Monday, December 05, 2016

How Public Utilities Became Public Utilities

The idea of a "public utility" is firmly entrenched in the minds of most people who live in industrialized countries today.  Things like the water supply, electric power, and more recent developments such as Internet service are all considered well-nigh essential to modern life.  Most people would probably agree that because of this, governments have the right to regulate public utilities in a way that would be regarded as heavy-handed or illegal if the firm involved was making dental floss, for example, instead of providing a necessity like clean water or electric power.  But I, for one, never stopped to wonder where the phrase came from until I read a historical article by Adam Plaiss called "From Natural Monopoly to Public Utility."

Plaiss traces the origin of the phrase all the way back to philosopher John Stuart Mill, who used it in a different sense, as a modifier rather than a noun.  Mill referred to canals and bazaars as works useful to the general public—that is, works of "public utility."  But the concept that a system of waterworks or communications could be called a public utility dates back only to the late 1800s, when the related concept of a natural monopoly began to influence thinkers during what came to be called the Progressive Era.

Progressives enthused about applying relatively new social sciences such as economics to pressing public problems such as the exploitation of the working classes by private monopolistic companies.  One of the first professionally-trained economists in the U. S. was Richard T. Ely, who obtained his doctorate from Germany and came back to join the effort to apply scientific approaches to economics as a way of "bring[ing] about a better world."  And during a period in the U. S. when utility companies selling gas, water, electricity, and telephone service were rapidly expanding, Ely examined the question of a natural monopoly.  Was there such a thing, and if so, what were its characteristics?

Around 1888, Ely came up with a set of criteria that made an entity a natural monopoly.  The thing it supplied had to be a necessity, like water.  The area it served had to be geographically distinct.  And there could be no wasteful duplication of service within the area.  A classic example of what Ely called a natural monopoly was a water-supply company.  The heavy expense of laying pipes and distribution networks made it virtually impossible for there to be meaningful competition between two rival water-supply companies for the same customers.  So if a service met Ely's criteria for being a natural monopoly, Ely believed it was the public's right to regulate that service closely. 

Perceptive and thoughtful as Ely was, Plaiss points out that he had a blind spot when it came to the root cause of a natural monopoly.  Ely attributed the cause to the nature of the hardware infrastructure itself.  But the idea that only private capital could afford to build utility services was so universally accepted at the time, that Ely failed to see the contribution of the economic background, so to speak, of late 1800s America, to the existence of natural monopolies.  It is only a slight exaggeration to say that Ely believed technology caused natural monopolies, not people. 

And because Ely saw the creation of natural monopolies as "technologically determined," as historians put it, he felt it was necessary for all owners of such monopolies to be subject to government regulation.  Otherwise, horrors such as Plaiss cites in his paper might come about, and did in fact happen in the 1880s and 1890s.  For example, privately-owned water companies in cities such as Houston and Seattle refused to extend their networks to newer parts of the cities, hampering fire departments which had no water hydrants to connect to in case of fire.  And a typhoid-fever outbreak in Superior, Wisconsin was caused by impure water provided by a private water company.  Thus, Ely believed that effective governmental control, if not outright ownership, of natural monopolies was necessary to prevent the exploitation of the masses that would result from unregulated private ownership.

After Ely published his thoughts along these lines, a Progressive journalist named Henry Call first used the phrase "public utility" as a noun in 1895, meaning by it any organization that enjoys what Ely would call a natural monopoly in the delivering of what was considered a modern necessity.  Call widened this category to include "banks, railroads, telegraphs," and municipal services such as water and gas.  In the coming years, as cities and states established regulatory commissions and agencies for such utilities, the public got used to the idea that certain types of business could be categorized as a public utility, and therefore subjected to regulation.  Many states passed regulatory laws for public utilities in the twenty years or so after 1900, which saw the height of the Progressive Era.  And although the free-market trends of the 1920s put a damper on further attempts at regulation, the distress of the Great Depression renewed public enthusiasm for government controls on all sorts of businesses that looked like public utilities.  The establishment of the Federal Communications Commission in 1933 was square in the tradition of regulating public utilities such as the air waves, for example. 

