DAVID MALAN: All right, welcome back. This is CS50, and this is the start of week 10. So, for the past several weeks, we've been looking at a fairly low level how the internet works. TCP/IP, HTTP, the language [? top ?] which we've begun to build interesting things in languages like HTML, CSS, PHP, and most recently JavaScript. 

Today, though, we're joined by Jonathan Zittrain, a professor at Harvard Law School, at Harvard Kennedy School, and the Harvard School of Engineering and Applied Sciences, who most recently taught a course called Computer Science 42, Controlling Cyberspace. Today, we are poised to now look at a much bigger picture, and undoubtedly a bit at how life, the universe, and everything works, with our friend, professor Jonathan Zittrain. 

JONATHAN ZITTRAIN: Thank you, David, and good afternoon. You are in an incredible course, as you know. You are apprenticing to a set of technologies that are really unusual, and I want to talk today about what makes them so unusual, why we should care about it, and why they might be evolving in the future in directions that we don't like. And possibly even what to do about it, although I realize we have about 49 minutes and 30 seconds yet, so some corners may be cut. 

Maybe a framework to think about this stuff is technologies as owned and unowned. And I want to explain what I mean by owned and unowned. Most technology in the world is owned, and I'll give a few examples of that. But the internet turns out to be an unowned technology, and that can make all the difference. 

So here are some owned technologies. This is the IBM System/360. This was a serious computer back in its day, and as you can see, everything about it radiates that you had better not go anywhere near it. This is the kind of computer that sat in the basement of a big company-- an actuary, an insurance company, a bank, or maybe a government tallying the census. And it was programmed, usually, by the vendor who operated the machine, in this case IBM. And that's because, while it was a general purpose computer, it could be programmed or reprogrammed, it was so precious and delicate, and part of the business model of IBM was to keep it apart from its consumer. 

You would instead tell IBM what you wanted, and then they would go ahead and program it for you. Not a bad deal, but a very owned technology in the sense that we know who is responsible for it, and whom to blame if something goes wrong with it, and it means that we're not going to get that surprised by it, because everybody is so careful about what they use the computer for. Now, these are the sorts of things that went into it. Those are, of course, old-fashioned punch cards, and those represented, again, that you could program the machine in any way that you wanted, so long as you could get near it, which again, generally, you could not. 

This is another kind of technology that is also owned. This is the Friden Flexowriter. And the Friden Flexowriter was like a standard typewriter, and as you typed, the letters would appear on the paper, but it would also make for little indentations in this tape that ran through it. And the tape, if put back through the typewriter like a player piano, would type out whatever had previously been done. Which meant that with enough scissors and glue, you could actually cut and paste your way to a mail merge more easily than you can with Microsoft Word. 

So, the Flexowriter was very cool. It was very accessible. It doesn't threaten to electrocute you if you go near it. But there's no place to put a punch card to tell it what to do. The only punch technology is data. Type what you see, or it generates that strip as you type. There's no code. There's only content with the Flexowriter, and its successors are what the world of the 1980s and 1990s was shaping up to be for information technology. 

This is the Brother Smart Word Processor. You turn this thing on, this is its home screen. Where would you like to go today? Word processing, spreadsheet, et cetera, et cetera. And the way this thing worked on Wednesday it was exactly the way it worked on Tuesday, and was the way it was going to work until you got rid of it. It was not programmable. 

Again, it only dealt with data, and it's an owned technology, because how it would act was very much an artifact of what the Brother people put into it. Ditto, one might hope, for a CAT scan machine. You want it to operate exactly as it was designed, although they are slightly reprogrammable in the IBM System/360 way. Again, we see some risks, some unpleasant surprises that could come if you have the wrong people programming your CAT scanner, as actually has happened in the past few years. But now, part of this CAT scanner is a little piece of what I would describe as an unowned technology in the middle of it. And that is the personal computer. 

So let's look at the unowned technology that got things started. This is Steve Jobs at the West Coast Computer Faire in 1977, described as 10,000 walking, talking computer freaks. This was very marginal, but well attended, and this was, for the first time in consumer hands, a reprogrammable machine. You get your Apple II. You turn it on after hooking it up to, yes, your television set, and you get a blinking cursor. And it's up to you to figure out what to do. When you get the Apple II out of the box, it is a door stop. It's only when you do such things as 10, print hello. 20, go to 10, that fun really begins. 

And you had lots and lots of people stepping forward to program their personal computers, intended as hobbyist machines. Within two years you had Dan Bricklin and Bob Frankston of the Boston area, programming the first digital spreadsheet ever, VisiCalc. And suddenly, businesses the nation over were like, oh my god, spreadsheets. And they started buying Apple II computers. They are flying off the shelves, and Apple had to do market research to figure out why this thing was so popular. 

