Bitwacker Associates

Large generative AI models (LGAIMs), such as ChatGPT, GPT-4 or Stable Diffusion, are rapidly transforming the way we communicate, illustrate, and create. With this (currently…) informal project at Rensselaer we consider these new generative models in the context of AI regulation and ponder not only how laws might be tailored to their capabilities, but also to what extent those capabilities can be constrained to comply with laws.       

Our group is actively curating a reading list on some of the practical aspects of implementing regulations on large language models. The papers, presentations and posts we’re finding have been prepared by some of the leading thinkers in AI, law and government, several of whom Tetherless World researchers know and have collaborated with in the past. 

Some of the topics under consideration: 

• The Big Picture on Regulating LLMs
• Identifying and Tracking LLM output
• Identifying and Tracking Diffusion Output
• Generative AI and Virtual Child Pornography
• Evaluating Safety, Trustworthiness and Fairness in Generative AI
• Detecting Hate Speech
• Detecting & Mitigating Bias
• Building Biases into AI
• LLM-assisted Copyright Infringement Detection
• Generative AI and Copyright Law
• Generative AI and Creative Commons Licensing
• LLMs and Scientific Communication
• LLMs and Education
• LLMs and Legal Practice
• Jailbreaking Generative AI-based Systems

Please contact me if you have suggestions for this list!

The following is an invited tribute to Dr. Norman Paskin that will appear in an upcoming Data Science Journal special issue on persistent identifiers (PIDs)…

We were shocked and saddened to learn of the death of our longtime friend and colleague Dr. Norman Paskin in March 2016.

Norman Paskin

Norman will be remembered as the thoughtful and tireless founding director of the International DOI Foundation (IDF). Some of us were fortunate to have known him in the earliest days, during those formative pre-DOI Foundation meetings when technical and political views came together to form the foundation of what the DOI is today. The early days of DOI involved many lengthy, sometimes heated, email and face-to-face discussions, and we fondly remember Norman as a sensible voice calling out in the wilderness.

Establishing sound technical foundations for the DOI was surely only a first step; the DOI’s long-term success and sustainability would depend on its widespread adoption, which in turn would require a clear message, sensible policies that would benefit a wide range of stakeholders, and constant evangelism. To the surprise of no one — except, perhaps, the man himself! — Norman Paskin was chosen in 1998 as the founding director of the IDF, and set out to spread the gospel of persistent identifiers while defining the mission of the IDF. Norman conveyed the message so well that twenty years later it is hard to imagine arguments against the DOI; indeed, its example is so compelling that in domains that can’t directly adopt the DOI, we see parallel object identifier systems emerging, modeled directly after the DOI.

A critical component of the DOI’s success is the robustness of its underlying infrastructure, the Handle System(tm), created and administered by Bob Kahn’s team at Corporation for National Research Initiatives (CNRI). Not long into the life of the DOI and IDF, it became clear that the long-term success of the DOI and other emerging object naming systems based on the Handle System would in turn depend on a well-considered set of Handle System governance policies. In order to consider the needs of a range of current and future stakeholders, a Handle System Advisory Committee (HSAC) was formed in early 2001; on the HSAC Norman naturally represented the interests of the IDF and its members, but also understood the perspectives of CNRI, then the operator of the Handle System, as well as other Handle System adopters.

It was our pleasure to work directly with Norman on DOI matters, including early technology demonstrators that we demoed at the Frankfurt Book Fair and other conferences in the late 1990s, and later mutually participating in HSAC meetings and various DOI strategy sessions. Whenever we saw each other, in New York, Oxford, Washington, London or Frankfurt, we would resume conversations, from yesterday to last year, via email or in person. To all who knew him, Norman Paskin set the standard both literally and figuratively; his friends and colleagues miss him tremendously, but he will persist in our professional memories and in our hearts.

John S. Erickson, PhD
Director of Research Operations
The Rensselaer Institute for Data Exploration and Applications
Rensselaer Polytechnic Institute, Troy, NY  (USA)

Laurence W. Lannom
Vice President Director of Information Services
The Corporation for National Research Initiatives (CNRI), Reston, VA (USA)

Other tributes to Norman Paskin:

1. Mark Seeley and Chris Shillum, Remembering Norman Paskin, a pioneer of the DOI system for scholarly publishing
2. Ed Pentz, Dr Norman Paskin
3. The Jensen Owners Club, Norman Paskin

Over the past few days there has been renewed discussion of the controversial W3C Encrypted Media Extension proposal with the publication of a revised draft. (07 Jan 2014). Today I’d like to provide a bit of background, based on my long experience in the digital rights management “game” and my familiarity with the W3C process.

Who are the players? The primary editors of the W3C EME draft are employed by Google, Microsoft and Netflix, but corporate affiliation really only speaks to one’s initial interest; W3C working groups try to work toward concensus, so we need to go deeper and see who is actually active in the formulation of the draft. Since W3C EME is a work product of the HTML Working Group, one of the W3C’s largest, the stakeholders for EME are somewhat hidden; one needs to trace the actual W3C “community” involved in the discussion. One forum appears to be the W3C Restricted Media Community Group; see also the W3C restricted media wiki and mailing list. A review of email logs and task force minutes indicates regular contributions from representatives of Google, Microsoft, Netflix, Apple, Adobe, Yandex, a few independent DRM vendors such as Verimatrix, and of course W3C. Typically these contributions are highly technical.

