The Dalai Lama once said, “Love and compassion are necessities, not luxuries. Without them, humanity cannot survive.” But today, as environmentalist and author Paul Hawken observed, “goods seem to have become more important, and are treated better, than people.” Faced with the existential threat of this mounting tension, our species will be forced to shoulder the challenge Jeremy Rifkin imagines we can accomplish: “extend our empathy to the entire human race as an extended family, and to our fellow creatures as part of our evolutionary family, and to the biosphere as our common community,” or perish.

Thus, the urgent question is: how do we do that? As it happens, today’s polyamory movement is uniquely situated at an ideological and technological intersection illuminating a possible answer. Polyamory’s key tenet—that a relationship involving more than two individuals is a good and valuable thing—is so powerful because it is so simple. To understand why, we can look to the Internet.

In his seminal work, New Rules for the New Economy: 10 Radical Strategies for a Connected World, technology theorist Kevin Kelley wrote, “In the network economy, the more plentiful things become, the more valuable they become.” From a polyamorous perspective, one could say, “Love is not a scarce commodity,” or, even more generally, “the more, the merrier.”

A polyamory advocate’s core goal can be succinctly described as achieving equality in relationship choice. Like many polyamorous people, Angi, who “has one daughter, one husband, and one boyfriend,” sees compulsorily monogamous relationships, in which one person is “attached” to one and only one other person, as limiting. Instead, people may find more value when a person can be “attached” to more than one other person. In her own words, “we all deserve to live in a world where we are free to choose whatever relationship structure suits us the best, without being made to feel that we are some kind of freaks or degenerates.”

If you drew people as dots and the relationships between them as lines connecting the dots, the result would look remarkably similar to the topology of telecommunication networks like the Internet, wherein dots represent telephony devices (phones, fax machines, computers, etc.) and lines represent interconnections between them. However, a telecommunication network in which each device could only be connected to one other device—a compulsorily monogamous worldview—would not be very useful. Why buy a phone that can only call one other phone in the world?

This freedom to “connect” with whomever we choose, to exchange ideas with others regardless of geographic constraint, undeniably enriched our intellectual experiences. Is it so hard to imagine the same phenomenon holds true when we exchange bodily fluids or emotional adventures? Here’s how veteran web designer John Waters explained it:

In the industrial economy, scarcity established value. Natural resources such as oil, gold, and diamonds were scarce and therefore considered valuable. […] Paul Romer and other theorists introduced the “New Growth Theory”. In this model, the principle of scarcity is turned upside down.

The new theory essentially divides the world into two productive inputs: “things” and “ideas”. Only one person at a time can use things such as a hammer, a telephone, a lawnmower, or a car. On the other hand, ideas can be used by many people simultaneously, i.e., recipes, blueprints, formulas, methodologies, and software. They can be used to rearrange things. They can be copied, shared, and connected, thereby leading to more ideas. “Economic growth,” Romer says, “arises from the discovery of new recipes and the transformation of things from low to high value configurations.”

Such “transformation of things from low to high value configurations” is what the polyamory movement does with regard to relationships. The most obvious limitation with the often-monogamous notion of “true love” is that it creates a scarcity model, and free distribution is anathema to maintaining scarcity. Polyamorous people understand that “free love” is not just a hippie slogan, it is a way to create real-world emotional value.

Further, the “emotional value” derived from a polyamorous culture is not ambiguous. It can be accurately valuated, albeit not in any currency currently recognized. Instead of dollars and cents, the value it creates is of social capital, intimacy, degree of connectedness, and love. Its “currency” is none other than empathy itself; its payload isn’t digital data, but empathic experiences that cultivate shared joy. There’s even a word for this experience: compersion.

Polyamorists also developed discrete ways to “packetize” empathy and emotional communications. Conversational techniques such as “mirroring” (what Non-Violent Communication calls “reflecting”) in which a listener rephrases what they heard a speaker say, act as a kind of cyclic redundancy check, or an error-correction protocol, for emotional information transmission. It ensures that what one meant to say is what was heard, avoiding misunderstandings.

The introduction of new language—both terms and techniques for communication itself—is a profound change. In the words of asexuality activist David Jay, “By finding new ways to talk about relationships we can greatly increase our options for forming them.” In addition to the value offered by transforming the topology of relationships, there is value in having a diversity of relationship types; even healthy monogamous people have strong friendship, co-worker, familial, and other kinds of social networks that look similar to polyamorous people’s more intimate networks.

It is now our words, in the form of programming languages, that are driving the evolution of technology. Meanwhile, technologies like online social networks offer fertile soil where non-mainstream perspectives—and new languages—can take root. As Wired columnist Regina Lynn wrote, “Beyond the obvious benefits of online community, the language’s Internet-speed evolution continues to give polyamory a boost. When poly or poly-curious people stumble across the polyamorous lexicon, the discovery can help validate their worldview.” This marriage of polyamorous culture with the Internet thereby accelerates the distribution of the Dalai Lama’s prophylactic prescription for humanity.

In the early 19th century, American railways were a transportation infrastructure for commerce—a network of matter-moving devices. In the early 1990’s, the World Wide Web emerged as a general purpose infrastructure for communications—a network of idea-moving devices. Today, polyamorous and non-monogamous culture is a peer-to-peer infrastructure for the transmission of information about human relationships—a literal social network of compassion-moving devices.

As Harvard professor Nicholas Christakis observed, your structural position in a social network, and the topology of the network itself, influences many things in your life:

[I]f you imagine social networks as a kind of vast fabric of humanity—I’m connected to you and you to her, on out endlessly into the distance—this fabric is actually like an old-fashioned American quilt, and it has patches on it, happy and unhappy patches. And whether you become happy or not depends in part on whether you occupy a happy patch.

In other words, the success or failure of that quintessential American Dream, your “pursuit of happiness” is, at least in part, intertwined with others’ similar pursuits. Christakis continues:

If I were always violent towards you or gave you misinformation, or made you sad, or infected you with deadly germs, you would cut the ties to me, and the network would disintegrate. So the spread of good and valuable things is required to sustain and nourish social networks. Similarly, social networks are required for the spread of good and valuable things, like love and kindness and happiness and altruism and ideas. I think, in fact, that if we realized how valuable social networks are, we’d spend a lot more time nourishing them and sustaining them, because I think social networks are fundamentally related to goodness. And what I think the world needs now is more connections.

If our “civilization,” as our dictionaries insist, truly is “the most advanced stage of human social development and organization,” why then is humanity the only species in the world without full employment? Why are we so poorly trained in the principles of peaceful social development and organization? Accepting the polyamorous tenet, that goodness is inherent in social connectedness, is therefore fundamental to realizing our dictionaries’ aspirations.

After all, as Jeremy Rifkin said, “To empathize is to civilize. To civilize is to empathize.” If this is true, then cultivating the skill of empathy across the planet’s populace, as polyamorous culture actively endeavors to accomplish, is a prerequisite not merely for one’s own individual happiness, but also for the very survival of civilization—and our humanity.

Despite feeling severely out of place for most of the conference because of the über-academic surroundings, I still had a really good time! I recorded the multi-media portion of the presentation I gave at my panel session, a video of which and the (mostly-accurate) transcript is below.

For those who are coming here after meeting me, attending, or hearing about our session at the conference, I hope you’ll take the time to follow the links in the hypertext transcript below. For those of you who are already familiar with my work, most of this piece will seem like glimpses of highly self-referential previous work. That’s intentional; I met so many new people in so many various fields and, moreover, I knew that I would, that I purposefully composed what essentially amounts to a mash-up of my own previous writing and thinking on these topics, distilled as much as possible to fit within the 10 minute time limit I was given.

As you may know, I’m really disillusioned with the majority of the sexuality subculture and its willful ignorance. Traveling outside of the sex-positive filter bubble is thus a high priority, despite its difficulty and the fears it raises for me, personally. The Public Anthropology Conference was a challenge in some ways, but it was also hugely rewarding in others.

Part of me wants to sit down and write a longer post about my experience here, the conversations I’ve had, and the fascinating people I met. But in light of relatively very little sleep these past few days and the stress of travel, I’ve only got the energy to offer you the link to my #PAC2011 hashtag stream. Thank you to everyone who was there, and especially the kind volunteers who helped me get and stay connected to the Internet with guest Wi-Fi access! :)

And now, without further ado, my presentation! As usual, all original material is Creative Commons licensed. Feel free to download the presentation in any of the following formats:

• Dreaming of Compassion: Technology, Polyamory, and Social Justice keynote presentation as a ZIP archive.
• Dreaming of Compassion: Technology, Polyamory, and Social Justice keynote presentation as a PDF document.
• Dreaming of Compassion: Technology, Polyamory, and Social Justice keynote presentation as a text transcript.

I want a new American Dream. I don’t know exactly what it is, but I think that we could build it, if we try together, because we live in an amazing moment in history.

As I bet any sexually vocal person will tell you, the Internet has fundamentally transformed our ability to communicate with one another. For example, before the Internet, if you were a gay teenager in bum-fuck nowhere, you were the only gay person in the world. Now, though, after the Internet, if you’re a gay teenager in bum-fuck nowhere, you’re one of millions of gay teenagers communicating online.

This is big. This is not merely the evolution of telecommunication technologies. This is a revolution.

The Internet is such a big deal that it’s actually a revolution of all kinds—media, governance, technology itself. But it’s also a second sexual revolution, and this one—our generation’s sexual revolution—traces its roots through the first. This is where just a bit of history comes in handily.

On May 9th, 1960, the first oral contraceptive was made available to the general public; “the Pill” sparked the sexual revolution of the 1960s and ’70s. Like all revolutions, no one could predict the outcome at the outset. It sparked chaos; the sexual revolution precipitated the “sex wars” in the 1980s.

Also in the 1960s—in 1962 to be exact—Joseph Carl Robnett Licklider, affectionately known as “Lick,” (not kidding) first proposed a global network of computers. The project was initially adopted by the Advanced Research Projects Agency (ARPA), an R&D branch of the US military.

As the slogan “Make Love, Not War” spread through public consciousness in the “free love” movement of the 60s, the Internet was being recognized as a tool of generic utility and in 1969 was launched as ARPANet. “Make love, not war” is, at least poetically, a physical parallel of Internet technology.

A specification for the ubiquitous File Transfer Protocol (FTP) was published in 1973—the same year as the Roe v. Wade decision legalized abortion in America. In 1986, as the sex wars raged, the National Science Foundation funded NSFNet as a cross country 56 Kbps Internet backbone for expressly non-commercial, essentially academic purposes. The protocol for the World Wide Web, called the HyperText Transfer Protocol (HTTP), was developed by Tim Berners-Lee in 1989, and, of course, eventually became the most widely used protocol on the public Internet.

In the same way as Gutenberg’s printing press was recognized as a revolution, bringing with it 150 years of chaos, so too is the Internet. Before the printing press, countries were kingdoms. The invention of the printing press around the year 1440 essentially signalled the start of the end of a feudal Western social order, culminating in the Peace of Westphalia in 1648, which brought forth a new system of political order to Europe and, with it, the modern concept of nation states. What might replace today’s countries in 150, or even just 50 years from now?

These histories highlight the intersections of and tensions between technology, culture, and policy. Moreover, hegemonic preconceptions are especially insidious when they make their way into technology. The same-sex marriage debate illustrates this when, for instance, clerks in many jurisdictions maintaining matrimony databases try to record a new marriage and the computer systems they use ask them “Which one’s the wife?” This unintentional antipathy to the diversity of human identities and relationships, which is literally encoded into society’s infrastructure, is perhaps the greatest silent threat to our species’ survival.

Schemes for a marriage database completely free of gender and sexuality assumptions do exist. Sam Hughes’s example permits any human to marry any other human any number of times and have any number of partners simultaneously. Now, if you tried to use a schema like his, you’d actually be forced to write tons of application layer logic to enforce the legal restrictions that are placed on marriage today; our technology already offers us capabilities that are beyond our society’s understanding of the social constructs and contracts many people have and are using right now.

The Dalai Lama once said, “Love and compassion are necessities, not luxuries. Without them, humanity cannot survive.” But today, as environmentalist and author Paul Hawken observed, “goods seem to have become more important, and are treated better, than people.” Faced with the existential threat of this mounting tension, our species will be forced to shoulder the challenge that political advisor Jeremy Rifkin imagines we can accomplish: “extend our empathy to the entire human race as an extended family, and to our fellow creatures as part of our evolutionary family, and to the biosphere as our common community,” or perish.

Thus, the urgent question is: how do we do that? As it happens, today’s polyamory movement is uniquely situated at an ideological and technological intersection illuminating a possible answer. Polyamory’s key tenet—that a relationship involving more than two individuals is a good and valuable thing—is so powerful because it is so simple. To understand why, we can look to the Internet.

In his seminal work, New Rules for the New Economy: 10 Radical Strategies for a Connected World, technology theorist Kevin Kelley wrote, “In the network economy, the more plentiful things become, the more valuable they become.” From a polyamorous perspective, one could say, “Love is not a scarce commodity,” or, even more generally, “the more, the merrier.”

As I see it, a poly activists’ core goal can be succinctly described as achieving equality in relationship choice. That is, polyamorous people recognize that the structure of a compulsorily monogamous relationship, in which one individual is connected to only one other individual, is limiting. Instead, we argue, many people may find more value by changing the structure such that one individual can be connected to more than one other individual.

This has some remarkable parallels to the way telecommunication technologies (like the Internet) work. In essence, polyamory does for relationships what digital telecommunication technologies have done for ideas. Here’s how veteran web designer John Waters explained it:

In the industrial economy, scarcity established value. Natural resources such as oil, gold, and diamonds were scarce and therefore considered valuable. […] Paul Romer and other theorists introduced the “New Growth Theory”. In this model, the principle of scarcity is turned upside down.

The new theory essentially divides the world into two productive inputs: “things” and “ideas”. Only one person at a time can use things such as a hammer, a telephone, a lawnmower, or a car. On the other hand, ideas can be used by many people simultaneously, i.e., recipes, blueprints, formulas, methodologies, and software. They can be used to rearrange things. They can be copied, shared, and connected, thereby leading to more ideas. “Economic growth,” Romer says, “arises from the discovery of new recipes and the transformation of things from low to high value configurations.”

Such “transformation of things from low to high value configurations” is what the polyamory movement does with regard to relationships. The most obvious limitation with the often-monogamous notion of “true love” is that it creates a scarcity model, and free distribution is anathema to maintaining scarcity. Polyamorous people understand that “free love” is not just a hippie slogan, it is a way to create real-world emotional value.

It is now our words, in the form of programming languages, that are driving the evolution of technology. The corpus of this technological literature changes our physical reality, offering us everything from hormone therapies to space shuttles to online social networks.

Meanwhile, those same social networks offer fertile soil where non-mainstream perspectives—and new languages—can take root. As Wired columnist Regina Lynn wrote, “Beyond the obvious benefits of online community, the language’s Internet-speed evolution continues to give polyamory a boost. When poly or poly-curious people stumble across the polyamorous lexicon, the discovery can help validate their worldview.”

The introduction of new language—both terms and techniques for communication itself—is a profound change. In the words of asexuality activist David Jay, “By finding new ways to talk about relationships we can greatly increase our options for forming them.” In addition to the value offered by transforming the topology of relationships, there is value in having a diversity of relationship types; even healthy monogamous people have strong friendship, co-worker, familial, and other kinds of social networks that look similar to polyamorous people’s more intimate networks.

In the early 19th century, American railways were a transportation infrastructure for commerce—a network of matter-moving devices. In the early 1990’s, the World Wide Web emerged as a general purpose infrastructure for communications—a network of idea-moving devices. Today, polyamorous and non-monogamous culture is a peer-to-peer infrastructure for the transmission of information about human relationships—a literal social network of compassion-moving devices.

This marriage of polyamorous culture with the Internet thereby accelerates the distribution of the Dalai Lama’s prophylactic prescription for humanity. Or, in other words, the success or failure of that quintessential American Dream, your “pursuit of happiness” is, at least in part, intertwined with others’ similar pursuits. As Harvard professor Nicholas Christakis observed:

“If I were always violent towards you or gave you misinformation, or made you sad, or infected you with deadly germs, you would cut the ties to me, and the network would disintegrate. So the spread of good and valuable things is required to sustain and nourish social networks. Similarly, social networks are required for the spread of good and valuable things, like love and kindness and happiness and altruism and ideas. I think, in fact, that if we realized how valuable social networks are, we’d spend a lot more time nourishing them and sustaining them, because I think social networks are fundamentally related to goodness. And what I think the world needs now is more connections.”

In the latter 20th Century, the American Dream grew up in a house with a white picket fenced porch, had a college education, and got a steady job. But today, the American Dream has increasingly been seen as a platitude veiling corporate greed. Founding director of Xavier University’s Center for the Study of the American Dream, Michael Ford, sums up the situation like this:

[T]o an astonishing degree [Americans] have lost confidence in the institutions traditionally seen as Dream guardians. […] Americans feel they are on their own but they haven’t lost the Dream. They have confidence in themselves, their families and their personal networks.

So perhaps adopting the polyamorous tenet, that goodness is inherent in social connectedness, is therefore not merely a social ideal, but also a blueprint for a 21st Century version of a re-imagined, re-invigorated American Dream.

And where better to present such an idea than here, in America’s capitol city, at American University? Thank you very much.

I want something
that's better than this.
And I'm not sure exactly what it is
but I think that we could build it
if we try together.

[…]

And that very same night,
kids all across the earth
felt lonely and confused,
frightened and unsure,
and we're trying to find one another
through a system that keeps us apart.

—Evan Greer

It’s been clear for some time that FetLife has passed a tipping point. It’s the new behemoth everyone in their sphere of influence has to accommodate “because of their immense user base and perceived power,” to borrow Jeff Atwood’s words from a time not-yet-forgotten. But FetLife’s insulation away from the rest of the Internet is a serious problem.

Despite my making some noise about this problem, little actually improved. When I spoke about FetLife at the Atlanta Poly Weekend conference back in March, I discussed how prioritizing interoperability is a sort of social anti-censorship measure:

Since anything that declares itself sexuality-related becomes a target for censorship, building sexuality-specific infrastructure is a recipe for disaster.