That's what makes this an unowned technology. You didn't buy it from Apple, but Apple expects you or Bob Frankston or or somebody to program it later. And if your Apple doesn't spreadsheet the way you want, it's not clear that it's Apple's fault. It is unowned in that it accepts contributions from anybody with the moxie and skill to program it, who can then share that program with anybody else. And that model became the model for all that followed. 

This is Bill Gates two years after he dropped out of Harvard, and he was pulled over for a traffic stop in Albuquerque, New Mexico. You can see the fashion was different then. And he does have a smile on his face, somehow knowing that he can buy and sell us all someday. And he was able to take what Jobs did and put it into, maybe, MS-DOS or later, Windows. 

But basically, this format, which is, you give this thing code, it may start with the blinking cursor, but then it will run the code. And that was true on many PCs until recently. And it was true then. This thing is probably around 1992. I place it because of the 66 light here. It had a button that could alternate between 66 and 33, which was the speed at which the chip inside should run. You may wonder, why not leave it fast all the time? That's because it would tire the hamsters out inside if you made it run too quickly. And Prince of Persia would be too fast as well. I see, by the way, they now have hamster powered paper shredders. So you can put the paper in the top, and then the hamster runs on the wheel and shreds the paper, and then can live in the paper afterwards. So it's all part of the cycle of life. 

Anyway, these things can run any code you give it, and that is a fundamental, but still contingent, piece of the technology. It didn't have to be that way. It could have been the Brother Smart Word Processor, and as people at Brother or their competitors invent new stuff, they roll it out like any consumer product. It's not up to you to put a seventh blade into your safety razor. We wait for Gillette to say, if five is good, why not seven? And then we get it, and we buy it. 

This is different. With the modern PC revolution, for the past 30 years, you hand a computer code that you have written or gotten from somebody else, it will run the code. And that changes everything. That is what gave rise to the off the shelf independent software movement. So you could buy a computer for any purpose, and then use it for any number of other purposes. Or your brother could, or your kid could, or anything else. 

It didn't have to be this way, but it turned out to be this way, once everybody discovered how many discoveries could come if you just released the technology blinking cursor style and figured that the world would build cool stuff. So that's, to me, the essence of unowned technologies, and I just want to emphasize that you don't have to be this way. If you rewound time and played it back again, it's not clear to me that we would end up with an unowned technology at the core of our consumer computing experience. 

Now, on the network side, there was a similar transformation. It began in the owned space. AT&T ran the long distance system, and that was that, and it worked pretty well. And the prices were what they were, and the regulators came in to set the prices. And AT&T purported to control the whole network. So back in the early 20th century, when an enterprising man invented this, the Hush-A-Phone, it was something that would go over your telephone handset, so that your person you were talking to wouldn't hear extraneous noise. And no one could hear what you were saying to your interlocutor. AT&T said no, we must a license that, because it could damage our network, and they purported to block people using it. 

This is an era, by the way, in which the telephones were leased from AT&T. You could not go to the store and buy a telephone. You had to get it from your telephone services provider. This went up and down the Federal Communications Commission. The FCC backed up AT&T. It took a Supreme Court decision, ultimately, to reverse that. And the world was free to have their phone hushed, but not much else. 

That had its own successors. Back in the day-- and I now mean probably the mid '80s into the early '90s-- there were services like CompuServe. That was going to be the future of networking. It had competitors, like Prodigy, and AOL, and the source, and MCI Mail. But you basically paid by the month, and then you got a rational menu of things you might want to do. Where you want to go today? 

But this menu was produced by CompuServe. If there was going to be something new on it, you'd get it from CompuServe. And if somebody out there was like, I think there should be a VisiCalc button, you'd better persuade CompuServe of its worth, or it would never be accessible to somebody using the service. So that's an example of the IBM 360 or the Flexowriter model of technology for networking. That gets blown out of the water, unexpectedly to almost everybody in the field, by this academic research network known as the internet. 

Here are three of the founders, pictured here, of the internet-- classmates, it turns out, at Van Nuys High School in California. There's Jon Postel and Steve Crocker and Vint Cerf, showing at their 25th anniversary retrospective picture for Newsweek that you can build a network out of pretty much anything. Although, as you'll see, their network doesn't work. It goes from his ear to his ear, and mouth to mouth, which I hope is an inside joke, rather than the founders of the internet don't know how to string tin cans together. But you can see that they built a network because they didn't have a lot of money and couldn't roll it out FedEx style, with lots of people working for them. And because they weren't intending to make any money from it, they built a network that was unowned, whose points would be respectively owned or operated by who knows who, and maybe there would even be piggybacking. MIT would piggyback on BBN to get its packets going back and forth. 

But unowned as a total thing-- what they built were protocols to put the internet together in a way that there was no CEO. There was no main menu. It just is. And it's such an unusual way of doing it, both in methodology and in substance, that for many years, IBM was fond of saying you couldn't possibly build a corporate network using TCP/IP. And that's why internet engineers say that their mascot would be the bumblebee, because the fur to wingspan ratio of the bumblebee is far too large for it to be able to fly, and yet, miraculously, the bee flies. It turns out that we finally discovered how bees fly in 2006, thanks to massive government funding. It turns out they flap their wings very quickly. 