A bit of history: The “world” first began actively debating the W3C’s interest in DRM as embodied by the Encrypted Media Extension in Octover 2013 when online tech news outlets like Infoworld ran stories about W3C director Tim Berners-Lee’s decision move forward and the controversy around that choice. In his usual role as anti-DRM advocate, Cory Doctorow first erupted that Ocober, but the world seems to be reacting with renewed vigor now. EFF has also been quite vocal in their opposition to W3C entering into this arena. Stakeholders blogged that EME was a way to “keep the Web relevant and useful.”

The W3C first considered action in the digital rights management arena in 2001, hosting the Workshop on Digital Rights Management (22-23 January 2001, INRIA, Sophia Antipolis, France), which was very well attended by academics and industrial types including the likes of HP Labs (incl. me), Microsoft, Intel, Adobe, RealNetworks, several leading publishers, etc.; see the agenda. The decision at that time was Do Not Go There, largely because it was impossible to get the stakeholders at that time to agree on anything “open,” but also because in-browser capability was limited. Since that time there has been a considerable advancements in support for user-side rendering technologies, not to mention the evolution of Javascript and the creation of HTML5; it is clear that W3C EME is a logical, if controversial, continuation in that direction.

What is this Encrypted Media Extension? The most concise way to explain EME is, that it is an extension to HTML5’s HTMLMediaElement that enables proprietary controlled content handling schemes, including encrypted content. EME does not specify a specific content protection scheme, but instead allows for vendor-specific schemes to be “hooked” via API extensions. Or, as the editors describe it,

“This proposal allows JavaScript to select content protection mechanisms, control license/key exchange, and implement custom license management algorithms. It supports a wide range of use cases without requiring client-side modifications in each user agent for each use case. This also enables content providers to develop a single application solution for all devices. A generic stack implemented using the proposed APIs is shown below. This diagram shows an example flow: other combinations of API calls and events are possible.”

A generic stack implemented using
the proposed W3C Encrypted Media Extension APIs

Why is EME needed? One argument is that EME allows content providers to adopt content protection schemes in ways that are more browser- and platform-independent than before. DRM has a long history of user-unfriendliness, brittle platform dependence and platform lock-in; widespread implementation could improve user experiences while given content providers and creators more choices. The dark side of course is that EME could make content protection an easier choice for providers, thereby locking down more content.

The large technology stakeholders (Google, Microsoft, Netflix and others) will likely reach a concensus that accomodates their interests, and those of stakeholders such as the content industries. It remains unclear how the interests of the greater Internet are being represented. As an early participant in the OASIS XML Rights Language Technical Committee (ca 2002) I can say these discussions are very “engineer-driven” and tend to be weighted to the task at hand — creating a technical standard — and rarely are influenced by those seeking to balance technology and public policy. With the recent addition of the MPAA to the W3C, one worries even more about how the voice individual user will be heard.

For further reading:

• UPDATE: W3C HTML Working Group, Encrypted Media Extensions. W3C Recommendation (18 Sep 2017)
• Tim Berners-Lee, On Encrypted Video and the Open Web. W3C Blog (09 Oct 2013)
• James Delahunty, MPAA joins W3C, giving it a voice on the future of the web.(08 Jan 2014)
• Cory Doctorow, What I wish Tim Berners-Lee understood about DRM. The Guardian Technology Blog (12 Mar 2013)
• Manu Sporny, DRM in HTML5. (26 Jan 2013)
• Danny O’Brien (EFF), Lowering Your Standards: DRM and the Future of the W3C. (02 Oct 2013)
• Simon St. Laurant, What Do We Get for That DRM? The W3C sells out users without seeming to get anything in return. (10 Oct 2013)
• Peter Bright (Microsoft), DRM in HTML5 is a victory for the open Web, not a defeat. (10 May 2013)
• John S. Erickson, et.al., Principles for Standardization and Interoperability in Web-based Digital Rights Management. A Position Paper for the W3C Workshop on Digital Rights Management (22-23 January 2001, INRIA, Sophia Antipolis, France)

John Erickson is the Director of Research Operations of The Rensselaer IDEA and the Director of Web Science Operations with the Tetherless World Constellation at Rensselaer Polytechnic Institute, managing the delivery of large scale open government data projects that advance Semantic Web best practices. Previously, as a principal scientist at HP Labs John focused on the creation of novel information security, identification, management and collaboration technologies. As a co-founder of NetRights, LLC John was the architect of LicensIt(tm) and @ttribute(tm), the first digital rights management (DRM) technologies to facilitate dialog between content creators and users through the dynamic exchange of metadata. As a co-founder of Yankee Rights Management (YRM), John was the architect of Copyright Direct(tm), the first real-time, Internet-based service to fully automate the complex copyright permissions process for a variety of media types.