[…]

I’m suggesting that for both users of a network, like you and me, as well as creators of networks and networking tools, like […] FetLife’s founder, John Baku, interoperability should be prioritized.

For example, I think the single best thing about FetLife is its “Events near me” page, but the single worst thing about it is that none of these events are findable from outside FetLife. […] FetLife is currently incompatible with any other network. […] This is also culturally dangerous because it nurtures an in-group/out-group mentality among FetLife users. But the “you’re either with us or against us” mindset offers no space either for allies or dissension, so the longer FetLife remains a technological monoculture, the more it becomes a social ghetto.

Unfortunately, to date FetLife seems at best disinclined and at worst actively hostile to the prospect of interoperating with the rest of the Internet. So, in an attempt to address this issue myself, I began writing a couple software tools with the aim of demonstrating the usefulness of integrating FetLife with other services. Both tools are showcased at the end of this post.

FetLife’s Terms of Use explicitly prohibit the “use [of] automated means, including spiders, robots, crawlers, or the like to download data from any BitLove Inc Network database.” I hope the spirit of these terms do not match their liability-limiting letter, because if improving things means breaking The Rules, then I’ll fucking break them.

Like Facebook before it, and AOL before Facebook, FetLife seems almost eager to repeat others’ mistakes. Here, too, Jeff Atwood provides useful historical context:

It was so clear to me back in 1999 that AOL was doomed. But at the time, any criticism of AOL was heresy. […] Ten years later, is AOL is even relevant? Does anyone care?

The lesson I take from this is that no matter how wonderful your walled garden is, it can’t compete with the public, open internet.

It’s clear to me that FetLife, like its walled garden predecessors, is doomed unless it rethinks its approach. Technological interoperability is a bit like sex; yeah, having sex will potentially expose you to more unknowns than if you never have any, and that’s risky, but if you adhere to safety best-practices, you’re likely to find it very rewarding. Abandoning the walled garden mentality isn’t just good for the services you interface with, it’s also good for you.

Case in point, I didn’t notice FetLife had a persistent backdoor account access security problem until I started poking at its technical implementation. I wasn’t even looking for flaws, but rather learning enough about its inner workings so I could build tools that interoperated with the service. Trying to make FetLife better in one way quickly revealed other, unrelated avenues for improvement. Another way to improve FetLife is to encourage people to tinker and poke and test it—whether FetLife likes it or not, whether it adheres to The Rules or not.

Make no mistake: for FetLife to actually remain a viable for-profit service, then we—its users—are going to find ourselves increasingly commoditized. Locked in their capitalistic, every-man-for-themselves ideology, these competitive businesses treat their users as another commodity to control rather than the seeds generating their capital in the first place. But don’t take my word for it, take John Baku’s own Twitter bio:

Picking a fight with the Sex 1.0 players. I might be David but you are a dumbass Goliath.

Well, I ask you to consider: if FetLife is David and the “Sex 1.0” players are Goliath, and if this is indeed a fight, then we’re a bunch of raw materials! But we’re raw materials that don’t mean to become weapons in others’ fight. Weapons never end fights, they only escalate them. We can’t win by being weapons, but we can win by changing the game.

Ironically, most social networking businesses, including FetLife, are incredibly anti-social, yet this mindset is fundamentally antithetical to the principles on which the Internet and the Web were designed:

[T]he Web is a technology that puts control into the hands of its users.

This is why we don’t need to wait for FetLife’s blessing to write tools that interoperate with it. We’re already interoperating with it through software. And, y’know what? Software isn’t so different from you and me.

But perhaps more importantly, I’m not even asking for FetLife’s blessing because I want you, dear reader, to understand that no one ever needs permission to make things better. In other words: fuck The Powers That Be, and their Terms.

New FetLife Tools

The two quick ‘n’ dirty demo tools I wrote are the Better FetLife Userscript and the FetLife Bridge StatusNet plugin. The former is a downloadable script you install in your browser to easily move (export) user profile and event data from FetLife.com pages into your address book and calendaring application of choice, such as iCal or Google Calendar. The latter is a cross-posting tool that allows StatusNet users to post a FetLife status update whenever they publish a “tweet.”

Both tools work well, but are still crude, lacking in professional polish. I’m publishing them in this state anyway because I haven’t the energy to perfect them on my own, but maybe you can help. Also, kaizen, CANI, and all that jazz.

Better FetLife Userscript

With FetLife now nearing a million users, they’ve “made it.” If you want to know what’s happening in any sex-positive social sphere, it is now almost necessary to monitor FetLife rather than ignore it. More and more often I’m seeing events ranging from casual meetups to local organizations’ meetings to professionally-promoted parties getting listed on FetLife but nowhere else. Perusing FetLife’s events section is fast becoming a requirement to stay in-the-know about your local Scene goings-on.

Some savvy organizers keep public calendars for their own groups, but many of these are poorly maintained, out of date or inaccurate; FetLife’s where it’s at. Enter the Better FetLife Userscript: a (currently only Firefox) browser plugin that copies event information from FetLife into a Google Calendar, Yahoo! Calendar, Apple iCal event and more. Here’s a short video showing you how to install and use the tool:

Since creating this video demo, I also added the ability to export a FetLife user profile as an address book contact (in vCard format). Now you can quickly download events and people to your personal computer without having to copy-and-paste anything from FetLife. In the future, I’d also like to see features to accomplish the following tasks:

• Export all events on a single listing page in addition to the individual event pages.
• One-click cross-posting of FetLife Journal entries to a MetaWeblog API-enabled blog (like WordPress, Blogger, etc.), pre-populated with proper link-back, citations, and source attribution.
• One-click cross-posting of FetLife pictures to Flickr, Picasa Web, or another popular image sharing service.
• Linkify the URLs in comments on FetLife status updates.
• Anything and everything else you can dream up to make FetLife better from the client side. (Just leave a comment on the project page or the project’s UserScripts.org page to let me know what you come up with.)

Some of these things are already possible in specific, limited ways. For instance, you can use the “Share on Tumblr” bookmarklet to select and cross-post any text or images on a FetLife.com page to your Tumblr blog. You can do something similar with the PressThis! bookmarklet for WordPress. Those are decent solutions for more specific workflows, but I’d still like something more generally useful.

FetLife Bridge StatusNet Plugin

If you’ve “friended” me on FetLife (and if you haven’t, please feel free to), you may have noticed I’ve appeared a lot more active there by posting many status updates. In fact, these updates are coming from my own website running an open source Twitter clone called StatusNet. My site automatically cross-posts to FetLife every time I send a “tweet.” It’s my way of practicing what I preach:

[W]ith regard to your own personal distribution network’s structure, I’m suggesting that you use FetLife and Facebook and your own WordPress blog, or whatever other services and platforms you have the resources to utilize. In other words, don’t put all your eggs in one basket since this kind of diversification offers redundancy on the distribution network level itself.

I wrote the FetLife Bridge StatusNet Plugin to acquire “the resources to utilize” a distribution network that I was ignoring. That’s why, if you follow me in numerous social networking venues, you’re likely to see similar content on all of them: the Internet makes it inexpensive for me to “literally” be in multiple places at once, letting you control where and when you want to see me. In the future, I’d like to see a similar tool that bridges Twitter to FetLife so those of you using both of those services can duplicate your Twitter posts as FetLife status updates without needing to host your own StatusNet installation.

In particular, I’d like to improve this plugin so that it uses StatusNet’s Foreign service class instead of my own janky getup, but I haven’t gotten around to learning how to do that yet. (And it’s not like anyone’s subsidizing me for doing any of this.) For now, it should work smoothly on any StatusNet installation with PHP 5.2 and up.

To use the FetLife Bridge:

1. Download and install it as you would any of the other StatusNet plugins, that is, by copying the plugin folder into the local/ folder.
2. Activate the plugin by adding the following to the bottom of your StatusNet config.php file:

   addPlugin('FetLifeBridge');

3. Navigate to the FetLife Settings tab in the Account menu and enter your FetLife username and password, as shown in the screenshot below:
   

Security-conscious users (especially those installing this on a shared host) should note that the plugin currently stores your FetLife password in an unencrypted text file, so once you configure the plugin you may want to manually restrict the permissions on the automatically-generated local/FetLifeBridge/fetlifesettings.ini file (another big reason I want to use the Foreign service class soon).

What Happens Next?

The software above serves simply to scratch my own itch and to give you a taste of what is possible. These are just two of an infinite number of ideas. How about a tool that periodically polls your FetLife account for your latest activity and moves data in the other direction? (A kind of poor man’s ActivityStream?) Maybe a tool that extracts all the listed relationship data from a given profile and creates a visualization using GraphViz? (It’ll take your game of six degrees of separation to a whole new level!)

The possibilities are endless. So long as you behave responsibly, don’t let anyone say you can’t scale these walls. After all, we’re from the Internet. Just let ‘em try to fucking stop us. ;)

In the end, I want something that’s better than this. And I’m not sure exactly what it is, but I think that we could build it if we try together…but I’ve got a feeling that we’re winning as I hear more and more and more of us say: I want something that’s better than this.

Update: Check it out! Other people are beginning to write interoperability-focused tools. In light of that, I’ll be adding links to other tools as I am made aware of them to the following list.

• FetLife2GCal — Adds 1-click export of events listed on FetLife to Google Calendar to Firefox. Published by Stefan Knotts.
• Wrote a tool? Leave a comment, send me an @-mention on Twitter, or otherwise let me know and I’ll add it to this list.

(Watch a .mov video of the unmitigated issue as it existed in June 2011. Read a text transcript of the voiceover.)

In order to avoid further risking the privacy of FetLife users—including myself!—I sent FetLife an email on June 14 at 10:57 PM informing them of what I saw and asking them what they planned to do to resolve or at least mitigate the severity of the issue. My email conversation with FetLife is published at the very end of this post. The short version: after my repeated insistence, they took some steps to mitigate (but not exactly resolve) the issue.

I’ll make post-publication updates and clearly mark edits to this post when or if FetLife (or, more accurately, BitLove, Inc., formerly Protose Inc.) addresses the issues discussed here further.

Update, August 17, 2011, 3:53 AM local time: Within a week of this post being published, FetLife announced its SSL support was in the works. They then began rolling out site-wide SSL, beginning with paid subscribers (“supporters”) yesterday, and also turned on the feature for my own account early. Earlier tonight, I noticed the remainder of my various (non-paid) test accounts also got switched to SSL. (Yay!) I haven’t had a chance to look at the site again in any technical depth, but I’m very pleased to see this change.

Update, December 20, 2011, 5:08 AM local time: In a comment, Ian reports that the switch FetLife made to a CDN as part of their migration to site-wide SSL caused a new problem: all of your FetLife profile images are publicly viewable, no login required. This is confirmed.

This post is split into sections. I wrote a plain-English summary describing the issues, their severity, and mitigation in language I tried to keep so simple everyone can understand. The Technical Details section provides another analysis with a step-by-step demonstration, along with references to background information for the technically interested but uneducated reader. Finally, an Editorial section is where I’ll get on my well-worn soapbox about this whole thing.

Plain-English Summary

Due to the way FetLife handled your login status, an attacker monitoring your computer could secretly gain permanent, full, and irrevocable access to your FetLife account simply by observing your browser fetch any page on FetLife.com while you were logged in.

If this happened to you, it meant an attacker could do anything on FetLife that you could, as though they were you. For example, an attacker could be able to:

• log in as you, whenever they want to
• read your private conversations, and view all your photos, including the ones you have set to “friends only”
• view all private photos your friends shared with you
• post status updates, comment in group discussions, write entries, and upload images as if they were you
• edit your profile and fetish list
• send anyone on FetLife a friend request as you, or remove friends from your friend list
• change all of your account settings, including your FetLife password and email address

There’s only one thing the attacker couldn’t do: find out what your original password was. To the best of my knowledge, this issue affected FetLife.com from its inception several years ago until last month.

After my prodding in June, FetLife changed the way it handles your login status so that an attacker couldn’t retain secret access to your account for more than one month. They also made changes that help prevent an attacker from locking you out of your own account.

How was this possible?

When you log in to FetLife, your browser is sent a “session cookie” that acts like a special key intended only for you. As you use the site, your web browser presents this special key to FetLife every time you load a page. Using session cookies is not bad per se; it’s standard practice, and ensures you don’t have to type your password each time you click another link.

However, since FetLife doesn’t send you this cookie privately, it’s very easy for someone else to get a copy of it. If they do, they get to use it just like you did, and there would be no way for you to find out if someone has done that. Worse, since FetLife didn’t put even basic limitations on the cookie, other people could use their copy of it forever, from any computer, even after you logged out or changed your FetLife password, and there was nothing you could do to stop them.

Thanks to the changes FetLife made last month, changing your password will allow you to regain control of your account from an attacker who may be using your special key (session cookie). Naturally, I’d suggest you change your FetLife password from your home Internet connection as soon as you can. (Do not change your FetLife password at a Wi-Fi café, though! See below.)

But FetLife says they’re secure!

FetLife says they “use SSL to login to FetLife,” which is “the same technology your bank uses when you login to their website.” It’s true that this does mean your user name and password can’t be (easily) stolen while you are logging in. (Your user name and password can, however, be easily stolen when you change your password, since FetLife doesn’t use SSL for that—an equally glaring oversight making the point rather moot anyway.) But since the session cookie (your special key) is not returned to you using SSL, an attacker never needs to see you log in and never has to know your password to gain virtually total control of your account.

Moreover, there are numerous other ways an attacker could get a copy of your session cookie and your special key, ways that not even using SSL can protect you against. One way would be by tricking you into visiting a different, malicious website that could then watch as it makes your computer visit FetLife.com behind your back. And if anyone else has access to the computer (e.g., a family, library, or frenemy’s machine) they can easily save a copy of your session cookie and use it later.

FetLife also says that “at any time, you can delete the cookies that are on you [sic] computer.” This is true, but irrelevant; you can’t delete a copy of a cookie on someone else’s computer.

Mitigation: How can FetLife fix this and what can I do to protect myself?

There are a number things FetLife can do to address the issue, either by more strongly securing the communications between you and FetLife.com or by limiting the usefulness of the special key they give you (i.e., the session cookie). While no single item is a panacea, each significantly reduces the threat. (This is known as “defense in depth.”) So, while FetLife deserves some (faint) praise for finally taking some steps to protect its users, FetLife would take all reasonable steps as soon as possible to maximally protect you if it is, indeed, a priority for them.

First, FetLife could use SSL for everything (not just logging in), so that even if an attacker does see you load some page, they can’t get your key. This is also called “SSL-only browsing” and has long been recommended to be enabled by default for everyone. While they are late in doing so, to their credit, FetLife told me they are working on making this happen in “60-90 days.” If implemented correctly, this will protect you against the simplest (and thus most common) attacks, but not all of them.

Second, FetLife could do a number of things to limit what an attacker could do even if they did get your special key, even without fundamentally changing the way their current system works. In simple terms, industry developers accept several measures as standard security practice:

• Expiring the special key on its own after a reasonable amount of time, after which it’s no longer good, and you’re given a new one instead.
• Asking you for your password every time you try to do some particularly sensitive action, like changing your account’s email address or changing your password to something new.
• Associating the key with the specific computer you’re using so that if it’s used somewhere else, the system will ignore it and ask you for your password again.

Among its recent changes, FetLife began adopting the first two measures. FetLife now limits the lifetime of any given session cookie to 30 days. FetLife will also now prompt you to enter your old password when changing it to something new. That’s a good start, but it leaves an obvious loophole. An attacker could still change your account’s email address to one they control, and then use FetLife’s “Forgot your login information?” feature to reset your password as they wish.

The takeaway is that there are many safer ways to handle your key than what FetLife was (and, arguably, still is) doing with it.

There’s sadly very little you can do to protect yourself, as a user. Since I sometimes still want to use FetLife but I don’t want to risk losing my special key, I registered a second FetLife account. I now use that account instead of my “real” one for reading group discussions, looking at people’s profiles, and doing anything that I don’t have to use my real account for. I only use my real account from my desktop, at home, to reduce the chances of accidentally exposing my secret key to an attacker; my laptop is always logged into FetLife using my dummy account.

What can I do to help?

You can help a lot simply by encouraging FetLife to take even small steps that protect your safety. Every additional security feature FetLife adds makes you that much safer by making it that much harder for an attacker to pretend to be you. Right now, FetLife’s only security focus is at “the gate,” the login page. Adding safety features inside FetLife as well as between it and the outside world is just as important as strengthening its walls (insofar as it is appropriate to have those walls, anyway…).

• Write to privacy@fetlife.com and complain. Seriously. All you have to do is air your concern. Just like any other company, FetLife will respond to pressure from its users, but only if its users actually pressure the company into acting. And, just like any other company, they will probably respond first with lip service in an attempt to placate you, but will eventually cave to user demands (if their past correspondence with me is any indication).
• Tell FetLife you won’t support them financially until they implement multiple, layered security precautions (“defense in depth”). Paying money for a service that’s insecure in the hopes that it will become more secure is as silly as paying for rotten food in the hopes that it will ripen. That’s just backwards.
• Acknowledge the fact that FetLife intendsto be a business first, and a community hub second (if at all). If you really want to be pro-active, raise funds and tell FetLife you’ll award them a bounty when they implement security and privacy improvements. I don’t have time to manage a campaign like this myself but, I promise you, nothing motivates for-profit companies more than more profit! Here are some ideas you can encourage FetLife to prioritize and implement with the funds you raise:
  • An “activity on this account” screen that shows us the locations from which our accounts were last accessed in order to help us detect suspicious activity. See also Last account activity by Google.
  • Implement OAuth so we can link our FetLife accounts to other identity providers and log in using, for instance, our Twitter accounts. (This would also go a long way towards improving FetLife’s interoperability more generally.)
  • Offer one-time passwords that get sent as a text message (SMS) to your mobile phone. See also Single-Use Codes in Hotmail.
• Educate yourself and your fellow FetLife users. Learn about the problems and how to avoid pitfalls, and then share your knowledge freely, generously, and liberally with others; republish or link them to this post, for example.

Ultimately, this is not very complicated, and you can let others make their own choices about how secure or insecure they’re willing to be. But, of all communities, this one should understand the importance of making informed choices.

Technical details

As FetLife says on its privacy page:

FetLife uses cookies for authentication and to store information in between page requests.

