From: "L. Detweiler" <ld231782@longs.lance.colostate.edu>
Date: Mon, 25 Oct 93 00:28:47 PDT
To: cypherpunks@toad.com
Subject: the Joy of Pseudospoofing
Message-ID: <9310250728.AA09485@longs.lance.colostate.edu>
MIME-Version: 1.0
Content-Type: text/plain


Not a single person has said they understand what I have been talking
about in describing the evils of pseudospoofing. Let me be more
specific. I hope anyone with additional comments can send me email.

First, I've been talking about `pseudospoofing' as if what it connotes
is obvious, but let me be absolutely thorough. Suppose a person created
an entire fake identity. Jim Riverman, a software engineer, working in
CA. Subscriber to the cypherpunks. Expert in number theory and NSA
arcania. Posts very authoritatively to the list, and when he does its
short and sweet, and a keeper. Even has a phone number. Has a nice
signature complete with a cute quote: `death is the ultimate form of
censorship' along with his phone number (work). Signed up on a public
access Internet system that requires no authentication of identity.
Address jr@netcom.com. Perhaps he has even described his troublesome
toils in software development projects with a large company. Cultivated
personal relationships with people in email.

But JR does not exist. He is the figment of somebody's imagination,
let's call her Medusa. The phone number reaches her. When she gets a
call on the `JR' phone she speaks in a deep voice and talks about
software development. It's rather rare that anyone calls anyway, and
she rather loathes it when it happens and does not encourage anyone to
do so. She's very guarded in phone conversations, and often takes the
offensive stance by asking questions. `What are you calling about?'
`Why should this be important?' etc. She never volunteers personal
information under the JR voice for obvious reasons.

She uses the jr@netcom.com account in a very systematic way. When she
has interesting information she is very careful about presenting it in
a way that maximizes her posting reputation under the JR pseudonym. If
the information is related to his personality, she posts it under his
identity in a characteristic way, perhaps even with consistent
mispellings and a certain style. She never posts uncharacteristically
under JR, such as talking about some other arbitrary subject she's
knowledgable on but would be a bit surprising if JR said anything about it.

Okay, let's stop and take note of this. Is any `deception' going on
here? Absolutely. Should this be permitted? I don't think so, but
perhaps others do. (Certainly many have contacted me to say so.) Many
are saying `you can't prevent this' etc. `it's harmless and her
cyberspatial right to build up her reputation under a digital pseudonym.'

So, let's go further and explore this. Suppose Medusa also has an
account snake@netcom.com. She cultivates another personality and
reputation from that address, as an authority on mail forgery, guerilla
warfare, and sabotage. Again, she is careful to never post on
`uncharacteristic' subjects, *particularly* those that would overlap
with JR, because that would cast suspicion on the uniqueness of the two
identities. Is all this still OK with everyone?

* * *

But let's now look at the interplay of postings on a mailing list. The
whole point is that a *dialogue* is in action, right? That's the draw.
The mailing list is not just a endless series of contextless messages
existing independently (quite contrary to what a lot of
`pseudothinkers' have been telling me lately). People respond to each
other, carry on conversations, quote each other, flame, criticize,
comment, contradict, rebut, reject, congratulate, even lauch private
email conversations from public postings. (And these private dialogues
can be highly rewarding, in many ways more than reading the list
itself, which tends to be `noisy'.)

And, in fact, all this feedback is actually the *basis* of the best
reputations. When someone posts something that is extremely relevant to
the conversation at hand, their reputation in the eyes of their
colleagues increases. When they rebut an argument with a stellar
comeback, their own esteem is raised in the eyes of the group just as
the victim's is lowered. When they post something that is authoritative
on a given subject, again they are admired. `posting is reputation'.

Finally, there can even be an interplay *behind the scenes* of the
mailing list. People might organize meetings or go to parties with
people they have met on the list. For some, this is sort of the holy
grail of online interaction, and gives it true meaning. The interplay
of reputations between this and a mailing list is complex. Someone's
reputation might be raised or lowered because of their `realspace' vs.
`cyberspace' personas. And the possibilities of outside project
development can be extremely important, especially if a mailing list is
designated to discuss some endeavor, say PEM software standards or whatever.

* * *

But the problem with all this is that in a regular social setting,
there are some very ancient, venerable, and sophisticated rules
involving propriety and courtesy of communication that break down
dangerously on any online `forum' when a single person has multiple
pseudonyms, and these `subversive uses' are what I will expand on.