So the way the internet works is kind of like the way the beer finds its way around in Fenway Park. Somebody asked for a beer, but there's no beer distribution limit network down to the last foot or so. For that, the person has to hand the beer to the toddler sitting on the end, who then passes it over. And at risk to each of our trousers, we do this because we stand together to let the fun flow. And that's basically the way packet networking works on the internet, where there are entities on the internet handling your packets, as you get them relayed from one point to another, who have no contractual relationship with you, nor with the ultimate destination. It's like nested matryoshka dolls, how it goes around. 

The basic format is this, and you may have learned a little bit about it. It's called hourglass architecture, and it says that you put not intellectual property, but internet protocol, in the middle of the hourglass here. That's what the engineers work on, and it's designed to be totally ecumenical, which is why it's broad on the top and the bottom. At the top, we allow any number of applications. Who knows what somebody's going to build on it. It's just like a blinking cursor. 

The internet is just designed to take points of presence and route packets between them using best efforts. That's it. That's It. It's not a set of applications. It's just the network. And then anybody can build applications on top of it, and may the best apps win. And underneath, it was meant to be ecumenical about what hardware you would use. Whatever hardware you want to use, boom. You can bring it to the party, so long as it speaks internet protocol. And there is no copyright asserted in internet protocol, and as changes are made to it, you're free to adopt them or not. As an equipment manufacturer or as a network provider, it is, in fact, a collective hallucination, but a very sustained and powerful one. 

And the idea was, don't make the network smart. Don't keep adding features. Otherwise, we would be at the animated paper clip phase of the internet. We are not, because we never added many features to it. Instead, it's just supposed to route and let the endpoints-- the smart things on the end like PCs-- deal with any features they want, such as encryption, such as return receipt, all of that stuff meant to be only if you need them. 

Now a different David-- that was David Clark who contributed to last paper-- a different Clarke, Arthur C. Clarke, came up with what he calls his Third Law. And this was, "Any sufficiently advanced technology is indistinguishable from magic." He was actually borrowing from a previous science fiction writer, Leigh Brackett, who put it a little less kindly. "Witchcraft to the ignorant-- simple science to the learned." 

And I put it to you that part of CS50 is to move you from one category to the other, so that you can start understanding stuff that seems like magic to others. I turn on my Flexowriter, and magically, it pounds out a paper that I had previously recorded. You're learning about the guts of technology. And these are unowned technologies, both at the endpoint and in the network, that let you take what you've learned and just take it for a spin. Try it out. See if you can change the world in some way. And it will look like magic to others, but you are learning the secrets to make it simple science. 

One such person who did this to the nth degree is Sir Tim Berners-Lee. He wrote an app called the web, and that means he wrote protocols. It's like, hey, if you want to just ship a file to somebody but have it render into clickable links and pictures and stuff, here's how you would do that. And now I've programed a server and a client. So, OK, world, here's your web. Go to town. 

And unbelievably, the world did just that. Tim asserted no patent, no copyright in it. He gave it away. And the web is the second great unowned, collective hallucination that we have, which is also why if have a problem with a website, you can't go to the CEO of the web and have it be taken down. There is no such person, and there is no main menu for the web, exactly the opposite of AT&T or CompuServe. 

It's also, then, a moment, probably around 1995 or so, when Windows, which had no means of connecting to internet protocol, got finally hooked up to it, thanks to this guy, named Tattam. At University of Tasmania, in the psychology department, he wrote something called Trumpet Winsock. That's because he likes trumpets. That's him. And Trumpet Winsock was just a little shim that connected your Windows 95 or 3.1 into web and the internet. And suddenly everybody was like, holy crap, this is great. And Tattam just said, well, if you like it, you can send me some money, but otherwise it's totally up to you. 

And that's how you start getting amazing content-level unowned technology taking off, such as catsthatlooklikehitler.com. CompuServe is unlikely to put this on its main menu, and yet it's but a click away on this web, with enough people now connected that have cats and that know enough to upload a photo of them, that you can get this incredible number four Kitler, which is just like, I don't know how you would come back home to that every day. 

It also lets such things that are crazy, like Wikipedia, is being created. Can you imagine, in 2001, somebody named Jimbo saying to you, I've got a great idea. We start with 20 articles, and then anybody can edit anything, and before you know it, we'll have an incredibly useful source. How many people have used Wikipedia for medical advice in a direct way? Right. And the rest of you are not admitting it. That is amazing, given how it started and how it is sustained, by anybody able to edit any article at any time. In that sense, this is an unowned technology at the content layer of the hourglass, capable of incredible things. So popular, in fact, that it is now appearing on Chinese restaurant menus. Not exactly sure why. I have a theory, but we don't have time. 