When a user requests a FetLife.com web page, FetLife looks for a cookie with the name _FetLife_session and reads its value. Over the wire, a logged-in user’s _FetLife_session cookie looked something like this:

BAh7CjoQX2NzcmZfdG9rZW4iMTRmMjdTcDNqUE9HTXNUdWo0UmlMSmxjOGg4ckxuZzhzTEY1V0QwUEVHS1E9Og9zZXNzaW9uX2lkIiVkOWMyZDYzOGI0ODU4MDI5MDlhNzRjMzRmZjQ1MmJkNzoUY3VycmVudF91c2VyX2lkaQOfow4iCmZsYXNoSUM6J0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7AAY6CkB1c2VkewA6FGFiaW5nb19pZGVudGl0eWwrCEq1JAICAA%3D%3D--a8128aa96ed5da1ec9d4fda35f1ad366d8ea21f2

Figure 1 shows Firebug requesting the FetLife home page using the above cookie (which, yes, was valid and belongs to a test FetLife account nicknamed “fetfails”).

A _FetLife_session cookie is a Base64- and URL-encoded blob containing several pieces of data, evidently produced by the FetLife Ruby on Rails application. Among the data in the cookie is the current user’s ID and associated session ID, in this case 959391 and d9c2d638b485802909a74c34ff452bd7, respectively.¹

Actually stealing a cookie isn’t something I’m going to describe in detail because it’s stupidly easy and I don’t want to encourage that kind of mischief. Suffice it to say that well-known tools like Firesheep make it trivial.² And while that’s the simplest way to steal cookies, other attack vectors exist as well, particularly against users who browse with Internet Explorer.³

In any case, getting a cookie is far too easy. The stolen session cookie was, in FetLife’s case, functionally equivalent to an automatic, and permanent login. FetLife basically said, “whoever shows me this cookie is logged in as user ID 959391, a.k.a. ‘fetfails’.”

Once an attacker got a logged-in user’s (victim’s) _FetLife_session cookie, they merely need to send that cookie in place of the one FetLife sent whenever they wanted to impersonate the victim. This is possible using a tool like the Edit This Cookie extension for Google Chrome. Figure 2 illustrates how simple an attack might have looked like against my “fetfails” test account:

1. Navigate to the FetLife home page (using Chrome with the aforementioned extension installed).
2. Click the “Edit This Cookie” icon at the top right the Chrome window.
3. Expand the section labeled _FetLife_session.
4. Copy and paste the (stolen) encoded cookie into the valuefield, replacing the old value. For the next month, you can copy and paste the following session cookie value to try this out yourself:

   BAh7DDoQbGFzdF9hY2Nlc3NsKwdma0BOOhRjdXJyZW50X3VzZXJfaWRpA5%2BjDjoPc2Vzc2lvbl9pZCIlNmQzNThiZjY1NDRhYzdlZTU2NzQ2NmE4YmI5NzI0NzM6EF9jc3JmX3Rva2VuIjFmVVU3aG15SUU1Slh5cDluQlYxU1F5VXEyZU0yekhBUE5JUXU1VCtiRjA4PToGcyItMWI3MDg1YjAxYzFlNDczMmU3YTAyMjZhOTUyNDc2OWFjMDc3NTk3YSIKZmxhc2hJQzonQWN0aW9uQ29udHJvbGxlcjo6Rmxhc2g6OkZsYXNoSGFzaHsABjoKQHVzZWR7ADoUYWJpbmdvX2lkZW50aXR5bCsHxK8i6w%3D%3D--de0b9e177e21d67d5e345e48dd04604cc4320ac8

5. Click “Submit Cookie Changes”.
   
6. Reload the FetLife home page.

Voila; that’s all an attacker needed to do to be logged into FetLife as the “fetfails” user. And since FetLife never asked for a password once you’re already logged in, the cookie granted the attacker full access to fetfails’s account. Furthermore, since FetLife didn’t ever expire the cookie, the attacker could continue to use it for as long as they wanted.

On a website that uses server-side sessions instead of cookie-based ones, when you click “logout,” the session cookie you used to log in with would never work again. On FetLife, however, even after the “fetfails” user clicks the “Logout” link, the above procedure continued to work—and it still does, for up to 30 days, if you manage to steal another user’s session cookie. There was nothing a user could have done to invalidate the cookie; lose control of one cookie, and you lost exclusive control of your FetLife account.

This susceptibility to replay attacks against a Rails application (like FetLife) when the default cookie-based sessions are used was discussed way back in 2007. It’s also addressed in §2.6 of the Ruby on Rails Security Guide.

While rolling out SSL site-wide would certainly help, so would a number of other things, like the ones I already described in the mitigation section of this post. Moreover, those things don’t require the kind of expensive hardware overhead that switching away from cookie-based sessions or even implementing SSL do and, further, they should be done anyway. It’s doing those other things that make “defense in depth” actually defense in depth.

Finally, the importance of all this was brutally demonstrated more than 6 months ago.

Editorial

As FetLife’s users, we deserve to know what it is that FetLife is or is not actually doing to protect our privacy, not just what FetLife is saying about what they are doing to protect our privacy. It is the distance between how safe you feel and how safe you actually are that is the threat. If you feel safe when you are not, you’re a much easier target for an attacker than if you are aware of your vulnerabilities.

If you already knew that you currently have little to no protection when using FetLife and you chose not to do anything differently in light of that—if you already knew the emperor is naked and you chose to pretend that he is clothed anyway—then, great! More power to your polite fiction! However, if you falsely believed you were secure because you were intentionally or accidentally misled, then I say shame on those who mislead you.

FetLife knew better, and then dragged their feet. They have and continue to mislead people. This is not news.

Back in March, I described how FetLife’s lack of granular privacy controls meant that anyone who wanted to could gain access to so-called “private” (i.e., not-for-public-consumption) material simply by creating a new account and logging in as any normal user might:

For an individual, FetLife’s primary “privacy” offering is simply that nothing you post will be indexed by search engines like Google. Since there is no way to access FetLife from outside FetLife, it’s like Vegas: what you say on FetLife stays on FetLife. The implicit claim, then, is that the entire container is safe.

However, since all that is required to gain access to FetLife membership is a (free) email address, the claim is farcical on its face. Claiming FetLife is either private or safe for any given individual is like breaking open someone’s back door and then selling them a stronger lock for their front door.

FetLife’s “front door” is its login page. By requiring you to use that login page to view any content at all, what FetLife is saying to laymen users is, “Nobody who tries can enter unless they go through this door.” The implicit claim in this case is that FetLife understands that because what you do inside FetLife is more sensitive than what you do on the public Internet, it needs special protections.

In this way, FetLife has made a claim about their behavior. But the distance between their claim and their actions is considerable, and it is foolhardy at best to obscure or deny the fact that this distance exists.

What’s so interesting to me about FetLife is that, unlike Facebook’s users, among whom only the clearly deluded have any trust in the company, the vast majority of FetLife’s user base seem ardently vocal in their adoration. Could this be due to the extraordinarily personal nature of the content FetLife hosts for them? I can’t imagine a typical user (which I am not) talking openly about their fetishes on Facebook, for example.

Both FetLife and Facebook arguably have monopolistic control over their users’ online social lives. But of the two, FetLife is in a far more trusted position because many people who use it do so precisely to avoid using services that aren’t friendly to sexual expression (like, say, Facebook). In other words, most of FetLife’s adoring fans don’t just treat the company like a friend, they treat it like the friend they send naked photos of themselves to, the friend they ask to pass on the sexually explicit note they wrote to their sweetheart(s). And not just any note, but the note about that totally taboo fantasy. Because, why not? That’s okay here! I mean, it’s FetLife, not Facebook!

And y’know what? That’s actually really cool! No, not just cool, that’s awesome. And not merely awesome, but culturally necessary. Just in case it isn’t clear, yes, I’m actually praising FetLife. But as the only large social network not actively hostile to (most) sexual expression, FetLife has also become the single, giant basket many of us have placed our eggs in. And that makes it even more important for FetLife to go the extra mile to secure us.

FetLife is continuing to develop new features, seemingly pumping them out like crazy. As I was putting this post together, they announced they were “starting to roll out the ability to upload pics via email from your phone to your FetLife profile” and then proudly announced “100% of People Have the Ability to Upload Pics via Email.” While that sounds cool, I guess, I have to wonder whether or not their users’ privacy and security are being taken as seriously as how whatever the next shiny feature is handled.

Moreover, if the FetLife team really is as small as they make it out to be, it’s even more unlikely that they’re developing new functionality while simultaneously spending the same amount of brainpower prioritizing security, no matter what they say. Immediately after I learned of the persistent nature of this issue, I asked the FetLife crew if they were planning on implementing SSL-only browsing:⁴

Does @FetLife plan to enforce SSL/TLS on all logged-in requests soon? If so, on what timeline? /cc @JohnBaku @JamesGolick #FetLife #security

One of their developers, James Golick, responded in the affirmative:

@maymaym We’re going to do it. It’s on our list, but it’s nontrivial for various reasons. We never make timeline promises though, sorry.

When I asked if security was a priority for them, James responded affirmatively again. This is certainly good to hear. I don’t doubt their skill or knowledge, and I’m heartened to read about James’s security-conscious bullheadedness. Back in February, James found himself in a similar situation to the one I feel like I’m in now:

Despite this being an incredibly serious security issue, nobody really seemed to care. Oh well. […] Yes, [this example] is relatively unimportant security-wise (except that if there’s a man-in-the-middle, he now has credentials to access your [data], which may or may not contain [your] secrets — but I digress). Eventually I remarked that despite the relative unimportance of [this example, the developer] is a leader in the ruby community, and leaders should set good examples.

I strongly agree. As James reminds his Twitter followers, “Broken gets fixed, but shitty lasts forever.” Truth! And that’s a really, really good point.

When it comes to FetLife.com itself, there seems to be far too much talk and not enough walk.

Of course, that wouldn’t be some shocking betrayal, but rather confirmation of what should be a very obvious thing few seem willing to recognize: FetLife is just like any other social media company. By investing far more heavily in new features than in the very basics of security, FetLife behaves just like Facebook. In itself, that doesn’t bother me. (Well, not anymore than I’m bothered by Facebook generally, that is.) What bothers me is that FetLife says they’re behaving differently when they’re not, and then relying on people’s relative technical ignorance to get away with that.

FetLife keeps saying it’s a “community” site for people to meet and network and build stronger community ties. It goes out of its way to distinguish itself from seedy hookup sites, and even claims to limit some of its search functionality to prevent that behavior. But can we trust that FetLife, as a company, cares more about our privacy than about the next new feature? If not—frankly, I don’t—ask yourself: under what circumstances would you prefer FetLife got pressured into prioritizing user privacy and security? Pressure from its own constituents who have its improvement in mind, or pressure from its economic or political competitors, who have its destruction in mind?

FetLife is not a community. FetLife is a business. Only fools confuse the two. Yes, FetLife’s robes are said to be made of the finest cloth. But the Emperor is naked. And the whole people will one day say, “He has nothing on at all.”

Email conversation with FetLife

Subject: Privacy concern: FetLife’s session handling does not invalidate old user sessions
From: maymay <bitetheappleback@gmail.com>
Date: June 14, 2011 10:57:53 PM PDT
To: privacy@fetlife.com

To whom it may concern at Protose, Inc.,

I have some concerns regarding FetLife’s handling of its users’ session cookies. Specifically, it appears authentication cookies that I receive from FetLife never expire and thus, if stolen, can be used to access my FetLife account even after I expressly log out of the website. I recorded a brief video that showcases this issue at the following address:

http://maybemaimed.com/tmp/fetlife-cookie-expiry-tests.mov

In the video, I use a cookie obtained from FetLife on June 9th. The video was recorded on June 14th. The video shows that FetLife still considered the cookie valid at the time of recording, even after I logged out of the service. I’ve also been able to log in to FetLife using the captured June 9th cookie from other browsers on other computers.

It is troubling to me that FetLife does not invalidate session cookies when I log out of the service. Shouldn’t that be done to ensure old sessions can no longer be used? Regardless, how long does FetLife consider session cookies valid? Is there any expiry time enforced on the server? If so, what is it?

I could find no evidence of any such expiration and as a result I am deeply concerned that theft of a single FetLife session cookie could theoretically grant unauthorized access to my FetLife account for the lifetime of my account.

If indeed there is no expiration, then this effectively offers session hijacking persistence to even one successful “sidejacking” attack against a FetLife user. As I know you are aware,[0] since FetLife currently does not support HTTPS-only browsing, every request by a logged-in user for a resource on FetLife.com exposes the user’s authentication cookie to the network. Worse, once the attacker hijacks a victim’s session, since FetLife.com never asks users to re-authenticate to perform any action (like changing one’s password), compromising a single cookie effectively fully, silently, and permanently takes over a FetLife.com account.

Given the prevalence of cookie theft,[1] the highly sexual and thus sensitive nature of FetLife.com users’ content, and the persistence of even a single successful attack, I feel it’s critical to address this issue urgently. What, if anything, is FetLife planning to do to resolve or at least mitigate the severity of an account breach like this?

If I understand FetLife’s architecture correctly, then it is possible a resolution to the issue is as simple as a one-line fix, which is documented in §2.8 of the Ruby on Rails Security Guide:[2]

“If you use the popular RestfulAuthentication plugin for user management, add reset_session to the SessionsController#create action.”

I’ve prepared a blog posting describing this issue to non-technical users. My plan is to publish in one week’s time, but if I receive a notice that FetLife is taking steps to resolve this issue, I’ll delay publishing for some more time if you’d like. I’m writing you before I publish specifically because I don’t want to unnecessarily endanger FetLife users (including myself!), especially as there is nothing we can do to resolve this particular concern ourselves.

Thank you for your attention and for prioritizing your users’ privacy and security. I think FetLife.com has become an important cultural phenomenon and I feel strongly that it needs to do everything possible to protect its users from attacks.

Sincerely,
-maymay
Blog: http://maybemaimed.com/
Talk show: http://KinkOnTap.com/
Community: http://KinkForAll.org/

EXTERNAL REFERENCES:

[0] http://twitter.theinfo.org/78611275625676800
[1] https://www.digitalsociety.org/2010/11/online-services-security-report-card
[2] http://guides.rubyonrails.org/security.html

From: James Lennon <[REDACTED]@fetlife.com>
Subject: Re: Privacy concern: FetLife’s session handling does not invalidate old user sessions
Date: June 15, 2011 10:15:27 AM PDT
To: maymay <bitetheappleback@gmail.com>
Cc: John Baku <[REDACTED]@fetlife.com>

Hey [maymay],

Thanks for emailing in about this issue. Actually, it’s something that we were aware of, but preferred to solve in a different way. Unfortunately, because of the way that we store our sessions, expiring them is a lot more complicated than it sounds. And in any case, it’s the wrong solution to this problem.

The correct solution is to implement site-wide SSL. If the cookies are protected from the network, there’s no particular need to expire them. We do delete them from users’ computers on logout.

We are working on getting site-wide SSL going, but unfortunately, it’s not entirely within our control. We have partners who we have to work with, and their timelines are somewhat out of our control. We are leaning on them as hard as we can, but it’s probably going to take another 60-90 days for us to be ready to start rolling this functionality out to the community.

I’ve prepared a blog posting describing this issue to non-technical users. My plan is to publish in one week’s time, but if I receive a notice that FetLife is taking steps to resolve this issue, I’ll delay publishing for some more time if you’d like. I’m writing you before I publish specifically because I don’t want to unnecessarily endanger FetLife users (including myself!), especially as there is nothing we can do to resolve this particular concern ourselves.

I really appreciate your enthusiasm. It’s clear that like us, you have a great deal of passion for the kinky community. If you really want to help us get this functionality out the door, encouraging your audience to support FetLife would be a huge contribution you could make. Offering SSL to our growing community is a very expensive proposition for many reasons.

So, please give us a couple of months to get all the pieces of this SSL project together; we’re actively working on it. If you do decide to publish the article (obviously we’d prefer that you didn’t), we’d really appreciate some warning.

Thanks again,

James Golick

Subject: Re: Privacy concern: FetLife’s session handling does not invalidate old user sessions
From: maymay <bitetheappleback@gmail.com>
Date: June 16, 2011 8:49:22 PM PDT
To: James Lennon <[REDACTED]@fetlife.com>
Cc: John Baku <[REDACTED]@fetlife.com>

Hey James,

I’m glad to hear you’re already aware of the problem. I’d hoped you were, since it seems like such a basic issue. That said, I’m disappointed by your response.

You wrote that, “If the cookies are protected from the network, there’s no particular need to expire them,” but I think this is a very dangerous mindset. While it’s certainly the case that implementing site-wide SSL would close the most trivial cookie theft vulnerability (and that’s good!), the fact of the matter is session cookies can be stolen in a number of other ways. Moreover, I fear you have missed the point of my concern when you said that “We do delete [cookies] from users’ computers on logout.” The whole reason for my concern is that, if my cookie is stolen, I can’t delete it from the *thief’s* machine!

Again, I want to stress that my concern is not solely with the lack of SSL and that implementing SSL, while definitely helpful, is not a panacea by any means. If the server never enforces some kind of expiration on session cookies, it is still the case that the theft of just one cookie would irrevocably give an attacker total control over my FetLife account. Just because a session cookie was *transmitted* securely doesn’t mean it’s trustworthy *forever*.

Enforcing some kind of reasonable expiry on these session cookies is not outlandish. I feel that failing to do so exposes me to an unacceptable level of risk when I use FetLife. I believe that if laymen users were aware of the situation, it would be unacceptable to them, too.

I’m also sorry to hear that resetting sessions is not as easy to accomplish in FetLife’s case as I hoped. While I’m sympathetic to the complexity of your situation, I also know this is not an unsolvable problem. Especially considering the expertise the FetLife team has in this area, and the extremely personal nature of users’ content, I feel it’s important that FetLife urgently adopt a defense-in-depth approach here.

There are concrete steps FetLife can take that would frustrate an attacker, even if those steps wouldn’t remove all risk. I feel you are obliged to take at least some of these steps if indeed you want to claim that FetLife is a secure and private place for the average user, especially as most of them are posting sexual content. Doing things like asking the user to at least provide their old password when they change it to something new would significantly mitigate concerns here.

