Abstract: Any given computer or network runs code from an enormous number of sources, including the producer of the operating system, the hardware, built-in and user-installed applications, websites, and the user herself. Computers may also run code injected by remote attackers of various sorts including autonomous viruses, individual hackers and state-backed organizations. What happens when the authors of these various software components have different objectives for the behavior of that single computer or network?
This talk will propose a simple theory that predicts which of these contestants will tend to win in different kinds of computer security contests, including the robustness of encrypted communications; the control of cloud-based and distributed computing systems; and some hypothetical future applications to the security of AI systems.
About the Speaker: Peter Eckersley is Technology Projects Director at the Electronic Frontier Foundation. He leads a team of technologists who do both coding and policy work to strengthen Internet security, privacy, and innovation.
Peter holds a PhD in computer science and law from the University of Melbourne. His doctoral research was on digital copyright and the alternatives, including the computer security dimensions of copyright policy.
Encina Hall (2nd floor)
Peter Eckersley
Technology Projects Director
Speaker
Electronic Frontier Foundation
Abstract: The first Snowden disclosure was that Verizon was providing daily updates of telephony metadata to the NSA. This caused great consternation, and resulted in two government studies, one by the President's NSA Review Committee and one by the Privacy and Civil Liberties Oversight Board. Both concluded the collection should be ended. The President asked Office of the Director of National Intelligence to produce a report "assessing the feasibility of creating software that would allow the intelligence community more easily to conduct targeted information acquisition rather than bulk collection." This talk reports on that work, which considered the issue from the angle of technical alternatives, and concluded that there is no technical replacement for bulk data collection, but that software can enhance targeted collection and automate control of data usage. This talk will discuss that report, conducted by the National Research Council, explaining what the report says — and what it doesn't say.
About the Speaker: Susan Landau is Professor of Cybersecurity Policy in the Department of Social Science and Policy Studies at Worcester Polytechnic Institute. Landau has been a senior staff Privacy Analyst at Google, a Distinguished Engineer at Sun Microsystems, a faculty member at the University of Massachusetts at Amherst and at Wesleyan University. She has held visiting positions at Harvard, Cornell, and Yale, and the Mathematical Sciences Research Institute. Landau is the author of Surveillance or Security? The Risks Posed by New Wiretapping Technologies (MIT Press, 2011), and co-author, with Whitfield Diffie, of Privacy on the Line: The Politics of Wiretapping and Encryption (MIT Press, 1998, rev. ed. 2007). She has written numerous scientific and policy research papers, and has also published in other venues, including Science,Scientific American, and the Washington Post. Landau has testified in Congress on cybersecurity and on electronic surveillance. Landau currently serves on the Computer Science Telecommunications Board of the National Research Council. A 2012 Guggenheim fellow, Landau was a 2010-2011 fellow at the Radcliffe Institute for Advanced Study, the recipient of the 2008 Women of Vision Social Impact Award, and also a fellow of the American Association for the Advancement of Science and the Association for Computing Machinery. She received her BA from Princeton, her MS from Cornell, and her PhD from MIT.
Encina Hall (2nd floor)
Susan Landau
Professor of Cybersecurity Policy in the Department of Social Science and Policy Studies
Speaker
Worcester Polytechnic Institute
Abstract: NSA stands for National Security Agency, but the agency is at odds with itself in its security mission. Undermining global encryption standards, intercepting Internet companies' data center transmissions, using auto-update to spread malware, and demanding law enforcement back doors in products and services are all business as usual. What legal basis does NSA and FBI have for these demands, and do they make the country more or less safe?
About the Speaker: Jennifer Granick started as the Stanford Law School Center for Internet and Society's (CIS) Director of Civil Liberties in June of 2012. She became an affiliate at the Center for International Security and Cooperation in July 2012.
Jennifer returned to Stanford after stints as General Counsel of entertainment company Worldstar Hip Hop and as counsel with the internet boutique firm of Zwillgen PLLC. Before that, she was the Civil Liberties Director at the Electronic Frontier Foundation. Jennifer practices, speaks and writes about computer crime and security, electronic surveillance, consumer privacy, data protection, copyright, trademark and the Digital Millennium Copyright Act.
