# data[].attributes.attachment_link.readable_text
If you're looking for the best VPN for torrenting, privacy, bypassing censorship, staying anonymous online, getting around geographic restrictions, or just location shifting, you've got a lot of confusing choices. Keep reading as we help you pick the right VPN for you.

VPNs, or Virtual Private Networks, are a quick and easy solution to making your computer appear to be coming from a different location. They accomplish this by creating a virtual network that routes all of your PC or smartphone's network traffic through an encrypted tunnel and out the other side, making it seem to the world that you're actually in whatever location the VPN server is located. This can help you bypass geographic restrictions, avoid censors, or keep you (relatively) anonymous online.

The problem is that there are scores of different VPN providers out there, and a ton of different reasons to use one - so which one do you choose?

Don't Feel Like Reading Everything? Here's the TL;DR Version

This article has a lot of information, and you probably just want to install a VPN so you can try to watch your favorite TV show or movie on a streaming service on the other side of the world that's unfairly been geographically restricted, or you're looking for something that can protect you while you're torrenting.

So here are our top choices and why we picked them:

ExpressVPN is our top choice if you're looking for simple, easy-to-use clients for every Windows, Mac, Android, iPhone, or Linux, blazing fast speeds that can handle torrenting or bypassing geographic restrictions, and just a generally pleasant experience. They have a 30 day money-back guarantee as well.

StrongVPN is a great choice if you're looking for blazing fast speeds, and a VPN that can handle torrenting and bypassing geographic restrictions. The clients are a little outdated in comparison, but since it's a lesser known service it sometimes is less likely to be blocked. They have a 30-day money-back guarantee.

Tunnelbear is a solid choice if you're looking for a quick VPN connection to use at the coffee shop - they have a limited free trial tier and cheap prices, and while they aren't quite as powerful or fast, they have a really nice service.

Again, if you're looking for a VPN to bypass restrictions, try out one of the services above. They've all got cheap prices and a 30 day money-back guarantee, so you've got nothing to lose.

What Is Virtual Private Networking, and Why Do People Use It?

Through the use of software (and sometimes, at the corporate and governmental level, hardware) a VPN creates a virtualized network between two physically separate networks.

VPN use, for example, allows an IBM employee to work from home in a Chicago suburb while accessing the company intranet located in a building in New York City, as if he was right there on the New York office's network. The same technology can be used by consumers to bridge their phones and laptops to their home network so, while on the road, they can securely access files from their home computers.

VPNs have other uses cases, though. Because they encrypt your connection, VPNs allow users to prevent others from seeing the data they're transferring. This keeps data secure, particularly on public Wi-Fi networks in places like coffee shops and airports, ensuring no one can snoop your traffic and steal your passwords or credit card numbers.

Since VPNs route your traffic through another network, you can also make it appear as if it's coming from another location. That means if you're in Sydney, Australia, you can make your traffic appear to come from New York City. This is useful for certain sites that block content based on your location (like Netflix). It also allows some people (we're looking at you, Australians) have to deal with insanely high import taxes on software that see them paying twice (or more) what US consumers pay for the same products.

On a more serious note, an unfortunately large number of people live in countries with high levels of overt censorship and monitoring (like China) and countries with more covert monitoring (like the US); one of the best ways to get around censorship and monitoring is to use a secure tunnel to appear as if you're from somewhere else altogether.

In addition to hiding your online activity from a snooping government it's also useful for hiding your activity from a snooping Internet Service Provider (ISP). If your ISP likes to throttle your connection based on content (tanking your file downloads and/or streaming video speeds in the process) a VPN completely eliminates that problem as all your traffic is traveling to a single point through the encrypted tunnel and your ISP remains ignorant of what kind of traffic it is.

In short, a VPN is useful anytime you want to either hide your traffic from people on your local network (like that free coffee shop Wi-Fi), your ISP, or your government, and it's also incredibly useful to trick services into thinking you're right next door when you're an ocean away.

Assessing Your VPN Needs

Every user is going to have slightly different VPN needs, and the best way to pick the ideal VPN service is to take careful stock of what your needs are before you go shopping. You may even find you don't need to go shopping because home-grown or router-based solutions you already have are a perfect fit. Let's run through a series of questions you should ask yourself and highlight how different VPN features meet the needs highlighted by those questions.

To be clear, many of the following questions can be satisfied on multiple levels by a single provider, but the questions are framed to get you thinking about what is most important for your personal use.

Do You Need Secure Access to Your Home Network?

If the only use case you care about is securely accessing your home network to, then you absolutely do not need to invest in a VPN service provider. This isn't even a case of the tool being overkill for the job; it's a case of the tool being wrong for the job. A remote VPN service provider gives you secure access to a remote network (like an exit node in Amsterdam), not access to your own network.

To access your own home network, you want a VPN server running on either your home router or an attached device (like a Raspberry Pi or even an always-on desktop computer). Ideally, you'll run the VPN server at the router level for best security and minimal power consumption. To that end, we recommend either flashing your router to DD-WRT (which supports both VPN server and client mode) or purchasing a router that has a built in VPN server (like the previously reviewed Netgear Nighthawk and Nighthawk X6 routers).

If this is the solution you need (or even if you just want to run it in parallel with remote solutions for other tasks), definitely check out our article How to Set Up Your Own Home VPN Server for additional information.

Do You Need Secure Casual Browsing?

Even if you aren't particularly security or privacy conscious, everyone should have a VPN if they regularly use public Wi-Fi networks. When you use Wi-Fi at the coffee shop, the airport, or the hotel you're staying at while traveling cross-country, you have zero idea whether or not the connection you're using is secure.

The router could be running outdated and compromised firmware. The router could actually be malicious and actively sniffing packets and logging your data. The router could be improperly configured and other users on the network could be sniffing your data or probing your laptop or mobile device. You never have any guarantee whatsoever that an unknown Wi-Fi hotspot isn't, either through malice or poor configuration, exposing your data. (A password doesn't indicate a network is secure, either-even if you have to enter a password, you could be subject to any of these problems.)

In such scenarios, you don't need a beastly VPN provider with massive bandwidth to secure your email, Facebook, and web browsing activities. In fact, the same home VPN server model we highlighted in the previous section will serve you just as well as a paid solutions. The only time you might consider a paid solution is if you have high-bandwidth needs that your home connection can't keep up with (like watching large volumes of streaming video through your VPN connection).

Do You Need to Geo-Shift Your Location?

If your goal is to appear as if you're in another country so you can access content only available in that are (e.g. BBC Olympic coverage when you're not in the UK) then you'll need a VPN service with servers located in the geographic region you wish to exit the virtualized network in.

Need UK access for that Olympic coverage your crave? Make sure your provider has UK servers. Need a US IP address so you can watch YouTube videos in peace? Pick a provider with a long list of US exit nodes. Even the greatest VPN provider around is useless if you can't access an IP address in the geographic region you need.

Do You Need Anonymity and Plausible Deniability?

If your needs are more serious than watching Netflix or keeping some war kiddie at the coffee shop from snooping on your social media activity, a VPN may not be for you. Many VPNs promise anonymity, but few can actually provide it-and you're still trusting the VPN provider with access to your traffic, which isn't ideal. For that, you likely want something more like Tor, which- while not perfect -is a better anonymity solution than VPNs.

Many users do, however, rely on VPNs to create some plausible deniability when doing things like file sharing on BitTorrent. By making their traffic appear as if it's coming from a different IP address, they can put one more brick on the wall obscuring them from others in the swarm. Again, it isn't perfect, but it is helpful.

If that sounds like you, you want a VPN provider that doesn't keep logs and has a very large user base. The bigger the service, the more people poring through every exit node and the more difficult it is to isolate a single user from the crowd.

A lot of people avoid using VPN providers based out of the United States on the premise that US law would compel those providers to log all VPN activity. Counterintuitively, there are no such data logging requirements for US-based VPN providers. They might be compelled under another set of laws to turn over data if they have any to turn over, but there is no requirement they even keep the data in the first place.

In addition to logging concerns, an even bigger concern is the type of VPN protocol and encryption they use (as it's much more probable a malicious third party will try and siphon up your traffic and analyze it later than they will reverse engineer your traffic in an attempt to locate you). Considering logging, protocol, and encryption standards is a great point to transition into the next section of our guide where we shift from questions focused on our needs to questions focused on capabilities of the VPN providers.

Selecting Your VPN Provider

What makes for a VPN provider? Aside from the most obvious matter, a good price point that sits well with your budget, other elements of VPN selection can be a bit opaque. Let's look at some of the elements you'll want to consider.

It's up to you to answer these questions by reading over the documentation provided by the VPN service provider before signing up for the service. Better yet, read over their documentation and then search for complaints about the service to ensure that even though they claim they don't do X, Y, or Z, that users aren't reporting that they are in fact doing just that.

What Protocols Do They Support?

Not all VPN protocols are equal (not by a long shot). Hands down, the protocol you want to run in order to achieve high levels of security with low processing overhead is OpenVPN.

RELATED: Which is the Best VPN Protocol? PPTP vs. OpenVPN vs. L2TP/IPsec vs. SSTP

You want to skip PPTP if at all possible. It's a very dated protocol that uses weak encryption and due to security issues should be considered compromised. It might be good enough to secure your non-essential web browsing at a coffee shop (e.g. to keep the shopkeeper's son from sniffing your passwords), but it's not up to snuff for serious security. Although L2TP/IPsec is a significant improvements over PPTP, it lacks the speed and the open security audits found with OpenVPN.

Long story short, OpenVPN is what you want (and you should accept no substitutions until something even better comes along). If you want the long version of the short story, definitely check out our guide to VPN protocols for a more detailed look.

There's currently only one scenario where you would entertain using L2TP/IPsec instead of OpenVPN and that's for mobile devices like iOS and Android phones. Currently neither Android nor iOS supports native OpenVPN (although there is third-party support for it). Both mobile operating systems do, however, support L2TP/Ipsec natively and, as such, it's a useful alternative.

A good VPN provider will offer all of the above options. An excellent VPN provider will even provide good documentation and steer you away from using PPTP for the same reasons we just did. You should also check the pre-shared keys they use for those protocols, since many VPN providers use insecure and easy-to-guess keys.)

How Many Servers Do They Have and Where?

If you're looking to access US media sources like Netflix and YouTube without geo-blocking, then a VPN service with the majority of its nodes in Africa and Asia is of very little use to you.

Accept nothing less than a diverse stable of servers in multiple countries. Given how robust and widely used VPN services have become it isn't unreasonable to expect hundreds, if not thousands, of servers across the world.

In addition to checking how many servers they have and where those servers are located, it's also wise to check into where the company is based and if that location aligns with your needs (if you're using a VPN to avoid persecution by your government, then it would be wise to avoid a VPN provider in a country with close ties to your country).

How Many Concurrent Connections Are Allowed?

You might be thinking: "I only need one connection, don't I?" What if you want to set up VPN access on more than one device, for more than one family member, on your home router, or the like? You'll need multiple concurrent connections to the service. Or, perhaps, if you're particularly security oriented, you'd like to configure multiple devices to use multiple different exit nodes so your collective personal or household traffic isn't all bundled together.

At minimum, you want a service that allows for at least two concurrent connections; practically speaking at the more the better (to account for all your mobile devices and computers) and with the ability to link your router to the VPN network is preferable.

Do They Throttle Connections, Limit Bandwidth, or Restrict Services?

ISP throttling is one of the reasons many people turn to VPN networks in the first place, so paying extra for a VPN service on top of your broadband bill just to get throttled all over again is a terrible proposition. This is one of those topics some VPNs aren't perfectly transparent, about so it helps to do a little digging on Google.

Bandwidth restrictions might not have been a big deal in the pre-streaming era, but now that everyone is streaming videos, music, and more, the bandwidth burns up really fast. Avoid VPNs that impose bandwidth restrictions unless the bandwidth restrictions are clearly very high and intended only to allow the provider to police people abusing the service.

In that vein, a paid VPN service restricting you to GBs worth of data is unreasonable unless you're only using it for occasional, basic browsing. A service with fine print that restricts you to X number of TBs of data is acceptable, but really unlimited bandwith should be expected.

Finally, read the fine print to see if they restrict any protocols or services you wish to use the service for. If you want to use the service for file sharing, read the fine print to ensure your file sharing service isn't blocked. Again, while it was typical to see VPN providers restrict services back in the day (in an effort to cut down on bandwidth and computing overhead) it's more common today to find VPNs with an anything-goes policy.

What Kind of Logs, If Any, Do They Keep?

Most VPNs won't keep any logs of user activity. Not only is this of benefit to their customers (and a great selling point) it's also of huge benefit to them (as detailed logging can quickly consume disk after disk worth of resources). Many of the largest VPN providers will tell you as much: not only do they have no interest in keeping logs, but given the sheer size of their operation they can't even begin to set aside the disk space to do so.

Although some VPNs will note that they keep logs for a very minimum window (such a only a few hours) in order to facilitate maintenance and ensure their network is running smoothly, there is very little reason to settle for anything less than zero logging.

What Payment Methods Do They Offer?

If you're purchasing a VPN for securing your traffic against snooping Wi-Fi nodes while traveling, or to route your traffic safely back to the US, anonymous payment methods aren't likely a very high priority for you.

If you're purchasing a VPN to avoid political persecution or wish to remain as anonymous as possible, then you'll be significantly more interested in services that allow for payment through anonymous sources like cryptocurrency or gift cards.

You heard us right on that last bit: a number of VPN providers have systems in place where they will accept gift cards from major retailers (that are totally unrelated to their business) like Wal-Mart or Target in exchange for VPN credit. You could buy a gift card to any number of big box stores using cash, redeem it for VPN credit, and avoid using your personal credit card or checking information.

Do They Have a Kill Switch System?

If you are depending on your VPN to keep your activities even mildly anonymous, you need some sense of security that the VPN isn't just going to go down and dump all your traffic out into the regular internet. What you want is tool known as a "kill switch system". Good VPN providers have a kill switch system in place such that if the VPN connection fails for any reason it automatically locks down the connection so that the computer doesn't default to using the open and unsecured internet connection.

Our Recommendations

At this point, your head might be understandably spinning at the thought of all the homework you've got ahead of you. We understand that selecting a VPN service can be a daunting task and that even armed with the questions we outlined above you're just not sure where to turn.

We're more than happy to help cut through all the jargon and ad copy to help get the bottom of things and, to that end, we've selected three VPN service providers that we have direct personal experience with and that meet our VPN selection criteria. In addition to meeting our outlined criteria (and exceeding our expectations for quality of service and ease of use) all of our recommendations here have been in service for years and have remained highly rated and recommended throughout that time.

StrongVPN

StrongVPN is a great choice, as it meets the needs of both power users and casual users alike. Prices start at $10 a month and drop quickly, when you purchase a year of service at a time, to $5.83 a month. The ease of setup is fantastic-if you're new to VPNs and/or don't have extra time to fuss with manual settings, you can just download their setup app for Windows, OS X, iOS, and Android to automate the setup process. If you want a more granular control or need to manually configure devices like your router, you can follow one of their many guides for different operating systems and hardware to do it manually.

StrongVPN has exit nodes in 43 cities, 20 countries, and supports PPTP, L2TP, SSTP, IPSec, and OpenVPN protocols-you'll be hard pressed to find a device you can't configure to use their service. There are no bandwidth caps, speed limits, or restrictions on protocols or services (torrenting, Netflix, you name it, they don't care). Additionally, StrongVPN maintains no server logs.

Although StrongVPN does limit you to two concurrent connections per account (not installation on two devices, mind you, two different connections at one time), you can configure your home router to connect to their service, so it's really more like you have a connect for at home and a connection for your device while you're out and about.

ExpressVPN

If you're looking for a VPN that has it all - easy-to-use client applications for every single platform, 2000+ servers across 94 different countries, blazing fast speeds, and security - you're probably going to choose ExpressVPN. They've got plans that start as low as $8.32 per month as of this writing, with a 30 day money-back guarantee.

ExpressVPN doesn't log, they don't block anything, and they have no bandwidth restrictions or limits. There are servers in basically any country you can imagine, and they are big enough to be able to handle a lot of customers.

Besides fast speeds, which are the most important factor in choosing a VPN, ExpressVPN definitely has the nicest clients across the widest array of devices - Windows, Mac, iPhone, Android, Linux, and they even sell routers pre-loaded with their VPN configuration.

TunnelBear

If you're looking for something free, look no further. If StrongVPN and SurfEasy are like like a solid mid-class sedan, TunnelBear is more like the econo-car (if you buy a TunnelBear subscription) or the city bus (if you use their generous free program). That's not a knock on TunnelBear, either-they've been around for years and their free service tier has been of great utility to people in need all over the world.