My point in bringing this up is that the lack of security precautions *within* the FetLife walls are equally troubling. FetLife’s reliance on the perimeter security of the login form is dangerously over-confident.

Finally, while I can also appreciate your need for funds, I can’t in good conscience recommend that anyone financially support FetLife while I know it has such lax security practices. FetLife needs to implement appropriate security and privacy measures for its users *before* I’ll feel justified encouraging anyone to pay for it.

Since there are numerous things FetLife can and, as I’ve argued, should do to more adequately protect user privacy prior to going SSL-only, and since you say you’ve been aware of these concerns for some time, I don’t feel comfortable waiting 60 to 90 days before posting about the issue. Unless you show me that you need a reasonable amount of time to implement some basic precautions, I still plan to publish a post explaining my concerns and describing the technical details to non-technical users next week (on Wednesday, June 22nd). It doesn’t seem like implementing session cookie expiry times or at least asking for re-authentication on a request to perform major actions, for example, needs to wait another 3 months.

Thank you for taking time out of your day to correspond with me about my concerns. I really do appreciate that FetLife offers a valuable service. I just also hope you take a closer look at the broad assumptions you’re making regarding your security measures in the context of the unique role FetLife plays in our communities.

Sincerely,
-maymay
Blog: http://maybemaimed.com/
Talk show: http://KinkOnTap.com/
Community: http://KinkForAll.org/

From: James Lennon <[REDACTED]@fetlife.com>
Subject: Re: Privacy concern: FetLife’s session handling does not invalidate old user sessions
Date: June 17, 2011 12:23:47 PM PDT
To: maymay <bitetheappleback@gmail.com>
Cc: John Baku <[REDACTED]@fetlife.com>

We are working on building another mechanism for session storage, but it’s non trivial, and requires a hardware order for capacity. We’re doing our best to get this out the door as quickly as possible, but again, it’s not a trivial problem to solve to store and then migrate hundreds of thousands of sessions in a durable way (as this is going to introduce 500+ req/s worth of additional load on whatever datastore we choose, we don’t have the capacity to spare on our current MySQL cluster). I very much doubt this is going to be shipped by Wednesday, but we are working on it.

Subject: Re: Privacy concern: FetLife’s session handling does not invalidate old user sessions
From: maymay <bitetheappleback@gmail.com>
Date: June 18, 2011 4:37:37 PM PDT
To: James Lennon <[REDACTED]@fetlife.com>
Cc: JohnBaku <[REDACTED]@fetlife.com>

Hey James,

It is *very* good to hear that you’re working on another (presumably) more secure mechanism for session storage.

Are you also working on implementing some of the simpler things that doesn’t require new hardware but would still mitigate these concerns somewhat? I already named some: ask users to supply their old password when they perform sensitive actions (like updating their password); add an “expires at” timestamp that gets checked and updated on page load to cookies you send right now so they don’t last forever.

These are just two things you can do without fundamentally re-architecting your session store or making expensive hardware purchases and they would greatly enhance security for FetLife users. If you roll out these two improvements by Friday, June 24th, I’ll wait another month and a half (45 days, until August 8th) for you to implement default site-wide SSL for all users before publishing about this issue. Otherwise, I’ll still publish during June.

Sincerely,
-maymay
Blog: http://maybemaimed.com
Talk show: http://KinkOnTap.com
Community: http://KinkForAll.org

From: James Lennon <[REDACTED]@fetlife.com>
Subject: Re: Privacy concern: FetLife’s session handling does not invalidate old user sessions
Date: June 19, 2011 10:55:58 PM PDT
To: maymay <bitetheappleback@gmail.com>
Cc: John Baku <[REDACTED]@fetlife.com>

Hi [maymay],

I’ve discussed our practices with a few of my friends who have security backgrounds, and here’s what I’ve come up with.

I’ve deployed a change that expires session cookies 1 month after their last request. We’re working on code to require the current password when changing your password. And when we implement that, we’re also going to expire all of your existing sessions when you change your password by putting a unique token in the session cookie that expires when you change your password. This way, if somebody’s account has been compromised, we can easily expire all the existing sessions at the same time we change the password to ensure that control of the account is restored.

With those changes, implementing another session storage mechanism shouldn’t be necessary. We won’t be able to delete sessions on logout, but once we implement SSL, that won’t really be a relevant concern. If the user’s machine is compromised, the attacker is going to have an easy time getting their username and password anyway. And will almost certainly have access to the user’s email, and therefore our reset password functionality.

- James

From: James Lennon <[REDACTED]@fetlife.com>
Subject: Re: Privacy concern: FetLife’s session handling does not invalidate old user sessions
Date: June 21, 2011 10:15:52 AM PDT
To: maymay <bitetheappleback@gmail.com>
Cc: John Baku <[REDACTED]@fetlife.com>

All of these changes, aside from SSL have been deployed, tested, and rolled out.

From: maymay <bitetheappleback@gmail.com>
Subject: Re: Privacy concern: FetLife’s session handling does not invalidate old user sessions
Date: June 23, 2011 2:46:09 PM PDT
To: James Lennon <[REDACTED]@fetlife.com>
Cc: JohnBaku <[REDACTED]@fetlife.com>

Hi James,

I just had a chance to look at the changes you describe. They’re good to see! I’m particularly glad to see you at least asking for a user’s current password when changing their password to something new.

I’ve also verified that you’ve indeed invalidated a user’s session cookie when said user changes their password, but I noticed this is only the case if the cookie data itself includes the new, unique tokens. The numerous cookies I saved before you implemented this change still allow me to access FetLife without logging in, same as before, essentially treating the new cookies with their unique tokens as though they are optional. When will you ensure FetLife session cookies lacking the new unique tokens are invalidated, too?

Thank you for implementing the mitigating features you have so far. I think they’re an important step for FetLife users.

Sincerely,
-maymay
Blog: http://maybemaimed.com
Talk show: http://KinkOnTap.com
Community: http://KinkForAll.org

From: James Lennon <[REDACTED]@fetlife.com>
Subject: Re: Privacy concern: FetLife’s session handling does not invalidate old user sessions
Date: June 23, 2011 3:01:33 PM PDT
To: James Lennon <[REDACTED]@fetlife.com>
Cc: JohnBaku <[REDACTED]@fetlife.com>

Hi [maymay],

We’re going to phase out the old cookies in about 30 days. The last time we mass expired all of our sessions, we received so many support emails that it took our team months to get out from under them. We’re giving our users a month to use their sessions again (as soon as you use your session, you receive both of the new tokens). Then, we’ll make ‘em mandatory.

- J.

From: maymay <bitetheappleback@gmail.com>
Subject: Re: Privacy concern: FetLife’s session handling does not invalidate old user sessions
Date: June 23, 2011 3:11:06 PM PDT
To: James Lennon <[REDACTED]@fetlife.com>
Cc: JohnBaku <[REDACTED]@fetlife.com>

Hi James,

Sounds good. I look forward to no longer being able to use my saved cookies after this July . :) And, shortly thereafter, to site-wide SSL on FetLife.

Cheers,
-maymay
Blog: http://maybemaimed.com
Talk show: http://KinkOnTap.com
Community: http://KinkForAll.org

1. Here’s how you might start to decode the cookie using Python:

   >>> import urllib >>> t='BAh7CjoQX2NzcmZfdG9rZW4iMTRmMjdTcDNqUE9HTXNUdWo0UmlMSmxjOGg4ckxuZzhzTEY1V0QwUEVHS1E9Og9zZXNzaW9uX2lkIiVkOWMyZDYzOGI0ODU4MDI5MDlhNzRjMzRmZjQ1MmJkNzoUY3VycmVudF91c2VyX2lkaQOfow4iCmZsYXNoSUM6J0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7AAY6CkB1c2VkewA6FGFiaW5nb19pZGVudGl0eWwrCEq1JAICAA%3D%3D--a8128aa96ed5da1ec9d4fda35f1ad366d8ea21f2' >>> data=t.split('--')[0] >>> hmac=t.split('--')[1] >>> urllib.unquote(data).decode('base64')'\x04\x08{\n:\x10_csrf_token"14f27Sp3jPOGMsTuj4RiLJlc8h8rLng8sLF5WD0PEGKQ=:\x0fsession_id"%d9c2d638b485802909a74c34ff452bd7:\x14current_user_idi\x03\x9f\xa3\x0e"\nflashIC:\'ActionController::Flash::FlashHash{\x00\x06:\n@used{\x00:\x14abingo_identityl+\x08J\xb5$\x02\x02\x00'>>> hmac'a8128aa96ed5da1ec9d4fda35f1ad366d8ea21f2'

   See Wikipedia’s article on HMACs for more detail about that part of the cookie.

2. I was able to go from never using the tool to writing a working Firesheep handler for FetLife in under 20 minutes. Here it is.
3. For example, since IE won’t honor host-only cookies, it’s more vulnerable to a poisoned DNS cache. It’s also more vulnerable to “cookie jacking” via UI redressing attacks, which is also an example of an attack that site-wide SSL will not protect you against.
4. View the whole Twitter conversation on one page.

As I’m wont to do, my article explores the intersection of gender, sexuality and technology. Since this topic is so broad, the strict word limit was a real challenge. But I like such intellectual challenges. The following is a reprint of my contribution, but don’t let the fact that you’re reading my piece here stop you from exploring SsexBbox’s new mini-blog/online magazine and its other intriguing contributions.

Gender is a text field, by maymay

In one hand, as developmental psychologist Gertrude Wyatt once remarked, the “symbolic transformation of bits of reality into language [is] part and parcel of the individual’s ego development.” If we can accept that, then finding our own words is more than merely good communication, it’s literally necessary for growing up human. There is no more universal human experience than that of describing one’s own identity.

In the other, as “wrongologist” Kathryn Shulz said, “the miracle of your mind isn’t that you can see the world as it is. It’s that you can see the world as it isn’t.” This is no more profoundly expressed than through our species’ incredible use of technology, the force of which transforms the impossible into the possible. We have reached a point where arguably the most fundamental of God’s gifts to humankind—words—have come full circle.

It is now our words, in the form of programming languages, that are driving the evolution of technology. The corpus of this technological literature changes our physical reality, offering us everything from hormone therapies to space shuttles to online social networks. And as new technologies are developed, technology itself mimics its creator.

Except, that is, in at least one very crucial arena: the description of ourselves. To our technology, our genders are among our most baffling human properties. The binary coarseness with which our technology encodes this information should serve as a humbling reminder to anyone arrogantly proclaiming humanity’s superior intelligence; if your laptop’s screen can display millions of colors, why can your Facebook profile only display one of two options for gender?

Today’s standard for such things is defined in the International Organization for Standardization’s specification titled “Information technology — Codes for the representation of human sexes,” referred to as ISO 5218. This worldwide standard, most recently updated in July 2004, defines 4 mutually exclusive options: “male”, “female”, “not known”, and “not applicable”. It’s a simple scheme that takes a total of 2 computer bits to record.

That’s woefully inadequate—and we can do better. But how?

One early attempt called “Yay! Genderform” offers you 947 options using checkboxes, which allows you to combine each option with any other option for “a total of 1.1896×10285 or 1.1 quattruornovemgintillion possible combinations, more than there are elementary particles in the universe. If each option were a computer bit, it would take 119 bytes to encode a combination.” Though a good illustration of the problem space, staring at an interface of 947 possible boxes to check isn’t merely practically unusable, it fails to free us from the flawed paradigm’s constraints: we need to break out of boxes altogether.

A simple interface can be a gateway to endless possibilities. Take, for example, Google’s famously simple homepage; using just a single text field, Google gives you access to the entire searchable Internet. So, too, can a text field access the symbolic gender galaxy—or at least a coordinate within it.

The words we use to communicate are the tools with which we teach each other—and our software—about ourselves, who we are, who we like, and why. Designing sexist systems might sound brain-dead, but it’s actually how many people think of gender issues in their mind. They quite literally don’t see different humans as being equal; when two men marry, they need to figure out “which is the wife” and so they literally imbue the code they write, and the technology they build, with rigidly gendered, technically inaccurate world views.

Ultimately, it’s up to us to build a world where we can either limit or accept the possibilities of the people we interact with. Therefore, we ought remember Internet pioneer Jon Postel’s Law: “be liberal in what you accept.” Put another way: don’t limit us with boxes, because, as Eddie Izzard said, “there’s gonna be a lot more guys with makeup during this millennium!”

Formerly a professional web developer, maymay is now a social justice technologist whose work primarily intersects with issues of digital civil liberties and sexual freedom. He is the co-author of Foundation Website Creation and AdvancED CSS, the founder of the sexuality education conference series KinkForAll.org, and host of the KinkOnTap.com Internet radio talk show. His seminars on technology and sexuality have been featured at conferences from coast to coast, and he prefers couches to hotel rooms. Learn more at maybemaimed.com/cv.

As usual, please feel free to republish this article at your whim, so long as you don’t do it in any place that requires a financial commercial transaction to access (unless you get permission for that, first), and so long as you link back here. Thanks very much.

My talk was called “Anti-censorship best practices for the sex-positive publisher,” and I subtitled it “How to make keeping it up easy and taking it down hard.” I wrote the longest talk I’ve ever given (~7,300 words) and, in my usual style, supplemented it with a slide deck totaling 220 rapid-fire visual aids. In the end, I felt like it went over pretty well, although I was exceptionally nervous.

I was nervous first and foremost because this talk had several far-reaching objectives. Among them were driving home the importance of fighting for freedom of information and free speech, explaining the way Internet censorship and sex-negativity support and often rely on one another, and exploring how social networking theory can help cure the current worldwide pandemic of sexual paranoia. Moreover, I also wanted to provide as much insight as possible into the months of thinking that have gone into my “FetLife Considered Harmful: The Risks of Sex Ghettoization” essay in an effort to clarify it, because much of the backlash against it (and me) coming from FetLife members and some sexuality community stalwarts betrays their profound ignorance of the issues at hand.

That’s a tall order. On top of all of that, however, I also had no idea who my audience was going to be, other than that they paid to see me speak at a conference focusing on polyamory. Were they going to be techies or luddites? Young digital natives or stereotypically technophobic moms and grandparents? All of the above? No matter how homogenous and receptive in-person attendees may have been, however, I also live streamed the talk and I knew I was going to publish it on my blog for the Internet to see.

Ultimately, I chose to de-jargonize the whole talk; I never use the word “database” and I only use the word “data” 5 times. I don’t think I mention anything more technologically complicated than “a proprietary file format,” and I use the ubiquitous example of a Photoshop PSD when I do. I tried to discuss the issue generically while still providing practical guidance because when talking to a large group, talking about too many specifics would likely benefit only several individuals, not the whole group.

In the end, this presentation is about the “practical theory” of anti-censorship techniques, and while I focus on technical (Internet) censorship most, “censorship” is defined loosely. I again drew heavily on FetLife as a case study but I mercifully had way longer for this talk (an hour and a half) than for my KinkForAll Providence 2 talk in which I first presented my concerns about that site (20 minutes). Even so, I still didn’t have time to go into as much nuance as I’d have liked. Complicating factors like Reed’s and Sarnoff’s laws were left out of my talk entirely and I feel like I just barely scratched the surface of what I did mention, such as applications for Metcalfe’s law.

Nevertheless, it just so happened that a conference about polyamory was the perfect place to give this talk.

I want to thank the staff of Atlanta Poly Weekend for accepting my proposal, for putting up with me when I insisted that they re-organize the layout of my session’s room, for giving me a wireless microphone since I had a sore throat so I didn’t have to strain my voice to give the speech, for making a special effort to video record my speech and my slides, and for generally treating me way nicer than I’m used to, even though the VIP treatment made me a bit uncomfortable. Most of all, though, I want to thank everyone who offered encouragement when they saw me banging away at my keyboard in the hotel hallways late at night actually working on finishing this thing.

And that’s another reason why I’m nervous. This presentation is a first draft!

So, without further ado, below is a low-fidelity video of my presentation recorded from the live stream. (The high-quality version has yet to make it to me.) Like all my similar work, this presentation is “open source” and Creative Commons licensed. Feel free to download it, use it yourself (including, since I can only be at one place at one time, literally re-presenting it wherever you wish and are able), or share it with anyone you think might find it valuable. If you do any of these things, I would greatly appreciate a link back to this page.

Anti-censorship best practices for the sex-positive publisher by maymaym on Ustream

Download:

• Anti-censorship best practices for the sex-positive publisher keynote presentation as a ZIP archive.
• Anti-censorship best practices for the sex-positive publisher keynote presentation as a PDF document.
• Anti-censorship best practices for the sex-positive publisher slides (and animations) as a QuickTime movie.
• Anti-censorship best practices for the sex-positive publisher keynote presentation as a text transcript.

[Video of The Machine is Us/ing Us plays.]

What do bananas have to do with censorship? What do polyamorous people have in common with fax machines? And how can you help your ideas have sex? These are the three questions I’m going to answer in this seminar.

We live in an amazing moment in history. As I bet any sexually vocal person will tell you (if you don’t already know), the Internet has fundamentally transformed our ability to communicate with one another. For example, before the Internet, if you were a gay teenager in bum-fuck nowhere, you were the only gay person in the world. Now, though, after the Internet, if you’re a gay teenager in bum-fuck nowhere, you’re one of millions of gay teenagers communicating online.

This is big. This is not merely the evolution of telecommunication technologies. This is a revolution.

The second sexual revolution is about information

The Internet is such a big deal that it’s actually a revolution of all kinds—media, governance, technology itself. But it’s also a second sexual revolution, and this one—our generation’s sexual revolution—traces its roots through the first. This is where just a bit of history comes in handily.

On May 9th, 1960, the first oral contraceptive was made available to the general public; “the Pill” sparked the sexual revolution of the 1960s and ’70s. Like all revolutions, no one could predict the outcome at the outset. It sparked chaos; the sexual revolution precipitated the “sex wars” in the 1980s.

Also in the 1960s—in 1962 to be exact—Joseph Carl Robnett Licklider, affectionately known as “Lick,” (not kidding) first proposed a global network of computers. The project was initially adopted by the Advanced Research Projects Agency (ARPA), an R&D branch of the US military. Yes, the Internet was originally conceived of like a weapon.

As the slogan “Make Love, Not War” spread through public consciousness in the “free love” movement of the 60s, the Internet was being recognized as a tool of generic utility and in 1969 was launched as ARPANet. “Make love, not war” is, at least poetically, a physical parallel of Internet technology.

