sense of Community The Five Star Movement was founded by Beppe Grillo, a comedian famous across Italy for his pugnacious humour, and an internet entrepreneur named Gianroberto Casaleggio—the founder of Casaleggio Associates. For more than a decade, Grillo has been the movement’s figurehead. But until his death from brain cancer in 2016, Casaleggio, who was relatively unknown among most Italians, was the movement’s most powerful figure.

Response: Casaleggio had some intensely bizarre political beliefs that seemed to verge at once on the paranoid and the utopian. He was a fan of Genghis Khan’s horseback couriers and Benito Mussolini’s radio broadcasts, and foresaw a future a few generations hence in which a total war would annihilate billions of people, leaving the remnant to govern itself by means of a worldwide internet democracy.