So anyway, these unowned technologies can end up yielding new unowned technologies and content at other layers. And we end up with the amazing explosion we've seen in the past 30 years. Incredible, powerful, still contingent, especially because as more and more people use it, you start to see that it's worth subverting. Whether to scam people or for your own purposes, these technologies that depend on some measure of trust and goodwill can themselves become very, very limited. And the fact that we're not accrediting people who contribute-- anybody can write anything, even if you're from Tasmania-- that cool thing can become a problem. 

So we see , generally, a movement from owned stuff, with the introduction of the web and the internet, to an unowned zone. But then, you start to see certain apps themselves become foundational, and some of them may in turn be owned, and they start to look like the new CompuServe. So there's a kind of weird cycle going, as people shelter and look for stability and consistency and security and main menus. And once you start getting those, and some people and entities start to really get powerful in the space, they quite naturally might want to assert control. So things they could do to be open, they, in turn, can start to close, if it fits their business model to do it. And these are, of course, several instances of those sorts of things happening, as mere apps become foundational platforms and start pulling back. 

But this is really more of an entrepreneurial story. There's a more fundamental problem going on, which is, in all the stuff running on this really cool PC you might have, whose lineage traces back to 1977, what happens if just one piece of that code is bad? And it turns out, terrible things can happen, because any piece of code written by anybody running on your machine generally has had the keys to the kingdom. And that's kind of like The Princess and the Pea. Just one problem on the computer can spoil more than a good night's sleep. 

And this was something that the music industry discovered when they produced the compact disc before there were PCs. They produced this for an appliance-sized world. The compact disc had digital quality music on it, read by CD players. And the CD players were in a very complicated arrangement with the music producers, so that it never even occurred to them to put any form of encryption on the disc. Because who would decrypt it? How would a consumer decrypt it? 

Well, it turns out, once you start putting CD-ROMs and CD readers in PCs, anybody can decrypt it, and that leads to problems. In fact, the industry briefly tried to use the reprogrammability of the PC as a feature rather than, to them, a bug, when they started putting code onto these CDs, so that, if it were loaded into a computer, the code would run and try to protect the computer from copying what's on the CD, as against the wishes of the user, by just watching, at all times, to see if you were ever going to try to rip the CD. 

This is called a rootkit, and it was not very popular when it was found out. And they started outing which CDs had this software that would ride on top, load itself on your computer, and refuse to leave, even if you no longer liked the music. This is the one where it was discovered, by the way, ironically called Get Right with the Man. Here are my top other three rootkit CDs, The Invisible Invasion, Suspicious Activity, and Healthy in Paranoid Times. 

Anyway, that's an example of a compromise of your machine from a trusted, or not so trusted, partner. But this stuff starts coming out of the wild, and you end up with things like the Storm Worm in 2007. This is one of the biggies, and you see quotes like this. "It can launch attacks against those who try to figure it out. It knows, and it punishes. Researchers are afraid. I've never seen this before." And you're like, is this Network World, or Homeland? 

This is ridiculous. How is it so bad? And it has, in fact, gotten worse and worse. And as we've seen more and more sophisticated malware, we start to realize that just one bad move can end up ruining things for everybody. And we don't really have good defenses calculated for it yet, and that is a real problem. 

In fact, just today it was reported that the Stuxnet virus has found its way onto the International Space Station because some Russians had a USB key infected with it. And now the space station has come down with a problem. That's pretty incredible. And it's ironic, too, because it was a few years ago that somebody from Microsoft was pointing out that malware is becoming so bad that once you've got it, there's basically no way to perform an exorcism on your machine. That's this wonderful quote that says, really what you have to do is nuke the systems from orbit, which starts to be a fairly serious thing to do to clean your machine of a virus. And if you're already in orbit on the space station, I don't know what's going to happen. 

So, anyway, this is a real problem. And the fundamental problem is this, the Cap'n Crunch bosun's whistle, a prize in a box of Cap'n Crunch cereal in the early 1970s. After you have sugared up your child, why not have her run around the house and blow a whistles? It's the perfect prize. But it turns out that if you covered one hole of the whistle after extracting it from the box and blew, it emitted a tone of 2,600 hertz, which is exactly the tone used by AT&T, monopoly telephone provider at the time, to indicate an idle line. Pick up the phone, blow the whistle, get free long-distance telephone calling. Boxes of Cap'n Crunch cereal flying off the shelves. General Mills has no idea why. And it turns out, there's a new third-party app for their cereal. 

Now, this is a real problem for AT&T, but they have an owned network, which means they can fix it. Which they did. They turned to out of band signaling, so that data was distinct from code, and there was nothing you could put into the data channel-- the voice-- that could change the way the network worked. The internet is unowned and cannot be so readily fixed. The very channels that carry our music, our email, our dancing hamsters, are also the channels that carry executable code for the network itself, and for the endpoints. And we wouldn't want to have it any other way, except that now we are in a serious dilemma, because you click on the wrong thing, and now it's all over. 