From 2001 to 2007, Jennifer was Executive Director of CIS and taught Cyberlaw, Computer Crime Law, Internet intermediary liability, and Internet law and policy. Before teaching at Stanford, Jennifer spent almost a decade practicing criminal defense law in California. She was selected by Information Security magazine in 2003 as one of 20 "Women of Vision" in the computer security field. She earned her law degree from University of California, Hastings College of the Law and her undergraduate degree from the New College of the University of South Florida.
Encina Hall (2nd floor)
Jennifer Granick
Director of Civil Liberties at Stanford Center for Internet and Society
Speaker
Stanford University
Abstract: With the development of cyber capabilities by an increasing number of states, policymakers as well as scholars have been calling for the negotiation of a new international treaty to regulate cyber warfare. This paper provides an account and analysis of relevant debates in the United Nations with a focus on the position of four states – Russia, China, the US and the UK. Discussions have been concentrated in the First Committee of the General Assembly which has been seized with the issue since 1998 when the Russian Federation submitted a proposal for an international convention to govern the use of information and communication technologies for military purposes. While these efforts towards a wholesale international treaty have not materialized, Russia and China continue to advocate a change in the legal status through the promulgation of additional norms. In contrast, the US and the UK have been firm supporters of applying current legal regimes, including the UN Charter and the Geneva Conventions, to the use of cyber capabilities by states. In advancing these positions, two powerful narratives have emerged each emphasizing different aspects of the cybersecurity debate.
About the Speaker: Elaine Korzak is a postdoctoral cybersecurity fellow at CISAC. She earned her Ph.D from the Department of War Studies at King´s College London in 2014. Her thesis examined the applicability and adequacy of international legal frameworks to the emerging phenomenon of cyber attacks. Her analysis focused on two legal areas in particular: international law on the use of force and international humanitarian law. Elaine holds both an MA in International Peace and Security from King´s College London and an LL.M in Public International Law from the LSE. Her professional experience includes various governmental and non-governmental institutions, including NATO´s Cyber Defence Section as well as the European Commission´s Directorate-General on Information Society and Media.
Elaine Korzak is a research scholar at the Berkeley Risk and Security Lab (BRSL) at UC Berkeley where she focuses on international cybersecurity governance. She is also an affiliate at the Center for Long-Term Cybersecurity (CLTC) at UC Berkeley and the Center for International Security and Cooperation (CISAC) at Stanford University.
Her research covers international legal, policy, and governance aspects in cybersecurity, including norms and international law governing state conduct in cyberspace, cybersecurity negotiations at the United Nations, and the international regulation of commercial spyware. Her work has appeared in the Oxford Handbook of Cyber Security, the Routledge Handbook of International Cybersecurity, the Georgetown Journal of International Affairs, the Bulletin of the Atomic Scientists, and RUSI Journal.
Previously, Elaine was a cybersecurity postdoctoral fellow at the Center for International Security and Cooperation (CISAC) and a national fellow at the Hoover Institution, both at Stanford University, before leading the Cyber Initiative at the Middlebury Institute of International Studies at Monterey (MIIS). She holds a PhD in War Studies and an MA in International Peace and Security from King’s College London, as well as an LL.M. in Public International Law from the London School of Economics and Political Science (LSE).
CISAC's Scott Sagan is the chair of a new project by the American Academy of Arts & Sciences, called the New Dilemmas in Ethics, Technology and War. The project convenes an interdisciplinary group of scholars and practitioners (political scientists, philosophers, ethicists, lawyers, physicians, historians, soldiers, and statesmen) in a series of small workshops to explore the intricate linkage between the advancement of military technology and the moral and ethical considerations of the deployment of such capabilities in war and in postwar settings.
The project will produce a multidisciplinary Dædalus issue that will inform the debate surrounding the acceptable use of modern instruments of war and will provide a useful teaching tool for both universities and military service academies.
Stanford University today launched the Stanford Cyber Initiative to apply broad campus expertise to the diverse challenges and opportunities that cybersecurity, cyberspace and networked information pose to humanity.
Information security has an expanding and deepening role in virtually every facet of our personal, social, governmental and economic lives. Yet the Internet is decentralized and vulnerable to malicious use. How does society protect its core values in the face of the promise and perils of digital information? And, how does society adapt to changing technologies?
