COMMUNICATIONS

ACM
CACM.ACM.ORG OF THE 05/2018 VOL.61 NO.05

Speech
Emotion
Recognition
Never-Ending Learning
Toward Sustainable Access:
Where Are We Now?
Canary Analysis Service
ACM’s General Election Ballot Association for
Computing Machinery
The field of multimedia is unique in offering a rich and dynamic forum for researchers from
The fieldfields
“traditional” of multimedia is unique
to collaborate andin offering
developa rich
newand dynamicand
solutions forum for researchers
knowledge that from
transcend the
“traditional” fields to collaborate and develop new solutions and knowledge
boundaries of individual disciplines. Despite the prolific research activities and outcomes, that transcend the however,
boundaries of individual disciplines. Despite the prolific research activities and outcomes, however,
few efforts have been made to develop books that serve as an introduction to the rich spectrum of
few efforts have been made to develop books that serve as an introduction to the rich spectrum of
topicstopics
covered by this
covered broad
by this broad field.
field.AAfew
fewbooks
books areareavailable
available that
that either
either focusfocus on specific
on specific subfields
subfields or or
basic background
basic backgroundin multimedia.
in multimedia.Tutorial-style materials
Tutorial-style materials covering
covering the active
the active topicstopics being pursued
being pursued by by
the leading researchers at frontiers of the field are currently lacking...until now.
the leading researchers at frontiers of the field are currently lacking...until now.
Each chapter
Each chapter discusses
discusses thethe problems,technical
problems, technical challenges,
challenges, state-of-the-art approaches
state-of-the-art and and
approaches
performances, open issues, and promising direction for future work. Collectively, the chapters
performances, open issues, and promising direction for future work. Collectively, the chapters
provide an excellent sampling of major topics addressed by the community as a whole. This book,
provide an excellent
capturing some ofsampling of major
the outcomes of suchtopics
efforts,addressed by thetocommunity
is well positioned as a whole.needs
fill the aforementioned Thisinbook,
capturing sometutorial-style
providing of the outcomes of such
reference efforts,
materials is welltopics
for frontier positioned to fill the aforementioned needs in
in multimedia.
providing tutorial-style reference materials for frontier topics in multimedia.
 tHE ACM A. M. turing AwArd
by the community ◆ from the community ◆ for the community

ACM and Google congratulate

JOHN HENNESSY and DAVID PATTERSON

For pioneering a systematic, quantitative approach
to the design and evaluation of computer architectures with
enduring impact on the microprocessor industry.

For more information see http://research.google.com/

Financial support for the ACM A. M. Turing Award is provided by Google Inc.
COMMUNICATIONS OF THE ACM

Departments News Viewpoints

5 Cerf’s Up
Turing Test 2
By Vinton G. Cerf

6 Editorial
Toward Sustainable Access:
Where Are We Now?
By Jack Davidson, Joseph Konstan,
Andrew A. Chien, and Scott Delman

9 Vardi’s Insights
How We Lost the Women
in Computing
By Moshe Y. Vardi
26 37
10 Letters to the Editor
Get ACM (and Communications) 26 Shrinking Machines, 34 Law and Technology
Out of Politics Cellular Computers Is the Law Ready for Driverless Cars?
Scientists are using DNA and RNA Yes, with one big exception.
13 ACM’s 2018 General Election to build the world’s tiniest robots By Ryan Calo
and computing devices.
24 BLOG@CACM By Gregory Mone 37 Privacy and Security
Commenting on Code, Considering Putting Trust in Security Engineering
Data’s Bottleneck 29 Using Functions for Proposing a stronger foundation

(L) IMAGE BY D EM IN LIU, COURTESY OF CA LIFORNIA INSTIT UTE OF TECHNOLO GY; (R) IMAGE BY AN DRIJ BORYS ASS OCI AT ES/S HUT T E RSTOCK
Edwin Torres considers Easier Programming for an engineering discipline to
the enduring value of code comments, Functional programming languages support the design of secure systems.
while Walid Saba wonders if automate many of the details By Fred B. Schneider
we have overreacted to the underlying specific operations.
knowledge acquisition bottleneck. By Neil Savage 40 Education
Scale or Fail
7 Calendar 31 Finding a Healthier Approach Moving beyond self-selected
to Managing Medical Data computer science
117 Careers Researchers are exploring ways education in Switzerland.
to put medical data to greater use By Alexander Repenning
while better protecting privacy.
Last Byte By Samuel Greengard 43 Viewpoint
The March into the Black Hole
120 Future Tense of Complexity
Free Press Addressing the root causes of rapidly
When all online news and comment increasing software complexity.
can be digitally manipulated, By Harold “Bud” Lawson
some might recall a more
trustworthy way to spread the word. 46 Viewpoint
By Ken MacLeod Science, Policy, and Service
Some thoughts on the way forward.
By Margaret Martonosi

Association for Computing Machinery

Advancing Computing as a Science & Profession

2 COMMUNICATIO NS O F THE ACM | M AY 201 8 | VO L . 61 | NO. 5

 05/2018 VOL. 61 NO. 05

Practice Contributed Articles Review Articles

54 72 90

50 Research for Practice: 66 More Than the Code: Learning Rules 90 Speech Emotion Recognition:
Cluster Scheduling for Datacenters of Rejection in Writing Programs Two Decades in a Nutshell,
Expert-curated guides to A teacher and students coding Benchmarks, and Ongoing Trends
the best of CS research. together make explicit the unwritten Tracing 20 years of progress in
By Malte Schwarzkopf rules of programming. making machines hear our emotions
By Josh Tenenberg, Wolff-Michael based on speech signal properties.
54 Canary Analysis Service Roth, Donald Chinn, Alfredo Jornet, By Björn W. Schuller
Automated canarying quickens David Socha, and Skip Walter
development, improves production
Watch the author discuss
safety, and helps prevent outages. 72 Internet Freedom in West Africa: his work in this exclusive
By Štěpán Davidovič and Betsy Beyer Technical Support for Journalists Communications video.
https://cacm.acm.org/
and Democracy Advocates videos/speech-emotion-
63 How Is Your Week Going So Far? The U.S. State Department’s Internet recognition
Praise matters just as much as money. Freedom agenda is being adapted
(L) IM AGE BY NUC LEA RTIST; ( C) P HOTO BY F EDERICO SCOPPA/A F P/GET T Y IMAGES; (R) ILLUSTRATIO N BY VAULT 49

By Kate Matsudaira to help them communicate without Research Highlights

DNS and IP address filtering.
Articles’ development led by By Richard R. Brooks, Lu Yu, Yu Fu, 102 Technical Perspective
queue.acm.org
Oluwakemi Hambolu, John Gaynard, Breaking the Mold
Julie Owono, Archippe Yepmou, of Machine Learning
and Felix Blanc By Oren Etzioni

103 Never-Ending Learning

Watch the authors discuss
their work in this exclusive
By T. Mitchell, W. Cohen, E. Hruschka,
Communications video. P. Talukdar, B. Yang, J. Betteridge,
https://cacm.acm.org/
videos/internet-freedom-in- A. Carlson, B. Dalvi, M. Gardner,
About the Cover: west-africa B. Kisiel, J. Krishnamurthy, N. Lao,
Dialogue systems like Siri
and Alexa may be all the K. Mazaitis, T. Mohamed, N. Nakashole,
rage, but they don’t capture 83 Data Acquisition in E. Platanios, A. Ritter, M. Samadi,
the emotions behind
our words. Researchers in Vehicular Ad Hoc Networks B. Settles, R. Wang, D. Wijaya,
the field of speech emotion The data comes from multiple A. Gupta, X. Chen, A. Saparov,
recognition (SER) have been
toiling for over 20 years optimal sources in parallel, M. Greaves, and J. Welling
to make machines hear helping reduce addressing
our emotions and in
this issue Björn Schuller and data-acquisition latency.
(p. 90) traces the advances
to date and the work ahead.
By Xiaonan Wang
Cover illustration by Vault49.

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF THE ACM 3

 COMMUNICATIONS OF THE ACM
Trusted insights for computing’s leading professionals.

Communications of the ACM is the leading monthly print and online magazine for the computing and information technology fields.
Communications is recognized as the most trusted and knowledgeable source of industry information for today’s computing professional.
Communications brings its readership in-depth coverage of emerging areas of computer science, new trends in information technology,
and practical applications. Industry leaders use Communications as a platform to present and debate various technology implications,
public policies, engineering challenges, and market trends. The prestige and unmatched reputation that Communications of the ACM
enjoys today is built upon a 50-year commitment to high-quality editorial content and a steadfast dedication to advancing the arts,
sciences, and applications of information technology.

ACM, the world’s largest educational STA F F EDITORIAL BOARD ACM Copyright Notice
and scientific computing society, delivers DIRECTOR OF PU BL ICATIONS E DITOR- IN- C HIE F Copyright © 2018 by Association for
resources that advance computing as a Scott E. Delman Andrew A. Chien Computing Machinery, Inc. (ACM).
science and profession. ACM provides the cacm-publisher@cacm.acm.org eic@cacm.acm.org Permission to make digital or hard copies
computing field’s premier Digital Library of part or all of this work for personal
and serves its members and the computing Deputy to the Editor-in-Chief or classroom use is granted without
Executive Editor Lihan Chen
profession with leading-edge publications, fee provided that copies are not made
Diane Crawford cacm.deputy.to.eic@gmail.com
conferences, and career resources. or distributed for profit or commercial
Managing Editor
advantage and that copies bear this
Thomas E. Lambert S E NIOR E DITOR
Acting Executive Director notice and full citation on the first
Senior Editor Moshe Y. Vardi
Deputy Executive Director and COO page. Copyright for components of this
Andrew Rosenbloom
Patricia Ryan work owned by others than ACM must
Senior Editor/News NE W S
Director, Office of Information Systems be honored. Abstracting with credit is
Lawrence M. Fisher Co-Chairs
Wayne Graves permitted. To copy otherwise, to republish,
Web Editor William Pulleyblank and Marc Snir
Director, Office of Financial Services to post on servers, or to redistribute to
David Roman Board Members
Darren Ramdin lists, requires prior specific permission
Rights and Permissions Monica Divitini; Mei Kobayashi;
Director, Office of SIG Services and/or fee. Request permission to publish
Deborah Cotton Michael Mitzenmacher; Rajeev Rastogi;
Donna Cappo from permissions@hq.acm.org or fax
Editorial Assistant François Sillion
Director, Office of Publications (212) 869-0481.
Jade Morris
Scott E. Delman
VIE W P OINTS
For other copying of articles that carry a
ACM CO U N C I L Co-Chairs code at the bottom of the first or last page
Art Director Tim Finin; Susanne E. Hambrusch;
President Andrij Borys or screen display, copying is permitted
Vicki L. Hanson John Leslie King; Paul Rosenbloom provided that the per-copy fee indicated
Associate Art Director Board Members
Vice-President Margaret Gray in the code is paid through the Copyright
Cherri M. Pancake Stefan Bechtold; Michael L. Best; Judith Bishop; Clearance Center; www.copyright.com.
Assistant Art Director Andrew W. Cross; Mark Guzdial; Haym B. Hirsch;
Secretary/Treasurer Mia Angelica Balaquiot
Elizabeth Churchill Richard Ladner; Carl Landwehr; Beng Chin Ooi; Subscriptions
Production Manager Francesca Rossi; Loren Terveen;
Past President Bernadette Shade An annual subscription cost is included
Alexander L. Wolf Marshall Van Alstyne; Jeannette Wing in ACM member dues of $99 ($40 of
Advertising Sales Account Manager
Chair, SGB Board Ilia Rodriguez which is allocated to a subscription to
Jeanna Matthews P R AC TIC E Communications); for students, cost
Co-Chairs, Publications Board Chair is included in $42 dues ($20 of which
Jack Davidson and Joseph Konstan Columnists Stephen Bourne and Theo Schlossnagle is allocated to a Communications
Members-at-Large David Anderson; Phillip G. Armour; Board Members subscription). A nonmember annual
Gabriele Anderst-Kotis; Susan Dumais; Michael Cusumano; Peter J. Denning; Eric Allman; Samy Bahra; Peter Bailis; subscription is $269.
Elizabeth D. Mynatt; Pamela Samuelson; Mark Guzdial; Thomas Haigh; Terry Coatta; Stuart Feldman; Nicole Forsgren;
Eugene H. Spafford Leah Hoffmann; Mari Sako; Camille Fournier; Benjamin Fried; ACM Media Advertising Policy
SGB Council Representatives Pamela Samuelson; Marshall Van Alstyne Tom Killalea; Tom Limoncelli; Communications of the ACM and other
Paul Beame; Jenna Neefe Matthews; Kate Matsudaira; Marshall Kirk McKusick; ACM Media publications accept advertising
Barbara Boucher Owens C O N TAC T P O IN TS Erik Meijer; George Neville-Neil; in both print and electronic formats. All
Copyright permission Jim Waldo; Meredith Whittaker advertising in ACM Media publications is
BOARD C HA I R S at the discretion of ACM and is intended
permissions@hq.acm.org
Education Board Calendar items to provide financial support for the various
Mehran Sahami and Jane Chu Prey C ONTR IB U TE D A RTIC LES
calendar@cacm.acm.org Co-Chairs activities and services for ACM members.
Practitioners Board Change of address Current advertising rates can be found
Terry Coatta and Stephen Ibaraki James Larus and Gail Murphy
acmhelp@acm.org Board Members by visiting http://www.acm-media.org or
Letters to the Editor William Aiello; Robert Austin; Kim Bruce; by contacting ACM Media Sales at
REGIONA L C O U N C I L C HA I R S letters@cacm.acm.org (212) 626-0686.
Alan Bundy; Peter Buneman; Carl Gutwin;
ACM Europe Council
Yannis Ioannidis; Gal A. Kaminka;
Chris Hankin W E B S IT E Single Copies
Ashish Kapoor; Kristin Lauter; Igor Markov;
ACM India Council http://cacm.acm.org Single copies of Communications of the
Bernhard Nebel; Lionel M. Ni; Adrian Perrig;
Madhavan Mukund ACM are available for purchase. Please
Marie-Christine Rousset; Krishan Sabnani;
ACM China Council contact acmhelp@acm.org.
AU T H O R G U ID E L IN ES m.c. schraefel; Ron Shamir; Alex Smola;
Yunhao Liu
http://cacm.acm.org/about- Josep Torrellas; Sebastian Uchitel;
Hannes Werthner; Reinhard Wilhelm COMMUN ICATION S OF THE ACM
communications/author-center
PUB LICATI O N S BOA R D (ISSN 0001-0782) is published monthly
Co-Chairs by ACM Media, 2 Penn Plaza, Suite 701,
RES E A R C H HIGHLIGHTS
Jack Davidson; Joseph Konstan New York, NY 10121-0701. Periodicals
ACM ADVERTISIN G DEPARTM E NT Co-Chairs
Board Members 2 Penn Plaza, Suite 701, New York, NY postage paid at New York, NY 10001,
Azer Bestavros and Shriram Krishnamurthi
Phoebe Ayers; Anne Condon; Nikil Dutt; 10121-0701 and other mailing offices.
Board Members
Roch Guerrin; Chris Hankin; T (212) 626-0686 Martin Abadi; Amr El Abbadi; Sanjeev Arora;
Yannis Ioannidis; Xiang-Yang Li; F (212) 869-0481 POSTMASTER
Michael Backes; Maria-Florina Balcan;
Sue Moon; Michael L. Nelson; Please send address changes to
Andrei Broder; David Brooks; Doug Burger;
Sharon Oviatt; Eugene H. Spafford; Communications of the ACM
Stuart K. Card; Jeff Chase; Jon Crowcroft;
Stephen N. Spencer; Alex Wade; Advertising Sales Account Manager 2 Penn Plaza, Suite 701
Alexei Efros; Bryan Ford; Alon Halevy;
Julie R. Williamson Ilia Rodriguez New York, NY 10121-0701 USA
Gernot Heiser; Takeo Igarashi; Sven Koenig;
ilia.rodriguez@hq.acm.org Steve Marschner; Greg Morrisett;
ACM U.S. Public Policy Office Tim Roughgarden; Guy Steele, Jr.; Printed in the USA.
Adam Eisgrau, Media Kit acmmediasales@acm.org Robert Williamson; Margaret H. Wright;
Director of Global Policy and Public Affairs Nicholai Zeldovich; Andreas Zeller
1701 Pennsylvania Ave NW, Suite 300,
Washington, DC 20006 USA WEB
T (202) 659-9711; F (202) 667-1066 Association for Computing Machinery Chair
(ACM) James Landay
Computer Science Teachers Association 2 Penn Plaza, Suite 701 Board Members A
SE
REC
Y

Jake Baskin New York, NY 10121-0701 USA Marti Hearst; Jason I. Hong;
E

CL
PL

Executive Director T (212) 869-7440; F (212) 869-0481 Jeff Johnson; Wendy E. MacKay
NE
TH

S
I

Z
I

M AGA

4 COMM UNICATIO NS O F THE ACM | M AY 201 8 | VO L . 61 | NO. 5

 cerf’s up

DOI:10.1145/3200485 Vinton G. Cerf

Turing Test 2

I
N 1950, ALAN TURING wrote a successfully respond with the correct into treating computer-generated ac-
paper entitled “Computing alphanumeric string while a com- tions as if they originate from a human.
Machinery and Intelligence.”a puter program, interacting with the This is an important practical problem
He proposed a test in which a same image will not succeed. There because failure to make this distinction
human attempts to distinguish are other variations, for example, in may mean malicious programs can reg-
between a human and a computer by which an image of an equation is dis- ister millions of fake identities on an
exchanging text messages with each played and the solution to the equa- email system for purposes of sending
of them. If the human is unable to tion must be entered in response. phishingc email messages or making
distinguish between the two, the Assuming the image is just a set of comments on social media Web pages.
computer is said to have passed the pixels, the challenge for the comput- One reason this is now a serious matter
“Turing Test.” In fact, there were er program trying to appear human is is that such programs (called “bots”)
variations, including one in which a to correctly identify the equation and are being used to distort news and so-
human interrogator interacting with solve it. cial media to trick humans into accept-
a man and a woman was to try to tell Much has been written about ing false information (“fake news”) as
which was the man and which was the increasingly sophisticated abil- true or simply reinforcing incorrect or
the woman. Turing called this the ity of computer programs to pass biased beliefs through confirmation
“Imitation Game.” The first version is the CAPTCHA tests or a variation in bias and “echo chamber” effects. Of
sometimes now called the “Standard which the program sends the image course, bots can also be used to launch
Turing Test.” to a human on the Internet who is denial-of-service attacks or to pollute
In this modern era, in which the given some benefit or payment for crowdsourcing systems. The technical
Internet and the World Wide Web solving the problem, which is then challenge is that a computer program
play such visible roles, a different relayed by the imitating program to may be hard-pressed to distinguish be-
problem arises. In this version, which the computer program running the tween input from a human or from a
I will call “Turing Test 2,” a computer CAPTCHA test. This is not merely computer because the same paths and
program undertakes textual inter- an amusing game. As computer media are used to carry the input.
actions with a human and another programs have grown capable of On the other hand, increasingly
computer. The task of the computer more sophisticated behavior, they difficult CAPTCHA practices can drive
program is to distinguish between are being used to emulate humans humans crazy. “Which pictures do
the human and the computer. If the to fool less-sophisticated programs NOT contain traffic signs?” “Confirm
computer program successfully iden- this statement, ‘there are no images
tifies which correspondent is a hu- or partial images of automobiles in
man and which is a computer, it has For Turing Test 2, this set of pictures.’”
successfully passed Turing Test 2. If Humans may justifiably want to
it cannot, then it fails the test. One a computer program throw their computers through the
particular form of this test is called undertakes textual nearest window when poorly executed
a CAPTCHAb (Completely Automated CAPTCHAs prevent them from legiti-
Public Turing test to tell Computers interactions with mately accessing online services.
and Humans Apart). These tests take a human and another
many forms, but a popular variation c Messages intended to fool a human user into
is to display a distorted image of a computer. The task clicking on a hyperlink leading to the inges-
word or random string of numbers of the program is to tion of malware into the user’s computer or
smartphone or taking an action such as send-
and characters. In theory, a human
interacting with the CAPTCHA will distinguish the human ing money to the account of a person commit-
ting a fraud.
from the computer.
a Turing, A. Computing machinery and intel- Vinton G. Cerf is vice president and Chief Internet Evangelist
at Google. He served as ACM president from 2012–2014.
ligence. Mind 49, 236 (Oct. 1950), 433–460;
doi: 10.1093/mind/LIX.236.433
b https://en.wikipedia.org/wiki/CAPTCHA Copyright held by author.

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF THE ACM 5

editorial

DOI:10.1145/3201219 Jack Davidson, Joseph Konstan, Andrew A. Chien, and Scott Delman

Toward Sustainable Access:

Where Are We Now?

A
CM’S PUBLICATIONS PROGRAM is ever “out of print.” A portion of the
is a core part of fulfilling its publishing budget covers costs of mak-
mission to advance com- The publishing ing digital content accessible through
puting as a science and landscape changing standards and guarantees
a profession. ACM’s con- there will be a backup provider should
ference proceedings, journals, books, is changing, ACM be unable to publish the DL.
magazines, and newsletters comprise and ACM with it. Access. Broad access by both read-
an essential component of ACM’s iden- ers and authors. We strive to keep sub-
tity as well as service to members and scription prices low and provide a vari-
the profession. We are proud of the pre- ety of mechanisms for authors to make
eminence of the ACM Digital Library their work visible, easily discoverable,
and its suite of services that provide ac- open publishing, the desire for more rep- and freely accessible. All ACM publica-
cess to these publications, ensure their licable science, and the accelerating dis- tions support Gold OA with an author-
preservation, and is also a repository for semination through distribution of pre- paid article processing charge (APC).
a growing breadth of related artifacts in- prints (including prior to peer review). In addition, authors have a variety of
cluding video, code, and datasets. For this reason, we take this op- Green OA options including posting
Selling access to ACM’s publica- portunity to describe what ACM, and an “Author-izer” Web link that gives
tions, primarily through institutional in particular its Publications Board, readers direct access at no charge. And
subscriptions to the DL, pays for the thinks about these issues, recent we are careful to ensure author-pays
direct costs of running ACM’s publish- changes, and the future. Gold OA publications have provisions
ing program, provides funds for SIG- for authors who cannot pay. We also
specific initiatives, and supports the Six Key Principles help authors comply with funder man-
many good works of ACM, including its As we consider directions in publica- dates for open access.
curriculum and education efforts, pub- tions, we focus on six key principles: Quality. Highest quality of techni-
lic policy initiatives, and broad support Sustainability. Both the financial cal content and publication. The ACM,
of diversity efforts worldwide. sustainability of ACM and its publish- thanks to its members and volunteers,
For decades, ACM has carefully bal- ing program underpin the ability to en- as well as its history of quality, is a trust-
anced sustainability of the publishing sure content is available indefinitely. ed brand. Publications are reviewed reg-
program with providing authors the ACM must ensure no ACM publication ularly for quality; proposed publications
opportunity to disseminate their work
widely. Examples include longstand-
ing author rights to post their papers
through personal or institutional web-
sites, reuse in future publications, and
of course to share copies with anyone
who might wish to read them.
The publishing landscape is chang-
ing, and ACM with it. We recognize the
importance of the Open Access (OA)
movement—the deeply held belief that
research should be available to all—to
advance the field and to ensure access
for scholars who are unaffiliated or
whose institutions are not subscribers.
We also recognize and respect other
trends, including sponsor mandates for Jack Davidson Joseph Konstan

6 COMM UNICATIO NS O F THE ACM | M AY 201 8 | VO L . 61 | NO. 5

 editorial

undergo rigorous review by the ACM

community; and ACM uses state-of-the-
of contents on their Special Interest
Group pages that provide open access Calendar
art plagiarism-detection software and
invests substantial volunteer time in
handling cases of plagiarism, research
to specific proceedings.
ACM continues to explore models
to enable greater sustainable open
of Events
misconduct, and other ethics violations. access. For example, we are work- May 4–6
Our peer-review is first-rate, and we doc- ing with institutional subscribers to I3D ‘18: Symposium on Interactive
3D Graphics and Games,
ument in the DL key quality metrics as- explore “author-side” subscriptions Montreal, Canada
sociated with each publication. where institutions pre-commit to pay- Sponsored: ACM/SIG,
Author Choice. Provide publication ing the Gold OA APCs for some or all Contact: Morgan McGuire,
access options that serve authors’ sci- of their authors’ publications. We Email: morgan@cs.williams.edu
entific objectives. Authors can make are also working, in partnership with May 8–10
decisions about how their work is ac- other publishers, to better support CF ‘18: Computing
cessible, selecting among the variety of authors in meeting the open access re- Frontiers Conference,
access models and corresponding fee quirements of government-funded re- Ischia, Italy,
Sponsored: ACM/SIG,
structures. Similarly, ACM authors can search. In addition, a partnership with Contact: David R. Kaeli,
choose how they wish to manage rights, arXiv is exploring ideas for how to best Email: kaeli@ece.neu.edu
from self-management to having ACM connect preprints and final published
handle everything. papers. And of course, a key effort is May 15–18
I3D ‘18: Symposium
Service. Provide an excellent experi- the next generation of the ACM DL, on Interactive 3D Graphics
ence for authors and readers. To better incorporating features that broaden and Games,
support authors and readers, we are in- the notion of publication, supporting Montreal, Canada,
vesting in new publishing technology dissemination of code, data, and other Sponsored: ACM/SIG,
Contact: Morgan McGuire,
that reduces author effort for manu- research artifacts. Email: morgan@cs.williams.edu
script preparation and submission, We would love to hear from you!
streamlines the publication process, May 23–25
and provides greatly improved search Jack Davidson, GLSVLSI ‘18: Great Lakes
Symposium on VLSI 2018,
and discovery of relevant articles. The CO-CHAIR Chicago, IL,
new platform will also allow ACM to ACM PUBLICATIONS BOARD Sponsored: ACM/SIG,
render articles accessible for read- Contact: Deming Chen,
Email: dchen@illinois.edu
ers with disabilities and readable on a Joseph Konstan,
broad range of devices. CO-CHAIR May 23–25
Community Choice. Enable com- ACM PUBLICATIONS BOARD SIGSIM-PADS ‘18:
munities to make choices that reflect SIGSIM Principles of
Advanced Discrete Simulation,
their different values and priorities. Andrew A. Chien, Rome, Italy,
We support conferences and jour- EDITOR-IN-CHIEF Sponsored: ACM/SIG,
nals that have gone entirely Gold OA COMMUNICATIONS OF THE ACM Contact: Alessandro Pellegrini,
(through author-paid APCs or by pay- Email: pellegrini@dis.uniroma1.it
ing APC costs in conference budgets). Scott Delman, May 27–28
All ACM conferences have the option DIRECTOR ICPC ‘18: 26th IEEE/ACM
of a month-long “open surround” ac- ACM PUBLICATIONS International Conference
cess period to their proceedings in on Program Comprehension,
Gothenburg, Sweden,
the DL, and the option of open tables Copyright held by authors/owners.
Contact: Foutse Khomh,
Email: foutse.khomh@polymtl.ca

May 27–28
MOBILESoft ‘18: 5th IEEE/ACM
International Conference on
Mobile Software Engineering
and Systems,
Gothenburg, Sweden,
Contact: Christine L. Julien ,
Email: c.julien@mail.utexas.edu

May 27–June 3
ICSE ‘18: 40th International
Conference on Software
Engineering,
Gothenburg, Sweden,
Contact: Ivica Crnkovic,
Email: crnkovic@chalmers.se

Andrew A. Chien Scott Delman

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF THE ACM 7

 INSPIRING MINDS
FOR 200 YEARS
Ada’s Legacy illustrates the depth
and diversity of writers, things, and
makers who have been inspired
by Ada Lovelace, the English
mathematician and writer.
The volume commemorates the
bicentennial of Ada’s birth in
December 1815, celebrating her
many achievements as well as
the impact of her work which
reverberated widely since the late
19th century. This is a unique
contribution to a resurgence in
Lovelace scholarship, thanks to the
expanding influence of women in
science, technology, engineering and
mathematics.

