7 ms·

Indiscriminate surveillance at MIT – Logging of card access data at CSAIL

46 points by Tsiolkovsky 12y ago

noobface 12y ago
Richard Stallman is the man.
- angersock 12y ago
  He's a hardliner on the fringe and a lunatic in many ways, but he serves as an excellent reference point when evaluating policy decisions. He's pedantic and often unlikable, but we're very lucky to have him.
seanieb 12y ago
I didn't read the by line and assumed it was written by an optimistic undergrad. Then at the end I saw "By Richard Stallman". I must say I'm in awe of Mr Stallmans optimism and never give up attitude.
oldbuzzard 12y ago
Sounds like an opportunity for some students to do some cool RFID hacking and pool their IDs to obfuscate the logs... What a great EE/CS project ;)
- cschmidt 12y ago
  Richard Stallman himself did that: http://www.bostonmagazine.com/2008/04/the-shaggy-god/ http://www.bostonmagazine.com/2008/04/the-shaggy-god/ (the story about the access cards is right at the top)
  - davexunit 12y ago
    That article is really cool, but... >The most momentous product of Stallman’s genius, Linux, was the first operating system to feature software that was entirely free Ugh!
  - arjie 12y ago
    Is this a joke article? I mean, I kind of get saying that RMS had a role to play in GNU/Linux, but calling it Linux and then repeating again and again that he wrote it just sounds comical. Still, it does establish the fact that he uses some alternative means of getting in. Good for him.
- ynniv 12y ago
  Stallman already does this in a way: http://www.bostonmagazine.com/2008/04/the-shaggy-god/ http://www.bostonmagazine.com/2008/04/the-shaggy-god/
joezydeco 12y ago
"When the Computer Science and Artificial Intelligence Lab (CSAIL) moved into Stata in 2004, the MIT administration decided, without consulting the personnel of CSAIL, to make the system log which cards are used to open which doors and when." Who owns the building? MIT or the personnel of CSAIL? If the building's owner wants a log of who came in and out of the building is that really something Mr Stallman has the power to object to?
- _delirium 12y ago
  In universities power is typically a bit distributed. Ultimately a nonprofit corporation owns everything, overseen by a board of trustees. But the board doesn't do that much day-to-day management. Instead there is an administrative and departmental structure. Unlike in a company, it's usually slightly less clearly hierarchical: there is usually a President or Provost, but they usually have less power than a CEO (for example, their ability to hire & fire academic staff is significantly constrained). And there are other structures like departments, faculty senates, etc. which have independent power (varying by university). My guess is that, in this case, nobody at a high level made a decision in the first place, but rather a mid-level organization like MIT security or facilities management instituted the policy. Since they probably are delegated responsibility over building-access systems, they can do that. But the building inhabitants can also try to complain about the way their departments' buildings are being managed. If you were to ask more specifically, "does facilities management or CSAIL own the building?", the answer is sort-of neither, and sort-of both: it's owned by the corporate parent of both of them.
- NotAtWork 12y ago
  Let's take an extreme: What if MIT were logging who went to the bathroom? There's clearly no fundamental difference in securing a different part of the building. Does Mr Stallman (or perhaps an employee of the building if he's just a third party) not have a basis to criticize MITs tracking of bathroom habits because he (or they) don't own the building? In what way is door access different?
  - joezydeco 12y ago
    I don't think we're talking about bathroom hygenic habits here, so let's skip that derail. Stallman's thesis is "logs have no use". I'm sure the building's owners disagree. Let's think of a possible use-case: "Someone stole a laptop from Room 214 over the weekend" So are the logs useful now?
superuser2 12y ago
It is absolutely the right of a private property owner to control and monitor access to its property. Further, this data is actually useful: if something happens, you know who the last people to open the door were. Further, as a grantee of privileged access, you know that. You know you can't just say it must have been one of the 200 others with the common key. So it's more invisible prevention than measurable solving. This lets administrators be more permissive about delegating access while simultaneously increasing security. For example, I work in a couple of the concert halls on campus. Students have always held keys to interior doors, but University policy was that students could not have unsupervised access to exterior doors, probably for insurance reasons. This meant that if the boss wanted to leave the hall operational while not present, student staff would have to prop doors open. If the hall was locked, he'd have to drive all the way out to campus even if he didn't need to be there for the event. Now that we have an audit-trail-producing card reader system, administration is fine with granting students card access to exterior doors. We are both more efficient (because we don't waste supervisor time) and more secure (because students can lock doors and reopen them when necessary.) In the past, when students have gone missing, their last contact was not with humans but with the access control system. It provided better "last known location" data that improved investigations. It can validate alibis (demonstrating that you were at a building across campus) and provide evidence in discipline proceedings (the alleged rapist says he wasn't there that night, but his ID swiped into the dorm a few seconds behind the alleged victim, etc.) Access control logs introduce truth into otherwise ambiguous situations. It matters less what you think, who you like more, or what you want to be true because there is a record you can check. Whether it's "should we keep the library open later?" or "when exactly did this kid go missing?" You also almost never have to interact with the access control system unless you hold privileged access as part of a job, research assignment, etc. Students who live off campus and don't study at the libraries can go months without pulling out their IDs. It's not like you need to swipe your card to walk down a public street. But when you are accessing university services, it seems only reasonable that the university gets to know that you're doing so.
- agwa 12y ago
  Those are a lot of hypotheticals. As RMS said in his article: > Such claims must be put to the test. The NSA claimed that surveilling everyone in the US was vital for preventing terrorism. When it had to give details, it became clear that the supposed benefit did not exist. And indeed, when RMS pressed the MIT police chief for actual evidence of the claimed benefits, he dodged the question.
Buge 12y ago
The card logs at the University of Michigan helped catch a thief stealing from a snack kiosk I work at. http://www.annarbor.com/news/u-m-graduate-student-whose-plan-helped-catch-a-thief-to-be-honored-for-his-effort/ http://www.annarbor.com/news/u-m-graduate-student-whose-plan... It's kind of a weird story. A chemistry PhD student repeatedly climbing over walls to steal candy bars...