These are the type of questions that Stanford researchers will study, thanks to the jumpstart given by a $15 million grant from the William and Flora Hewlett Foundation. Stanford's initiative will be highly interdisciplinary in building a new policy framework for cyber issues. It will draw on the campus' experience with multidisciplinary, university-wide initiatives to focus on the core themes of trustworthiness, governance and the emergence of unexpected impacts of technological change over time.
"Our increasing reliance on technology, combined with the unpredictable vulnerabilities of networked information, pose future challenges for all of society," said Stanford President John Hennessy. "We share the Hewlett Foundation’s goal to seek a robust understanding of how new technologies affect us all at the most fundamental human levels. Stanford has a long history of fostering interdisciplinary collaborations to find thoughtful and enlightened answers to these paramount questions."
Building on Stanford strengths
The Stanford Cyber Initiative will build upon the university's already extensive inquiry and research into Internet security. In doing so, Stanford has drawn on connections with industry and government by establishing, for example, a "cyber boot camp" for U.S. congressional staff (a Freeman Spogli Institute for International Studies/Hoover Institution collaboration,) a conference on the "ethics of data in civil society" and an ongoing "security conundrum" speaker series on cyber issues.
The initiative will work with Stanford’s existing research hubs addressing cyber issues, including those in the Computer Security Lab in the Department of Computer Science, the Freeman Spogli Institute's Center for International Security and Cooperation, the Hoover Institution and the Law School's Center for Internet and Society. FSI's Center on Democracy, Development, and the Rule of Law will also play a key role in the initiative.
The initiative will launch immediately and develop faculty seminars and conferences, organize working groups of faculty and students to tackle policy-relevant problems in information security, and provide support for internal research awards, teaching and curriculum development. Collaborations with industry and government are a vital part of the initiative.
The Stanford Cyber Initiative includes roles for faculty and students across a wide swath of research disciplines – computer science, law, the social sciences, engineering, political science and education, among others. And it will also enlist Stanford alumni who are leaders in the policy and technology fields.
For those seeking to participate, information is available on the Stanford Cyber Initiative website.
A central hub
"We are deeply grateful to the Hewlett Foundation for recognizing Stanford's ongoing work and future potential in this area. With the help of their generous grant, this initiative will grow into a central presence on campus that more broadly comprehends the possibilities and perils of networked information," said Stanford law Professor George Triantis, who will chair the steering committee for the initiative.
The committee currently includes professors Jeremy Bailenson (communications,) Stephen Barley (management science and engineering,) Ian Morris (classics and history,) John Mitchell (computer science and electrical engineering,) Dan Boneh (computer science and electrical engineering,) Amy Zegart (Hoover Institution and CISAC) and Barbara van Schewick (law).
Mariano-Florentino Cuéllar, the director of Stanford's Freeman Spogli Institute for International Studies and a Stanford law professor, is one of the founders of the initiative.
"The Stanford initiative will create vast opportunities to advance knowledge about the future of cyberspace and cybersecurity," Cuéllar said. "Faculty and students will expand existing research efforts and conversations with the goal of building a safer, better world that balances humanity's concerns with the promise of new technologies."
Cuéllar noted that crucial areas of examination include how to resolve trust and security problems endemic to networked information technologies, how to govern the Internet in a world where people often disagree about what they value, and how to anticipate unexpected developments in information technologies that could affect national security, intellectual property, civil liberties and society.
Ann Arvin, Stanford's vice provost and dean of research, said, "Our scholars and students will examine pressing questions about how can we ensure security and protect privacy while continuing to foster an open, innovative and entrepreneurial culture and society. We want to better understand the short- and long-term consequences and implications of the pervasiveness of digital technology in our lives."
In exploring this conundrum, the initiative will encourage collaborative focus across disciplines on the challenges of trustworthiness – for example, can individuals trust that information technologies will deliver on their promise and also avoid the hazards of deliberately hostile or antisocial actions?
A central goal is to create a policy framework that can generate lasting solutions not only to existing problems but also to problems that may emerge in the future.
'Profound implications'
The new program is supported through the Hewlett Foundation's Cyber Initiative, which has now committed $65 million over the next five years to the study of cybersecurity, the largest amount given to date by a private donor to this topic.