ACM Books is a new series of high quality books for the computer science community, published by
the Association for Computing Machinery with Morgan & Claypool Publishers.
 vardi’s insights

DOI:10.1145/3201113 Moshe Y. Vardi

How We Lost the Women where women are preyed upon. But the
controversial sex parties are a small

in Computing part of Silicon Valley’s problems. The

main story of the book is of a culture is

I
that highly hostile to women.
N JU LY 2 0 1 7 , Google engineer For example, it is less well known that A.T. Wynn and S.J. Correll, two
James Damore distributed a seven womena were the world’s first Stanford sociologists, reach the same
memorandum titled “Google’s programmers, having programmed conclusion in their recent paper in So-
Ideological Echo Chamber,” the ENIAC, the first general-purpose, cial Studies of Science, titled “Punctur-
which was critical of Google’s electronic, programmable computer. ing the pipeline: Do technology com-
diversity policies. The memo “went vi- But the general ignorance of com- panies alienate women in recruiting
ral” and was widely distributed inside puting history goes deeper. The early sessions?”d Using original observation-
and outside of Google, leading to ex- programmers were women because until al data from recruiting sessions hosted
tensive media discussions. In August the development of electronic comput- by technology companies, they found
2017, Google fired Damore for viola- ers, computing used to be a human job; that company representatives often
tion of the company’s code of conduct. computers were humans who comput- engage in behaviors known to create
The U.S. National Labor Relations ed. Computing required precision and a chilly environment for women. They
Board concluded that Google did not patience, and most pre-ENIAC human concluded that representatives “may
violate U.S. federal labor law when it computers were female. Specifically, puncture the recruiting pipeline, less-
fired Damore, but Damore filed a law- women played a key role in code break- ening the interest of women at the point
suit against Google for discrimination. ing, which has had an intimate connec- of recruitment into technology careers.”
The memo’s central argument was tion with computing. Three recent books One may think these problems are
that the gender disparity observed in describe this key role played by women specific to Silicon Valley, but the recent
the tech industry in general, and in in cryptology. Women Codebreakers at #MeToo movement made it clear that ac-
Google in particular, could be partial- Bletchley Park, by Kerry Howard,b deci- ademic environments can also be hostile
ly explained by biological differences phers the legacy of British women code- to women. I urge you to read ‘What Hap-
between women and men. In essence, breakers in World War II. Code Girls, by pens to Us Does Not Happen to Most of
argued Damore, women are less inter- Liza Mundy, tells the story of over 11,000 You,’e where Kathryn McKinley provides
ested in computing then men. Ironi- women, who comprised more than 70% “a personal account of sexism, harass-
cally, over the past few years the his- of all U.S. code breakers during that war. ment, and racism that I and some anony-
torical role of women in computing The Woman Who Smashed Codes: A True mous members of the computer-archi-
has become much clearer. We can- Story of Love, Spies, and the Unlikely Hero- tecture community have experienced.”
not, I believe, understand the cur- ine Who Outwitted America’s Enemies, by So how did we lose the women in
rent gender disparity in computing Jason Fagone, chronicles the life of Eliza- computing? They did not just leave; they
without understanding the history of beth Smith Friedman, who played a lead- were pushed out. There is hard work
women in computing. ing role in U.S. cryptanalysis for 40 years. ahead of us to start to undo the damage.
The critical roles played by Ada Another recent book, Brotopia, by Check out ACM SIGARCH’s Committee
Lovelace and Grace Hopper are widely Emily Chang, describes how “Silicon to Aid REporting on discrimination and
known. Lovelace worked closely with Valley disrupts everything but the Boys’ haraSsment (CARES)f and its diversity
Charles Babbage, the British math- Club.” “From its earliest days,” Chang conversationsg to see what the comput-
ematician who was the first to con- writes, “the industry has self-selected er-architecture community is doing.
ceive of general-purpose computers, for men: first, antisocial nerds, then, de-
d https://goo.gl/sdxqwD
and was first to realize that computers cades later, self-confident and risk-tak-
e https://goo.gl/zfDAco
will have applications beyond pure cal- ing bros.” As a prelude, I suggest read- f https://goo.gl/UgU2m9
culation. Hopper was one of the first ing the Vanity Fair disputed excerpt,c g https://goo.gl/yuy3oU
programmers of the Harvard Mark I featuring Chang’s reporting about “ex-
computer and played a key role in the clusive, drug-fueled, sex-laced parties” Moshe Y. Vardi (vardi@cs.rice.edu) is the Karen Ostrum
George Distinguished Service Professor in Computational
development of COBOL. But quite of- Engineering and Director of the Ken Kennedy Institute for
ten Lovelace and Hopper are the only a https://goo.gl/8AvX9G
Information Technology at Rice University, Houston, TX, USA.
He is the former Editor-in-Chief of Communications.
women to receive recognition for their b https://goo.gl/WX2shx
significant role in computing history. c https://goo.gl/gmLMVU Copyright held by author.

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF THE ACM 9

letters to the editor

DOI:10.1145/3203077

Get ACM (and Communications) Out of Politics

R
ECENT EDITORIAL POLICY competitors, resulting in a 1956 U.S. De- bias for glorifying free trade and old-school
seems to have let ACM morph partment of Justice consent decree and corporate capitalism (just think about that for
into what I would call the left- in 1973 Telex Corp. being awarded in a second), Toxen unwittingly captured the rise
leaning ACM. Examples Federal Court $352.5 million from IBM of open vs. closed political alignments over
include Moshe Y. Vardi’s for antitrust violations. As published, traditional left vs. right ones.
editorial “ACM’s Open-Conference the column could have come from Thomas Haigh, Shorewood, WI, USA
Principle and Political Reality” (Mar. IBM’s PR department.
2017) where he addressed bathroom Having had the honor of being
laws in several U.S. states with respect published in Communications (“The For Old(er) Users,
to men who might want to use the “la- NSA and Snowden: Securing the All- Talking Still Beats Texting
dies room” and vice versa. Vardi said, Seeing Eye,” May 2014), I can attest to Bran Knowles’s and Vicki L. Hanson’s
“In January 2017, the ACM SIGMOD the rigor of the editorial review when I contributed article “The Wisdom of
Executive Committee decided to move strayed even a little short of the highest Old(er) Technology (Non)Users” (Mar.
the SIGMOD/PODS 2017 conference standards. I am not complaining, as 2018) took a condescending attitude,
out of North Carolina” due to its HB2 it made for a better, more credible ar- saying old(er) users must learn to be
Public Facilities Privacy & Security Act, ticle. I urge ACM’s leadership and Com- more “fully participating, indepen-
as passed in March 2016, prohibiting munications’ editors to reconsider their dent citizens in our increasingly digital
flexibility for the transgendered, even editorial policy and ask the two authors society.” As a 70-something software
though Vardi, for the record, disagreed I mention here to explain their motiva- engineer who still teaches computer
with the move. None of this is relevant tions or revise the organization’s name science and cybersecurity in a U.S. uni-
to computers or programming. to reflect its left-leaning inclinations. versity, I was put off by such arrogance.
Another example is Thomas Haigh’s Consider the following touchstones
Reference
“Historical Reflections” column “Defin- 1. Black, E. IBM and the Holocaust: The Strategic Alliance
of today’s mass digital culture:
ing American Greatness: IBM from Wat- Between Nazi Germany and America’s Most Powerful Perceptions of risk and responsibility.
Corporation. Crown Publishers, New York, 2001.
son to Trump” (Jan. 2018). In its “Watson We old(er) users do not fear technol-
and Trump” section, Haigh said, “Trump Bob Toxen, Peachtree Corners, GA, USA ogy but rather the carelessness of the
promised to make America great again people administering it. After getting
by building walls, stepping back from its letters describing how our data had
commitment to the defense of NATO al- Author Responds: been exposed and stolen from the U.S.
lies, and tearing up trade deals.” I see zero I fail to see how my editorial can be called Office of Personnel Management, Tar-
relevance of such a statement to com- “left leaning.” I also fail to see how policies get, Equifax, and others, why should
puters nor was it completely accurate. on locations for ACM conferences are we trust it to yet another organization’s
What then-candidate, now-President outside the scope for Communications. And, data sieve? Moreover, it is not that we
Donald J. Trump has said about NATO as Toxen’s own Communications article fear making decisions we previously
is the U.S. will require its “allies” to “pay shows, Communications is definitely not left to others, but finally realize it is
their fair share of the cost” of the com- only about computers and programming. pointless to even try to keep up with the
mon defense, defined as a percentage of Moshe Y. Vardi, Houston, TX, USA everyday tweaks to the system;
GDP, rather than continue to mooch off Values. When I originally was in col-
the American taxpayer. The U.S. presi- lege (1965–1969), before a professor
dent is obliged to keep illegal aliens out Author Responds: would arrive in the classroom, the class-
of the U.S. and “tear up trade deals” that To understand computing’s history we need to room would naturally be abuzz with
are bad for America, as spelled out in the understand IBM, and to understand IBM we conversation over very human concerns,
Constitution. I see no relevance to com- need to understand IBM’s evolving political say, test results, dating, or an upcoming
puter technology in mentioning Trump. context. IBM’s old slogan was “World Peace basketball game. When the professor
I should think a headline saying, for ex- Through World Trade.” As a charter member entered the room, a hush would replace
ample, “Defining American Greatness: of Eisenhower’s “military industrial complex” the conversation. Today, when I (now
IBM” without mentioning Trump would IBM helped America build unrivaled as the prof) enter a classroom, I see stu-
have been sufficient. military, scientific, and economic might while dents hunched over cellphones, with the
Haigh also neglected the darker side safeguarding democracy in Europe. I argued only sound thumbs striking glass;
of IBM’s history (such as selling tabulat- that IBM’s later shift to gaming short-term Cultural expectations. Those were
ing machines to Nazi Germany to help financial metrics, which shrank the company Knowles’s and Hanson’s biases, not
identify citizens with even a fraction of and shifted jobs from the U.S. to India, mine, apparently seeing us old(er)
Jewish lineage so they could be rounded illustrated the appeal of Trump’s diatribes people as obsolete. We in turn choose
up for genocide1 or efforts to crush its against “globalists.” By accusing me of leftist to see the younger generation as im-

10 COMMUNICATIO NS O F TH E AC M | M AY 201 8 | VO L . 61 | NO. 5

 letters to the editor

pulsive narcissists who could use some malfunctions in the braking systems deaths and injuries. Despite the occa-
advice. But that would require today’s in, say, 70% of them, while also direct- sional destructive results, most are still
generation to put down their phones ing others into crowds to maximize in use because they overall improve hu-
and talk to us; some evil intent. Tens of millions are man quality of life while saving money
Listening. The fact that younger peo- injured or killed in possibly the greatest and time. Anticipating the level of trust
ple choose to ignore us has not changed one-day tragedy ever. in a new, potentially harmful technolo-
in 6,000 years. Moreover, I admit we did Now imagine a peaceful alternative, gy, particularly autonomous AI-directed
not do it either when it was our turn; and with self-driving technology revolu- machines, should thus account for all
Changing interface. Since 1987, I have tionizing road transportation. Not only other related technologies that, com-
used Mail, Lotus Notes, Roundcube, does the technology allow drivers to bined, could result in some generally
multiple versions of Outlook, and oth- use their time more efficiently, it also acceptable risk that will not prevent the
er systems I can no longer name. What significantly reduces the number of broad adoption of the new technology.
I do need is a reliable way to send and car crashes, potentially to zero. Major Determining the trustworthy option in
receive information. Do I need HTML? causes of crashes are practically elimi- the deadly dilemma must account for
Not really. And even when I use it, it nated, most notably due to driver error. all associated technologies. Otherwise,
gets stripped out anyway when I email Compare against the current reality it is not just potentially misleading but
something to colleagues in govern- of human-operated vehicles, whereby really no dilemma at all.
ment agencies, something I do often. motor-vehicle collisions in the U.S.
Reference
Same with fancy colors, fonts, back- alone, for example, are associated with 1. Association for Safe International Road Travel. Annual
grounds, and cute pictures. Please also approximately 37,000 deaths per year.1 United States Road Crash Statistics, 2018; http://asirt.
org/initiatives/informing-road-users/road-safety-facts/
do not insist on constantly changing In the context of designing trust- road-crash-statistics
the features just to sell a new version. worthy self-driving cars, Benjamin
We old(er) humans are simply not Kuipers, in his review article “How Uri Kartoun, Cambridge, MA, USA
all that enamored of the latest and Can We Trust a Robot?” (Mar. 2018)
greatest tech (recall that, in many cas- addressed the “deadly dilemma,” or Communications welcomes your opinion. To submit a
Letter to the Editor, please limit yourself to 500 words or
es, we created it), nor are we impressed an AI designed to choose between two less, and send to letters@cacm.acm.org.
by the ability to add emojis to our digi- bad options, both very likely harm-
tal correspondence. We have learned ful to humans, illustrating a rare, but ©2018 ACM 0001-0782/18/5
that talking is more satisfying than tex- plausible, situation in which the com-
ting, and visits from grandchildren are putational intelligence controlling a
better than Facebook. Do not pity us— self-driving car must choose between Coming Next Month in COMMUNICATIONS ACM A.M. Turing
though, if you like, you may envy us. two alternatives—one that could re- Award Recipients:
Joseph M. Saur, Virginia Beach, VA, USA sult in the driver’s injury or death and
John L. Hennessy and
the other that will save the driver but is
certain to cause harm to others. David A. Patterson
Authors Respond: The fundamental assumption of
Saur reflects many of the frustrations we the deadly dilemma is that self-driving Identifying Patterns
reported in our article, but we must not cars will indeed be in broad use some- in Medical Records
forget that young people use many digital day. It does not assume other technolo-
with Latent Analysis
tools not by choice but out of social and gies that might help eliminate crashes
economic necessity. Our concern is that will significantly advance by the time
society is becoming less accommodating they fill the road. Ignoring it could dis- Bias and the Web
to people lacking resources or desire to qualify the dilemma’s inverse correla-
develop digital skills, and that chipping tion with increased trust. Technologies Ability-Based Design
away at the freedom to reject technologies expected to obviate both possibilities,
will silence important debates about their as outlined in the deadly dilemma,
Privacy in Decentralized
effects on our lives. Instead of forcing include GPS navigation and car- and
older adults to digitize, their objections need ground-located sensors designed to Cryptocurrencies
greater attention. identify other cars, along with pedes-
Bran Knowles, Lancaster, U.K., and trians and bicyclists; braking systems Coz: Finding Code
Vicki L. Hanson, Rochester, NY, USA that can stop a car just in time; and new that Counts with
types of construction materials in cars
Causal Profiling
and roads more likely to protect hu-
Don’t Trust the Deadly Dilemma mans than their current counterparts.
Imagine the year is 2028, and self-driv- History has recorded many technolo-
ing cars have the run of U.S. roads, with gies that were not viewed, even by their
more than 25 million at any given mo- users, as trustworthy at first. But trans- Also, the latest news about
how deep learning works,
ment. Imagine further a well-designed portation-related technologies have ul- 3D sensor chips and apps, and
cyberattack or self-motivated artificial timately won our trust, though all have getting hooked on technology.
intelligence bot causing simultaneous resulted in some number of human

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF T HE ACM 11

 Introducing ACM Transactions
on Human-Robot Interaction

Now accepting submissions to ACM THRI

As of January 2018, the Journal of Human-Robot Interaction (JHRI) has become an

ACM publication and has been rebranded as the ACM Transactions on Human-Robot
Interaction (THRI).

Founded in 2012, the Journal of HRI has been serving as the

premier peer-reviewed interdisciplinary journal in the field.

Since that time, the human-robot interaction field has

experienced substantial growth. Research findings at the
intersection of robotics, human-computer interaction,
artificial intelligence, haptics, and natural language
processing have been responsible for important discoveries
and breakthrough technologies across many industries.

THRI now joins the ACM portfolio of highly respected

journals. It will continue to be open access, fostering the
widest possible readership of HRI research and information.
All issues will be available in the ACM Digital Library.

Co-Editors-in-Chief Odest Chadwicke Jenkins of the University of Michigan and Selma

Šabanović of Indiana University plan to expand the scope of the publication, adding
a new section on mechanical HRI to the existing sections on computational, social/
behavioral, and design-related scholarship in HRI.

The inaugural issue of the rebranded ACM Transactions on Human-Robot Interaction is

planned for May 2018.

For further information and to submit your paper, please visit https://thri.acm.org.
 acm election DOI:10.1145 / 3 1 9 6 9 43

Meet the candidates who introduce their

plans—and stands—for the Association.

ACM’s
2018 General
Election
Please take this opportunity to vote.

THE ACM CONSTITUTION provides that our Association hold a general

election in the even-numbered years for the positions of President, Vice President,
Secretary/Treasurer, and Members-at-Large. Biographical information and
statements of the candidates appear on the following pages (candidates’ names
appear in random order).
In addition to the election of ACM’s officers—President, Vice President,
Secretary/Treasurer—two Members-at-Large will be elected to serve on
ACM Council.
Electronic Balloting Procedures. Please refer to the instructions posted at
https://www.esc-vote.com/acm2018.
To access the secure voting site, you will need to enter your email address
(the email address associated with your ACM member record) and your unique PIN
provided by Election Services Co.
Paper Ballots. Should you wish to vote by paper ballot please contact Election
Services Co. to request a paper copy of the ballot and follow the postal mail ballot
procedures: acmhelp@electionservicescorp.com or +1-866-720-4357.
Postal Mail Ballot Procedures. Please return your ballot in the enclosed envelope,
which must be signed by you on the outside in the space provided. The signed
ballot envelope may be inserted into a separate envelope for mailing if you prefer
this method.
All ballots must be received by no later than 16:00 UTC on 24 May 2018.
The ACM Tellers Committee will validate the computerized tabulation
of the ballots. Validation by the Tellers Committee will take place at 14:00 UTC
on 29 May 2018.

Sincerely,
Gerald Segal
chair, acm elections committee

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF T HE ACM 13

acm election

candidates for

PRESIDENT
(7/1/18 – 6/30/20)

JACK DAVIDSON
Professor of Computer Science
University of Virginia
Charlottesville, VA
U.S.A.

Biography Statement
Education and Employment Awards and Honors I joined ACM in 1975 as a student No doubt each of us could name a
˲˲ B.A.S. (Computer Science) ˲˲ DARPA Cyber Grand Challenge member. Our student group half-dozen computing technologies
Southern Methodist University, Competition, 2nd Place, organized programming contests, that are or will have a profound
1975; M.S. (Computer Science) $1M prize (2016) planned chapter activities, wrote impact on society: AI, machine
Southern Methodist University, ˲˲ ACM Fellow (2008). code just for fun, and discussed learning, cyber social networks,
1977; PhD (Computer Science) ˲˲ IEEE Computer Society Taylor L. the awesome power of ubiquitous and invisible networks,
University of Arizona, 1981. Booth Education Award (2008). programs (that generate programs)*. cyber currencies, autonomous
˲˲ University of Virginia, Professor, ˲˲ UVA ACM Student Chapter Since then, I have had the privilege systems, wearable sensors, and
1982–present. Undergraduate Teaching Award to contribute to ACM’s mission cyber-enhancement of the body.
˲˲ President, Zephyr Software, (2000). in many capacities, most recently The benefits of these technologies
2001–present. ˲˲ NCR Faculty Innovation Award serving as co-Chair of ACM’s are undeniable.
˲˲ Princeton University, Visiting (1994). Publication Board. I am honored Unfortunately, such technologies
Professor, 1992–1993. to have been asked to stand for can have unanticipated negative
˲˲ Microsoft Research, Visiting Jack Davidson’s research interests election as President. consequences on basic human
Researcher, 2000–2001. include compilers, computer A nomination statement typically values of privacy, freedom,
˲˲ Programmer Analyst III, architecture, system software, discusses the challenges facing democracy, individual autonomy,
University of Texas Health embedded systems, computer ACM and the candidate’s plans to and quality of life. These
Science Center at Dallas, security, and computer science address those challenges. As I see technologies and the resulting
1993–1997. education. He is co-author of it, ACM is a vibrant volunteer-led systems are complex and their
two introductory textbooks: C++ organization in excellent financial integration into society cuts across
ACM and SIG Activities Program Design: An Introduction health. Each year thousands of geographic, cultural, gender, age,
˲˲ ACM member since 1975. to Object-Oriented Programming volunteers plan and carry out a and socioeconomic boundaries.
˲˲ ACM Publications Board and Java 5.0 Program Design: variety of activities and initiatives— It is only through international,
Co-Chair, 2010–present; ACM An Introduction to Programming organizing conferences, multidisciplinary efforts
Publications Board member, and Object-oriented Design. performing and publishing the involving academia, industry, and
2007–2010. Professionally, he has helped very best research in the field, government that these problems
˲˲ ACM Student Chapter Excellence organize many conferences across working to improve diversity can be addressed.
Award Judge, 2010–2017. several fields. He participated in the computing profession, ACM leadership is essential
˲˲ ACM Student Research in the organization of several and developing new education for initiating and facilitating
Competition Grand Finals Judge, international summer schools programs. These activities are these international collaborative
2011–2017. including the International carried out on a solid financial efforts. Our involvement would,
˲˲ Associate Editor, ACM TOPLAS, Summer School on Advanced footing. Non-profits normally seek as a side effect, strengthen
1994–2000. Associate Editor, Computer Architecture and financial reserves equal to one year ACM by creating a sense of
ACM TACO, 2005–2016. Compilation for Embedded of annual expenses. Our reserves global unity on important
Systems, the inaugural Indo-U.S. are approaching twice that. problems that affect us all. By
Member of SIGARCH, SIGBED, Engineering Faculty Leadership The most important challenges presenting a value proposition
SIGCAS, SIGCSE, and SIGPLAN. Institute held in Mysore, India, and I believe ACM must confront to the worldwide computing
˲˲ SIGPLAN Chair, 2005–2007. the First International Summer are outward rather than inward. community that is compelling,
˲˲ SIGPLAN Executive Committee, School on Information Security and I advocate we marshal our meaningful, and relevant, we can
1999–2001, 2003–2005 Protection held in Beijing, China. ample resources and dedicated become a more inclusive and
˲˲ SGB Representative to ACM Most recently he served as Program volunteers to help address the diverse professional society.
Council, 2008–2010. Chair for the HiPEAC 2018 held in important challenges facing Now is the time for ACM to use
˲˲ SGB Executive Committee, Manchester, U.K. society posed by the powerful its resources and the energy of
2006–2008. Davidson’s current research and pervasive digital technologies our volunteers to help address
focuses on cyber security and we are creating. In doing so, pressing societal problems
societal computing. He is PI on ongoing internal challenges— posed by emerging computing
two active research contracts to membership value, diversity, technologies. I ask for your vote,
secure critical infrastructure and inclusiveness—can continue support, and involvement.
autonomous vehicles. to be addressed—but addressed
from a more relevant platform.

14 COMMUNICATIO NS O F TH E AC M | M AY 201 8 | VO L . 61 | NO. 5

 acm election

candidates for

PRESIDENT
(7/1/18 – 6/30/20)

CHERRI M. PANCAKE
Professor Emeritus and Intel Faculty Fellow
School of Electrical Engineering & Computer Science
Oregon State University
Corvallis, OR
U.S.A.

Biography Statement
Cherri Pancake is Professor to make remote collaboration It’s exciting to be nominated The expansion of computing into
Emeritus and Director of and data sharing fit naturally for ACM president during a other fields has also introduced new
the Northwest Alliance for into typical patterns of scientific time of real change, within challenges for our profession. For
Computational Science and research and practice. our organization and in our example, in many settings it has
Engineering (NACSE), an A member of ACM since 1982, profession. I believe my become critical that computational
interdisciplinary research center Pancake has served in a wide variety experience in both has prepared results be reproducible. Bridging
known for software systems that of roles, including Vice President. me well for the role. I have the gap between ease of computing
analyze large-scale scientific data to Previously, she was Awards Co-Chair, served on ACM-wide committees and reproducibility requires
yield results that “make sense” to an elected member of ACM Council, and held the positions of Awards patient experimentation. When we
decision-makers. She is a Fellow of and area editor for Communications co-chair, Council member, and formed SIGHPC, one of our first
ACM and IEEE. of the ACM. She also led two ACM/ Vice President. Most of ACM’s actions was to join forces with the
Pancake started her career as an IBM industry advisory boards, activities occur at the level of Publications Board and other SIGs
ethnographer conducting fieldwork chaired the Gordon Bell Prize and SIGs and boards; I will leverage to promote reproducibility through
in Guatemalan Indian communities, Fellows committees, and has held my past work with conferences competitions, associating data
where she applied cross-cultural leadership roles in one of ACM’s sponsored by four different with Digital Library publications,
techniques to study social change. largest conferences since 1990. SIGs, in editorial positions, and and acknowledgment of outside
After earning a PhD in Computer Pancake’s efforts were as founder of one of the newest verification. As President, I hope
Engineering, she leveraged her instrumental in creating SIGHPC SIGs to help identify areas for to expand those efforts and extend
ethnographic expertise to address (Special Interest Group on High growth and renewal. Across the them to other audiences.
problems in computing. She was Performance Computing) and she international community, I’ve held I also believe ACM should do more
among the first worldwide to served as its first Chair. Under her leadership and advisory roles in in response to the growing demand
use ethnographic techniques to leadership, it grew to over 1,000 a number of research- and data- for computing professionals.
improve software usability, an members and achieved financial sharing collaborations, including As a field, we must attract new
approach which is now standard in viability in the first year, setting the Protein Databank, the people from diverse backgrounds,
the field. She also conducted much two records for ACM. In 2015, she Long-Term Ecological Research not just to fill the pressing need
of the seminal work identifying how obtained a $1.5M endowment Program, the National Biological but also to enrich the ideas and
the needs of scientists differ from from Intel to establish the SIGHPC/ Information Infrastructure, and processes used in computing
computer scientists. Intel Computational & Data the Network for Earthquake research, education, and practice.
She then turned to studying Science Fellowships, which to Engineering Simulation. I’ve seen several ACM boards
how “virtual collaborations”— date have provided $15,000/year Those experiences plus my and SIGs make great strides to
interactions that span large to 26 outstanding women and unique background—coupling increase the diversity of their
interdisciplinary and physically minority graduate students from anthropology with computer conferences, publications, and
distributed communities—differ seven countries. She is currently engineering—have given me the competitions, discovering that
from those where collaborators coordinating efforts to establish broad perspective needed for the relatively simple changes can
are physically co-located. Under a new competition designed to position of President. make a surprising difference.
her guidance, NACSE developed attract students to computing by I see great opportunities for ACM One of my goals as President is to
processes and software tools engaging them in data analysis and now that advanced capabilities, such ensure that these best practices
computation to address socially as machine learning, location-aware are shared across ACM.
relevant problems. computing, and wireless sensor In this time of change, ACM needs
networks, have become accessible a President with the experience and
to a broad spectrum of users in expertise to identify strategies that
many fields. As the leading society can broaden our base. With your
for computing, ACM is uniquely help and support, I believe I can
positioned to be the “glue” that joins do that.
emerging practitioner communities
with classical computer scientists.
I believe ACM must proactively
engage the new groups, providing
conference and publication
opportunities that will help drive
advances in their fields.

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF T HE ACM 15

acm election

candidates for

VICE PRESIDENT
(7/1/18 – 6/30/20)

MOSHE Y. VARDI
Professor in Computational Engineering
Director, Ken Kennedy Institute
for Information Technology
Rice University
Houston, TX
U.S.A.

Biography Statement
Moshe Y. Vardi is the Karen Ostrum He holds honorary doctorates Serving as Editor-in-Chief of Opportunity: A profound shift in
George Distinguished Service from the Saarland University in Communications of the ACM for the public view of computing has
Professor in Computational Germany, Orleans University in about a decade has offered me a taken place recently. Computing
Engineering and Director of France, UFRGS in Brazil, and unique opportunity to get a very was traditionally viewed as a source
the Ken Kennedy Institute University of Liege in Belgium. He broad view of computing and of innovation, economic growth,
for Information Technology served for a decade as the Editor- of ACM. ACM is facing today a good jobs, and cool gadgets. In the
Institute at Rice University. He in-Chief of Communications of significant challenge, I believe; at past few months, one reads in the
is the co-recipient of three IBM the ACM, and chaired the ACM the same time ACM has a unique mainstream media descriptions
Outstanding Innovation Awards, Job Migration Taskforce. Vardi’s opportunity to play a major of cyberspace as “a dark and
the ACM SIGACT Goedel Prize, the research interests focus on societal role. lawless realm where malevolent
ACM Kanellakis Award, the ACM automated reasoning, a branch Challenge: A quick examination actors ranging from Russian trolls
SIGMOD Codd Award, the Blaise of artificial intelligence with of ACM’s annual report indicates to pro-ISIS Twitter users could
Pascal Medal, the IEEE Computer broad applications in computer that scholarly publishing is work with impunity to subvert
Society Goode Award, the ACM science, including database theory, the financial mainstay of ACM. the institutional foundations of
Outstanding Contribution Award, computational-complexity theory, Publishing profits help ACM democracy.” Computing today is
and two ACM Presidential Awards. multiagent systems, computer- carry a wide area of activities. one of the greatest forces driving
He is the author and co-author aided verification, and teaching Yet, the emerging sense of the societal change, and computing
of over 500 papers, as well as two logic across the curriculum. scientific community is that professionals must accept their
books: Reasoning about Knowledge science publishing should be share of social responsibility. ACM
and Finite Model Theory and Its done under an open access model, is involved in several activities
Applications. which means that articles should related to social responsibility.
He is a Fellow of the Association be available to readers without Yet, these efforts are dispersed
for the Advancement of Artificial charge. ACM is under significant and lack coordination. ACM must
Intelligence, the Association pressure from its membership be more proactive in addressing
for Computing Machinery, to move from a subscription- social responsibility issues raised
the American Association for based publishing model to an by computing technology. An effort
the Advancement of Science, open access publishing model. that serves as a central organizing
the Institute for Electrical and Such a transition is exceedingly and leadership force within ACM
Electronic Engineers, and the challenging. A significant drop in would bring coherence to ACM’s
Society for Industrial and Applied ACM’s publishing revenue, which various activities in this sphere, and
Mathematics. He is a member of would threaten ACM’s financial would establish ACM as a leading
the U.S. National Academies of viability, is a risk that must be voice on this important topic.
Science and of Engineering, the taken seriously. ACM must engage
American Academy of Arts and with its membership to develop
Science, the European Academy of and carry out such a transition
Science, and Academia Europaea. plan, yet ACM has an obligation to
manage such a transition in a way
that protects the organization’s
financial viability and vibrancy.

16 COMM UNICATIO NS O F THE ACM | M AY 201 8 | VO L . 61 | NO. 5

 acm election

candidates for

VICE PRESIDENT
(7/1/18 – 6/30/20)

ELIZABETH CHURCHILL
Director of User Experience
Google
Mountain View, CA
U.S.A.