Since the Progressive Era, the scales of regulation have swung back and forth.  As late as the 1970s, airlines, the telephone system, and electric utilities in the U. S. were all closely-regulated and rather dull businesses, guaranteed an annual profit by their regulatory agencies, but not encouraged to do anything rash or speculative.  By and large, this situation produced stability and profitability, but discouraged technological innovation.  The spate of deregulation that began in the 1980s and continues largely to this day contributed to an explosion of new communications technologies—cable TV, mobile phones, and the Internet, to mention only a few—but has arguably had its downsides, as many smaller cities lost air service altogether and the deregulated electric-power market was gamed by near-criminal enterprises such as Enron. 

With at least the hope of some fresh winds blowing through Washington these days, we may see a swing of the regulatory pendulum back toward tighter controls in some services, or looser ones, depending on whether the interests of the supposedly downtrodden public or of the wealthy owners of public utilities win out. 

But whatever happens, we will do well to remember that the idea of a public utility is only about 130 years old, and its definition has twisted and turned with the political winds of the times in which it was used.

Sources: "From natural monopoly to public utility: technological determinism and the political economy of infrastructure in progressive-era America," by Adam Plaiss, appeared in the Society for the History of Technology journal Technology and Culture (Oct. 2016, vol. 57, no. 4, pp. 806-830).

Monday, November 28, 2016

Driving While Online: Does the NHTSA Know Best?














Monday, November 21, 2016

Can the Digital Future of Cars Save Lives and Time?












Monday, November 14, 2016

Can Democracy Survive Social Media?












Monday, November 07, 2016

Can Science and Technology Studies Prevent the Next Engineering Disaster?











Monday, October 31, 2016

Zombie Cameras On the Internet of Things

On Friday, Oct. 21, millions of Internet users trying to access popular websites including Twitter, Netflix, the New York Times, and Wired suddenly saw them stop working.  The reason was that for a few hours, a massive distributed-denial-of-service (DDOS) attack hit a domain-name-server (DNS) company called Dyn, based in New Hampshire.  As I mentioned in last week's blog, DNS companies provide a sort of phone-book service that turns URLs such as into machine-readable addresses that connect the person requesting a website to the server that hosts it.  They are a particularly vulnerable part of the Internet, because one DNS unit can handle requests for thousands of websites, so if you take that DNS machine down, you've automatically damaged all those websites as long as the DNS is out of service.

DDOS attacks are nothing new, but the Oct. 21 attack was the largest yet to use primarily Internet-of-Things (IoT) devices in its "botnet" of infected devices.  The Internet of Things is the proliferation of small sensors, monitors, and other devices less fancy than a standard computer that are connected to the Internet for various purposes. 

Here's where the zombie cameras come in.  Say you buy an inexpensive security camera for your home and get it talking to your wireless connection.  If you're like millions of other buyers of such devices, you don't bother to change the default password or otherwise enhance the security features that would prevent unauthorized access to the device, like you might do if you bought a new laptop computer.  Security experts have known for some time about a new type of malware called Mirai that takes over poorly protected always-on IoT devices such as security cameras and DVRs.  When the evil genius who sent out the Mirai malware sends a signal to the infected gizmos, they all start spouting requests to the targeted DNS server, which immediately gets buried in requests and can't respond to anybody.  That is what a DDOS attack is. 

As the victim learns the nature of the requests, programmers can mount a defense, but skillful attackers can foil these defenses too, for a time, anyway.  The attackers went away after three attacks that day, each lasting a couple of hours, but by then the damage had been done.  The attacks made significant dents in the revenue streams of a number of companies.  And perhaps most importantly, we learned from experience that the much-ballyhooed Internet of Things has a dark side.  The question now is, what should we do about it?

Sen. Mark Warner, a Democrat from Virginia, has reportedly sent letters to the FCC and other relevant Federal agencies asking that same question.  According to a report on the website Computerworld, Warner has a background in the telecomm industry and recognizes that government regulation may not be the best answer.  For one thing, Internet technology can change so fast that by the time a legislative or administrative process finally produces a regulation, it can be outmoded even before it's put into action.  Warner thinks that the IoT industries should develop some kind of seal of security approval or rating system that consumers could use to compare prospective IoT devices before they buy. 