The specification for the ubiquitous File Transfer Protocol (FTP) was published in 1973—the same year as the Roe v. Wade decision legalized abortion in America. In 1986, as the sex wars raged, the National Science Foundation funded NSFNet as a cross country 56 Kbps Internet backbone for expressly non-commercial, essentially academic purposes. The protocol for the World Wide Web, called the HyperText Transfer Protocol (HTTP), was developed by Tim Berners-Lee in 1989, and, of course, eventually became the most widely used protocol on the public Internet.

In exactly the same way as Gutenberg’s printing press was recognized as a revolution, bringing with it 150 years of chaos, so too is the Internet. [Video: "Why do you think the world will be in chaos for 50 years?" clips play.] You may be asking yourselves, “Why is any of this important? So what if we are living in a time of media chaos?”

It’s important because disruption is the precursor to progress, and successful innovation harnesses chaos. Create chaos carefully, and you will be a force to be reckoned with. This seminar is about how to be a force to be reckoned with online.

Last month, on February 21, 2011, in an episode of Al Jazeera’s show “Empire” titled Social networks, social revolution host of Democracy Now! Amy Goodman asked:

In the United States, we don’t have State Media, but you have to ask, ‘In this country, if we had State Media, how would it be any different?’

While it is true that never before in human history have individuals like you and me been so empowered to create change using available telecommunication technologies, it is also true that never before in human history have all the technological pieces necessary for a totalitarian Police State existed simultaneously, as envisioned by Orwell—until now. In today’s age of postmodern warfare, information itself can be a weapon of mass destruction.

Information weapons come in two main forms: propaganda and censorship. Both can be considered cultural terrorism, each pointing in different directions. For us as sexual freedom advocates, propaganda includes fear-based messages spreading sexual paranoia or moral panic. Its target is the general populace. Censorship includes the firewalls, content filters, and bandwidth limits intended to target you—sex-positive publishers.

Lest you think I’m being hyperbolic, let’s look at some recent examples of the information landscape.

The censoring of sex

Perhaps the most obvious examples of Internet censorship can be found in China. But China also offers a particularly relevant case study for sex-positive publishers.

In 2003, a woman writing under the nom de plume of “Muzi Mei” became a notorious household name in mainland China after she started blogging about her sexual encounters with a number of men. She displayed a confidence that may seem familiar to many of you. In November of that year, she was featured in a New York Times article which reads, in part:

[…A]s China’s propaganda machine has promoted the nation’s new space hero or the latest pronouncements from Communist Party leaders, the Chinese public has seemed more interested in a 25-year-old sex columnist whose beat is her own bedroom. […] Mu Zimei is both reviled and admired, but she is not ignored. […] Her celebrity — which exploded when she posted an explicit online account of her tryst with a Chinese rock star — first seemed to baffle government censors but now has drawn a familiar response. Her forthcoming book was banned this week. She has quit her magazine columnist job and halted her blog, or online diary.

Yet at a time when ”Sex and the City” episodes are among the most popular DVD’s in China, the Mu Zimei phenomenon is another example of the government’s struggle to keep a grip on social change in China. Her writings have prompted a raging debate about sex and women on the Internet, where more people are writing blogs or arguing anonymously about a host of subjects in chat rooms and discussion pages.

”She does bring a huge impact on Chinese society,” said Zeng Fuhu, a top editor at Sohu.com.

[…]

[Ms. Mu] said she never realized her […] online diary would be so widely discovered, or that it would grow into a national controversy. But she defended her right to sleep with as many men as she pleased — and to write about it.

“If a man does this,” she said, “it’s no big deal. But as a woman doing so, I draw lots of criticism.”

[…]

Ms. Mu does not regard herself as peddling smut. She said her generation of Chinese grew up with little or no sex education. ”Some learned it from videos,” she said. ”Why not from words?”

Muzi Mei had opened pandora’s box. In the years that followed, a wave of celebrity sex bloggers, all young women, spread across China, each more audacious than the last. In 2004, a Chinese university student named Fu Rong Jie Jie posted softcore pictures of herself along with “lovelorn prose” and quickly became the country’s next phenomenon, calling herself “Sister Lotus.” She flat-out declared, “I will not be censored,” but by 2005 she had a cult following so large that Chinese censors ordered the country’s top blog host to move posts covering her to low-profile areas of the site and pulled a TV documentary about her from airing at all.

Meanwhile, another blogger, Liu Mang Yan, aka. “Lost Sparrow,” began podcasting lovemaking noises she recorded categorized by geographical regions of the country. That year, Pacific News Service reported:

In a culture where sexual attitudes are still repressive, the racy details shared by the women bloggers are thrusting them into the spotlight, despite China’s most recent crackdown on the Internet news media.

[…]

Though the Internet community for women is thriving, the Chinese government is stepping up its efforts to regulate online bloggers. China’s Ministry of Information Industry and the State Council on Sept. 24 released new regulations containing vague language banning sexually explicit content on the Web, which many analysts say are aimed at bloggers. Observers say the real goal of China’s Internet censorship is to prevent leadership and movement rising from the medium.

(Emphasis added.)

Sex-positive publishers, regardless of the labels they claim for themselves, have such a powerful effect on the inherently misogynistic, patriarchal, and sex-negative forces governing the world today that they—you, us—represent the collective human drive for self-determination. As Dr. Katrien Jacobs, Assistant Professor of Media and Communication studies at Hong Kong University writes in her book Netporn: DIY web culture and sexual politics:

[Reports] show that the PRC [People's Republic of China] party-state encourages the spread of the Internet while it believes that it can monitor and censor those aspects of activity that it sees as destabilizing, dangerous, and unhealthy. The PRC indirectly regulates the Internet by directly regulating intermediary actors/owners of cyber-cafés, ISPs [Internet Service Providers], Internet content providers (ICPs), and everyday citizens. For instance, the Guangdong public security department has agreed with local telecommunications companies to pay a reward of up to 2,500 yuan (US$309) to people who report any type of netporn traffic.

Dr. Jacobs also describes “the Chinese government’s provisions that were included in a draft of regulations in the year 2000 to govern telecommunications and the publication of news and electronic information on the Internet.” These regulations were a list of amazingly broad and vaguely defined “forbidden contents,” which were simply banned:

information that (1) Contradicts the principles defined in the constitution [of the PRC]; (2) Endangers national security, discloses state secrets, subverts the government, or destroys the unity of the country; (3) Damages the honor and the interests of the State; (4) Instigates ethnic hatred or ethnic discrimination, or destroys the unity of [China's] nationalities; (5) Has negative effects on the state’s policy on religion or propagates evil cults or feudal superstition; (6) Disseminates rumors, disturbs social order, and undermines social stability; (7) Spreads lewdness, pornography, gambling, violence, murder; (8) offends or defames other people, infringes upon the rights and interests of other people; and (9) Other contents that are forbidden by law or administrative regulations.

Number 7 in particular, which lumps lewdness and porn together with murder, deserves being called out as what Dr. Marty Klein calls a “phony category”:

It’s a common strategy in public policy discussions—creating a category that lumps two dissimilar things together, and decrying the more serious of the two. We’re all in favor of preventing hangnails and heart attacks, aren’t we? We MUST do something about that!

Also in 2005, in what was known as China’s “great Internet pornography trial,” the Chinese government sentenced 11 defendants, 5 of whom were university students, to prison for between three and twelve years. They were convicted as Internet pornographers under the censors’ regulations for administering a fee-based online BBS, 99bbs.com, whose users traded pornographic content. Dr. Jacobs describes the trial as an attempt of the government not to eradicate porn distribution but to undermine the very vitality of a new social network [because t]he values of this Chinese network were different from those of official mainstream society controlled by the PRC. It announced a sex/porn revolution in a twilight zone: It included the sharing of sexual ideas and communication by both women and men and gave its people access to pornography.

All of this censorship of sexuality is an erotophobic tightening of the social sphere. All of these regulations are fronts for an ideology that constrains women and sexual minorities. In China’s great Internet pornography trial, the lone female defendant, 29-year-old Zhao Yong, got the strictest sentence: twelve years. And just in case you needed any more convincing, just this week—THIS WEEK—32 Chinese women were reportedly arrested for writing and publishing gay erotica on the Internet.

China is not the only country with such repressive information policies.

Iran is equally repressive, of course, but so is Turkmenistan, Uzbekistan, Syria, and Vietnam, for example. Note, in particular, Tunisia and Egypt—both in the news recently due to their revolutions—were suffering equally pervasive Internet censorship, according to data from Reporters Without Borders. And Saudi Arabia, a key US ally in the Middle East, is just as bad. In fact, most countries that are connected to the Internet conduct some level of Internet censorship, including the United States. Interestingly, among First World American allies, Australia—Wikileaks founder Julian Assange’s home country—is by far the worst.

Still think Internet censorship can’t happen here, in the Western so-called liberal democracies? In many of these countries, legislatures have been trying to ban content from the Internet for years under various guises: “combating copyright infringement,” “defending national security,” “eradicating child pornography.” These causes are routinely misused and abused to support a pro-censorship agenda, I say as someone who would support legitimate efforts to do all of those things.

And what’s censored most?

Blogs—especially sex blogs—like yours and mine. Personal blogs are more censored even than opposition political party websites, according to data compiled by the OpenNet Initiative.

A few years ago, I started keeping a list of corporations and public facilities that censored my blog and I encouraged my readers to report any blocking to me. I learned that I’m censored by the free Wi-Fi provider in both Long Beach, CA’s airport and Austin-Bergstrom International Airport in Austin, Texas; by Bolt Bus’s free Wi-Fi; by NASA’s Goddard facility in Greenbelt, Maryland; Vodafone UK censors my blog unless subscribers ask to opt-out of “Content Control”; and I’m censored by the public libraries in Austin, Texas, Sacramento, California, and Providence, Rhode Island (even on computers specifically reserved for use by adults).

Internet filtering at public libraries in America is actually mandated by a 2003 law known as the “Children’s Internet Protection Act” despite numerous reports, including the Youth Safety on a Living Internet report published in June 2010, saying Internet filtering is actually bad for kids and their education. Such misguided attempts at “protection” result in a sexuality information deficit that causes terrible emotional, and often even physical and legal, damage to the very youth they claim to be protecting.

This isn’t supposed to happen, right? The premise—and the promise—of the Internet was that you, an individual with something—anything—to say, can reach a global audience with the push of a button. But that simple activity presumes that on the Internet, all content is created equal. Or, as ever so famously phrased, “In our world, all the sentiments and expressions of humanity, from the debasing to the angelic, are parts of a seamless whole, the global conversation of bits.”

But if that were really true, non-controversial content would be pretty much the same as controversial content, perhaps of a political nature. Of course, we know that even in America, content is not all treated equally. The ACLU recently launched a campaign called Don’t Filter Me! because they received reports of LGBT websites being blocked in schools because they were LGBT education websites!

Censorship also happens in the form of service discrimination, not merely content blocking. For instance, after Wikileaks began releasing US diplomatic cables in December, 2010, it faced a series of extrajudicial attacks: Amazon kicked Wikileaks off its servers, Everydns.net withdrew its domain name, and PayPal froze WikiLeaks’ account. The amazing thing about this is that each and every one of these attacks has a sexual censorship precedent.

In other words, if you didn’t see this coming, you weren’t talking about sex loudly enough.

The folks who published the NYC Sex Blogger Calendar have had their PayPal account frozen and their funds seized not once, but twice, before they decided to ditch the service way back in 2008. Web celeb Violet Blue’s “sex-positive URL shortener,” vb.ly, had its domain name seized by the Libyan government in October, 2010. And just one month before Amazon cut off WikiLeaks, there was a big hoopla over Amazon’s initial defense of, then banning of a “Pedophile book” from their virtual shelves. Interestingly, Amazon initially said it wouldn’t pull the book because that would amount to censorship. Eventually, Amazon capitulated to public pressure and, of course, now the book is gone.

Amazon’s conflicting actions with regards to the pedophile book should teach us 2 very important lessons. First, that censorship can be social just as much as as it can be technical. And secondly, that sexual speech will always be in the vanguard of anti-censorship efforts. Thus, sexual speech will always be censorship’s initial—but never its last—casualty.

So here’s how we can frame the censorship versus free speech problem: On the Internet, even if your content may not be illegal, if you can’t find anyone to host it, link to it, or bill for it, it may as well be. In exactly the same way as Julian Assange is being called a “terrorist,” not a journalist, Galileo was being called a heretic, not a scientist. And in a fascistic world where such ludicrous stigma is treated as dogmatically-enforced fact, since I’m a “sex” blogger discussing sexuality a lot online, they call me a “pedophile.”

Of course, we’re none of those things. Nevertheless, we’ll all get called these things because, in the words of national security blogger Maximilian Forte, “The real ‘insurgency’ is the one being fought at home. To the state, every defiant citizen is a terrorist, in mind if not in practice.”

You may not have realized it until now, but because you as a sex-positive publisher publish material asserting different values from the mainstream society controlled by corporations and your government, websites like the Chinese 99bbs.com are your kindred spirits.

Circumvention Tactics for Information Guerrillas in the Culture War

Anti-censorship is called circumvention because it helps you dodge, or circumvent, the censors. Since there are many different publishing platforms, I’m not going to get into the technical nitty-gritty of which button to push on which screen. If you want to talk about that with me, I’d be happy to speak with you privately later.

Instead, I’m going to detail three best practices that, taken together, I hope will provide a framework for how to build anti-censorship techniques directly into the way you think about publishing itself. Each concept builds on the one beneath it, so you can think of any action you take online to be a cumulative result of these principles in action. They are:

1. Avoid single points of failure,
2. diversify your distribution network, and
3. liberate your data.

Let’s go through them one by one.

Avoid single points of failure

First, you need to be aware of single points of failure and do your best to avoid them.

A single point of failure (SPOF) is a part of a system which, if it fails, will stop the entire system from working. This is also known as the weakest link, and is the single most critical concept in this entire presentation. To explain this, let me tell you a short story about bananas.

Dangers of a banana (and sexuality) monoculture

When Americans think of bananas, they think of one and only one variety: the Cavendish. In the words of Chiquita, the globe’s largest banana producer, the Cavendish is “quite possibly the world’s perfect food.” But it also happens that all of the 100 billion Cavendish bananas eaten annually worldwide are genetically identical; every commercial Cavendish banana tree is grown from cuttings of the original tree. This genetic monoculture is the Cavendish banana’s single point of failure.

Since it lacks the genetic diversity key to a species’ health, any fungal or bacterial disease that infects one banana plantation can infect them all. That’s exactly what happened in the early 1900′s when similarly genetically identical crops of the Gros Michel variety of banana were devastated by a fungus called Panama disease. It ravaged plantations across the globe for decades.

According to a 2005 article at PopSci.com:

Growers adopted a frenzied strategy of shifting crops to unused land, maintaining the supply of [Gros Michel] bananas to the public but at great financial and environmental expense—the tactic destroyed millions of acres of rainforest. By 1960, the major importers were nearly bankrupt, and the future of the fruit was in jeopardy. […] U.S. banana executives were hesitant to recognize the crisis facing the Gros Michel. […] Once a little-known species, the Cavendish was eventually accepted as Big Mike’s replacement after billions of dollars in infrastructure changes were made to accommodate different growing and ripening needs. Its advantage was its resistance to Panama disease. But in 1992, a new strain of the fungus—one that can affect the Cavendish—was discovered in Asia. Since then, Panama disease Race 4 has wiped out plantations in Indonesia, Malaysia, Australia and Taiwan, and it is now spreading through much of Southeast Asia.

Insistence on a banana monoculture is once again costing billions of dollars in efforts to save the Cavendish from extinction, just as was once spent—fruitlessly—on the Gros Michel. It seems to me that growing multiple varieties of bananas and importing all of them would be better for business and the environment. Yet American culture’s obsession with essentialism—on dichotomies, which are, briefly, a set of “good” things that are exclusive from an opposing set of “bad” things—discourages US banana execs from diversifying their product line, thereby keeping the American populace largely ignorant of banana varieties and contributing to environmental disaster.

The problem is not with any given consumer’s desire for a consistent—Cavendish-only—experience, but rather with the lack of anything other than a proscriptive experience as the only option, whereas others are, in fact, available.

That’s the exact same dynamic playing out with regards to sexuality information. You and I live in wild banana fields, where a variety of sexuality information is growing all around us. But most Americans are being allowed to access only one very specific kind of sexual information.

The moral of this story is that if you have only 1 of a crucial thing, that thing is a single point of failure and represents a vulnerability to you.

Recovering from SPOF vulnerability

There are two basic ways to deal with being vulnerable to single points of failure.

1. The obvious solution is to create redundancies for every part of your system; you make available as many duplicates as you can afford to maintain. (This is sometimes called “mirroring.”) This way, even if some parts of your system are taken offline or if some places featuring your content are blocked, the others will hopefully still be available.
2. The other strategy is to decentralize the system or content itself such that there is no single piece necessary for the other pieces to function; you eliminate single points of failure by making available as many overlapping pieces as you can. In this design, even if some parts of the system or of your content does get censored, enough of it remains available to maintain a cogent message.

A decentralization strategy is not better or worse than one using redundancy, and in fact a hybrid strategy is frequently most effective in most circumstances; both methods offer different advantages and disadvantages. Redundancy is often more expensive and time consuming to make available because everything has to be done multiple times (unless you automate the process), but it can offer greater integrity. On the other hand, decentralization is more often lightweight and versatile but can be far more complex to manage. Here, many small actions are taken by many participants in many places that may seem inconsequential or incomplete when viewed in isolation, but they weave enough of a web—so to speak—to become an agile, even graceful way to move through the world as a whole.

Some common examples of an Internet publisher’s single points of failures are:

• having only one copy of your data (no backups)
• having only one website or contracting with only one web hosting provider;
• registering only one domain name or registering domain names with only one domain registrar;
• hosting your websites in only one country, or state (or other area of legal jurisdiction);
• using only one publishing platform that you do not control (Tumblr, Twitter, Facebook, etc.).

Here’s a super simple example of recognizing a potential single point of failure and avoiding it in a tweet. Do you see it? Using two URL shortening services in one tweet means that if one of the services stops working, people who view this tweet will still be able to get a sense of the examples I’m citing as “GOP fiscal idiocy and moral irresponsibility” via the other shortlink(s).