Biography Statement
Elizabeth Churchill is a Director The current Secretary/Treasurer I am honored to be nominated known worldwide as ‘the
of User Experience at Google. Her of the ACM, Churchill served on for ACM Vice President. association for computing
field of study is Human Computer the Executive Committee of the As the current Secretary/ sciences,’ not just the
Interaction and User Experience, ACM’s Special Interest Group on Treasurer of ACM, I am very American one.
with a current focus on the Computer-Human Interaction aware of the need to serve our ˲˲ Leveraging ACM’s existing
design of effective designer and (SIGCHI), for eight years, six membership effectively through programs and platforms to
developer tools. years of those as Executive judicious investment in the right underscore its place as the key,
Churchill has built research Vice President and two as Vice initiatives. As an industry applied lifelong professional network
groups and led research in a President for Chapters. She has research leader committed to for those involved in all aspects
number of well-known companies, also held leadership committee education, I believe ACM has of computer science. Drawing
including as Director of Human positions on a number of ACM a central role in academic and on the deep expertise of our
Computer Interaction at eBay SIGCHI associated conferences. practitioner development. membership whose work
Research Labs in San Jose, CA, as Churchill is a Distinguished Finally, I also believe ACM has an centers on social networking
a Principal Research Scientist and Scientist and Distinguished important leadership role to play offers ACM an unrivaled
Research Manager at Yahoo! in Speaker of the ACM, and a member when it comes to inclusiveness, opportunity to further develop
Santa Clara, CA, and as a Senior of the SIGCHI Academy. equality, equity, and ethics in all the social connectivity of all its
Scientist at PARC and before that Churchill earned her BSc. in computer sciences. members.
at FXPAL, Fuji Xerox’s Research lab Experimental Psychology and her If elected, I will be a strong voice ˲˲ Meeting increasing challenges
in Silicon Valley. MSc. in Knowledge Based Systems for deepening our efforts in the faced by the CS and
Working across a number of from the University of Sussex, U.K., following areas: technological world. Further
research areas, she has published and her PhD in Cognitive Science developing our commitment to
research, patented prototypes, from the University of Cambridge, ˲˲ Early-stage development and ethical, equitable computing
and taught courses at a number U.K. Her dissertation research career support of our field’s education and application,
of universities. She has more than focused on the design and future leadership. ACM and to the promotion of
50 patents granted or pending, development of Programmable membership currently skews diversity and inclusiveness in
seven academic books, and over User Models. After her PhD, she toward mid- to late stage CS education and practice, will
100 publications in theoretical was a Postdoctoral Research Fellow professionals. Initiatives benefit not only our members,
and applied psychology, cognitive at the University of Nottingham focused on early career but also society at large.
science, human-computer before leaving the U.K. and moving support, such as the Future of
interaction, mobile and ubiquitous to industry in 1997. Computing Academy in 2017, ACM is already a leader. From
computing, computer mediated will provide a solid foundation our Digital Library to our many
communication and social media. for growth and relevance for conferences, symposia, and
In 2016, she received the Citris- many years to come. other events, we provide an
Banatao Institute Athena Award ˲˲ Community development essential knowledge platform
for Executive Leadership. through broader global for the theoretical and applied
outreach efforts. Our computing sciences, and an
membership is globally unparalleled opportunity for
based, yet ACM is often academics and practitioners to
mistaken as an ‘American engage in lifelong learning and
association’ for computing community.
sciences. Greater focus on It would be my privilege, as ACM
relevant initiatives, programs, Vice President, to work with ACM
and promotions in the global staff and volunteers to ensure this
arena will ensure ACM is leadership continues.

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF T HE ACM 17

acm election

candidates for

SECRETARY/TREASURER
(7/1/18 – 6/30/20)

YANNIS IOANNIDIS
President and General Director
“Athena” Research & Innovation Center
Professor of Informatics & Telecom
University of Athens
Greece

Biography Statement
Yannis Ioannidis holds a PhD a member of Academia Europaea, The very concept of a scientific backgrounds, for example,
in Computer Sciences (Univ. of and a recipient of several research society is being challenged these computational or data scientists
California–Berkeley, 1986), an MSc and teaching awards, including days. If honored to be elected and practitioners.
in Applied Mathematics (Harvard Presidential Young Investigator as ACM Secretary/Treasurer, I It is also important that ACM
Univ., 1983), and a Diploma in (1993), UW Chancellor’s Teaching will use my past experience as a strengthens its role in computing
Electrical Engineering (National Award (1996), VLDB 10-Year Best volunteer in several roles to serve education at all levels globally,
Technical Univ. of Athens, 1982). Paper (2003). the community and help ACM starting with very young kids,
He is currently President and An ACM member since 1983, maintain and further strengthen so that they grow up well versed
General Director of the “Athena” he currently serves on the ACM its current position of scientific in algorithmic thinking (a
Research & Innovation Center in Europe Council (since 2017), the leadership and financial stability. fundamental skill) and possibly
Athens, Greece (since 2011) and a SIG Governing Board Executive In this direction, I believe ACM inspired to follow a relevant career
professor of Informatics & Telecom Committee (since 2012), and the should enrich and diversify in computing. In the long term,
at the Univ. of Athens (since 1997). ACM Publications Board as SGB its profile in at least three key this should largely eliminate most
Previously, he was a professor of liaison (since 2014). He has also dimensions: scientific areas ACM member underrepresentation
Computer Sciences at the Univ. of served four-year terms as vice- of concern, membership, and based on gender, geography, or age.
Wisconsin–Madison (1986–1997). chair and then chair of the Special conceptions of publication. Finally, in the new era of Open
His research interests include Interest Group on Management While remaining current on the Science, as a top-quality publisher,
database and information systems, of Data (SIGMOD). In 2017, purely technological advances ACM should be a pioneer again
data science, recommender he received the ACM SIGMOD in computing, ACM should and help redefine scholarly
systems and personalization, and Outstanding Contributions Award. significantly expand its scientific communication and the entire
electronic infrastructures. His Ioannidis is the Greek delegate domain and become the home research life cycle, under the
work is often motivated by data to the European Strategy Forum on of all interdisciplinary areas principles of reproducibility and
management problems that arise in Research Infrastructures (ESFRI) that involve computing, possibly accountability. It should treat
the context of other scientific fields and a member of its Executive through strategic alliances with software and data as first-class
(Life Sciences, Cultural Heritage Board. He is also a member of the peer scientific and scholarly publishable results, embed
and the Arts, Physical Sciences). He steering committee of the IEEE Int’l societies and appropriate joint all provenance artifacts in a
has published over 150 articles in Conf. on Data Engineering, and has activities. This will have the publication, and explore new review
leading journals and conferences served on several other professional added benefit of attracting new processes and access policies.
and also holds three patents. boards and committees, including members with non-traditional
Ioannidis is an ACM and IEEE the IEEE Technical Committee on
Fellow (essentially both “for Data Engineering and the VLDB
contributions to database systems, Endowment Board of Trustees.
particularly query optimization”),

18 COMM UNICATIO NS O F THE ACM | M AY 201 8 | VO L . 61 | NO. 5

 acm election

candidates for

SECRETARY/TREASURER
(7/1/18 – 6/30/20)

MEHRAN SAHAMI
Professor (Teaching) and Associate Chair for Education
Computer Science Department
Stanford University
Stanford, CA
U.S.A.

Biography Statement
Mehran Sahami is a Professor research at the intersection of the As a Life Member of ACM, I am goals while ensuring the financial
(Teaching) and Associate Chair learning sciences and computer honored to be nominated for viability of the organization.
for Education in the Computer science. Additionally, he was the position of Secretary/Treasurer. By pushing ACM to remain
Science department at Stanford co-founder and first Chair for the As Co-chair of the ACM Education relevant for younger academics
University. He is also the Robert annual Symposium on Educational Board, I’ve served on the Extended and practitioners, we can help
and Ruth Halperin University Advances in Artificial Intelligence Executive Committee of the to extend the membership base
Fellow in Undergraduate Education (EAAI), now in its 8th year. ACM for nearly four years. That and expand support for the
at Stanford. Prior to joining the Mehran’s research interests experience gives me a deep organization more globally.
Stanford faculty in 2007, he was include computer science appreciation for the issues facing Another responsibility of the
a Senior Research Scientist at education, artificial intelligence, the organization and provides Secretary/Treasurer is chairing
Google (2002–2007) and a Senior and Web search. He has published the opportunity to hit the ground ACM’s investment committee. I
Engineering Manager at Epiphany numerous technical papers, running in the new capacity of have over a decade of experience
(1998–2002). including the book Text Mining: Secretary/Treasurer. with investment stewardship,
Mehran is currently completing Classification, Clustering and My main goals are working including as an investor and
his second two-year term as Applications. He has over 20 to better serve the needs of limited partner in several venture
Co-chair of the ACM Education patent filings on a variety of topics the membership, specifically capital funds. As Secretary/
Board and Education Council, including machine learning, Web pursuing opportunities to push Treasurer, I would help ACM
helping to initiate and oversee search, recommendation engines for more open access models continue to develop agreements
educational activities for the ACM. in social networks, and email spam for publications, increasing with other organizations to
He co-chaired the ACM/IEEE-CS filtering that have been deployed in development of content relevant pursue our mutual goals.
joint task force on Computer several commercial applications. to practitioners, and more fully Previously, I helped create
Science Curricula 2013 (CS2013), He received the 2017 CIKM Test realizing ACM’s mission to be a agreements for joint projects
which was responsible for creating of Time Award, recognizing global association. Additionally, I between ACM and IEEE, AIS,
curricular guidelines for college outstanding papers published 10 or am concerned with the enormous and other computing societies.
programs in Computer Science more years ago that had a sustained enrollment growth in college CS I look forward to continuing to
at an international level. In 2014, impact on the research community. programs and am committed to serve as an ACM volunteer (in any
he received the ACM Presidential He received his BS, MS, and PhD exploring how ACM might be able capacity) and I appreciate your
Award for his leadership of this in CS from Stanford. And despite all to help educational institutions consideration. Thank you for
effort. He also co-founded and that, he still hasn’t figured out how better address this issue. Of course, reading this statement.
served as the first General Chair of to get his kids to brush their teeth the challenge is to pursue these
the ACM Conference on Learning at bedtime without a fuss.
at Scale, which has become an
annual meeting (now in its 5th
year) focused on interdisciplinary

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF T HE ACM 19

acm election

candidates for

MEMBERS AT LARGE
(7/1/18 – 6/30/22)

CLAUDIA BAUZER MEDEIROS NENAD MEDVIDOVIC’

Professor of Computer Science Professor of Computer Science & Informatics
University of Campinas University of Southern California
Brazil Los Angeles, CA
U.S.A.

Biography Statement Biography Statement

Claudia Bauzer Medeiros is full It is an honor to be nominated Nenad Medvidović is a professor in ACM serves a broad constituency
professor, Computer Science, at U. for Member at Large. I became an the Computer Science Department with divergent perspectives,
of Campinas (Unicamp), Brazil, with ACM member in 1983 as a PhD and in the Informatics Program interests, and needs. I have been
Brazilian and international awards student, and have not ceased to at the University of Southern involved with ACM and my home
for excellence in research, teaching, discover the many opportunities California (USC). Medvidović SIG—SIGSOFT—for almost 25
and work fostering the participation it offers—for learning, research, is the Founding Director of the years in a number of capacities: as a
of women in computing. She is a professional growth, and network- SoftArch Laboratory at USC. He volunteer, attendee, and presenter
Commander of the Brazilian Order ing. If elected, I would like to help has previously served as Director at ACM-sponsored conferences;
of Scientific Merit, and holds two expand some key activities along of the USC Center for Systems in various conference organizing
honorary doctorates from U. Antenor these lines. I look at ACM from at and Software Engineering (2009– and overseeing roles; and as Chair
Orrego, Peru, 2007, and U. Paris IX least three perspectives: as a (Latin 2013), Associate Chair for PhD of ACM SIGSOFT. During the past
Dauphine, France, 2015. For engag- American) academic; as an active Affairs in USC’s CS Department quarter-century, the computing
ing women in IT, she earned the player in creating and enforcing (2011–2015), and Chair of the community has grown and changed
Google Brazil Award and the Grace policies for universities and scien- Steering Committees for the two tremendously. Our field has become
Hopper Agent of Change Award. tific societies; and as someone who premier conferences in his field: global and interdisciplinary. Even
Her research is centered on man- has closely worked with and for ICSE — International Conference within SIGSOFT, our flagship
aging scientific data. In 1994, she several funding agencies in Brazil on Software Engineering (2013– conference, International
created Unicamp’s Laboratory of and abroad. 2015) and FSE — Symposium Conference on Software Engineering
Information Systems, one of the first Information technology is all per- on the Foundations of Software (ICSE), was held for the first time
labs in Brazil dedicated to interdisci- vasive. ACM should find new ways Engineering (2015–2017). He has outside the West only 10 years ago.
plinary data-intensive research. Since to raise awareness of ethical issues been the Program Chair for several Since then, we have gone to China,
1997, she has headed large multi- associated with computing research conferences, including ICSE South Africa, India, and Argentina.
institutional projects in biodiversity, and practices, not only among com- 2011. Medvidović has served as ACM’s future will be shaped by the
health, agriculture and environmen- puting professionals (handled by an Associate Editor of 10 different growth and globalization of comput-
tal planning, involving universities in its Code of Ethics), but also among journals. He is currently the Editor- ing. As an ACM Council Member at
Brazil, Germany, and France. those whose work requires some in-Chief of IEEE Transactions on Large, I will dedicate my energy to
One of the few Brazilians to kind of computing skills. Data and Software Engineering, a flagship help ACM in its efforts to embrace
become a Distinguished Speaker of algorithm ethics need to be better software engineering journal, as and facilitate these trends. I will rely
ACM, she is a member of IEEE, SIG- exploited, as do ethical concerns well as the Chair of ACM SIGSOFT. on my experience in expanding the
MOD, SIGSPATIAL and ACM-W and raised by other domains. Medvidović received his PhD reach of SIGSOFT into different geo-
has served as ACM-W Latin America My eScience research and work in 1999 from the Department of graphic regions and different seg-
ambassador and SIGMOD liaison. for funding agencies taught me the Information and Computer Science ments of the software engineering
While President of the Brazilian advantages (and pitfalls) of interdisci- at UC Irvine. He is a recipient of community. As illustrations of this
Computer Society (2003–2007), she plinarity. I would like to help promote the National Science Foundation experience, I chaired or participated
launched the first countrywide initia- mechanisms to foster this, both CAREER (2000) award, the Okawa in “Warm-up Workshops” for ICSEs
tives to draw women to computing, within computing fields and in our Foundation Research Grant (2005), held in South Africa and Argentina,
and liaised with funding agencies to work with other domains. We should the IBM Real-Time Innovation whose shared objective was to expose
create opportunities in CS research encourage interactions across SIGs, Award (2007), the USC Mellon Men- the local computing communities
and education. She has served as and open science initiatives. Cross- toring Award (2010), and Orange to SIGSOFT; I served as Program Co-
member and/or chair of scientific disciplinary collaboration should be County Engineering Council’s Chair of last year’s Indian Software
evaluation panels in Brazil, for the fostered early, and nurtured through- Distinguished Engineering Merit Engineering Conference; and in my
Ministries of Education and of Sci- out one’s career—through advocacy, Award (2018). Medvidović has over role as SIGSOFT Chair, I oversaw the
ence and Technology, and the São mentoring, and educational material. 200 publications in the area of soft- creation of CSoft, SIGSOFT’s Chi-
Paulo State Foundation (FAPESP). Last but not least, there is still ware engineering research. Several nese Chapter. I have also been active
Since 2013, she’s represented much to be done toward attracting of his publications have received in efforts to engage a larger cross-
FAPESP in a network of agencies women and minorities to computing, Most Influential Paper (a.k.a. “Test section of the professional software
from 12 countries, for research in particularly in Latin America. ACM of Time”), Best Paper, and Most community in the activities of
the Social Sciences and Humanities. should further promote inclusive- Cited Paper awards. He is a co- SIGSOFT, for example, through the
Since 2014, she’s coordinated the ness in the workplace and give more author of a textbook on software appointment of a SIGSOFT Industry
FAPESP eScience research-funding visibility to initiatives within ACM-W. system architectures. Medvidović Liaison. I believe these experiences
program to foster data- and/or To this end, cultural and social differ- is an ACM Distinguished Scientist make me well positioned to partici-
computing-intensive interdisciplin- ences must be carefully analyzed and and an IEEE Fellow. pate in and impact ACM Council’s
ary research. taken into account. important work.

20 COM MUNICATIO NS O F TH E ACM | M AY 201 8 | VO L . 61 | NO. 5

 acm election

candidates for

MEMBERS AT LARGE
(7/1/18 – 6/30/22)

PJ NARAYANAN THEO SCHLOSSNAGLE

Professor and Director Founder and CEO
IIIT Hyderabad Circonus
India Fulton, MD
U.S.A.

Biography Statement Biography Statement

Education: BTech in CSE (1984), I started volunteering for ACM from Theo Schlossnagle has spent the The ACM is dear to me; it represents
IIT Kharagpur; PhD in CS (1992) 2009 as a founding Co-Chair of last 20 years applying computer the industry I love and those that are
University of Maryland, College Park. ACM India Council, its first elected science to pressing problems positioned to build the technology
Employment: Lipi Indian language President, and the chair of its in industry. He founded four underlying our future. With eight
word-processor group of CMC Ltd.; Research Board. We set out to make companies all grounded in years of exposure to academia and
Research Faculty Member, Robotics ACM India the voice of the Indian large-scale distributed systems 20 years of intense, entrepreneurial
Institute of CMU (1992–1996); Head computing community. We set up technology. participation in industry I feel I have
of Vision and VR group, Centre for an ACM India Dissertation award, a Theo studied at The Johns a grounded perspective on how best
Artificial Intelligence and Robotics, survey on Indian PhD production, Hopkins University where he the ACM can serve its members.
DRDO; (1996–2000), Faculty member, an annual event attended by Turing received a BS in Computer Science My experience as co-chair of
IIIT Hyderabad (from 2000). Award Laureates as well as hundreds in 1997 and a MSE the following ACM’s Queue and participation
Contributions: Narayanan’s PhD of students, a student travel-support year related to his graduate on the ACM Practitioners
thesis was on parallel processing for scheme for conferences abroad, work. In 2003, he left academia Board provides immersion in
Computer Vision. At CMU he built an annual Research Summit for industrial pursuits prior to the parts of ACM that directly
Virtualized Reality, the first system to with Microsoft Research, and completing his doctorate. touch the largest portion of its
capture 3D representations of dynamic several education initiatives. ACM Beginning in 1996, Theo began membership: the practitioner.
events using cameras. He built a VR membership tripled in India from participating in various open ACM must represent the
resource center at CAIR, resulting in 2009, to become the second-largest source communities including practicing computer scientist in
applications of VR in DRDO. The IIIT country by membership. the Apache Software Foundation all of their various forms.
Vision group is among the world’s The impact of computing on life and in 1999 began a career in As ACM Member at Large, I will
largest, with over 100 researchers. continues to grow, with AI poten- public speaking on topics both aim to influence decisions to
Early work on using the GPU for tially enhancing and disrupting technical and professional. He consistently align them with
Vision and other tasks has influenced unimaginable aspects of life every- has contributed significantly to the needs of practitioners of today
the GPU-led deep learning revolution. where. The non-Western geogra- over 100 open source projects and tomorrow.
At IIIT, Narayanan was the first post- phies will have greater roles in com- and shared his experience with
graduate coordinator and the first ing years, with the growing access industry peers through over 200
Dean of Research. He was appointed to computing, communication, speaking engagements.
Director of IIIT in 2013. The insti- and social media. The positive and Theo authored Scalable Internet
tute has since established stronger detrimental impacts of computing Architectures, (Sams) and wrote
connections with industry and vital need to be understood also from a chapters for Web Operations
engagements with startups. TCS point of view of impoverished popu- (O’Reilly) and Seeking SRE (O’Reilly).
Foundation endowed a Kohli Centre lace, inadequate resources, and Having founded four
on Intelligent Systems, the largest AI deficient governments. Technology engineering-led organizations,
group in India, at IIIT in 2015. can be a strong force to promote his perspective on the computing
Narayanan was General Chair of equity and to lessen the gap. Teach- profession is both varied and
the 2nd Indian Vision conference (ICV- ers, researchers, and professionals well informed; a perspective
GIP) in 2000 and the Program Chair should keep in mind the human and formed by operating some of the
of ICVGIP2010 and ACCV2006. He social impact of each advancement. largest systems architectures on
was an SPC member or Area Chair of ACM will need to enhance and diver- Earth, on-call rotations as an Site
IJCAI2007, ICCVs (2007, 2011, 2015), sify its activities to enhance its influ- Reliability Engineer, developing
CVPR 2017; ACCVs (2007, 2009, 2010, ence in such a future. I will try to both open and closed software
2018), among others. He was on the make this happen from the Council. systems, hiring engineering
JPDC Editorial Board till 2017. Several experiences influence my staff, mentoring, and guiding
Narayanan helped establish ACM professional outlook: research roles professional development of staff.
in India as the founding Co-Chair and in USA/India; teaching, especially
the first elected President, 2012–2014. as the head of a top institution, in
He now leads the ACMI Research India; and voluntary activities for
Board and is active in creating a com- ACM and different academic/gov-
puting community within India. He ernment bodies. I believe my experi-
has also been on several committees ences can greatly help ACM traverse
related to research and education the future with greater balance. I
in India. pledge my efforts toward a more
relevant ACM.

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF T HE ACM 21

ACM
ON A MISSION TO SOLVE TOMORROW.

Dear Colleague,

Without computing professionals like you, the world might not know the modern
operating system, digital cryptography, or smartphone technology to name an obvious few.

For over 60 years, ACM has helped computing professionals be their most creative, connect
to peers, and see what’s next, and inspired them to advance the profession and make a
positive impact.

We believe in constantly redefining what computing can and should do.

ACM offers the resources, access and tools to invent the future. No one has a larger
global network of professional peers. No one has more exclusive content. No one
presents more forward-looking events. Or confers more prestigious awards. Or provides
a more comprehensive learning center.

Here are just some of the ways ACM Membership will support your professional growth
and keep you informed of emerging trends and technologies:

• Subscription to ACM’s flagship publication Communications of the ACM

• Online books, courses, and videos through the ACM Learning Center
• Discounts on registration fees to ACM Special Interest Group conferences
• Subscription savings on specialty magazines and research journals
• The opportunity to subscribe to the ACM Digital Library, the world’s
largest and most respected computing resource

Joining ACM means you dare to be the best computing professional you can be. It means
you believe in advancing the computing profession as a force for good. And it means
joining your peers in your commitment to solving tomorrow’s challenges.

Sincerely,

Vicki L. Hanson
President
Association for Computing Machinery

Advancing Computing as a Science & Profession

 SHAPE THE FUTURE OF COMPUTING.
JOIN ACM TODAY.
ACM is the world’s largest computing society, offering benefits and resources that can advance your career and
enrich your knowledge. We dare to be the best we can be, believing what we do is a force for good, and in joining
together to shape the future of computing.

SELECT ONE MEMBERSHIP OPTION

ACM PROFESSIONAL MEMBERSHIP: ACM STUDENT MEMBERSHIP:
q Professional Membership: $99 USD q Student Membership: $19 USD
q Professional Membership plus q Student Membership plus ACM Digital Library: $42 USD
ACM Digital Library: $198 USD ($99 dues + $99 DL) q Student Membership plus Print CACM Magazine: $42 USD
q ACM Digital Library: $99 USD q Student Membership with ACM Digital Library plus
(must be an ACM member) Print CACM Magazine: $62 USD

q Join ACM-W: ACM-W supports, celebrates, and advocates internationally for the full engagement of women in
computing. Membership in ACM-W is open to all ACM members and is free of charge.
Priority Code: CAPP
Payment Information
Payment must accompany application. If paying by check
or money order, make payable to ACM, Inc., in U.S. dollars
Name or equivalent in foreign currency.

ACM Member # q AMEX q VISA/MasterCard q Check/money order

Mailing Address
Total Amount Due

Credit Card #
City/State/Province
Exp. Date
ZIP/Postal Code/Country
Signature
Email

Return completed application to:

Purposes of ACM ACM General Post Office
ACM is dedicated to: P.O. Box 30777
1) Advancing the art, science, engineering, and New York, NY 10087-0777
application of information technology
Prices include surface delivery charge. Expedited Air
2) Fostering the open interchange of information Service, which is a partial air freight delivery service, is
to serve both professionals and the public available outside North America. Contact ACM for more
3) Promoting the highest professional and information.
ethics standards Satisfaction Guaranteed!

BE CREATIVE. STAY CONNECTED. KEEP INVENTING.

1-800-342-6626 (US & Canada) Hours: 8:30AM - 4:30PM (US EST) acmhelp@acm.org
1-212-626-0500 (Global) Fax: 212-944-1318 acm.org/join/CAPP
 The Communications Web site, http://cacm.acm.org,
features more than a dozen bloggers in the BLOG@CACM
community. In each issue of Communications, we’ll publish
selected posts or excerpts.

Follow us on Twitter at http://twitter.com/blogCACM

DOI:10.1145/3193752 http://cacm.acm.org/blogs/blog-cacm

Commenting on Code, a comment could convey its meaning.

5. Some companies require employ-

Considering
ees to comment their code. Google’s
programming style guides specify how
to write comments in programming lan-

Data’s Bottleneck guages like Java, JavaScript, and C++.

6. Specialized comments allow tools
like javadoc, JSDoc, and apiDoc to gen-
Edwin Torres considers the enduring value of code comments, erate professional, thorough, and con-
while Walid Saba wonders if we have overreacted to sistent documentation for programs.
7. Comments can be placeholders
the knowledge acquisition bottleneck. for future work, a useful way to create an
outline for a large program. The Eclipse
Integrated Development Environment
Edwin Torres commenting code, the arguments are (IDE) creates a TODO comment when it
Why Code Comments simplistic and general; comments are generates a main method, a reminder to
Still Matter necessary for a variety of reasons: add the starting code of a program.
http://bit.ly/2FgllP9 1. Not all programmers can write re- Commenting may be tedious or over-
February 26, 2018 ally obvious code. Beginning program- whelming, but it is valuable in many sit-
In computer science, mers are just happy to write a correct uations. Even if you think you write obvi-
you are taught to comment your code. program; they are still mastering the ous code, try reading your code months
When you learn a new language, you craft. Even experienced programmers or years later; will it still obvious to you,
learn the syntax for a comment in that write sloppy code. Programs are unique or would you wish for comments?
language. Although the compiler or like fingerprints, so judging whether
interpreter ignores all comments in a code is obvious is a subjective call. Comments
program, comments are valuable. How- 2. It can be tedious to comment too A key characteristic of comments is with
ever, there is a recent viewpoint that much, but some comments are like titles respect to narration, as Ward Cunningham
commenting code is bad, and that you and subtitles in articles; they guide, pro- has pointed out. It can be important to
should avoid all comments in your pro- vide context, and convey overall meaning. distinguish what the code is *for*, not just
grams. In the 2013 article No Comment: 3. Comments are not just for code; what it is, and what the key assumptions and
Why Commenting Code Is Still a Bad Idea, they can document important program constraints might be. It is valuable to develop
Peter Vogel continued this discussion. information such as author, date, li- a grasp for what the requirements are, and
Those who believe commenting cense, and copyright details. code is rarely a substitute for that.
code is a bad idea argue that comments 4. Some programming languages —Dennis Hamilton
add unnecessary maintenance; when are cryptic, like the Glass programming
code changes, you must also modify language. This sample program (http:// Dennis — That is a good point. There
comments to keep them in sync. They esolangs.org/wiki/Glass#Fibonacci_se- are times when you just need a quick
argue it is the responsibility of the pro- quence) is hard to decipher, but prints a overview of the code, without spending
grammer to write really obvious code, Fibonacci sequence. Is the meaning of time to trace through it. Comments help
eliminating the need for comments. Al- this program clear to you? It may be pos- here, assuming they are correct.
though these are valid reasons to avoid sible to write it in a more obvious way, but —Edwin Torres

24 COMM UNICATIO NS O F THE ACM | M AY 201 8 | VO L . 61 | NO. 5

 blog@cacm

There are many things we agree on. Peter — My goal was to highlight some thing, that induction is not a sound
I should, for example, point out that my additional needs for comments. I agree inference methodology—outside of
objection is to comments “in” code, not to that the “code doesn’t lie.” Also, too many mathematical induction, that is), in
comments at, for example, the start of a comments can be overwhelming and practice, it seems that avoiding the
method, that include the name of the author, distracting. I find it interesting that a knowledge acquisition bottleneck has
date created, and so on (though often, source discussion on comments even exists today. not resulted in any net gain. In the
control can automate that work). Who would’ve thought? world of data science, it seems data sci-
I also definitely agree with you that code —Edwin Torres entists spend more than half of their
at the start of a method should describe what time not on the science (models, algo-
the method is “for”—why the method exists That’s a great list of reasons to comment, to rithms, inferences, etc.), but on prepar-
or was written. This is something even really which I would add one more: what is obvious ing, cleaning, massaging, and making
obvious code often cannot communicate. At to *you*, the author of the code, probably sure the data is ready to be pushed to
best, really obvious code can communicate isn’t obvious to *me*, the reader. If you’ve the data analysis machinery—whether
the “how” of what the code does (though the been working on the feature you are building the machinery was SVM, deep neural
name of the method can sometimes help for the last week, you have spent that week networks, or what have you.
address what this code is “for”). building a mental model of that area of the Some studies indicate data scien-
We even agree about the need to problem domain and its mapping onto the tists spend almost 80% of their time
comment cryptic code. I will, however, software system. I do not have that model. on preparing data, and even after that
suggest that the problem should not be first Developers should try to empathize with the tedious and time-consuming process
addressed by writing a comment: it should developer who understands software, but is is done, unexpected results are usually
be first addressed by writing obvious code. new to *this problem*, and help improve their blamed by the data ‘scientist’ on the in-
If there is a bug in that Fibonacci generator understanding. adequacy of the data, and another long
or there’s a need to enhance it, clear code —Graham Lee iteration of data collection, data clean-
will help you find the bug or enhance the ing, transformation, massaging, and
code in a way that a comment cannot. I Graham — Great point. One of my earliest more, goes on. Given that data scien-
suggest we consider a comment, in this lessons in programming was that it is tists are some of the most highly paid
scenario, as an apology from the original much harder to change someone else’s professionals in the IT industry today,
programmer to the next one: “I did the best program than create your own. When used isn’t 80% of their time on cleaning and
I could but, for various reasons, I still ended effectively, comments can help here. preparing the data to enter the infer-
up with this unfortunate code. Here’s what I —Edwin Torres no something that should raise some
can do to help.” flags—or, at least, some eyebrows?
I like the idea of comments as headings Walid Saba Such techniques, even after the long,
to guide a programmer through the code. As Did We Just Replace tedious process of data cleaning and
a part-time technical writer, that especially the ‘Knowledge data preparation, still will be vulnerable.
appeals to me. Of course, I’m going to Bottleneck’ With a These models can be fooled by data that
suggest those comments (like headings) ‘Data Bottleneck’? is similar, yet it will cause these models
be only two or three words in length and, http://bit.ly/2tdSHfS to erroneously classify them. The prob-
perhaps, evidence that this method should February 26, 2018 lem of adversarial data is getting too
be refactored into several methods with One of the main reasons behind the much attention, without a solution in
their names reflecting those titles. But, in quantitative and data-driven revolu- sight. It has been shown that any ma-
many cases, I can see that being overkill. tion that took artificial intelligence (AI) chine learning model can be attacked
In fact, I will disagree with you in only by a storm in the early 1990s was the with adversarial data (whether an image,
one place: the idea that a programmer brittleness of symbolic (logical) sys- an audio signal, or text) and can make
who can’t write obvious code is, for some tems and their never-ending need for the classifier decide anything the attack-
reason, capable of writing a comment carefully crafted rules. The rationale er wants the classification to be, often by
that is (a) obvious, (b) accurate, and was that there is a knowledge acquisi- changing one pixel, one character, or
(c) complete. We hire programmers, tion bottleneck in the quest to build in- one audio signal—changes otherwise
after all, for their ability to write code, telligent systems. The new cliché? Let unnoticeable for a human.
not for their ability as technical writers. the system ‘discover’ the logic/rules by Maybe not everything we want is in
And if the comment isn’t accurate, crunching as much data as you can pos- some data distribution? Maybe we are
well, to paraphrase “The Elements of sibly get your hands on. With powerful in a (data) frenzy? Maybe we went a bit
Programming Style,” the code and its machine learning techniques, the sys- too far in our reaction to the knowledge
comments provide two descriptions of the tem will ‘discover’ an approximation acquisition bottleneck?
processing logic. If they disagree, only the of the probability distribution function
code is true. At this point, code that goes and will ‘learn’ what the data is, and Edwin Torres is a full-time software engineer at
The MITRE Corporation and an adjunct professor of
beyond describing what a method is for what it means, and will be ready for computer science at Monmouth University. Walid Saba
creates a maintenance burden of fixing the any new input hereafter. It all sounded is Principal AI Scientist at Astound.ai, where he works on
Conversational Agents technology.
comments to keep them in line with the good; too good to be true, in fact.
code. Programmers are busy enough. Notwithstanding the philosophical
—Peter Vogel problems with this paradigm (for one © 2018 ACM 0001-0782/18/5 $15.00

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF T HE ACM 25

N
news

Science | DOI:10.1145/3193743 Gregory Mone

Shrinking Machines,
Cellular Computers
Scientists are using DNA and RNA to build
the world’s tiniest robots and computing devices.