And we even start to see stuff being installed before you even take it out of the box. It's compromised in one way or another, and trying to figure out, as you peer into your box, whether it's already compromised, is a hopeless, hopeless task. And try figuring out the same for anything you hook that box up to, the intermediate routers, et cetera. Which is one reason why I think people are very puzzled at the prospect that their laptop webcam could simply be turned on by somebody who has compromised the machine, and viewing everything. I don't know how many of you put a Post-it note over your laptop webcam. I don't see any hands up. Turns out it's a cheap security feature, and I recommend it, because you start to see that this is a so-called RAT-- a remote access technology. 

And here is a Danish family being viewed. This is from the point of view of the hacker, who has gotten into their machine and is watching them as they are computing, can completely control the machine, watch what's going on. Here is a police officer, whose machine in his squad car was compromised. So you can watch the police officer going around. I guess you can see if he's coming to your house to arrest you for that. There's the chat room where they are talking about this phenomenon, and amazed that they have managed to do this. 

This is the kind of stuff that makes it hard to be healthy in paranoid times. You add up this stuff-- anywhere you see a PC, including that CAT scan machine, you now start to worry about bad code getting near it. And this is becoming a somewhat dire threat. And I think we have to recognize that threat, because it is already changing the nature of the unowned technologies that otherwise I am extolling. 

So what do we do about it? Well, here is a quick tour of some potential solutions. Thinking through an axis between owned an unowned in a given environment, and then hierarchy and polyarchy. And hierarchy means there's only one choice for your solution. Everybody is bound by one entity that does something. And polyarchy means no, no, there's lots of choice and competition. And I'll give you some examples to straighten this out. 

But let's first look at responses to the cybersecurity problem, quadrant by quadrant. So let's look at the unowned polyarchy one, which I think is basically anarchy. It means you're on your own. Good luck. There's lots of things you could do. Try to pick the right one, and just do the best you can to defend what you have. And that, I think, is great if you happen to be a ninja. It's not so great if you are not. And it's not even great for ninjas, because everybody asks them for help and they get bored. 

So we start to see things like this, designed to help you decide what to do. And if you see something like this-- I don't know how often you see windows like this-- it's a Saturday night, you're clicking around. How many of you, when you see a window like this click, continue? Lots of hands. How many click cancel? A couple. Right. And then you click cancel, and you're back where you started. You're like, but I wanted to see the Hampster Dance. So then you click continue, and away you go. 

This is just not an effective way of securing things, and it reminds me of this email I got several years ago warning Harvard Law School faculty and staff of an insurgence of fraudulent emails at the law school, and all the things you have to do so that if you click on the wrong thing you're not totally screwed. And it's just ridiculous how much you have to do every time you see an email. This is my favorite one, by the way. "Be weary of emails that have misspelling, poor grammar or odd characters. They are a red flag for fraud." I wrote back, I was like, I got one. And they sent me to Oxford for three years, so never mess with your IT department. And if you're going to end up in an IT department, don't allow yourself to be messed with. 

But anyway, you see that user ignorance is something that is going to mean that it's really hard to rely on that bottom right quadrant to help people. And I've got to say, I'm not even sure the answer to this question. Right? If it's bad enough, I suppose it could. If there's rain over Redmond. 

But anyway, let's look at another quadrant, upper left. When I think of hierarchy and owned, I'm thinking government. And what might government do to try to help? Well, government has been trying to help for about 10 years now. This was the original strategy to secure cyberspace. It was huge. It basically said digital Pearl Harbor, be very afraid. And we don't know what to do about it. So they've been trying to figure out what to do about it, like creating information sharing and analysis centers that look at the internet. They're like, it's down, it's down. It's like, OK, it's down. We can't tell anybody, it's down. 

So, one of the disadvantages of unowned technologies are there's no obvious place to send the Marines, and they have no particular comparative advantage, even if you could send them, in securing this distributed network. Which means the government has had a hard time figuring out what to do. Instead they made calls like this, from former CIA director George Tenet, who said that, maybe we have to make it so that people-- the access to the web might need to be limited to those who show they can take security seriously. It would no longer be a world wide web. It would be like, three people being like, we are very secure. And that's one of the problems in trying to figure out what to do. 

And just a couple years ago, there was this big thing about, oh my god, they have a cybersecurity bill, and the president's going to have emergency power to shut down the internet. I don't think that amounted to much of anything. And in fact the lawmakers themselves were not pleased with these reports of the kill switch. Although it doesn't make me feel better that, as you can see at the bottom, the senator was like, the president already has the authority to shut down the internet under a little-known provision of the Communications Act passed one month after the 1941 attack on Pearl Harbor, which is a very forward-looking law, to give the president the power to shut down the internet after the Japanese attacked in 1941. 