"Choices we are making today about Internet governance and security have profound implications for the future," said Hewlett Foundation President Larry Kramer, a former dean of the Stanford Law School. "To make those choices well, it is imperative that they be made with some sense of what lies ahead and, still more important, of where we want to go."
The other universities receiving Hewlett grants of $15 million each – the Massachusetts Institute of Technology and the University of California, Berkeley – will take a complementary approach in setting up the new centers based on their particular strengths and expertise.
The heated debate over the line between liberty and national security took center stage as Gen. Michael Hayden, former director of the National Security Agency and CIA, defended government surveillance programs at Stanford’s launch this week of “The Security Conundrum” speaker series.
If such surveillance methods were further restricted, “that smaller box, in my professional judgment, would make the job of the NSA harder and would probably make you less safe,” Hayden told a packed audience at the event co-sponsored in part by the university’s Freeman Spogli Institute for International Studies (FSI) and the Center for International Security and Cooperation (CISAC).
Hayden admitted to being “prickly” as he discussed privacy concerns over NSA’s collection and storage of phone and email metadata covering billions of calls and messages by American citizens. The surveillance programs, which were exposed last year by leaks from NSA contractor Edward Snowden, were only used after the Sept. 11 terrorist attacks, given “the totality of the circumstances,” Hayden explained.
Hayden was director of the NSA from 1999 to 2005. He then led the CIA from 2006 to 2009.
The metadata collection “is something we would have never done on Sept. 9 or Sept. 10. But it seemed reasonable after Sept. 11,” he said. “No one is doing this out of prurient interests. No, it was a logical response to the needs of the moment.”
Amy Zegart, CISAC’s co-director and a senior fellow at the Hoover Institution, led the conversation with the four-star general. She pointed out that a majority of Americans distrusts the NSA and believes the agency is lying.
Hayden stressed that the phone records were similar to billing statements – detailing who made the calls and when. “There is no content. It is not electronic surveillance. Not at all.”
CISAC Co-Director Amy Zegart leaders a talk with former NSA and CIA Director Michael Hayden at the inaugural "Security Conundrum" speakers series on Oct. 8, 2014.
Though he understands why the operation is “theoretically frightening,” in reality, it’s designed to aid in the capture of terrorists within the United States, Hayden said.
“To listen to the content of the calls would violate the laws of the United States. It would violate the laws of physics,” he said. He challenged if anyone could offer “concrete evidence” of harm stemming from the phone data collection.
In defining the right to privacy, Hayden cited his philosophy behind the balancing act between security and liberty.
“Privacy is the line we continually negotiate for ourselves as unique creatures of God and as social animals,” he said. “There are some things that the community has the right to know – and there are other things that they clearly do not have the right to know.”
The debate is over where that line is drawn, between “what is mine” and “what is owed the collective,” he said.
Hayden noted that the phone and email metadata collection programs are only a small part of the larger issues the nation faces as it deals with increasingly adept enemies and the surveillance abilities of other nations.
“I’m just simply saying – who knows more about you? One of the least of your worries is the government,” he said, half-jokingly. He noted that Google knows more about Americans than does the U.S. government, and the Silicon Valley company uses that data for commercial purposes.
Addressing how tech companies are becoming more reluctant to cooperate with government requests for email communication data, Hayden said he didn’t have an answer about how to address the relationship.
There is a call for transparency of what the government is doing, but Hayden said “translucency” might be the better option, so as to not reveal all that the U.S. does for foreign intelligence.
“This is an enterprise that’s based on absolute secrecy,” he said of the NSA.
Image
“We have to give American people enough information to be at least tolerant, if not supportive, of what the American government is doing.”
But to achieve that, “it’s not transparency,” he said. “We actually have to be translucent … where you have the glass … and you get the broad patterns of movemen
The danger of not being able to target emails, Hayden said, would be that emails become a safe haven for enemies. “If we don’t’ do it, if you’re not going to let us do this stuff … over the long term, it puts your liberty at risk because bad stuff will happen.”
“The Security Conundrum” speaker series looks behind and beyond the headlines, examining the history and implementation of the NSA operations, the legal questions generated by them, the media’s role in revealing them, and the responsibility of Congress to oversee them.
Each guest speaker, in conversation with Stanford scholars, will probe the problems from different vantage points to explain the political, legal and technological contours of the NSA actions, as well as outline ways to preserve the nation’s security without sacrificing our freedoms.