S
I N CE RE S E ARCH IN SYN TH E T -
began nearly
I C BI O LO G Y
two decades ago, the field
has expanded beyond its
original mandate of using
engineering principles to study and
manipulate cells. Today, scientists are
building biological computers and
DNA-based robots that can carry out
logical operations and complete tasks.
These miniscule machines look
nothing like laptops or Roombas.
Yet, algorithms still guide the robots
through tasks, and the biological com-
puters funnel inputs through logic
gates. While a standard circuit works
with electrical currents, though, the
IMAGE BY DEM IN LIU, COURT ESY O F C ALIFORNIA INST IT UTE OF T ECH NOLOGY

inputs in the biological version are bio-

chemical signals triggered by presence
of a protein or pathogen. The outputs,
in turn, are another set of biochemical
signals that trigger cellular responses,
such as the activation of a gene.
The potential applications vary
widely, ranging from reprogramming
immune cells to fight infections with-
out inducing harmful side-effects, to
triggering molecular robots in trash to
accelerate decomposition. However,
scientists caution that biological com-
Conceptual illustration of two DNA robots sorting cargo on a DNA origami surface by
puters and robots are still in their early transporting fluorescent molecules from initially unordered locations to separated
stages of development, in part because destinations.

26 COM MUNICATIO NS O F TH E AC M | M AY 201 8 | VO L . 61 | NO. 5

 news

the cellular environment is such a chal- nario, the walker moved along the sur-
lenging space. “You really need to be face by latching onto these tiny strands
an engineer to design them correctly,” “You really need of DNA, then transferring to the next
says Massachusetts Institute of Tech- to be an engineer one like a snake moving between tree
nology (MIT) synthetic biologist Chris- branches. As the robot attached itself
topher Voigt. “You have to understand to design [biological to each DNA strand, the bond triggered
the molecular biology, but you have to computers and another reaction that caused a mole-
think like an engineer.” cule to fluoresce. When the walker cov-
robots] correctly. ered enough of the surface and inter-
Computing Inside the Cell You have to understand acted with enough of the DNA strands,
While Voigt and many other scientists its fluorescence was bright enough to
prefer to use DNA as the building blocks molecular biology, be detected with a microscope.
of their biological computers, Arizona but you have to think Allen envisions building robots that
State University bioengineer Alexander lie dormant until they come into con-
Green and his colleagues at Harvard Uni- like an engineer.” tact with certain molecules or patho-
versity’s Wyss Institute for Biologically gens, which then spur them to move
Inspired Engineering have been build- and trigger the fluorescent signals.
ing RNA-based circuits. In their work, “You could put your DNA robots into
the design of the system is coded into grammable way to use RNA to do sim- a vial of blood and it would either light
DNA, which is then inserted into bacteria ple computations in living cells,” says up or not,” he says, “and you’d know if
as a ring of DNA called a plasmid. From Green. “We’re basically enabling cells the pathogen was there or not.”
here, the cell takes over, essentially con- to make very logical decisions.”
structing the computer by transforming Random Walks
the DNA into what Green calls gate RNA. DNA Robots Calling these machines ‘robots’ in their
These gate RNAs are folded in such Scientists building biological robots current form is slightly misleading,
a way that they only interact with the are making difficult decisions of their Allen concedes, but recent advances
cell’s ribosome to produce proteins own in determining how to construct suggest they eventually will be able to
when activated by additional strands. molecular machines that move and complete the kind of tasks normally
When one of these strands (the input) manipulate objects. For example, associated with large-scale robots; they
latches onto a gate RNA, the hybrid pair chemist Peter Allen of the University of just might not do so in the same way. For
then instructs the ribosome to produce Idaho and colleagues Andrew Elling- example, bioengineer Lulu Qian of the
a glowing protein (the output). ton of the University of Texas, Austin, California Institute of Technology and
Green refers to the system as a ribo- and Cheulhee Jung of Korea Universi- her colleagues recently demonstrated
computer, and envisions multiple ap- ty, first built a two-legged, DNA-based a DNA robot capable of sorting cargo.
plications, including a future version robot that could walk across a surface Given such a task, a standard electro-
that could be used to detect viruses littered with strands of DNA. mechanical robot would probably ex-
even if they mutate rapidly. For exam- Each of the robot’s legs was designed plore its space, pick up and attempt to
ple, if the gate RNA were programmed to be complementary to these anchor recognize each item, deposit an item in
to respond to two different types of vi- pieces of DNA—the particular sequenc- the right place, and then search for the
ral RNA (the inputs) associated with the es of Adenine, Thymine, Cytosine, and next one. “Obviously, it would be very
Zika virus, and to trigger the ribosome Guanine molecules on each were select- hard to program all that ‘intelligence’
to generate a glowing signal (the out- ed to bind to each other. For the robot into a single molecule,” Qian explains.
put) in the presence of one or the other, to move, its legs first had to latch onto So her group designed a robot that
then the ribocomputer would be using neighboring strands. One would un- completed the sorting task by following
the biological equivalent of an OR gate, bind and attach to another strand, then a random walk algorithm, with which
since either one strand of viral RNA or the next would follow. As each of the the robot does not remember where it
the other would stimulate the output. legs completed this action, releasing has been or recognize the cargo. In the
The most complex ribocomputer one strand and binding to a neighbor, experiment, the DNA robot moved on a
Green and his colleagues have devised the robot walked. The problem with this substrate covered with about 100 strands
so far can carry out 12 logic operations: approach, Allen explains, is that both of DNA, dubbed pegs. The cargo items,
five AND, five OR, and two NOT. In this strands could abandon their grip at the fluorescent molecules, were linked to
case, a variety of RNA inputs can inter- same time. “There was a chance that different pegs, and the robot’s job was
act with the gate RNA. An AND opera- both legs could detach and the walker to find them, pick them up, and deliver
tion is triggered when two complemen- could float away,” Allen says. them to the appropriate drop-off point.
tary inputs are present, for example. This glitch prompted Allen’s col- The robot consisted of a leg with two
Another set of RNA strands effectively league, Jung, to devise a single-legged feet (each a segment of a strand of DNA)
prevents other inputs from interact- DNA walker. The scientists took micro- and an arm with a hand. The segment
ing with the gate RNA, functioning as scopic plastic spheres and covered the of DNA on each foot was synthesized to
a NOT gate because it shuts down ac- surface with 10,000 strands of synthe- latch itself to the DNA on the pegs. When
tivity. “We have developed a very pro- sized DNA. As with the previous sce- one took hold, the other moved freely un-

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF T HE ACM 27

news

til it grabbed onto a neighboring strand that complex tasks, like cargo sorting, the research, Allen observes that the
of DNA; then the previous leg released can be accomplished with simple algo- potential is tremendous: “The idea of
and searched for its next mooring. rithms. “The simpler the algorithm,” being able to assemble matter at the
The robot’s hand was designed to she notes, “the more likely it can be atomic or molecular level and have
bind to strands of DNA attached to the carried out by simple molecules.” control over it at a rational level, that’s
fluorescent molecules, so when the The other key demonstration is the extremely appealing.”
robot bumped into a piece of cargo, importance of modularity in building
it would grab the molecule and con- these robots. Before the current experi-
Further Reading
tinue its random walk. Eventually, the ment, Qian’s group demonstrated the
robot would come across the drop-off viability of the walking robot using only Cameron, N.E., Bashor, C.J., and Collins, J.J.
A brief history of synthetic biology. Nature
point. Another segment of the cargo one leg and two feet. “We then showed
Reviews Microbiology, May 2014.
strand served as an identification tag, that adding an arm and a hand seg-
almost like a Universal Product Code. ment, without any changes to the leg Jung, C., Allen, P.B., and Ellington, A.D.
A stochastic DNA walker that traverses
The drop-off point recognized that seg- and foot segments, allowed the robot a microparticle surface. Nature
ment, latched on, and took the cargo to pick up and drop off cargos while Nanotechnology, February 2016.
strand and the fluorescent molecule at- moving around in random directions,” Thubagere, A.J., Li, W., Johnson, R.F., et. al.
tached to it. The robot then continued she explains. “This proof-of-concept A cargo-sorting DNA robot, Science,
its random walk. demonstration opens up future pos- Vol. 357, Issue 6356.
The entire experiment, which in- sibilities for developing additional Nielson, A.A.K., Der, B.S., Shin, J., et. al.
volved sorting six cargo items, required building blocks that can be added to Genetic circuit design automation, Science,
300 steps and 24 hours, so the work is the toolbox of DNA robots.” Vol. 352, Issue 6281.
not exactly designed for holiday fulfill- Eventually, that expanding toolbox
ment operations in an Amazon ware- could be used to develop new applica- Gregory Mone is a Boston-based science writer and the
co-author, with Bill Nye, of Jack and the Geniuses: At the
house. Yet Qian says there are several tions. While the scientists are hesitant Bottom of the World.
important, transferrable lessons com- to go into too much detail about these
ing from the experiment. The first is applications, given the early stages of © 2018 ACM 0001-0782/18/5 $15.00

Security

Quantum Computing: The End of Encryption?

Security researchers warn that Such nightmare scenarios— Lange agrees. “Sadly, none other researchers, while another
hackers are gobbling up encrypt- and many more—are Lange’s of the currently used public-key seven have been shown to have
ed data and waiting for the day stock in trade. She leads crypto—e.g., in https—is safe.” flaws, and still other methods sub-
when quantum computers will PQCRYPTO, a European research Researchers have made some mitted are considered question-
easily break their encryptions. consortium of 11 universities and progress on alternative encryp- able, according to Lange.
“Intelligence agencies are al- companies assembled by the Eu- tion technologies they believe Yet even methods that have
ready recording massive amounts ropean Commission and charged could defeat quantum comput- withstood extreme vetting have
of encrypted data sent over the with developing a preventative ers. Granted, they may not have a problem: preliminary tests in-
networks in the hope to success- solution to the looming threat of quantum computers to work with, dicate it takes longer to transmit
fully decrypt them with powerful widespread data theft. but they are able to extrapolate data over the Internet using these
quantum computers in a few PQCRYPTO operates under how quantum computers can newer encryption methods.
years,” says Tim Guneysu, chair the assumption that many of us neutralize today’s encryption, and The remaining challenge,
for security engineering at Ger- are likely to become victims of they have come up with alterna- Lange says, is for researchers
many’s Ruhr University Bochum. technology’s ongoing success if a tive encryption methods for the to develop a new encryption
High on the radar of the data solution to security in the age of quantum era. method that is both bulletproof
thieves: trade secrets, health quantum computers is not found. “While we do not have big, and practical.
records, criminal records, and any The group anticipates encryption scalable quantum computers yet, “The NIST competition is
other sensitive data hackers be- methods currently considered it is clear what operations they something that keeps the com-
lieve they will be able to sell, trade, impenetrable by individuals, can execute,” Lange says. “When munity busy right now, and on
or leverage in the quantum era. companies, and many govern- analyzing the security of proposed the attack and implementation
“Think of the secret recipe for ments—including the RSA public cryptosystems, we take these extra side, this is very much an ongoing
Coca-Cola, or blueprints for a su- key cryptosystem, and elliptic- operations into account.” project,” Lange says.
personic plane,” says Tanja Lange, curve cryptography (ECC)—could IT security researchers the Adds Daniel Gauthier, a profes-
chair of Cryptology at Eindhoven become child’s play to decrypt world over began engaging in a sor of physics at The Ohio State
University of Technology in the once quantum computers be- friendly competition sponsored University exploring secure Inter-
Netherlands. “Trade secrets are come hacker tools. by the U.S. National Institute for net communications via quantum
often held close by companies “RSA and ECC belong to the Standards and Technology (NIST) key distribution, “We really need
and never published or patented.” class of asymmetric cryptography late last year to develop encryption to be thinking hard now of differ-
Also, “Identifying dissidents that is known to be broken by alternatives. Lange says 69 new ent techniques that we could use
and decrypting their commu- tomorrow’s quantum computers,” encryption methods have been for trying to secure the Internet.”
nication will be worthwhile to Guneysu says. “Hence, for both submitted so far. —Joe Dysart is an Internet
some regimes, even years later,” schemes, we need replacements These new encryption meth- speaker and business consultant
says Lange. as soon as possible.” ods have withstood the scrutiny of based in Manhattan, NY, USA.

28 COMMUNICATIO NS O F TH E ACM | M AY 201 8 | VO L . 61 | NO. 5

 news

Technology | DOI:10.1145/3193776 Neil Savage

Using Functions for

Easier Programming
Functional programming languages automate
many of the details underlying specific operations.

A
S COMPUTERS BECOME Object-Oriented Functional
more powerful and the
Data and the operations upon it are tightly Data is only loosely coupled to functions.
programs that run them coupled.
grow more complex, pro-
grammers are increasingly Objects hide their implementation of operations Functions hide their implementation, and the
from other objects via their interfaces. language’s abstractions speak to functions and
trying to make their lives easier by turn-
the way they are combined or expressed.
ing to an idea that dates to the early days
of computer languages, an approach The central mode for abstraction is the data The central mode for abstraction is the function,
itself, thus the value of a term isn’t always not the data structure, thus the value of a term
called functional programming. predetermined by the input (stateful approach). is always predetermined by the input (state-
“Functional programming’s on less approach).
a long steady burn, starting 30 or 40
The central activity is composing new objects The central activity is writing new functions.
years ago,” says Simon Peyton Jones, and extending existing objects by adding new
a researcher at Microsoft Research in methods to them.
Cambridge, U.K., where he focuses on
the functional language Haskell. kind of software we write tends to be a ing the same data at the same time,
Programming languages break down lot more complicated, so some of these one processor may alter the input to
into broad categories. There are impera- small performance issues are not nearly the other; if that happens in the wrong
tive languages, which say, “do this, then as important. What’s important is that order or at the wrong time, the results
do that,” specifying a series of steps to you manage to put all the pieces togeth- could be incorrect. In functional pro-
accomplish a task. Functional languag- er and get the program to work.” gramming, each processor would only
es, on the other hand, rely on functions, Higher-level languages are more need to read the original data, which
which are mathematical operations. productive, says Sergio Antoy, Textron- would remain unaltered.
“A function is just basically a piece ics Professor of computer science at The fact that the computational
of an algorithm,” says Iavor Diatchki, a Oregon’s Portland State University, in state of the system does not change
senior research and development engi- the sense that they require fewer lines makes it easier to understand what
neer at Galois, a software company in of code. A program written in machine exactly a program is doing, says An-
Portland, OR. “It’s something that you language, for instance, might require toy. “It’s more difficult to reason about
can give some inputs and it computes 100 pages of code covering every little computation in which there is a state,”
some outputs.” For instance, “plus” is detail, whereas the same program he says. Object-oriented imperative
a basic function; it says to take two inte- might take only 50 pages in C and 25 in languages such as C, Java, or Python
gers and combine them to produce one Java, as the level of abstraction increas- change their state as they run. “If you
integer as a result. es. In a functional language, Antoy says, have a computation in which you have
Functional languages operate at a the same task might be accomplished variables that can change over time,
higher level of abstraction, automating in only 15 pages. when you reason about this you don’t
a lot of the details that underlie a par- Additionally, the less a developer know what the value of the variable is at
ticular operation. That makes it easier writes, the less opportunity he has to in- that time, so it’s like shooting a moving
to write programs quickly. Years ago, clude something that causes a problem. target. You want to reason about some-
when computers were slower, that ease “As you remove details, you remove the thing and things keep changing.”
TA BLE CONTENT COURTESY OF BEL ATRIXSF.COM /BLOG

came with a cost, Diatchki says; the pro- potential for error,” Antoy says. Higher- Because the state does not change,
gram’s default steps were not always the level languages also lead to programs functional languages are attractive for
most efficient, and a programmer could that are easier to modify if the underly- programs that require a high level of
make it run better by taking the time ing machine architecture changes. security, such as those used by finan-
to tweak the details. That has changed. Another important aspect of func- cial institutions, where functional pro-
“Computers are a lot faster, so things tional programming is that functions grams are becoming increasingly popu-
like that don’t matter all that much,” do not change the data with which lar, says Philip Wadler, a professor of
says Diatchki, who argues that mak- they work. Having immutable data theoretical computer science at the Uni-
ing better use of a programmer’s time makes it easier to do parallel process- versity of Edinburgh in the U.K. and one
has become more important. “Also, the ing. If two processors are manipulat- of the creators of Haskell. “You need to

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF T HE ACM 29

news

be able to write a program pretty quickly mulates what it returns, presenting the seems to be blurring the line between
and still have high assurance it’s going search results as a new page. writing the program and verifying it.”
to do what you expect,” Wadler says. For Facebook uses Haskell to filter spam The style also lends itself to new
instance, the New York-based interna- from postings. Microsoft supports F#, a variations. Antoy and Michael Hanus,
tional trading firm Jane Street Capital dialect of Ocaml, in its Visual Studio de- a professor of computer science at the
uses Ocaml, a dialect of ML, one of the velopment environment. A functional University of Kiel, Germany, are study-
earliest functional languages. language developed by industry, Erlang, ing functional logic programming,
Wadler is also a senior research fel- was created by the Stockholm, Sweden- which adds a concept called determin-
low for IOHK, a Hong Kong-based com- based telecommunications company ism. That allows them to attack prob-
pany designing cryptocurrency, a digital Ericsson for telephone systems and lems where no precise algorithm is
form of money of which bitcoin is the now is used to build scalable real-time known, and some trial and error is re-
most well-known example. The ease systems for banking, e-commerce, and quired. “This is quite convenient when
of creating and validating programs instant messaging; the messaging and you have to compute with partial or
written in functional languages makes Voice-over-IP program Whatsapp is incomplete information,” Antoy says,
them than appealing for such appli- written in Erlang. or when getting precise and complete
cations, Wadler says. “There’s a huge information is inconvenient.
amount of money that’s at stake there.” Laboratory Space Peyton Jones believes functional pro-
Peyton Jones sees functional program- gramming is becoming more popular as
Matter of Opinion ming as a laboratory for trying out new more developers learn about it. Eventu-
Just what counts as a functional lan- ideas in programming that then find ally, he says, its distinction from impera-
guage can be open to interpretation. their way into other languages. “Func- tive languages will all but evaporate, as
“Haskell and ML are widely considered tional programming has been an effec- the useful features of one approach seep
to be functional. Languages like C++ tive seedbed of ideas,” says Peyton Jones. into the other. “They are kinds of ends
or C and even Java are considered to “It started off extremely impractical, but of the spectrum that are converging,” he
be imperative,” Diatchki says. “Then nevertheless intellectually appealing, says. “When the limestone of imperative
there are languages like Scala, which and that very practicality forced a series programming has worn away, the gran-
sort of depends on who you talk to of ideas to come to the surface that have ite of functional programming will be
whether they’re functional or impera- then turned out to be useful much more revealed underneath.”
tive, because they support both styles.” broadly.” For instance, garbage collec-
Often, programmers choose the style tion, an automated approach to manag-
Further Reading
that suits them best, or even employ ing memory, started out in functional
both in different parts of their code. programming but has since been more Diatchki, I.S., Hallgren, T., Jones, M.P.,
Leslie, R., and Tolmach, A.
To Diatchki’s thinking, imperative widely adopted. It has also been a test-
Writing systems software in a functional
languages are more like recipes, lay- bed for static type checking, which looks language: An experience report
ing out a series of steps to accomplish through the program for errors before PLOS 2007
a task, while functional programming runtime and can vastly reduce the num- http://yav.github.io/publications/plos07.pdf
is more like a calculator, except that it ber of bugs in a program. Antoy, S. and Hanus, M.
manipulates more than just integers. In fact, Peyton Jones says, there is a Functional Logic Programming, CACM 43,
“You type in a big expression and say, lot of work among functional program- April 2010, doi:10.1145/1721654.1721675
‘what is the result now?’” He would not ming researchers on developing richer Bernardy, J-P., Boespflug, M., Newton, R.,
consider a language functional, he says, type systems, which verify the accuracy Peyton Jones, S., and Spiwack, A.
unless it treated functions as ‘first-class of a program. The theorem prover Coq Linear Haskell: Practical linearity in a
higher-order polymorphic language,
citizens’; in other words, the functions is a dependently typed functional lan- Proceedings of the ACM on Programming
can be used as arguments for other guage able, because of its type struc- Languages 2, 2017
functions, and be returned as values by ture, to verify mathematical statements, https://www.microsoft.com/en-us/research/
still other functions. though it is difficult to write programs publication/retrofitting-linear-types/
While much of the work in func- in, he says. Vazou, N., Choudhury, V., Scott, R.G., Newton,
tional programming originated with He sees functional programming P.R., Wadler, P., and Jhala, R.
academia—Haskell was created in 1990 moving toward formal verification, giv- Refinement reflection: Complete verification
with SMT
by academics who were doing much ing developers greater confidence a pro- Principles of Programming Languages
the same work, but needed a common gram will do what it is designed to do. (POPL), Los Angeles, 8—13 January 2018.
language to share their findings—it is “The more people care about reliability, https://dl.acm.org/citation.
increasingly finding a place in indus- about knowing that something is true, cfm?doid=3177123.3158141
try. For instance, Google’s MapReduce, that money depends on it or people’s Functional Programming and Haskell
used for searching the Web, draws lives depend on it, the more they’re go- https://www.youtube.com/
heavily on ideas from functional pro- ing to care about this,” Peyton Jones says. watch?v=LnX3B9oaKzw
gramming, Wadler says. Map applies a Of course, Diatchki says, it is not
Neil Savage is a science and technology writer based in
function to a large collection of data— only functional programmers who care Lowell, MA, USA.
finding instances of a term on scattered that what they write works correctly.
Web pages, say—and reduce then accu- “It’s just that functional programming © 2018 ACM 0001-0782/18/5 $15.00

30 COMM UNICATIO NS O F THE AC M | M AY 201 8 | VO L . 61 | NO. 5

 news

Society | DOI:10.1145/3193759 Samuel Greengard

Finding a Healthier
Approach to Managing
Medical Data
Researchers are exploring ways to put medical data
to greater use while better protecting privacy.

O
NE OF THE formidable chal-
lenges healthcare providers
face is putting medical data
to maximum use. Some-
where between the quest to
unlock the mysteries of medicine and
design better treatments, therapies, and
procedures, lies the real world of apply-
ing data and protecting patient privacy.
“Today, there are many barriers to
putting data to work in the most ef-
fective way possible,” observes Drew
Harris, director of health policy and
population health at Thomas Jeffer-
son University’s College of Population
Health in Philadelphia, PA. “The goals
of protecting patients and finding an-
swers are frequently at odds.”
It is a critical issue and one that protect patient data. These meth- a variety of other sensors, machines,
will define the future of medicine. ods revolve largely around machine and systems are pushing the boundar-
Medical advances are increasingly de- learning, integrating blockchain into ies of medicine in new directions. As
pendent on the analysis of enormous electronic healthcare records (EHRs) a result, researchers, physicians, and
datasets—as well as data that extends and other systems, and finding other other practitioners—using big data
beyond any one agency or enterprise. ways to anonymize data, validate re- analytics and machine learning—can
What’s more, as connected health- cords, and prevent data leaks. “We spot patterns, trends, and causalities
care devices flourish, at-home and must strike a balance between data that would otherwise escape human
remote monitoring blossoms and big ownership, interoperability, security, detection. This makes it possible to
data analytics advances at a stagger- and dynamic consent for patients, so improve therapies, procedures, and
ing rate, the stakes—and the ability to that data can be used and shared at drugs, while improving diagnostics
use, misuse, and abuse confidential the right times and under the right and care for individual patients.
data grows significantly. circumstances,” says Jim Nasr, chief Yet the risks are also enormous—
“Healthcare is at a very important software architect for the Centers for and they are magnified by the fact that
crossroads. To move to a more value- Disease Control and Prevention (CDC). there are no clear boundaries for what
LIF EOGRA PH Y DASH BOA RD. IMAGE C OURTESY OF UMBRA H EA LTH .

based framework and one that rewards constitutes appropriate or inappropri-

patient and doctor behavior, we need to Beyond Data ate use. In some cases, it’s possible
have systems in place that manage data The level of disruption rippling to trace aliases, codes, and metadata
and protect individuals,” says Ophir through the healthcare industry is stag- used for anonymous tracking back to
Frieder, professor of computer science gering. According to research firm IDC, individuals. At the same time, a sub-
and information processing at George- the overall volume of data in the indus- stantial amount of health data—par-
town University in Washington, D.C., try will increase from 153 exabytes in ticularly information from activity
and professor of biostatistics, bioin- 2013 to 2,314 exabytes in 2020. trackers, website searches, and credit
formatics, and biomathematics at the There also is a greater variety of card records—remains unregulated
Georgetown University Medical Center. data to manage. Electronic healthcare in the U.S. and many other countries.
Make no mistake, researchers are records, personal fitness devices, con- Because all this data falls outside the
exploring ways to better manage and nected home monitoring systems, and scope of the U.S. Health Insurance Por-

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF T HE ACM 31

news

tability and Accountability Act (HIPAA), through heuristic selection of samples.

data scientists can circumvent privacy Such a model can also help guide cau-
protections by combining publicly “There are almost sality, though it can also reflect biases
available data with anonymized data to no standards for data. and introduce or amplify human errors.
gain deep insights into personal behav- By combining cross-functional ex-
ior and health. As a result, doctors pertise, it also is possible to explore
Marketers and companies looking rarely have access data models in entirely different
to target consumers can tap into this ways—all while maintaining tight se-
data. “The result is a blizzard of trans- to a complete curity and privacy controls through
actions hidden to the public in which and accurate a tool such as blockchain. The goal
companies (called data miners) buy, is a glass-box approach to data pro-
sell, and barter anonymized but inti- medical record.” cessing. “It introduces the concept
mate profiles of hundreds of millions of explainable medicine. A medical
of Americans,” says Adam Tanner, who doctor can retrace what a certain al-
authored a 2017 report for The Cen- gorithm has done, and this may pro-
tury Foundation, Strengthening Protec- vide insight that ultimately delivers a
tion of Patient Medical Data. “While the urgency. For instance, the General medical explanation,” Holzinger says.
the anonymization of patient data may Data Protection Regulation (GDPR) At the CDC, Nasr and an accelera-
seem like a good firewall for protect- in the European Union requires any tor development team are building a
ing privacy, it increasingly is not.” In organization handling data for even software framework that incorporates
fact, Tanner says, “Data scientists can a single European citizen to abide by blockchain to integrate disparate sys-
now circumvent HIPAA’s privacy pro- strict privacy guidelines, or risk a sub- tems used to address public health
tections by making very sophisticated stantial fine. In Japan, a law introduced issues such as opioid abuse and infec-
guesses, marrying anonymized patient last year requires stricter controls over tious disease. Blockchain would guar-
dossiers with named consumer profiles how healthcare providers manage antee the anonymous data is accurate,
available elsewhere—with a surprising data. While all electronic healthcare re- and that it comes from a legitimate
degree of accuracy.” cords must be searchable for academic source. This is critical because differ-
Says Andreas Holzinger, profes- researchers, drug companies, and oth- ent groups and agencies—across a
sor of machine learning at the Medi- ers, facilities must make the data com- spectrum of public and private enti-
cal University of Graz in Austria and pletely anonymous. ties—must share data feeds and data-
founder and lead of the university’s Holzinger is developing a human-in- bases while ensuring errors, intention-
Human-Computer Interaction and the-loop machine learning approach al or inadvertent, are not introduced
Knowledge Discovery and Data Mining that offers a high level of data trace- into the data stream.
(HCI-KDD) group. “Healthcare data ability, and the ability to explain how “We need to have greater flexibility
represents enormous value to both the system arrives at a conclusion. “We than current data service architectures
legitimate businesses and the hacker must understand how and why an algo- provide,” Nasr explains.
community.” For example, employers rithm makes decisions and that data At the center of this emerging model
could potentially use private medical is verifiable. Consequently, we have to is a simple but profound issue, he says.
and healthcare data to guide decisions move beyond a black box approach to “We must be able to effectively commu-
about hiring and firing. Insurance have full confidence that data is accu- nicate software decisions and direction
companies could use personal data to rate and systems work as advertised,” to a large customer base of physicians,
make coverage and pricing decisions, he explains. epidemiologists, and public health ex-
and individuals could find the public The central problem Holzinger is perts. We have to ensure large numbers
release of personal health data embar- attempting to address is that medi- of disparate groups working on uncon-
rassing or costly in other ways. “If we cal data is intrinsically complex, high- nected, separately funded, contract-
are unable to protect people but at the dimensional, and noisy, and contains based projects can access, share, and
same time enable the use of data in an much unstructured information. A process data efficiently.”
appropriate manner, we risk the public prime example is the use of Gaussian Nasr has his sights set on design-
losing confidence in the system and processes, where automated machine ing an interoperable software frame-
medical researchers losing opportuni- learning (aML) systems with standard work that can tie together databases,
ties to solve problems,” Holzinger says. kernel machines attempt to find an- IoT devices, and more. The approach
swers through stochastic modeling. uses open source software, deployed
Protection Schemes These systems struggle with basic ex- through Docker containers, to create a
The need for more sophisticated re- trapolation functions that remain very mesh of functions and applications—
search methods and controls is rede- simple for humans. Nasr calls this the “Software Theme
fining healthcare. Researchers are ex- An interactive machine learning Park”—that can be connected and re-
ploring new and more sophisticated (iML) model, on the other hand, allows arranged to address broad data ana-
ways to collect, manage, and exchange a researcher, doctor, or other expert in lytics requirements. These functions
data. In addition, regulatory require- the loop to select specific parameters could carry out much of what is needed
ments in many countries are adding to or reduce an exponential search space for public health data surveillance, in-