Similarly, when I publish episodes of my sexuality netcast, Kink On Tap, I post a live, unedited version to Ustream.tv and then post another version to my own website, effectively making a mirror (a copy) of every episode. If KinkOnTap.com should go down, Ustream.tv still has every episode.

Here’s yet another example in which I published an exposé about some shady and unethical technology being used by Internet sex toy retailer EdenFantasys on two of my blogs on different domains. When a commenter expressed concern that I’d receive a cease-and-desist letter from EdenFantasys I suggested that they copy and cross-post my exposé to their own blog, which they did. As more and more copies began appearing online, it became obvious that a cease-and-desist letter would be pointless because the info had spread so far so quickly.

The takeaway here is that the Internet is a copy machine. Since digital copying is so inexpensive, combating Internet censorship is as simple as copying and distributing the censored thing, so censorship itself becomes increasingly expensive.

Diversify your distribution network

Second, you need to do your best to diversify your distribution networks. Herein are two key concepts that we’ve just learned. First, if you only have 1 distribution network, that’s a single point of failure. Secondly, and more importantly, diversity itself is a shorthand for discussing the SPOF response scale because diversity is anathema to censorship.

A distribution network is the infrastructure—the structural system—providing the means by which information flows. This could be a website like Twitter, verbal conversation with friends, or a conference like this one. All strong distribution networks are diverse. To understand why, we can look (conveniently enough) to sex and, specifically, polyamory.

Understanding distribution networks: Polyamory and the Internet, sitting in a tree

As I see it, a poly activists’ core goal can be succinctly described as achieving equality in relationship choice. That is, polyamorous people recognize that the structure of a compulsorily monogamous relationship, in which one individual is connected to only one other individual, is limiting. Instead, we argue, many people may find more value by changing the structure such that one individual can be connected to more than one other individual.

This has some remarkable parallels to the way telecommunication technologies (like the Internet) work. In essence, polyamory does for relationships what digital telecommunication technologies have done for ideas.

As technology theorist Kevin Kelley wrote in his seminal work, “In the network economy, the more plentiful things become, the more valuable they become.” Another way to say essentially the same thing, but from a polyamorous perspective, is “Love is not a scarce commodity,” or, even more generally, “the more, the merrier.” Here’s how veteran web designer John Waters explained it:

In the industrial economy, scarcity established value. Natural resources such as oil, gold, and diamonds were scarce and therefore considered valuable. […] Paul Romer and other theorists introduced the “New Growth Theory”. In this model, the principle of scarcity is turned upside down.

The new theory essentially divides the world into two productive inputs: “things” and “ideas”. Only one person at a time can use things such as a hammer, a telephone, a lawnmower, or a car. On the other hand, ideas can be used by many people simultaneously, i.e., recipes, blueprints, formulas, methodologies, and software. They can be used to rearrange things. They can be copied, shared, and connected, thereby leading to more ideas. “Economic growth,” Romer says, “arises from the discovery of new recipes and the transformation of things from low to high value configurations.”

So, this “transformation of things from low to high value configurations” is what the polyamory movement does with regards to relationships. The most obvious limitation with the often-monogamous notion of “true love” is that it creates a scarcity model, and free distribution is anathema to maintaining scarcity. Polyamorous people understand that “free love” is not just a hippie slogan, it is a way to create real-world emotional value.

Unsurprisingly, then, we can look at the evolution of telecommunications to learn about sex-positive movements. A good example is fax machines.

Contrary to popular belief, the facsimile machine was invented in 1843 by a man named Alexander Bain, built from the same things as the telegraph. It was not until 1906, however, that the machines started seeing significant use. Newspapers were the first early adopter because the machines allowed them to send photos across long distances. Next, weather services adopted the technology. Finally, 2 years before ARPANet was introduced, XEROX invented the modern “fax” machine in 1967. Today faxes are still ubiquitous, and they can interface directly with the Internet. There are, for instance, numerous services that translate faxes to emails and vice versa.

Like the Internet, the fax machine had a long incubation period. Moreover, it took millions of today’s dollars to invent the first one, and that machine was utterly useless. It wasn’t until the second one was built that the first one became useful. As more fax machines were built, each one became more valuable.

That’s Metcalfe’s Law: the usefulness of a network equals the square of the number of its users.

Metcalfe's law: the usefulness of a network equals the square of the number of its users.

On a graph, the “incubation period” looks like a long mostly-horizontal line, but then as more devices are added to the network, we see a continually steepening upwards incline. When people talk about the “network effect,” this is the shape they’re talking about. After a network reaches critical mass, as Kevin Kelley put it:

When you buy a fax machine, you are not merely buying a $200 box. Your $200 purchases the entire network of all other fax machines in the world and the connections among them—a value far greater than the cost of all the separate machines.

This works on multiple levels of scale. When we’re talking about it from the perspective of an individual, the “devices” of Metcalfe’s law are humans. Whenever you hear someone saying, “I joined FetLife because all my friends were on it,” what’s happening is that their personal social network—the people they interact with on a regular basis—has hit the critical mass crossover point.

When we’re talking about it from the perspective of a group, or community, then the “devices” are, themselves, communities. When organizers talk about “building coalitions,” what they’re doing is trying to pull their cause towards the critical mass crossover point. Metcalfe’s curve, as it’s known, is what makes large networks hard to resist—regardless of whether that network’s nodes are fax machines, people, or ideas.

When a network gets large enough, it becomes the de-facto infrastructure for the nodes it serves. Just as Facebook has become a de-facto communications substrate for large segments of the Internet-enabled populace, FetLife is fast becoming a de-facto substrate for many sexuality communities, often overshadowing, even replacing prior infrastructure.

Now, before I go any further, it’s important to mention that large networks like Facebook or FetLife are not inherently bad things. From the perspective of an individual node, this feels wonderfully connective. But if we scale up to the perspective of the group’s network itself, we see we’re suddenly alone; using a system that doesn’t offer interoperability, like FetLife for example, we’re unable to interact with other networks.

This is what in-group/out-group, us/them, you-versus-me, thinking looks like. This is how privilege hierarchies are created and recreated time and again. If ignorance is a privilege, then knowledge of this social networking concept is key to creating a socially just world.

Structurally speaking, when combined with the competitive, capitalistic, “every man for himself” ideology, the network effect encourages each large network to create incompatibilities with other networks in order to lock users into their service. In other words, this interplay pushes systems towards structural monoculture; it creates vendor lock-in. And regardless of whether it’s technological, cultural, or social, vendor lock in, as we’ve seen, is a single point of failure.

The only solution I see to this large-scale problem is to weave diversity into the very fabric our lives. That is, we need to systematicize diversity itself. And there’s no better place to start than sex.

Systematicizing sexual diversity

Now that we understand the systemics, improving the system is relatively easy, although it may be easier said than done. All we need to do as individuals is use multiple distribution networks, including as many services purporting to be subject matter-agnostic as possible, and prioritize services that offer interoperability with other networks. Similarly, as a community, we need to prioritize, build and use infrastructure that’s highly interoperable at every opportunity.

For instance, with regard to your own personal distribution network’s structure, I’m suggesting that you use FetLife and Facebook and your own WordPress blog, or whatever other services and platforms you have the resources to utilize. In other words, don’t put all your eggs one basket since this kind of diversification offers redundancy on the distribution network level itself.

Remember Kink On Tap? In addition to multiple copies of the content (my proverbial “eggs”), I was also using my own WordPress-powered blog and a social networking video site called Ustream (my proverbial “baskets”).

My other major project, a national series of sexuality education conferences called KinkForAll, is even more decentralized: it has a Google Group, a FetLife group, and a Facebook group (to name just a few), videos are posted on YouTube and Vimeo, live-blogged event notes are posted to personal blogs all over the ‘net, it has a Twitter account, and even an account on Identi.ca, an open-source Twitter-like clone. Moreover, since other KinkForAll participants independently create and share their own media from events, not even I am a single point of failure. Our own KinkForAll.org website is unusually spartan. To navigate, each upload is marked with a global “KinkForAll” tag as well as an event-specific tag, creating a decentralized yet well-organized multi-media cyber-library out of many small pieces, loosely joined.

In contrast, remember Violet Blue’s “sex-positive link shortener”? Since anything that declares itself sexuality-related becomes a target for censorship, building sexuality-specific infrastructure is a recipe for disaster. When vb.ly was taken offline by the Libyan government, all its short-links ceased to function. Violet had created a single point of failure and, worse, she had created one in the structure of the distribution network itself. That’s why I expressed critical skepticism when Violet launched her website in August, 2009; just as a road doesn’t care if it’s being driven on by a kinky person, Internet infrastructure should be content-neutral, too.

Beyond technicalities, though, publishing to (supposedly) content-neutral services challenges the hostile culture of sex-negative networks. In the last week of July, 2010, Facebook took down the community pages of Self Serve, a women-owned sexuality resource center, and also Violet Blue’s “Our Porn, Ourselves” consciousness-raising campaign page. While this cultural terrorism hurts us, not only will it hurt less the more decentralized our content is, but it also inspires conversation.

From a cultural rather than a technical networking perspective, when you speak up in support of, say, polyamory in a place where no one else is doing it, then as far as this new network is aware, you’re the first fax machine ever invented. It may take time, but when someone joins your monologue (even if they’re initially hostile), you’re suddenly having a dialogue—and that means they just became the second fax machine. Remember Muzi Mei, whose “writings have prompted a raging debate about sex and women on the Internet, where more people are writing blogs or arguing anonymously about a host of subjects in chat rooms and discussion pages.”

Finally, I’m suggesting that for both users of a network, like you and me, as well as creators of networks and networking tools, like Violet Blue and FetLife’s founder, John Baku, interoperability should be prioritized.

For example, I think the single best thing about FetLife is its “Events near me” page, but the single worst thing about it is that none of these events are findable from outside FetLife. Since there’s no way to access FetLife from outside FetLife, it’s like Vegas: what you say on FetLife stays on FetLife. This prevents individuals from, for example, importing event listings to their Google Calendar, something Facebook can do and that makes it more useful for a user.

FetLife is currently incompatible with any other network. In fact, nothing you post to FetLife can so much as be indexed by search engines like Google. This is also culturally dangerous because it nurtures an in-group/out-group mentality among FetLife users. But the “you’re either with us or against us” mindset offers no space either for allies or dissension, so the longer FetLife remains a technological monoculture, the more it becomes a social ghetto.

The online equivalent of dropping a bomb on a ghetto to eradicate a marginalized group of people is seizing or censoring a domain name. In this way, FetLife is to social networking what vb.ly was to link shortening: an easy target. And for a social network, as a network, FetLife isn’t very social. That’s why I think FetLife should work on creating public-facing options for at least three of its major components: journal entries, groups’s discussions, and events.

Not only would this interoperability be a boon for users, when we look at the big picture—at the level of networks themselves—this sort of federation is frequently nothing less than a matter of life or death for marginalized communities. Living in a hostile society, as we do, means we are many small and disparate networks. Even FetLife’s incredible ~775,000 users pales in comparison to Facebook’s ~500 million. Our smartest survival option is therefore to create as many connections as possible between groups: we must become a diverse network of interoperable networks.

As social network developer Evan Prodromou says:

The great thing about federated systems is that anyone can play […b]ut our current social web technologies don’t work like this at all. From the point of view of a typical social web site, if you don’t have an account on that site, you don’t exist. The only way for your friends on that site to interact with you is if they invite you to join the site. Despite the fact that there are hundreds of other social networking sites on the Web, almost every single one works as if there were zero other social networks on the Web.

That approach, especially for sexuality communities, is fundamentally flawed—isolationism is dangerous. To the extent that we are to have sexuality-focused social networks, or sex-positive branded infrastructure, we must federate. We must use tools that interoperate with other tools. And if we don’t demand that we get them from the people who control the large networks that we use, we’re burying our collective head in the sand.

Thankfully, it just so happens that federation, openness, and networking are all very sexual concepts.

Liberate your data

Lastly, you need to liberate your data. On the one hand, this simply means using services that don’t keep you and your content walled off from the rest of the world like a jealous lover, as we’ve just seen. In the words of DataPortability Project steering committee member Drummond Reed, this means that, You can read it, write it, or move it somewhere else—all under your control, using the tool, program, or service of your choice.

On the other hand, though, it means not acting like that jealous lover towards your own data in the first place. Since both the Internet and love function on the principle that abundance is more valuable than scarcity, loving your online content means setting it free. Have you ever heard someone say “don’t steal my idea”? This sentiment doesn’t make sense because ideas are free, and data—indeed, all technology—is simply a collection of ideas.

When computer networking professionals are “promiscuous,” they’re not being slutty—at least, not in the sexual sense. Instead, they’re configuring their network cards to let them see all the communication happening on a network. But transposing sex onto technology makes a lot of sense because technology evolves in exactly the same way humans do; using sexual reproduction.

As a sexual species, a human baby inherits the genes from both its parents’s lineages. But humans are not merely sexual creatures in a physical sense, we are sexual creatures in an intellectual sense, too. The way we share our genes to make new babies exactly mirrors the way we share our ideas to make new technology. Just as biological organisms evolve and they become more diverse, specialized, complex, and social, so too does technology evolve.

The easier you make it for your ideas to meet and, indeed, to mate with those of others, the more value you both will get from them. More to the point, however, the more your ideas “have sex” with other people’s ideas, the more diverse your idea distribution network will be.

Speed dating for ideas

When it comes to helping your ideas have cyber-sex, there are a few easy things you can do.

First, get out of the house. Have an idea? Talk about it online, on a blog, in a tweet, to a friend in email, anywhere that gets your idea out of your head and onto the Internet. In other words, publish, publish, publish.

Second, get socializing. When you publish, link liberally. Link to your own, prior content, and link back to the content that inspired yours. Speak URLs in audio recordings like podcasts so listeners can “follow” those, too. The more you link—the more connections you make—the more possibilities you offer others to interact with you.

Third, be yourself. Be sure to make your own source files available, if you can. In other words, open source your content. For instance, all artwork for KinkForAll, from icon designs to door signs, to promotional materials like print-ready flyers and postcards, is made available for free in their original file format. When possible, I convert proprietary formats to standardized ones that are more interoperable, such as turning simple PhotoShop images to SVG ones. I do the same thing with presentations like this one; browse my website and you can download all the assets that I used to make this presentation with one click.

And finally, be up-front, honest and open. Explicitly license your content permissively so that your content is legally attractive to others. You can use any of the Creative Commons licenses to keep your copyright but allow people to copy and distribute your work provided they give you credit—hopefully with a link back to your site! I sourced most of the imagery you saw in this presentation in exactly this way. Again, KinkForAll goes even further, expressly putting all shared resources into the public domain.

None of us were ever meant to work, or live, or love completely alone. In the end, we need one another—and we need others who aren’t the same as we are. And when different people like your ideas, and then make copies of your work, they’re helping you stay one step ahead of the censors.

As I once heard said, “unprotected speech leads to brain babies,” and that means “epiphanies are orgasmic brain baby conception moments.” I hope I at least gave you a cerebrorgasm or two. :) Thanks for coming to my seminar.

UPDATE 2: As KinkForAll sessions are relatively short, I didn’t have a lot of time to dive into background material in this presentation. However, I did just that the following weekend at the “Anti-censorship best practices for sex-positive publishers” seminar I lead during Atlanta Poly Weekend, since I had way more time. If you’re finding yourself thinking about this post, you’ll probably find plenty of value out of following up with the longer presentation.

Yesterday was KinkForAll Providence 2 (“KFAPVD2″), the eighth of these (now national) free and open-to-the-public unconferences about the intersection of sexuality with the rest of life. This one was put on as a fitting climax to Brown University’s Sex Week 2011, “unorganized” largely by xMech and SHEEC chairperson Aida Manduley. There were talks, presentations, and discussions about a range of different things, many of which were recorded by the live video stream I put up in the main room. You’ll be able to follow up with most of them at the KinkForAll Providence 2 schedule archive page as participants flesh it out in the coming days.

In my usual style, I gave a prepared talk and presented an accompanying slideshow. My talk was called “FetLife Considered Harmful: The Risks of Sex Ghettoization,” and I discussed what I see as a deeply dangerous, insular, growing monoculture within sexuality communities, epitomized by FetLife.com. This monoculture whitewashes the effects of privilege hierarchies while simultaneously reifying them in a way so ignorant and so terrifyingly undiscussed as to cause a lot of harm to individuals and “the community” en masse.

This was a challenging talk to research, it was even more challenging to write, but it was most challenging to actually present. This is not a nice talk. I am, ultimately, not interested in making nice with the community, with its leaders, or with its sex-negative attackers. Instead, I am interested in making change.

In part, this is because I have lost any and all significant investment I once had in “the community” and this, in turn, is because the community—unknowingly obsessed as it is with its narrow-minded, exclusionary ideals—is a place that is currently incapable of offering sanctuary or refuge from the hateful mainstream overculture for me and for countless others. In other words, I’m not an ambassador, publicist, or other form of PR-minded spokesperson for sex communities, and I am tired of their frequent, yet understandable spin doctoring. However, rather than discuss any pain this “community” inflicts from a personal perspective, since this talk was ultimately directed at wide swaths of the community itself, I approach the issue from the intersection of sociological and (elementary) technological analysis.

Below is a video of my presentation. As usual, my presentation is “open source” and Creative Commons licensed. Feel free to download it, use it yourself (including, since I can only be at one place at one time, literally re-presenting it wherever you wish and are able), or share it with anyone you think might find it valuable. If you do any of these things, I would greatly appreciate a link back to this page.

“FetLife Considered Harmful: The Risks of Sex Ghettoization” by maymaym on Ustream

Download:

• FetLife Considered Harmful: The Risks of Sex Ghettoization keynote presentation as a ZIP archive.
• FetLife Considered Harmful: The Risks of Sex Ghettoization keynote presentation as a PDF document.
• FetLife Considered Harmful: The Risks of Sex Ghettoization keynote presentation as a text transcript.

