Thursday, February 28, 2019

The Truth Behind Momo - A Cybersecurity Expert Calls for Education

Preview of  the Upcoming Peppa Phone Phreaking Scandal

I wrote this article in collaboration with Pete Jacob, cybersecurity expert to some of the world’s top amusement parks, concerning the Momo hoax and what we can learn from it. 

Momo isn't real. YouTube videos were not "hacked." There's not much more to it, but let's explore, from a cybersecurity standpoint, why this is such an interesting phenomenon and why teaching the public about cybersecurity could have quashed the whole thing before it started.

Keisuke Aisawa didn't intend to incite mass panic when they designed a nightmarish "Mother Bird" sculpture.
Talents include: Hacking without having arms, Staring Contests
Rather, the sculpture references tormented spirits found in Chinese folklore. But the pictures were shared online and, like all good art, it inspired someone - they renamed the creature "Momo" and concocted a crazy story. 

Pirate Pitfalls

It was alleged that Momo was hacking into Peppa Pig content - inserting herself into videos of the friendly pig. A quick search of YouTube turns up thousands of Peppa Pig videos - only some of which are posted by an official, verified source. (Read more about Verified YouTube channels here) The verified channel (marked with a check mark) has some free videos, but also prominently features ads to buy digital editions of the series.

As a business, Peppa has no reason to give you the entirety of their content for free. Some official channels do offer free videos, but they're teasers - things to get you and your children interested in buying digital copies, subscriptions, and merchandise. Or they're monetized - they show ads throughout the video and receive money for your views. If a company is offering their copyrighted goods for free, consider the motives: Are you expected to become hooked on the good? Spread the word? Buy related merchandise? Is it a stunt to generate exposure and feelings of good will?

Note that only one of these videos comes from a verified channel - and the verified search result isn't always first.

I reached out to Peppa Pig and their parent company, Entertainment One, and asked for a link to the official Peppa Pig YouTube accounts to ensure that the "Peppa Pig - Official Channel" and the international equivalents are indeed the only sanctioned accounts. I have not received a response but will update as information becomes available. Unless Peppa tells me otherwise, I have to assume that all unverified accounts are illegally streaming copyrighted work. Peppa does not endorse this content and, because we have no idea what kind of people are posting these, we can't confirm that they aren't splicing weird stuff into the stolen videos (which, though unethical, isn't hacking - I'll explain why in a moment).

When you view pirated content on YouTube, or any platform, you are accepting the possibility that the video has been edited or tampered with in some way. Just as when your LimeWire download of Missy Elliot came with a side of virus, you should not be surprised when something garnered through criminal means contains something unsavory.

What would actually pulling off this Momo thing entail?

Editing two videos together is easy. Search the App Store and you'll find countless apps that promise the ability to merge multiple clips. Hacking, however, is not so simple. First, consider the time and effort someone would have to put into hacking a channel's account. It would require some degree of technical skill or social manipulation to gain access to a password. If passwords aren't easily attainable, we could force our way in. Websites have safeguards in place to hinder hackers from using brute force to access an account, yet it can be done - but think of the know-how required: years of technical experience, speed (Google eyes me with suspicion every time I sign in on a new device - you bet the original channel will be receiving an email concerning a
This is just some WordPress code, but that black background is really spooky.
troubling login), and precision. Once access to the account has been gained, you'd have to upload a video that has either been ripped from a legitimate Peppa Pig source or torrented (this is starting to sound like more trouble than it's worth) edited (more technical skill!) to include a clip of Momo, a figure we've only ever seen still pictures of, talking (so, now we need some artistic skill to make the voice-over convincing). Then we need to make sure all of our hard work will be viewed, so we need to know a little about marketing and SEO. Then we must ensure that if our our painstakingly hacked video does get viewed, people share and talk about it, which might take months to come to fruition. Momo apparently engages children in a challenge, which implies even more videos and some degree of interactivity. All to what end? To scare a child? Where's the money in that?

If a hacker is able to exploit a website as lucrative as YouTube, they'll have bigger bounties on their mind than corrupted pig videos. (Or, maybe they're seeking a career in viral marketing). It's much more likely that if an original Momo video did exist, it was uploaded intentionally to generate profit, which isn't hacking at all.

NOTE: It’s important to mention that YouTube HAS been recently hacked, though not in this exact way. In April 2018, hackers were able to change the titles and descriptions of some of the most viewed videos on the site. However, in the interest of free information, the hackers quickly came forward to explain their tactics and motives. It’s also telling that video descriptions were changed to the political message: “Free Palenstine.”