The free TunnelBear service offers up to 500MB per month. That's not a whole lot of data, but it's enough for occasional light browsing on public networks. If you need more data than that, you can upgrade to their professional accounts for $7.99 per month or $4.16 per month if billed annually.

The free account is limited to a single user, while the premium account enabled unlimited bandwidth for up to five computers or mobile devices. TunnelBear doesn't list the total number of servers on their site, but they do offer servers in 20 countries. Their Windows and Mac OS X client is based on OpenVPN and their mobile VPN system uses L2TP/IPsec. Unlike the previous two recommendations, however, TunnelBear has a firmer stance against file sharing activities and BitTorrent is blocked. Their speeds also aren't quite as fast as the others, so you might experience a slower connection with TunnelBear.

From a feature-to-dollar standpoint, TunnelBear's premium offering doesn't beat out our two previous recommendations. StrongVPN and SurfEasy are better bets if you're willing to pay. But, TunnelBear does offer a free tier, doesn't maintain logs, and it is extremely easy to get up and running with their dead-simple apps for desktop and mobile users alike.

Whether you're you're sick of your ISP throttling your connection, you want to secure your browsing sessions while on the road, or you just want to download whatever the heck you want without the man on your back, there's no substitution for a securely deployed Virtual Private Network. Now that you're armed with the knowledge necessary to pick a good VPN (and with three solid recommendations at that), it's time to secure your internet traffic once and for all.
Image Credits: Jared Scheel; Mike Mozart.

# data[].attributes.attachment_link.title
How to Choose the Best VPN Service for Your Needs

# data[].attributes.attachment_link.description
If you're looking for the best VPN for torrenting, privacy, bypassing censorship, staying anonymous online, getting around geographic restrictions, or just location shifting, you've got a lot of confusing choices. Keep reading as we help you pick the right VPN for you.

# data[].attributes.headline
Repeal of Online Privacy Protections 2017

# data[].attributes.subject
Repeal of Online Privacy Protections 2017

# data[].attributes.attachment_link.readable_text
SAN FRANCISCO - Congress on Tuesday moved to dismantle online privacy rules created during the Obama era. The rules, which were scheduled to take effect this year, would have required internet providers to get permission before collecting and selling a customer's online information, including browsing activities.

What does this mean for your privacy and what can you do? Here's what to know.

Congress voted to overturn rules created by the Federal Communications Commission in October that required broadband providers to get your permission before collecting private data on your online activities and offering it for sale to advertisers.

The truth is, you never had much online privacy.

The new F.C.C. rules had not taken effect, so you probably won't notice any difference. Internet service providers have always been able to monitor network traffic, see what websites you visit and share some of that information with advertisers.

Yes.

The new F.C.C. rules would have given consumers stronger privacy protections - without such restrictions, internet providers may decide to become more aggressive with data collection and retention. Expect more targeted advertising to come your way.

These companies provide your connection to the internet. Your gadgets are each assigned an identifier, called an IP address, and an internet provider can see which IP addresses are being used on your account.

When you are browsing the web, the service provider helps route your device's internet traffic to each destination website. In other words, internet providers can see which devices you use and which websites you visit and choose to retain that data.

Many privacy advocates say this a good time to consider investing in a virtual private network, or VPN. A VPN is a tunnel that shields your browsing information from your internet service provider and allows you to appear as if you are in a different location.

However, a VPN isn't a foolproof solution. A VPN service is also tied to a service provider, meaning a VPN provider could also share your information with the service provider if it wanted to, said Runa Sandvik, a director of information security for The New York Times.

In other words, you will have to pick a VPN provider that has a strong privacy policy and take a leap of faith.

Ms. Sandvik recommended Freedome by F-Secure and said TunnelBear was another popular option.

The Wirecutter, the product recommendations site owned by The New York Times, highlighted a service called Private Internet Access.

People who are concerned about their privacy might also consider using Tor, a type of software that helps internet users mask their online identities and whereabouts, Ms. Sandvik said.

Tor essentially encrypts your browsing activity and bounces a website request to multiple servers, decrypting layers of information about the request with every server "hop," which makes it difficult to see from where and whom the original request came.

Some services might break: for example, Netflix blocks VPN users from accessing its content. And Tor often makes web browsing sluggish.

Ms. Sandvik recommended using a combination of the two whenever it feels necessary - like when you are accessing sensitive information related to your work, for instance.

# data[].attributes.attachment_link.title
What the Repeal of Online Privacy Protections Means for You

# data[].attributes.attachment_link.description
SAN FRANCISCO - Congress on Tuesday moved to dismantle online privacy rules created during the Obama era. The rules, which were scheduled to take effect this year, would have required internet providers to get permission before collecting and selling a customer's online information, including browsing activities.

# data[].attributes.attachment_link.readable_text
Unlike iPhones, Android phones don't allow you to restrict an app's access to your location to just the moments when you're using it. Any app on Android that has your permission to track your location can receive the data even when you're not using it. In newer versions of Android, the collection of this data is limited to "a few times an hour," Google says.

To disable location services altogether, switch off "Use location," within the same Location settings described above. Google's instructions are here.

If you don't enable location services at all, you may not be able to use certain services, like finding yourself on a map. If you want to be able to switch periodically between having location services on and off, you can create a Quick Setting. To see your Quick Settings, swipe down from the top of your screen and tap the little pencil to edit.

If you have apps you no longer use, you may want to delete them from your phone.

The location data industry benefits from lack of regulation and little transparency, making it extremely difficult to get access to or delete this data. Your information can also be spread among many companies. And most of them store location data attached not to a person's name or phone number, but to an ID number, so it may be cumbersome for them to identify your data if you want to delete it - and they are under no obligation to do so.

In the European Union, people now have the legal right to request a copy of the data that companies hold about them, and to ask that it be deleted. The British data commissioner provides an explanation, here.

Google, a prominent collector of location data, lets users delete a segment of that information called their Location History. To do that, go to this page, then hit the Delete Location History button. Click it again when prompted. You can delete another segment of location data associated with your Google account by logging in and going to My Activity. Then click on Activity Controls and turn off Web & App Activity.

Jennifer Valentino-DeVries is an investigative reporter covering technology and public policy. @jenvalentino

# data[].attributes.attachment_link.title
How to Stop Apps From Tracking Your Location

# data[].attributes.attachment_link.description
Unlike iPhones, Android phones don't allow you to restrict an app's access to your location to just the moments when you're using it. Any app on Android that has your permission to track your location can receive the data even when you're not using it.

# data[].attributes.attachment_link.readable_text
Our laws offer students very little protection against the wiles of the technology industry.

By Dipayan Ghosh and Jim Steyer

Mr. Ghosh is a scholar of digital privacy. Mr. Steyer advocates protections for children who use technology.

Image

Credit Credit Lina Yu

This year, the media has exposed - and the government, including through guidance issued by the F.B.I. has begun to address - a string of harms to individual privacy by the technology sector's leading firms. But policymakers must intervene specifically to protect the most precious and vulnerable people in our society: children. Their behavioral data is continuously suctioned up by technology firms through tablets, smartphones and computers and is at risk of being misused.

For many American children, going to school means handing over personal data. The Summit "personalized learning" educational tool - a platform for online lessons and assessments that was developed by a charter school network with the help of Facebook engineers and is backed by the Chan Zuckerberg Initiative - has been criticized for asking parents to consent to sharing their children's personal data, including their names, internet activity and grades. Google has vastly expanded its reach into America's schools as more than half of students use its Gmail and Docs apps, and a majority of mobile devices shipped to schools are Chromebooks. Should the tremendous amounts of data underlying the operation of these kinds of services get into the wrong hands, our children's futures could be at stake.

Concerns over illegitimate sharing of and access to student data have been raised by parent groups, consumer watchdogs, and privacy advocates, many of whom have begun public awareness campaigns and legal battles. They're rightly worried, for example, about the fairness of college admissions processes that rely on student data profiles shared by personalized learning companies. Similarly, parents are concerned about the dispensation of financial awards including scholarships that are influenced by data that children have provided in surveys. In some cases the information doesn't include just things like grades and test scores but also covers categories like race, religion, address and whether they have "impairments" like H.I.V. or depression.

In 2014, inBloom, a nonprofit that offered to warehouse and manage student data for public school districts, announced that it would shut down, after parents objected to 400 categories of information, including children's reasons for absences and sensitive family relationships, being included in its database.

Beyond the collection of our children's education-related data, we don't want industry behemoths to profile our children and target them with advertisements and shady content. We don't want children to fear that anything they say or do online could be used against them someday. And we don't want technology companies to compete for our children's attention just so that they can claim their loyalties when they come of age to join a social media network, choose an email provider or purchase their first cellphones. It is not just about the protection of data; it is a matter of letting children learn and grow without concern about how their early preferences, talents and habits could shape the opportunities they have in the future.

But laws in the United States offer students very little digital privacy or security protection against the wiles of the industry.

Wherever the rules are muddy for the industry, we should make them resoundingly clear in such a way that protects our children and, implicitly, our national interest. If we have learned anything about Silicon Valley this year, it is that we cannot sit back and wait for the industry to voluntarily act on behalf of children; our government must intervene before more harm comes to them.

Tech companies should not be permitted to collect data on children and profile them using their personal data without a parent or guardian's meaningful consent to the data collection. In an educational setting, in which children might be denied the ability to participate in certain learning activities if their parents object, meaningful consent is a often simply not possible. They should not be allowed to market products to a child based on inferences about the child's behaviors, preferences, beliefs or interests, and they should not be allowed to sell or share a child's personal data to a third party under any circumstances. These protections, must be brought to every child in America.

We don't have to start from scratch. In 2014, Gov. Jerry Brown of California signed into law an important piece of legislation to protect children's privacy. Months later, President Obama pushed to federalize a similar approach through his announcement of the Student Digital Privacy Act. That bill, the culmination of years of advocacy and conversation, gained bipartisan support in the House and the Senate - but it continues to languish in Congress largely because of industry attempts to water it down. Another recent effort deserving broader support is the Do Not Track Kids bill, which too gained strong bipartisan support and would prohibit behavioral advertising targeted to children under the age of 13 - but the political impetus behind it has also fallen off in recent months.

National policymakers should act more decisively. They should reignite efforts in the House and Senate to federalize the California law, and we should tack on the additional measures proposed in the Do Not Track Kids bill. They should assure that industry efforts to encourage passage of a weak federal privacy law do not interfere with efforts made by state legislatures to protect students. More broadly, we cannot allow the industry to overtake the American classroom. The alternative - to enable commerce to rule the classroom - can only spell danger to the long-term educational interests of our children.

Dipayan Ghosh is a fellow at the Shorenstein Center at the Harvard Kennedy School. Jim Steyer is the chief executive and founder of Common Sense Media, a nonprofit organization devoted to improving media and entertainment for families.

A version of this article appears in print on , on Page A27 of the New York edition with the headline: Sacrificing Privacy for Education. Order Reprints | Today's Paper | Subscribe

# data[].attributes.attachment_link.title
Opinion | Kids Shouldn't Have to Sacrifice Privacy for Education

# data[].attributes.attachment_link.description
Our laws offer students very little protection against the wiles of the technology industry. By Dipayan Ghosh and Jim Steyer Mr. Ghosh is a scholar of digital privacy. Mr. Steyer advocates protections for children who use technology. This year, the media has exposed - and the government, including through guidance issued by the F.B.I.

# data[].attributes.attachment_link.title
DuckDuckGo - Protection. Privacy. Peace of mind.

# data[].attributes.attachment_link.description
The Internet privacy company that empowers you to seamlessly take control of your personal information online, without any tradeoffs.

# data[].attributes.attachment_link.readable_text
Security flaws threaten our privacy and bank accounts. So why aren't we fixing them?

By Cooper Quintin

Mr. Quintin is a senior staff technologist at the Electronic Frontier Foundation.

Image

Credit Credit Andrew Degraff

America's cellular network is as vital to society as the highway system and power grids. Vulnerabilities in the mobile phone infrastructure threaten not only personal privacy and security, but also the country's. According to intelligence reports, spies are eavesdropping on President Trump's cellphone conversations and using fake cellular towers in Washington to intercept phone calls. Cellular communication infrastructure, the system at the heart of modern communication, commerce and governance, is woefully insecure. And we are doing nothing to fix it.

This should be at the top of our cybersecurity agenda, yet policymakers and industry leaders have been nearly silent on the issue. While government officials are looking the other way, an increasing number of companies are selling products that allow buyers to take advantage of these vulnerabilities.

Spying tools, which are becoming increasingly affordable, include cell-site simulators (commonly known by the brand name Stingray), which trick cellphones into connecting with them without the cellphone owners' knowledge. Sophisticated programs can exploit vulnerabilities in the backbone of the global telephone system (known as Signaling System 7, or SS7) to track mobile users, intercept calls and text messages, and disrupt mobile communications.

These attacks have real financial consequences. In 2017, for example, criminals took advantage of SS7 weaknesses to carry out financial fraud by redirecting and intercepting text messages containing one-time passwords for bank customers in Germany. The criminals then used the passwords to steal money from the victims' accounts.

How did we get here, and why is our cellular infrastructure so insecure?

The international mobile communications system is built on top of several layers of technology, parts of which are more than 40 years old. Some of these old technologies are insecure, others have never had a proper audit and many simply haven't received the attention needed to secure them properly. The protocols that form the underpinnings of the mobile system weren't built with security in mind.

SS7, invented in 1975, is still the protocol that allows telephone networks all over the world to talk to one another. It was built on the assumption that anyone who can connect to the network is a trusted network operator. When it was created, there were only 10 companies using SS7. Today, there are hundreds of companies all over the world connected to SS7, making it far more likely that credentials to the system will be leaked or sold. Anyone who can connect to the SS7 network can use it to track your location or eavesdrop on your phone calls. A more recent alternative to SS7 called Diameter suffers from many of the same problems.

Another protocol, GSM, invented in 1991, allows your cellphone to communicate with a cell tower to make and receive calls and transmit data. The older generation of GSM, known as 2G, doesn't verify that the tower that your phone connects to is authentic, making it easy for anyone to use a cell-site simulator and impersonate a cell tower to obtain your location or eavesdrop on your communications.

Larger carriers have already begun dismantling their 2G systems, which is a good start, since later generations of GSM such as 3G, 4G and 5G solve many of its problems. Yet our phones all still support 2G and most have no way to disable it, making them susceptible to attacks. What's more, research has shown that 3G, 4G, and even 5G have vulnerabilities that may allow new generations of cell-site simulators to continue working.

Nobody could have envisioned how deeply ingrained cellular technology would become in our society, or how easy and lucrative exploiting it would be. Companies from China, Russia, Israel and elsewhere are making cell-site simulators and providing access to the SS7 network at prices affordable even to the smallest criminal organizations. It is increasingly easy to build a cell-site simulator at home, for no more than the cost of a fast-food meal. Spies all over the world - as well as drug cartels - have realized the power of these technologies.

So far, industry and policymakers have largely dragged their feet when it comes to blocking cell-site simulators and SS7 attacks. Senator Ron Wyden, one of the few lawmakers vocal about this issue, sent a letter in August encouraging the Department of Justice to "be forthright with federal courts about the disruptive nature of cell-site simulators." No response has ever been published.

The lack of action could be because it is a big task - there are hundreds of companies and international bodies involved in the cellular network. The other reason could be that intelligence and law enforcement agencies have a vested interest in exploiting these same vulnerabilities. But law enforcement has other effective tools that are unavailable to criminals and spies. For example, the police can work directly with phone companies, serving warrants and Title III wiretap orders. In the end, eliminating these vulnerabilities is just as valuable for law enforcement as it is for everyone else.

As it stands, there is no government agency that has the power, funding and mission to fix the problems. Large companies such as AT&T, Verizon, Google and Apple have not been public about their efforts, if any exist.

This needs to change. To start, companies need to stop supporting insecure technologies such as 2G, and government needs a mandate to buy devices solely from companies that have disabled 2G. Similarly, companies need to work with cybersecurity experts on a security standard for SS7. Government should buy services only from companies that can demonstrate that their networks meet this standard.

Finally, this problem can't be solved by domestic regulation alone. The cellular communications system is international, and it will take an international effort to secure it.

We wouldn't tolerate gaping potholes in our highways or sparking power lines. Securing our mobile infrastructure is just as imperative. Policymakers and industries around the world must work together to achieve this common goal.

Cooper Quintin is a senior staff technologist with the Electronic Frontier Foundation, where he investigates digital privacy and security threats to human-rights defenders, journalists and vulnerable populations.
Follow The New York Times Opinion section on Facebook, Twitter (@NYTopinion) and Instagram.

# data[].attributes.attachment_link.description
Security flaws threaten our privacy and bank accounts. So why aren't we fixing them? By Cooper Quintin Mr. Quintin is a senior staff technologist at the Electronic Frontier Foundation. America's cellular network is as vital to society as the highway system and power grids.