I purposefully kept this presentation as short as I felt was possible because, due to the 20 minute time limit on sessions at KinkForAll, and due to the fact that I was convinced the material in this presentation would spur heated discussion, I wanted to leave some room for a short Q&A after the talk. This meant I had to leave out a lot of depth, as well as many additional examples I could have cited. I may, at some point, present follow ups to this material that includes those in-depth details but, for now, I’m hopeful that there is enough here to get this long-overdue conversation started.

As expected, after I gave my talk, there were numerous questions and points raised from the in-person audience that I addressed, and are audible on the video embedded above. They were as follows:

• One person asked if FetLife could serve as a place of congregation and coordination for sexual minorities because the mainstream offers no such space. This was a great question. My (short) answer was that it can—in fact, every ghetto is by definition a place of congregation, and can potentially be a site of coordination as well—but the question is not whether these things are happening at all (they are) but how effective the result is. Currently, for many reasons, including current technical limitations that were sometimes chosen deliberately, harmful social norms deeply rooted within FetLife’s written rules (its “policies”) as well as its unspoken rules (its “practices”), and the active resistance of the sexuality minorities community as a whole for improving their ability to cooperate with one another, FetLife serves neither as a place of safe congregation nor a site of effective coordination.

  In fact, the greater problem is that in the current anti-sex climate at large any sexuality-specific website will become a ghetto and thus the solution is not to create sexuality-centric spaces as silos in the first place. Instead, we need to create decentralized networks that disperse our memberships and information into spaces that are (ostensibly) subject-matter agnostic. The Internet was designed for this, and sites like FetLife.com actively hinder attempts to safely diversify in this way.

• Several people asked whether or not I had spoken with John Baku before I presented my talk. The answer is “yes and no” because while I made John aware of my concerns, I did so over Twitter and thus did not go into much detail. On the one hand, I simply didn’t have the time to do so (and I doubt John did either, as we’re both pretty busy people). On the other, however, I preferred to get the attention of people at FetLife.com in this way because it is, frankly, more disruptive and I feel that the complacency with which the sexuality communities handle “internal” issues like this needs to be publicly disrupted. It should also be noted that while I think John Baku sometimes presents as a bumbling fool, I like him personally very much.

  Also, we as a community need to recognize that FetLife is a business. That does not mean it is inherently bad, but many people have begun treating FetLife as though it is their closest of friends as opposed to simply one of their business partners or service providers. (See also this absolutely classic response to this whole issue from a “community leader” on FetLife.) As a business, FetLife’s agenda is different from mine, and likely different from yours. At a minimum, we should be aware of this difference in perspectives.

• Another person questioned whether FetLife was actually better than I presented and posited that the site is actually more like Alcoholics Anonymous (AA) than a ghetto. This question betrays a profound ignorance regarding the various structures coordination may actually take, not to mention the structures of both Alcoholics Anonymous and FetLife as organizations. My answer was that, no, FetLife is not like Alcoholics Anonymous because AA is a fundamentally decentralized organization while FetLife is a fundamentally centralized one. For more on why this questioner is simply flat-out wrong, I recommend reading The Starfish and the Spider by Ori Brafman and Rod A. Beckstrom. See especially their second principle of decentralization: “it’s easy to mistake starfish for spiders.” (And, while we’re making analogies, you’ll actually see that KinkForAll is far more akin to Alcoholics Anonymous than FetLife is and will likely ever be.)
• This questioner also objected to my “conflation” of the LGBT community with the kink community. It is no surprise that this person self-identifies as a (top/dominant, cisgendered man and) member of the BDSM community, specifically. The strong tendency that BDSM community members have for reinforcing us/them (binary) thinking is a long-standing frustration I have with many of them and one that I view as inherently counterproductive (not to mention blatantly hypocritical) to their own stated mission statements. It was a derailing question and one I almost answered except for the fact that we really, really ran out of time at that point.

Notably, there was also a participant in the audience who offered a brief version of their own life story as a “data point” to support pretty much every point I made in this talk. That was quite unexpected and something I found very heartening. Thanks to you; you know who you are. ;)

Finally, here is a transcript of my talk in hypertext form. I encourage you to make use of the links herein; follow them, for they offer additional context and depth to the point with which they are associated.

August, 1966. “Cross-dressing” is illegal in San Francisco.

In the sixties, Gene Compton’s Cafeteria in the Tenderloin neighborhood was one of the few places in San Francisco where trans people could gather safely. They were unwelcome almost everywhere else they went. They were even often kicked out of gay bars.

Stonewall won’t happen for another three years. The LGBT community is currently known as the “homophile” community. America is experiencing a wave of mass student and youth protests against the war in Vietnam.

Three years before the Stonewall riots on Christopher Street, New York City, police entered Compton’s Cafeteria on Turk and Taylor Street in San Francisco. Fed up with the constant persecution, the transgender woman the officers were harassing threw her coffee cup in their faces, instigating a full-fledged riot that marked “the first known instance of collective, militant, queer resistance to police harassment in United States history“.

Many of the rioters were trans and homosexual members of “Vanguard, Incorporated,” an LGBT youth organization sponsored and funded by the Glide Memorial Methodist Church in San Francisco. Vanguard’s goal was to bring together factions of the San Francisco Tenderloin neighborhood—gay, trans, straight, police, businesspeople, and any other neighbors—to air differences peacefully and end discrimination. Later that year, the Vangaurd youth group changed its name to The Gay and Lesbian Center, becoming the first gay community center in the nation.

In 2002, I joined public sexuality communities; I began talking to people about their stories and started learning about the history of marginalized sexuality cultures. In 2009, the Internet turned me into a sexual freedom activist; I co-founded KinkForAll and I began traveling across America spreading the idea from city to city, coast to coast. But despite talking to thousands upon thousands of people, despite reading hundreds upon hundreds of news reports and blog posts and so on, it was not until 9 years later (2011)—this year—that I learned about Compton’s Cafeteria, or the central role trans people and young people played in fighting for sexual freedom from even before the start of the gay liberation movement in this country.

When people think of San Francisco they often think of Harvey Milk, or the Castro Theatre. “San Francisco,” they say, “sanctuary for the sexually open. San Francisco,” they say, “home for wayward queers. San Francisco,” they say, “epicenter of the sexual revolution.”

I’m no longer so sure.

Walk the streets of my (new) hometown of San Francisco in 2011 and, if you take the time to look around carefully, you may notice a peculiar thing. Go to the Castro and, yes, you’ll find it teeming with hyper-masculinized musclemen, visit the Haight and you’ll run into YUPpies and hipsters with their designer boutiques as plentiful as Starbuck’s are in New York. But go to the Tenderloin and you’ll find every disadvantaged group you can imagine: immigrants (especially from Vietnam), Blacks, and—of course—trans youth.

After the Compton’s Cafeteria riots, police essentially cordoned off the Tenderloin as an area where trans people, most of whom were sex workers, could go without getting bullied. The Vanguard youth had won territory—they were granted a ghetto—where they have largely stayed, largely invisible to the up-and-coming GLB(“T”) mainstream, to this very day. Not two blocks from where I live, on the corner of Sutter and Larkin Street, is where many of the city’s trans street walkers call their office.

In contrast to the Tenderloin’s intersectionally underprivileged populace, the monoculture of other neighborhoods is stunning—the ghetto of San Francisco’s Tenderloin is and has long been segregation, not sanctuary. Monoculture is, by definition, the creation of a privileged class; it rejects the value inherent in diversity in order to favor a particular set of traits. Like all other institutions, monocultures are inherently exclusionary.

And as our generation’s organizing is moving away from physical city streets and into what Steven Johnson calls the cyber-cities that are websites on the Internet, I fear some of them, and one website in particular, is unwisely recreating sexuality monoculture online.

We live in an amazing moment in history. As I bet any sexually vocal person will tell you (if you don’t already know), the Internet has fundamentally transformed our ability to communicate with one another. For example, before the Internet, if you were a gay teenager in bum-fuck nowhere, you were the only gay person in the world. Now, though, after the Internet, if you’re a gay teenager in bum-fuck nowhere, you’re one of millions of gay teenagers communicating online.

This is big. This is not merely the evolution of telecommunication technologies. This is a revolution.

But for a while now, I’ve been growing increasingly concerned about the monopolizing—and whitewashing—effects FetLife is having over sexuality community discourse. Like a fetish all its own, sex community inhabitants are turning to FetLife instead of their own blogs or local mailing lists to write, debate, and promote their art and events. FetLife is sucking us up like a big black hole, and we risk getting crushed by its gravitational force.

On its homepage, FetLife says it’s “similar to Facebook and MySpace.” On his Twitter profile, FetLife’s creator, John Baku, describes himself as “David” to other social networks’ “Goliath”. No matter how noble his goal, however, in an ironic twist of fate John may have inadvertently created the greatest threat to online sex community and cyber-sex culture that has ever existed.

For those who don’t know, FetLife.com purports to be a safe space made “by kinksters, for kinksters.” Once inside, you’re ostensibly within the “community’s” walls. Here, limited individual privacy controls means that almost anything you post to FetLife is potentially visible to any other FetLife user. At the same time, anything you post to FetLife is restrained within FetLife’s walled garden; no entity, whether human or machine, peering at FetLife from its outside can see inside.

This is the primary dialectic claiming FetLife is “private” and thus “safe,” but it is deeply and dangerously flawed. It is flawed first and most simply from an individualistic perspective. Secondly, it is flawed from a group coordination (i.e., single community) perspective—and even more so from a global interactionist perspective.

For an individual, FetLife’s primary “privacy” offering is simply that nothing you post will be indexed by search engines like Google. Since there is no way to access FetLife from outside FetLife, it’s like Vegas: what you say on FetLife stays on FetLife. The implicit claim, then, is that the entire container is safe.

However, since all that is required to gain access to FetLife membership is a (free) email address, the claim is farcical on its face. Claiming FetLife is either private or safe for any given individual is like breaking open someone’s back door and then selling them a stronger lock for their front door.

I’m astounded by how many people fail to realize how exposed they are within FetLife. In a recent article published in The Eye about Columbia University’s BDSM education group, Conversio Virium (CV), this was highlighted quite clearly:

For Devon, the nature of his career forces him to keep his scene self under wraps, and though he’s a CV regular, few people know his real name. He describes one particular night he was going out with a bunch of his job friends at T.G.I. Friday’s when a co-worker whispered “Devon” under her breath. “I have a secret—I know you’re on FetLife,” she said.

Frankly, I’m shocked that some malicious idiot with a blog hasn’t logged onto FetLife and mined it for LULZ yet—but I assure you, it’s only a matter of time. When that happens, it’s not going to be FetLife’s fault per sé, but it is their responsibility as a social networking company to portray both the technical and social aspects of their service in an accurate way. In this sense, Facebook is actually a far, far safer place for a savvy kinky individual than FetLife is right now.

FetLife should either prioritize and implement granular privacy controls post-haste (instead of what they seem to be focusing on, which is creating a mobile version, chat rooms, and a spam filter) or change its public line to reflect that it has no meaningful ones. Since having a false sense of security is more dangerous than having an awareness of one’s very real vulnerabilities, prioritizing anything other than privacy at this stage in the game is irresponsible.

But FetLife is also hurting sexuality communities globally by encouraging people to join what amounts to a voluntary ghetto, and doing that is as stupid as it sounds.

When The Eye posted its article about Conversio Virium, I noticed within minutes of its publication and I spread the word to members of the group via the discussion list they (sort of) maintain. But ever since FetLife hit this subculture’s mainstream (yes, subcultures have a mainstream), I knew that to get any notice at all, I had to cross-post it to CV’s FetLife group. As you can see in the two threads here, the public Google group has no responses, while the FetLife group has quite a number.

This is not merely annoying on a personal level, it is problematic for the entire community in at least two ways. First, when someone in the FetLife thread offered valuable additional information about the article, that information was not visible to anyone outside of FetLife. (It was up to me to cross-post the followup.) Second, since the FetLife login screen effectively repels Google, everyone from archivists to casual observers are guaranteed not to stumble upon the additional information.

This isolationism is dangerous; like an anti-Vanguard, it discourages the peaceful airing of differences, separates factions of the community from one another, and nurtures an in-group/out-group mentality void of leadership. Where is our generation’s Vanguard? Sexuality on the Internet is a terribly persecuted topic. Why are we, as a community, making it easier for our words—our voice—to be muffled? Don’t get me wrong. Some private spaces are necessary and helpful. But when so much community evolution takes place within a single, closed environment, we are voluntarily ghettoizing our most important cultural valuables.

Take, as an example, Asher Bauer’s excellent essay, Field Guide to Creepy Dom. At the top of his post, Asher says, “This is something I wrote about two years ago which has been reposted every which way all over the internet. I don’t even know where it is at this point, I just know that I still get repost requests for it all the time.” I did some digging and found that it was originally posted (where else?) inside FetLife.

Again, two things are worthy of note about this:

1. Despite being “reposted every which way all over the Internet,” Asher still received “repost requests for it all the time.” What this seems to suggest is that people were hearing about the article, but unable to find it on their own. Hence, the repost requests. Indeed, (at the time of this writing) Google’s cache only shows 6 hits on 3 different domains for a unique phrase within the essay. Of these, only one (1!) is a personal blog unaffiliated with one of John Baku’s “Goliaths.”
2. Despite the obvious importance of this essay to the BDSM community, only the people who had heard about it already were able to extract value from it, because only they even knew to go looking for it. And despite getting posted to the Internet by others, it took nearly 2 years for the essay to even make it outside the FetLife wall and onto the public ‘net in the first place.

The Internet gave the sexual revolution—gave us—warp speed. I fear the growing FetLife monoculture is pulling us back to impulse.

In contrast to Asher’s essay, Patti’s equally thoughtful essay, Safewords are Dangerous, was first published at Alt.com. For all the problems of Alt.com (and they, themselves, could fill a whole talk, much less a short KinkForAll one) Patti’s essay was then, and is now, public for any newbie who’s googling for “safewords” to find. Even Patti, however, has now cross-posted the essay to her FetLife journal, perhaps a tribute to the all-mighty social network effect gods.

This should not be surprising. FetLife has become a cultural institution, and it carries with it all the side effects of such an organization. As Clay Shirky says, “an institution is inherently exclusionary.”¹

The Internet has changed sexual culture. Is FetLife a peek into our future, or is it a reflection of our past? I fear it is the worst of both. Using FetLife, we’re unable to interact with the outside world while simultaneously being unable to interact to our full potential within its walls; promoting a “101″ class or doing outreach using FetLife is a waste of energy because those things should be geared for people who probably don’t spend time there.

In the words of Dar Williams:

And what's the future, who will choose it
Politics of love and music
Underdogs who turn the tables
Indie versus major labels
There's so much to see through
Like our parents do more drugs than we do

[…]

I am calling, can you hear this?
I was out here listening all the time….

Do you hear them calling? The masses of people, young and old, who don’t yet know where to look?

If you’re spending most of your time in FetLife’s walled garden, you’re not listening. But it’s worse than that, because as far as they know, you don’t exist. And that means they think they’re the only gay teenager in the world.

1. Quote is 4 minutes and 10 seconds into his speech.

The suit is predictable because it alleges copyright infringement in much the same way that you might expect the Recording Industry Association of America to go after music “pirates.” What makes the lawsuit newly noteworthy, however, is its conclusion: the largest settlement in porn file-sharing ever. As XBIZ.com reports:

In what apparently is the largest porn file-sharing settlement against a single defendant in the U.S., an East Coast man has consented to a $250,000 judgment against him for uploading six Corbin Fisher movies.

XBIZ has learned that [a man known as T.S.]¹ signed settlement papers on Christmas Eve, just four days after the gay studio filed a complaint against the BitTorrent defendant who was identified through his IP address.

Marc Randazza, Corbin Fisher’s general counsel, told XBIZ he knows of no other file-sharing settlement, porn or mainstream, that has reached this dollar high.

I think this is a dangerous turn of events for both the porn industry and for consumers. It was culturally damaging enough when music fans were turned into pirates by the industry they once supported, but with porn, that problem is amplified ten-fold. Now, not just criminality, but social stigma and shaming for consuming the very product the prosecuting party produces (porn) is being used as a stick to bully consumers into “paying up.”

The message is clear: pirate porn, and we’ll put your name as a porn-user in the court’s records.

Since I count a number of you in the industry among my friends, I’ll speak directly to you: take a lesson from the failed attempts of the RIAA to fight piracy this way. Your industry, if not your particular studio, is a huge prosecutor of copyright infringement. No matter what you think of piracy, it’s clear litigation is not a sustainable solution.

Further, the porn industry ought be careful with whom it gets into bed. It’s worth remembering that much of the same money used to “crack down” on Internet piracy, especially through BitTorrent, is the same money used to actively censor your work.

The non-erotic American entertainment conglomerates are the single strongest industry lobbying for draconian Internet censorship sanctions against anyone who infringes on their copyright. (ACTA is a prime example.) The technology that would enable these laws is the same technology that would censor your product from reaching your consumers. (See, for instance, COICA, also lobbied for by entertainment companies.) Not only is fighting piracy through litigation laughably ineffective, it directly employs Internet filters, legislative bans, and other restrictions on Internet access that your own industry front groups fight against.

I know that many of you do not have the money to hire copyright shakedown firms. But the mainstream porn producers who do have the money to hire lawyers for such lawsuit farces are not the people you, my feminist pornographer friends, should be cheering on. They are not on your side, no matter how pained your economic prospects in the industry have become.

Let us recall that feminist, queer, alternative, and independent pornographers and models, like indie musicians, are often helped (not hurt) by increased peer-to-peer distribution, the technological equivalent of word-of-mouth marketing. When you cozy up to the RIAA-like members of your own industry, you’re not only alienating your own consumers (as the RIAA have done), you’re also enabling the corrupt, civil liberties-destroying capitalistic enterprises to further empower entertainment groups like the MPAA to censor sexual expression.

Even if all you cared about was your bottom line, and I know that you care about a lot more than that, that kind of industry bedfellow should worry you plenty more than some pirate on BitTorrent masturbating to your image without paying you for the privilege because, next time there’s a lawsuit, it won’t be the consumer in the defendant’s chair. It’ll be the producer.

1. Edited by personal request of the individual in question, who states that his “full name was never supposed to be used in their publicity” as part of settlement conversations.