This may get somewhere, and then again it may not.  The reason is that an IoT device that can be used in a DDOS attack but otherwise functions normally as far as the consumer is concerned, is a classic case of what economists call an "externality."

A more familiar type of externality is air-pollution abatement devices on cars:  catalytic converters, the diesel exhaust fluid that truckdrivers now have to buy, and all that stuff.  None of it makes your car run better; in fact, cars can get better mileage or performance if they don't have that anti-pollution stuff working, as Volkswagen knew when it purposely disabled the anti-pollution function on some of its diesel models and turned it on only to pass government inspections.  The pollution your car would cause without anti-pollution equipment is an externality.  The additional pollution that your car causes is so small that you won't notice it.  Only when you add up the contributions of the millions of cars in a city does it become a problem.  But if you don't have anti-pollution stuff on your car, you're adding a tiny bit to the air pollution that everybody in your city has to breathe.  It's that involuntary aspect, the fact that other people are put at a disadvantage because of your action (or inaction), that makes it an externality.

The vulnerability of IoT devices to being used in DDOS attacks is an externality of a similar kind.  When you buy and install a security camera, or rent a DVR from your cable company, and they don't have enough security software installed to prevent them from being used in a DDOS attack, you're raising the risk of such an attack for everybody on the Internet.  And they don't have a choice in the matter.

Historically, externality problems such as air and water pollution have been resolved only when the government gets involved at some level.  When the externality problems are strictly local, sometimes local political pressures can resolve the issue, but the Internet is by its nature a global thing, in the main, although for reasons that are not entirely clear, the Oct. 21 attacks affected mainly East Coast users.  So my guess is that to fix this issue, we are going to have to have national or international governmental cooperation to set some rules and fix minimum standards for IoT devices regarding this specific problem.

The solutions are not that hard technically:  things like attaching a unique username and password to each IoT device and designing them to receive security updates.  These measures are already in place for conventional computers, and as IoT devices get more sophisticated, the additional cost of these security measures will decline to the point that it will be a no-brainer, I hope. 
But right now there's millions of the gizmos out there that are still vulnerable, and it would be very hard to get rid of them by any means other than waiting for them to break or get replaced by new ones.  So we have created a serious security problem that somebody, somewhere has figured out how to take advantage of.  Let's hope that the Oct. 21 attack was the last big one of this kind.  But right now that's all it is—just a hope. 

Sources:  I referred to the article " What We Know About Friday’s Massive East Coast Internet Outage" by Lily Hay Newman of Wired at, and the article "After DDOS attack, senator seeks industry-led security standards for IoT devices" by Mark Hamblen at  I also referred to the Wikipedia articles on "externality" and "Mirai" (which means "future" in Japanese).

Monday, October 24, 2016

The Day The Internet Goes Down

This hasn't happened—yet.  But Bruce Schneier, an experienced Internet security expert with a track record of calling attention to little problems before they become big ones, is saying he's seeing signs that somebody may be considering an all-out attack on the Internet.  In an essay he posted last month called "Someone Is Learning How to Take Down the Internet," he tells us that several Internet-related companies which perform essential functions such as running domain-name servers (DNS) have come to him recently to report a peculiar kind of distributed denial-of-service (DDOS) attack.

For those who may not have read last week's blog about ICANN, let's back up and do a little Internet 101.  The URLs you use to find various websites end in domain names—for example, .com or .org.  One company that has gone public on its own with some limited information about the attacks is Verisign, a Virginia-based firm whose involvement with the Internet goes back to the 1990s, when they served as the kind of Internet telephone book for every domain ending in .com for a while, before the ICANN, now an internationally-governed nonprofit organization, took over that job.  Without domain-name servers, networked computers can't figure out how to find websites, and the whole Internet communication process pretty much grinds to a halt.  So the DNS function is pretty important.

