Читать книгу Trust in Computer Systems and the Cloud - Mike Bursell - Страница 28

The word authority has its etymology in the Latin word auctor: creator or originator. The English word author still carries this meaning, usually describing the person who wrote a particular novel, paper, poem, or other work of text. In most contexts, however, when we think of the word authority, we tend to think about being told to do something, as in phrases such as “Does she have the authority to tell me to do this?” There is another meaning as well, related to an entity—typically a person or an organisation—with expertise in a particular area, who may act as a trustee. Sometimes these authorities will endorse ideas, people, organisations, or systems, creating a second level of authority.

How are these secondary authorities endorsed and established? Historically, authority was vested in figures or texts that had become established through either consensus or endorsement by another type of authority, such as the Roman Catholic Church. Notable examples include:

 The Bible—or, specifically, particular interpretations of the Bible that led to astronomical theories of geocentricism (with the Earth and planets revolving around the Sun) and that were defended by the Roman Catholic Church against the Copernican theories for which Galileo argued

 Galen, a Roman doctor and writer on medicine in the Greek tradition, whose incorrect theories around the circulation of the blood, for instance, were accepted for centuries

 Trofim Lysenko, a scientist (or arguably, pseudo-scientist) whose theories espousing inherited characteristics between generations led to a campaign against Darwinism and genetic theory pursued by the Soviet Union

The establishment of the endorsing authorities for these three examples are notably different. The first example is the theocratic rule of the Roman Catholic Church, whose control of much of Mediæval Europe was almost total, with spiritual power being backed up by economic and political (and concomitant military) power. The second example is the mediæval academe, whose practices and understandings of authority were established mainly through historical precedent and lack of philosophical means or impetus to challenge them, though they were also shored up by the Roman Catholic Church. The third was the autocratic regime of the Soviet Union, whose ability to influence research and teaching through political control—backed up by propaganda and force of arms—allowed them to endorse a particular viewpoint as authoritative.

The established endorsing authorities of the Middle Ages, including Biblical authority, the divine right of kings, and simplistic assumptions that force was sufficient to establish authority, came under question and then attack with the Renaissance and the Age of Reason (or Age of Enlightenment). Personal experience and the scientific method came to the fore, and the basis for authority was questioned. We have already looked at Thomas Hobbes's views on institutional authority: the assumptions that underlined these were exactly what Thomas Paine criticised as he attempted to find a new basis for social institutions and government in his late-eighteenth-century treatise The Rights of Man,²⁸ which defended the French Revolution. It had a significant impact on political and societal theory and reflected the broader move to a more individualistic view of human rights and experience, at least within European and American society.

This move to a more individual-centric world view led both to a debasing of the Roman Catholic Church as the sole endorsing authority for matters spiritual within the West and to a new approach to science, where experimentation challenged and developed scientific theory. This move has arguably never been fully complete, as the study of the philosophy of science shows us; neither is the search for “objective scientific truth” a simple acceptance of new ideas as they come along—a point addressed by Thomas Kuhn in his work on paradigm shifts.²⁹ The general march of society over the past few hundred years has, however, been towards an acceptance of science as an authority, with the scientific method its endorser, and experts in particular fields—we might say contexts for our purposes—as its practitioners.

We have more recently also seen a new set of ways in which endorsing authorities have become established and maintained their power. In a capital-based economy, money can be equally as powerful as force. In the modern era, wielding the two together is typically the reserve of nation-states, but in the past, organisations such as the East India Company were able to combine the two with great effectiveness. The multinational nature of much business in the modern era generally allows the effective exercise of economic power without employing military force: the overwhelming success of the x86 instruction set, pushed by the silicon chip vendor Intel, is a case in point. Other types of endorsing power in the modern era include:

 Standards Bodies Organisations come together to create an industry standard that will benefit multiple parties.

 De Facto Standards Enough groups start following the same specification that it becomes more valuable to keep to it than to diverge from it.

 Fiscal Power The power of central banks, even when not fully controlled by a government, allows them significant control over fiscal matters domestically and sometimes internationally.

 Cultural Power Latterly, the position of the BBC (British Broadcasting Company) within Great Britain, the British Empire, and later the British Commonwealth was such that it wielded considerable cultural power, allowing, even in the 1980s, the rise of the Acorn BBC microcomputer as a significant computing platform in the UK.

 Utility Power A particular organisation has sufficient effective control over a utility, tool, or device that they gain significant power, such as Google's power to promote companies in search results or Facebook's ability to influence what news we see.