On Nov. 17, journalist Barton Gellman will be the featured speaker. He is known for his Pulitzer Prize-winning reports on the 9/11 attacks and has led the Washington Post's coverage of the NSA. On April 10, Reggie Walton, the former presiding judge of the Foreign Intelligence Surveillance Court, will take the stage as the speaker on April 10.
Along with FSI and CISAC, the series is also co-sponsored by the Hoover Institution, Stanford Continuing Studies, Stanford in Government, and the Stanford Law School.
Former Deputy Secretary of Defense Ash Carter will join Stanford this academic year as a lecturer at the Freeman Spogli Institute for International Studies (FSI) and a distinguished visiting fellow at the Hoover Institution.
Carter, who has a PhD in theoretical physics, served in the Clinton and Obama administrations and is well known in academic and technology circles.
"I am honored to join the remarkable team at Stanford, one of the country's top universities and a key center for technological and business innovation,” Carter said. “The regional context of Silicon Valley was also an important attraction for me: the creative – even unorthodox – approaches to solving challenges are a model for both the private and public sectors. All that combined with a motivated faculty and a dynamic student population made Stanford a great opportunity. And as a scientist, I was always encouraged as a student to use my knowledge for the public good, and I hope to inspire the same thinking in students here.”
At FSI, Carter will be the Payne Distinguished Visitor and will be responsible for delivering several lectures. He will also deliver the annual Drell Lecture, which is sponsored by FSI’s Center for International Security and Cooperation (CISAC).
"Ash will bring to Stanford incomparable experience handling some of the most complex security issues facing the United States and the world,” said FSI Director Mariano-Florentino Cuéllar. “We are fortunate to have him at FSI, and know that he will make great contributions to the Institute's research and teaching missions."
"It is a true honor to have Secretary Carter join the Hoover Institution as a distinguished visiting fellow,” said Hoover Director John Raisian. “An expert on a broad range of foreign policy and defense matters, Ash brings a unique and worldly perspective, one that is in keeping with our mission statement of promoting ideas that define a free society. My colleagues and I look forward to having him join the fellowship."
Carter stepped down from his post at the Pentagon late last year after serving two years as the Deputy Secretary of Defense. As the agency’s second-ranking civilian, he oversaw a $600 billion budget and 2.4 million uniformed and civilian personnel. From 2009 to 2011 Carter was the Undersecretary for Acquisition, Technology and Logistics.
“Ash Carter is an extraordinary scholar statesman who thinks deeply, probes broadly, and transforms the organizations he leads,” said Amy Zegart, CISAC’s co-director. “We are thrilled to have him join the CISAC community.”
Carter joined the Defense Department from Harvard's John F. Kennedy School of Government, where he was a professor and chair of the International Relations, Science, and Security faculty.
Carter’s connection with the technology business dates to his previous position as a senior partner at Global Technology Partners, where he advised major investment firms on technology and defense. He is currently working with several companies in Silicon Valley.
Carter earned his bachelor’s degrees in physics and in medieval history from Yale in 1976, summa cum laude, Phi Beta Kappa. He was a Rhodes Scholar and received his doctorate in theoretical physics from Oxford in 1979.
He was a physics instructor at Oxford, a postdoctoral fellow at Rockefeller University and M.I.T., and an experimental research associate at Brookhaven and Fermilab National Laboratories. From 1993 to 1996, Carter served as Assistant Secretary of Defense for International Security Policy, responsible for policy regarding the former Soviet states, strategic affairs, and nuclear weapons policy.
Carter recently joined the Markle Foundation to help lead the "Economic Future Initiative" to develop groundbreaking ideas for empowering Americans in today’s networked economic landscape.
The atomic bombs had been dropped on Hiroshima and Nagasaki just before 18-year-old William J. Perry landed in Japan during the War of Occupation as a mapping specialist. He saw the devastation left behind by American firebombers on Tokyo and Okinawa.
The young man quickly understood the staggering magnitude of difference in the destruction caused by traditional firepower and these new atomic bombs. He would go on to devote his life to understanding, procuring and then trying to dismantle those weapons.
But that was seven decades back. And many young Americans today believe the threat of nuclear weapons waned alongside the Cold War and Cuban Missile Crisis.