32 COMMUNICATIO NS O F TH E AC M | M AY 201 8 | VO L . 61 | NO. 5

 news

cluding automatically validating anon- Of course, the ultimate challenge Milestones

ymous data from different sources
and across different application pro-
is to ensure these next-generation
systems and processes make data ACM
gramming interfaces (APIs). The key,
Nasr says, is standard-definition APIs
widely accessible, while locking it
down. The goal is to mine data to Bestows
regulated through an API gateway. This
makes it possible to verify data across
the extent possible, but protect per-
sonal privacy.
Turing
local, state, federal, and international
agencies, as well as private organi-
For now, many questions remain
about who should hold and maintain
Award,
zations and other third-party data
sources. The end result is a “robust in-
blockchain ledgers, who should be
granted privileges to modify or view
Prize in
formation supply chain,” he says. data, and how identities should be Computing
managed and displayed on a block- At press time, ACM announced
For the Records chain. No clear consensus or direction the names of this year’s
Finding ways to improve healthcare at has emerged. recipients of its most
the patient level is also at the center of Nevertheless, the future of health- prominent awards.
The A.M. Turing Award,
this revolution in informatics. George- care is clear: “We need greater porta- ACM’s most prestigious
town’s Frieder, who also serves as chief bility of data, greater interoperability technical award, is given for
scientific officer for Umbra Health, has between systems, and a more coordi- major contributions of lasting
importance to computing.
developed a framework for connecting nated approach to patient care,” Har-
This year’s ACM A.M. Turing
and merging disparate medical data ris says. “As we incorporate fitness Award is being presented to
automatically while protecting the devices, medical monitoring devices, John Hennessy, executive
identity of patients. The system allows and more advanced analytics, systems chairman of Alphabet Inc.,
Google’s parent company,
authorized healthcare practitioners— must address the often-competing in- and David Patterson, Pardee
doctors, dentists, therapists, nutrition- terests of putting data to maximum use Professor of Computer Science,
ists, and others—to access EHRs and but also protecting it.” Emeritus, at the University of
view only the specific information they California at Berkeley (and
a past president of ACM)
require to do their jobs. “for pioneering a systematic,
Further Reading
Frieder’s motivation? Medical errors quantitative approach to
account for about 250,000 deaths a year Holzinger, A. the design and evaluation
Beyond Data Mining: Integrative Machine of computer architectures
in the U.S. alone, according to a 2016 with enduring impact on the
Learning for Health Informatics. April,
study conducted by Johns Hopkins Med- 2016; https://online.tugraz.at/tug_online/ microprocessor industry.”
icine. In addition, errors account for voe_main2.getVollText?pDocumentNr=1347 The ACM Prize in
many other injuries and therapy failures 744&pCurrPk=89271. Computing (formerly the
ACM-Infosys Foundation Award
globally. “Part of the problem is incon- Holzinger, A. in the Computing Sciences)
sistent systems and processes. There are Machine Learning for Health Informatics. recognizes an early to mid-
almost no standards for data. As a result, ML for Health Informatics, LNAI 9605, pp. career fundamental innovative
1–24, 2016; https://pure.tugraz.at/portal/ contribution in computing that,
doctors rarely have access to a complete
files/7615225/HOLZINGER_2016_Machine_ through its depth, impact, and
and accurate medical record.” Learning_for_Health_Informatics.pdf. broad implications, exemplifies
The approach, which the compa- the greatest achievements in
Aitken, M., de St. Jorre, J., Pagliari, C., Jepson, the discipline.
ny calls Lifeography, ties a person’s R., and Cunningham-Burley, S. This year’s ACM Prize
data together in a secure cloud-based Public responses to the sharing and linkage in Computing is being
HIPAA-compliant environment. It har- Of health data for research purposes: a presented to Dina Katabi of
nesses blockchain to create a traceable systematic review and thematic synthesis of the Massachusetts Institute of
qualitative studies. BMC Medical Ethics, Vol. Technology Computer Science
ledger that spans healthcare touch-
17, No. 1. Jan. 12, 2016. and Artificial Intelligence
points. Frieder says the system serves Laboratory for her creative
as a lingua franca for healthcare data, Prater, V.S. contributions to wireless
Confidentiality, Privacy and Security of systems. Katabi applies methods
and delivers a longitudinal view from Health Information: Balancing Interests. from communication theory,
birth to death. The software framework Dec. 8, 2014. https://healthinformatics. signal processing, and machine
delivers only the data the patient and uic.edu/resources/articles/confidentiality- learning to solve problems in
attendant providers deem necessary privacy-and-security-of-health-information- wireless networking.
for a specific interaction or transaction balancing-interests/ These awards will be
presented at the ACM Awards
and strips out any unnecessary person- Johns Hopkins Medicine, News Release,
Banquet in San Francisco in June.
al information, while also providing a Study Suggests Medical Errors Now Third Communications will provide
Leading Cause of Death in the U.S., May 3, in-depth coverage of these
forensic trail of users and devices. The 2016; http://bit.ly/2BeXY5T award recipients in upcoming
end goal is to deliver “more precise
issues, beginning with
orders, more accurate diagnoses, and Samuel Greengard is an author and journalist based in interviews with Hennessy and
more coordinated healthcare, includ- West Linn, OR, USA. Patterson in the June issue.
ing predictive and preventative capa- —Lawrence M. Fisher
bilities,” he says. © 2018 ACM 0001-0782/18/5 $15.00

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF T HE ACM 33

V
viewpoints

DOI:10.1145/3199599 Ryan Calo

Law and Technology

Is the Law Ready for
Driverless Cars?
Yes, with one big exception.

I
AM A law professor who ies or catch up on email while travel- are allowed—or even mandated—on
teaches torts and has been ing in the vehicle. Notwithstanding public roads.
studying driverless cars for some handwringing by pundits and Courts will have to determine who
almost a decade. Despite the legal academy, courts have little is responsible in situations where a hu-
the headlines, I am reason- trouble sorting out who is liable for man or a vehicle could have intervened
ably convinced U.S. common law the occasional driverless car crash. but did not. On the one hand, courts
is going to adapt to driverless cars When someone creates a product tend to avoid questions of machine lia-
just fine. The courts have seen hun- that is supposed to move people bility if they can find a human opera-
dreds of years of new technology, around safely and instead crashes, tor to blame. A court recently placed
including robots. American judges judges assign liability to whoever the blame of an airplane accident ex-
have had to decide, for example, built the vehicle or vehicles involved clusively on the airline for incorrect-
whether a salvage operation exer- in the accident. ly balancing the cargo hold despite
cises exclusive possession over a There are some difficult cases on evidence the autopilot was engaged
shipwreck by visiting it with a robot the horizon. Policymakers will have to at the time of the accident. 7 On the
submarine (it does) and whether a determine just how much safer driv- other hand, there is presumably a
robot copy of a person can violate erless cars will need to be compared limit on how much responsibility
their rights of publicity (it can). to human-operated cars before they a company can transfer to vehicle
Assigning liability in the event of owners merely because they clicked
a driverless car crash is not, in the on a terms of service agreement. In
run of things, all that tall an order. There are some the fatal Tesla crash last year, the
There is, however, one truly baffling deceased driver seemingly assumed
question courts will have to confront difficult cases the risk of engaging the autopilot.
when it comes to driverless cars—and on the horizon. The pedestrian killed this year by
autonomous systems in general: What an Uber driverless car took on no
to do about genuinely unforeseeable such obligation. In its centuries of
categories of harm? grappling with new technologies,
Imagine a time when driverless however, the common law has seen
cars are wildly popular. They are saf- tougher problems than these and
er than vehicles with human drivers managed to fashion roughly sensi-
and their occupants can watch mov- ble remedies. Uber will likely settle

34 COMMUNICATIO NS O F TH E ACM | M AY 201 8 | VO L . 61 | NO. 5

 viewpoints

its case with the pedestrian’s family. If from the need to drive while main- penses with the need to find intent or
not, a court will sort it out. taining a sterling safety record, it negligence on the part of the defen-
Some point to the New Trolley Prob- adaptively reduces its environmen- dant—courts still require the plain-
lem, which posits that cars will have to tal impact. The designers of this tiff to show the defendant could fore-
make fine-grained moral decisions hybrid vehicle provide it with an see at least the category of harm that
about whom to kill in the event of objective function of greater fuel transpired. The legal term is “proxi-
an accident. I have never found this efficiency and the leeway to exper- mate causation.” Thus, a company
hypothetically particularly trou- iment with system operations, con- that demolishes a building with ex-
bling. The thought experiment in- sistent with the rules of the road and plosives will be liable for the collapse
vites us to imagine a robot so poor passenger expectations. A month of a nearby parking garage due to
at driving that, unlike you or anyone or so after deployment, one vehi- underground vibrations, even if the
you know, the car finds itself in a cle determines it performs more company employed best practices
situation that it must kill someone. efficiently overall if it begins the in demolition. But, as a Washington
At the same time, the robot is so day with a fully charged battery. Accord- court held in 1954, a demolition
sophisticated that it can somehow ingly, the car decides to run the gas company will not be liable if mink at
instantaneously weigh the relatively engine overnight in the garage—kill- a nearby mink farm react to the vibra-
moral considerations of killing a ing everyone in the household. tions by instinctively eating their
child versus three elderly people in Imagine the designers wind up in young. 2 The first type of harm is
real time. The New Trolley Problem court and deny they had any idea this foreseeable and therefore a fair ba-
strikes me as a quirky puzzle in search would happen. They understood a driv- sis for liability; the second is not.
of a dinner party. erless car could get into an accident. We are already seeing examples
Technology challenges law not They understood it might run out of of emergent behavior in the wild,
when it shifts responsibility in space gas and strand the passenger. But they much less in the university and cor-
and time, as driverless cars may, but did not in their wildest nightmares porate research labs that work on
when the technology presents a genu- imagine it would kill people through adaptive systems. A Twitter bot once
PHOTO BY PH ASE4STUD IOS

inely novel affordance that existing le- carbon monoxide poisoning. unexpectedly threatened a fashion
gal categories failed to anticipate. This may appear, at first blush, to show in Amsterdam with violence,
Imagine one manufacturer stands be just as easy a case as the driverless leading the organizers to call the po-
out in this driverless future. Not only car collision. It likely is not. Even un- lice.3 Tay—Microsoft’s ill-fated chat-
does its vehicle free occupants der a strict liability regime—which dis- bot—famously began to deny the

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF T HE ACM 35

viewpoints

Holocaust within hours of operation.5 suggesting that the behavior of soft-

And who can forget the flash crash ware cannot be fully anticipated as a
of 2010, in which high-speed trading matter of mathematics. But the more
algorithms destabilized the market, we can do to understand autonomous
precipitating a 10% drop in the Dow systems before deploying them in the
Jones within minutes.4 wild, the better.
As increasing numbers of adap- Second, it is critical that research-
tive systems enter the physical ers be permitted and even encouraged
world, courts will have to reexam- to test deployed systems—without
ine the role foreseeability will play fear of reprisal. Corporations and
as a fundamental arbiter of proxi- regulators can and should support
mate causation and fairness. 1 That research that throws curveballs to
is a big change, but the alternative autonomous technology to see how
is to entertain the prospect of vic- it reacts. Perhaps the closest anal-
tims without perpetrators. It is one ogy is bug bounties in the security
thing to laugh uneasily at two Face- context; at a minimum, terms of ser-
Advertise with ACM! book chatbots that unexpectedly vice agreements should clarify that
invent a new language. a It is anoth- safety-critical research is welcome
er to mourn the loss of a family to and will not be met with litigation.
Reach the innovators carbon monoxide poisoning while Finally, the present wave of intel-
and thought leaders refusing to hold anyone account- ligence was preceded by an equally
able in civil court. consequential wave of connectivity.
working at the We lawyers and judges have our The ongoing connection firms now
cutting edge work cut out for us. We may wind maintain to intelligence products,
up having to jettison a longstanding while in ways problematic, also of-
of computing and ubiquitous means of limiting fers an opportunity for better moni-
and information liability. But what role might there toring.6 One day, perhaps, mechani-
be for system designers? I certainly cal angels will sense an unexpected
technology through would not recommend stamping opportunity but check with a human
ACM’s magazines, out adaptation or emergence as a before rushing in.
research goal or system feature. In- None of these interventions rep-
websites deed, machines are increasingly use- resent a panacea. The good news is
and newsletters. ful precisely because they solve prob- that we have time. The first genera-
lems, spot patterns, or achieve goals tion of mainstream robotics, includ-
in novel ways no human imagined. ing fully autonomous vehicles, does
◊◆◊◆◊ Nevertheless, I would offer a few not present a genuinely difficult
thoughts for your consideration. puzzle for law in this law profes-
First, it seems to me worthwhile to in- sor’s view. The next well may. In the
Request a media kit vest in tools that attempt to anticipate interim, I hope the law and technol-
with specifications robot behavior and mitigate harm.b ogy community will be hard at work
The University of Michigan has con- grappling with the legal uncertainty
and pricing: structed a faux city to test driverless that technical uncertainty under-
cars. Short of this, virtual environ- standably begets.
Ilia Rodriguez ments can be used to study robot in-
teractions with complex inputs. I am, References
+1 212-626-0686 of course, mindful of the literature
1. Calo, R. Robotics and the lessons of cyberlaw.
California Law Review 513, 103 (2015).
acmmediasales@acm.org 2. Foster v. Preston Mill Co. 268 P.2d 645 (Wash. 1954).
3. Hill, K. Who do we blame when a robot threatens to kill
people? Spinter.com (Feb. 15, 2015); http://bit.ly/2FFKszl
a Tim Collins and Mark Prigg, “Facebook
4. Hope, B. and Ackerman, A. ‘Flash crash’ overhaul is
shuts down controversial chatbot experi- snarled in red tape. Wall Street Journal (May 5, 2015);
ment after AIs develop their own language to http://on.wsj.com/2ph9w4D
talk to each other,” Daily Mail (Jul. 31, 2017); 5. Price, R. Microsoft is deleting its AI chatbot’s
incredibly racist tweets. Business Insider (Mar. 24,
http://dailym.ai/2vnk47J Also see “Did Face- 2016); http://read.bi/1ZwcFYZ
book Shut Down an AI Experiment Because 6. Walker Smith, B. Proximity-driven liability. Georgetown
Chatbots Developed Their Own Language?” Law Journal 1777, 102 (2014).
Snopes.com (Aug. 1, 2017); http://dailym. 7. Vladeck, D.C. Machines without principles. Washington
Law Review 117, 89 (2014).
ai/2vnk47J (concluding that Facebook did
not necessarily expect the behavior but nor
did it shut down the experiment as a result of it). Ryan Calo (rcalo@uw.edu) is a Lane Powell and D. Wayne
Gittinger Endowed Professorship Associate Professor of
b For a prescient discussion, see Jeffrey Mogel, Law at the University of Washington in Seattle, WA, USA.
“Emergent (Mis) Behavior vs. Complex Soft-
ware Systems.” ACM SIGOPS 40, 4 (Oct. 2006),
293–304. Copyright held by author.

36 COM MUNICATIO NS O F TH E AC M | M AY 201 8 | VO L . 61 | NO. 5

 V
viewpoints

DOI:10.1145/3199601 Fred B. Schneider

Privacy and Security

Putting Trust in
Security Engineering
Proposing a stronger foundation for an engineering
discipline to support the design of secure systems.

W
H E N W E M U ST depend
on a system, not only
should we want it to
resist attacks but we
should have reason
to believe that it will resist attacks. So
security is a blend of two ingredients:
mechanism and assurance. In develop-
ing a secure system, it is tempting to
focus first on mechanism—the famil-
iar “build then test” paradigm from
software development. This column
discusses some benefits of resisting
that temptation. Instead, I advocate
that designers focus first on aspects
of assurance, because they can then
explore—in a principled way—connec-
tions between a system design and its
resistance to attack. Formalizing such
connections as mathematical laws
could enable an engineering discipline
for secure systems.

Trust and Assumptions

To computer security practitioners, the
term “trust” has a specific technical convince you, so psychological ques- interfaces, we are making an implicit
meaning, different from its use in ev- tions that underpin trust claims now assumption: that attackers have access
eryday language. To trust a component can be explored separately in discus- to only certain avenues for controlling
C is to assert a belief that C will behave sions about the evidence. the system or for learning information
IMAGE BY AND RIJ BORYS ASSOCIAT ES/SHUT TERSTOCK

as expected, despite attacks or failures. Trust is often contingent on assump- about its state. We also are making an
When I say that “we should trust C” tions. These assumptions must be implicit assumption when we ignore
then either I am asking you to ignore sound, or our trust will be misplaced. delays associated with memory access,
the possibility that C is compromised We often make explicit our assump- since attackers might be able to make
or I am asserting the availability of evi- tions about the environment, talking inferences by measuring those delays.
dence that convinced me certain (often about anticipated failures or the capa- Assumptions are potential vulner-
left implicit) aspects of C’s behavior bilities of attackers. But we also make abilities. If a component will behave
cannot be subverted. Availability of evi- implicit assumptions. For example, as expected only if some assumption
dence is required in the second case, when expectations about behavior are holds, then an attacker can succeed
because what convinces me might not couched in terms of operations and simply by falsifying that assumption.

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF T HE ACM 37

viewpoints

Most attacks can be deconstructed ˲˲ Analysis of a system or its compo- be smaller than an operating system,
using this lens. For example, buffer- nents could allow weaker assumptions VMM should be easier to understand
overflow attacks exploit an assump- to replace stronger assumptions, be- than OS and, therefore, easier to trust.
tion about the lengths of values that cause we then know more about pos- Any isolation, however, is relative to a
will be stored in a buffer. An attack sible and/or impossible behaviors. To set of interfaces. The designers of VMM
stores a value that is too long into the embrace the results of such an analy- and OS both will have made assump-
buffer, which overwrites values in ad- sis, however, we must be prepared to tions about what interfaces to include.
jacent memory locations, too. The trust the analyzer. And, for example, if the interface to a
recent Spectre1 attack illustrates just ˲˲ Incorporating security mecha- memory cache was not included in the
how subtle things can get. With access nisms in a system or its components set of isolated interfaces then attacks
to an interface for measuring execu- provides a means by which an assump- like Spectre become feasible.
tion times, an attacker can determine tion about possible and/or impossible
what memory locations are stored in a behaviors can be made, because the Bases for Trust
cache. Speculative execution causes a security mechanism prevents certain The approach advocated in this col-
processor to access memory locations, behaviors. So we can weaken assump- umn depends critically on having
transferring and leaving information tions about system behaviors if we are methods to justify trust in compo-
in the cache. So, an attacker can learn prepared to trust a security mechanism. nents and in systems built from those
the value of a secret by causing specu- In both cases, we replace trust in components. There seem to be three
lative execution of an instruction that some assumption by asserting our classes of methods: axiomatic, ana-
accesses different memory depending trust in something else. So assump- lytic, and synthesized. They are often
on that secret’s value. The implicit as- tions and trust have become the driv- used in combination.
sumption: programs could not learn ing force in the design of a system. Axiomatic Basis for Trust. This
anything about speculative executions An example will illustrate this role form of trust comes from beliefs that
that are attempted but reversed. for assumptions and trust. To justify we accept on faith. We might trust
One aspect of a security engineer- an assumption that service S executes some hardware or software, for ex-
ing discipline, then, would be to iden- in a benign environment, we might ample, because it is built or sold by
tify assumptions on which our trust execute S in its own process. Process a given company. We are putting our
depends and to assess whether these isolation ensures the required benign faith in the company’s reputation.
assumptions can be falsified by attack- environment, but we now must trust Notice, this basis for our trust has
ers. Whether such assumptions can an operating system OS to enforce iso- nothing to do with the artifact we are
be falsified will depend, in part, on an lation. To help discharge that assump- trusting. The tenuous connection to
attacker’s capabilities. The Defense tion, we might run only the one process the actual component makes axiom-
Science Board3 groups attackers into for S in OS but also execute OS in its atic bases a weak form of evidence
three broad classes, according to at- own (isolated) virtual machine. A hy- for justifying trust. Moreover, an axi-
tacker capabilities: pervisor VMM that implements virtual omatic basis for trust can be difficult
˲˲ Those who only can execute ex- machines would then allow us to as- for one person to convey to another,
isting attacks against known vulner- sume OS is isolated, thereby requiring since the underlying evidence is, by
abilities; a reduced level of trust in OS, because definition, subjective.
˲˲ Those who can analyze a system to OS now executes in a more benign Analytic Basis for Trust. Here we use
find new vulnerabilities and then de- environment. Since a hypervisor can testing and/or reasoning to justify con-
velop exploits; and clusions about what a component or
˲˲ Those who can create new vulner- system will and/or will not do. Trust in
abilities (e.g., by compromising the To build a system an artifact is justified by trust in some
supply chain). method of analysis. The suitability of
Or we might characterize attackers we are prepared an analysis method likely will depend
in terms of what kind of access they to trust, we eliminate on what is being analyzed and on the
have to a system: property to be established.
˲˲ Physical access to the hardware; assumptions The feasibility of creating an ana-
˲˲ Access to the software or data; or
˲˲ Access to the people who use or
that constitute lytic basis for trust depends on the
amount of work involved in perform-
run the system. vulnerabilities ing the analysis and on the sound-
Cryptographers characterize attack- that could be ness of any assumptions underlying
ers by bounding available computa- that analysis.
tion; they see execution of PPT (proba- exploited by ˲˲ Testing. In theory, we might check
bilistic polynomial-time) algorithms as attackers. every input to every interface and con-
defining the limit of feasible attacks. clude that some properties about be-
To build a system we are prepared to haviors are always satisfied. But enu-
trust, we eliminate assumptions that meration and checking of all possible
constitute vulnerabilities we believe inputs is likely to be infeasible, even
could be exploited by attackers. for simple components. So only a sub-

38 COM MUNICATIO NS O F TH E AC M | M AY 201 8 | VO L . 61 | NO. 5

 viewpoints

set of the inputs to certain interfaces so an attack that succeeds at one

would be checked. An assumption is replica is not guaranteed to succeed
thus being introduced—that the right An engineering at another. Other randomly selected
set of inputs is being checked.
˲˲ Formal Verification. Software is
discipline should per-replica semantics-preserving
transformation would work, too.
amenable to logical analysis, either provide means Program rewriters are another
manual or automated. Today’s state of to analyze and means for creating synthesized bas-
the art for automated analysis allows es. The rewriter takes a software com-
certain simple properties to be checked construct artifacts ponent C as its input, adds checks or
automatically for large components that will satisfy performs analysis, and outputs a ver-
and allows rich classes of properties to sion C′ that is robust against some
be verified by hand for small compo- properties of interest. class of attacks, because C′ is inca-
nents. Research in formal verification pable of certain behaviors. If we trust
has made steady progress on widen- the rewriter, then we have a basis for
ing the class of properties that can be enhanced trust in C′. But even if we
checked automatically, as well as on do not trust the rewriter, we could
increasing the size and complexity that some component executes in a more- still have a basis for enhanced trust in
can be handled. benign setting, so the component can that rewriter’s output by employing a
be designed to operate in an environ- variant of proof-carrying code.2 With
An analytic basis for trust can be con- ment characterized by stronger as- proof-carrying code, the rewriter also
veyed to some consumer by sharing sumptions than we are prepared to outputs a proof that C′ is a correctly
the method and the results the method make about the environment in which modified version of C; certifiers for
produced. When testing is employed, the synthesis (mechanism plus compo- such proofs can be simple and small
the artifact, set of test cases, and ex- nent) is deployed. programs, independent of how large
pected outputs are shared. For under- Assumptions about independence and complicated the rewriter is.
taking other forms of automated analy- are sometimes involved in estab-
sis, we would employ an analyzer that lishing a synthesized basis for trust. Conclusion
not only outputs a conclusion (“pro- With defense in depth, we aspire for a An engineering discipline should pro-
gram type checked”) but also generates combination of defenses to be more vide means to analyze and construct
and provides a transcript of the infer- secure than any of its elements. Two- artifacts that will satisfy properties
ences that led to this conclusion—in factor authentication for withdraw- of interest. This column proposed a
effect, the analyzer produces a proof ing cash at an ATM is an example; a foundation for an engineering disci-
of the conclusion for the given arti- bankcard (something you have) and a pline to support the design of secure
fact. Proof checking is, by definition, PIN (something you know) both must systems. It suggests that system de-
a linear-time process in the size of the be presented, so stealing a wallet con- sign be driven by desires to change the
proof, and proof checkers are far sim- taining the card alone does not ben- assumptions that underlie trust. Se-
pler programs than proof generators efit the attacker.a Defense in depth curity mechanisms change where we
(that is, analyzers). So, without dupli- improves security to the extent that its must place our trust; analysis allows
cating work, a consumer can check the elements do not share vulnerabilities. us to weaken assumptions.
soundness of a manually or automati- So an independence assumption is in-
cally produced proof. volved—we make an assumption that References
1. Kocher, et al. Spectre attacks: Exploiting speculative
Synthesized Basis for Trust. Trust success in attacking one element does execution; https://spectreattack.com/spectre.pdf
in the whole here derives from the way not increase the chances of success in 2. Necula, G.C. Proof-carrying code. In Proceedings of the
24th ACM SIGPLAN-SIGACT Symposium on Principles
its components are combined—a form attacking another. of Programming (Paris, France), 1997, 106–119.
of divide and conquer, perhaps involv- Independence does not hold in 3. Resilient Military Systems and the Advanced Cyber
Threat. Defense Science Board Task Force Report
ing trust in certain of the components replicated systems if each replica (Oct. 2013).
or in the glue used to combine them. runs on the same hardware and exe-
Most of the mechanisms studied in a cutes the same software; the replicas Fred B. Schneider (fbs@cs.cornell.edu) is Samuel B.
Eckert Professor of Computer Science and chair of the at
computer security class are intended all will have the same vulnerabilities Cornell University computer science department, Cornell
for supporting a synthesized basis of and thus be subject to the same at- University, USA.

trust. OS kernels and hypervisors en- tacks. However, we can create some
Supported in part by AFOSR grant F9550-16-0250
force isolation, reference monitors and measure of independence across and NSF grant 1642120. The views and conclusions
firewalls restrict the set of requests a replicas by using address space lay- contained herein are those of the author and should not be
interpreted as necessarily representing the official policies
component will receive, ignorance of a out randomization, which causes or endorsements, either expressed or implied, of these
secret can impose unreasonable costs different replicas of the software to organizations or the U.S. government.

on an outsider attempting to perform employ different memory layouts, Schneider is grateful to Susanne Hambrusch, John King,
certain actions. Carl Landwehr, Steve Lipner, and Greg Morrisett for their
very helpful feedback on early drafts of this column.
With synthesized bases for trust, a Kidnapping the person usually gets the wallet,
we place trust in some security mech- too. So the two mechanisms here have a vul-
anisms. These mechanisms ensure nerability in common. Copyright held by author.

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF T HE ACM 39

V
viewpoints

DOI:10.1145/3199603 Alexander Repenning

Education
Scale or Fail
Moving beyond self-selected computer science
education in Switzerland.