Perhaps the most important example of an endorsing authority in our context is that of certificate authorities. As the Internet grew and the World Wide Web exploded in popularity in the mid-1990s, it became clear that there was a need to be able to identify the computer system—typically the web server—to which you were connecting. More accurately, there was a need to tie the identity of the entity—person or organisation—owning or operating that computer to that computer and the information it was providing. The invention of public-key cryptography and associated public-key infrastructure (PKI) based on asymmetric cryptography offered a way to do this, and a number of companies started offering a service by which they cryptographically signed certificates that could be requested by companies and then hosted on computers to prove their ownership: these companies became known as certificate authorities (CAs). They checked the identity of the requesting party and their ownership of the computer system (or associated DNS record), issued a certificate, and made legal representations around the service they were providing.

The complexity and importance of the trust relationships to CAs and public-key cryptography within our day-to-day interactions with computing systems should not be underestimated, and we will be undertaking a deep analysis of the issue later in the book. The relevant point here is that CAs became endorsing authorities through the identification of a need, the development of clearly defined processes, and the application of legal frameworks to support the services offered, which led to a new type of endorsing authority. The particular authority that they were endorsing was a series of cryptographic root certificates to which other certificates could be linked, leading to a chain of trust. These root certificates have come to be known as trust anchors, creating a concept that we will adopt and expand as we look beyond just PKI and into trust more generally.

While this shift to an expert-led, rationality-based, authority-endorsed approach to trust has been largely successful, particularly in the fields of science and technology, it is not without its detractors. Whether it is the doubt cast on the radical logical positivism that was proposed in the 1920s to the more recent populist antiscience movement, there has been a growing reaction against the authority of science and expert knowledge to what is becoming, in certain circles, a more post-expert world. The results of this move are concerning to many and have led to such extremes as:

 The anti-vaccination (anti-vaxxers) movement

 The leading British politician Michael Gove refusing to name any economists who supported his “pro-Brexit” stance and saying that “people in this country have had enough of experts”³⁰

 Holocaust deniers

 A move by some to deny the validity of the scientific consensus on climate change³¹ Exactly what has brought this antiscience movement about—and how to try to reverse it—is the subject of much debate, but this is not a new concern. In the 1990s, for instance, Steven Nock suggested that the change in who and what people trust could be traced to young people moving away from larger family units, arguing that an increase in privacy leads to a reduction in sufficient social relationships to allow trust to build up.³² This change away from trusting established authorities has not all been bad nor all based on the rejection of qualified experts, however. Some of the foundations on which Western civilisation has long been considered to be based have come under prolonged and justified fire. The most obvious example of such an attack would be that of feminism on the patriarchal Establishment, with multiple waves of action and theoretical underpinnings (such as those put forward by Julia Kristeva and Luce Irigaray), but colonialism, racism, and many other long-held assumptions around authority have also come under scrutiny. Philosophical and literary critical theories such as post-structuralism and the deconstructionism espoused by Jacques Derrida have provided approaches that allow for the criticism of established authorities without a free-for-all rejection of their values and underpinnings (an example being the hermeneutics of suspicion).

Some of these approaches have led to developments that are important and relevant to our field of study, the most obvious being interest in using blockchains as the basis of crypto-currencies, providing an alternative to fiat currencies and research into self-sovereign identity (SSI). This approach rejects state, national, regional, or commercial organisations as the appropriate repositories for, and owners of, personal information held about individuals, such as their health or financial data, and seeks to provide means to allow the individuals to control this data and how it is collected, used, and changed. The mechanics of handling different types of data and its various usages are still under debate, and the trust issues also are still being studied. Other movements that we could associate with these approaches include the copyleft movement, which attempts to undermine the controls put in place to support copyright, and the open source movement,³³ a subject of discussion later in the book.

To return to the more general anti-authority, pro-individualist movement, the problem with trusting only in oneself is that it makes it almost impossible to build systems and processes involving other people in ways that allow for any useful cooperation or economies of scale or scope. Authorities of some type do end up being important to our larger set of requirements, and even movements that aim to reduce the number of trust relationships to as few as possible generally recognise the need for authorities in some guise or another. A good example of this is oracles, a concept within the field of blockchain that accepts the need to trust information from certain sources. Equally, standards—whether formal or de facto—are typically vital in allowing individual entities to work together, two classic historical examples being the regularisation of time across the United Kingdom with the rise of the railway and the standardisation of the systems of measurement that allowed government, commerce, and science to collaborate with less friction and confusion (the canonical example of this within the science community is the loss of a Mars Rover in 1999, due to a lack of standardisation on a particular measurement—metric or imperial units^34—but the problem has been around for much longer than this³⁵). We can expect that as we delve deeper into considerations of trust, we will need to consider what authorities we need to establish a trust relationship with, and the question of endorsement: one of the most troubling concerns around existing discussions of trust is how often such relationships are created with little or no consideration, and sometimes just assumed, leaving implicit relationships that, as they are not stated, cannot be critically examined.