So as faculty at Stanford and the Center for International Security and Cooperation evolve with the digital age by taking their lessons online, one of the university’s oldest professors is also adapting to online teaching in an effort to reach the youngest audience, urging them to take on the no-nukes mantle that he’s held for many years.
“The issue is so important to me that I tried all sorts of approaches from books and courses and lectures and conferences to try to get my contemporaries and the generations behind me engaged – all with limited success,” says the 86-year-old Perry, a CISAC faculty member and the Michael and Barbara Berberian Professor (emeritus) at the center’s parent organization, the Freeman Spogli Institute for International Studies.
“First – which is a sine qua non – they must become seriously concerned that there is a nuclear danger, which most of these kids don’t understand at all,” said Perry. “Secondly, we want to convince them that there is something they can actually do about it.”
To reach those students, he believes he must go digital. So Perry – who co-teaches with CISAC’s Siegfried Hecker the popular Stanford course, “Technology and National Security” – began to map out a classroom course that would be videotaped and serve as a pilot for an online class that would be free and open to the public.
That course, “Living at the Nuclear Brink: Yesterday & Today” included lectures by some of the best people working in the field of nuclear nonproliferation today. Among those who will be highlighted in the online course are Perry and Hecker; Joe Martz of the Los Alamos National Laboratory; Stanford nuclear historian David Holloway; Stanford political scientist Scott Sagan; and Ploughshares Fund president, Joseph Cirincione.
The Perry Project will produce short-segment videos highlighting key information and stories from the course, packaging them in an online course available in multiple platforms and possibly offered by the university.
Perry used his personal journey as a young soldier during WWII, a mathematician and later a developer of weapons for the U.S. nuclear arsenal as undersecretary of defense for the Carter administration – and then trying to dismantle those weapons as secretary of defense for President Bill Clinton.
“I’m not doing this simply because I want to put a notch on my belt, to say that I’ve done a MOOC,” Perry said. “I’m doing it because I really want to get across to hundreds of thousands of young people.”
Last summer, he launched the Perry Project by inviting a dozen high school and college students to campus for a nuclear weapons boot camp so that they could take back to campus the message that nuclear annihilation is still a real, contemporary possibility.
He asked them: How do I get through to your generation?
“They said, `We don’t get our information by books or even by television, we get it through social media and YouTube, the various social media platforms. And you want to make the message relevant and relatively compact,’” he recalls.
Perry listened. “Living at the Nuclear Brink: Yesterday and Today” is in production now and a short-segment pilot video should be made available in the fall.
And lectures from CISAC's signature course, “International Security in a Changing World” (PS114S) will soon go up on YouTube as lecture modules entitled, “Security Matters.”
“Online learning offers a way to expand CISAC's reach to new audiences, geographies, and generations,” says CISAC Co-Director Amy Zegart, who has co-taught the popular course for the past few years with CISAC’s Martha Crenshaw.
“At the same time, the PS114 online modules will give us a living lecture library so that future Stanford students can compare faculty lectures on similar topics across time – learning, for example, how Martha Crenshaw assessed the terrorist threat in 2010 vs. 2015,” Zegart said.
Guest lecturers whose presentations will be included for the YouTube package include:
Jack Snyder of Columbia University: Democratization and Violence
Francis Fukuyama of Stanford: The Changing Nature of Power
Zegart: Understanding Policy Decisions: The Cuban Missile Crisis
Scott Sagan of CISAC: The Nuclear Revolution; and Why Do States Build/Forego Nuclear Weapons?
Abbas Milani, director of Iran Studies at Stanford: Historical Perspective on Iran
Former FBI Director Robert Mueller: the FBI’s Transformation Post 9/11
U.S. Army Lt. Gen. Karl Eikenberry (Ret.) and former U.S. ambassador to Afghanistan: The War in Afghanistan and the Future of Central Asia
Jane Holl Lute, former deputy secretary of Homeland Security: Emerging Threats in Cybersecurity
Perry: Security Issues in Russia, Yesterday and Today
Brad Roberts: former U.S. Deputy Assistant Secretary of Defense for Nuclear and Missile Defense Policy: Ensuring a (Nuclear) Deterrence Strategy that is Effective for 21st Century Challenges
CISAC Co-Director David Relman: Doomsday Viruses
And lectures at CISAC’s Cybersecurity Boot Camp for senior congressional aids will also be videotaped and packaged for YouTube and online consumption later this year.