A synopsis, followed by the video and its transcript, is below:

Recent Internet censorship stories such as the WikiLeaks saga have surprised some people, but not sexually vocal Internet users, who have been the unsung vanguard of anti-censorship efforts for many years. And this is true even if their content contains less skin than the Sports Illustrated Swimsuit issue, as in the case of the NYC Sex Blogger Calendar. Nevertheless, straw-man arguments are routinely used to marginalize people who publish controversial material. Thankfully, since copying is a creative act, it can be used to directly combat the destructive act of Internet censorship.

Hi, my name’s maymay. I’m a sex blogger, and a sexual freedom activist, and as such I get censored online more than I think is fair. So I had some ideas about that and I wanted to share them with you.

So, here’s the premise. Let’s imagine you have something to say and you want to say it. No problem: you get a blog and you publish it. But this simple activity presumes that on the Internet, all content is created equal. Or, as ever so famously phrased, “In our world, al the sentiments and expressions of humanity, from the debasing to the angelic, are parts of a seamless whole, the global conversation of bits.” Beautiful.

But is it really the case? If it were, non-controversial content like this would be pretty much the same as controversial content, perhaps of a political nature. Of course, we know that content is not all treated equally. And last week we saw a dramatic re-enactment of what that looks like.

Wikileaks faced all kinds of attacks. A lot of people were surprised that this kind of arbitrary censorship happened but to sex bloggers like me it was no surprise at all. In fact, the more sexually vocal you’ve been online, the more likely you are to have seen this coming. Here’s a few examples.

PayPal freezing WikiLeaks’ account came as no surprise to the folks who published the NYC Sex Blogger Calendar, who have had their PayPal account frozen and their funds seized not once, but twice, before they decided to ditch the service way back in 2008! And just last month, there was a big hoopla over Amazon’s initial defense of, then banning of a “Pedophile book” from their virtual shelves. Interestingly enough, Amazon initially said it wouldn’t pull the book because that would amount to censorship. Eventually, Amazon capitulated to public pressure and, of course, now the book is gone.

Amazon’s conflicting actions with regards to the pedophile book and Wikileaks should teach us 2 very important lessons. First, that censorship can be social just as much as as it can be technical. And secondly, that sexual speech will always be in the vanguard of anti-censorship efforts, and thus sexual speech will always be censorship’s initial–but never its last–casualty.

So here’s how we can frame the censorship versus free speech problem: On the Internet, even if your content may not be illegal, if you can’t find anyone to host it, link to it, or bill for it, it may as well be. To bring this back down to an Earthly example again, if Assange is a “terrorist,” not a journalist, then Galileo was a heretic, not a scientist, and that, since I’m a “sex” blogger discussing sexuality a lot online would make me a “pedophile.” Of course, we’re none of these things.

Nevertheless, we’ll all get called these things because, in the words of national security blogger Maximilian Forte, “The real ‘insurgency’ is the one being fought at home. To the state, every defiant citizen is a terrorist, in mind if not in practice.” So let’s look at how this is playing out in the Wikileaks case, just very briefly.

When governments started censoring Wikileaks, copies of the cables started popping up on mirror sites. At first, only a hundred or so. But within a week thousands. This happened for one very simple reason: the Internet is a copy machine. Since digital copying is so inexpensive, combating Internet censorship is as simple as copying and distributing the censored thing so censorship itself becomes increasingly expensive. But to do that, even today, you need supporters–you need humans.

As Dan Gillmor explains it, “WikiLeaks is the beneficiary, in this respect, of a wide swath of support from people who will make it part of their life’s mission to help prevent this particular instance of censorship from succeeding. How ready or able will they be to defend free speech every time it’s threatened in the future?” Okay, that’s great for Wikileaks, right? But what about me? What about you?

Right now, if I wanted to go publish something I had to say, I’d go to my own website, publish there, and then whatever I published would get pushed out to any number of other sites. Note that pushing the content to the other sites creates a copy.

But what if I first went to a remote site, published there, then had my own site pull that content back? There are already some ways to do this, so at first it didn’t seem like a big deal, but I wanted to see how far I could stretch this idea.

So I started experimenting at one of my own sites, KinkOnTap.com in this case. Here you see that a blog post I wrote actually came from Delicious.com, originally. I never had to go to my site to publish the post; I wrote it in Delicious and my site copied or “pulled” what I wrote from there.

Then I started experimenting with other tools all over the place. I wrote in Google Reader, copied over to Facebook, other feeds, and so on. I even enrolled other people to write so that no single user account was adding content into the copying machine.

The basic idea turned out pretty powerful: publishing first-class content elsewhere meant that my own website wasn’t the only place where my content was, which meant censoring my site itself wouldn’t do much good in terms of stopping my content from reaching others’ eyes. Moreover, censors would have to block a service provider, which means they’ll upset a whole lot of “legitimate” users who’ll want the block removed, too, regardless of their feelings about my content since they just want to use the service, for instance Delicious.

So that’s where I’m currently at with all of this. But if you’ll indulge my idealism for a moment, maybe the ideas herein can be amplified in the realm of the currently-theoretical.

Recall that being able to copy cheaply is what makes censorship expensive. Copying, in this model, is essentially an embodiment of the expression of free speech. Moreover copying is nonviolent, that is, it’s a creative, not a destructive, act. I think this is an important nuance because, as John F. Kennedy says: “Those who make peaceful revolution impossible will make violent revolution inevitable.”

In other words, the cheaper you make it to create rather than destroy, and perhaps the more copying is inextricably tied to publishing, the more nonviolent social change will be. So, with that in mind, what if…?

What if in order to download a web page, you had to serve one? What if in order to have someone host your blog, you had to host someone else’s? See, the thing is, everyone cares devoutly about their own freedom of speech, but it’s the other guy’s that’s important. What if something like BitTorrent wasn’t for file swapping? What if it was a web server? To “say” (or publish) something, you’d have to let someone else “say” something, too. And would you gag your enemies if it meant gagging yourself?

So, these are just some ideas I’ve been playing around with. I made a space some months ago to brainstorm ideas like this, mostly myself right now. It’s at InternetNonviolence.org. I’d love it if you joined me there to talk about all this stuff. :)

Thanks very much.

What may be far less obvious to most people than the affirmation that knowledge is power is just how much sexuality has figured throughout this entire Wikileaks saga—and what lead up to it. For months, people have wondered whether one of Wikileaks’ possible sources, the imprisoned Bradley Manning, is a transperson. And then there was the arrest in absentia for Assange’s alleged rape under notoriously confusing Swedish law, a quick retraction, and then a re-instatement that has, this week, resulted in Assange’s jailing awaiting an extradition hearing.

If only the governments of the world actually cared about sexual violence against women as much as they pretend to in this one, very questionable instance. And even if the allegations are proven true, legally and with due process, would that make the facts Wikileaks published less true? News reports raise far more questions than answers—even going so far as to cite STD concerns as the root of the rape claim. (Not that there’s anything wrong with that.)

But none of this is what the First World Infowar is really about. And it is a war. This Sunday, EFF-founder John Perry Barlow published the tweet heard ’round the world:

The first serious infowar has now been engaged. The field of battle is Wikileaks. You are the troops.

Barlow’s point is well-made, his sentiment shared. But the view from a sexual freedom activist’s perspective is different. We are seeing, in the infowar against Wikileaks, a dramatic re-enactment in real-time of the attacks against free speech and freedom of expression that have spanned the past decade, if not more.

Like all wars, this infowar did not spontaneously spring into being. It began because the conditions for it were put in place, step-by-step, with one violation of civil liberties after another. For many sexually vocal people, what’s happening to Wikileaks feels eerily familiar, if massively amplified: delegitimization (“Wikileaks isn’t really journalism”), demonization (Fox News’ standard line for Assange seems to be “the Wikileaks rapist”), direct and indirect censorship, political and legal attacks, and even death threats.

These tactics are not new. What’s new in the Wikileaks case is the scale, speed, and level of coordination of the actions against the organization, as well as the actions in support of it. So it’s very easy to draw some parallels between the attacks on Wikileaks and what many sexual and other “minorities” face all the time.

When sexually vocal people try to do pretty much anything online, we do it under a fearful spectre of having it taken away from us without even a moment’s notice. When PayPal suspended Wikileaks’ use of their service, it didn’t surprise anyone who deals in sexuality-related media. Back in 2008, the folks at the charitable New York City Sex Blogger Calendar had this to say about PayPal:

We believe what has caused PayPal to twice now review our account is the word “sex” in both our email address and the actual calendar title…. It is obvious to us and many others in this community that PayPal is not good to use for anyone in the adult industry. We were aware of others who had had their accounts frozen and their funds taken by PayPal for what PayPal felt was a violation of their TOS. We did not think when we set up our Paypal account we would have this problem because there is no nudity in our calendar. As a matter of fact our calendar shows less skin than the Sport Illustrated calendar does but we do not want to take the risk of having the funds in our account seized.

Being “in violation” of an acceptable use policy is very, very familiar territory for anyone who deals in sexuality-related content, whether the violation is objectively justified or not. That’s why it’s been fascinating for me to see the eruption of contempt at America’s government and their corporate and foreign friends for so blithely attempting to wipe Wikileaks off the face of the ‘net. Independent pornographer Furry Girl expressed similar feelings on her Twitter account:

It’s interesting to see WikiLeaks get a taste of what we fringe pornographers have been choking on for years. Companies are the real censors

Example: menstruation porn might not be illegal, but if you can’t find anyone to host it, link to it, or bill for it, it might as well be.

When Wikileaks was unceremoniously ousted from Amazon’s servers, Amazon said it was because their material could “injure others,” despite even Pentagon officials’ admissions that no one was harmed by Wikileaks’ actions. If others’ paranoia over the potential danger of your content doesn’t sound familiar to you, it’s because you don’t talk about sex loudly enough. And not even transgressive sex, necessarily, just good ol’ fashioned heternormative sex.

The Internet has become a virtual city where sexuality-related content is segregated, complete with its own safe-housing projects. Facebook is so hostile to sexuality—they banned web celeb’s Violet Blue’s “Our Porn, Ourselves” page—that entire networks of social networks supporting sexuality have sprouted, but are often disconnected from the rest of the web (like the un-Googleable FetLife). And yet, in a cheer-worthy move, Facebook says they won’t ban Wikileaks’ page. Is this because Wikileaks is a media entity? I don’t think so.

I think it is because it is safer for Facebook to side with Wikileaks than it is to side with TOS-abiding sexually vocal users. As Violet Blue said at this year’s Gnomedex, “If you want to see where [a system] is the most vulnerable…make the conversation about sex.” Violet has also had run-ins with Flickr, but she has the privilege of web celebrity. How many other less privileged than her have faced similar online censorship woes that we do not hear about?

Did you really think Internet censorship couldn’t—didn’t—happen in the Western so-called liberal democracies? In many of these countries, legislatures have been trying to ban content from the Internet for years under various guises: “combating copyright infringement,” “defending national security,” “eradicating child pornography.” These causes are routinely misused and abused to support a pro-censorship agenda, I say as someone who would support legitimate efforts to do all of those things.

While I’m thrilled to see swarms of people suddenly cry out against Internet censorship, it also makes me want to scream. Where has your voice been all these years? It was 1996—nineteen-ninety-fucking-six!—when John Perry Barlow railed against American legislation of the time, the Telecommunications Reform Act, whose Title V euphemistically nicknamed the “Communications Decency Act” had chilling effects on free speech online.

And although you may be reading these words at my blog, you wouldn’t be able to do so today if you were at the public libraries in Providence, Rhode Island, or Austin, Texas, where this blog is censored even on computers specifically reserved for use by adults. Internet filtering at public libraries is actually mandated by a 2003 law known as the Children’s Internet Protection Act despite numerous reports, including this one by the United States Government, saying Internet filtering is actually bad for kids and their education. Such misguided attempts at “protection,” I said in a speech at KinkForAll Washington DC, result in a sexuality information deficit that causes terrible emotional damage to the very youth they claim to be protecting.

Perhaps, in the government’s mind and the mind of other pro-censorship groups, Julian Assange is to “terrorist” what a sex and relationship educator is to “pedophile.” Indeed, I have suffered that label on numerous occasions for saying things such as this in University venues.

The Wikileaks story is important, but far more important is the way it has galvanized long-overdue and uncompromising support for free speech more generally. Even many of Wikileaks’ detractors are now fervently fighting for it to stay alive and online. Open source software advocate Simon Phipps, who has “great misgivings” about and is “not a massive fan of Wikileaks,” nevertheless finds himself defending them, in his words, “Not because I agree with them, but because the misguided attempts to plaster over the fault-lines they stress and expose will inhibit or remove the freedoms upon which internet freedoms – of innovation, of expression, for software and more – all fundamentally depend.”

What Phipps identifies in Wikileaks is the technological equivalent of what sexual speech is to culture: it stresses the fault-lines and exposes innovation, alternative expressions, and far more. To use feminist professor Constance Penley’s words, “Isn’t porn [and sexually explicit expression] supposed to offend? Doesn’t it have a lot of its challenge to sexual and moral taboos and also isn’t it supposed to use lewdness and lewd humor to challenge political authority?” Further, as Penley also points out:

With every technological advance we have seen a greater democratization of culture generally, but certainly sexually explicit expression. […] And that’s the great fear represented by the Internet. It’s just the most recent wave of hysteria that’s around the democratization of sexually explicit expression.

Thanks to Wikileaks, it is now clear to far more people that freedom of speech is under attack. But what’s lacking in the media narrative, and even the blogosphere’s narrative, is that this is a war free speech, and especially sexual freedom, activists have been fighting online for a long, long time. It is long past due for everyone who cares about their own freedom to recognize that being protected from offense or disgust will only enslave you to people in power who spoon-feed you “comfort” and “security” while denying your basic human rights.

Moreover, Wikileaks itself has shown this to be true. In a 2008 press release, Wikileaks announced it was publishing the list of over 3,800 websites “voluntarily” censored by Danish ISPs that allegedly contain “child pornography,” according to police. “Unaccountability is intrinsic to such a secret censorship system,” the press release said, noting that many of the sites had since switched owners, moved entirely, or were even wrongly added to the list in the first place. And, as the press release argued, the effects are more insidious than unaccountability:

The list has been leaked because [similar] cases such as Thailand and Finland demonstrate that once a secret censorship system is established for pornographic content the same system can rapidly expand to cover other material, including political material, at the worst possible moment — when government needs reform.

Two days ago Wikileaks released the secret Internet censorship list for Thailand. Of the 1,203 sites censored this year, all have the internally noted reason of “lese majeste” — criticizing the Royal family. Like Denmark, the Thai censorship system was originally promoted as a mechanism to prevent the flow of child pornography.

In Australia, Julian Assange’s home country, the same cyber-firefight over a government-mandated Internet blacklist has waged for years, with the government’s line being a protection from child porn. In America, new Internet censorship legislation spearheaded by the entertainment industry (COICA) is currently making its way through the Senate, and while sexuality has not been used as a weapon in that instance, mark my words, it will before the fight is over. In England, Section 63 of the Criminal Justice and Immigration Act outlaws the “possession of an extreme pornographic image,” which is defined so vaguely as to mean whatever the State finds objectionable it has actually prompted legal scholars to suggest that “there are many books it would be safer to mutilate—or destroy altogether” than be caught owning.

Again, no civil individual argues in favor of child pornography, so propaganda asserting its prevalence is used as a rouse to whip an ignorant and frightened populace to demand that “something must be done” when perhaps nothing does. The over-the-top fear-mongering kills sexual speech like a “pervy poison pill” kills good bills. And when sexual speech is attacked, so is the basic human right to enjoy freedom of sexual self-expression.

Recently, amid a fury of controversial remarks about religion, British writer Hari Kunzru said, “I believe that the right to freedom of speech trumps any right to protection from offense…. Without freedom of speech, we, as writers, can have very little impact on culture.” Since publishers of sexual speech are in the vanguard of anti-censorship efforts, we are also almost always the first casualties of attacks on freedom of speech, and we suffer in many more smaller ways long before something like Wikileaks suffers in larger ways.

Larger injustices are enabled, step-by-step, by neglecting to fight smaller injustices. If the media had not done such a piss-poor job of creating actual accountability and transparency in our civic institutions and our corporations, Wikileaks would not be necessary, and the media may not have done such a piss-poor job if the same number of citizens would have fought smaller injustices nearer to them as we are doing to fight this larger one relatively further away. This is a point Dan Gillmor hinted at all-too-subtly when writing about Wikileaks this week:

No, Amazon is not bound [to host Wikileaks] by the First Amendment. But if it’s bowing to government pressure, it’s helping a panicked government tear up one of our most basic freedoms. […]

And, no, the government’s campaign is not fully working. Internet “mirror” sites are springing up to host WikiLeaks’ material faster than governments can take them down. But WikiLeaks is the beneficiary, in this respect, of a wide swath of support from people who will make it part of their life’s mission to help prevent this particular instance of censorship from succeeding. How ready or able will they be to defend free speech every time it’s threatened in the future?

Indeed, free speech is threatened every day, but a paltry few defend it when it is sexual in nature as voraciously as we are defending Wikileaks today. Could Amazon’s defense of, then rejection of “the pedophile book” from its virtual shelves have been an indication of their future stance on Wikileaks? There are countless publishers, either individuals like my friends and I, or independent groups, not newspapers or academic journals, but zines or other cultural artifacts whose works are routinely threatened or obstructed merely for their sexual content, even though we also loudly condemned “the pedophile book” and any non-consensual sex, especially of that nature. But if you want to support free speech, you need to support the free expression of sex, too; “I disapprove of what you say, but I will defend to the death your right to say it.”

So sex has everything to do with the First World Infowar. It has been on the front lines all along—and it always will be. Those involved in anti-censorship efforts and the circumvention community need to be talking to sex bloggers a lot more than I suspect they are (Chinese women are a great, long-standing example of why), and free and open-source software advocates need to make space for sexuality researchers, thinkers, and publishers to more openly join their ranks (as the debate over Diaspora’s gender text-field instead of drop-down menu makes clear). Unless that happens, Barlow’s 1996 declaration that, “In our world, all the sentiments and expressions of humanity, from the debasing to the angelic, are parts of a seamless whole, the global conversation of bits,” will not be fully or justly realized.

As of this writing, there are more synchronized mirrors of the Wikileaks website than there are released Cablegate cables. Censorship is losing this battle. The only remaining question is whether censorship will lose the war.