A Nation of Accidents

This week, I published a piece with my friends at Teachers Going Gradeless. It’s about my old nemesis the College Board and their gatekeeping function in university admissions. In researching the piece, I learned a bit about the organization’s founding. The College Board’s role as a third party between high school students and universities is not something that anyone in government or in states necessarily planned; it just ended up that way. Like so much of the dumb stuff we do in the US, policymakers couldn’t be bothered to actually make policy. It fits a pattern that I’ve been thinking about recently. Due largely to the dysfunctional nature of Congress in policymaking and the decentralized nature of the US’ system of federalism, much of our most important national practices are really accidents of history:

Why are Iowa and New Hampshire the first caucus and primary? 

Why do we vote on Tuesdays rather than weekends? 

Why are there nine judges on the SCOTUS? 

Why do we treat dental care as something separate or distinct from health care? 

Why are 401ks the primary vehicle for retirement saving? 

Why are interest rates on student loans so damn high? 

There was never a meaningful national debate about any of these—we just ended up like this and we all live with the consequences because of inertia and the inability of our leaders to imagine alternatives.

In the piece, I looked at one of these accidents, the system of employer based health coverage in the US. We’re basically the only country that does this and if you think about it for more than thirty seconds you’ll see why no one chose to follow our lead. For the unfamiliar, here’s where the system came from (from the TG2 article):

It’s an unintended consequence of domestic policy in World War II. During the war, the federal government imposed wage controls which made it difficult for employers to attract workers by offering higher salaries. To compete, many companies began offering health insurance as a benefit. This became more popular in the post-war period as labor unions began negotiating health benefits as part of collective bargaining agreements. 

We stumbled into a system that is inefficient, keeps potential entrepreneurs stuck in jobs they hate to maintain their benefits, and makes life nearly impossible for small business owners. This was never the plan, it just happened but a bunch of politicians treat the model like some immutable sacrement handed down by Hamilton & Madison. It is not. It’s only been with us as long as air conditioning. Tangentially, understanding the employer health care schemes helps us understand why some unions have opposed a national healthcare system like Sen. Sanders’ Medicare for All. 

Another example of this is the state of cannabis laws. We first visited Thailand in 2018 and can see a shift. In 2022, the Thai government legalized marijuana and dispensaries have popped up in major cities, increasing Thailand’s already powerful tourist draw. The government thought legalization was the best policy, they created legislation to enact said policy, said policy was put in place—that’s how governance is supposed to work. Compare that to the sloppy patchwork in the US. Weed is legal in Washington State. It is sold, consumed, and taxed. Meanwhile in neighboring (and deeply inferior) Idaho:

 “Possession of three ounces or less of marijuana is a misdemeanor punishable by up to one year imprisonment and/or a fine up to $1,000. If the quantity possessed is more than three ounces but less than one pound, it is a felony punishable by up to five years imprisonment and/or a fine up to $10,000.”

But in both states, it’s illegal under federal law and at any time the feds could bust in the door of every dope shop in Washington, sending everyone working and shopping to prison. The feds choose not to do so because they know the drug laws are idiodic but they can’t be bothered to remove them. Meanwhile, roughly a quarter million mostly poor Black and Brown people are locked up every year for marijuana possessions largely in Southern States [Texas (of course), Tennessee, and North Carolina lead the pack].

If you think about any of this for more than a moment, you’d see red. But most of us don’t think about it at all. 

One of the gifts of teaching young people political science is that they aren’t burdened down with the weight of lived experience. They violently question or openly reject things that we take for granted because “it’s always been that way.” When I explain the extent to which the entire system is made up of historical accidents and held together by norms rather than laws, they give me the most dumbfounded and “WTFAYTATDMNS*” faces. I love them for that. They aren’t jaded or beaten down by the stupidity of it all like we all are. That’s why they’re our best hope.

*WTFAYTATDMNS: What the f*** are you talking about? That don’t make no sense!

Beloved, Use a Password Locker but Make Sure it's Not LastPass

In a recent newsletter, I wrote about online security and password lockers. Password lockers allow you to create longer, randomized passwords that are more secure than whatever you’re likely to come up with and memorize. The locker then stores them in an encrypted file on your device. 

I spent most of Wednesday evening going through the annoying but important process of migrating my passwords off one of those lockers, LastPass. It’s a long story but I think it’s one worth sharing with you.

I started using LastPass in 2016. The service had its ups & downs. At one point, I paid for the premium version but they moved to a pricier monthly sub model and I slid back down to the free tier. The company provides an important service, but they’ve had an extremely rough run of things as of late that I think is worth detailing.

On August 25, 2022 LastPass detected "unauthorized" access to their servers. In their press statement about the incident, they buried this bit of terrible news in paragraph five:

“The threat actor was also able to copy a backup of customer vault data from the encrypted storage container which is stored in a proprietary binary format that contains both unencrypted data, such as website URLs, as well as fully-encrypted sensitive fields such as website usernames and passwords, secure notes, and form-filled data.

I am far from an expert in this area—that seems bad though. But it was really just the beginning. They followed that up with an announcement on September 15 about a subsequent breach that read roughly “Yeah, we were breached but your data and passwords are safe. Trust us.”

Then on November 30, they released a statement saying, “we have determined that an unauthorized party, using information obtained in the August 2022 incident, was able to gain access to certain elements of our customers’ information… We are working diligently to understand the scope of the incident and identify what specific information has been accessed.” 