“We are excited to enter into this phase of experimentation to see what works, what doesn't, and how we can further CISAC's teaching mission both here at Stanford and around the world,” Zegart said.
Jonathan Mayer's education path is unusual: He has earned a Stanford law degree while working on his Ph.D. in computer science. He did research with a fellow doctoral candidate to discredit NSA claims that sensitive information about American citizens cannot be gleaned in the "metadata" the spy agency gathers from millions of phone calls.
Law and computer science both have their codes, but they're disparate. Legal code is often fuzzy and qualitative. Computer code is precise and quantitative. Not surprisingly, law and computer science tend to attract different people. It's not that the twain shall never meet; it's just that they seldom do.
Mayer is the exception. He has received his law degree and is completing his PhD in computer science, both at Stanford. Along the way he has aimed his double-barreled expertise at the National Security Agency's practice of collecting various forms of electronic information, including telephone metadata of Americans: the phone number of every caller and recipient, the unique serial number of the phones involved, the time and duration of each phone call.
Working with fellow Stanford computer science doctoral candidate Patrick Mutchler, Mayer proved that the NSA was wrong when it claimed that its analysts could not tease detailed personal information from phone metadata searches.
"Phone numbers, as it turns out, aren't just phone numbers," said Mayer, who is also a cybersecurity fellow at the Center for International Security and Cooperation. "They're an avenue for finding out detailed information about individual citizens."
Aleecia McDonald, the director of privacy for the Center for Internet and Society at Stanford Law School, said Mayer's research irrefutably demonstrated that phone metadata is anything but trivial.
"The lovely thing about Jonathan's research is that it made the sensitivity of phone metadata concrete," McDonald said. "The country was told that phone metadata were not worth constitutional protection, and now Jonathan's research confirms otherwise."
McDonald said Mayer's research confirmed the sense of unease felt by many Americans, which could have ramifications beyond the current metadata debate.
"Mobile phones are basically tracking devices, but in addition to geographic data, Jonathan showed you can obtain rich information on daily lives and associations," she said. "This speaks directly to strongly protected privacy issues. No one is calling for stopping all surveillance, but these new dragnet programs essentially treat everyone as criminals and terrorists all the time. People are wondering if they can trust government on anything, and that's dangerous."
Mayer talks to CBS News about his metadata project
Mayer's ability to have significant public impact while still a young academic stems directly from his unusual combination of legal and computer acumen, according to John C. Mitchell, the Mary and Gordon Crary Family Professor in the School of Engineering and Stanford vice provost for online learning. Mitchell, who is Mayer's adviser, is a professor of computer science and, by courtesy, of electrical engineering.
"That ability to apply high technology to legal issues, to understand both fields so deeply – well, not many people have those skill sets," said Mitchell. "In fact, he seems one of a kind. We're lucky to have him working on these issues. I don't know anyone else who could do it."
Go 'geekward,' young man
Mayer traces his interest in computer science – his "geekward leanings," as he puts it – to his childhood in Chicago, where he logged a lot of time on his family's Apple IIGS computer. Once, when he received an elementary school writing assignment, he developed a web page instead. This was in the early stages of the World Wide Web, and his accomplishment engendered both respect and confusion.
As his facility with computers grew, he became increasingly interested in security issues. This was sometimes expressed in unorthodox – even mischievous – fashion. He couldn't help but hack.
One holiday, he recalled, he received a Radio Shack watch that had a TV remote control feature. After fiddling a bit, he discovered that by setting the frequency for a Sony TV, pointing his device at the infrared port on certain Apple computers and hitting channel change, he could force the computer to reboot.
"My school used those kinds of computers, so I spent quite a bit of time pushing channel change when kids were on the computers at school," Mayer said. "They were mystified. I have to admit it was fun, but it also got me thinking about computer vulnerabilities."
Computer science quickly became a focus for Mayer during his undergraduate studies at Princeton. But he also developed interests in public policy and politics – subjects that had previously struck him as dreary.
"They just seemed somewhat vapid and tedious," Mayer said. "But my roommates were intensely interested in policy and politics, and they gradually won me over. I saw that both are viable paths for implementing change, for getting real things done."