# data[].attributes.attachment_link.readable_text
VPNs Can Keep You Safe Online

When you're accessing the internet via Wi-Fi, do you worry about the safety of the data you're sending over the air-and about who else might be spying on that data, or even stealing it? If not, you're in the high-risk majority. You really ought to be using a virtual private network, or VPN. In fact, however, when PCMag ran a survey on VPN usage, we found that a surprising 71 percent of our 1,000 respondents had never even used a VPN. Even among those who support net neutrality-who you might think would be better informed on security and privacy issues-55 percent had never used a VPN.

That all-too-common attitude to the safety and privacy of personal data creates an enormous risk when it comes to online security. Public Wi-Fi networks, which are ubiquitous and convenient, are unfortunately also extremely convenient for attackers who are looking to compromise your personal information. How do you know, for example, that "starbucks_wifi_real" is actually the Wi-Fi network for the coffee shop? Anyone could have created that network, to lure victims into disclosing personal information. In fact, a popular security researcher prank is to create a network with the same name as a free, popular service and see how many devices will automatically connect because it appears safe.

Even if you're inclined to trust your fellow humans (which I do not recommend), you still shouldn't trust your internet service provider. In its infinite wisdom, Congress has decided that your ISP is allowed to sell your browsing history.

In short, it's time to start thinking about protecting your personal information. That's where virtual private networks, or VPNs, come in. These services use simple software to protect your internet connection, and they give you greater control over how you appear online, too. While you might never have heard of VPN services, they are valuable tools that you should understand and use. So who needs a VPN? The short answer is that everyone does. Even Mac users can benefit from a VPN.

Can You Be Tracked if You Use a VPN?

In the simplest terms, a VPN creates a secure, encrypted connection-which can be thought of as a tunnel-between your computer and a server operated by the VPN service. In a professional setting, this tunnel effectively makes you part of the company's network, as if you were physically sitting in the office.

While you're connected to a VPN, all your network traffic passes through this protected tunnel, and no one-not even your ISP-can see your traffic until it exits the tunnel from the VPN server and enters the public internet. If you make sure to only connect to websites secured with HTTPS, your data will continue to be encrypted even after it leaves the VPN.

Think about it this way: If your car pulls out of your driveway, someone can follow you and see where you are going, how long you are at your destination, and when you are coming back. They might even be able to peek inside your car and learn more about you. With a VPN service, you are essentially driving into a closed parking garage, switching to a different car, and driving out, so that no one who was originally following you knows where you went.

VPN services, while tremendously helpful, are not foolproof. There's no magic bullet (or magic armor) when it comes to security. A determined adversary can almost always breach your defenses in one way or another. Using a VPN can't help if you unwisely download ransomware on a visit to the Dark Web, or if you are tricked into giving up your data to a phishing attack.

What a VPN can do is to protect you against mass data collection and the casual criminal vacuuming up user data for later use. It can also protect your privacy by making it harder for advertisers to figure out who and where you are. That's why VPNs are important, even when you're browsing from the comfort and (relative) safety of your home.

Who Needs a VPN?

First and foremost, using a VPN prevents anyone on the same network access point (or anywhere else) from intercepting your web traffic in a man-in-the-middle attack. This is especially handy for travelers and for those using public Wi-Fi networks, such as web surfers at hotels, airports, and coffee shops. Someone on the same network, or the person in control of the network you're using, could conceivably intercept your information while you're connected.

VPNs also cloak your computer's actual IP address, hiding it behind the IP address of the VPN server you're connected to. IP addresses are distributed based on location, so you can estimate someone's location simply by looking at their IP address. And while IP addresses may change, it's possible to track someone across the internet by watching where the same IP address appears. Using a VPN makes it harder for advertisers (or spies, or hackers) to track you online.

Many VPN services also provide their own DNS resolution system. Think of DNS as a phone book that turns a text-based URL like "pcmag.com" into a numeric IP address that computers can understand. Savvy snoops can monitor DNS requests and track your movements online. Greedy attackers can also use DNS poisoning to direct you to bogus phishing pages designed to steal your data. When you use a VPN's DNS system, it's another layer of protection.

VPNs are necessary for improving individual privacy, but there are also people for whom a VPN is essential for personal and professional safety. Some journalists and political activists rely on VPN services to circumvent government censorship and safely communicate with the outside world. Check the local laws before using a VPN in China, Russia, Turkey, or any country with with repressive internet policies.

What about using a VPN for BitTorrent? Some services, such as TorGuard and NordVPN, allow peer-to-peer file sharing and the use of BitTorrent sharing. Others restrict such activity to specific servers. Be smart: Learn the company's terms of service-and the local laws on the subject. That way you can't complain if you run into trouble.

Can VPNs Save Net Neutrality?

It is possible (emphasis on "possible") that VPNs may be able to save net neutrality repeal. Kind of.

For those who are unaware, net neutrality is the much-discussed concept that ISPs treat web services and apps equally, and not create fast lanes for companies that pay more, or require consumers to sign up for specific plans in order to access services like Netflix or Twitter. Federal net neutrality rules would ensure that the internet effectively continues to operate the way it has for its entire existence.

Depending on how ISPs respond to a newly deregulated environment, a VPN could tunnel traffic past any choke points or blockades thrown up by ISPs. That said, an obvious response would be to block or throttle all VPN traffic. Or perhaps ISPs will come up with an entirely novel way to monetize the letitude given them by the current lack of net neutrality legislation.

We'll have to see how this plays out, but this isn't really a problem that VPNs should have to fix. It's up to Congress and, by extension, the voters. So right after you purchase a VPN subscription, maybe give your reps and senators a call.

How to Choose a VPN Service

The VPN services market has exploded in the past few years, and a small competition has turned into an all-out melee. Many providers are capitalizing on the general population's growing concerns about surveillance and cybercrime, which means it's getting hard to tell when a company is actually providing a secure service and when it's throwing out a lot of fancy words while selling snake oil. In fact, since VPN services have become so popular in the wake of Congress killing ISP privacy rules, there have even been fake VPNs popping up, so be careful. It's important to keep a few things in mind when evaluating which VPN service is right for you: reputation, performance, type of encryption used, transparency, ease of use, support, and extra features. Don't just focus on price or speed, though those are important factors.

Some VPN services provide a free trial, so take advantage of it. Make sure you are happy with what you signed up for, and take advantage of money-back guarantees if you're not. This is actually why we also recommend starting out with a short-term subscription-a week or a month-to really make sure you are happy. KeepSolid VPN Unlimited offers a one-week Vacation subscription, for example. Yes, you may get a discount by signing up for a year, but that's more money at stake should you realize the service doesn't meet your performance needs.

Most users want a full graphical user interface for managing their VPN connection and settings, though a few would rather download a configuration file and import it into the OpenVPN client. Most VPN companies we have reviewed support all levels of technological savvy, and the best have robust customer support for when things go sideways.

Which Is the Best Free VPN?

Not all VPN services require that you pay. There are, in fact, many excellent free VPNs. But all of the free VPNs we've tested have some kind of limitation. Some limit you to just a few simultaneous connections or devices on an account. Others restrict you to a few hundred MBs of data per day or per month. Others limit you to just a handful of servers. Still others do all of the above.

Finding the best free VPN is an exercise in balancing those restrictions. TunnelBear, for example, lets you use any server on its network but limits you to 500MB-1GB per month. Avira Phantom VPN lets you use as many devices as you like and any server you like, but also restricts you to 500MB per month. AnchorFree Hotspot Shield also places no limits on the number of devices, but restricts you to 500MB per day and only US-based servers. Kaspersky Secure Connection also doesn't limit your devices but doesn't let you choose a VPN server-the app does it automatically.

ProtonVPN has the unique distinction of placing no data restrictions on free users. You can browse as much as you want, as long as you want. You will be limited to just one device on the service at a time and can only choose between three server locations, but the unlimited data makes up for all that. It doesn't hurt that ProtonVPN, from the same people that brought you super-secure ProtonMail email, is very concerned about security and customer privacy. For all that, ProtonVPN is our Editors' Choice for free VPN.

Note that, in addition to our collection of free VPNs, we also have a roundup of the best cheap VPNs, for those who are willing to spend at least a little cash on their protection.

Can You Trust Your VPN Service?

If you're using a service to route all your internet traffic through its servers, you have to be able to trust the provider. Established security companies, such as F-Secure, may have only recently come to the VPN market. It's easier to trust companies that have been around a little longer, simply because their reputation is likely to be known. But companies and products can change quickly. Today's slow VPN service that won't let you cancel your subscription could be tomorrow's poster child for excellence.

We're not cryptography experts, so we can't verify all of the encryption claims providers make. Instead, we focus on the features provided. Bonus features like ad blocking, firewalls, and kill switches that disconnect you from the web if your VPN connection drops, go a long way toward keeping you safe. We also prefer providers that support OpenVPN, since it's a standard that's known for its speed and reliability. It's also, as the name implies, open source, meaning it benefits from many developers' eyes looking for potential problems.

Since we last tested VPNs, we've given special attention to the privacy practices of VPN companies and not just the technology they provide. In our testing, we read through the privacy policies and discuss company practices with VPN service representatives. What we look for is a commitment to protect user information, and to take a hands-off approach to gathering user data.

As part of our research, we also make sure to find out where the company is based and under what legal framework it operates. Some countries don't have data-retention laws, making it easier to keep a promise of "We don't keep any logs." It's also useful to know under what circumstances a VPN company will hand over information to law enforcement and what information it would have to provide if that should happen.

The best VPN services have a privacy policy that clearly spells out what the service does, what information it collects, and what it does to protect that information. Some companies explain that they collect some information, but don't inform you about how they intend to use that information. Others are more transparent.

While a VPN can protect your privacy online, you might still want to take the additional step of avoiding paying for one using a credit card, for moral or security reasons. Several VPN services now accept anonymous payment methods such Bitcoin, and some even accept retailer gift cards. Both of these transactions is about as close as you can get to paying with cash for something online. That Starbucks gift card may be better spent on secure web browsing than a mediocre-at-best latte.

Understanding the Limitations of VPN Services

VPNs are great, but it's just as important to know what a VPN can and cannot do. A tool is only useful when it's used correctly, after all.

While it hides your IP address, a VPN is not a true anonymization service. For that, you'll want to access the Tor network, which will almost certainly slow down your connection. While a VPN tunnels your web traffic to a VPN server, Tor bounces around your traffic through several volunteer nodes making it much, much harder to track. Using Tor also grants access to hidden Dark Web sites, which a VPN simply cannot do. That said, some services, such as NordVPN, offer Tor access on specific servers.

Using a VPN will prevent most kinds of DNS attacks that would redirect you to a phishing page, but a regular old page made to look like a legit one in order to trick you into entering your data can still work. Some VPNs, and most browsers, are pretty good about blocking phishing pages, but this attack still claims too many victims to be ignored. Use common sense and be sure to verify that websites are what they say they are by looking carefully at the URL and always visiting HTTPS sites.

In addition to blocking malicious sites and ads, some VPNs also claim to block malware. We don't test the efficacy of these network-based protections, but most appear to be blacklists of sites known to host malicious software. That's great, but don't assume it's anywhere near as good as standalone antivirus. Use this feature to complement, not replace, your antivirus.

Lastly, keep in mind that some security conscious companies like banks may be confused by your VPN. If your bank sees you logging in from what appears to be another US state or even another country, it can raise red flags. Expect to see captchas and more frequent multifactor requests when your VPN is on.

VPNs by the Numbers

Some important things to look for when shopping for a VPN are the number of licenses for simultaneous connections that come with your fee, the number of servers available, and the number of locations in which the company has servers. It all comes down to numbers.

Most VPN services allow you to connect up to five devices with a single account. Any service that offers fewer connections is outside the mainstream. Keep in mind that you'll need to connect every device in your home individually to the VPN service, so just two or three licenses won't be enough for the average nested pair. Note that many VPN services offer native apps for both Android and iOS, but that such devices count toward your total number of connections.

Of course, there are more than just phones and computers in a home. Game systems, tablets, and smart home devices such as light bulbs and fridges all need to connect to the internet. Many of these things can't run VPN software on their own, nor can they be configured to connect to a VPN through their individual settings. In these cases, you may be better off configuring your router to connect with the VPN of your choice. By adding VPN protection to your router, you secure the traffic of every gadget connected to that router. And the router-and everything protected by it-uses just one of your licenses. Nearly all of the companies we have reviewed offer software for most consumer routers and even routers with preinstalled VPN software, making it even easier to add this level of protection.

When it comes to servers, more is always better. More servers mean that you're less likely to be shunted into a VPN server that is already filled to the brim with other users. NordVPN, Private Internet Access, and TorGuard currently lead the pack with well over 3,000 servers each-NordVPN is at the forefront with 5,130 servers. But the competition is beginning to heat up. Last year, only a handful of companies offered more than 500 servers, now it's becoming unusual to find a company offering fewer than 1,000 servers.

The number and distribution of those servers is also important. The more places a VPN has to offer, the more options you have to spoof your location! More importantly, having numerous servers in diverse locales means that no matter where you go on Earth you'll be able to find a nearby VPN server. The closer the VPN server, the better the speed and reliability of the connection it can offer you. Remember, you don't need to connect to a far-flung VPN server in order to gain security benefits. For most purposes, a server down the street is as safe as one across the globe.

In the most recent round of testing, we've also looked at how many virtual servers a given VPN company uses. A virtual server is just what it sounds like-a software-defined server running on server hardware that might have several virtual servers onboard. The thing about virtual servers is that they can be configured to appear as if they are in one country when they are actually being hosted somewhere else. That's an issue if you're especially concerned about where you web traffic is traveling. It's a bit worrisome to choose one location and discover you're actually connected somewhere else entirely.

See How We Test VPNs

What's the Fastest VPN?

We have often said that having to choose between security and convenience is a false dichotomy, but it is at least somewhat true in the case of VPN services. When a VPN is active, your web traffic is taking a more circuitous route than usual, often resulting in sluggish download and upload speeds as well as increased latency. The good news is that using a VPN probably isn't going to remind you of the dial-up days of yore.

Most services provide perfectly adequate internet speed when in use, and can even handle streaming HD video. However, 4K video and other data-intensive tasks like gaming over a VPN are another story. Some VPN services, such as NordVPN, have started to roll out specialty servers for high-bandwidth activities. And nearly every service we have tested includes a tool to connect you with the fastest available network. Of course, you can always limit your VPN use to when you're not on a trusted network.

When we test VPNs, we use the Ookla speed test tool. (Note that Ookla is owned by PCMag's publisher, Ziff Davis.) This test provides metrics for latency, download speeds, and upload speeds. Any one of these can be an important measurement depending on your needs, but we tend to view the download speed as the most important. After all, we live in an age of digital consumption.

Our speed tests stress comparison and reproducibility. That means we stand by our work, but your individual results may vary. After all, perhaps you live on top of a VPN server, or just happen to have a super-high bandwidth connection.

What follows are the results from our top-rated VPNs as of May, 2018.

All that being said, we currently name TorGuard as the fastest VPN service. It doesn't take the top spot in all of our tests, but has remarkably low latency and had the best performance in the all-important download tests. Fittingly, it offers many add-ons such as dedicated IP addresses that, along with its speed, will appeal to the BitTorrent users it is designed to protect.

Can a VPN Be Blocked by Netflix?

Borders still exist on the web, in the form of geographic restrictions for streaming content. The BBC iPlayer, for example, lets UK residents watch the Beeb to their heart's content. The rest of the world, not so much. But if you were to select a VPN server in the UK, your computer's IP address would appear to be the same as the server, allowing you to view the content.

The trouble is that Netflix and similar video streaming services are getting wise to the scam. In our testing, we found that Netflix blocks streaming more often than not when we were using a VPN. There are a few exceptions, but Netflix is actively working to protect its content deals. VPNs that work with Netflix today may not work tomorrow.

Netflix blocking paying customers might seem odd, but it's all about regions and not people. Just because you paid for Netflix in one place does not mean you're entitled to the content available on the same service but in a different location. Media distribution and rights are messy and complicated. You may or may not agree with the laws and terms of service surrounding media streaming, but you should definitely be aware that they exist and understand when you're taking the risk of breaking them. Netflix, for its part, lays out how that it will attempt to verify a user's location in order to provide content in section 6c of its Terms of Use document.

What's the Best VPN For Kodi?

If you don't know what Kodi is, you're not alone. However, an analysis of searches leading to our site reveals that a surprising number of you are, in fact looking for VPN that works with the mysterious Kodi. Dictionary.com defines Kodi as a possible misspelling of "Jodi," but PCMag analyst Ben Moore clarified for me that Kodi is "free, open-source software for managing your local collection of movies, television shows, music, and photos."

