The Duty of a Scholar

The Duty of a Scholar On November 16th, 2004 — π years after arriving in Oxford — I submitted my doctoral thesis. My mind wasn't really on my thesis though; I was thinking about an issue I had noticed in recent Intel CPUs: The "Hyper-Threading" (simultaneous multithreading) feature they introduced in 2002 could leak information between execution threads via the cache state.There was a joke at the time that although the National Security Agency had opened up in recent years and started taking their defensive role more seriously, the one aspect of cryptography which they would never discuss publicly was side channel attacks — and this itself constituted a side channel, revealing the importance they attributed to the field. Being active in computer security, and recognizing that the NSA knew a few things about the topic, my immediate priority was to determine whether the information leakage I had identified was sufficient to construct a practical cryptographic side channel. By mid-December I had a proof-of-concept exploit which stole enough bits of an RSA private key for the entire key to be reconstructed, and I turned my attention to the hard part of the problem: Quietly notifying security teams and working together to get the issue fixed before disclosing it publicly. This became my occupation for the next six months. While my Oxonian contemporaries were making corrections to their theses and applying for jobs, I set those aside (much to the irritation of my supervisors): I had a responsibility, and it took priority over mere career considerations. As it turned out, being unemployed proved useful in early May, when Intel — rather irked by my impending publication — asked Yahoo to order me to withdraw the paper; Yahoo was very happy to reply that, unlike many FreeBSD developers, I was not in fact employed by them and they were not in a position to threaten to fire me. On May 13th, 2005, I presented my paper at BSDCan and published an advisory on the topic; advisories were published at the same time or soon thereafter by FreeBSD, NetBSD, Red Hat, SCO, and Ubuntu. Anyone involved with open source software security will recognize the process of responsible disclosure (now widely called "coordinated disclosure", after some people in the industry struggled with the concept of responsibility), although the length of this particular process was unusual. If you find a security vulnerability, you shouldn't ignore it (or worse, sell it to bad actors); conversely, it's irresponsible to simply publish the vulnerability and hope that the good guys can fix it before the bad guys exploit it. Instead, you have a responsibility to identify who needs to know about the issue and to contact them — quietly — so they can get patches ready to distribute to their users the moment the issue becomes publicly known. In this particular case, I was unusually able to put my life on hold: I was single, child-free, and, after defending my thesis and returning home to Canada, living rent-free in my (very tolerant) parents' basement. While I had some bills to cover — being a type 1 diabetic, I had to purchase insulin — living in Canada meant that I didn't need to worry about the risk of extraordinary costs from a hospital stay. Had I been living in the USA, I would have needed to prioritize seeking employment and medical insurance and likely would not have been able to discharge the duty which fate had thrust upon me. Engineers, of course, are familiar with such duties: While the precise language varies from jurisdiction to jurisdiction, nearly all professional ethical codes include a requirement to act upon safety hazards regardless of whether any personal connection exists. Members of the IEEE commit, for example, "to hold paramount the safety, health, and welfare of the public..." without that duty being limited to hazards arising from projects employing the Engineer in question: The duty "to disclose promptly" vests in any Engineer who recognizes that the hazard exists. As with responsible disclosure of software security vulnerabilities, however, the subject matter of this duty is limited in scope: There is no duty to report if work is being done inefficiently. As a legal duty this would be reasonable; but as a moral duty, I feel it sets the bar too low. Engineering codes also often set out a process of escalation: In the common case of a licensed Engineer becoming aware of a hazard in a project they are working on, in the first instance they should report their concerns to their employer; only if that fails to yield results should they take more direct steps. This is both efficient and practical: Reporting an issue to someone who fails to act upon it isn't necessarily sufficient to discharge a duty, but conversely reporting everything broadly risks drowning out the few items which truly need broad attention. I routinely apply this same principle; for example, in 2009 I discovered that the Amazon EC2 firewall broke Path MTU Discovery by default and reported it to Amazon; but by