For example, many people become annoyed when someone talks too much,
roughly analogous in cyberspace to postings that are too long or too
frequent. In fact, this repulsion may be so strong as to cause people
to reject messages simply because of it and irrespective of content
(which might nevertheless have consistently high or at least above-average quality).

Moreover, many people are highly annoyed by others who are constantly
stroking their own fragile egos. `I am great because I did this.' It's
quite nauseating at times with some! People often tune out or reject
comments like this with something like `mental filters'. Reputations
can be affected in extreme cases. `Oh, that JR is so quiet.' `Oh, that
Medusa is so vain.'

Also, some people turn out to be control freaks, and various degrees of
clever euphemisms can be used to hide their inherent dominative
tendencies. `You do this because I say so.' `That is the wrong way to
do what you want to do.' `*work* with me!' `you are being uncooperative'.

The final and most important aspect of group communication psychology
is that of *consensus* and *peer pressure*. This can be an
extraordinarily powerful force. Many people are `lurkers' and are most
influenced by what they perceive to be other's opinion on various
subjects, or the general group feelings as gauged through multiple
postings. They are unlikely to question what they read.

* * *

Now let's look at how some of these proprieties can be thwarted to the
detriment of community by use of pseudospoofing, in the case of Medusa
and JR. First, notice that a single person could get away with far more
postings if they all successfully matched the online personas. In fact,
this could become quite a problem with traffic on the list at very high
levels with everyone actually trying to *break apart* their posts into
different identities to maximize the reputations associated with each
-- a rather bizarre disincentive.

A sort of anti-respect might develop for people who take the time to
write long postings. They would look atypical in the forum. They might
even be perceived as being egotistical and simply trying to assuage
their own reputation through a lot of concerted effort under a single
identity. Have you ever met anyone who hated you the more you
accomplished and the more successful you were? This translates very
directly into the cyberspatial realm.

This leads directly into the ego case. What about people who are simply
out to assuage their own ego? Suppose Medusa wishes to do this. She
could `stage' very clever situations where jr@netcom.com says `I heard
that Medusa knows a lot about industrial sabotage, and am always
fascinated by her posts.' Medusa pops up a few messages later under
snake@netcom.com and says `Thanks Jim, I really respect your knowledge
of number theory too, and I hope you can provide some more updates on
it' and launches into an amazingly relevant post, considering what Jim asked about.

So, cypherpunks, what do you think of that? This strikes me as rather
perverted. In reality, if Jim and Medusa were different entities, this
would generate significant respect for both. But if they were the same
entity, this would just be a twisted deception. And anyone who found
out about it might feel very misled and disillusioned. Someone had
created the false impression of reputation that was nothing but a sham.

Of course, this all seems very implausible. Why would anyone go through
*so much trouble* to do this? the problem is that we can ask this
problem about a lot of `criminal' behaviors, and the situation is that
every perversion known to man has been practiced at some time or
another, *especially* when circumstances permit it. If there are
certain people who are so consumed by reverence for online reputation,
multiple personality fantasies from e.g. fiction, and getting away with
clever deceptions, they would be *drawn* to an environment where this is possible.

A person with a very fragile ego would be drawn into defending all of
`its' identities with the different online personas. If someone
attacked snake@netcom.com, a message from jr@netcom.com might pop up
saying that `Medusa is my best friend, and you're a paranoid ranter.'
This is like having `someone else' do the dirty work for you, and with
great irony that `someone else' is yourself. In very extreme cases,
suppose that Medusa has a cherished belief, for example, in the basic
propriety of multiple personality disorder. If that was ever questioned
on the list by anyone, perhaps she would be so upset as to engage
*both* jr@netcom.com and snake@netcom.com.

Let's now look at the penultimate case, where someone is a control
freak. Suppose they wished to create support for a project or inhibit
others working on a project not within their agenda. Whenever someone
pops up, they are flamed. `Medusa knows what she is talking about. I
heard that she has done all these things. Don't do anything until you
have talked to her.' `Thank you! That's quite correct! Anyone involved
with this should contact me personally, or wait until we are finished.
It's definitely in the works.'