46 points by Tsiolkovsky 12y ago

noobface 12y ago

Richard Stallman is the man.

angersock 12y ago
He's a hardliner on the fringe and a lunatic in many ways, but he serves as an excellent reference point when evaluating policy decisions. He's pedantic and often unlikable, but we're very lucky to have him.

seanieb 12y ago

I didn't read the by line and assumed it was written by an optimistic undergrad. Then at the end I saw "By Richard Stallman". I must say I'm in awe of Mr Stallmans optimism and never give up attitude.

oldbuzzard 12y ago

Sounds like an opportunity for some students to do some cool RFID hacking and pool their IDs to obfuscate the logs... What a great EE/CS project ;)

cschmidt 12y ago
Richard Stallman himself did that: http://www.bostonmagazine.com/2008/04/the-shaggy-god/ http://www.bostonmagazine.com/2008/04/the-shaggy-god/ (the story about the access cards is right at the top)
- davexunit 12y ago
  That article is really cool, but... >The most momentous product of Stallman’s genius, Linux, was the first operating system to feature software that was entirely free Ugh!
- arjie 12y ago
  Is this a joke article? I mean, I kind of get saying that RMS had a role to play in GNU/Linux, but calling it Linux and then repeating again and again that he wrote it just sounds comical. Still, it does establish the fact that he uses some alternative means of getting in. Good for him.
ynniv 12y ago
Stallman already does this in a way: http://www.bostonmagazine.com/2008/04/the-shaggy-god/ http://www.bostonmagazine.com/2008/04/the-shaggy-god/

joezydeco 12y ago

"When the Computer Science and Artificial Intelligence Lab (CSAIL) moved into Stata in 2004, the MIT administration decided, without consulting the personnel of CSAIL, to make the system log which cards are used to open which doors and when." Who owns the building? MIT or the personnel of CSAIL? If the building's owner wants a log of who came in and out of the building is that really something Mr Stallman has the power to object to?