On 26 July the The Pew Research Center for the People & the Press released Few See Adequate Limits on NSA Surveillance Program…But More Approve than Disapprove which they’ve summarized in this post. Here’s a snippet…

…(D)espite the insistence by the president and other senior officials that only “metadata,” such as phone numbers and email addresses, is being collected, 63% think the government is also gathering information about the content of communications – with 27% believing the government has listened to or read their phone calls and emails…Nonetheless, the public’s bottom line on government anti-terrorism surveillance is narrowly positive. The national survey by the Pew Research Center, conducted July 17-21 among 1,480 adults, finds that 50% approve of the government’s collection of telephone and internet data as part of anti-terrorism efforts, while 44% disapprove. These views are little changed from a month ago, when 48% approved and 47% disapproved.

A famous conclusion of the 9/11 Commission was that a chronic and widespread “failure of imagination” led to the United States leaving its defenses down and enabling Bin Laden’s plot to succeed. This is a bit of an easy defense, and history has shown it to not be completely true, but I think in general we do apply a kind of double-think when contemplating extreme scenarios. I think we inherently moderate our assumptions about how far our opponents might go to win and the range of methods they will consider. How we limit our creativity is complex, but it is in part fueled by how well informed we are.

The Pew results would be more interesting if the same questions had been asked before the Edward Snowden thing, because it would have created a “baseline” of sorts for how expansive our thinking was and is. What the NSA eruption has shown us is that our government is willing to collect data at a much greater scale than most people imagined. The problem lies with that word, imagined. What if we asked instead, “What is POSSIBLE?” Not “what is possible within accepted legal boundaries,” but rather “what is possible, period, given today’s technology?” For example, what if the NSA were to enlist Google’s data center architects to help them design a state-of-the-art platform?

Key lawmakers no doubt were briefed on the scale of the NSA’s programs years ago, but it is unlikely most of the legislators or their staffers were or are capable of fully appreciating what is possible with the data collected, esp. at scale. One wonders who is asking serious, informed questions about what is possible with the kind and scale of data collected? Who is evaluating the models, etc? Who is on the outside, using science to make educated guesses about what’s “inside?”

Many versions of the web science definition declare our motivation ultimately to be “…to protect the Web.” We see the urgency and the wisdom in this call as we watch corporations and governments construct massive platforms that enable them to monitor, analyze and control large swaths and facets of The Global Graph. It is incumbent upon web scientists to not simply study the Web, but to use the knowledge we gain to ensure that society understands what influences the evolution of that Web. This includes the daunting task of educating lawmakers.

Why study web science? Frankly, because most people don’t know what they’re talking about. On the issues of privacy, tracking and security, most people have no idea what is possible in terms of large-scale data collection, what can be learned by applying modern analytics to collected network traffic, and what the interplay is between technological capabilities and laws. Fewer still have a clue how to shape the policy debate based on real science, especially a science rooted in the study of the Web.

Web science as a discipline gives us hope that there will be a supply of knowledgeable — indeed, imaginative — workers able to contribute to that discussion.

Recently I wrote each member of Vermont’s congressional delegation, Senators Patrick Leahy and Bernie Sanders and Congressman Peter Welch, regarding Aaron’s Law, a proposed bill named in memory of the late Aaron Swartz that would implement critical changes to the notorious Computer Fraud and Abuse Act (CFAA) (18 U.S.C. 1030). As usual, Senator Leahy responded quickly and with meat:

Dear Dr. Erickson:

Thank you for contacting me about the need to reform the Computer Fraud and Abuse Act (CFAA). I appreciate your writing to me about this pressing issue.

In my position as Chairman of the Senate Judiciary Committee, I have worked hard to update the Computer Fraud and Abuse Act in a manner that protects our personal privacy and our notions of fairness. In 2011, I included updates to this law in my Personal Data Privacy and Security Act that would make certain that purely innocuous conduct, such as violating a terms of use agreement, would not be prosecuted under the CFAA. This bill passed the Judiciary Committee on November 22, 2011, but no further action was taken in the 112th Congress. I am pleased that others in Congress have joined the effort to clarify the scope of the CFAA through proposals such as Aaron’s law. Given the many threats that Americans face in cyberspace today, I believe that updates to this law are important. I am committed to working to update this law in a way that does not criminalize innocuous computer activity.

As technologies evolve, we in Congress must keep working to ensure that laws keep pace with the technologies of today. I have made this issue a priority in the past, and will continue to push for such balanced reforms as we begin our work in the 113th Congress.

Again, thank for you contacting me, and please keep in touch.

Sincerely,

PATRICK LEAHY
United States Senator

Thanks again for your great service to Vermont and the United States, Sen. Leahy!

References

• Stephanie Francis Ward, Hacker’s Hell: Many want to narrow the Computer Fraud and Abuse Act. abajournal.com (01 May 2013)
• Zoe Lofgren and Ron Wyden, Introducing Aaron’s Law, a Desperately Needed Reform of the Computer Fraud and Abuse Act. Wired.com (20 June 2013).
• Text of Aaron’s Law Act of 2013. (20 June 2013)
• Detailed summary of Aaron’s Law. (20 June 2013)