Anyway, we start to see other ways that government is trying to think of this like the government would think of any other form of intrusion into a space. And that's one of the negatives of calling it cyberspace, because it's not really a space. But we think of perimeter defense. Of just like, well let's just put antivirus nodes all around the edges of the country, and they can shoot down incoming viruses like missile command. And it doesn't quite work that way. And it means, instead, that we may end up building a system to shoot down all sorts of other content that has nothing to do with network security. It's not clear. We want to take a page out of the books of countries that have already done that. 

In the meantime, we've seen proposals from some multinational multigovernment institutions, like the International Telecommunications Union, to completely redo the internet. As you can see, they are an extremely hierarchical organization, kind of the opposite of the three guys who started the internet off. And they have this idea of replacing the hourglass was what they call the next generation network. And they started a focus group on the next generation networks, also known as the FGNGN. And it came up with a new map for a better tomorrow. 

You ready for the new hourglass? Here it is. It's ITU next generation network, and it has everything but the animated paper clip. Suddenly it's feature laden in the network, because the idea should be, they figure, that you want to be able to make it, if packet says don't copy me, even if two users want to exchange it, the network should know not to do it. That could help with content control, and that could help with security. It doesn't, I think, end up mattering that much, because trying to replace the network we have is really difficult to do. It has a lot of inertia to it. Just ask the internet engineers who are trying to upgrade it themselves. 

So a third quadrant here is the upper right. And it's still owned, but it's polyarchy. There's lots of owners, and you get your pick. That's basically the corporate sector. It's turning to the corporate world to say, I've got a problem. Sell me a solution. I'm not looking for government. I can't do it myself. But you could maybe come up with something. And sure enough, we've seen lots of efforts by private companies to secure the space, which in turn sometimes end up in trouble. 

Is that RSA calling? I hear a weird beep. I guess not. 

Anyway, it turns out, then, that the corporate sector tries to offer some measure of security, but it has the feel, metaphorically, of securing the road from the Baghdad airport with your own bodyguard force. It has its element of inefficiency to it, and it means that different people will get different levels of security, which can end up not being all that fair. 

In a more subtle sense, we've seen the introduction of technologies made to be in the mold of the Flexowriter. In fact, the very company that in 1977 gave us the first great unowned technology, the PC, gave us the first great owned technology exactly 30 years later, with the iPhone, where the iPhone says, look, we are going to define everything on it. You don't want to be like a PC. Those crash all the time. Instead what you want is to be able to have it work, have it act just like that Smart Word Processor. Now that was the original iPhone. There were no apps, no App Store on the original iPhone. It was more just like basically saying, look, we're going to close it off, and this is going to look like something some of you have seen before. And we will define what goes on the phone. 

Now, that changed when, a couple years later, they introduced the software developers kit, and suddenly third parties could code for the iPhone. And that includes you. This is not a real Newsweek cover. In fact, it's not clear to me Newsweek exists anymore. But anyway, it's just a bad dream, the whole thing. 

It turns out, though, that they put an extra tweak in. it's not like VisiCalc. If you invent something that's going to run on somebody's iPhone, and you want to give it to them, and they want to take it, it must go through the App Store, which in turn says, we're not going to allow illegal, malicious, privacy invading, porn, bandwidth hog, or my favorite, unforeseen. We can't have anything unforeseen happening on the iPhone. And that App Store model is responding to a very real and pressing problem in the unowned universe. But it's a solution that comes with its own worries. 

So, for example, when a guy created something called Freedom Time, counting down the end of George W. Bush's term, it was rejected from the App Store. And he actually wrote a note to Steve Jobs asking why it had been rejected. Steve Jobs wrote back and said, this is going to be offensive to roughly half our customers. What's the point? And you realize that people are now walking around with their technology. They may want it. You may want to give it to them. But somebody in the middle has to be persuaded of its worth before allowing it. 

That's a very different technological environment. And it's one that Steve Jobs accurately foresaw. It's not just about mobile phones. This is coming to all our technologies. And indeed, we've started to see hybrids and other ways in which our own PC architecture is now App Store driven. 

This is now like, we take it for granted. Two years ago, it would have been, I'm not so sure that's going to happen. And years before that, it would have been insane to suggest such a thing. And, of course, the other day I tried to load this-- I don't even know what it does, this thing called Vuze. Anybody familiar with it? Anyway, I tried to load it on my Mac, and I said, no, no, sorry. You can only allow things approved by the App Store. If you're totally nuts, you can change your settings to allow any old stuff to run on your machine. But why would you possibly want to do that? 

And it turns out that it's not just Apple doing that now. Every major producer is building architectures that are both meant to secure things and that become vectors for control. And if you think Android is open, just wait until it gets a particularly bad set of malware, and you'll see-- this is the SMS Zombie-- I don't know who would click on "Animated Album I Found When I Fixed My Female Coworker's Computer," but enough people did, and ended up then with Android malware. And you start to see the rate of uptake of malware happening. And you realize that it's just a matter of time before we go to an App Store model for everything. 