With Kodi, you can access your media over a local connection (LAN) or from a remote media server, if that's your thing. This is, presumably, where concerns about VPN enter the picture. A device using a VPN, for example, will have its connection encrypted on the local network. You might have trouble connecting to it. Using Chromecast on a VPN device just doesn't work, for example. Kodi users might have the same issue.

For local VPN issues, you have a couple of options. First, consider installing VPN software on your router and not using a VPN on your local machines. Alternatively, many VPN services offer browser plug-ins that only encrypt your browser traffic. That's not ideal from a security perspective, but it's useful when all you need to secure is your browser information.

Some, but not all, VPN services will let you designate specific applications to be routed outside the encrypted tunnel. This means the traffic will be unencrypted, but also accessible locally.

If you're trying to connect to a remote media source with Kodi, a VPN would likely play a different role. It might, for example, prevent your ISP from determining what you're up to. It might also be useful if you're connecting to a third-party service for Kodi that allows streaming of copyright-infringing material. Keep in mind, however, that some VPN services specifically forbid the use of their services for copyright infringement.

Using a VPN With Windows 10, Chrome, and Linux

When we test VPNs, we generally start with the Windows client. This is often the most complete review, covering several different platforms as well as the service's features and pricing in depth. That's purely out of necessity, since most of our readers use Windows (although this writer is currently using a MacBook Air). We currently use a Lenovo ThinkPad T460s laptop running the latest version of Windows 10. We periodically upgrade to a newer machine, in order to simulate what most users experience.

But as you can see from the chart at the top, however, Windows is not the only platform for VPNs. The Android mobile operating system, for example, is the most widely used OS on the planet. So it makes sense that we also test VPNs for Android.

That's not to ignore Apple users. We also review VPN clients for macOS and iOS.

Using a VPN is a little trickier for ChromeOS users, however. While Google has worked to make it easier to use a VPN with a Chromebook or Chromebox, it's not always a walk in the park. Our guide to how to set up a VPN on a Chromebook can make the task a bit easier, however. In these cases, you might find it easier to install a VPN plug-in for the Chrome browser. This will only secure some of your traffic, but it's better than nothing.

Finally, we have lately begun to review the best Linux VPN apps, too.

Using a Mobile VPN

We used to advise people to do banking and other important business over their cellular connection when using a mobile device, since it is generally safer than connecting with a public Wi-Fi network. But even that isn't always a safe bet. Researchers have demonstrated how a portable cell tower, such as a femtocell, can be used for malicious ends. The attack hinges on jamming the LTE and 3G bands, which are secured with strong encryption, and forcing devices to connect with a phony tower over the less-secure 2G band. Because the attacker controls the fake tower, he can carry out a man-in-the-middle attack and see all the data passing over the cellular connection. Admittedly, this is an exotic attack, but it's far from impossible.

Wi-Fi attacks, on the other hand, are probably far more common than we'd like to believe. While attending the Black Hat convention, researchers saw thousands of devices connecting to a rogue access point. It had been configured to mimic networks that victim's devices had previously connected to, since many devices will automatically reconnect to a known network without checking with the user. That's why we recommend getting a VPN app for your mobile device to protect all your mobile communications. Even if you don't have it on all the time, using a mobile VPN is a smart way to protect your personal information.

Most VPN services offer both Android and iOS VPN apps, saving you the trouble of configuring your phone's VPN settings yourself. VPN providers typically allow up to five devices to be connected simultaneously under a single account. Also, while there are free VPN services available, many require that mobile users sign up for a paid subscription.

Not all mobile VPN apps are created equal. In fact, most VPN providers offer different services (and sometimes, different servers) for their mobile offerings than they do for their desktop counterparts. We're pleased to see that NordVPN and Private Internet Access provide the same excellent selection of servers regardless of platform. These apps received an Editors' Choice nod both for desktop VPN apps and Android VPN apps.

If you're of the iPhone persuasion, there are a few other caveats to consider for a mobile VPN. Some iPhone VPN apps don't use OpenVPN, even if the VPN service that made the app supports the protocol. That's because Apple requires additional vetting if a company wants to include OpenVPN with its app. VPN app developers have slowly started jumping through those extra hoops and are bringing support for protocols such as OpenVPN to iOS.

Thankfully, there's a workaround for this problem. Instead of using the VPN app from the company from which you've purchased a subscription, you can download the standalone OpenVPN app. Open it, and you can enter your subscription information from the VPN company you've decided to work with. The OpenVPN app will then connect to the VPN company's servers using our preferred protocol.

Get Yourself a VPN

Computer and software providers work hard to make sure that the devices you buy are safe right out of the box. But they don't provide everything you'll need. Antivirus software, for example, consistently outperforms the built-in protections. In the same vein, VPN software lets you use the web and Wi-Fi with confidence that your information will remain secure. It's critically important and often overlooked.

Even if you don't use it every moment of every day, a VPN is a fundamental tool that everyone should have at their disposal-like a password manager or an online backup service. A VPN is also a service that will only become more important as our more of our devices become connected. So stay safe, and get a VPN.

Click through the review links of the best VPN services below for detailed analysis and performance results, and feel free to chime in on the comments section below them. Once you've picked, be sure to read our feature on how to set up and use a VPN to get the most from your chosen service.

# data[].attributes.attachment_link.description
When you're accessing the internet via Wi-Fi, do you worry about the safety of the data you're sending over the air-and about who else might be spying on that data, or even stealing it? If not, you're in the high-risk majority. You really ought to be using a virtual private network, or VPN.

# data[].attributes.attachment_link.title
Why Do Our Brains Love Fake News? | Above The Noise

# data[].attributes.attachment_link.description
Why our brains can so easily make us believe that fake news is real news.

# data[].attributes.attachment_link.title
Fake News: How A Partying Macedonian Teen Earns Thousands Publishing Lies | NBC News

# data[].attributes.body
Play with a partner

# data[].attributes.attachment_link.provider_name
Pew Research Center: Internet, Science & Tech

# data[].attributes.attachment_link.description
A majority of online adults can identify a strong password and know the risks of using public Wi-Fi. Yet, many struggle with more technical cybersecurity concepts.

# data[].attributes.attachment_link.readable_text
By Claire Wardle

These high-resolution graphics were created to help explain information disorder. They are available for use in publications and presentations under a Creative Commons license. Click the description of each image to download it.

# data[].attributes.attachment_link.title
Information Disorder, Part 3: Useful Graphics

# data[].attributes.attachment_link.description
These high-resolution graphics were created to help explain information disorder. They are available for use in publications and presentations under a Creative Commons license. Click the description...

# data[].attributes.headline
Discussion starter: Activist artist Sue Coe's etching: Alternate Facts

# data[].attributes.subject
Discussion starter: Activist artist Sue Coe's etching: Alternate Facts

# data[].attributes.body
How does this image speak to its viewers? What language is Sue Coe using? Why?

# data[].attributes.body
Look up three sources and use a 3-column chart to compare the news on the same topic.

# data[].attributes.attachment_link.readable_text
Intro to The Media Bias Chart

This is the Media Bias Chart, in its latest iteration. It's a unique way of laying out the complex media landscape in two dimensions: quality, on the vertical axis, and bias, on the horizontal axis.

People find it helpful because it's a useful taxonomy (i.e., system of classification) for discussing a complex subject. We also have a detailed methodology for how we place sources on the chart. There is a ton of information and background on this site, so please explore. We welcome your input and feedback!

# data[].attributes.attachment_link.description
This is the Media Bias Chart, in its latest iteration. It's a unique way of laying out the complex media landscape in two dimensions: quality, on the vertical axis, and bias, on the horizontal axis. People find it helpful because it's a useful taxonomy (i.e., system of

# data[].attributes.attachment_link.readable_text
By Claire Wardle, with research support from Grace Greason, Joe Kerwin & Nic Dias

An algorithm is a fixed series of steps that a computer performs in order to solve a problem or complete a task. Social media platforms use algorithms to filter and prioritize content for each individual user based on various indicators, such as their viewing behavior and content preferences. Disinformation that is designed to provoke an emotional reaction can flourish in these spaces when algorithms detect that a user is more likely to engage with or react to similar content.¹

An API, or application programming interface, is a means by which data from one web tool or application can be exchanged with, or received by another. Many working to examine the source and spread of polluted information depend upon access to social platform APIs, but not all are created equal and the extent of publicly available data varies from platform to platform. Twitter's open and easy-to-use API has enabled thorough research and investigation of its network, plus the development of mitigation tools such as bot detection systems. However, restrictions on other platforms and a lack of API standardization means it is not yet possible to extend and replicate this work across the social web.

Artificial intelligence (AI) describes computer programs that are "trained" to solve problems that would normally be difficult for a computer to solve. These programs "learn" from data parsed through them, adapting methods and responses in a way that will maximize accuracy. As disinformation grows in its scope and sophistication, some look to AI as a way to effectively detect and moderate concerning content. AI also contributes to the problem, automating the processes that enable the creation of more persuasive manipulations of visual imagery, and enabling disinformation campaigns that can be targeted and personalized much more efficiently.²

Automation is the process of designing a 'machine' to complete a task with little or no human direction. It takes tasks that would be time-consuming for humans to complete and turns them into tasks that are completed quickly and almost effortlessly. For example, it is possible to automate the process of sending a tweet, so a human doesn't have to actively click 'publish'. Automation processes are the backbone of techniques used to effectively 'manufacture' the amplification of disinformation.

Black hat SEO (search engine optimization) describes aggressive and illicit strategies used to artificially increase a website's position within a search engine's results, for example changing the content of a website after it has been ranked. These practices generally violate the given search engine's terms of service as they drive traffic to a website at the expense of the user's experience.³

Bots are social media accounts that are operated entirely by computer programs and are designed to generate posts and/or engage with content on a particular platform. In disinformation campaigns, bots can be used to draw attention to misleading narratives, to hijack platforms' trending lists and to create the illusion of public discussion and support.⁴ Researchers and technologists take different approaches to identifying bots, using algorithms or simpler rules based on number of posts per day.⁵

A botnet is a collection or network of bots that act in coordination and are typically operated by one person or group. Commercial botnets can include as many as tens of thousands of bots.⁶

Data mining is the process of monitoring large volumes of data by combining tools from statistics and artificial intelligence to recognize useful patterns. Through collecting information about an individual's activity, disinformation agents have a mechanism by which they can target users on the basis of their posts, likes and browsing history. A common fear among researchers is that, as psychological profiles fed by data mining become more sophisticated, users could be targeted based on how susceptible they are to believing certain false narratives.⁷

Dark ads are advertisements that are only visible to the publisher and their target audience. For example, Facebook allows advertisers to create posts that reach specific users based on their demographic profile, page 'likes', and their listed interests, but that are not publicly visible. These types of targeted posts cost money and are therefore considered a form of advertising. Because these posts are only seen by a segment of the audience, they are difficult to monitor or track.⁸

Deepfakes is the term currently being used to describe fabricated media produced using artificial intelligence. By synthesizing different elements of existing video or audio files, AI enables relatively easy methods for creating 'new' content, in which individuals appear to speak words and perform actions, which are not based on reality. Although still in their infancy, it is likely we will see examples of this type of synthetic media used more frequently in disinformation campaigns, as these techniques become more sophisticated.⁹

A dormant account is a social media account that has not posted or engaged with other accounts for an extended period of time. In the context of disinformation, this description is used for accounts that may be human- or bot-operated, which remain inactive until they are 'programmed' or instructed to perform another task.¹⁰

Doxing or doxxing is the act of publishing private or identifying information about an individual online, without his or her permission. This information can include full names, addresses, phone numbers, photos and more.¹¹ Doxing is an example of malinformation, which is accurate information shared publicly to cause harm.

Disinformation is false information that is deliberately created or disseminated with the express purpose to cause harm. Producers of disinformation typically have political, financial, psychological or social motivations.¹²

Encryption is the process of encoding data so that it can be interpreted only by intended recipients. Many popular messaging services such as WhatsApp encrypt the texts, photos and videos sent between users. This prevents governments from reading the content of intercepted WhatsApp messages.

Fact-checking (in the context of information disorder) is the process of determining the truthfulness and accuracy of official, published information such as politicians' statements and news reports.¹³ Fact-checking emerged in the U.S. in the 1990s, as a way of authenticating claims made in political ads airing on television. There are now around 150 fact-checking organizations in the world,¹⁴ and many now also debunk mis- and disinformation from unofficial sources circulating online.

Fake followers are anonymous or imposter social media accounts created to portray false impressions of popularity about another account. Social media users can pay for fake followers as well as fake likes, views and shares to give the appearance of a larger audience. For example, one English-based service offers YouTube users a million "high-quality" views and 50,000 likes for $3,150.¹⁵

Malinformation is genuine information that is shared to cause harm.¹⁶ This includes private or revealing information that is spread to harm a person or reputation.

Manufactured amplification occurs when the reach or spread of information is boosted through artificial means. This includes human and automated manipulation of search engine results and trending lists, and the promotion of certain links or hashtags on social media.¹⁷ There are online price lists for different types of amplification, including prices for generating fake votes and signatures in online polls and petitions, and the cost of downranking specific content from search engine results.¹⁸

The formal definition of the term meme, coined by biologist Richard Dawkins in 1976, is an idea or behavior that spreads person to person throughout a culture by propagating rapidly, and changing over time.¹⁹ The term is now used most frequently to describe captioned photos or GIFs that spread online, and the most effective are humorous or critical of society. They are increasingly being used as powerful vehicles of disinformation.

Misinformation is information that is false, but not intended to cause harm. For example, individuals who don't know a piece of information is false may spread it on social media in an attempt to be helpful.²⁰

Propaganda is true or false information spread to persuade an audience, but often has a political connotation and is often connected to information produced by governments. It is worth noting that the lines between advertising, publicity and propaganda are often unclear.²¹

Satire is writing that uses literary devices such as ridicule and irony to criticize elements of society. Satire can become misinformation if audiences misinterpret it as fact.²² There is a known trend of disinformation agents labelling content as satire to prevent it from being flagged by fact-checkers.

Scraping is the process of extracting data from a website without the use of an API. It is often used by researchers and computational journalists to monitor mis- and disinformation on different social platforms and forums. Typically, scraping violates a website's terms of service (i.e., the rules that users agree to in order to use a platform). However, researchers and journalists often justify scraping because of the lack of any other option when trying to investigate and study the impact of algorithms.

A sock puppet is an online account that uses a false identity designed specifically to deceive. Sock puppets are used on social platforms to inflate another account's follower numbers and to spread or amplify false information to a mass audience.²³ The term is considered by some to be synonymous with the term "bot".

Spam is unsolicited, impersonal online communication, generally used to promote, advertise or scam the audience. Today, it is mostly distributed via email, and algorithms detect, filter and block spam from users' inboxes. Similar technologies to those implemented in the fight against spam could potentially be used in the context of information disorder, once accepted criteria and indicators have been agreed.

Trolling is the act of deliberately posting offensive or inflammatory content to an online community with the intent of provoking readers or disrupting conversation. Today, the term "troll" is most often used to refer to any person harassing or insulting others online. However, it has also been used to describe human-controlled accounts performing bot-like activities.

A troll farm is a group of individuals engaging in trolling or bot-like promotion of narratives in a coordinated fashion. One prominent troll farm was the Russia-based Internet Research Agency that spread inflammatory content online in an attempt to interfere in the U.S. presidential election.²⁴

Verification is the process of determining the authenticity of information posted by unofficial sources online, particularly visual media.²⁵ It emerged as a new skill set for journalists and human rights activists in the late 2000s, most notably in response to the need to verify visual imagery during the 'Arab Spring'.

A VPN, or virtual private network, is used to encrypt a user's data and conceal his or her identity and location. This makes it difficult for platforms to know where someone pushing disinformation or purchasing ads is located. It is also sensible to use a VPN when investigating online spaces where disinformation campaigns are being produced.

# data[].attributes.attachment_link.title
Information Disorder, Part 1: The Essential Glossary

# data[].attributes.attachment_link.description
An algorithm is a fixed series of steps that a computer performs in order to solve a problem or complete a task. Social media platforms use algorithms to filter and prioritize content for each individual user based on various indicators, such as their viewing behavior and content preferences.

# data[].attributes.attachment_link.description
Tech Fix is a research-driven feature aimed at solving everyday problems related to consumer technology. Share your tech frustrations with brian.chen@nytimes.com or @bxchen on Twitter.

# data[].attributes.body
Why does this poem resonate with young people today? What cultural norms are reflected?

# data[].attributes.attachment_link.readable_text
Call it a classic case of supply meeting demand.

Universities, colleges, even community colleges insist that faculty publish scholarly research, and the more papers the better. Academics and the schools they teach at rely on these publications to bolster their reputations, and with an oversupply of Ph.D.'s vying for jobs, careers hang in the balance.