Finally, let's look at how peer pressure can be influenced by these
pseudonymous postings of Medusa's. Obviously, she has created the
illusion of support or rejection of something that is not consistent
with reality. It is a deception. People may have lowered or raised
their opinion of something merely because they saw multiple posts
criticizing the same thing, when they all came ultimately from Medusa.
In the absolute worst case they would alter their *real space*
activities or perceptions, perhaps thinking that someone else is a jerk
and avoiding meeting them in person, or giving up work on a particular
project because someone else was apparently farther along.

By this time it should be clear that Medusa does not really have any
ethics or morality, if she is going to deceive and manipulate people
like this. She might even create imaginary `realspace' illusions to
augment her elaborate cyberspatial fantasies. She might make up
progress reports on various projects, and have various details
confirmed by JR. If someone pops up on the list saying `I haven't seen
anything going on with this' JR would pop up and say `don't worry, you
can be sure that it's happening.' These fantasies would totally pollute
and poison any trust in an online community. It could be compared to brainwashing.

* * *

Let's add some new dimensions to our little thought experiment. Suppose
that the possibility of *private* email is added to all these areas,
and that *very many* pseudonyms could be maintained with a minimum of
effort. First, again, the `talk too much' case. If someone is posting
too often, Medusa would not like that because it detracts from her own
arsenal of pseudonymous identities. She would flame from her array of
identities in public postings. If the person persists, she could
assault him with private email, especially in the one-two form `I
really admire and respect what you've done, but you've really got to be
quieter.' The first half of the sentence generates respect, and the
second half manipulates the listener. 

And if someone got this flame from *both* JR and Medusa in private
email, they might be quite intimidated. `gosh, these cypherpunk members
seem to know what they are talking about, and they say I'm out of line,
so I better cut it out.' Even if the person had never `met' these
identities before, they could be manipulated. In fact, totally
arbitrary new identities could be created and still influence some
people. `this person is responding to my public posting, so s/he
obviously is a contributing member and his opinion counts. If they are
telling me to shut up, I'd better be quiet. Especially if JR, a
software engineer who I have a great deal of personal respect for says
so.' Even if other cypherpunks would be aghast to find out there were
behind-the-scenes flames going on, they might never know. Some people,
while at the same time just deleting flames, can be very upset by them.

Note that in all these cases, if any of this was going on in `real
world meetings' it would be considered shocking depravity. In the
online realm, some are championing it all as `newly liberating freedoms
from true anonymity'. Note that if these messages were sent
*anonymously* there would not be much of a problem. People would
realize they could be coming from anyone, including the known
powermongers on the list, and dismiss them without too much value.

Now let's look again at the `ego' case. This can be *extremely*
compelling when orchestrated via multiple identities and private email.
Imagine a person criticizes Medusa on the list, and gets a barrage of
public and private flames. `You are really way out of line here. Medusa
has done all of these things for the cypherpunks.' There could be all
kinds of `damage control' where different pseudonymous entities try to
clean up the holes, each one addressing a different aspect of the
criticism. All this could be done without snake@netcom.com ever sending
*anything*! An entire illusion of respect for an entity could be
manufactured. It might look something like an `elite clique' to anyone
who didn't know there was a single entity behind the postings.

Again, the case of the control freak. Obviously the ability to create
the illusion of consensus in public postings and private mail would be
extremely dangerous but very enticing for Medusa, who has no
compunctions about deceit and treachery. A megalomaniac would be quite
drawn to the capability. They would even be interested in developing
powerful software to keep track of all the identities to prevent any
`crossings' (a leak of information that reveals a link between
identities). What's to prevent them? Certainly not a personal
conscience. With all of this, quite a barrage of misinformation could
be orchestrated, a sort of mental invasion campaign. Medusa could
systematically `break down' any resistance to her evil plans for world
domination <g> `behind the scenes' without anyone ever knowing it. If
anyone said something, they would be accused of harboring bizarre
conspiracy theories and violating the trust of personal email.

Finally, what about the idea of consensus and peer pressure under this
system? I think it has become clear that an entire *movement* could be
faked with this system. A mailing list could turn into a sort of
international brainwashing machine for Medusa's evil agenda. Combine
the possibility that there is more than one Medusa -- perhaps she has
several sisters. They are all conspiring behind the scenes to break
down resistance, confuse and obfuscate their opponent's arguments with
psychological mind-bombs, and promote it all under something like
Liberation of the Universe. An ingenous tactic would be to litter the
mailing list with pseudospoofed posts that attack irrelevant points and
obscure the original messages of real people. Who would ever know? What
would prevent it? What is our protection? After all, creating multiple
identities and pseudospoofing is a fundamental right of cyberspace,
right? With it, the liberation of the world is at hand!