This was followed by two other company statements encouraging customers to “stay vigilant” and follow “security best practices,” advice the company clearly should have been taking themselves. 

In January, the wheels started falling off the wagon as the company started to drip, drip more news about the access hackers were able to get.

On January 3, a John Doe filed a class action lawsuit on behalf of LastPass users over “failure to exercise reasonable care in securing and safeguarding highly sensitive consumer data in connection with a massive, months-long data breach.” This is when it finally hit me. They hadn’t been breached in August as an isolated incident. The hackers had ongoing access to LastPass’ servers for months. 

On January 23, LastPass admitted, “we also have evidence that a threat actor exfiltrated an encryption key for a portion of the encrypted backups.” Also on January 23, they reported, “the threat actor then exported the native corporate vault entries and content of shared folders, which contained encrypted secure notes with access and decryption keys needed to access the AWS S3 LastPass production backups.”

Again, I’m no expert in cyber security but you don’t have to be one to see where this is going. Hackers attacked LastPass and the company’s security infrastructure utterly failed. This is when I started exploring alternatives and talking about the issue on the Channel 253 Member Slack.

Then on March 10, Matthew Gault from Vice posted an episode of their Cyber podcast titled LastPass Isn’t Safe and Your Hiking App May be Tracking You. In that episode, Gault quoted Joseph Cox who summarized the situation succinctly:

“​​The hacker against LastPass was resourceful and persistent, but also that LastPass was not treating its own crown jewels with the serious security practices it should have. A LastPass engineer was accessing critical services from their home computer and network. LastPass had difficulty distinguishing between the activity of the worker and that of the hacker. The sensitive information—in this case, customers’ password vaults that need the user’s master password to decrypt, but could theoretically be brute forced at some point—were stored less in a bank vault and more in a closet.”

That was the last straw for me. The situation is clear: responsible internet users that have concerns about their security and privacy should use randomized passwords and password lockers but those lockers should absolutely not be on LastPass. They simply can't be trusted. 

This week I deleted my locker on LastPass and moved to a different service provider. In doing so, I changed my master password and will slowly change my passwords on essential services like banking and investment apps. This is a time suck for sure, but it sucks way less than finding my accounts drained or my zombie Twitter account got hacked and is promoting some crappy NFT project.

The Already Forgotten War

I am not the first member of my family to spend time in the Gulf. 

In 1991, when I was in seventh grade, my mom’s Army Reserve Unit, the 50th General Hospital, was activated for the first time since the Normandy landing. She was deployed to Saudi Arabia as a part of Operation Desert Shield to provide medical care in support of what would become the first of two US military invasions of Iraq. 

Military service is a tradition in my family. My father was a Warrant Officer in the Army and this was his route to the PNW. My brother was in the Army. My uncle was an Airmen, my step-father was drafted into the Army and wounded in the Vietnam War. I split the difference between my uncle and my mother and I enlisted in the US Air Force Reserves after high school. It felt like what I was supposed to do and I figured it would help pay for college. I enjoyed my time in the military. It gave me my first taste of travel—much of it in Texas.

But by mid-2002 the terrain changed. I publicly opposed the impending war in Iraq and my commentary about the war made for awkward situations during the waning days of my enlistment. I remember reading Norman Soloman’s Target Iraq and trying to explain the ways public opinion was being shaped in support of the war. I remember reading a PDF copy of Chomsky’s What Uncle Sam Really Wants and giving people highlighted copies of excerpts of the text. In 2003, I decided not to reenlist. I had become more a “college kid” than an “Airman”—those two aspects of my life having been at tension for years.

As the war went on, I remember being enraged listening to pols & pundits say “no one knew…” or “who could have foreseen…” as body counts soared and the nation soured on the war. It’s odd how clear those memories from twenty years ago are in my head because it seems like we’ve collectively forgotten about the Iraq War. 

The Iraq invasion was based on false premises from the jump.  The war was catastrophic, costing the lives of hundreds of thousands of Iraqis, wasting an estimated 2.4 trillion USD ($2,400,000,000,000) dollars of taxpayer money, and destabilizing much of the region. The war undermined American legitimacy in the region. It created a power vacuum that allowed extremist groups like ISIS to rise and allowed Iran to make the new government in Iraq another of its client states. The war inspired the largest protests in human history, damaging America's reputation and credibility with its allies. 

The Iraq invasion was a disastrous decision, a bipartisan blunder that passed  77-23 in the US Senate. All but the Ron Paul brand of Republicans were champions of the war and nearly 60% of Congressional Democrats supported it. My own Senator Maria Cantwell voted for it; 2016 Democratic Nominee, Hillary Clinton voted for it; Joe Biden voted for it, calling it “not a rush to war but a march to peace and stability.” But no one in the US political establishment ever faced any consequences for this failure. The cost was paid by the people of Iraq and the 7,000 US servicemembers and military contractors who died in the conflict. 

For my older students, the invasion is like Watergate is for people my age: a formative event with lasting repercussions that happened before I was born, like a memory belonging to someone else.

The Iraq War was the moment I learned America is allergic to holding people in power accountable. We saw this again during the 2008 crisis, poor Covid pandemic management, and are seeing it again with the current bank liquidity crisis. This allergy is arguably the defining characteristic of America’s political culture.