So that which has become unowned is becoming owned, and that which is owned but open is becoming just owned, for all sorts of reasons. And we're seeing it not just on endpoint devices, but in the cloud as well, as more and more platforms are starting to be intermediaries between you and ostensibly an independent party that you want to communicate with. Just ask the people who did something called Critter Island, a somewhat busy game. And it had 150 million users back in its heyday, until it did something that Facebook didn't like. Facebook simply pulled the plug, and there is its user graph right at the moment that Facebook pulled the plug. That's very different from the zone where you get Napster out there, and Napster is out there. There's no way that Bill Gates or anybody else could have pulled the plug on it, for better or for worse. 

And control over the code means control over the content. So, for example, when the Kindle came out-- perfect example of an owned Friden Flexowriter style device-- there was a third party that submitted through Amazon, 1984 for $0.99. And people bought it. And then the person submitting it was like, oops, it's under copyright in the US. I thought it was in the public domain. My mistake. Amazon was like, oh my god, we could be in big trouble for allowing this to happen. And as a result, Amazon reached into every single Kindle that had downloaded 1984 and deleted 1984 from the Kindle from afar. 

It's like, you don't have 1984. You never had 1984. There's no such book as 1984. Now, that's a problem. And it's not as much of a problem when this happened, because there were still bookstores. Remember bookstores? Remember libraries? It was like, don't worry, there's a place that just has this already printed out and bound on paper in the unlikely event that somebody should walk in and be like, I'd like to give you $5 for a printed copy of 1984. How totally absurd is that as a business model? And as that fades, and you start to go to print on demand or read on demand, you realize that control over content is a serious thing. 

And I just want to be sure, it's not just Amazon here that's a baddy. It's Barnes and Noble as well. I was reading-- talk about not having much of a life-- I was reading War and Peace the other day when I read this passage. "A vivid glow Nookd in her face." What the hell is that? "The flame of the sulphur splinters Nookd--" Why is the work "Nookd" all over War and Peace? And then you realize that every place the word "Kindle" would appear, it has been replaced by the word "Nook." Yeah. 

Now that wasn't Barnes and Noble. That was a third party who had probably done this Amazon ebook and then just re-purposed it to go on the Nook, and figured they would change their wrapper content on either end to say, oh, find us on our Nook store, and did a search and replace, and disaster happened. But you start to realize just how readily this could be repurposed. And believe me, if you're halfway through War and Peace, you're just like, whatevs, that's Tolstoy for you. What are you going to do? 

So this is an era in which our products are becoming services, and you think, I've I got a toaster. Well, that's a product. Imagine your toaster as a web-enabled service. What does that mean? It means you come down one day, it's like, congratulations, you've gotten the Tuesday update. You now have three slots. You're like, well that's pretty cool. And then the next day, they're like , sorry we rolled it back. There was a problem. We apologize for any toast that was crushed. And then on Friday, you go down and it's making orange juice. You're like what do I own? The answer is you own nothing. You have a long term service oriented relationship with a breakfast provider. And that is great, but it's also something that we are still trying to wrap our arms around as we get used to this kind of thing. And the regulatory possibilities are only just beginning. 

So, for example, some of you may remember the old OnStar system. It was in your car. You'd be driving around, and you get lost or something, and you press the button in the rearview mirror. It has a little microphone so you can speak right into it, and speakers so you can hear what people say back. And this woman answers when you press the help button. And you're like, I can't get up. Please help. And she's like, well, help is on the way. 

And then it turns out that the FBI ends up going to an OnStar like company and says, I want you, for this car, to simply turn on the microphone, and listen to everything going on in the car at all times. And the company was like, uhh. And they're like, that's what you're going to do. We're the FBI. The company said OK, and then sued anonymously, leading to this wonderful case, The Company v. United States of America, in which, it turned out, then, that this was not permitted under the Wiretap Act for the thinnest of reasons. Which namely was the way the FBI asked for it to happen, to be implemented. If the person asked for help because they were really in trouble, it would still only go to the FBI, rather than OnStar, or that company, which presumably would not come and help. But if you could fix that glitch, you would be in a position to change the way this works. 

So, all sorts of ways in which malleable software, for which changing it is the prerogative and privilege of the vendor, overriding, or getting to permit, third party change, that's today. That's the new environment, and it is the environment of the System/360. You don't own your stuff anymore, and that is a real problem. 

So what do we do about it? Well, I'm going to give you some ideas in the next 4 and 1/2 minutes. So, one possibility is to return to these very unowned technologies and look for new means of defense in this quadrant. Coming in an unowned fashion, but so powerful, so persuasive, so widely adopted, that they end up being things that the criminals can't easily opt out of, which is what puts them on the left side of this graph. It's something that Wikipedia has discovered, in that any administrator of Wikipedia can be making changes to Wikipedia in a privileged way, but still in this kind of distributed, unowned fashion, in order to try to make for a better encyclopedia. And they just take through a list of people that complain about stuff all day long, and for no money, they just keep fixing it. That is an incredible story, and always a contingent one, that I believe has lessons for how people can intervene usefully in ways to secure the internet. 

