PROMOTING NETWORK CIVILITY AT MIT Crime & Punishment, or the Golden Rule? GREGORY A JACKSON DIRECTOR OF ACADEMIC COMPUTING MIT INFORMATION SYSTEMS _________________________________________________________________ Is there a computer cluster somewhere where someone can be safe from pornography and harassment? I'm sick of this. _________________________________________________________________ There was more to the story, of course, although this is the only direct communication I received from Judy Hamilton (not her real name, of course). Judy went into an Athena cluster and sat down next to a male student. His screen was displaying a graphic image of a sexual act. Judy asked the student to remove the image, since it was interfering with her ability to work comfortably. and contentiously. After a shouting match, Judy, feeling intimidated, left to find someplace else to work. She complained to friends, and to MIT's Ombudswoman. The Ombudswoman sent her to me. On its face this case involves a conflict between rights: Judy has a right to use facilities without interference, the male student has a right to display whatever images he wishes, and both cannot exercise their rights without conflict. The conflict arises, in part, because personal computers in a public cluster are an oxymoron - the user doesn't know whether to treat them as shared or private. When different users answer the question differently, conflict ensues. One approach to problems of this sort, typical of college and university disciplinary mechanisms, involves judgments and sanctions. The judgment-and-sanctions approach takes a long time, entails standards of evidence, and requires answers to difficult questions. Most people I have told about Judy Hamilton say that she should win, that her rights outweigh the male student's because the incident involved public facilities and her goal was learning whereas his was titillation. But what, for example, if the display had been on a more personal computer, say a laptop? What if the context had been a cafeteria, rather than an academic facility? What if the image had been a swastika, rather than a sexual image? What if the screen had displayed an anti-Semitic quotation from the published writings of Harvard's President Lowell (once an MIT faculty member) in large type? In small type? What if had been a Rubens painting? What if had been a fraternity's name? What if there were other workstations available, from which the male student's display could not be seen? A judgment-and-sanctions approach revisits the problem for each variation. It creates a stream of acrimonious, difficult-to-decide cases, consigning policy evolution, social learning, and ethical progress to the indefinite future. And it leaves administrators without an efficient, commonsensical response to complaints like Judy's. A different approach to problems of this sort frames the issues not in terms of competing rights, but rather in terms of balancing interests. Judy and the male student both have an interest in continuing availability of public facilities, whose existence depends on a social contract to respect each other as citizens sharing limited common resources. Each has a right to do things that might offend others. Yet it is in each of their interests not to exercise that right at all times, lest their competition jeopardize their common interests by causing administrators to restrict or eliminate public facilities. From an interests perspective this problem requires an approach that helps each citizen to consider the interests of others. A judgment-and-sanctions approach might serve this end, especially if it involved the equivalent of public hangings. But we believe there are more efficient approaches focused on averting and changing inappropriate behavior rather than punishing it. I will return to this point, but only after another case. _________________________________________________________________ My concern is about one M Zareny, who is using his computer account to post UseNet articles in rec.arts.books and to send messages with extremely derogatory claims about gay men. Normally I would be most solidly against censorship, but if similar remarks about the immorality of Jews or Blacks were made, they would probably be illegal. I have tried at great length to reason with MZ, but his prejudices seem to be beyond reason. He was previously using an account elsewhere before he moved to MIT. As an alumnus, I am disappointed to see Zareny's trash emanating from alma mater. I also think that if the hate laws covered gender orientation, he would be in violation of the law. Could you please respond to my plea? As I said, I am very uncomfortable with censorship of any form, but MZ has been going on for more than three years now, and his views are quite beyond rational comment. I have suggested that we take the debate to philosophical journals instead of the Internet (he suggested the same thing, but shows no signs of doing so, despite my having published papers on issues underlying the topic), since there are some established standards there. He has made unsubstantiated remarks about my character and relations with my students, that if I were in the US I might consider taking legal action over. _________________________________________________________________ An easy one, it seemed: find Mr Zareny (again, not his real name), let him know that continuing to post offensive messages after being asked to desist might constitute harassment, and warn him that legal action could result. But do public postings of this sort constitute harassment, and are they legally actionable? The second question is murky, and I will duck it for the moment, but the first depends on an institution's harassment policy. MIT's policy reads as follows: Harassment is any conduct, verbal or physical, on or off campus, which has the intent or effect of unreasonably interfering with an individual's or group's educational or work performance at MIT or which creates an intimidating, hostile or offensive educational, work or living environment. In practice we apply three tests to determine