The misuse of the term "hack" is alarmist - it preys on those uneducated in cybersecurity, breeding an atmosphere of misdirected distrust. There's a lot to be scared of on the internet - but this isn't it. By sending letters home with students, well-meaning but misinformed school officials are inciting panic. Think of how far some simple cybersecurity education could have gone in preventing this hoax from spreading. I hope that this serves as a case to educate others on security, but I fear that when Momo blows over, the public's senses will have become deadened to the word, and we'll have a "boy who cried 'hack' " scenario on our hands.

A spy for Big Peppa
Unfortunately, hoaxes such as these are self-fulfilling prophecies. Now that creators know that Momo is profitable, we will see conspiracy theorists obsessing over her origin, spurred on by fake videos created by other creators (or themselves). We will see "jump scare" videos featuring the birdlike creature. We will see staged and out-of-context videos of children crying. All in the name of clicks. Momo wasn't real, but she will be, if you let her. (Here's another curious Momo side effect: there are grown adults watching hours of innocuous Peppa Pig videos, hoping to spot Momo. Wouldn't it be interesting if this was all put on by Big Peppa lobbyists?)

EDIT: As of March 1, 2019, YouTube has announced that they have demonetized all videos related to the Momo hoax (meaning, it'll be harder to profit off of Momo).  This is a step in the right direction for the platform. However, it's unfortunate that informative, fact-based videos debunking the Momo scare have also been demonetized. Next hoax, will we see reluctance on behalf of fact-based bloggers? 

So what can I do?

Without a doubt, there are questionable videos on YouTube and other video sharing platforms. If you do notice something disturbing in a YouTube video geared toward children, be sure to report the channel directly to YouTube and, if you suspect wrongdoing, local authorities. YouTube takes such accusations very seriously and will review the content. Don't share the video on social media - this generates views, which on monetized channels results in paying the offending creator. Don't incentivize bad behavior.

If you're shaken by the Momo scare, it might be time to take a break from platforms that host user-generated content. If you can post to it, so can "they." Stick to tried and true apps such as PBS KIDS Video, Sesame Street, Netflix, and Hulu. While paying for streaming services can feel frustrating when there's all sorts of free stuff on YouTube, you'll be getting a carefully curated selection of videos for your children as opposed to the wild west of content available on YouTube.
Most importantly, use this as an opportunity to educate yourself about how the internet works. Look at your favorite websites and ask yourself: What motivates people to contribute here? What are the potential ways this platform could be abused? Research hacking and the people who do it. Learn about the many companies who work to stop cyber attacks. Use your findings to open up a dialog with your children about safe internet practices.  As an informed internet user, you'll be able to ignore the sensationalism and focus your energies on security topics of real concern.

Ask your school district if they offer internet safety programs for children, teachers, and parents. Encourage them to put one in place if they don't. And if they do, encourage participants to take it again in a year - things change rapidly in this field.

At this very moment, there's a team of people fending off attacks on the companies you work for and interact with. It's a demanding job with ever-evolving responsibilities. It's also immensely interesting and the people in those roles are passionate about education. Ask to speak to your company's cybersecurity analyst  - many of us would be thrilled to visit schools and libraries to help inform the next generation about real online threats. At the very least, we have tons of resources and stories to share.
Pete Jacob is the Cybersecurity Analyst for Cedar Fair Entertainment Company. Stephanie Sanders-Jacob is a writer, editor, and Pete's wife.

Tuesday, February 26, 2019

The Personality Brokers: The Strange History of Myers-Briggs and the Birth of Personality Testing by Merve Emre

I'm an INFJ. My husband is an INFJ. My best friend, who introduced me to my husband, is an INFJ. I have stopped a coworker in mid-conversation to accuse them of being an INFJ; I was right. I knew I'd be right because I liked them and trusted them innately. I felt that weird familiar spark - the blink of recognition that, through lenses made thick by too much introspection and intuition, morphs into something bigger, something more akin to predestination. The feeling of seeing yourself not only reflected, but completely understood and welcomed in someone else. It's kind of like immortality. It's kind of like coming home. I have never met an INFJ I didn't love immediately. So... there's got to be something to this Myers-Briggs Type Indicator (MBTI) stuff... Right?

Merve Emre tells the strange history of the Myers-Briggs Type Indicator - a personality test that aims to categorize people into one of 16 distinct types, each represented by a convenient four-letter acronym. Used by schools, businesses, counselors, and soul searchers alike, it has become the preeminent personality test (MBTI prefers to call it an "instrument") on the market. At $50 to take the assessment online and with coach certification classes costing upwards of $2200, the MBTI is big business. Yet, despite its success and my own personal fascination with type and personality, I've never thought to research the test's origins. I guess I assumed I knew them: two immensely educated old men, PhD types (Myers with a mustache, Briggs with military hair), smoking pipes together in a dimly-lit study, expounding forth on Jung and the self, drafting this assessment with the help of a young secretary, maybe, if she's allowed in the room... I am so thankful Emre put me straight - I had it entirely, completely wrong.