_delirium 12y ago
In universities power is typically a bit distributed. Ultimately a nonprofit corporation owns everything, overseen by a board of trustees. But the board doesn't do that much day-to-day management. Instead there is an administrative and departmental structure. Unlike in a company, it's usually slightly less clearly hierarchical: there is usually a President or Provost, but they usually have less power than a CEO (for example, their ability to hire & fire academic staff is significantly constrained). And there are other structures like departments, faculty senates, etc. which have independent power (varying by university). My guess is that, in this case, nobody at a high level made a decision in the first place, but rather a mid-level organization like MIT security or facilities management instituted the policy. Since they probably are delegated responsibility over building-access systems, they can do that. But the building inhabitants can also try to complain about the way their departments' buildings are being managed. If you were to ask more specifically, "does facilities management or CSAIL own the building?", the answer is sort-of neither, and sort-of both: it's owned by the corporate parent of both of them.
NotAtWork 12y ago
Let's take an extreme: What if MIT were logging who went to the bathroom? There's clearly no fundamental difference in securing a different part of the building. Does Mr Stallman (or perhaps an employee of the building if he's just a third party) not have a basis to criticize MITs tracking of bathroom habits because he (or they) don't own the building? In what way is door access different?
- joezydeco 12y ago
  I don't think we're talking about bathroom hygenic habits here, so let's skip that derail. Stallman's thesis is "logs have no use". I'm sure the building's owners disagree. Let's think of a possible use-case: "Someone stole a laptop from Room 214 over the weekend" So are the logs useful now?

superuser2 12y ago

It is absolutely the right of a private property owner to control and monitor access to its property. Further, this data is actually useful: if something happens, you know who the last people to open the door were. Further, as a grantee of privileged access, you know that. You know you can't just say it must have been one of the 200 others with the common key. So it's more invisible prevention than measurable solving. This lets administrators be more permissive about delegating access while simultaneously increasing security. For example, I work in a couple of the concert halls on campus. Students have always held keys to interior doors, but University policy was that students could not have unsupervised access to exterior doors, probably for insurance reasons. This meant that if the boss wanted to leave the hall operational while not present, student staff would have to prop doors open. If the hall was locked, he'd have to drive all the way out to campus even if he didn't need to be there for the event. Now that we have an audit-trail-producing card reader system, administration is fine with granting students card access to exterior doors. We are both more efficient (because we don't waste supervisor time) and more secure (because students can lock doors and reopen them when necessary.) In the past, when students have gone missing, their last contact was not with humans but with the access control system. It provided better "last known location" data that improved investigations. It can validate alibis (demonstrating that you were at a building across campus) and provide evidence in discipline proceedings (the alleged rapist says he wasn't there that night, but his ID swiped into the dorm a few seconds behind the alleged victim, etc.) Access control logs introduce truth into otherwise ambiguous situations. It matters less what you think, who you like more, or what you want to be true because there is a record you can check. Whether it's "should we keep the library open later?" or "when exactly did this kid go missing?" You also almost never have to interact with the access control system unless you hold privileged access as part of a job, research assignment, etc. Students who live off campus and don't study at the libraries can go months without pulling out their IDs. It's not like you need to swipe your card to walk down a public street. But when you are accessing university services, it seems only reasonable that the university gets to know that you're doing so.

agwa 12y ago
Those are a lot of hypotheticals. As RMS said in his article: > Such claims must be put to the test. The NSA claimed that surveilling everyone in the US was vital for preventing terrorism. When it had to give details, it became clear that the supposed benefit did not exist. And indeed, when RMS pressed the MIT police chief for actual evidence of the claimed benefits, he dodged the question.

Buge 12y ago

The card logs at the University of Michigan helped catch a thief stealing from a snack kiosk I work at. http://www.annarbor.com/news/u-m-graduate-student-whose-plan-helped-catch-a-thief-to-be-honored-for-his-effort/ http://www.annarbor.com/news/u-m-graduate-student-whose-plan... It's kind of a weird story. A chemistry PhD student repeatedly climbing over walls to steal candy bars...