And I'll just give you some examples of unowned but powerful-- so powerful they move to the left on that chart-- technologies like Tor, where, with enough computers together, you can end up laundering the source and destination of packets, so the something like the Silk Road could be up and unfindable, even though it's a click away, for months at a time. It took the owner of the Silk Road trying to put out a hit on one of his vendors for the cops to be able to find this person. That's pretty incredible. For better or worse, this is an example of a technology, then, that defies a certain kind of OnStar like surveillance. At the content layer, we see things like Ushahidi, which allow people to immediately throw up a map and make reports of things, so after an earthquake or with other problems, you have people coming together in a civic, unowned kind of way, to actually create a collective hallucination, that in this case is a map of trouble, that can become quite reliable. 

This is an idea that we're pursuing over at the Berkman Center, in which currently, if you try to access a web page, it renders some links, and you click on one of those links and try to go where the link points. If you can't get there, that's it. You're stuck. Well, what if we made it so that when you visit a page, it has already cached some of the links that point elsewhere? It's taken a copy from that server to itself, so that if you go to the server and you can't get there, you can go back to the place where you got the link, and it will send you what you missed. 

That's an example of a distributed defensive system that could take some of the sting out of distributed denial of service attacks. And, it turns out, if the filtering, if the blocking is somewhere in the middle, maybe thanks to government filtering, this system would be a distributed means around it. That's an example of an unowned civic technology coming back. 

Now if the entire plug is pulled on the internet, as now has been known to happen, although at the time it was like, wow, who knew that actually happened? It turns out there's mesh networking, in which each one of our devices could be programmed to be able to respond to nearby devices, and then onward onward, like that beer passing brigade at Fenway Park, so that we end up with a network among ourselves, possibly with cached Facebook and Twitter credentials. So you can find your Facebook friends in your mesh network without even having to get to facebook.com. That's an example of a distributed, unowned collective hallucination that could greatly affect security. 

There was a time when there was a debate among state governments about slavery, and about returning slaves to the South who were on the run in the North. And a political accommodation was reached, to try to prevent the Civil War at the time, that they would be returned. And it turns out it didn't work. And why didn't it work? Because there was not centralized law enforcement in any big way. If you needed to find somebody or do anything that was bigger than a single arrest, you needed a posse, you needed to recruit citizens to do it. And enough citizens were like, I don't think so, that it didn't happen. Technologies that rely on the general public to work are also technologies that have some check valves against abuse in a way that's different from the check valves against abuse that we are familiar with from the more traditional centralized government scenarios. 

So I end up with this question. You are now graduating from CS50. You've gotten the bug bit that gets you into this technology. And in this following puzzle from Game of Thrones, try to think about who you are. 

[VIDEO PLAYBACK] 

-Are you fond of riddles? 

-Why? Am I about to hear one? 

-Three great men sit it a room, a king, a priest, and the rich man. Between them stands a common cell sword. Each great man bids the cell sword kill the other two. Who lives? Who dies? 

-Depends on the cell sword. 

-Does it? He has neither crown, nor gold, nor favor with the gods. 

-He has a sword. The power of life and death. 

-But if it's swordsmen who rule, why do we pretend kings hold all the power? 

-I've decided I don't like riddles. 

[END VIDEO PLAYBACK] 

JONATHAN ZITTRAIN: OK, so, in this scenario, I think you're either Maesters in training, for those who read the books, or you've got the sword. That's what you're sharpening. You have a tool that you can use in an environment still sufficiently generative that in a week you could flip things over. You could completely transform it with some good code deployed on this network. How you choose to use it will, in part, influence whether anybody sees reason to keep the network generative, or whether it's time to just call it quits and go back to the Flexowriters we love. 

In this graph of people-- this is Clarke's Third Law coming back again-- basically there are Luddites on the left, so removed from technology that they don't care what happens in the world. OnStar isn't a problem, because they don't drive. OK, not that many left of those. They are all the Harvard bookstore. Then, on the right, you have the nerds, who are the ninjas, who can get around anything. In the middle, you have the public. And you have a chance to emerge from the herd, while still remembering what it was like, and influence the course of history in a way that is better for everybody. 

So, to me, that is the test. Can we make systems that distribute power, rather than focus it, and still be secure? And I am confident that the answer lies within this room, and over this webcast, and with those who are curious enough to undergo the phenomenon that is CS50. And they are the kind of people that, clacking late at night, end up like this. 

"Are you coming to bed? 

I can't. This is important. 

What? 

Someone is wrong on the internet." 

That's the instinct I believe that's going to save us. Thank you very much. 

DAVID MALAN: Thank you so much to professor Zittrain. Do come on up if you have questions. We'll see you on Wednesday.