Competition is fierce to get published in leading journals. But what about the overworked professors at less prestigious schools and community colleges, without big grants and state-of-the-art labs? How do they get ahead?

As it turns out, many of their articles are appearing in "journals" that will publish almost anything, for fees that can range into the hundreds of dollars per paper. These publications often are called predatory journals, on the assumption that well-meaning academics are duped into working with them - tricked by flattering emails from the journals inviting them to submit a paper or fooled by a name that sounded like a journal they knew.

But it's increasingly clear that many academics know exactly what they're getting into, which explains why these journals have proliferated despite wide criticism. The relationship is less predator and prey, some experts say, than a new and ugly symbiosis.

Many faculty members - especially at schools where the teaching load is heavy and resources few - have become eager participants in what experts call academic fraud that wastes taxpayer money, chips away at scientific credibility, and muddies important research.

"When hundreds of thousands of publications appear in predatory journals, it stretches credulity to believe all the authors and universities they work for are victims," Derek Pyne, an economics professor at Thompson Rivers University in British Columbia, wrote in a op-ed published in the Ottawa Citizen, a Canadian newspaper.

The number of such journals has exploded to more than 10,000 in recent years, with nearly as many predatory as legitimate ones. "Predatory publishing is becoming an organized industry," wrote one group of critics in a paper in Nature.

Many of these journals have names that closely resemble those of established publications, making them easily mistakable. There is the Journal of Economics and Finance, published by Springer, but now also the Journal of Finance and Economics. There is the Journal of Engineering Technology, put out by the American Society for Engineering Education, but now another called the GSTF Journal of Engineering Technology.

Predatory journals have few expenses, since they do not seriously review papers that are submitted and they publish only online. They blast emails to academics, inviting them to publish. And the journals often advertise on their websites that they are indexed by Google Scholar. Often that is correct - but Google Scholar does not vet the journals it indexes.

The journals are giving rise to a wider ecosystem of pseudo science. For the academic who wants to add credentials to a résumé, for instance, publishers also hold meetings where, for a hefty fee, you can be listed as a presenter - whether you actually attend the meeting or not.

One of those meetings, held in New York in June by a group called the World Academy of Science, Engineering and Technology, seemed more like a Potemkin village. On the publisher's website, the convention promised to be large and lavish.

But when I visited, the only venue was a small windowless room on the sixth floor of a hotel undergoing renovation. A handful of people sat in the room, diligently listening to a talk. Most who were listed on the program were not in attendance.

Participating in such dubious enterprises carries few risks. Dr. Pyne, who did a study of his colleagues' publications, reports that faculty members at his school who got promoted last year had at least four papers in questionable journals. All but one academic in 10 who won a School of Business and Economics award had published papers in these journals. One had 10 such articles.

Academics get rewarded with promotions when they stuff their résumés with articles like these, Dr. Pyne concluded. There are few or no adverse consequences - in fact, the rewards for publishing in predatory journals were greater than for publishing in legitimate ones.

Dr. Pyne does not know what role those studies played in the promotions. But, he said, "I can say that such publications do not seem to hurt promotion prospects."

Tensions over this kind of scholarship have spilled over Queensborough Community College, part of CUNY, the City University of New York.

Although it is hardly known for its research, college administrators urge the faculty to publish. Recently a group of concerned professors complained that nearly a dozen colleagues have repeatedly published in at least one of the dubious journals - and have been promoted and rewarded for it.

Noting that a number of these papers apparently depended on federal and city funds, the professors brought the matter to the attention of the vice chancellor for research and even wrote to the New York State inspector general's office.

The school referred inquiries to its head librarian, Jeanne Galvin.

"Just as with many colleges, faculty submit their work for publication in a variety of journals based on individual judgment," she said in an email. "Queensborough offers several advisory resources, such as workshops and individual consultation with expert librarians. The research that I have seen published by our faculty is of the highest quality."

Some say the academic system bears much of the blame for the rise of predatory journals, demanding publications even from teachers at places without real resources for research and where they may have little time apart from teaching.

At Queensborough, faculty members typically teach nine courses per year. At four-year colleges, faculty may teach four to six courses a year.

Yet "every university requires some level of publication," said Lawrence DiPaolo, vice president of academic affairs at Neumann University in Aston, Pa.

Recently a group of researchers invented a fake academic: Anna O. Szust. The name in Polish means fraudster. Dr. Szust applied to legitimate and predatory journals asking to be an editor. She supplied a résumé in which her publications and degrees were total fabrications, as were the names of the publishers of the books she said she had contributed to.

The legitimate journals rejected her application immediately. But 48 out of 360 questionable journals made her an editor. Four made her editor in chief. One journal sent her an email saying, "It's our pleasure to add your name as our editor in chief for the journal with no responsibilities."

The lead author of the Dr. Szust sting operation, Katarzyna Pisanski, a psychologist at the University of Sussex in England, said the question of what motivates people to publish in such journals "is a touchy subject."

"If you were tricked by spam email you might not want to admit it, and if you did it wittingly to increase your publication counts you might also not want to admit it," she said in an email.

The consequences of participating can be more than just a résumé freckled with poor-quality papers and meeting abstracts. Publications become part of the body of scientific literature.

There are indications that some academic institutions are beginning to wise up to the dangers.

Dewayne Fox, an associate professor of fisheries at Delaware State University, sits on a committee at his school that reviews job applicants. One recent applicant, he recalled, listed 50 publications in such journals and is on the editorial boards of some of them.

A few years ago, he said, no one would have noticed. But now he and others on search committees at his university have begun scrutinizing the publications closely to see if the journals are legitimate.

"If something gets published in one of these journals and it's complete garbage, it can develop a life of its own," Dr. Fox said.

"Think about human medicine and how much is on the line. When people publish something that is not replicable, it can have health impacts."

A version of this article appears in print on , on Page D5 of the New York edition with the headline: In Academia, a Predatory Twist in Publishing. Order Reprints | Today's Paper | Subscribe

# data[].attributes.attachment_link.title
Many Academics Are Eager to Publish in Worthless Journals

# data[].attributes.attachment_link.description
Call it a classic case of supply meeting demand. Universities, colleges, even community colleges insist that faculty publish scholarly research, and the more papers the better. Academics and the schools they teach at rely on these publications to bolster their reputations, and with an oversupply of Ph.D.'s vying for jobs, careers hang in the balance.

# data[].attributes.body
How does this affect you? Your family?

# data[].attributes.attachment_link.title
Social Engineering Tactics Infographic | RECOIL OFFGRID

# data[].attributes.attachment_link.description
Personal interaction is a fine balance of trust and suspicion. On one hand, we shouldn't be too trusting of strangers, as this may allow malicious individuals to take advantage of our blind trust. On the other hand, we can't exactly go through life cynically doubting and scrutinizing everyone we know at all times - that would ...

# data[].attributes.attachment_link.readable_text
Anurag Acharya's problem was that the Google search bar is very smart, but also kind of dumb. As a Googler working on search 13 years ago, Acharya wanted to make search results encompass scholarly journal articles. A laudable goal, because unlike the open web, most of the raw output of scientific research was invisible-hidden behind paywalls. People might not even know it existed. "I grew up in India, and most of the time you didn't even know if something existed. If you knew it existed, you could try to get it," Acharya says. "'How do I get access?' is a second problem. If I don't know about it, I won't even try."

Acharya and a colleague named Alex Verstak decided that their corner of search would break with Google tradition and look behind paywalls-showing citations and abstracts even if it couldn't cough up an actual PDF. "It was useful even if you did not have university access. That was a deliberate decision we made," Acharya says.

Then they hit that dumbness problem. The search bar doesn't know what flavor of information you're looking for. You type in "cancer;" do you want results that tell you your symptoms aren't cancer (please), or do you want the Journal of the American Medical Association? The search bar doesn't know.

Acharya and Verstak didn't try to teach it. Instead, they built a spinoff, a search bar separate from Google-prime that would only look for journal articles, case law, patents-hardcore primary sources. And it worked. "We showed it to Larry [Page] and he said, 'why is this not already out?' That's always a positive sign," Acharya says.

Today, even though you can't access Scholar directly from the Google-prime page, it has become the internet's default scientific search engine-even more than once-monopolistic Web of Science, the National Institutes of Health's PubMed, and Scopus, owned by the giant scientific publisher Elsevier.

But most science is still paywalled. More than three quarters of published journal articles-114 million on the World Wide Web alone, by one (lowball) estimate-are only available if you are affiliated with an institution that can afford pricey subscriptions or you can swing $40-per-article fees. In the last several years, though, scientists have made strides to loosen the grip of giant science publishers. They skip over the lengthy peer review process mediated by the big journals and just ... post. Review comes after. The paywall isn't crumbling, but it might be eroding. The open science movement, with its free distribution of articles before their official publication, is a big reason.

Another reason, though, is stealthy improvement in scientific search engines like Google Scholar, Microsoft Academic, and Semantic Scholar -web tools increasingly able to see around paywalls or find articles that have jumped over. Scientific publishing ain't like book publishing or journalism. In fact, it's a little more like music, pre-iTunes, pre-Spotify. You know, right about when everyone started using Napster.

Before World War II most scientific journals were published by small professional societies. But capitalism's gonna capitalism. By the early 1970s the top five scientific publishers-Reed-Elsevier, Wiley-Blackwell, Springer, and Taylor & Francis-published about 20 percent of all journal articles. In 1996, when the transition to digital was underway and the PDF became the format of choice for journals, that number went up to 30 percent. Ten years later it was 50 percent.

Those big-five publishers became the change they wanted to see in the publishing world-by buying it. Owning over 2,500 journals (including the powerhouse Cell) and 35,000 books and references (including Gray's Anatomy) is big, right? Well, that's Elsevier, the largest scientific publisher in the world, which also owns ScienceDirect, the online gateway to all those journals. It owns the (pre-Google Scholar) scientific search engine Scopus. It bought Mendeley, a reference manager with social and community functions. It even owns a company that monitors mentions of scientific work on social media. "Everywhere in the research ecosystem, from submission of papers to research evaluations made based on those papers and various acts associated with them online, Elsevier is present," says Vincent Larivière, an information scientist at the University of Montreal and author of the paper with those stats about publishing I put one paragraph back.

The company says all that is actually in the service of wider dissemination. "We are firmly in the open science space. We have tools, services, and partnerships that help create a more inclusive, more collaborative, more transparent world of research," says Gemma Hersh, ¹ Elsevier's vice president for open science. "Our mission is around improving research performance and working with the research community to do that." Indeed, in addition to traditional, for-profit journals it also owns SSRN, a preprint server-one of those places that hosts unpaywalled, pre-publication articles-and publishes thousands of articles at various levels of openness.

So Elsevier is science publishing's version of Too Big to Fail. As such, it has faced various boycotts, slightly piratical workarounds, and general anger. ("The term 'boycott' comes up a lot, but I struggle with that. If I can be blunt, I think it's a word that's maybe misapplied," Hersh says. "More researchers submit to us every year, and we publish more articles every year.")

If you're not someone with ".edu" in your email, this might make you a little nuts. Not just because you might want to actually see some cool science, but because you already paid for that research. Your taxes (or maybe some zillionaire's grant money) paid the scientists and funded the studies. The experts who reviewed and critiqued the results and conclusions before publication were volunteers. Then the journal that published it charged a university or a library-again, probably funded at least in part by your taxes-to subscribe. And then you gotta buy the article? Or the researcher had to pony up $2,000 ² to make it open access?

Now, publishers like Elsevier will say that the process of editing, peer-reviewing, copy editing, and distribution are a major, necessary value add. And look at the flip side: so-called predatory journals that charge authors to publish nominally open-access articles with no real editing or review (that, yes, show up in search results). Still, the scientific publishing business is a $10 billion-a-year game. In 2010, Elsevier reported profits of $1 billion and a 35 percent margin. So, yeah.

In that early-digital-music metaphor, the publishers are the record labels and the PDFs are MP3s. But you still need a Napster. That's where open-science-powered search engines come in.

A couple years after Acharya and Verstak built Scholar, a team at Microsoft built their own version, called Academic. It was at the time a much, let's say, leaner experience, with far fewer papers available. But then in 2015, Microsoft released a 2.0, and it's a killer.

Microsoft's communication team declined to make any of the people who run it available, but a paper from the team at Microsoft Research lays the specs out pretty well: It figures out the bibliographic data of papers and combines that with results from Bing. (A real search engine that exists!) And you know what? It's pretty great. It sees 83 million papers, not so far from estimations of the size of Google's universe, and does the same kind of natural-language queries. Unlike Scholar, people can hook into Microsoft Academic's API and see its citation graph, too.

Even as recently as 2015, scientific search engines weren't much use to anyone outside universities and libraries. You could find a citation to a paper, sure-but good luck actually reading it. Even though more overt efforts to subvert copyright like Sci-Hub are falling to lawsuits from places like Elsevier and the American Chemical Society, the open science movement gaining is momentum. PDFs are falling off virtual trucks all over the internet-posted on university web sites or places like ResearchGate and Academia.edu, hosts for exactly this kind of thing-Scholar's and Academic's first sorties against the paywall have been joined by reinforcements. It's starting to look like a siege.

For example the Chan Zuckerberg Initative, philanthropic arm of the founder of Facebook, is working on something aimed at increasing access. The founders of Mendeley have a new, venture-backed PDF finder called Kopernio. A browser extension called Unpaywall roots around the web for free PDFs of articles.

A particularly novel web crawler comes from the non-profit Allen Institute for Artificial Intelligence. Semantic Scholar pores over a corpus of 40 million citations in computer science and biomedicine, and extracts the tables and charts as well as using machine learning to infer meaningful cites as "highly influential citations," a new metric. Almost a million people use it every month.

"We use AI techniques, particularly natural language processing and machine vision, to process the PDF and extract information that helps readers decide if the paper is of interest," says Oren Etzioni, CEO of the Allen Institute for AI. "The net effect of all this is that more and more is open, and a number of publishers ... have said making content discoverable via these search engines is not a bad thing."

Even with all these increases in discoverability and access, the technical challenges of scientific search don't stop with paywalls. When Acharya and Verstak started out, Google relied on PageRank, a way to model how important hyperlinks between two web pages were. That's not how scientific citations work. "The linkage between articles is in text. There are references, and references are all approximate," Acharya says. "In scholarship, all your citations are one way. Everybody cites older stuff, and papers never get modified."

Plus, unlike a URL, the location or citation for a journal article is not the actual journal article. In fact, there might be multiple copies of the article at various locations. From a perspective as much philosophical and bibliographical, a PDF online is really just a picture of knowledge, in a way. So the search result showing a citation might also attach to multiple versions of the actual article.

That's a special problem when researchers can post pre-print versions of their own work but might not have copyright to the publication of record, the peer-reviewed, copy-edited version in the journal. Sometimes the differences are small; sometimes they're not.

Why don't the search engines just use metadata to understand what version belongs where? Like when you download music, your app of choice automatically populates with things like an image, the artist's name, the song titles...the data about the thing.

The answer: metadata LOL. It's a big problem. "It varies by source," Etzioni says. "A whole bunch of that information is not available as structured metadata." Even when there is metadata, it's in idiosyncratic formats from publisher to publisher and server to server. "In a surprising way, we're kind of in the dark ages, and the problem just keeps getting worse," he says. More papers get published; more are digital. Even specialists can't keep up.

Which is why scientific search and open science are so intertwined and so critical. The reputation of a journal and the number of times a specific paper in that journal gets cited are metrics for determining who gets grants and who gets tenure, and by extension who gets to do bigger and bigger science. "Where the for-profit publishers and academic presses sort of have us by the balls is that we are addicted to prestige," says Guy Geltner, a historian at the University of Amsterdam, open science advocate, and founder of a new user-owned social site for scientists called Scholarly Hub.

The thing is, as is typical for Google, Scholar is as opaque about how it works and what it finds. Acharya wouldn't give me numbers of users or the number of papers it searches. ("It's larger than the estimates that are out there," he says, and "an order of magnitude bigger than when we started.) No one outside Google fully understands how the search engine applies its criteria for inclusion, ³ and indeed Scholar hoovers up way more than just PDFs of published or pre-published articles. You get course syllabi, undergraduate coursework, PowerPoint presentations ... actually, for a reporter, it's kind of fun. But tricky.

That means the citation data is also obscure, which makes it hard to know what Scholar's findings mean for science as a whole. Scholar may be a low-priority side-project (please don't kill it like you killed Reader!) but maybe that data is going to be valuable someday. Elsevier obviously thinks it's useful.

The scientific landscape is shifting. "If you took a group of academics right now and asked them to create a new system of publishing, nobody would suggest what we're currently doing," says David Barner, a psychologist at UC San Diego and open science advocate. But change, Barner says, is hard. The people who'd make those changes are already overworked, already volunteering their time.