K
–12 COMPUTER SCIENCE Edu- Figure 1. Switzerland is crossing the computer science education chasm with mandatory
cation (CSed) is an interna- pre-service teacher education.
tional challenge with differ-
ent countries engaging in
diverse strategies to reach Mandatory
Pre-Service
systemic impact by broadening partici- Teacher Education
pation among students, teachers and
the general population. For instance,
the CS4All9 initiative in the U.S. and the
Computing at School4 movement in
the U.K. have scaled up CSed remark-
ably. While large successes with these
kinds of initiatives have resulted in sig-
nificant impact, it remains unclear how
early impact3 becomes truly systemic.
The main challenge preventing K–12
CSed to advance from teachers who are
technology enthusiasts to pragmatists Stage I Self-Selected Students/Self-Selected Teachers
is perhaps best characterized by Cross-
ing the Chasm,5 a notion anchored in Stage II All Students/Self-Selected Teachers
the diffusion of innovation literature.
This chasm appears to exist for CSed. Stage III All Students/All Teachers
It suggests it is difficult to move beyond
early adopters (Figure 1, red and orange
stages) of a new idea, such as K–12 Stage I: The “Friday Afternoon Com- afternoon clubs. These clubs, in turn,
CSed, to the early majority (Figure 1, puter Club” Stage (Self-Selected Stu- attracted only the usual suspects, that
green stage). Switzerland, a highly af- dents/Self-Selected Teachers): Stage I is, self-selected kids (mostly male) in-
fluent, but in terms of K–12 CSed some- focused mostly on the “right” tools. In structed by self-selected teachers (also
what conservative country, is radically the 1990s the overall negative percep- mostly male). To make computing
shifting its strategy to cross this chasm tion of programming by children, best more relevant to schools it was crucial
by introducing mandatory pre-service described as “hard and boring,”7 sug- to focus less on tools supporting pro-
teacher computer science education gested cognitive as well as affective chal- gramming per se but to create tools to
starting at the elementary school level. lenges. Being constantly just one semi- forge explicative ideas through comput-
Three fundamental CSed stages, colon away from total disaster with ing, or as Papert started to call it, com-
captured in Figure 1, are character- traditional programming languages putational thinking.6
ized by permutations of self-selected/ such as C or Pascal, is an example of I developed computational thinking
all and students/teachers combina- syntax being a cognitive challenge. But tools to allow students to get past the
tions. It took approximately 20 years even with the presence of early educa- cognitive and affective challenges7 at
to transition through these stages. tional programming languages, such the University of Colorado. Computa-
Each stage is described here from a as Logo and BASIC, programming in tional thinking tools have the ultimate
more general CSed perspective as well schools was typically marginalized into goal to transform people’s perception
as my personal perspective. after-school contexts such as Friday of programming from “hard and bor-

40 COM MUNICATIO NS O F TH E ACM | M AY 201 8 | VO L . 61 | NO. 5

 viewpoints

ing” to “accessible and exciting.” K–12 efits of CS had to be explained to the

CSed does not have the intent of pro- Swiss Conference of Cantonal Ministers
ducing a fleet of programmers but on K–12 computer of Education, finally resulted in the ac-
producing computational thinkers. science education creditation of mandatory CS courses for
Students should be enabled by compu- elementary school teachers.
tational thinking tools to participate does not have
in activities including programming, the intent of Scalable Game Design
such as creating STEM simulations Switzerland Courses
or games, in the regular K–12 course producing a fleet Conceptually, the Scalable Game Design
context and not just at the Friday af- of programmers Switzerland course is rooted in the Scal-
ternoon computer clubs. With Agent- able Game Design framework developed
Sheets we made programming more but on producing at the University of Colorado8 but it had
accessible by moving beyond the chal- computational to go through radical transformation to
lenges of syntax through drag-and- deal with the different needs of a non-
drop programming.7 With AgentCubes thinkers. self-selected audience. Less than 1% of
we made programming more excitinga these pre-service teachers had program-
to kids by providing them with brows- ming experience. The expectations of
er-based tools to create 3D shapes, teachers (75% women, 25% men) varied
which they can 3D print, compose into widely with many anticipating learning
interactive 3D worlds, and share with Private funding supported internation- how to use Word or PowerPoint. Instead,
their friends. al Scalable Game Design sites, for ex- just like the original course, this new
Stage II: The “Professional Develop- ample, Scalable Game Design Mexico course focused on computational think-
ment Movement” Stage (All Students/ funded by Google. ing conveyed through game design and
Self-Selected Teachers). Once compu- Stage III: The “Mandatory Pre-Service STEM simulation building. To make the
tational thinking tools sufficiently Teacher Education” Stage (All Stu- course relevant to pre-service teachers,
addressed the cognitive and affective dents/All Teachers). Compelling cur- Scalable Game Design Switzerland had
challenges dimensions of CSed, it ricula can spread through networks of to be carefully aligned with the learn-
was time to shift the research focus excited CS teachers surprisingly quick- ing goals defined as competences in the
from tools to curricula and teacher ly,2 but how will they cross the CSed Swiss Lehrplan 21.
professional development. Research- chasm (Figure 1) and persuade more On September 17, 2017, in four states,
ers started not only to design, and conservative audiences? If society seven instructors began to teach 26 CS
conduct teacher professional devel- truly believes computational think- courses with approximately 25 pre-ser-
opment but also to systematically ing is an essential 21st-century skill, vice teachers each. All 600+ pre-service
evaluate its efficacy. The teachers at- just like mathematical thinking, teachers must take two courses: Intro-
tending were mostly self-selected, but then it will have to shift to transfor- duction to Computer Science and Com-
in many cases the classes they would mative mandatory practices reaching puter Science Didactics. This totals four
teach were aimed at all students and all pre-service teachers. credit hours, resulting in over 25,000
no longer limited to after-school con- In 2013, I began leading a pilot project contact hours. The Introduction to Com-
texts. Stage II started to reach a much in Switzerland to explore systemic im- puter Science course, which finished in
broader audience than Stage I. pact on K–12 CSed through mandatory December 2017, was based on three core
I initiated Scalable Game Design pre-service teacher education. This concepts. Each concept is described
as a strategy to teach computational project engages all pre-service elemen- here and includes a brief description of
thinking through game design and tary school teachers at one of Switzer- our preliminary assessment:
STEM simulation creation activities.8 land’s largest Schools of Education, PH 1. Learning and Motivation Strategy:
Scalable Game Design is rooted in a FHNW, in CSed, through two manda- Scalable Game Design. The strategy is to
didactic model called the Zones of tory CS courses. Other Swiss Schools of teach computational thinking through
Proximal Flow, which helps students Education, e.g., the PHSZ, are offering a series of computational thinking pat-
to design their own games and STEM similar mandatory CS courses. The new terns8 that gradually—hence the no-
simulations based on the understand- Swiss Lehrplan 21, a national curricu- tion of scalability—expose students
ing of common computational think- lum reaching the 21 German-speaking to increasingly sophisticated game
ing patterns.1 Teacher professional de- states out of all 26 states in Switzerland, design and STEM simulation build-
velopment gradually scaled from local enabled this kind of transformational ing challenges, following the Zones of
face-to-face summer institutes at the practice because it mandates K–12 Proximal Flow strategy.1
University of Colorado, to online and CSed. The transformative nature hinges The “scalable” aspect of the course
blended professional development, on the possibility for students to fail be- worked well resulting in all pre-service
reaching schools in all 50 U.S. states. coming an elementary teacher based teachers (students of the school of edu-
on failing a mandatory CS course. This cation) developing the necessary skills
a AgentCubes online is a 3D computational think-
unparalleled kind of causality resulted to program at least a basic game. Be-
ing tool with more than one million student in government intervention. Four years fore the course, the acceptance of game
projects created in 2017 in over 180 countries. of negotiations, where the societal ben- design as learning strategy by teachers

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF T HE ACM 41

viewpoints

Figure 2. AgentCubes games designed and programmed by pre-service teachers. bubble sort to understand the notion
of an algorithm.

Scale or Fail?
The preliminary evaluation of the first
part of the course (Introduction to
Computer Science) suggests a shift
in audience from self-selected in-ser-
vice teachers to all pre-service teachers
may not be as difficult as anticipated.
However, to actually assess if we can
teach these pre-service teachers to
teach computational thinking to their
students will not only require us to
conduct the second part of the course
(Computer Science Didactics) but also
much more time to observe practi-
cal impact. We have an approach that
has been successful in the past, and
we have a broad, transformative ex-
periment that could scale to an entire
country. We have confidence that this
approach will allow us to cross the
CSed chasm.
was one of our biggest concerns. Course had created and programmed multiple
satisfaction overall was high with many games and participated in multi week References
1. Basawapatna, A., Repenning, A., Koh, K.H., and
even mentioning in their course evalu- game programming group projects. Ev- Nickerson, H. The zones of proximal flow: Guiding
ation that they liked programming erybody had gone beyond the minimal students through a space of computational thinking
skills and challenges. In Proceedings of the
games. Figure 2 shows sample games basics of programming, for instance International Computing Education Research (ICER
2013), San Diego, CA, USA, 2013.
and simulations produced by teachers by programming collaborate ghosts 2. Bradshaw. P. and Woollard, J. Computing at school:
such as 1980s-era arcade-style 2D games in a Pac-Man like game. Also, learning An emergent community of practice for a re-
emergent subject. In Proceedings of the International
(Donkey Kong), puzzle games (Tetris), was not reduced to CS in isolation but Conference on ICT in Education, Rhodes, Greece, 2012.
educational simulation games (honey included uses of computation in other 3. Brown, N.C.C., Sentance, S., Crick, T., and Humphreys,
S. Restart: The resurgence of computer science in U.K.
bee pollination), 3D indoor games, and subject areas such math, music, art, schools. Trans. Comput. Educ. 14 (2014), 1–22.
3D outdoor games. To design these and social sciences. 4. Crick, T. and Sentance, S. Computing at school:
Stimulating computing education in the U.K. In
games students had to engage in an iter- 3. Course structure: The seven big Proceedings of the 11th Koli Calling International
ative computational thinking process.7 ideas of computer science. The map- Conference on Computing Education Research (Koli,
Finland), 2011, 122–123.
2. Tools to support computational ping of the Scalable Game Design 5. Moore, G.A. Crossing the Chasm: Marketing and
thinkers in schools: Computational strategy onto the computer science Selling High-Tech Products to Mainstream Customers.
HarperBusiness, New York, 1999.
thinking tools. We used our Agent- part of the Lehrplan 21 was straight- 6. Papert, S. An exploration in the space of mathematics
Cubes computational thinking tool forward. The three main Swiss Lehr- educations. International Journal of Computers for
Mathematical Learning 1 (1996), 95–123.
because it had established accessi- plan 21 CS topics (data, algorithms, 7. Repenning, A. Moving beyond syntax: Lessons from 20
bility even with younger kids, inde- and systems) were identified as a years of blocks programing in AgentSheets. Journal
of Visual Languages and Sentient Systems 3, (2017),
pendent of gender and race,8 and it subset of the seven big ideas found 68–89.
8. Repenning, A. et al. Scalable game design: A strategy
enabled kids to create interesting ar- in the AP Computer Science Prin- to bring systemic computer science education to
tifacts such as 3D games and STEM ciples framework: creativity, abstrac- schools through game design and simulation creation.
Transactions on Computing Education (TOCE) 15
simulations. To cover the wide range tion, data, algorithms, programming, (2015), 1–31.
of needs in elementary schools, we the Internet and global impact. Each 9. Vogel, S., Santo, R., and Ching, D. Visions of computer
science education: Unpacking arguments for and
also included CS Unplugged activities, Computer Science Principle idea was projected impacts of CS4All initiatives. In Proceedings
for classrooms lacking computers, and mapped onto a two-week block in the of the 2017 ACM SIGCSE Technical Symposium on
Computer Science Education, Seattle, WA, USA.
Processing, as brief exposure to more 14-week course.
traditional textual programming. In spite of its density, most students Alexander Repenning (alexander.repenning@fhnw.ch)
There was a huge shift of perception really enjoyed this course structure. is Professor and Chair of Computer Science Education
at FHNW, School of Education, Windisch, Switzerland,
regarding pre-service teachers’ abil- Students took particular pleasure and Professor of Computer Science at the University of
ity to program. Before the course es- in the Computer Science Principles Colorado at Boulder, Boulder, CO, USA.
sentially nobody had done any kind of ideas that were either evidently rel-
programming nor did they think pro- evant to their lives such as the Inter- This research was supported by the U.S. National Science
Foundation, the Swiss National Science Foundation, and
gramming was particularly relevant to net, or conveyed through engaging the Hasler Foundation.
K–12 education. At the end of the first activities such as a CS unplugged role
course all 600+ pre-service teachers play of people acting as bubbles in Copyright held by author.

42 COMM UNICATIO NS O F THE ACM | M AY 201 8 | VO L . 61 | NO. 5

 V
viewpoints

DOI:10.1145/3201606 Harold “Bud” Lawson

Viewpoint
The March into
the Black Hole
of Complexity
Addressing the root causes of rapidly increasing software complexity.

I
N JUNE 2002, Communications
published my Viewpoint “Re-
birth of the Computer Industry,”
in which I expressed hope that
the past complexity sins of the
computer industry had been admit-
ted and that something positive could
happen.5 Instead, complexity has in-
creased at an accelerated and alarming
rate. I pointed to many fundamental
problems in my previous Viewpoint;
here, I emphasize two aspects: the
hardware-software mismatch and the
state of affairs in developing and sus-
taining software systems. Both are
contributing root causes introducing
enormous risks and impacting digital-
age safety, security, and integrity. If the
world ever hopes to climb out of the
black hole of software complexity it
will involve addressing these aspects in
a constructive manner.

Hardware-Software Mismatch
and Consequences
During the late 1950s, Robert (Bob) Bar-
ton pioneered the idea of designing the
hardware to accommodate the needs
of software; in particular programming
languages in the design of the Bur- ber Burroughs provided a pedagogical entered a new era. Clearly, there were
roughs B5000. For example, he used game that one could clearly learn the significant advances in the 360, in par-
IMAGE F RO M SH UTT ERSTOCK.CO M

the Łukasiewicz’s concept of Reverse underlying principles for Algol and Co- ticular the usage of solid-state logic and
Polish Notation as the means of expres- bol program translation and execution. the control of most models by micro-
sion evaluation. There were several However, Burroughs did not domi- programs. While the series provided
other software relevant innovations as nate the computer industry. IBM did. compatibility over a range of models at
well. Burroughs continued to develop With the announcement of the IBM various price/performance levels, there
the B5500 and 6500.1 I fondly remem- System/360 series in 1964, the IT World was, in my opinion, a very serious prob-

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF T HE ACM 43

viewpoints

lem. The Instruction Set Architecture by E-Machines that implemented pro- microprocessor showed up and radi-
(ISA) included 143 instructions, but it gramming language-relevant instruc- cally changed hardware economics
was not easy to generate efficient code tion sets in a manner similar to the affecting the product offerings by all
from the various compilers for Fortran, Burroughs computers. computer hardware suppliers. While
Cobol, and the new language PL/I. There were several others follow- the integrated circuit technology was
The problems with providing 360 ing similar ideas including Wayne a major achievement the establish-
systems software have been well doc- Wilner with the microprogrammed ment of a primitive ISA (Instruction
umented by Fred Brooks in his book Burroughs B170010 and the work of Set Architecture) that has perme-
The Mythical Man Month.2 I was a Glenford Myers on software-oriented ated in the X86 architecture has had
member of the Change Control Board architectures.8 I was involved in two an even more radical effect upon the
for OS/360 as representative for PL/I. new microprogrammable architec- hardware-software relationship than
So, I observed firsthand the rapidly tures where there were plans to not the 360. Generating code for these
increasing complexity. The original only emulate existing machines, processors is highly complex and re-
concepts for OS/360 were clear and but to use the T- and E-Machine ap- sults in enormous volumes of code.
described in a small notebook. Find- proach. First was the MLP-900 at As a result, true higher-level lan-
ing that the instruction set was diffi- Standard Computer Corporation.7 guages have often been put aside and
cult to deal with, compiler and other Unfortunately, due to a change in the use of lower-level languages like
system software projects requested management, only the prototype C and C++ permeate. Another trend
exceptions, for example in calling was produced, but it wound up on evolved in attempting to hide the
conventions and parameter passing. the original ARPA network in a dual complexity, namely via middleware
As a result the documentation volume configuration with a PDP-10 at USC where functions provided by higher-
grew rapidly and eventually it became Information Science Institute. It pro- level abstractions are translated of-
virtually impossible to follow all the vided a microprogram research facili- ten to C code. Clearly middleware
changes. Entropy was a fact; very few ty and was used during the 1970s. Da- hides complexity, but it is also clear
people read anymore. To add to the tasaab in Sweden planned to license that it does not eliminate it. Finding
complexity, a very complicated Job the MLP-900 to emulate a previous bugs in this complex of software lev-
Control Language was provided. machine, but also to work toward els is a real challenge.
Given the situation IBM discovered implementing T- and E-Machines. The problems continued when IBM
a new market. Customers had extreme There, I designed the Flexible Central in an effort to capture the personal
difficulty in installing and operating Processing Unit, a 64-bit machine, computer market agreed to use DOS
their System/360s. So, IBM established with rather advanced microprogram and other Microsoft software. This
the role of “Systems Engineers” with features. It was microprogrammed to was followed by the so-called WINTEL
the altruistic goal of helping custom- provide a compatible D23 system, but cycle. More powerful processors with
ers making their installations and ap- the true potential of using the FCPU more memory from Intel—and then
plications operational. The bug-laden for T- and E-Machine implementa- new software functionality (often not
software resulted in fix after fix, each tion did not transpire.6 really essential and not used) from Mi-
fix reconciling some problems but in- Had these innovative “language- crosoft and then the next round.
troducing new ones. This all produced directed architectures” achieved During the 1980s there was a debate
an enormous revenue source from the wide market acceptance one won- about the merits of the CISC (Complex
selling of Systems Engineer’s services. ders how computing would be these Instruction Set of the X86 type) versus
I identify this as the beginning of days? But as previously stated, IBM RISC (Reduced Instruction Set) archi-
the March into the Black Hole of Com- dominated. In the mid-1970s, the tectures. While RISC architectures
plexity. It created fantastic opportuni- provided enhanced performance and
ties for consultants and start-up com- the fact that higher-level functions can
panies that made fortunes because The March into be achieved by subroutines, they do not
they could handle some piece of the directly address the hardware-software
complexity. Now very significantly am- the Black Hole relationship. That is, there is a “seman-
plified by a wide variety of suppliers of of Complexity tic gap” between true higher-level lan-
complex software systems. guages and the ISA. The semantic gap
There were efforts in 1960s and created fantastic refers to the level of cohesion between
early 1970s to return to the importance opportunities for the higher-level language and the ISA.
of the hardware-software relationship. The T- and E-Machine approach de-
I led a research group at IBM that de- consultants and scribed here has significantly reduced
veloped ideas of T-Machines and E-Ma- start-up companies. the semantic gap.
chines supported by microprograms. We now know that the world has
T-Machines that implemented an in- been provided with an enormous
struction set conducive to constructing amount of new functionality via both
compilers and based upon ideas from CISC and RISC processors; but with
Digitek (at that time a supplier of com- the nasty side effects of the unneces-
pilers). Compiled programs executed sary complexity in the form of enor-

44 COMM UNICATIO NS O F THE AC M | M AY 201 8 | VO L . 61 | NO. 5

 viewpoints

mous volumes of compiled code and tainly as we move into the era of the
middleware leading to bugs, viruses, Internet of Things and cyber-physical
hacker attacks, and so forth, to a large The scope and systems the importance of organiz-
extent due to the enormous complex- complexity of today’s ing multidisciplinary teams and sys-
ity. Given the current problems of cy- tems engineering become obvious.
ber security, it is high time to seriously large software To meet this need, Ivar Jacobson and
address the semantic gap and develop endeavors demand I have co-edited the book Software En-
language-directed architectures that gineering in the Systems Context where
make software more understandable, that the process many well-known software and sys-
maintainable, and protectable while of developing, tems experts have provided their in-
also significantly reducing the amount put.3 Further, a call is made to extend
of generated code. deploying, and the ideas from Essence to the systems
sustaining software engineering domain.
Software Development,
Deployment, and Sustainment must be improved. Conclusion
I have termed the unnecessary com- We are very deep in the Black Hole of
plexity that has evolved Busyware. Complexity and two important root
Certainly it keeps vast numbers of causes to this situation have been
consultants and teams of software en- identified. First, due to the mismatch
gineers and programmers occupied. effort initiated by Richard Soley, Ber- between hardware and software that
They should be focusing on produc- trand Meyer, and Ivar Jacobson result- has resulted in complexities with the
ing good-quality software products ed in the SEMAT (Software Engineer- widescale usage of lower-level lan-
(Valueware and Stableware), but find ing Method and Theory) organization. guages and middleware. Secondly,
themselves often side-tracked into They observed that software engineer- given the scope and complexity of
handling implementation complexi- ing suffers from: today’s software systems, we need to
ties. While a resolution of the hard- ˲˲ The prevalence of fads more typi- improve our approach to developing,
ware-software mismatch would be a cal of a fashion industry than of an en- deploying, and sustaining software
step in a positive direction, the scope gineering discipline; systems that have become the most
and complexity of today’s large soft- ˲˲ The lack of a sound, widely accept- important and vulnerable elements
ware endeavors demand that the pro- ed theoretical basis; of modern-day systems. Here, Essence
cess of developing, deploying, and sus- ˲˲ The huge number of methods and provides an important step forward.
taining software must be improved. method variants, with differences little Progress must be made in these two
For example, today’s operating sys- understood and artificially magnified; important aspects if the world is to
tems and many advanced applications ˲˲ The lack of credible experimental avoid sinking further into the Black
in the range of 50 to 100 million lines evaluation and validation; and Hole of Complexity.
of code produced by a large group of ˲˲ The split between industry prac-
software engineers and programmers tice and academic research. References
1. Barton, R. Functional design of computers. Commun.
have introduced significant problems As a concrete step a team of interna- ACM 4, 9 (Sept. 1961).
of stability and maintainability. tional experts developed the Essence 2. Brooks, F. The Mythical Man-Month. Addison-Wesley, 1974.
3. Jacobson, I. and Lawson, H., Eds. Software
The software engineering profes- Kernel4 that has become an OMG stan- Engineering in the Systems Context, Volume 7. Systems
Series, College Publications, Kings College, U.K., 2015.
sion was established to improve ca- dard.9 Essence provides: 4. Jacobson, I. et al. The Essence of Software
pabilities in developing, deploying, ˲˲ A thinking framework for teams to Engineering: Applying the SEMAT Kernel. Addison-
Wesley, 2013.
and sustaining software. While reason about the progress they are mak- 5. Lawson, H. Rebirth of the computer industry.
early efforts focused on improve- ing and the health of their endeavors. Commun. ACM 45, 6 (June 2002).
6. Lawson, H. and Magnhagen, B. Advantages of structured
ments in program structure, later ˲˲ A framework for teams to assem-
hardware. In Proceedings of the 2nd Annual International
developments have focused on the ble and continuously improve their Symposium on Computer Architecture, 1975.
7. Lawson, H. and Smith B. Functional characteristics
way of working. Many “gurus” have way of working. of a multi-lingual processor. IEEE Transactions on
provided their own twist on best ˲˲ The common ground for improved Computers C-20, 7 (July 1971).
8. Myers, G. SWARD—A software-oriented architecture.
practices and methods that are of- communication, standardized measure- In Proceedings of the International Workshop on
ten followed in a religious manner. ment, and the sharing of best practices. High-Level Language Computer Architecture, 1980.
9. OMG. Essence—Kernel and Language for Software
As a result, a plethora of approach- ˲˲ A foundation for accessible, in- Engineering Methods. Object Management Group, 2015.
es have evolved. While this situa- teroperable method and practice defi- 10. Wilner, W. Design of the Burroughs B1700. In
Proceedings of the Fall Joint Computer Conference, 1972.
tion has made a lot of people rich, nitions.
it certainly has contributed to addi- ˲˲ And most importantly, a way to
Harold “Bud” Lawson (bud@lawson.se) is an ACM,
tional complexities in selecting and help teams understand where they are, IEEE, and INCOSE Fellow, IEEE Charles Babbage
Computer Pioneer, and INCOSE Systems Engineering
applying appropriate practices and and what they should do next. Pioneer.
methods—moving us even deeper While developed for software engi-
into the Black Hole of Complexity. neering, when examining Essence it
In an effort to improve upon this is obvious there are many ideas that
alarming situation an international can be applied on a wider scale. Cer- Copyright held by author.

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF T HE ACM 45

V
viewpoints

DOI:10.1145/3199604 Margaret Martonosi

Viewpoint
Science, Policy,
and Service
Some thoughts on the way forward.

F
O R M A N Y COM PU T E R scien-
tists, the thrill of impactful
technical inventions and fast-
moving innovation is what
pulled us into this field origi-
nally and is what keeps us here. But as
computer systems impact society ever
more deeply, questions arise regarding
the societal implications of the tech-
nologies we are building, and from
there the conversation often shifts to
questions of policy and regulation.
When it comes to privacy, security, and
other crucial issues, what should be
expected of these computer systems
that are increasingly ubiquitous? How
should computer systems be managed
and regulated? Just as importantly,
who should make those decisions?
How will policy experts grapple with
developing regulatory and governance
decisions about the deeply complex
technologies we are developing, and
who will help them understand what
they need to know? U.S. Department of State headquarters in Washington, D.C., USA.
From its roots supporting trajec-
tory calculations and cryptography that affect human health and safety in our innovations are slowing and this
during the wars in the first half of myriad ways; they control the electri- scaling loss is leading to massive top-
the 20th century, computing technol- cal grid, manage transportation, me- to-bottom shifts in how software and
ogy has been deeply intertwined with ter out medicine dosages, and control systems are designed, programmed,
policy and government issues. But the front-door locks on houses. More and operated. The low-level system
PHOTO BY MA RK VA N SCYOC/SHU TTERSTO CK.COM

the societal and personal impact of than ever before, CS as a field faces designer’s response has been to sup-
our inventions is becoming more and deep responsibility for creating al- plant software with increased use of
more apparent and urgent. Artificial gorithms, devices, and systems that specialized hardware accelerators
intelligence and machine learning operate in a manner that is reliable, for cryptographic routines, image
are now integral to a profound ar- secure, ethical, and fair. analysis, and so forth. These hard-
ray of real-world applications, from Simultaneously, the deceleration ware-accelerator-oriented approach-
autonomous vehicles to law enforce- of Moore’s Law and Dennard scaling es offer a viable path forward in the
ment. Internet of Things (IoT) devices mean that the underlying semicon- short-term, but are not without their
and systems are being built and sold ductor improvements supporting challenges. Namely, although both

46 COMMUNICATIO NS O F TH E AC M | M AY 201 8 | VO L . 61 | NO. 5

 viewpoints

hardware and software are suscep- These differences of opinion need to

tible to bugs and vulnerabilities, the be negotiated; without some broader
bugs and vulnerabilities our systems Both domestically and agreement, computer systems will lack
“bake into” hardware are much more abroad, computing the interoperability and ubiquity that
difficult, expensive, and time-con- makes them so vital in our world today.
suming to fix. technology is On a nearly daily basis, a range of
So here we are, in a world where viewed in terms of computing and telecommunications
computing devices and systems have and digital economy issues are be-
more societal impact than ever before, both societal and ing discussed in multilateral forums
and yet they are simultaneously more economical benefits. including United Nations agencies,
difficult to test, debug, patch, or even in the International Telecommunica-
understand than ever before. And in the tions Union (ITU), in the Organization
midst of that, policymakers are—often for Economic Cooperation and De-
with relatively little technical back- velopment (OECD), in the G7, and in
ground—deciding what to do … other similar dialogs. Most research-
From August 2015 to April 2017, I So what did I do as a JSF? I followed ers are surprised when I describe the
was a Jefferson Science Fellow (JSF) a range of computing and communi- frequency of intergovernmental policy
engaged in computing and communi- cations issues for my group, such as meetings on computing topics. One of
cations policy within the United States Internet of Things (IoT), smart cities, my goals as a JSF was to help ensure
Department of State. For the first 12 blockchain, and financial technolo- the U.S. policy approaches at these
months, I lived in Washington, D.C., gies. For these and other broader topics forums were technically sound and
and worked in-person at the Office of (computer security and privacy) I inter- viable. My colleagues and I also ad-
International Communications and preted and explained the technology vocated for approaches and meeting
Information Policy in the Economics behind the topic, and I contributed to outcomes consistent with U.S. values
Bureau at the State Department. After broader governmental and multistake- regarding an open and interoper-
I returned to my university position holder processes to formulate U.S. posi- able Internet governed through mul-
in August 2016, I continued to work tions on the issues. I also participated tistakeholder processes, and a level
remotely on these issues for an addi- in international meetings where these playing field for global tech innova-
tional eight months. The Jefferson Sci- issues were discussed, and I spoke for tion. In addition to learning a great
ence Fellow program was established the U.S. position on these issues, often deal about technology and policy, the
in 2003, acknowledging the strong negotiating with other countries whose time I spent representing my coun-
and widespread impact of science and beliefs in topics like Internet freedom try’s values at international meetings
technology trends on foreign policy differ strongly from our own. also made—at a personal level—for a
issues, and with the goal of augment- Both domestically and abroad, com- deeply fulfilling and patriotic year.
ing the State Department’s in-house puting technology is viewed in terms of Although my JSF immersed me in
science and technology expertise by both societal and economic benefits. international policy arenas, computing
bringing in tenured science and engi- Internet connectivity catalyzes better policy permeates many arenas across
neering professors for one-year fellow- education and healthcare, and it also government, both domestic and broad-
ships. It is one of many efforts across supports economic growth and entre- er. The technical and funding relation-
the U.S. government to include scien- preneurship. Likewise, issues like har- ships between CS researchers and some
tists and technologists in the conver- monizing the communication spec- agencies (Department of Defense, De-
sations regarding how “our” topics trum are also important worldwide, as partment of Homeland Security (DHS),
shape our world and therefore may re- they fundamentally define our ability National Institute of Standards and
quire technical inputs for their policy to use cellphones globally. But from Technology (NIST)) are familiar and
and governance. the Internet writ large, to cellphones, long term. In addition, other agencies
Sometimes when I mention to to tiny IoT devices, different stakehold- play increasing roles both in terms of
computer scientists that I worked at ers can have widely disparate opinions funding and in terms of broader policy
the State Department, they react in about how they should be regulated engagement. For example, the Depart-
surprise, because it does not seem and standardized. In my experience, I ment of Transportation has large proj-
like a tech-heavy arm of our govern- saw countries and companies pushing ects related to smart cities and con-
ment. But as many news stories over to develop broad technical standards nected vehicles that will benefit greatly
recent years have highlighted, when requiring heavyweight cost account- from CS input. Another example is in-
foreign policy decisions involve topics ing methods built into tiny IoT devices, creasing inter-agency attention on ar-
like data privacy, security, encryption, while others preferred lighter weight tificial intelligence policy issues over
Internet censorship, or other charged methods that would avoid these. I also the past two years, including both tech-
scientific topics like climate change, saw proposals of network protocols nical aspects of trust and fairness, as
most of us would agree it is prefer- that encouraged inspection of packet well as broader issues of impact on the
able to have those decisions guided by contents—with considerable privacy economy and labor markets. A further
sound science and technological truth and security implications—that con- example is that as a country, we need
wherever possible. cerned other meeting participants. to decide how to ensure a broad and

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF T HE ACM 47

viewpoints

diverse cross-section of our K–12 stu- opacity or unfairness might lead to

dent population has access to comput- undesirable results. If technologists
ing education and affordable in-home If technologists do not do not speak up to educate policy-
broadband Internet access. Given the speak up to educate makers, bad policy will result, and we
ubiquity of computing in society and in will all have to live with it, as people
our economy, there is a corresponding policymakers, bad and as technologists. There are also
ubiquity of computing-related policy policy will result, many lawmakers in the U.S. and else-
questions in our government. A funda- where who welcome input on techni-
mental issue is: Who will be answering and we will have cal issues; working with them and
these questions? to live with it. their staff to explain technical issues
Three years ago when I decided to and their implications is another way
join the State Department, I found it a to be more engaged. In addition to is-
very hopeful sign that I and many other sues being covered at the U.S. federal
science and technology researchers were level, there are also state and local
working in Washington either as JSFs or issues around data privacy, CS edu-
“on detail” within the Office of Science When I ended my service in April cation, and other topics that are of
and Technology Policy (OSTP), or as IEEE 2017, it was four months earlier than critical importance. Finally, working
or AAAS fellows across government. my original one-year renewal for re- with the press—both technical and
Now I am much less optimistic. mote work, but six months after elec- general—is another avenue for our
The position of Science Adviser to the tion day. In April, my office at the State knowledge to be parlayed into broad-
President has not been filled and much Department included many of the er understanding and action.
of OSTP is quite depleted overall. The same capable and devoted civil ser- I particularly implore my academic
State Department’s reorganization and vants, covering many of the same is- colleagues to speak. While larger tech
hiring freeze has left many leadership sues, as one year earlier before the elec- companies have dozens of public poli-
positions unfilled. This includes the tion. So, my decision to end my service cy advocates engaged full-time in these
State Department position of Science early was, to my considerable surprise, conversations, the longer-term and
and Technology Adviser to the Secretary more about how best to have effec- more company-neutral technical view-
(STAS), which became vacant in July tive impact than about the presiden- points from academia must be heard
2017; the Department’s leadership has tial administration per se, despite my as well. This includes advocacy for re-
not committed to refilling it. The status disagreements with it. In essence, my search and research funding, of course.
of the JSF program in which I partici- decision was that there is a wide range Importantly though, it also goes well
pated is also unclear. The program con- of impactful and much-needed ways beyond funding. The academic CS
tinues but with fewer than half as many to help steer our policymakers in the community must commit time and en-
fellows, and with placements only at right direction. Mailing back my badge ergy to advocacy for tech policy paths
USAID, not at State. More broadly, the in April was not the end of my work in that are technically rational, that bene-
news is filled with stories about the di- that regard, but just the finalization of fit society, and that are decoupled from
minishment of science within offices at a decision to find other ways to do so. the motives of a particular company or
EPA, NOAA, and other agencies. How can computer scientists help its shareholders.
Talking with colleagues right now shape policy for the better and en- At this moment in time, with com-
about government engagement, I am sure maximum societal benefit from puting central to our world and yet sci-
met with a wide range of responses. Im- our breakthroughs in computer sci- ence often being undervalued or even
mediately after the U.S. 2016 election ence? First and foremost, there are denigrated by some policymakers,
and 2017 inauguration, a conversation many important policy issues—IoT computer scientists must continue to
about my role as a JSF would often be security, network neutrality, trustwor- pursue ways and expand our efforts to
met with “How could you continue giv- thy and fair AI, drones, and more— share our technical knowledge for the
en the new administration … ?”. On the where computing practitioners and good of society. Think of one way to
other hand, the change of U.S. adminis- researchers can and should weigh in share your technical knowledge with
tration has not lessened the impact of from the technical side. In the U.S., the broader public or government
computing on today’s world, and there- the FCC, NTIA, NIST, and others are today, and continue with these steps
fore the urgency of computing policy often inviting stakeholders and the each week. Eventually we will either
discussions has not decreased either. general public to participate in poli- have governance and policymaking
In terms of specific technical policy top- cymaking processes on these and that does not make a computer scien-
ics (like spectrum coordination) the U.S. other topics. Just in the past month, tist cringe, or we will at least know that
position has not changed much. Some I have cringed at statements I have it is not for lack of our attention.
see (as I often was able to) that as long seen (on policy-oriented public email
as one is being listened to, and as long lists and in public meetings) made by Margaret Martonosi (mrm@princeton.edu) is an ACM
Fellow, the H.T. Adams ‘35 Professor of Computer Science
as one is not being asked to go against policymakers with unclear apprecia- and the Director of the Keller Center for Innovation in
ethics or beliefs, then having sensible tion for how security patches might Engineering Education at Princeton University, Princeton,
NJ, USA.
tech-savvy people continue to engage be applied to IoT systems, or for how
with any administration is a good thing. AI algorithms work, and for where Copyright held by author.