whether given behavior constitutes harassment. We post these questions for all to see on large posters in all computer clusters: Is it harassment? Ask yourself these three questions: * Did the incident cause stress that affected your ability, or the ability of others, to work or study? * Was it unwelcome behavior? * Would a reasonable person of your gender/race/religion subjected to this behavior find it unacceptable? Is Mr. Zareny's behavior harassment? On its face, no - at least based on the data in the complaint. It may satisfy the third test, depending how closely one defines the reference community. But the alumnus did not contend that his ability to work was being affected. Moreover, if Zareny's postings are typical of those in this UseNet group (and a quick review of rec.arts.books suggests they are), the alumnus might in effect have invited exposure to the postings by participating in the newsgroup. The policy basis for telling Mr. Zareny to stop is tenuous, and the legal threat even more so. As Nero Wolfe might say, this is unsatisfactory: Mr. Zareny's behavior clearly is unproductive. It falls short of the standard we would like MIT students to reach. So we should communicate with him, and let him know that flaming postings are unlikely to win him friends. A problem arises: how do we know that Mr. Zareny is in fact making these postings, and not someone forging his name? Signatures on UseNet postings are among the most forgeable items on the Internet, and so the phrasing of admonitions requires some care. As we pursued this point the case grew interesting: there was no "M Zareny" at MIT, and none of the usernames in the postings was registered centrally with us. We discovered that Zareny's postings had come from a private (although MIT-owned) workstation with a private user list, and that the workstation's previous user had given Mr. Zareny, apparently a friend, a local account and remote access to the machine so he could connect to it by telephone. So the postings were coming from an unknown individual outside the MIT community, but through an unofficial account granted some time in the past on a "private" but MIT-owned workstation by someone since departed. By an extraordinary coincidence (finding his thesis in an online catalog), I discovered that Mr. Zareny was in fact a graduate student at a neighboring university. The Zareny case, apparently about harassment, thus turns out to be as much about venue and responsibility. The Internet's accessibility, lack of authentication standards, and context-bound rules of discourse produce a jurisdictional and evidentiary morass: an alumnus in Australia complains to us about comments posted in a world-wide newsgroup from an MIT computer by an individual with an MIT electronic-mail address but who apparently is enrolled at another university. The comments are offensive to the recipient, but typical of the comments in the newsgroup - in which participation is fully voluntary. Who has standing to complain to whom, and who has standing to take action? Whose definition of harassment and/or improper use should govern - that of MIT, or the other perpetrator's university? The victim or the newsgroup? US or Australian law? Whose standard of evidence applies? Of course we shut off Mr. Zareny's unofficial account - we are perfectly comfortable doing this without any warning or process whatsoever, since it was unauthorized - but should we do more? The cases have some common threads: traditional judicial approaches are either infeasible or inefficient, framing the issue in terms of rights leads to conflict, jurisdiction can be messy, and therefore the central need is for members of electronic communities to appreciate their common interests in rules for behavior and use. Within the academic-computing and Athena side of Information Systems we first approached computer and network misbehavior idiosyncratically. Students cleaned screens for some offenses, lost their computer privileges for others, and underwent disciplinary proceedings for others. As academic computing become more central to education at MIT, these ad hoc and local approaches became too diffuse and unmanageable. Moreover, they often triggered acrimonious exchanges with perpetrators rather than productive behavior changes. And we became increasingly uncomfortable with our confounded roles as rulemakers, detectives, prosecutors, judges, and corrections officers. We discussed this problem among ourselves, and with individuals from the offices of the Provost, the Dean for Student Affairs, and the Ombudsman. Out of these discussions grew a recognition that averting and stopping antisocial and unethical behavior was sometimes more important than punishing offenders. And out of this recognition grew a simple set of mechanisms designed to stop harassment and improper use quickly, while keeping options for more traditional sanctions open. The stopit mechanisms, as they came to be known, were based on a simple proposition: Most offenders, given the opportunity to stop uncivil behavior without having to admit guilt, will do so. The stopit mechanisms thus were designed to do two things: to discover computer misbehavior rapidly, and to communicate effectively with its perpetrators. The overarching goal is just what the name suggests: to stop it. The first stopit mechanism is the poster I described above. The poster is displayed prominently in all Athena clusters. Facsimiles appear in printed and online documents. The primary goals of the poster are two: to encourage victims who feel they are in danger to call Campus Police immediately, and to provide a clear "if you can't figure out what to do" path to us. The second stopit mechanism is that path: the mailing address. Messages sent to go to the senior directors in MIT Information Systems involved with academic computing, who then make sure that users receive responses and that appropriate actions ensue. Responses to stopit messages are generally very quick, especially when the offense is great, since the stopits (as the Director-respondents are known) frequently check their mail. In many cases