Dave's Blog

LastPass is a fantastic way to manage passwords and keep yourself secure online. It was one of the first things I downloaded at HKS (possibly because it was much much easier than setting up connection to printers). Beyond the utility this application has brought to my life, it’s worth examining if this application is worth making mandatory to the HKS community.

My framework to unpack this is as follows:

1. Examine who may target HKS
2. What damage is HKS worried about
3. Ranking the significance of threats
4. Would LastPass make a difference?
5. Possible alternatives

Who Would Target HKS?

To follow the thought process of Adam Shostack in Threat Modeling: Design for Security, I’ll take a look at a few external threats to HKS first.

• Foreign Governments
• Other Universities
• Scorned Applicants/Prospective Applicants
• Journalists/Public Interest Organizations

Internal Threats

• Students and Faculty!
• Friends, Family and Partners of the HKS Community
• Unsecured Technology within HKS
• Vulnerable HKS Technology Staff

How/Why These Actors Would Damage HKS

• Foreign governments
  • They may try to tamper with the information of or spoof high profile professors and students like Sec. Ash Carter
  • Through access to normal student profiles, they may gain access by spoofing students
  • These actors may even have the capability to deny service, disclose information, tamper, etc.
  • This is probably the most high profile threat
• Other Universities
  • They may target admissions or the administration to learn about practices or admissions statistics
  • Now may be a valuable time for another university, possibly a top Ivy League competitors, to learn HKS admissions secrets
    • While recent lawsuits have forced Harvard College to release many of their admissions secrets, this rumored “Z” list may be good ammo for a school going after the Harvard brand
    • HKS could also be threatened by similar things
• Scorned Applicants/Prospective Students
  • HKS has low rate of admission to the school. This creates a large pool of upset and very intelligent students that may want to cause harm to HKS or its current students
  • In a similar vein, highly-motivated prospective students may want to learn inside tips and tricks to increase their chances of getting in

Internal Threats

• Students and Faculty!
  • This may be the largest threat to the University. With each student’s login information, they can reach a lot of sensitive information about the University or individual people. Whether the malicious actor is a student, faculty member, or outsider, they can take advantage of and target many different aspects of HKS.
  • Also students and faculty themselves have expertise and institutional know-how necessary to threaten HKS.
  • This is of serious concern because there are so many students and faculty – meaning there are so many possible weaknesses in the digital security of HKS. The security of HKS is only as strong as its weakest link.
  • This fraud at NC State only required learning the personal information of students and impersonating the University Police phone number. It’s that simple!
• Friends, Family and Partners of the HKS Community
  • They may access HKS’s system on behalf of their friends/family members. At the very least, they may learn the passwords/information necessary to spoof these HKS community members.
  • This group may have similar access and expertise as students, but are much harder to account for because they aren’t normally “listed” anywhere.

Introducing LastPass to the Mix

LastPass does a good job protecting individual people from spoofing and tampering by encrypting all of your passwords and creating a vault of passwords accessible with one master password. But is it important to add this as a mandatory security measure for HKS?

Pros:

• Could reduce the threat of illicit access to student and faculty profiles
• Proper use lowers the likelihood of internal and external threats
• In theory, a simple addition for a great deal of protection
• Targets one of largest concerns of HKS security: safety of student and faculty accounts and data

Cons:

• Miscalculates user motivation
• Difficult/expensive to institute and monitor
• Invasion of Privacy?
• Cost outweighs security benefit

Based on this list, I think the costs of making LastPass mandatory outweighs the possible security gains.

For one, I think this policy misidentifies the interests of the user. Most users don’t have much of an incentive to use LastPass effectively. For those within HKS seriously concerned about security, they often have a password manager or would voluntarily use the service. But if you don’t think or know about password security, people will most likely add the application and never use it. Security isn’t often a concern for users until their data is breached, but at that point, it’s too late. I know that Google already autofills my passwords for most sites, a setting very common among people. Why change a good and easy status quo option like this without new motivation? Just by making LastPass obligatory, doesn’t mean people’s outlook and behavior regarding personal security will change.

As an aside, the strength of LastPass master passwords can be an issue. I currently use LastPass, and the master password I initially created was not very different from passwords I used on other sites. Those of the HKS community that are most vulnerable, i.e. the people that repeat passwords or create simple passwords, will probably not use the application well. People are consistently told to create new, long, and difficult passwords to remember and they don’t. Why would they do it now with their LastPass master password? If users even put all of their passwords within LastPass, their password may just be a repeat of past passwords. While the LastPass vault is localized to your device, simple passwords still leave you vulnerable to people with access to your device.

Administratively, this would also be a tremendously difficult policy to effectively enforce. It would be very difficult, expensive, and invasive to check every HKS member’s personal device to check for the installation of LastPass. Beyond this step, HKS has no way to check if people are properly using the service. HKS can’t know people’s passwords and their strength – that would eliminate the point of the service. It’s also worth mentioning, does HKS have the right to invade people’s privacy by introducing a password manager? People have passwords for much more than HKS services, and forcing people to use LastPass may infringe on people’s personal rights.

Costs vs. Benefits

I believe the potential security benefits from LastPass are not worth the hassle of enforcing a compulsory usage policy. At its core, this policy would not significantly change the values and interests of target populations at HKS. Many people don’t want to think about their passwords or security and are fine with the status quo. Those that value security most likely would use the application without prompting. Additionally, the administrative costs of this policy would be immense in order to monitor so many personal devices.