48 COMMUNICATIO NS O F TH E AC M | M AY 201 8 | VO L . 61 | NO. 5

 ACM Welcomes the Colleges and Universities
Participating in ACM’s Academic
Department Membership Program

ACM now offers an Academic Department Membership option, which allows universities and colleges
to provide ACM Professional Membership to their faculty at a greatly reduced collective cost.

The following institutions currently participate in ACM’s Academic Department Membership program:

• Appalachian State University • Northeastern University • University of Colorado Denver

• Armstrong State University • Ohio State University • University of Connecticut
• Ball State University • Old Dominion University • University of Illinois at Chicago
• Berea College • Pacific Lutheran University • University of Jamestown
• Bryant University • Pennsylvania State University • University of Memphis
• Calvin College • Regis University
• University of Nebraska at Kearney
• Colgate University • Roosevelt University
• University of Nebraska Omaha
• Colorado School of Mines • Rutgers University
• University of North Dakota
• Edgewood College • Saint Louis University
• University of Puget Sound
• Franklin University • San José State University
• University of the Fraser Valley
• Georgia Institute of Technology • Shippensburg University
• University of Wyoming
• Governors State University • St. John’s University
• Harding University • Trine University • Virginia Commonwealth University

• Hofstra University • Trinity University • Wake Forest University

• Howard Payne University • Union College • Wayne State University
• Indiana University Bloomington • Union University • Western New England University
• Mount Holyoke College • University of California, Riverside • Worcester State University

Through this program, each faculty member receives all the benefits of individual professional membership,
including Communications of the ACM, member rates to attend ACM Special Interest Group conferences,
member subscription rates to ACM journals, and much more.

For more information: www.acm.org/academic-dept-membership

practice
DOI:10.1145/ 3154011
Increasingly, many ap-

Article development led by
queue.acm.org
plications and websites
rely on distributed back-
ends running in cloud
Expert-curated guides to datacenters. In these
the best of CS research. datacenters, clusters of
hundreds or thousands of machines
BY MALTE SCHWARZKOPF run workloads ranging from fault-tol-
erant, load-balanced Web servers to

Research for
batch data-processing pipelines and
distributed storage stacks.
A cluster manager is special “or-
chestration” software that manages

Practice:
the machines and applications in
such a datacenter automatically:
some widely known examples are Ku-
bernetes, Mesos, and Docker Swarm.

Cluster
Why are cluster managers needed?
Most obviously because managing
systems at this scale is beyond the ca-
pabilities of human administrators.

Scheduling for
Just as importantly, however, automa-
tion and smart resource management
save real money. This is true both at

Datacenters
large scale—Google estimates that its
cluster-management software helped
avoid building several billion-dollar
datacenters—and at the scale of a
startup’s cloud deployment, where
wasting hundreds of dollars a month
on underutilized virtual machines
may burn precious runway.
As few academic researchers have
Research for Practice features
T H I S INSTALLM E NT O F access to real, large-scale deployments,
academic papers on cluster manage-
a curated selection from Malte Schwarzkopf, who ment largely focus on scheduling work-
takes us on a tour of distributed cluster scheduling, loads efficiently, given limited resourc-
from research to practice, and back again. With es, rather than on more operational
aspects of the problem. Scheduling is
the rise of elastic compute resources, cluster an optimization problem with many
management has become an increasingly hot topic possible answers whose relative good-
ness depends on the workload and
in systems R&D, and a number of competing cluster the operator’s goals. Thinking about
managers including Kubernetes, Mesos, and Docker solutions to the scheduling problem,
are currently jockeying for the crown in this space. however, has also given rise to a vigor-
ous debate about the right architecture
Interested in the foundations behind these systems, for scalable schedulers for ever larger
and how to achieve fast, flexible, and fair scheduling? clusters and increasingly demanding
workloads.
Malte’s got you covered! Let’s start by looking at a paper
—Peter Bailis that nicely summarizes the many
facets of a full-fledged industry clus-
Peter Bailis is an assistant professor of computer science at Stanford University.
His research in the Future Data Systems group (futuredata.stanford.edu) focuses
ter manager, and then dive into the
on the design and implementation of next-generation data-intensive systems. scheduler architecture debate.

50 COMMUNICATIO NS O F TH E AC M | M AY 201 8 | VO L . 61 | NO. 5

 Google’s “Secret Sauce”
Verma, A. et al.
Large-scale cluster management at Google
with Borg. In Proceedings of the 10th European
Conference on Computer Systems, 2015,
18:1–18:17; http://dl.acm.org/citation.
cfm?id=2741964.

This paper is mandatory reading for

anyone who wants to understand what
it takes to develop a full-fledged cluster
manager and to deploy it effectively. Borg lem, often proposing improvements ing policy, Mesos neatly separates two
handles all aspects of cluster orchestra- that seemingly might apply to Borg. Un- concerns: a lower-level resource man-
tion: it monitors the health of machines, fortunately, they can at times be quite ager allocates resources to frameworks
restarts failed jobs, deploys binaries and confusing: some describe schedulers (for example, subject to fairness con-
secrets, and oversubscribes resources that operate at a higher level than Borg, straints), and the higher-level framework
just enough to maintain key SLOs (ser- or ones designed for workloads that dif- schedulers choose which specific tasks to
vice-level objectives), while also leaving fer from Google’s mix of long-running run where (for example, respecting data
few resources to sit idle. service jobs and finite-runtime batch- locality preferences). An important con-
To achieve this, the Borg develop- processing jobs. Fortunately, the next sequence of this design is that Mesos
ers had to make many decisions: from paper describes a neat way of separating can support long-running service tasks
choosing an isolation model (Google some of these concerns. just as well as short, high-throughput
uses containers), to how packages are ˲˲ https://dl.acm.org/citation. batch-processing tasks—they are simply
distributed to machines (via a torrent- cfm?id=2898444 handled by different frameworks.
like distribution tree), how tasks and ˲˲ https://dl.acm.org/citation. Mesos avoids having a complex
jobs find each other (using a custom cfm?id=2465386 API for frameworks to specify their
DNS-like naming system), why and how resource needs. By inverting the in-
low-priority and high-priority work- teraction between frameworks and
loads share the same underlying hard- Many Schedulers: Offers or Requests? the resource manager: instead of
Hindman, B. et al.
ware (a combination of clever oversub- frameworks requesting resources, the
Mesos: A platform for fine-grained resource
scription, priority preemption, and a sharing in the datacenter. In Proceedings of the Mesos resource manager offers re-
quota system), and even how to handle Usenix Conference on Networked Systems Design sources to frameworks in turn. Each
failures of the Borgmaster controller and Implementation, 2011, 295–308; http:// framework takes its pick, and the re-
component (Paxos-based failover to a static.usenix.org/events/nsdi11/tech/full_pa- source manager subsequently offers
pers/Hindman_new.pdf.
new leader replica). There is a treasure the remaining resources to the next
trove of neat tricks here (for example, Mesos was the first academic publication one. Using appropriately sized of-
the automated estimation of a task’s on modern cluster management and fers, Mesos can also enforce fair-
real resource needs in §5.5), as well as scheduling. The implementation is open ness policies across frameworks, al-
a ton of operational experience and source and appeared at a time when Borg though this aspect has in practice
sound distributed-system design. was still unknown outside Google. The turned out to be less important than
A related Queue article describes Mesos authors had the key insight, later perhaps originally anticipated.
how Borg and Omega, also developed reaffirmed by the Borg paper, that dy- The Mesos offer mechanism is some-
at Google, have impacted Kubernetes, namically sharing the underlying cluster what controversial: Google’s Omega pa-
an open source cluster manager de- among many different workloads and per observed that Mesos must offer all
veloped with substantial inspiration frameworks (for example, Hadoop, cluster resources to each framework to
from Borg. The features Kubernetes Spark, and TensorFlow) is crucial to expose the full knowledge of existing state
offers are currently far more limited achieving high resource utilization. (including, for example, preemptible
than Borg’s, but Kubernetes catches Different frameworks often have dif- tasks), but that a slow framework sched-
up further with every release. ferent ideas of how independent work uler can adversely affect other frame-
The actual scheduling of work to ma- units (tasks) should be scheduled; in- works and overall cluster utilization in
chines comprises only one subsection deed, the frameworks that Mesos target- the absence of optimistic parallel offers
IMAGE BY AH A-SOF T

of the Borg paper (§3.2), but it is both ed initially already had their own sched- and a conflict-resolution mechanism. In
challenging and crucially important. ulers. To arbitrate resources among response, the Mesos developers devised
Many standalone papers have been writ- these frameworks without forcing them concepts for such extensions to Mesos.
ten solely about this scheduling prob- into the straitjacket of a single schedul- The multischeduler design intro-

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF T HE ACM 51

practice

duced by Mesos has been quite impact- application-level task scheduler with-
ful: many other cluster managers have in each Spark job scales to only about
since adopted similar architectures, 1,500 tasks per second. Queueing tasks
though they use either request-driv- for assignment at a single scheduler

Scheduling is en allocation (for example, Hadoop

YARN) or an Omega-style shared-state
hence increases their overall “makes-
pan” (the time between task submission
an optimization architecture (for example, Microsoft’s
Apollo and HashiCorp’s Nomad).
and completion). It also leaves resources
idle while waiting for new tasks to be as-
problem with Another deliberate consequence of signed by the overwhelmed scheduler.
many possible the offer-driven design is that the Me-
sos resource manager is fairly simple,
Sparrow addresses this problem in
a radical way: it builds task queues at
answers whose which benefits its scalability. The next each worker and breaks the scheduler
relative goodness two papers look deeper into this con-
cern: the first one proposes an even
into several distributed schedulers that
populate these worker-side queues in-
depends on the simpler design for even greater scal- dependently. Using the “power of two
workload and the ability, and the second suggests that
scaling a complex scheduler is more
random choices” property, which says
that (under certain assumptions) it
operator’s goals. feasible than widely thought.
˲˲ http://mesos.apache.org/
suffices to poll two random queues to
achieve a good load balance, Sparrow
˲˲ https://dl.acm.org/citation. then randomly places tasks at workers.
cfm?id=2465386 This requires neither state at the sched-
˲˲ https://dl.acm.org/citation. uler, nor communication between
cfm?id=2523633 schedulers—and, hence, scales well by
˲˲ http://bit.ly/2sqMUmP simply adding more schedulers.
˲˲ https://www.nomadproject.io/ This paper includes several impor-
tant details that make the random-
placement approach practical and
Breaking the Scheduler Further Apart bring it close to the choices that an om-
Ousterhout, K. et al. niscient scheduler would make to bal-
Sparrow: Distributed, low-latency scheduling. ance queue lengths perfectly. As an ex-
In Proceedings of the Symposium on Operating ample, Sparrow speculatively enqueues
Systems Principles, 2013, 69–84; http://dl.acm.
a given task in several queues, spread-
org/citation.cfm?id=2522716.
ing its bets across multiple workers and
Even within what Mesos considers smoothing head-of-line blocking from
framework-level tasks, there may be other straggler tasks. It can also deal
another level of scheduling. Specifical- with placement constraints and offer
ly, some data-analytics systems break weighted fair sharing across multiple
their processing into many short work jobs that share the same workers.
units: Spark, for example, generates Sparrow could in principle be used as
application-level “tasks” that often run a cluster-level scheduler, but in practice
for only a few hundred milliseconds works best when it load-balances appli-
(note that these are different from the cation-level tasks over long-running
cluster-level tasks that Borg or Mesos workers of a single framework (which,
frameworks place!). Using such short for example, serves queries or runs an-
tasks has many benefits: it implicitly alytics jobs). At the cluster-scheduler
balances load across the workers that level, task startup overheads normally
process them; failing tasks lose only make tasks below tens of seconds in
a small amount of state; and straggler duration impractical because package
tasks that run much longer than others distribution, container launch, among
have smaller absolute impact. others already take several seconds.
Shorter tasks, however, impose a Consequently, the open source Spar-
higher load on the scheduler that places row implementation supplies a Spark
them. In practice, this is usually a frame- application-level scheduler plug-in.
work-level scheduler, or a scheduler Finally, while Sparrow’s random-
within the job itself (as in standalone ized, distributed decisions are scalable,
Spark). With tens of thousands of tasks, they assume that tasks run within fixed-
this scheduler might get overwhelmed: size resource slots and that queues of
it might simply be unable to support the equal length amount to equally good
decision throughput required. Indeed, choices. Several follow-up papers im-
the paper shows that the centralized prove more along these dimensions

52 COMM UNICATIO NS O F THE AC M | M AY 201 8 | VO L . 61 | NO. 5

 practice

while maintaining the same distribut- incrementally if possible, refining a previ- scale. In some cases, scheduler scal-
ed architecture for scalability and fault ous solution rather than starting over. ability can also be an issue in smaller
tolerance. One paper, however, looks With some additional tricks, Fir- clusters, however: if you are running
at whether Sparrow-style wide distribu- mament achieves subsecond decision interactive analytics workloads with
tion is really required for scalability. times even when scheduling a Google- short tasks, a scalable scheduler may
˲˲ https://github.com/radlab/sparrow scale cluster running hundreds of thou- give you better resource utilization.
sands of tasks. This allows Sparrow- Another important aspect of the
style application-level tasks to be placed scheduling problem is that clus-
Can We Have Quality and Speed? within hundreds of milliseconds in a ter workloads are quite diverse, and
Gog, I. et al.
centralized way even on thousands of scheduling policies in practice often
Firmament: Fast, centralized cluster scheduling
at scale. In Proceedings of the Usenix machines. The paper also shows there require substantial hand-tuning using
Conference on Operating Systems Design and is no scalability-driven need for distrib- placement constraints. Indeed, this is
Implementation, 2016, 99–115; https://www. uted cluster-level schedulers, as Fir- what makes cluster scheduling differ-
usenix.org/system/files/conference/osdi16/ mament runs a 250-times-accelerated ent from the multiprocessor schedul-
osdi16-gog.pdf.
Google cluster trace with median task ing that your kernel does: while most
Distributed decisions improve scalabili- runtimes of only four seconds, while applications are fine with the general-
ty and fault tolerance, but schedulers still making subsecond decisions in purpose policies the kernel applies
must make them in the presence of re- the common case. The simulator and to assign processes to cores, current
duced (and only statistically sampled) Firmament itself are open source, and cluster-level placement policies often
information about cluster state. By con- there is a plug-in that allows Kuber- do not work well for all workload mixes
tract, centralized schedulers, which netes to use Firmament as a scheduler. without some manual operator help.
make all decisions in the same place, The Firmament paper suggests we
have the information to apply more so- need not compromise on decision Future Directions
phisticated algorithms—for example, to quality to solve a perceived scalability Since it is challenging for humans to
avoid overloaded machines. Of course, problem in cluster scheduling. Never- develop scheduling policies and good
this applies both at the cluster level and theless, Sparrow-style distributed placement heuristics that suit all (or
to application-level schedulers. schedulers are useful: for example, a even most) workloads, research on
This paper sets out to investigate fault-tolerant application-level load policies that help in specific settings is
whether—fault-tolerance benefits not- balancer that serves a fixed set of equal- guaranteed to continue.
withstanding—distribution is indeed ly powerful workers might well wish to Another approach, however, may
necessary for scalability. It notes that it is use Sparrow’s architecture. also be viable. Recent, early results
crucial to amortize the cost of decisions ˲˲ https://dl.acm.org/citation. suggest that the abundant metrics
over many tasks, especially if the sched- cfm?id=1629601 data and the feedback loops of cluster-
uler supports features that require recon- ˲˲ https://github.com/camsas/ scheduling decisions are a good fit for
sidering the existing placements, such as firmament modern machine-learning techniques:
task preemption. Think about it this way: ˲˲ https://github.com/camsas/poseidon they allow training neural networks to
If the scheduler picked a task off a queue, automatically learn custom heuristics
looked at a whole bunch of machines, Research to Practice tailored to the workload. For example,
and did some complex calculations just What does all this mean for you, the reinforcement learning can effectively
to decide where to put this single task, it reader? For one, you are almost cer- learn packing algorithms that match or
cannot scale well to many tasks. tainly already using applications that outperform existing, human-specified
Firmament generalizes the Quincy run on Borg and other cluster manag- heuristics, and a neural network outper-
scheduler, a cool—and sometimes- ers every day. Moreover, if you are run- forms human planners in TensorFlow’s
overlooked—system that uses a min- ning a business that computes on large application-level operator scheduling.
cost, max-flow constraint solver to data or runs web applications (or, es- Therefore, future research may
schedule batch workloads. The con- pecially, both!), you will probably want raise the level of automation in cluster
straint solver always schedules the entire the automation of a cluster manager. management even further: perhaps the
cluster workload, not just waiting tasks. Many companies already do so and cluster scheduler will someday learn
Because min-cost, max-flow solvers are run their own installations of Mesos or its own algorithm.
highly optimized, their algorithms am- Kubernetes on clusters of VMs provi- ˲˲ https://dl.acm.org/citation.
ortize the work well over many tasks. sioned on the cloud or on machines on cfm?id=3005750
Applied naively, however, the Quincy their own premises. ˲˲ https://arxiv.org/abs/1706.04972
approach cannot scale to large work- The problem of scaling cluster
loads over thousands of machines—the managers and their schedulers to very Editor’s Note: To read this article with embedded
hyperlinks, visit https://queue.acm.org/detail.
constraint-solver runtime, which domi- large clusters, however, is one that cfm?id=3173558.
nates scheduling latency, would be un- most readers won’t have to face: only
acceptably long. To fix this, Firmament a few dozen companies run such large Malte Schwarzkopf is a post-doctoral associate in the
Parallel and Distributed Operating Systems (PDOS) Group
concurrently runs several min-cost, max- clusters, and buying resources on AWS at MIT, Cambridge, MA, USA.
flow algorithms with different properties (Amazon Web Services) or Google’s or Copyright held by owner/author.
and solves the optimization problem Microsoft’s clouds is the easiest way to Publication rights licensed to ACM. $15.00

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF T HE ACM 53

practice
DOI:10.1145/3190566
Google has deployed a shared cen-

Article development led by
queue.acm.org
tralized service called Canary Analysis
Service (CAS) that offers automatic (and
often autoconfigured) analysis of key
Automated canarying quickens metrics during a production change.
development, improves production CAS is used to analyze new versions of
binaries, configuration changes, da-
safety, and helps prevent outages. taset changes, and other production
changes. CAS evaluates hundreds of
BY ŠTĚPÁN DAVIDOVIČ AND BETSY BEYER thousands of production changes ev-

Canary
ery day at Google.
CAS requires a very strict separa-
tion between modifying and analyz-
ing production. It is a purely passive
observer: it never changes any part of

Analysis
the production system. Related tasks
such as canary setup are performed
outside of CAS.
In a typical CAS workflow (shown in
Figure 1), the rollout tool responsible

Service
for the production change deploys
a change to a certain subset of a ser-
vice. It may perform some basic health
checks of its own. For example, if push-
ing a new version of an HTTP server
causes a process restart, the rollout
tool might wait until the server marks
itself as able to serve before proceed-
ing. (This may also inform the deploy-
ment speed of the production change.
This rollout tool behavior is not specif-
ic to canarying.)
This subset of production now
constitutes the canary population. By
conducting an A/B test compared to a
I N 1 913, SCOTTIS H physiologist John Scott Haldane control population, CAS answers the
proposed the idea of bringing a caged canary into a question, “Is the canary meaningfully
worse?” The control population is a
mine to detect dangerous gases. More than 100 years (possibly strict) subset of the remain-
later, Haldane’s canary-in-the-coal-mine approach is der of the service. Importantly, CAS is
not trying to establish absolute health.
also applied in software testing. The population should be as fine-
In this article, the term canarying refers to a partial grained as possible. For example, an ap-
and time-limited deployment of a change in a service, plication update can use a global iden-
tifier of that particular process, which
followed by an evaluation of whether the service at Google would be a BNS (Borg Nam-
change is safe. The production change process may ing Service) path. A BNS path is struc-
tured as /bns/<cluster>/<user>/<job
then roll forward, roll back, alert a human, or do name>/<task number>. The job name
something else. Effective canarying involves many is a logical name of the application, and
IMAGE BY NU CL EA RTIST

decisions—for example, how to deploy the partial task number is the identifier of a par-
ticular instance.2 For a kernel update,
service change or choose meaningful metrics—and the identifier might be machine host-
deserves a separate discussion. name: clearly, multiple processes can

54 COM MUNICATIO NS O F TH E ACM | M AY 201 8 | VO L . 61 | NO. 5

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF T HE ACM 55
practice

run on the same machine, but (mod- CAS provides a point-in-time ver- gained extensive coverage across all of
ulo virtualization) you are limited to a dict after evaluation: a simple PASS or Google by integrating with all major tools
single running kernel, so granularity is FAIL, meaning the system is perform- used to change production, including
defined at the machine level. Granular- ing either the same or in a danger- tools to roll out new binaries, configura-
ity allows the caller to slice and dice the ously anomalous way. (A third option, tions, and data sets. Widespread integra-
overall service with no restrictions at NONE, is also possible if underlying tion required a conservative integration
runtime, and it makes a static preexist- infrastructure was unavailable and approach: in some cases, concessions in
ing canary setup unnecessary. CAS could not reach a verdict. Clients the analysis quality had to be made in fa-
Once the canary population is set commonly treat this the same as if they vor of not inconveniencing users.
up, the rollout tool requests a verdict could not reach CAS.) The signal must Yet another barrier to entry was re-
from CAS. This request specifies the be clear and unambiguous for the roll- moved by not requiring a canary setup
canary and control populations, as out tool to take an action such as roll- in order to start using CAS. If the user
well as a time range for each member ing forward, rolling back, or alerting does not specify a configuration, de-
of that population. An entity’s canary a human. CAS intentionally does not fault analyses are performed across
status can be ephemeral: the canary provide a confidence score, p-value, or metrics that can be reasoned about
only became a canary at some specific the like: that would imply that the roll- across the board. CAS auto-discovers
point in time; before that time, it did out tool has logic to determine when features of canaried systems, such as
not have the tested production change. to take a real-world action. Keeping whether the binary is C++ or Java, or
The request also contains a refer- this decision centralized allows better which RPC (remote procedure call)
ence to a user-supplied configuration, reuse and removes the risk of creat- methods receive significant traffic,
if one exists. As discussed in the follow- ing artificial confidence scores from a then chooses analyses to run (for exam-
ing section, CAS tries to provide value, meaningless heuristic. ple, RPC error ratio) for those features.
even without external configuration, by Default tooling integration and Google’s infrastructure homogeneity
enforcing things we hold generally true. zero configuration option. CAS quickly makes this largely successful.

Figure 1. Diagram of typical CAS workflow. Service Design

CAS’s relatively simple high-level inter-
actions are enabled by a fairly complex
application
system under the hood.
1. set up canary
Public API in detail. CAS’s API has
rollout two RPC calls: Evaluate() and Get-
tool canary control
Result(). Evaluate() is given one or
4. roll
forward/back
more trials and returns a unique string
identifier, Evaluation ID, which is a
2. ask CAS 3. receive verdict fully qualified URL to the CAS user in-
terface. This simple trick has made it
quite trivial to insert these links into
canary
various rollout tools, since it means
analysis
service population they do not need any additional client-
descriptors side logic to figure out how to turn an
identifier into a URL. Trials are pairs
of canary and control populations
and the time range during which they
Figure 2. Diagram of CAS main components. should be compared; if the end time of
the time range is left unset, CAS is free
rollout tool to decide how much time the evalua-
tion needs. This means striking a bal-
ance between delaying the evaluation
web front end model server too much and not having enough data
to reach a meaningful conclusion. In
RPC front end coordinator
practice, at least five minutes of data
config server
are required. The call is reasonably fast
(typically under a second), and the API
evaluator
spanner
retains the resulting data indefinitely
(or at least until garbage collection of
evaluations that are clearly no longer
relevant). The client sends one RPC for
Monarch a logical evaluation.
The CAS API does not promise
that the evaluation will start when the

56 COMM UNICATIO NS O F THE ACM | M AY 201 8 | VO L . 61 | NO. 5

 practice

Evaluate() call is sent. Instead, anal- fails, the entire evaluation is declared a
ysis starts on GetResult(), since that failure, and FAIL is returned.
indicates someone is interested in the Currently, trials are implemented
result. As an optimization, the analysis to be fairly independent, though a
actually starts on Evaluate(), but in
order to set appropriate expectations CAS’s relatively given evaluation request might have
multiple trials if they look at two re-
with the client, this optimization is not
part of the API definition.
simple high-level lated but different components. For
example, consider an application with
GetResult() takes one parameter: interactions are a front end and a back end. Changes
the Evaluation ID. This RPC blocks until
the analysis process is finished, which
enabled by a fairly on the front end can trigger bad be-
havior on the back end, so you need to
can take between a few seconds and a complex system compare both:
few minutes after the end time of the
request; GetResult() is idempotent.
under the hood. ˲˲ The canary front end to the pro-
duction front end.
For the sake of reliability, CAS de- ˲˲ The back end receiving traffic
velopers designed the system with two from the canary front end to a back
calls. This setup allows the system to end receiving traffic from the produc-
resume processing a request without tion front end.
requiring complex client cooperation. These are different populations,
This reliability strategy played out in possibly with different metrics, but
practice when a bug in a library made failure on either side is a potential
all CAS processes crash every five to 10 problem.
minutes. CAS was still able to serve all Configuration structure. What ex-
user requests, thanks to the robust API. actly does a user-defined configuration
There are some obvious alternatives entail? While the design phase of CAS
to this design. CAS developers decided involved lengthy philosophical discus-
against using a single long-running sion about the nature of configuration,
RPC: since these calls are fundamen- the primary aim was simplicity. The
tally point-to-point connections be- CAS developers did not want to force
tween two Unix processes, disruption users to learn implementation details
(for example, because one process re- to encode their high-level goals into a
started) would lead to a full retry from configuration. The intent was to ask us-
the client side. The original design doc ers only a few questions, as close to the
included a large number of options, user’s view of the world as possible.
each with trade-offs tied to nuanced The individual checks that should
properties of Google’s infrastructure be executed for each matching trial de-
and requirements. fine what information is needed. For
Evaluation structure. While the RPC each check, the user specifies:
returns only a simple PASS/FAIL ver- ˲˲ What it should be called.
dict, the underlying analysis consists ˲˲ How to get the time series for the
of several components. particular metric.
The lowest-level unit is a check, a ˲˲ How to turn these time series into
combination of time series from the a verdict.
canary population, time series from The user can also include optional
the control population, and a statisti- pieces of information, such as a long-
cal function that turns both time series form description.
into an unambiguous PASS/FAIL ver- Monarch is the typical source of
dict. Some example checks might be: monitoring data for time series.1 The
˲˲ Crash rate of the canary is not sig- user specifies an abstract query, and
nificantly greater than the control. the canary and control populations are
˲˲ RPC error ratio is not significantly determined at runtime in the RPC that
greater than the control. requests evaluation. CAS has a flexible
˲˲ Size of dataset loaded in memory automatic query rewrite mechanism:
is similar between canary and control. at runtime, it rewrites an abstract que-
As mentioned in the API descrip- ry to specialize it to fetch data only for
tion, each evaluation request can de- a particular population. Say a user con-
fine multiple trials (that is, pairs of figures a query, “Get CPU usage rate.”
canary and control populations). Eval- At runtime, CAS rewrites that query as
uation of each trial results in a collec- “Get CPU usage rate for job foo-server
tion of checks. If any check in any trial replicas 0, 1, 2.” This rewrite happens

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF T HE ACM 57

practice

for both the canary population and the until the evaluation is complete. If the
control, resulting in two queries. coordinator is not tracking the evalua-
It is possible, although uncom- tion (for example, if a restart resulted
mon, to specify different queries in lost state) or if no coordinator is as-
for the canary and the control. The
queries are still subject to rewriting, Checkpoints occur signed, the RPC front end chooses a
coordinator, stores that information in
which guarantees that they will fetch after a coordinator the database, and calls AwaitEvalu-
ation(). These retries are limited.
receives a
data only for the objects that are actu-
ally being evaluated. If the evaluation has already fin-
To simplify configuration, there are
also common queries. These are canned
fully qualified ished, the RPC front end does not con-
tact the coordinator and immediately
queries curated by the CAS team, such configuration and returns the results from the database
as crash rate, RPC server error ratio,
and CPU utilization. These offer known
asynchronously as to the caller.
It is very cheap for the RPC front
semantics, for which CAS can provide evaluators return end to handle parallel GetResult()s.
better quality analysis.
Finally, there needs to be a way to check-evaluation Selecting one coordinator avoids du-
plication of expensive work unless the
turn the time series (possibly multi- requests. client requests two duplicate and inde-
ple streams) obtained by running the pendent evaluations.
Monarch query for canary and control Coordinator. The coordinator keeps
populations into an unambiguous ver- all evaluations it is currently processing
dict. The user can choose from a family in memory. Upon AwaitEvaluation(),
of tests. Some tests (such as Student’s the coordinator checks whether the
t-test) have a clear statistical origin, evaluation is being processed. If so, the
while others contain custom heuristics coordinator simply adds this RPC to the
that attempt to mimic how a human set of RPCs awaiting the result.
would evaluate two graphs. If the evaluation is not being pro-
As we will discuss, automatic analy- cessed, the coordinator transactionally
ses are applied if a user chooses the de- takes ownership of the evaluation in
fault configuration, as well as on user- the database. This transaction can fail
supplied queries if the user does not if another coordinator (for whatever
specify a statistical test. reason, such as a race condition) inde-
pendently takes ownership, in which
System Components case the coordinator pushes back to
and Request Flow the RPC front end, which then contacts
Figure 2 illustrates the components of the new canonical coordinator.
the CAS system. This section describes Upon receiving a new evaluation,
the role of each component and the the coordinator does the following:
CAS request flow. 1. Retrieves fully qualified and un-
Spanner database. The Spanner ambiguous expanded configuration
database is a shared synchronization from the config server. The coordinator
point for the evaluation flow; almost all now has the full set of all checks to run.
components write to it. It is the canoni- 2. Fans out each check to evaluators.
cal storage for evaluation progress and 3. Calls the model server to obtain
final status. predicted behavior for checks, simul-
RPC front end. The rollout tool taneously reporting the results of the
sends Evaluate() calls to the RPC checks in the current evaluation.
front end, which is intentionally very 4. Responds to all waiting Await-
simple. The front end generates a Evaluation() RPCs with the final
unique identifier for the evaluation, verdict.
stores the entire evaluation request The coordinator checkpoints prog-
in the database (with the unique ress to the database throughout.
identifier as primary key), and re- Checkpoints occur after a coordina-
turns the identifier. tor receives a fully qualified configu-
GetResult() calls also land on the ration and asynchronously as evalua-
RPC front end, which queries the da- tors return check-evaluation requests.
tabase to see if a coordinator is already If the coordinator dies, a new one
working on the evaluation. If so, the RPC takes over, reads progress from the
front end sends an AwaitEvaluation() database, and continues from the last
RPC to the coordinator, which blocks coordinator’s checkpoint.