Even Elsevier knows that change is coming. "Rather than scrabble around in one of the many programs you've mentioned, anyone can come to our Science and Society page, which details a host of programs and organizations we work with to cater through every scenario where somebody wants access," Hersh says. And that'd be to the final, published, peer-reviewed version-the archived, permanent version of record.

Digital revolutions have a way of #disrupting no matter what. As journal articles get more open and more searchable, value will come from understanding what people search for-as Google long ago understood about the open web. "We're a high quality publisher, but we're also an information analytics company, evolving services that the research community can use," Hersh says.

Because reputation and citation are core currencies to scientists, scientists have to be educated about the possibilities of open publication at the same time as prestigious, reputable venues have to exist. Preprints are great, and the researchers maintain copyright to them, but it's also possible that the final citation-of-record could be different after it goes through review. There has to be a place where primary scientific work is available to the people who funded it, and a way for them to find it.

Because if there isn't? "A huge part of research output is suffocating behind paywalls. Sixty-five of the 100 most cited articles in history are behind paywalls. That's the opposite of what science is supposed to do," Geltner says. "We're not factories producing proprietary knowledge. We're engaged in debates, and we want the public to learn from those debates."

I'm sensitive to the irony of a WIRED writer talking about the social risks of a paywall, though I'd draw a distinction between paying a journalistic outlet for its journalism and paying a scientific publisher for someone else's science.

An even more critical difference, though, is that a science paywall does more than separate gown from town. When all the solid, good information is behind a paywall, what's left outside in the wasteland will be crap-propaganda and marketing. Those are always free, because people with political agendas and financial interests underwrite them. Understanding that vaccines are critical to public health and human-driven carbon emissions are un-terraforming the planet cannot be the purview of the one percent. "Access to science is going to be a first-world privilege," Geltner says. "That's the opposite of what science is supposed to be about."

¹ UPDATE 12/3/17 11:55 AM Corrected the spelling of this name.² UPDATE 12/4/17 1:25 PM Removed the word "another;" researchers sometimes pay to make their own articles open-access.³ UPDATE 12/4/17 1:25 PM Clarified to show that Google publishes inclusion criteria.

# data[].attributes.attachment_link.title
It's Gonna Get a Lot Easier to Break Science Journal Paywalls

# data[].attributes.attachment_link.description
Anurag Acharya's problem was that the Google search bar is very smart, but also kind of dumb. As a Googler working on search 13 years ago, Acharya wanted to make search results encompass scholarly journal articles. A laudable goal, because unlike the open web, most of the raw output of scientific research was invisible-hidden behind paywalls.

# data[].attributes.headline
Lesson Plan from Duke University on Information Privilege

# data[].attributes.subject
Lesson Plan from Duke University on Information Privilege

# data[].attributes.attachment_link.readable_text
Topic

Information Privilege

Key Takeaways

Lots of scholarly information is inaccessible to people outside of large, well-funded research universities like Duke.

There are barriers to information access that people might encounter due to their geography, access to technology, identity, status, financial situation, etc.

The Open Access movement seeks to address these disparities.

Notes for the instructor/librarian

This topic could potentially be a touchy subject for students who haven't thought about these aspects of privilege previously and should be framed carefully. It could be a great fit for an undergraduate course that has any social justice component. Students in these classes might be better primed for talking about disparities/inequalities and could apply that to this concept of information access. However, this discussion can be applicable to any level/discipline.

Lesson Content
Below you will find a variety of ways to briefly address this topic. Pick, choose, and adapt as you like.

Quick Mentions

When teaching a class and discussing databases, talk to students about how they will lose access to most of our databases upon graduation.

Mention alternative sources of free and open access information: public libraries, Google Scholar, unpaywall.org, Open Access Button, etc.

Mention to students that they will likely rarely encounter an item (book, article) they can't get through Duke Libraries, but many students at smaller colleges or researchers outside of the United States and western Europe may face significant barriers to getting the academic material they need.

Discussion Questions

Who has access to scholarly information and who does not?

Should access to scholarly information be free (why or why not)?

Should access to information be a human right? (Give an example: study reporting experimental cancer treatments; access to legal information for someone who is incarcerated). If not, are there certain types of information that you think should be free vs. others that should have a fee?

What barriers to information access can you think of?

"Access to science is going to be a first-world privilege ... that's the opposite of what science is supposed to be about." - Guy Geltner, Professor of History, University of Amsterdam

Visuals & Media(See all content in Google Drive)

Invisible Knapsack / Information Privilege graphic -

The "invisible knapsack" was introduced by she wrote on "white privilege." The essay describes what privilege (in this case, white privilege) looks like in everyday situations. This image riffs off of this and presents examples of what Peggy McIntosh in a 1989 essay information privilege might look like. The image could spark a conversation for students about the privileges around info access they have experienced, but had not thought about.

Defining Information Privilege

Digital Divide - who has access to the internet & who does not. This infographic from the IMF illustrates some of the issues surrounding the global digital divide.

Activities(See all content in Google Drive)

Game / Quiz / Survey
Should these be free ... (Why, or why not??)
Slide provides some examples of source types (popular movie, book, journal, engineering standard, market research report) to serve as a discussion about what kind of information is free/not free. Could adapt to examples from the topic/discipline of the course.

Case Studies / Scenarios (similar scenario-based lesson plan from Project CORA). Notes for instructor: Provide background on results of lack-of-access in these scenarios - in journalism, in community colleges, in politics.

Example: A student at a community college is taking a Biology class and researching zebrafish. The student finds an interesting article in his Google search results, but hits a page asking for money (a.k.a. a paywall). Instead of paying $45(!) for the article, the student finds some alternative information on the topic in a Wikipedia article.

Example: A journalist for a local independent newspaper is doing some investigative research on the growing trend of "white flight" between students attending public schools and charter schools in the community. The journalist finds some interesting articles in scholarly education journals and books listed on Google, but her newspaper does not have subscription access. What should she do?

Example: You are graduated and interning on Capitol Hill. Your boss asks you to find the latest information on water safety and public health. You're able to find some readily available sources, but most of the evidence-based/scientific water studies are behind a paywall. What do you do?

An activity where the facilitator (instructor or librarian) asks students to stand up and line up on one side of the room. The facilitator reads a list of questions related to information privilege. Students take a step forward if they answer yes, and step backward if the answer is no. Information Privilege Walk: Note for instructor: This activity would be best done when facilitator has a rapport with the students, as it may make some students uncomfortable. It could be adapted to be an used as an anonymous questionnaire, or a list of questions for discussion, if anonymity makes more sense. See Google Drive folder for sample Information Privilege questions.

Student Readings

# data[].attributes.attachment_link.description
Topic Information Privilege Key Takeaways Lots of scholarly information is inaccessible to people outside of large, well-funded research universities like Duke. There are barriers to information access that people might encounter due to their geography, access to technology, identity, status, financial situation, etc. The Open Access movement seeks to address these disparities.

# data[].attributes.attachment_link.provider_name
Digital Citizenship Literacy Curriculum | United States | Cyber Civics

# data[].attributes.attachment_link.title
The 7 Indispensable Digital Life Skills | Digital Citizenship Literacy Curriculum | United States | Cyber Civics

# data[].attributes.attachment_link.description
What are today's indispensable digital life skills? Find out by reading and downloading this handy checklist, and then ask yourself if your school is teaching

# data[].attributes.attachment_link.title
Unpaywall: An open database of 20 million free scholarly articles

# data[].attributes.attachment_link.description
An open database of 30,352,123 free scholarly articles.

# data[].attributes.attachment_link.title
Social Engineering Tactics Infographic | RECOIL OFFGRID

# data[].attributes.attachment_link.description
Personal interaction is a fine balance of trust and suspicion. On one hand, we shouldn't be too trusting of strangers, as this may allow malicious individuals to take advantage of our blind trust. On the other hand, we can't exactly go through life cynically doubting and scrutinizing everyone we know at all times - that would ...

# data[].attributes.headline
Obstacles to Healthy Digital Life Skills

# data[].attributes.subject
Obstacles to Healthy Digital Life Skills

# data[].attributes.body
Poverty and Fear

# data[].attributes.attachment_link.readable_text
Many of the definitions below are taken from the OWASP glossary ( https://www.owasp.org/index.php/Category:Glossary) and the NIST Glossary of Key Information Security Terms, NISTIR 7298, revision 2 ( http://nvlpubs.nist.gov/nistpubs/ir/2013/NIST.IR.7298r2.pdf). Definitions taken from these documents contain links to the source document in the title of the glossary term.

A
API
Application programming interface. For Web and mobile applications, this is a network-facing interface that the application can use to request user-specific information from the application's servers.
Authentication cookie
See session token.

C

A data object that binds information about a person or some other entity to a public key. The binding is generally done using a digital signature from a trusted third party (a certification authority).

An entity that manages digital certificates -- i.e., issues and revokes.

Data in its encrypted form.

Data exchanged between an http server and a browser (a client of the server) to store state information on the client side and retrieve it later for server use.

A class of problems resulting from insufficient input validation where one user can add content to a Web site that can be malicious when viewed by other users of the Web site. For example, one might post to a message board that accepts arbitrary HTML and include a malicious code item.

E

Any attack on a data connection wherein one simply records or views data instead of tampering with the connection.

Conversion of plain text to cipher text through the use of a cryptographic algorithm.
Exploit
To successfully leverage a security vulnerability to gain unauthorized access to a system or its contents.
Exploitability
The ease with which a given vulnerability can successfully be exploited.

H

A function that maps a string of arbitrary length to a fixed size value in a deterministic manner. Such a function may or may not have cryptographic applications.
HTTP
Hypertext Transport Protocol, the network-messaging protocol commonly used for transmission of requests and responses (including Web pages and data) between browser and mobile applications and their servers.
HTTPS
Secure http, or http sent over a secure link to protect the authenticity, privacy, and security of the information being transmitted.

I

The magnitude of harm that can be expected to result from the consequences of unauthorized disclosure of information, unauthorized modification of information, unauthorized destruction of information, or loss of information or information system availability.
Intercepting proxy
Standard protocol for transmission of data from source to destinations in packet-switched communications networks and interconnected systems of such networks.

L
localhost
A standard name used to define the network name of the host computer to programs running on that computer. In other words "this computer." For example, setting the IP address in a proxy program to localhost tells it to monitor that computer's network interface. This can also be represented with the default address "127.0.0.1."

M

An eavesdropping attack wherein a client's communication with a server is proxied by an attacker. Generally, the implication is that the client performs a cryptographic key exchange with an entity and fails to authenticate that entity, thus allowing an attacker to look like a valid server.
MITM
See man-in-the-middle attack.

P

A digital form of social engineering that uses authentic-looking -- but bogus -- emails to request information from users or direct them to a fake Web site that requests information.

Intelligible data that has meaning and can be understood without the application of decryption.
Proxy
A program that acts as an intermediary between a user's applications and the Internet. In security testing, a proxy can be used to examine and modify the requests and responses between an application and its servers.

R
Remote attack
A remote attack can be exploited without access to a user's network traffic. For example, an API that provides user information without checking that the requestor has access rights for the information makes a remote attack possible.

S

Data that can be public but is used to prevent precomputation attacks.

A popular protocol for establishing secure channels over a reliable transport, utilizing a standard X.509 public key infrastructure for authenticating machines. This protocol has evolved into the TLS protocol, but the term "SSL" is often used to generically refer to both.

A value that represents a user's identity during his or her session. Typically the user provides some form of credentials (e.g., username, password, possibly a one-time token value from a second authentication factor), and the server returns a token value that represents the user's identity. In Web applications, this token is often returned in a cookie. The client application includes the session token with each request, enabling the server to associate each request with the same user, role, and session.
Session hijack
An attack that takes over a session belonging to another user. This is typically accomplished through acquiring the user's session-token cookie and installing it in an attacker's browser. Also known as a sidejack.
Sidejack
See session hijack.

Attacks where data is read off a network while in transit without modifying or destroying the data.

See also eavesdropping attack.

A general term for attackers trying to trick people into revealing sensitive information or performing certain actions, such as downloading and executing files that appear to be benign but are actually malicious.
Spoofing
The practice of falsifying data to masquerade as a legitimate resource or entity.
SSL
See Secure Socket Layer.
SSL certificate spoofing
An attack that provides an SSL certificate from an untrusted source in an attempt to gain access to encrypted SSL communications. Problems in a mobile application's certificate verification can allow this attack to succeed.

T
TLS
See Transport Layer Security.

The successor to SSL, a protocol for establishing secure channels over a reliable transport, using a standard X.509 public key infrastructure for authenticating machines. The protocol is standardized by the Internet Engineering Task Force (IETF).

See also Secure Socket Layer.

U
URL
Uniform resource locator, another term for a site's "Web address" specifying how to find it on the Internet. For example: " https://www.graphite.org" is a URL.

V
Vulnerability
A security weakness in a system or application. A vulnerability creates an opportunity for an exploit that can impact an application and its users by compromising the system or its contents.

# data[].attributes.attachment_link.description
Many of the definitions below are taken from the OWASP glossary ( https://www.owasp.org/index.php/Category:Glossary) and the NIST Glossary of Key Information Security Terms, NISTIR 7298, revision 2 ( http://nvlpubs.nist.gov/nistpubs/ir/2013/NIST.IR.7298r2.pdf). Definitions taken from these documents contain links to the source document in the title of the glossary term. API Application programming interface.

# data[].attributes.attachment_link.readable_text
In the full Privacy Evaluations, we organize each evaluation into four concerns: Safety, Privacy, Security, and Compliance. When we run an evaluation, we read the policies and answer questions that relate to each of these concerns. This page shows the questions that we use when evaluating these specific concerns.

To jump to a specific concern, use these links:

You have multiple other options to learn more about the questions used to run the evaluations:

9.1.1: Safe Interactions

9.1.2: Unsafe Interactions

9.2.1: Visible Data

9.2.2: Profile Visibility

9.2.3: Control Visibility

Do the policies clearly indicate whether or not a user has control over how their personal information is displayed to others?

9.3.1: Block Content

9.3.2: Report Abuse

Do the policies clearly indicate whether or not a user can report abuse or cyber-bullying?

9.4.1: Monitor Content

Do the policies clearly indicate whether or not user content is reviewed, screened, or monitored by the vendor?

9.4.2: Filter Content

9.4.3: Moderate Interactions

9.4.4: Log Interactions

Do the policies clearly indicate whether or not social interactions are logged by the vendor?

9.4.5: School Audit

Do the policies clearly indicate whether or not social interactions may be audited by a school or district?

9.4.6: Parent Audit

Do the policies clearly indicate whether or not social interactions may be audited by a parent or guardian?

9.4.7: User Audit

Do the policies clearly indicate whether or not social interactions may be audited by a user or eligible student?

9.5.1: Safe Tools

Privacy: Protecting collected information

1.1.2: Change Log

Do the policies clearly indicate a changelog or past versions of the policies are available for review?

1.2.1: Services Include

1.3.1: Review Changes

1.3.2: Effective Changes

1.4.1: Change Notice

1.4.2: Method Notice

1.4.3: Cookie Notice

1.6.1: Quick Reference

1.7.1: Preferred Language

2.1.1: Collect PII

2.1.2: PII Categories

2.1.3: Geolocation Data

2.1.4: Health Data

2.1.5: Behavioral Data

2.1.6: Sensitive Data

Do the policies clearly indicate whether or not sensitive personal information is collected?

2.1.7: Usage Data

2.1.8: Lunch Status

2.3.1: Data Excluded

Do the policies clearly indicate whether or not the vendor does not collect specific types of data?

2.3.2: Coverage Excluded

Do the policies clearly indicate whether or not the vendor excludes specific types of collected data from coverage under its privacy policy?

2.4.1: Collection Limitation

3.1.2: Data Categories

3.2.1: Sharing Purpose

3.2.2: Third-Party Analytics

3.2.3: Third-Party Research

3.2.4: Third-Party Marketing

3.3.1: Exclude Sharing

Do the policies clearly indicate whether the vendor specifies the categories of information that will not be shared with third parties?

3.4.1: Data Sold

3.5.1: Data Acquired

3.6.1: Data Deidentified

3.6.2: Deidentified Process

3.8.1: Authorized Access

3.9.1: Third-Party Collection

3.10.1: Data Misuse

Do the policies clearly indicate whether or not a user's information can be deleted from a third party by the vendor, if found to be misused by the third party?

3.11.1: Third-Party Providers

3.11.2: Third-Party Roles

3.12.1: Third-Party Categories

3.13.1: Third-Party Policy

Do the policies clearly indicate whether a link to a third-party service provider, data processor, partner, or affiliate's privacy policy is available for review?