Born of a mother's obsessive, spiritual dreams and her daughter's quest to be more than a housewife, the MBTI began as something more than a corporate tool. It was Katherine Briggs' way of grieving her dead children, of grasping at relevancy when her daughter went away to college and her articles on formulaic, laboratory-based child-rearing were considered archaic and cruel. It was a mother
Briggs & Myers
coming to peace with herself when her mind began to slip. It was her daughter's way of  memorializing a mother who, though often misguided, held a bit of genius, of reclaiming a life spent as someone else's project. It was truly about knowing oneself, about maximizing one's potential. It was intended to be a tool to empower and liberate in both relationships and the workforce - a psychological test free of "wrong" answers and diagnoses. And if they made a few bucks on the side, all the better.

Merve Emre is a fantastic writer, but I couldn't always understand her stance on MBTI. Emre begins the book with a somewhat cynical introduction in which she recounts a bad experience with the CAPT, the owners of the MBTI, and a certification coach. She sets the MBTI up to sound like a highly propagandized tool for sure destruction of the individual - who wants to be narrowed down in that way, anyway? She scolds herself for subconsciously pinning her toddler as an "extrovert" and emphasizes that the women behind the original test didn't have any scientific training at all. Despite having found comfort in identifying myself as a specific type, I would not have been opposed to a piece pointing out the flaws in MBTI. But I couldn't help but feel like Emre softened as the book went on, becoming hypnotized by the dream-like world Katherine Briggs created. In the end, Emre concedes that finding out one's type might be helpful to some, but continues to goad and bully her peers in her certification class (she calls them "true believers," a term that feels a little mean [or maybe I just feel that because I just read Under the Banner of Heaven, which also had "true believers," albeit they were murderous religious zealots]). I was truly taken aback that she behaved this way, even if it was for the sake of experimentation. While I think it's misguided, MBTI is a religion to some, and Emre was walking into their place of worship to raise hell. I guess what I'm trying to say is, if she truly despises type, I want to hear about that. But I don't think she does - there must be something there, to delve so deep into this bizarre, romantic history. Her criticisms felt overly defensive and mean - just as unscientific as she claims MBTI to be.

At one point, Emre describes how the government used the test during WWII. They asked a personality scientist to use type in order to create some possible scenarios for the end of the war. He came up with a few outcomes: Hitler is captured alive, is made into a fool; Hitler throws himself off of a balcony in front of the public; Hitler shoots himself theatrically with a golden bullet; etc. The scientist even recommended that the US distribute propaganda advising the Nazis that their leader was going to kill himself and leave them high and dry. But, Emre insists that the doctor was completely wrong - The bullet wasn't golden. Type has failed. I felt some selective blindness was at play here.

There's a lot to dislike about MBTI: Isabelle and Katherine were racist and sexist. They were not licensed psychologists but often acted as such (there's one case in which Katherine takes on a young girl to "fix" and ends up hopelessly entwined with her, ruining the girl's relationship with her family, but even here, there's magic - prophetic shared dreams, poetry, a sense of destiny between them). Both women are extremely stubborn. They used unscientific test results to consult businesses in hiring and firing strangers. In the interest of money and immortality, they sold the test off to a publisher who profits off of corporations typing and categorizing their employees, students, and applicants. There are parallels drawn between yellow stars sewn onto clothing and acronyms next to names on lists.

Yet I can still find much to empathize with in Katherine and Isabelle. I can feel Katherine's thrill of discovery, of recognition, when she reads Jung for the first time and finds someone who talks like her, who thinks like she does. Psychology was the Wild West of science with unlicensed practitioners in living rooms across the country, accepting and counseling patients, why not her? I can feel Isabelle's yearning for greatness beyond mediocrity - a jack of all trades, master of none (she won a mystery novel writing competition, was wealthy and then lost it all in the Depression, and never wrote fiction again).

Maybe that's why I like the MBTI so much - it opens the door for all of these conversations about empathy. It gives us a very basic way to communicate with people who are so unlike us to seem despicable. While I agree that the MBTI is far from an exact science and there may be harm in pigeon-holing oneself, I don't truly believe that people live their lives in accordance with any strict type. I am an introvert, but at times I find myself leaping for the spotlight. I am a massive feeler, but I like to think I'm pretty damn logical, too. I don't shut these other attributes out just because they aren't the dominate attributes listed in my acronym. It's a starting place. It's a tool. It's a thesaurus. It's something to fall back on when the world seems lonely and sparse. It's something affirming and magical to discover after years of friendship and marriage: of course we're the same.