the response to a stopit complaint is a standard response from a specific office: for example, chain-letter and forged-mail complaints go directly to the network Postmaster, who takes standard actions (which range from admonitions to personal meetings depending on the incident). The advantage is, users need not worry about who should receive their complaints. They simply write to . As stopit precedents have accumulated, so have standard responses to typical offenses. Moreover, field staff have become better attuned to standard responses, and often are able to handle complaints completely on the spot. This was very difficult before stopit gathered enough data to develop, test, and implement response policies. Standard responses and field-staff skills gradually have reduced the senior administrative overhead associated with stopit. The third stopit mechanism is a carefully-structured standard note to alleged perpetrators of harassment, improper use, or other uncivil behavior. "Someone using your account," the note begins, "did [whatever the offense is]." The u.y.a. note (as this mechanism is known, for its introductory words) then explains why this behavior or action is offensive, or violates MIT harassment policy, or Rules of Use, or whatever. "Account holders are responsible for the use of their accounts. If you were unaware that your account was being used in this way," the note continues, "it may have been compromised. User Accounts can help you change your password and re-secure your account." Detailed directions to User Accounts follow. The note concludes with a short sentence: "If you were aware that your account was being used to [whatever it was], then please make sure that this does not happen again." Two interesting outcomes ensue. First, many recipients of u.y.a. notes go to User Accounts, say their accounts have been compromised, and change their passwords - even when we know, from eyewitnesses or other evidence, that they personally were the offenders. Second, and most important, u.y.a. recipients virtually never repeat the offending behavior. This is important: even though recipients concede no guilt, and receive no punishment, they stop. If we had to choose one lesson from our experience with misbehavior on the MIT network, it is how effective and efficient u.y.a. letters are. They have drastically reduced the number of confrontational debates between us and perpetrators, while at the same time reducing the recurrence of misbehavior. When we accuse perpetrators directly, they often assert that their misbehavior was within their rights (which may well be true). They then repeat the misbehavior to make their point and challenge our authority. When we let them save face by pretending (if only to themselves) that they did not do what they did, they tend to become more responsible citizens with their pride intact. We lose the satisfaction of seeing perpetrators punished, but we reduce misbehavior and gain educational effectiveness. Sometimes, especially where certain kinds of improper use such as reconfiguring machines or using restricted facilities are involved (there have been virtually no harassment recidivists), perpetrators perpetrate again. Or they respond to the u.y.a. letter by contesting the policy in question. In these cases the fourth stopit mechanism comes into play: the individual is invited to discuss the matter with a senior Information Systems administrator. If the individual declines this invitation, it becomes more forceful: in some cases the user's account is temporarily frozen until her or she appears (but this only happens with a Director's approval). In extreme cases, or if discussion fails to deter future misbehavior, the fifth stopit mechanism comes into play: the Institute's regular disciplinary procedures. In contrast to our earlier practice, MIT Information Systems neither takes private action nor imposes internal punishments (such as denying accounts, or having offenders clean screens) outside of regular procedures. Instead, Information Systems files complaints on behalf of itself or of victims (with their consent), and then lets the MIT Committee on Discipline (or whatever organization is responsible) judge the case and impose penalties. CRIME & PUNISHMENT, OR THE GOLDEN RULE? Our answer is simple: the Golden Rule. Attempting to reduce uncivil behavior on the academic network by defining "crimes" and punishing "criminals" solves only part of the problem, at the same time prompting enough debate, backtalk, and defiance of authority to wipe out any gains. Attempting to reduce uncivil behavior by promoting respect for others sharing resources, and especially by permitting community members to change their behavior without admitting guilt, seems to achieve our central goal: maximizing educational efficiency by reducing the social and ethical costs of intensive academic networking. But attaining our goal requires one further step, which we have yet to take effectively at MIT. Rather than educate students about civil use of shared academic-computing facilities only when they misbehave, we must find ways to educate students at the outset. Currently we provide materials on proper use when students open accounts, and our introductory training sessions emphasize the theme, but neither of these traditional approaches seems to have much effect. Occasionally we work more intensively with specific groups, such as our own user consultants-in-training, and here we have found that discussion of real cases works very well. Fundamentally, what we need is two things: for students to understand their basic social and ethical obligations as members of a community, and for them to understand the implications of these obligations when they use computers and networks. Promoting civility on the academic network requires moving our goal beyond adjudication to behavioral change and our tactics beyond accusation to redirection. Having achieved these two transitions, we need to move from remedial to preventive strategies if we are to realize the full potential of networked academic communities. Last modified 10/12/94 gaj