For a great cost, this policy would maintain the protection of those that already valued security, and likely leave those that don’t care in similarly vulnerable position. This would do little to improve the security situation of the University for a very great cost.

Alternatives

• Internet fluency courses for students and faculty
  • Exposing them to the real-life digital dangers through cases and high quality information
  • Can change motivation, which in turn, could change behavior
  • For students, it could be a part of our “very mandatory” orientation
• Focus on Other HKS Digital Security Concerns
  • Address a different threat
  • Ex: Unmanned computers all over campus people can access

Let’s try to be better than Canada with our data…

Given a mandate from the Governor of Massachusetts with a budget of $1 billion, I have a plan to make the state of Massachusetts a platform. At least, I have some general principles and guidelines. Of course, in the real world, giving me, a 22 year old, $1 billion and complete freedom to transform a state’s government may be ill-advised…But let’s dive right in!

What Does a Platform Government Look Like

By definition, the platform for the State of Massachusetts would just create standards for others to build off of. To paraphrase Tim O’Reilly, this approach assumes that people provide value to the government rather than the dogma that people pay taxes and expect services from the government. My platform government would include:

1. A User-Focused website/experience
   • The entire purpose of making government a platform is to receive input and innovation from people outside of government itself. This requires government to tailor its services to users to maximize their participation. Websites and services should be easy to access, devoid of excessive questions, and empathetic to the user experience. This will allow people to maximize the platform and truly build off of it.
2. Open Data Available to All
   • This is key for participation from people throughout Massachusetts and beyond. By providing open data, which does not include things like personal data, people can use this resource to improve society. For example, organizations and individuals can build off of government data and produce apps or policy solutions to problems in society. Then government can work with these people to scale solutions based off of these innovations. Open data is key to granting people access to their government and creating an environment where innovation is possible
3. Simple Standards for Use/Regulation
   • Part of the job of government, even as a platform, is to regulate the use of its services. That being said, these should not be extremely cumbersome. As someone who interned for a Congressman, I learned the application process for services like Medicare and Medicaid stand as large examples of how NOT to do this. For example, just to receive durable medical equipment included in your Medicare, people have to find the correct page under “how to file a claim” on the Medicare website, print and fill out a four page document, then mail it to differing locations based on their state of residence. After that, waits can vary for this extremely important equipment. Check out this cumbersome process here.
   • The standards and regulations governments put on their services should be transparent, and easy to use and understand.
4.  Government as Iterative and Flexible
   • With government as a platform, Massachusetts will not be able to predict what is built off of their services. Without an understanding of what the future will hold, government needs to adapt quickly. Whatever people demand, use frequently, and innovate should dictate how government needs to change to address those demands. Government needs to frame itself as a facilitator.

Let’s Get Specific: Which Services Do I Address?

Making the Massachusetts state government into a platform can’t happen immediately, so I need specific criteria that will help me create an order of operations. Below are questions/criteria I will consider in choosing my first areas of concern:

1. Which government services are used the most by citizens
2. What government services are most criticized
   • Both of these address a common thread: “as a user, what services do I care about the most and think improvement is most necessary”
3. Which government problems burden people the most?
   • Which ones burden government officials the most?
4. What government service’s data is most useful to people/businesses?
5. What are the largest issues people have with their government?
   • Does anything relating to ease of access or user experience underly these issues?
6. What do I have the capacity to initially change?
7. What is a good service/problem to address to gain support for my grand plan, thus, allowing me more money, creative license, and room to fail

The point of this list of criteria is to determine individual/government interests, priorities, and a gauge of the government’s ability to make a change. My starting point will need to be targeted to make the largest possible impact in people’s lives with my current capacity so my platform concept gains popularity. This should help slow-moving government more quickly adopt my approach, and give me latitude to work with other issue areas in the future. My first step, more than anything, needs to make a noticeable difference in our user’s lives.

My Governance Model

Decision Structure

Borrowing the approach of a place like Estonia, I would try to create a system of shared data among each of the departments in the Massachusetts state government. As pictured, each department should have access to a common “internet” source of data once passing through certain security. This would remove repetition in the data each branch of government stores while allowing each department to benefit from the information of others.

Operating Procedure

Through establishing set standards for information, different cities in Boston could contribute data in one format on their residents that would then be available to all of the state departments on the network. This network could then have open data, with certain regulation on sensitive material, that cities, citizens and the state could access through the network. Additionally, this would connect people to State services.

People in the state of Massachusetts could access their profile of information by logging into a portal where they will have access to their data and open data of the government. This portal will grant citizens access to the services they need from the state government.

Encouraging Collaboration

People, through their profile, should be able to upload data, submit recommendations, and communicate with their local governments about concerns or ideas of service. After city review, these can be released in the common internet space for relevant state departments to review and address these concerns. This will allow citizens and cities to better communicate with state government, allowing it to be adaptive to real-time citizen concerns

This sort of plan could be feasible in the state of Massachusetts because it only has 6.8 million people. Estonia, for example, only contains about one million people, making this sort of project attainable. Massachusetts is in a similar position to make this work. This sort of coordination among cities and the state government would me much more difficult in one of the more populous states, like Texas or California. But, Massachusetts should not be too large to handle this kind of system.

My plan for the state of Massachusetts to move to a platform is aspirational, but there are key ideas than can help any government improve its services. Anything to move beyond sticky notes in government…