However, I wholeheartedly believe that certain types (I think Katherine Briggs also implied this - Introverted Intuitives?) put more stock in the MBTI than others. Maybe I'm just that type and there are some reading this in horror, aghast at my mystical take on psychological science. I have also found that type is more useful (and gratifying) when comparing two like types (like my husband and I - sometimes I want him to be the extrovert and take the reins on something and I have to remind myself that he's introverted too. But when he does do something extroverted to help our family, I am so grateful and it means so much more knowing it's not in his nature),

The corporate use of MBTI is unfortunate. This book helped me articulate why. MBTI has become a trademark - something to buy for team building activities. Companies are sold a falsity - that there will be harmony in the workforce if only we knew ourselves. I, for one, will never be truly at peace as long as I'm trudging to my minimum wage job. And when the potential is there to help mediate issues, it's mishandled and garbled. I once worked at a software company that prided itself on being "not like the rest." There were slides in the atrium, free beer in the afternoon. But the pay was abysmal - more money went into marketing the idea that they were a great place to work than actually went into becoming a great place to work. The perks such as on-site barbers, gyms, and doctors were designed to keep you in the building - available to work at any time. They offered a series of MBTI courses taught by a certified coach and I had to see what this company's take would be on something that I found so interesting. The class was fine; just a series of ice breaking activities, really. I met some nice people from some other departments that I wouldn't have normally encountered. We talked about how each of us might handle a confrontation or crisis. I didn't really
learn anything new, but it wasn't a scam or anything like that; the coach was, to use Emre's terminology, a "true believer." However, I noticed that not a single person in the room was in any sort of managing or people-oriented position. They were all low level techs like me. What's the point in knowing yourself, your preferences in being managed, how to resolve conflict with your coworkers, if your managers (and, honestly, the workforce as a whole) disregards the concept of individuality entirely?  In a sick way, if you extrapolate a bit, you're just giving your people the tools to revolt. There may be jobs that truly care for the individual and view MBTI not as a way to weed applicants, but as a tool for creativity and collaboration, but they must not be hiring.

After the course, a coworker asked me how I liked the class. My entire team ended up sharing their types and we plotted them out on a chart. For a brief moment, we were excited about each other as people - were interested to know what it's like living as an E, an F, a P. But eventually, the weight of deadlines loomed, and we turned back to our screens.

Throwing balls to alleviate rage about their last paycheck
As a conspiracy theorist of the highest order, I now believe that my ex-employer offered this class only so, when confronted with bad Glassdoor reviews exposing their callousness and willingness to change out people like parts of a machine, they could point at their many MBTI courses and say, "But look. We care about you as a person, we really do. We paid for this, didn't we?"

So, I agree with Emre on some level. MBTI can be a bad thing, an exclusionary and classist thing, a way of commodifying the self. But like any tool, there's a correct time and way to wield it.

I am just having a hard time reconciling Emre's motives for writing with the contents of the book. It seems like this book will appeal much more to people who are invested in MBTI or, at least, have had enjoyed their encounters with the personality test, yet her criticism takes a form that I don't think will get through to anyone in these communities. So, people picking up this book with hopes to disprove the test will be dissatisfied, but strung along just enough to angrily get through it - there's too much concession, too much dwelling on magic and fantasy, yet Emre hints at some sort of great destruction of the test via top secret information that never comes. And people who want to live in the world of MBTI forever will be pleased, but thoroughly confused when the author occasionally appears to remind us that she hates this thing she paid thousands of dollars to be educated in and wrote a huge, beautiful book about.

In the introduction, Emre wavers between sympathy for the people who love MBTI and insisting that no one should or can be typed and that the test is "a wolf in sheep's clothing." I believe there's room for all of these opinions - but I don't think this introduction is for this book. It's for a different, equally good, but more critical book.

Though, after re-reading the Introduction, I realize I am not being entirely fair to Emre. I assumed that, as an expert in the history of identity and personality, she therefore must know herself and her stances completely. But to know the history of identity is not to know one's own, and who can enter someone else's story for the length of writing an entire book without transforming, just a bit? And, being my type - ever cautious to remain the prophet - I would have gone back and rewritten the entire thing so that no one ever knew I hadn't always known it all from birth. But Emre is not me, and she said it best:

"There are times when, confused and lacking direction, we speak the language of type to affirm our understanding of ourselves and the people we love, and there are times when we want desperately to guard our individuality from type's sly encroachments, to hold fast to the distinct and irrepressible qualities that make you who you are and me who I am. I started and finished this book at moments of great change in my life - my second son will arrive any day now - and there were moments when, against my prior judgments, I found myself thinking and speaking the words my subjects used with a will to belief that I never thought possible."