His faculty adviser, Princeton computer science and public affairs Professor Ed Felten, reinforced that. Mayer's senior thesis reflected the merging of his interests: It was about web privacy – balancing computer science research with law and policy issues.
Taking dual paths
After graduating from Princeton in 2009 with a degree in public policy, Mayer came directly to Stanford with the intention of becoming, as he tells it, the first student to simultaneously pursue a JD in law and a PhD in computer science (CS).
"I wasn't going to do law and policy lite or CS-lite," Mayer told the Stanford Daily in February. "I was going full in on both."
Among his successes on the legal front: He was recently asked to teach a class at Stanford Law. The seminar explores the legal ramifications of security and privacy in the technology sector, emphasizing "areas of law that are frequently invoked, hotly contested or ripe for reform," according to the course overview.
He finds his new instructor role rewarding: "I get a kick out of the fact that I'm an engineer teaching law at Stanford."
His legal accomplishments notwithstanding, Mayer's computer science efforts – particularly his metadata research – have made more of a public splash. And as so often happens at Stanford, it all started with a conversation among peers.
"Patrick [Mutchler] and I were talking with our adviser [Mitchell] shortly after the Edward Snowden revelations," Mayer recalled. "We were really intrigued by the NSA's programs, especially all the claims and counterclaims about phone metadata. There was a lot of conjecture at that point but very little scientific clarity. So we thought we'd try to bring some focus to bear."
But Mayer and Mutchler found it difficult to acquire the metadata. While the NSA could harvest it directly from telecommunications companies, the Stanford doctoral students had to solicit phone records from the public.
"We realized we might be able to get metadata voluntarily through crowdsourcing," Mayer said. "So we posted an explanation on a Stanford website and provided an Android app that allowed people to send us their data. Crowdsourcing is a pretty risky basis for research, of course, because you never know what you're going to get. We would've been very happy with 100 responses – instead, we got about 500, and we were off to the races."
Metadata was revealing
Again, this innovative tactic took root in the confluence of legal and computing expertise.
"Building and distributing the app was within the capabilities of many computer experts, but its application was very clever," Mitchell said. "The rationale was: 'We would like to see what the NSA sees, but we don't want to behave like the NSA. So how do we do that?' Seeking volunteers willing to provide their phone data and devising and distributing the app was an extremely creative, sophisticated – and effective—approach."
In the course of their analysis, Mayer and Mutchler derived many revealing inferences from the metadata that show who called whom, when, from where to where and how often. For example, they could determine where the subjects lived and worked, and could see some intimation of relationships between the volunteers.
In some cases, the researchers were able to identify who was dating whom. One volunteer contacted a pharmaceutical hotline for multiple sclerosis patients, a management service for rare medical conditions, a specialty pharmacy and several neurology medical groups. Another called several locksmiths, a hydroponics dealer, a head shop and a home improvement store.
Those findings, Mayer drily observed, debunked the NSA's original assertions that phone metadata were impenetrable.
"It gave us pause," he said. "It was pretty clear that we could tease out more sensitive information with some elbow grease."
The findings have caused headaches for the NSA, and Mayer sees waning support for the agency's aggressive pursuit of private information. A number of high-profile cases on metadata are either pending or wending their way through the courts, and the entire program is up for renewal, or cancellation, in 2015. In May, the U.S. House of Representatives passed legislation to halt the National Security Agency's wholesale collection of domestic phone records. Sen. Dianne Feinstein, the chairwoman of the U.S. Senate's intelligence committee, signaled she is amenable to supporting a companion bill.
What's Next?
Mayer, who has received his JD and recently passed the California Bar Exam, expects to complete his computer science PhD in 2015. And after that?
"I would like to go to Washington, to try to bring technical rigor to federal policy," Mayer said, "though I'm aware there's always the danger of sinking into the political morass in that town. I'm working on a start-up NGO that I hope can bridge D.C. and Silicon Valley. In the interim, I just enjoy teaching at the law school."
Glen Martin is a former San Francisco Chronicle reporter based in Santa Rosa, Calif.
CISAC Co-Director Amy Zegart leaders a talk with former NSA and CIA Director Michael Hayden at the inaugural "Security Conundrum" speakers series on Oct. 8, 2014.
Cybersecurity fellow Jonathan Mayer to teach online class on surveillance.