3.14.1: Vendor Combination

3.14.2: Third-Party Combination

3.15.1: Social Login

3.15.2: Social Collection

3.15.3: Social Sharing

3.16.1: Third-Party Limits

3.16.2: Combination Limits

4.1.1: Purpose Limitation

4.1.2: Data Purpose

4.2.1: Data Type

Do the policies clearly indicate specific types of personal information (PII, Non-PII, Children's PII, Sensitive information, etc.)?

4.3.1: Account Type

Do the policies clearly indicate different types or classes of user accounts?

4.4.1: Combination Type

4.5.1: Context Notice

Do the policies clearly indicate whether or not notice is provided to a user if the vendor changes the context in which data are collected?

4.6.1: Practice Changes

Do the policies clearly indicate whether or not the vendor will obtain consent if the practices in which data are collected change or are inconsistent with contractual requirements?

4.7.1: Community Guidelines

Do the policies clearly indicate whether or not the vendor may terminate a user's account if they engage in any prohibited activities?

5.1.1: User Submission

Do the policies clearly indicate whether or not a user can create or upload content to the service?

5.1.2: Content Control

5.2.1: Collection Consent

5.4.1: User Control

5.5.1: Opt-Out Consent

5.5.2: Disclosure Request

5.5.3: Disclosure Notice

6.6.1: User Export

7.1.1: Transfer Data

7.1.2: Data Assignment

Do the policies clearly indicate whether or not the vendor can assign its rights or delegate its duties under the policies to a third party without notice or consent?

7.2.1: Transfer Notice

Do the policies clearly indicate whether or not a user will be notified and allowed to provide consent to a data transfer to a third-party successor, in the event of a vendor bankruptcy, merger, or acquisition?

7.3.1: Delete Transfer

Do the policies clearly indicate whether or not a user can request to delete their data prior to its transfer to a third-party successor in the event of a vendor bankruptcy, merger, or acquisition?

7.4.1: Contractual Limits

10.1.1: Service Messages

Do the policies clearly indicate whether or not a user will receive service or administrative related email or text message communications from the vendor or third party?

10.2.1: Traditional Ads

10.3.1: Behavioral Ads

10.4.1: Third-Party Tracking

10.4.2: Track Users

10.4.3: Ad Profile

10.5.1: Child Ads

10.5.2: Filter Ads

Do the policies clearly indicate whether or not advertisements that are age inappropriate for minors are filtered (e.g., alcohol, gambling, violent, or sexual content)?

Background: * Advertising to children in school presents a variety of legal issues. Several states have laws that place restrictions on the advertising of products or services that have inappropriate content for children, such as alcohol and firearms. Additionally, contextual advertising would likley be permissible as, 'support for internal operations' of a service or applciation, in contrast to behaviorally targeted advertising that implicates several privacy laws such as the CIPA, COPPA, and FERPA, which restrict the use of personal information without parental consent.

10.6.1: Marketing Messages

10.7.1: Unsubscribe Ads

10.7.2: Unsubscribe Marketing

10.8.1: DoNotTrack Response

10.8.2: DoNotTrack Description

0.1.1: Policy Available

0.1.2: Same Policy

0.1.5: Use Trackers

0.2.2: Policy Accessible

0.2.3: Allow Crawling

0.2.4: Policy Purchase

0.2.5: Policy Registration

0.3.1: Free Account

Can you create a free sample account with the application or service?

0.3.2: Access Code

Does the application or service require the purchase of hardware or a School access code to create an account?

0.3.3: Purchase Options

Does the application or service offer a seperate paid version or In-App-Purchases?

0.4.1: Policy Readable

Do the policies contain structural or typographical errors?

Security: Protecting against unauthorized access

8.1.1: Verify Identity

8.2.1: Account Required

Do the policies clearly indicate whether or not the vendor requires a user to create an account with a username and password in order to use the Service?

8.2.2: Managed Account

Do the policies clearly indicate whether or not the vendor provides user managed accounts for a parent, teacher, school or district?

8.2.3: Two-Factor Protection

Do the policies clearly indicate whether or not the security of a user's account is protected by two-factor authentication?

8.3.1: Security Agreement

8.4.1: Reasonable Security

8.4.2: Employee Access

8.5.1: Transit Encryption

8.6.1: Storage Encryption

8.6.2: Data Control

Do the policies clearly indicate whether or not personal information are stored outside the direct control of the vendor?

8.7.1: Breach Notice

0.1.3: Default Encryption

0.1.4: Encryption Required

Compliance: Following statutory laws and regulations

1.8.1: Children Intended

1.8.2: Teens Intended

1.8.3: Adults Intended

1.8.4: Parents Intended

1.8.5: Students Intended

1.8.6: Teachers Intended

2.2.1: Student Data

2.2.2: Child Data

5.3.1: Restriction Notice

5.6.1: Data Ownership

Do the policies clearly indicate whether or not the vendor may limit its copyright license of a user's data?

6.1.1: Access Data

6.1.2: Restrict Access

6.1.3: Review Data

6.2.1: Maintain Accuracy

6.3.1: Data Modification

6.3.2: Modification Process

6.3.3: Modification Request

6.3.4: Modification Notice

Do the policies clearly indicate how long the vendor has to modify a user's inaccurate data after given notice?

6.4.1: Retention Policy

6.4.2: Retention Limits

6.5.1: Deletion Purpose

6.5.2: Account Deletion

6.5.3: User Deletion

6.5.4: Deletion Process

6.5.5: Deletion Notice

Do the policies clearly indicate how long the vendor may take to delete a user's data after given notice?

11.1.1: Actual Knowledge

11.1.2: Child Audience

11.1.3: COPPA Notice

11.1.4: COPPA Offline

11.1.5: Restrict Account

11.1.6: Restrict Purchase

11.1.7: Safe Harbor

11.2.1: Teen Data

11.3.1: School Purpose

11.3.2: Education Records

11.3.3: FERPA Notice

11.3.4: School Official

11.3.5: Directory Information

11.4.1: Parental Consent

11.4.2: Limit Consent

11.4.3: Withdraw Consent

11.4.4: Delete Child

11.4.5: Consent Method

11.4.6: Internal Operations

11.4.7: COPPA Exception

11.4.8: FERPA Exception

11.4.9: School Consent

Do the policies clearly indicate whether or not responsibility or liability for obtaining verified parental consent is transferred to the school or district?

11.5.1: Policy Jurisdiction

11.5.2: Dispute Resolution

11.5.3: Class Waiver

Do the policies clearly indicate whether or not the vendor requires waiver of any rights to join a class action lawsuit?

11.5.4: Law Enforcement

11.6.1: Privacy Award

11.7.1: GDPR Transfer

11.8.1: Accountability Audit

Do the policies clearly indicate whether or not the data privacy or security practices of the vendor are internally or externally audited to ensure compliance?

The Privacy Evaluation Questions are released under a Creative Commons Attribution Non-Commercial Share-Alike 4.0 License. If you use these questions in your non-commercial project, please credit Common Sense Media as the author, and link back to the announcement post.

This is an example of proper attribution for the Questions: The Privacy Evaluation Questions were authored by Common Sense Media, and are reusable under the terms of a Creative Commons Attribution Non-Commercial Share-Alike 4.0 License.

# data[].attributes.attachment_link.title
Privacy Questions, organized by Concern | Common Sense Education

# data[].attributes.attachment_link.description
In the full Privacy Evaluations, we organize each evaluation into four concerns: Safety, Privacy, Security, and Compliance. When we run an evaluation, we read the policies and answer questions that relate to each of these concerns. This page shows the questions that we use when evaluating these specific concerns.

# data[].attributes.headline
Excerpt from Harper's Magazine, Jan edition

# data[].attributes.subject
Excerpt from Harper's Magazine, Jan edition

# data[].attributes.attachment_link.readable_text
"The Goliath of totalitarianism will be brought down by the David of the microchip," Ronald Reagan said in 1989. He was speaking to a thousand British notables in London's historic Guildhall, several months before the fall of the Berlin Wall. Reagan proclaimed that the world was on the precipice of "a new era in human history," one that would bring "peace and freedom for all." Communism was crumbling, just as fascism had before it. Liberal democracies would soon encircle the globe, thanks to the innovations of Silicon Valley. "I believe," he said, "that more than armies, more than diplomacy, more than the best intentions of democratic nations, the communications revolution will be the greatest force for the advancement of human freedom the world has ever seen."

At the time, most everyone thought Reagan was right. The twentieth century had been dominated by media that delivered the same material to millions of people at the same time-radio and newspapers, movies and television. These were the kinds of one-to-many, top-down mass media that Orwell's Big Brother had used to stay in power. Now, however, Americans were catching sight of the internet. They believed that it would do what earlier media could not: it would allow people to speak for themselves, directly to one another, around the world. "True personalization is now upon us," wrote MIT professor Nicholas Negroponte in his 1995 bestseller Being Digital. Corporations, industries, and even whole nations would soon be transformed as centralized authorities were demolished. Hierarchies would dissolve and peer-to-peer collaborations would take their place. "Like a force of nature," wrote Negroponte, "the digital age cannot be denied or stopped."

One of the deepest ironies of our current situation is that the modes of communication that enable today's authoritarians were first dreamed up to defeat them. The same technologies that were meant to level the political playing field have brought troll farms and Russian bots to corrupt our elections. The same platforms of self-expression that we thought would let us empathize with one another and build a more harmonious society have been co-opted by figures such as Milo Yiannopoulos and, for that matter, Donald Trump, to turn white supremacy into a topic of dinner-table conversation. And the same networked methods of organizing that so many thought would bring down malevolent states have not only failed to do so-think of the Arab Spring-but have instead empowered autocrats to more closely monitor protest and dissent.

If we're going to resist the rise of despotism, we need to understand how this happened and why we didn't see it coming. We especially need to grapple with the fact that today's right wing has taken advantage of a decades-long liberal effort to decentralize our media. That effort began at the start of the Second World War, came down to us through the counterculture of the 1960s, and flourishes today in the high-tech hothouse of Silicon Valley. It is animated by a deep faith that when engineering replaces politics, the alienation of mass society and the threat of totalitarianism will melt away. As Trump fumes on Twitter, and Facebook posts are linked to genocide in Myanmar, we are beginning to see just how misplaced that faith has been. Even as they grant us the power to communicate with others around the globe, our social-media networks have spawned a new form of authoritarianism.

The political vision that brought us to this point emerged in the 1930s, as a response to fascism. In the years before the Second World War, Americans were mystified as to how Germany, one of the most sophisticated nations in Europe, had tumbled down the dark hole of National Socialism. Today we'd likely blame Hitler's rise on the economic chaos and political infighting of the Weimar era. But at the time, many blamed mass media. When Hitler spoke to row upon row of Nazi soldiers at torch-lit rallies, the radio broadcast his voice into every German home. When he drove through adoring crowds, standing in his Volkswagen convertible, giving the Nazi salute, the newsreel cameras were there. In 1933, the New York Times described the predicament of the average German this way:

With coordinated newspaper headlines overpowering him, with radio voices beseeching him, with news reels and feature pictures arousing him, and with politicians and professors philosophizing for him, the individual German has been unable to salvage his identity and has been engulfed in a brown wave. . . . They are living in a Nazi dream and not in the reality of the world.

Toward the end of the decade, President Roosevelt began searching for ways to urge Americans to take a unified stand against fascism. Given the rise of right-wing fervor in the United States at the time, he had reason to worry. The racism and anti- Semitism that characterized Nazi Germany also characterized much of American life. By 1938, millions of Americans listened weekly as Father Charles Coughlin, a Catholic demagogue, celebrated the rise of fascism and decried the existence of the Jews. Thousands of American fascists banded together in groups with names like the Silver Legion of America and the Crusader White Shirts. The Amerikadeutscher Volksbund, a 25,000-member pro-Nazi organization commonly known as the Bund, ran a summer camp on Long Island called Camp Siegfried, where young men marched in Nazi-style uniforms as their friends and families cheered. On February 20, 1939, the Bund brought more than 22,000 Americans to New York's Madison Square Garden to welcome fascism to American shores. When they gathered, a huge banner hung over their heads: stop jewish domination of christian americans!

As the United States geared up for war, its leaders faced a quandary: they wanted to use media to unite Americans against their enemies, but many also feared that using mass media to do it would transform Americans into just the kind of authoritarians they were trying to defeat. Roosevelt's cabinet sought advice from a group of intellectuals calling themselves the Committee for National Morale. The Committee had been founded in the summer of 1940 by a historian of Persian art named Arthur Upham Pope, who brought together a number of America's leading thinkers, including the anthropologists Margaret Mead and Gregory Bateson, psychologists Gordon Allport and Kurt Lewin, and journalists Edmond Taylor and Ladislas Farago. Over the next two years, they would advise the Roosevelt Administration; produce pamphlets, news articles, and books; and set the cornerstone of our contemporary faith in decentralized media.

The Committee began by defining national morale in terms of what they called the democratic personality. Members of the Committee joined many American intellectuals in subscribing to the views of the anthropologist Franz Boas, who believed that cultures shape the personalities of their members in predictable ways. Germans, they thought, tended toward rigidity and an affection for authority, hence Hitler's famously bureaucratic Nazi regime was a natural extension of the German character. Americans were more open, individualistic, expressive, collaborative, and tolerant, and so more at home in loose coalitions. Whatever kind of propaganda medium the Committee promoted would need to preserve the individuality of American citizens. Allport summed up the Committee's vision in a 1942 essay. "In a democracy," he wrote, "every personality can be a citadel of resistance to tyranny. In the co-ordination of the intelligences and wills of one hundred million 'whole' men and women lies the formula for an invincible American morale. "

As the Committee sought to coordinate rather than dominate American minds, its members turned to a kind of media system that we might now call a platform: the museum. These days we're not used to the idea of buildings as media systems. But the Committee thought about museums in the same way many think about virtual reality today-as immersive visual environments where we can increase our empathy for one another. Mead, who was a student of Boas and worked for the American Museum of Natural History in New York, pointed out that in a museum, people could walk among images and objects distributed across the walls and around the floor, choosing to pay attention to those that seemed most meaningful to them. They could hone their individual tastes, they could reason about their individual places in the world, and they could do it together.

In 1942, the Museum of Modern Art in New York put the Committee's vision into practice with a widely heralded propaganda exhibition entitled Road to Victory. Most American art shows at the time featured images of more or less identical sizes hung in a row at eye level, but this one mounted images of all sizes overhead, at the viewer's feet, and everywhere in between. A path wound through the forest of photographs. The pictures were carefully chosen to spark patriotic fervor, but judging from reviews, it was the manner of their display that captivated the show's audience. As one critic put it, the show did not seek to "mold" its visitors' beliefs, "for that word smacks of the Fascist concept of dominating men's minds." It simply invited Americans to walk down the road to war, individually unique, yet collectively united. Another reviewer wrote: "It is this inescapable sense of identity-the individual spectator identifying himself with the whole-that makes the event so moving."

The first electronic computer would not be unveiled until 1946, and the internet was still decades away. Yet the Committee's vision became central to how we think about computers today when several of its members began to collaborate with a mathematician named Norbert Wiener. In the first years of the war, Wiener and his MIT colleagues were trying to design a more accurate antiaircraft defense system. Antiaircraft gunners would only be able to shoot down enemy planes reliably if they could predict where the planes would be when the gunners' shells reached the sky. At the time, there was no way to make that prediction with any certainty, since both gunner and pilot were capable of random movements. Wiener tried to solve this problem by imagining the gunner, the antiaircraft gun, the enemy pilot, and the enemy plane as elements in a single system whose behavior could be represented mathematically.

Wiener's antiaircraft predictor never worked on the battlefield. But his insight that the behavior of both machines and human beings could be represented through computation became a founding principle of computer science. In 1946, it also became a founding principle of a new political vision. That year, Wiener and members of his scientific community traveled to New York to meet with a group of sociologists and psychologists, Mead and Bateson of the Committee for National Morale prominent among them. Together, the social and laboratory scientists began to outline a vision of a liberal world modeled and managed by computers, a vision that they would develop over the next seven years, and that would become one of the most influential intellectual movements of the twentieth century: cybernetics.

In 1950, Wiener published The Human Use of Human Beings, an enormously popular introduction to the new field that argued that modern society operated through a series of information exchanges, just like the antiaircraft predictor. Reporters and social scientists gathered data; intellectuals, business leaders, and politicians processed it; and, ultimately, the systems they controlled took action. When working properly, such a process would naturally tend toward equilibrium-that is, social order. And computers, Wiener argued, could help improve the flow of information by supplying decision-makers with better data faster. "Fascists, Strong Men in Business, and Government . . . prefer an organization in which all orders come from above, and none return," wrote Wiener. The solution to totalitarianism, he argued, was to recognize the world as a system of leveled, distributed communication that could be modeled and managed by computers. The proper way to achieve the Committee's vision and democratize society, his argument implied, was to take power away from politicians and put it in the hands of engineers.