Another astonishing possiblity is that Medusa is actually present on
*multiple* mailing lists and newsgroups. She could assault people in
all kinds of ways. She might see that someone she hates has posted to
some arbitrary list, and try to strike up a new conversation with them
with a unique tentacle. The person would be *wholly* unsuspecting
because of the `distance' of the body and the tentacle. He might let
strategic information slip to Medusa that compromises his protection
and privacy based on this empty trust.

Obviously, all this would be *extremely* difficult to detect,
especially if no one had the capability to trace even pseudonymous
identities to unique people. There would be various suspicious signs,
however. If `newbies' consistently popped up out of nowhere to ask
seemingly staged questions, provide setups, or comment on issues they
would presumably have little knowledge to do so (such as the general
list quality, the `movement', etc.) it would look very suspicious. 
Let's say that Medusa was extremely sensitive about `newbie flames'
because she had been accused in the past of being hostile to newcomers.
She might stage a routine where she helps out a `newbie' just to
deflect the criticism and `prove' that she is actually very gracious.
She would post to reaffirm that. `Why, I just helped out that newbie
with the book reference.' If anyone who was confronted about the
possibility of personally pseudospoofing instead deflected concern with
satire and no specific denials, it would also be suspicious.

* * *

The very final possibility of pseudospoofing I would like to describe ,
perhaps the most treacherous and evil, is the following. Suppose Medusa
not only had no ethics and morality, but was actually Satan in
disguise. Suppose that she liked to torment and `punish' people with
her `tentacles' whenever they `misbehaved', measured by their
resistance to her oppression. She could be quite unpleasant, don't you
think? She could consistently flame their arguments from different
tentacles even if the posts were intelligent, just out of spite. She
might bait them and say `I have some information for you' and when they
reply in a query, snatch it from their fingers. She might have all her
sisters try to work on the person in particular and break them down.
`You are not going to have any friends if you keep this up. Why are you
such a troublemaker, anyway? You are rude and have no manners. You need
to grow up and stop thinking that everyone is out to get you. That path
leads to madness.' Or, if the person has recognized the brainwashing
and is amidst flight, she could try to lead him back to darkness. `Oh,
I so enjoyed your posts, please reconsider.' This from a tentacle the
victim has never heard from before.

Now imagine the most fantastic possibility of all, that Medusa is so
interested in tormenting a certain (from her view) `uncooperative'
individual that she no longer even cares about converting him. Let's
call him Luke Skywalker. Even the arguments like `I am your father,
join the dark side, and together we can rule the universe' from many
other tentacles have failed.

In utter desperation she might still endeavor to build up another
situation to simply gain his trust, say, with even a respectable Jim
Riverman tentacle. `Luke -- I saw your post on lightsaber techniques,
and I'm really impressed.' She could try to cultivate the trust over a
long series of posts by responding to questions and revealing some
simple information she knows would interest him. `yes, there seems to
be some kind of clique or conspiracy going on'. Then she would slip in
things like `what do you know about it?' `what do you think of Medusa,
anyway?' Or, if she already knew that Luke thought she was evil, she
might say `Luke -- that bastard Medusa has really gotten to me too. You
should see my newbie posts she flamed me over! I don't know what to do.
What are you going to do?'

If Luke were naive, gullible, trusting, open, and honest, he might let
very serious strategic information leak, partly in the hopes that Jim
Riverman could help him personally, and together they could choke the
monster. But Luke would just be betrayed by yet another tentacle. What a pity.

* * *

But perhaps you think otherwise! Ah, the Joy of Psuedospoofing. Let
Medusa and Her head of snakes thrive in Cyberspace, and let's all bathe
in the beauty of Her radiance! Weekly virgin sacrifices on the altar of
the Death Star!

A person said to me, `I think the Usenet credo, `live with it',
applies.'  another said, `that which cannot be enforced should not be
prohibited.' another said, `if I were to prevent you from posting to
the list, that would not be censorship.' another said, `bowel
movement?' another said, `the assertion that [T.C.May] is Jamie
Dinkelacker is just too bizarre to be believed.' another said `on that
path lies madness'.

--

``Death is the ultimate form of censorship.'' (author unknown)

Jim Riverman
Software Engineer
jr@netcom.com
(415) 941-4782 [work]