As Schneier explains in his essay, companies such as Verisign have been experiencing DDOS attacks that start small and ramp up over a period of time.  He likens them to the way the old Soviet Union used to play tag with American air defenses and radar sites in order to see how good they were, in case they ever had to mount an all-out attack.  From the victim's point of view, a DDOS attack would be like if you were an old-fashioned telephone switchboard operator, and all your incoming-call lights lit up at once—for hours, or however long the attack lasts.  It's a battle of bandwidths, and if the attacker generates enough dummy requests over a wide enough bandwidth (meaning more servers and more high-speed Internet connections), the attack overwhelms the victim's ability to keep answering the phone, so to speak.  Legitimate users of the attacked site are blocked out and simply can't connect as long as the attack is effective.  If a critical DNS is attacked, it's a good chance that most of the domain names served will also disappear for the duration.  That hasn't happened yet on a large scale, but some small incidents have occurred along these lines recently, and Schneier thinks that somebody is rehearsing for a large-scale attack.

The Internet was designed from the start to be robust against attack, but back in the 1970s and 1980s, the primary fear was an attack on the physical network, not one using the Internet itself.  Nobody goes around chopping up fiber cables in hopes of bringing down the Internet, because it's simply not that vulnerable physically.  But it's likely that few if any of the originators thought of the possibility that the Internet's strengths—universal access, global reach—would be turned against it by malevolent actors.  It's also likely that few of them may have believed in original sin, but that's another matter.

Who would want to take down the Internet?  For the rest of the space here I'm going to engage in a little dismal speculation, starting with e-commerce.  Whatever else happens if the Internet goes down, you're not going to be able to buy stuff that way.  Schneier isn't sure, but he thinks these suspicious probing attacks may be the work of a "state actor," namely Russia or China.  Independent hackers, or even criminal rings, seldom have access to entire city blocks of server farms, and high-bandwidth attacks like these generally require such resources.

If one asks the simple question, "What percent of retail sales are transacted over the Internet for these three countries:  China, the U. S., and Russia?" one gets an interesting answer.  It turns out that as of 2015, China transacted about 12.9% of all retail sales online.  The U. S. was next, at about 8.1%.  Bringing up the rear is Russia, at around 2%, which is where the U. S. was in 2004.  Depending on how it's done, a massive attack on DNS sites could be designed to damage some geographic areas more than others, and without knowing more details about China's Internet setup I can't say whether China could manage to cripple the Internet in the U. S. without messing up its own part.  But there is so much U. S.-China trade that Chinese exports would start to suffer pretty fast anyway.  So there are a couple of reasons that if China did anything along these lines, they would be shooting themselves in the foot, so to speak.

Russia, on the other hand, has much less in the way of direct U. S. trade, and while it would be inconvenient for them to lose the use of the Internet for a while, their economy, such as it is, would suffer a much smaller hit.  So based purely on economic considerations, my guess is that Russia would have more to gain and less to lose in an all-out Internet war than China would.

A total shutdown of the Internet is unlikely, but even a partial shutdown could have dire consequences.  Banks use the Internet.  Lots of essential utility services, ranging from electric power to water and natural gas, use the Internet for what's called SCADA (supervisory control and data acquisition) functions.  The Internet has gradually become critical piece of infrastructure whose vulnerabilities have never been fully tested in an all-out attack.  It's not a comfortable place for a country to be in, and in these days of political uncertainty and the waning of dull, expert competence in the upper reaches of government, you hope that someone, somewhere has both considered these possibilities in detail, and figured out some kind of contingency plan to act on in case it happens. 

If there is such a plan, I don't know about it.  Maybe it's secret and we shouldn't know.  But if it's there, I'd at least like to know that we have it.  And if we don't, maybe we should make plans on our own for the Day The Internet Goes Down.

Sources:  Bruce Schneier's essay "Someone Is Learning How to Take Down the Internet" can be found at  I obtained statistics on the percent of U. S. retail e-commerce sales from the website, the China data from, and the Russia data from  I also referred to the Wikipedia article on Verisign.