November 2012 I concluded that Amazon was not going to address the problem, so I took to my blog to advise Amazon customers on how to fix Path MTU Discovery for themselves. (As it happened, Amazon fixed the bug a short time later.) While this was in no way a safety or computer security concern, I felt that, knowing what I did, I had an ethical duty to share that knowledge to help people who were affected by the issue. In the Star Trek: The Next Generation episode "The First Duty", the late Patrick Stewart, speaking as Jean-Luc Picard, delivers a memorable speech about truth: The first duty of every Starfleet officer is to the truth, whether it's scientific truth or historical truth or personal truth! It is the guiding principle on which Starfleet is based! If you can't find it within yourself to stand up and tell the truth about what happened, you don't deserve to wear that uniform! The duty described here is a duty to uncover and not conceal the truth; while I agree with this duty, I don't think it goes far enough. To me, the duty includes actively seeking out people to whom the truth should be told. To hide behind "nobody asked" is to fail to fulfill the duty. Much ink has been spilled by philosophers about duty and ethics, and the German Enlightenment philosopher Fichte in particular had some interesting comments to make in the fourth of his 1794 lectures, Über die Bestimmung des Gelehrten — often translated as The Vocation of the Scholar, which inspired the title of this essay. Fichte argues that Scholars have a particular relationship to knowledge: A Scholar "possesses his Knowledge not for himself, but for society". It is not proper for a Scholar to hoard knowledge; rather, Scholars have a duty to impart their knowledge to others — in Fichte's somewhat exaggerated view, to act as "the Teacher of the human race". On the other hand, it is unnecessary and inappropriate to enter with everyone into the "deep inquiries which he himself has been obliged to undertake"; rather, a Scholar relies upon others' trust in the Scholar's honesty when conveying the particular knowledge which is needed. Fichte notes that "[t]he Scholar will never be tempted to bring men to the adoption of his convictions by coercion or the use of physical force [...] neither will he deceive them". Scholars are not Plato's philosopher-kings; their duty is to provide the requisite knowledge, not to enforce what is done with that knowledge. Now, I don't agree with Fichte on every point. Fichte considers Scholars to be the loftiest of all classes, and even invites each Scholar to consider themselves a "Priest of Truth"; living in rather more egalitarian times, I absolutely reject this framing. Nor do I accept Fichte's framing (in his preceding lecture, On the Distinction of Classes in Society) that the duty of Scholars to share knowledge arises from an obligation to render back to society what it has done for us; to me, the duty arises not from a debt to society, but rather attaches to knowledge itself, no matter who holds it. This duty, naturally, is not unlimited. As Fichte notes, there is no duty to force people to act upon shared knowledge — indeed there is a moral obligation to accept everyone's freedom to choose how they act. Similarly, there is no duty to become a Cassandra: As with any gift, people are free to refuse the gift of knowledge, however unwise that might be; ultimately, if everyone who is able to act upon some knowledge has been made aware of it, the duty has been exhausted. In modern vernacular, the terms "Scholar" and "Researcher" often overlap, but to me there is a very precise distinction: Researchers create new knowledge, while Scholars carry that knowledge to the people who need it — a narrower definition than that of Fichte, whose Scholars also carry a duty to strive to extend knowledge. Many people, of course, are both Researchers and Scholars; but there are plenty of people who perform research and publish papers without truly communicating their discoveries. The research paper which is published in a journal but never read is almost a cliché; but even papers which are read do not necessarily have the impact they deserve if they are read only by academics and not by anyone in a position to act upon the findings published. My undergraduate alma mater, Simon Fraser University — of which I have been a sitting Senator for over two decades — describes itself as "Canada's engaged university" and makes a point of valuing not just academic output but the work of connecting academic learning with the real world. A true Scholar, in my mind, is someone who feels bound by the duty of knowledge: To find the people with whom it should be shared. It is for everyone to choose their own role in society, and not everyone feels every duty the same way; for that matter, just as my experience in 2005 would have been different had I needed to obtain medical insurance, not everyone is able to act upon a duty, no matter how much they feel it. But for myself, I choose the life and duty of a Scholar.