Wiener's writings fired the imaginations of an unlikely group of young Americans, members of the Sixties counterculture who would go on to have an outsized impact on the computer industry. Between 1965 and 1973, as many as 750,000 Americans left their apartments and suburban houses and created new collective communities. A few of these communes were religious, but most were secular gatherings of white, middle- and upper-middle-class young people seeking to leave mainstream America behind. In northern California, refugees from Haight-Ashbury migrated north, to the woods of Mendocino, and east, to the high plains of Colorado and the mountains of New Mexico. Some even set up shop in the hills around Stanford University, overlooking what we now call Silicon Valley.

Elsewhere I've called this generation of pilgrims the "New Communalists" to distinguish them from members of the New Left, with whom they often disagreed. Unlike the young dissidents who formed parties and wrote manifestos, the New Communalists hoped to do away with politics entirely. They wanted to organize their communities around a shared mind-set, a unified consciousness. Many agreed with Charles Reich when he wrote in his 1970 bestseller, The Greening of America, that industrial society offered "a robot life, in which man is deprived of his own being, and he becomes instead a mere role, occupation, or function." According to Reich, the solution was to cultivate a new consciousness of one's own desires and needs, of the connections between one's body, one's mind, and the natural world. Such a consciousness, he explained, could become the foundation of a new kind of society, one that would be nonhierarchical and collaborative.

Watching this migration take shape was Stewart Brand, a former multimedia artist and sometime member of Ken Kesey's psychedelic wrecking crew, the Merry Pranksters. In 1968, Brand and his wife Lois drove their aging pickup truck to a string of communes to see what the new settlers needed in the way of tools. That fall, the Brands set up shop in Menlo Park, California, not far from where Facebook's headquarters stand today, and began to publish a document that quickly became required reading across the counterculture: the Whole Earth Catalog. Despite its name, the Catalog did not actually sell anything. Instead, it collected recommendations for tools that might be useful to people headed back to the land. One of those tools was Norbert Wiener's first book, Cybernetics. Another was an early and massive Hewlett-Packard calculator.

The New Communalists eschewed what Reich called the "machine world" of tanks and bombs and the industrial bureaucracies that produced them. The rule-bound hierarchies of the corporation and the state, they thought, alienated their members from their own feelings and turned them into the kind of buttoned-down apparatchiks who could launch a nuclear war. Even so, the New Communalists embraced small technologies that they hoped would help them live as independent citizens within the kind of universe that Wiener and the Committee had described, a universe in which all things were interlinked by information. The Catalog gave readers access to plans for Buckminster Fuller's geodesic domes and guides to everything from cheap travel to boatbuilding. At a time when it could be difficult to find a commune if you didn't know someone who lived on one, the Catalog also became a map of the commune world and its concerns. As the first nodes of the internet were being wired together, the Catalog became a paperbound search engine.

The future leaders of Silicon Valley took notice. Steve Jobs, who had spent some time on a commune called All One Farm, would later call the Catalog "one of the bibles of my generation. . . . It was sort of like Google in paperback form, thirty-five years before Google came along." Alan Kay, whose designs for a graphical user interface would shape several generations of Apple computers, explained that he and his colleagues saw the Catalog as an information system in its own right. In that sense, he said, he "thought of the Whole Earth Catalog as a print version of what the internet was going to be."

By the mid-1980s, computers were small enough to sit on desks, and individual users were able to type messages to one another in real time. Most of the communes had collapsed, but the computer industry in northern California was growing rapidly, and it welcomed former communards. Brand worked with Larry Brilliant, who would later help launch Google's philanthropy division, Google.org, to design an online discussion system known as the Whole Earth 'Lectronic Link or WELL. On the WELL, users dialed in to a server where they saw messages from other users in threaded conversations. Howard Rheingold, a journalist and early member, believed that the WELL was a melding of the minds, a kind of virtual community. "Personal computers and the PC industry," he wrote later, "were created by young iconoclasts who had seen the LSD revolution fizzle, the political revolution fail. Computers for the people was the latest battle in the same campaign."

By the end of the decade, when Reagan hailed the "David of the microchip," many in Silicon Valley believed they had the tools to create the kind of person-centered democracy that the Committee had envisioned. They would achieve it through open conversation spaces like the WELL, engineered public spheres in which individuals gave voice to their experiences, gathered feedback from their peers, and changed their behavior accordingly. They shared Wiener's faith in the power of information systems to liberate those who used them, and the Committee's confidence that, given the chance to express themselves, individuals could create their own social order, without the need for top-down government control. If the mass-media era had brought us Hitler and Stalin, they believed, the internet would bring us back our individuality. Finally, we could do away with hierarchy, bureaucracy, and totalitarianism. Finally, we could just be ourselves, together.

Today, that sense of utopian mission persists throughout Silicon Valley. A month after Trump took office, Mark Zuckerberg laid out his social vision in a Facebook post entitled "Building Global Community." Though only a few thousand words long, the document is every bit as ambitious as Wiener's The Human Use of Human Beings. Like Wiener, Zuckerberg envisions a world in which individuals, communities, and nations create an ideal social order through the constant exchange of information-that is, through staying "connected." "Our greatest opportunities are now global-like spreading prosperity and freedom, promoting peace and understanding, lifting people out of poverty, and accelerating science," he wrote, sounding much like a representative of the Cold War-era State Department. "In times like these," he continued, "the most important thing we at Facebook can do is develop the social infrastructure to give people the power to build a global community that works for all of us."

For Zuckerberg, as for much of the left today, the key to a more egalitarian society lies in the freeing of individual voices, the expression of different lived experiences, and the forming of social groups around shared identities. But Facebook has tried to enable this kind of society by creating privately owned, for-profit digital technologies. As Zuckerberg put it, echoing the goals of the Whole Earth Catalog fifty years before, "Our commitment is to continue improving our tools to give you the power to share your experience." Engineers like Zuckerberg or, for that matter, Wiener, have little interest in party politics: if you want to change the world, you don't lobby or vote; you build new technologies.

This view has proved enormously profitable across Silicon Valley. By justifying the belief that for-profit systems are the best way to improve public life, it has helped turn the expression of individual experience into raw material that can be mined, processed, and sold. The big social-media companies, which often began with a dream of making WELL-like virtual communities at scale, have now become radically commercialized and devoted to surveillance at every level. On the WELL, users listened to each other, trying to get a feel for what kinds of people they were and how they might work together. Now user data is optimized and retailed automatically, to advertisers and other media firms, in real time. Computers track conversations and extract patterns at light speed, rendering them profitable. In 2017, Facebook reported annual revenue of more than $40 billion.

Social media's ability to simultaneously solicit and surveil communication has not only turned the dream of individualized, expressive democracy into a fountain of wealth. It has turned it into the foundation of a new kind of authoritarianism. Fascists used to be distinguished by their penchant for obedience, submission, and self-erasure, with the power of public emotional expression reserved for the dictator. That is why both Wiener and the Committee stressed the qualities of independence and self-awareness in the democratic personality. And it was against the background of fascism that, during and after the 1960s, Vietnam protestors, civil-rights activists, feminists, queer-rights activists, and other members of the myriad communities who drove the rise of identity politics asserted their individual, lived experience as the basis of their right to political power. If the essence of totalitarianism was collective self-effacement, the foundation of democracy would have to be the assertion of collective individuality.

Today, radio and television talk shows, podcasts, blogs, and, of course, social media are part of a new media ecosystem that has rendered the voicing of one's experiences so easy and powerful as to turn it into an appealing tool for the right as well as the left. Figures such as Richard Spencer, for instance, have adopted the playful, confessional style of online influencers everywhere. Since Spencer coined the euphemistic term in 2008, the "alt-right" has come to shelter white nationalists, anti-Semites, radical misogynists, and neo-Nazis. What holds the movement together in the public eye is its savvy use of social media. Over the past two years, scholars at the Data & Society Research Institute, an independent think tank in New York, have been tracking the rise of the alt-right online. In a series of reports, they have revealed a world in which the kinds of men who chanted "Jews will not replace us!" in Charlottesville, Virginia, present themselves in the bright, first-person style of online makeup instructors. They aim to be read as whole people-witty, warm, and authentically themselves.

Rebecca Lewis, a Data & Society researcher who is now a PhD student at Stanford, has studied sixty-five such right-wing influencers on YouTube. Most are masters of microcelebrity. They brand themselves with care, spark attention-getting controversy wherever possible, link to one another's websites, appear on one another's YouTube shows, and optimize their video feeds for search engines. Despite their intellectual differences, Lewis points out that they have been able to create the impression that they are a unified political force. Their chummy, millennial-friendly style, she argues, goes a long way toward suggesting that really, you know, anti-Semitism and violent, racist riots are the kind of thing that thinking young people everywhere ought to embrace.

Alt-right figures have consciously modeled their online behavior after the political logic of the 1960s counterculture, and particularly its New Communalist wing. In a 2016 interview with The Atlantic, Spencer could have been channeling an entire generation of commune-builders when he said, "We are really trying to change the world, and we are going to do that by changing consciousness, and by changing how people see the world, and how they see themselves." The Daily Stormer, a neo-Nazi website, put the project less benignly in a leaked style guide: "One should study the ways that Jews conquered our culture in the 1960s. . . . They created a subculture by infesting certain elements of the existing culture. That is what we aim to do."

The identity-based movements of the left have been extraordinarily effective at changing American culture, and the alt-right clearly hopes to copy their success. By claiming the mantle of rebellion, the alt-right can take to the streets in protest as if anticolonialism in the classroom were a new Vietnam War. They can argue that their ability to spew hate is in fact a civil right, and that their movement is simply a new version of the Free Speech Movement of 1964. On YouTube, they can tell stories of their own conversion to conservatism in an idiom pioneered by gay activists: the coming-out story. Lewis notes that the conservative activist Candace Owens rose to YouTube fame after she posted a humorous video on her channel, Red Pill Black, that revealed her political beliefs to her parents. Owens titled it, "Mom, Dad?. . . I'm a Conservative." When friends and families find their new politics reprehensible, the converts need not engage. Their storytelling style alone implies that racism and nationalism are in fact just as natural and true as a person's sexuality.

Pundits on the left are fond of reminding us of how Trump storms and fulminates, the White House itself unable to contain his petulance and rage. Those same pundits then marvel that around 40 percent of the American people still think he is doing a good job. What they fail to understand is that Trump has mastered the politics of authenticity for a new media age. What mainstream analysts see as psychological weakness, Trump's fans see as the man just being himself. What's more, his anger, his rants, and his furious narcissism act out the feelings of people who believe they have been dispossessed by immigrants, women, and people of color. Trump is not only true to his own emotions. He is the personification of his supporters' grievances. He is to his political base what Hitler was to many Germans, or Mussolini to Italians-the living embodiment of the nation.

Here, the identity-centered liberalism that has dominated so much of public life since the Second World War has come full circle. Its victories have been many, from civil rights to legalized abortion and gay marriage, and they have dramatically changed American life for the better. But in the form of people like Trump and Spencer, the performance of individualism-the revelation of the whole person in the context of public debate that was meant for so long to be a bulwark against totalitarianism-has also allowed today's authoritarians to claim a new legitimacy. Fifty years ago, the New Left marched on the Pentagon, hoping to undermine the military-industrial complex behind the Vietnam War. Today, Trump attacks the FBI and the Justice Department, hoping to undermine a fantastical Minotaur called "the deep state." Fifty years ago, the counterculture hoped to bring about a world in which individuals could be more authentically themselves, and in which the hierarchies of organizations and states would disappear. Today, those hierarchical institutions are all that stand between us and a cult of personality.

If the communes of the 1960s teach us anything, they teach us that a community that replaces laws and institutions with a cacophony of individual voices courts bigotry and collapse. Without explicit, democratically adopted rules for distributing resources, the communes allowed unspoken cultural norms to govern their lives. Women were frequently relegated to the most traditional of gender roles; informal racial segregation was common; and charismatic leaders-almost always men-took charge. Even the most well-intentioned communes began to replicate the racial and sexual dynamics that dominated mainstream America. Lois Brand recalled that on the communes they visited, men would do "important stuff" like framing up domes, while she and the other women would put small amounts of bleach in the water to keep residents from getting sick.

For all their sophistication, the algorithms that drive Facebook cannot prevent the recrudescence of the racism and sexism that plagued the communes. On the contrary, social-media platforms have helped bring them to life at a global scale. And now those systems are deeply entrenched. Social-media technologies have spawned enormous corporations that make money by mapping and mining the social world. Like the extraction industries of previous centuries, they are highly motivated to expand their territories and bend local elites to their will. Without substantial pressure, they have little incentive to serve a public beyond their shareholders. Companies such as Facebook and Twitter are coming to dominate our public sphere to the same degree that Standard Oil once dominated the petroleum industry. They too should be subject to antitrust laws. We have every right to apply the same standards to social-media companies that we have applied to other extraction industries. We cannot allow them to pollute the lands they mine, or to injure their workers, nearby residents, or those who use their products.

As Columbia law professor Tim Wu has argued, social-media companies are enabling a new form of censorship by allowing human and robotic users to flood the inboxes of their enemies in an effort to keep them quiet, and there are little-used provisions of the First Amendment that could radically slow these processes. We also have alternatives to traditional private or stockholder ownership of our social media. We can already see some of the possibilities in sharing practices developed within the computer industry, such as open-source code and "copyleft" rights management. An international community of scholars and technologists has looked for some time at creating cooperatively owned online platforms. As Nathan Schneider, a professor at the University of Colorado and one of the movement's leaders, has pointed out, member-owned cooperatives generate 11 percent of the electricity sold in America. If social media are equally important to our lives, he asks, why shouldn't we take a hand in owning and managing them?

That question is a good one, but it doesn't quite capture the historical specifics of our situation. The new authoritarianism represented by Spencer and Trump is not only a product of who owns today's media. It's also a product of the political vision that helped drive the creation of social media in the first place-a vision that distrusts public ownership and the political process while celebrating engineering as an alternative form of governance. Since the Second World War, critics have challenged the legitimacy of our civic institutions simply on the grounds that they were bureaucratic and slow to change. Yet organizations such as hospitals demonstrate the value of these features. They remind us that a democracy must do more than allow its citizens to speak. It must help them live. Above all, it must work to distribute our wealth more equably and to ensure that every member of society has both independence and security. This is work that requires intense negotiation among groups with conflicting material interests, and, often, deep-seated cultural differences. It requires the existence of institutions that can preserve and enforce the results of those negotiations over time. And it requires that those institutions be obliged to serve the public before tending to their own profits.

Today's social media will never be able to do the difficult, embodied work of democracy. Computer-supported interconnection is simply no substitute for face-to-face negotiation, long-term collaboration, and the hard work of living together. The Black Lives Matter and #MeToo movements have taught us that social media can be a powerful force for liberating us from the fiction that all is well just as it is. But the attention these activists have brought to their causes will mean little if the changes they call for are not enshrined in explicit, enforceable laws. Even though the American state can be inefficient, unfair, corrupt, and discriminatory, the logic of representation that underlies it remains the most effective engine we have for ensuring the equable distribution of our collective wealth.

Over time, as new media have saturated our public lives, and as the children of the 1960s have grown into the elites of today, we have learned that if we want a place on the political stage, we need to make our interior lives outwardly visible. We need to say who we are. We need to confess. When Richard Spencer calls himself a member of a victimized minority, or when Donald Trump bares his anger on Twitter, they are using the same tactics once deployed by the protesters of the 1960s or, for that matter, by participants in the #MeToo movement today. To make this observation is not to say that their causes are in any way equivalent-far from it. But whether they are lying like Trump or revealing long-buried truths like the members of #MeToo, those who would claim power in the public sphere today must speak in a deeply personal idiom. They must display the authentic individuality that members of the Committee for National Morale once thought could be the only bulwark against totalitarianism, abroad and at home.

Speaking our truths has always been necessary, but it will never be sufficient to sustain our democracy. It's time to let go of the fantasy that engineers can do our politics for us, and that all we need to do to change the world is to voice our desires in the public forums they build. For much of the twentieth century, Americans on both the left and right believed that the organs of the state were the enemy and that bureaucracy was totalitarian by definition. Our challenge now is to reinvigorate the institutions they rejected and do the long, hard work of turning the truths of our experience into legislation.

You are currently viewing this article as a guest. If you are a subscriber, please sign in. If you aren't, please subscribe below and get access to the entire Harper's archive for only $23.99/year.

= Subscribers only.
Sign in here.
Subscribe here.

# data[].attributes.attachment_link.description
"The Goliath of totalitarianism will be brought down by the David of the microchip," Ronald Reagan said in 1989. He was speaking to a thousand British notables in London's historic Guildhall, several months before the fall of the Berlin Wall.

# data[].attributes.body
play step in step out