58 COMM UNICATIO NS O F THE ACM | M AY 201 8 | VO L . 61 | NO. 5

 practice

Configuration server. The configu- If a user configures a statistical baseline for analysis. Whereas anom-
ration server looks up and fully ex- test, then the evaluator runs only that aly detection for monitoring triggers
pands a configuration that matches an test. If the user opts for autoconfigura- user alerts (possibly at 4 A.M.), bad
evaluation. tion, however, the evaluator may run CAS-related rollouts are far less intru-
When the configuration is explic- dozens of tests with various param- sive—typically resulting in a pause or
itly referenced in a request, lookup eters, which generate data that feeds a rollback.
is trivial. If the configuration is not into the model server. Users can opt out of autoconfigura-
explicitly referenced, a set of auto- The evaluator returns the data from tion by specifying a test and its param-
matic lookup rules search for the tests and any potential metadata (such eters manually.
user’s default config. These lookup as errors talking to time-series stores) Online behavior learning. In the
rules are based on features such as to the coordinator. simplest terms, we want to determine
who owns the canaried service. Model server. The model server per- the typical behavior of the system be-
The CAS-submitted configuration forms automatic data analysis. After ing evaluated during similar produc-
is generic: it might say something like evaluation, the coordinator asks the tion changes. The high-level assump-
“Fetch HTTP error rate,” without speci- model server for predictions. The re- tion is that bad behavior is rare.
fying where to fetch the error rate. In quest contains information about the This process takes place online,
the typical flow, the rollout tool identi- evaluation and all observed verdicts since it must be possible to adapt
fies the current canary and passes this from the evaluator. quickly: if a behavior is anomalous but
information along to CAS when the For each observed verdict, the mod- desirable, CAS fails the rollout; when
evaluation is requested. As a result, the el server returns its expected verdict for the push is retried, CAS needs to adapt.
configuration author cannot necessar- that particular evaluation. It returns Adaptive behavior poses a risk if a
ily predict the canary population. this information to the coordinator, user keeps retrying a push when an
To support this flexibility, the con- which ignores results of statistical anomaly is actually dangerous: CAS
figuration server expands configura- functions for predicted failures when eventually starts treating this risky be-
tion and canary/control population deciding the overall verdict. If the mod- havior as the new norm and no longer
definitions to specify exactly what el server predicts failure because said flags it as problematic. This risk be-
data is requested. For example, the failure is typical behavior, this behav- comes less severe as the automation
user’s “Fetch HTTP error rate” be- ior is deemed a property of the evalu- becomes more mature and reliable, as
comes “Fetch HTTP error rate from ated system and not a failure of this users are less inclined to blindly retry
these three processes for canary data, particular canary evaluation. (assuming an incorrect evaluation) and
and from these ten processes for more inclined to actually debug when
control data.” From a user’s point of Autoconfiguration CAS reports a failure.
view, after configuring the generic Canarying properly is a complex pro- Offline supporting processes can
variant, the “right thing” happens cess, as the user needs to accomplish supplement the standard online learning.
automatically, removing any need to these nuanced tasks: Breakdown of observations. In-
define a dedicated canary setup be- ˲˲ Correctly identify a meaningful tuitively, you know that comparing
fore canarying (although users can canary deployment that creates a rep- the same metrics across different
define such a setup if they have other resentative canary population with re- binaries may yield different results.
reasons to do so). spect to the evaluation metrics. Even if you look at the same metric
Besides evaluations, the configura- ˲˲ Choose appropriate evaluation (RPC latency, for example), a stateful
tion server also receives configuration metrics. service such as BigTable may behave
updates, validates updates for correct- ˲˲ Decide how to evaluate canaries as quite differently from a stateless Web
ness and ACLs (access control lists), and passing or failing. search back end. Depending on the
stores these updates in the database. CAS eases the burden by removing binary being evaluated, you may want
Evaluator. The evaluator receives a the most daunting of these tasks: eval- to choose different parameters from
fully defined configuration (after the uating what it means for a time-series the statistical tests, or even different
expansion already mentioned) for each pair to pass or fail. CAS builds upon statistical tests altogether.
check, with each check in a separate the underlying argument that running Rather than attempting to per-
RPC. The evaluator then: reliable systems should not require in- form in-depth discovery of potential
1. Fetches time series for both ca- depth knowledge of statistics or con- functional dependencies, CAS breaks
nary and control data from the appro- stant tuning of statistical functions’ down observations across dimen-
priate time series store. parameters. sions based upon past experiences
2. Runs statistical tests to turn the CAS uses behavior learning that with running production systems.
resulting pair of sets of time series is slightly different from the general You may well discover other relevant
into a single PASS/FAIL verdict for each problem of anomaly detection for dimensions over time.
statistical test (pair because of canary/ monitoring. In the CAS scenario, you Currently, the system groups obser-
control; sets because it is possible, for already know that a service is being vations by the following factors:
example, to have a time series per run- changed, and exactly where and when ˲˲ Data source. Are you observing
ning process and have many processes that change takes place; there is also a process crash rate, RPC latency, or
in the canary or control groups). running control population to use as a something else? Each data source is

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF T HE ACM 59

practice

assigned a unique identifier by finger- Each statistical function has a mini- relatively few unexpected risks. It still
printing the configuration and some mum pass ratio. The ratio sum[PASS] / greatly improves automated canary-
minor heuristics to remove common (sum[PASS] + sum[FAIL] + sum[NONE]) ing. The developers are actively work-
sources of unimportant differences. must be greater than the minimum for ing on improvements.
˲˲ Statistical function and parameters. a PASS prediction. Otherwise, the pre-
This could mean, for example, a t-test diction is FAIL. Future Work
with significance level of 0.05. Each This ratio allows CAS to impose a Time series aggregate models. While
distinct statistical function and param- notion of strictness on various func- the meta-analysis of the results of hard-
eter set is assigned a unique identifier. tions, while being tolerant of “nor- coded statistical functions has worked
˲˲ Application binary. mal” volatile behavior. For example, well for the initial launch of automatic
˲˲ Geographical location. This refers consider two statistical functions: configuration, this approach is crude
to locations of the canary and control. one that tolerates only 1% deviation and inflexible. Rather than storing re-
˲˲ Process age. Has the process recently between canary and control, and one sults of statistical tests without any
restarted? This helps distinguish that tolerates 10%. The former can knowledge about the time series that
a configuration push (which might be given a very high minimum pass caused them, CAS could store data
not restart the process) from a binary ratio, and the latter a lower one. If about the time series.
update (which likely would). the metric fluctuates more than 1% Each statistical function that CAS
˲˲ Additional breakdowns, such as dif- in normal operation, CAS quickly supports requires different data from
ferent RPC methods. For example, read- learns that behavior and stops flag- the time series. We could attempt to ex-
ing a row in BigTable may behave very ging it. If that fluctuation is a one- tract constant-size aggregate views on
differently from deleting the entire off, CAS flags it, the system recov- this data, one for each statistical test.
table. This breakdown depends on the ers, and over time CAS relearns that For example, a student’s t-test view on
supplied metric. normal behavior includes only de- the time series could be the mean value
˲˲ Time of observation. This is kept at viations under 1%. CAS intentionally for both populations, the population
daily granularity for system efficiency. takes longer to learn normal behav- sizes, and variance estimation.
These factors combine with the ior for larger tolerated fluctuations, This aggregated view from many
count of each observed verdict to make so in this example, CAS will learn at a past observations would allow syn-
a model. A model knows only identi- slower rate for the 10% case. thesizing a single test for each sta-
fiers—it has no understanding of the Bootstrapping. When a user initially tistical function, with the correct pa-
data source, statistical functions, or submits a configuration that evaluates rameters chosen based on past data
their parameters. a metric, no past behavior exists to and some policy.
Prediction selection. All models use for prediction. To bootstrap such This work would essentially re-
pertaining to a particular binary are cases, CAS looks for past evaluations place half of the current autoconfig-
fetched across all statistical functions that could have used this config and uration system.
for which there is an observation, and runs those evaluations to collect ob- Observation breakdowns turned out
across all data sources. servations for the model server. With to be the biggest contribution of the
For each statistical function and enough recent evaluations, CAS will model server to CAS as a whole, so the
each data source, the weighted sum already have useful data the first time a development team plans to expand this
of the previously observed behaviors user requests an evaluation. feature. Adding more breakdowns en-
is calculated for each possible result. If such bootstrapping is not pos- tails additional computational/storage
Similarity is weighted both by heu- sible, the model server reverts to the costs and, therefore, needs to be under-
ristic similarity of features (process most generous behavior possible. taken carefully given CAS’s large scale.
age and geographical location) and Arbitrary input analysis. The behav- While CAS currently has break-
by the age of the model. Because ad- ior-prediction mechanism is also the downs based on the object of evalu-
ditional breakdowns such as RPC first attempt at arbitrary input analysis, ation, this could be expanded to
methods do not have a usable simi- which allows modeling behavior for breakdowns by type of canarying.
larity metric, the additional match- tests when there is no prior knowledge Anecdotally, there have been major
ing breakdowns are simply filtered of what they are about. differences in canary behavior when
in, with no further weighting. When a user configures canarying observed using before/after tests
For a single statistical function and on RPC error ratio, CAS knows in ad- versus simultaneous tests of two
a single data source, we generate a vance that the values are between 0.0 populations. The size of the canary
score for each possible verdict (PASS, and 1.0, and that higher is worse. For a population in relation to the control
FAIL, or NONE). We calculate this user-supplied query against the moni- population and the absolute sizes
score from a weighted sum of past ob- toring data, CAS has no such knowl- of the populations can also provide
servations. Weighting is based upon edge and can only apply a battery of meaningful breakdowns.
factors like age of the observation tests and observe the differences. Future work could determine if
and similarity of the observation to Despite some significant issues, as these additional breakdowns are
the current situation (for example, do we will discuss, the CAS development worthwhile, and at what granularity to
both observations pertain to the same team chose this approach because perform them. Automatically generat-
geographic location?). they were confident that it would have ed decision trees may also be an option.

60 COMM UNICATIO NS O F THE ACM | M AY 201 8 | VO L . 61 | NO. 5

 practice

Priming with steady state data. CAS more than 5%. While relative compari-
sees only production changes. Cur- sons are easy to reason about, they be-
rently, it does not learn that a particu- have extremely poorly if the provided
lar metric is erratic even in steady state. time series value is typically zero, or if
Data about metric behavior outside
of production changes could be used Observation a large relative change occurs in abso-
lute numbers too small to be impor-
to define the typical noise in the data.
CAS would fail a canary only if the de-
breakdowns tant to the service owner.

turned out
This is a significant limitation of
viation is above this typical noise level. the mechanism. While it has not had
The noise data could come from ana-
lyzing only the control population for
to be the biggest much practical impact in real-world
operation, especially given existing
every evaluation, because the control contribution of trivial workarounds, it merits improve-
population is expected to have no pro-
duction changes.
the model server ment. Numerous improvements can
be made to this mechanism, some
to CAS as a whole, quite simple. In addition to the fu-
Known Issues
Same environment overfitting. CAS so the development ture work mentioned previously, can-
didates include standard deviation
autoconfiguration’s most significant team plans analysis and looking at past observed
issue is overfitting data when there is
already a rich history of past observa- to expand this behavior of the metric.
Scale limitations on the input values.
tions in exactly the same environment.
In this scenario, only the historical
feature. As CAS uses only a hard-coded set of
statistical functions and their param-
data of that environment is used. eters, the system is somewhat inflex-
This behavior has some caveats. ible about analyzing inputs outside of
Consider a rollout of a new version the expected input scale. For example,
of a system that takes twice as long to if the range of 1% through 100% differ-
handle each RPC call but does a signif- ence is covered, what about the sys-
icantly better job. CAS would flag the tems and metrics where a difference
longer RPC handling time as anoma- of 200% is normal? What if even a 1%
lous behavior for each geographical difference is unacceptable?
location of the rollout, causing the CAS developers did not anticipate
release owner undue hardship. The this to be a significant limitation in
mitigation is to adjust the heuristics practice, which thankfully proved true.
carefully in selecting relevant envi- Most metrics meriting canary analysis
ronments to include data beyond the turn out to contain some noise; con-
perfect match. versely, most of our A/B testing hopes
User mistrust. CAS is useful but far to see little difference between the two
from perfect. It has experienced inci- populations, so large differences are
dents when users disregarded a canary unexpected and therefore noticed.
failure and pushed a broken release.
User mistrust in complex automation Lessons Learned
is at the root of many of these issues. Good health metrics are surprisingly
The CAS developers are tackling rare. The best way to use CAS is to em-
this mistrust by explicitly explaining, ploy a few high-quality metrics that
in human-friendly terms that do not re- are clear indicators of system health:
quire knowledge of statistics, why CAS suitable metrics are stable when
reaches a particular conclusion. This healthy, and they drastically change
includes both textual explanation and when unhealthy.
graphical hints. Often, the best canarying strategy is
Relative comparisons only. Be- to choose metrics tied to SLOs (service-
cause the model server stores only level objectives). CAS automatically in-
the outcomes of statistical functions tegrates with an SLO tracking system
without knowing the input values, to apply servicewide SLOs and some
CAS does not know the typical values heuristics to scale them appropriately
for a time series. to the canary size.
Not knowing the semantics of the Setting an SLO is a complex process
data implies that the tests being run connected to business needs, and SLOs
are purely relative comparisons, such often cover an entire service rather than
as having a t-test with null hypothesis individual components. Even if a ca-
that the metric did not increase by nary of a single component misbehaves

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF T HE ACM 61

practice

in the extreme, its impact on a service’s magnitude of an outage, however, this analysis accuracy—led to widespread
overall SLO can be small. Therefore, key approach would not be expected to pro- CAS adoption. CAS has proven useful
metrics need to be identified (or intro- vide a clear signal. (Postmortem docu- even for basic cases that do not need
duced) for each component. ments often include a section such as configuration, and has significantly
It’s tempting to feed a computer “where we got lucky,” highlighting that improved Google’s rollout reliability.
all the metrics exported by a ser- many elements contribute to the sever- Impact analysis shows that CAS has
vice. While Google systems offer vast ity of the outage.) likely prevented hundreds of postmor-
amounts of telemetry, much of it is Ultimately, the team settled upon tem-worthy outages, and the rate of
useful only for debugging narrow what they call near-miss analysis: look- postmortems among groups that do
problems. For example, many Big- ing at large postmortems at Google not use CAS is noticeably higher.
Table client library metrics are not and identifying outages that CAS could CAS is evolving as its developers
a direct indication that a system is have prevented, but did not prevent. If work to expand their scope and im-
healthy. In practice, using only weak- CAS did not prevent an outage because prove analysis quality.
ly relevant metrics leads to poor re- of missing features, those features
sults. Some teams at Google have per- were identified and typically imple- Acknowledgments
formed analysis that justifies using a mented. For example, if CAS could A great number of people contributed
large number of metrics, but unless have prevented a $10M postmortem key components of this work. Thanks
you perform similarly detailed data if it had an additional feature, imple- to Alexander Malmberg, Alex Rodri-
analysis, using only a few key metrics menting that feature proves a $10M guez, Brian O’Leary, Chong Su, Cody
yields much better results. value of CAS. This problem space con- Smith, Eduardo Blanco, Eric Waters,
Perfect is the enemy of good. Canary- tinues to evolve, as we attempt other Jarrod Todd, Konstantin Stepanyuk,
ing is a very useful method of increas- kinds of analyses. Most recently, the Mike Ulrich, Nina Gonova, Sabrina
ing production safety, but it is not a team has performed analysis over a Farmer, Sergey Kondratyev, among
panacea. It should not replace unit test- (more homogeneous) portion of the others. Also, thanks to Brian O’Leary,
ing, integration testing, or monitoring. company to identify trends in outag- and Chris Jones for technical review.
Attempting a “perfectly accurate” es and postmortems, and has found
canary setup can lead to a rigid configu- some coarse signal.
Related articles
ration, which blocks releases that have Reusability of CAS data is limited. on queue.acm.org
acceptable changes in behavior. When CAS’s immense amount of informa-
Fail at Scale
a system inherently does not lend itself tion about system behaviors could po-
Ben Maurer
to a sophisticated canary, it’s tempting tentially be put to other uses. Such ex- http://queue.acm.org/detail.cfm?id=2839461
to forego canarying altogether. tensions may be tempting at face value,
The Verification of a Distributed System
Attempts at hyper-accurate canary but are also dangerous because of the Caitie McCaffrey
setups often fail because the rigid con- way CAS operates (and needs to oper- https://queue.acm.org/detail.cfm?id=2889274
figuration causes too much toil during ate at the product level). Browser Security:
regular releases. While some systems For example, the CAS team could Lessons from Google Chrome
do not canary easily, they are rarely im- observe where canaries behave best Charles Reis, Adam Barth, Carlos Pizano
possible to canary, though the impact and recommend that a user select only http://queue.acm.org/detail.cfm?id=1556050
of a having a canary process for that that geographical location. While the
system may be lower. In both cases, recommended location may be opti- References
1. Banning, J. Monarch, Google’s planet-scale monitoring
switching to a strategy of gradual on- mal now, if a user followed the advice infrastructure. Monitorama PDX 2016; https://vimeo.
com/173607638.
boarding of canarying, starting with to canary only in that location, the 2. Van Winkel, J.C. The production environment at
low-hanging fruit, will help. team’s ability to provide further advice Google, from the viewpoint of an SRE, 2017. https://
landing.google.com/sre/book/chapters/production-
Impact analysis is very hard. Early would lessen. CAS data is limited to its environment.html.
on, the CAS team asked, “Is providing observations, so behavior at a local op-
a centralized automatic canarying sys- timum might be quite different from Štěpán Davidovič is a Site Reliability Engineer at Google,
tem worth it?” and struggled to find the global optimum. where he works on internal infrastructure for automatic
monitoring. In previous Google SRE roles, he developed
a answer. If CAS actually prevents an Canary Analysis Service and has worked on AdSense and
outage, how do you know the impact of Conclusion many shared infrastructure projects.

the outage and, therefore, the impact Automated canarying has repeatedly Betsy Beyer is a technical writer for Google Site Reliability
Engineering in New York, NY, USA, and the editor of Site
of CAS? proven to improve development veloc- Reliability Engineering: How Google Runs Production
The team attempted to perform a ity and production safety. CAS helps Systems. She has previously written documentation for
Google’s Data Center and Hardware Operations teams and
heuristic analysis of production chang- prevent outages with major monetary lectured on technical writing at Stanford University.
es, but the diverse rollout procedures impact caused by binary changes, con-
made this exercise too inaccurate to figuration changes, and data pushes.
be practical. They considered an A/B It is unreasonable to expect engi-
approach where failures of a subset neers working on product develop-
of evaluations were ignored, passing ment or reliability to have statistical
them in order to measure impact. Giv- knowledge; removing this hurdle— Copyright held by owners/authors.
en the many factors that influence the even at the expense of potentially lower Publication rights licensed to ACM. $15.00.

62 COM MUNICATIO NS O F TH E AC M | M AY 201 8 | VO L . 61 | NO. 5

 DOI:10.1145 / 3 1 7479 5


Article development led by
queue.acm.org

Praise matters just

as much as money.
BY KATE MATSUDAIRA

How Is
Your Week
Going So Far?
I HAVE TO say, this week I am walking on sunshine. I am
getting a lot done and feeling really good while getting it
all done. Which is pretty surprising, since earlier this
week, I felt completely overwhelmed and a little defeated.
I had been feeling overwhelmed with the large amount
of work on my plate (both at home and at the office),
every new task added to the list just harder after hearing that my work was
made me feel more and more tired. not only appreciated, but that it also
Less and less excited. More and more helped us achieve some goals.
overwhelmed. Why did this work?
But then something kind of amazing Because praise is one of the most
happened. And it was amazing because meaningful ways to connect with the
it was so small. I got to work, and short- people on your team and motivate
ly thereafter, I received an email mes- them to do more amazing work.
sage highlighting some recent wins Nobody comes to work to do a bad
that came out of work I had just done. job. Most of us are doing our best.
In fact, the message included this Even so, it’s rare that we hear how our
day-maker: “Amazing job on the pre- work is being received. We assume if we
sentation!!!!!!!” hear nothing that it means we are not in
Oh yeah, those are seven exclama- trouble, which is good. But it’s not great.
tion points. A Gallup study found that more than
Ever wondered how to make your two-thirds of employees do not receive
team more productive, more excited, any praise in a given week.
and more motivated? It’s really simple. Which is surprising, given the re-
It’s so ridiculously simple. search that shows getting “praise or rec-
Seven exclamation points complete- ognition for good work” increases reve-
ly changed the trajectory of my week. nue and productivity 10% to 20% and that
You had better believe my spirits those feeling unrecognized are three
were lifted and I kept working even times more likely to quit in the next year.

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF T HE ACM 63

practice

Praise Is Difficult people and build a more amazing team.

Giving praise is difficult. It can be awk- To do this, choose a skill you want
ward. It can feel unnecessary. each team member to add or improve
You might think, “My team already on. Work on this with each person,
knows I think the work they do is awe- and any time you see improvement or
some.” good work, praise the person specifi-
And you know what? You might be cally for it.
right. They might already know you ap- You will see that person light up and
preciate them. But that does not coun- keep getting better until reaching the
teract their need to hear that you still level you want. Occasionally praising
think they are awesome. the things you know that someone has
It’s not just the knowledge that your Plus, negative comments last a lot always been good at will also keep that
boss values you and your work that longer in our brains than positive ones. person from feeling like no one notices
matters. Hearing it, out loud, for spe- This is why frequent praise matters. his or her ongoing hard work.
cific projects is what really matters. It is It has been said that it takes six What you reward and recognize is
what sustains people. It is what moti- positive interactions to overcome one what you get. If you do not recognize
vates them. negative interaction—keep that in anything, the bar will lower to see what
Hearing praise releases oxytocin in mind, especially if you are a hard- gets noticed (or what they can get away
our brains, a hormone that fuels trust driving manager who demands the with). When you do praise and reward
and bonding. Simply put, hearing how best. Make sure your team hears your team, you raise the bar based on
much our work is appreciated makes us more of the good than the bad. what gets praised.
want to do more to repeat that feeling Specific. How many email messag-
by pleasing the people we work with. es have you gotten with a “Thanks!” or Can You Be the Manager
In fact, when I think about my past, “Good job” tacked onto the end of it? You Always Wished You Had?
one of my biggest motivations for be- It doesn’t quite have the enthusiastic None of us hears “thank you” or “awe-
ing amazing in previous roles was be- effect the sender probably meant for it some job” enough at work. Being the
ing recognized for being amazing. to have. person who praises other people is an
The recognition and approval I re- As a manager, when you praise your amazing person to be, especially when
ceived from my leaders and peers were team, you need to tell them exactly you follow this formula for making
just as important as the raises and what you liked in their work in order your praise ridiculously effective.
promotions I received for being great for it to have any value to them. Was it What could you accomplish if you
at my job. the way they commented their code? had the best team in your company?
Praise matters just as much as money. Did they give a detailed, efficient, and Imagine what you could do if you had a
So, how do you do it right? prompt answer in a support question? team that was so successful and so mo-
Were they able to take control of a bad tivated that you could take a long vaca-
How to Praise Your situation and get everyone quickly tion without worrying about what was
Team Effectively working toward a good solution? going on at the office?
Valuable praise has the same three ele- If you acknowledge specifically what Stop thinking about it, and start do-
ments. If you add these together, the you liked about what they did, they will ing. Set a reminder on your calendar to
praise you are giving will be meaning- know that you really paid attention and give more praise every week.
ful and motivating to your team. they will know exactly what to do to be
It’s like a super-simple math equa- praised again.
Related articles
tion for motivation: to be effective, Researchers have found that the on queue.acm.org
praise must be frequent, specific, and highest driver of work engagement is
The Debugging Mindset
strategic. whether workers feel their managers
Devon H. O’Dell
Frequent. When you do not praise are genuinely interested in them and https://queue.acm.org/detail.cfm?id=3068754
your team regularly, they do not know their well-being. Think about how
The Paradox of Autonomy and Recognition
where they stand with you. They may many times in your own career you have Kate Matsudaira
make assumptions based on limited said to yourself things like, “I don’t https://queue.acm.org/detail.cfm?id=2893471
information such as your demeanor in think they even notice what I do.” Broken Builds
a meeting or a face you made in pass- Be clear about praising specific work Kode Vicious
ing. When your team has little to go on that you are grateful for or that has had https://queue.acm.org/detail.cfm?id=1740550
(or they hear from you only when a big impact. This will go a long way to-
things are wrong), they do not have ward fighting burnout and building an Kate Matsudaira (katemats.com) is an experienced
technology leader. She has worked at Microsoft and
enough information to know you (se- amazingly motivated team (especially if Amazon and successful startups before starting her own
cretly) appreciate their work. you take the time to look for unsung company, Popforms, which was acquired by Safari Books.
IMAGE BY KA PITOSH

Never forget that as a manager, your and overlooked heroes on projects).

opinion matters to your team and they Strategic. Are you convinced praise
are constantly looking to you for infor- is a good thing? Well, it gets better. You Copyright held by author.
mation about their status. can actually use praise to develop your Publication rights licensed to ACM. $15.00.

64 COMMUNICATIO NS O F TH E AC M | M AY 201 8 | VO L . 61 | NO. 5

 M
&C
In-depth.
Innovative.
Insightful.
Inspired by the need for high-quality
computer science publishing at the
graduate, faculty and professional
levels, ACM Books is affordable,
current, and comprehensive in scope.

For more information, please visit

http://books.acm.org

M
&C
Association for Computing Machinery
2 Penn Plaza, Suite 701, New York, NY 10121-0701, USA
Phone: +1-212-626-0658 Email: acmbooks-info@acm.org
contributed articles
DOI:10.1145/ 3132699
research study focused on this signa-
A teacher and students coding together make ture pedagogy of computer science.
Our aim here is to fill this gap. In par-
explicit the unwritten rules of programming. ticular, we provide an empirical ac-
count of the joint—irreducibly social—
BY JOSH TENENBERG, WOLFF-MICHAEL ROTH, DONALD CHINN, work that programming students and
ALFREDO JORNET, DAVID SOCHA, AND SKIP WALTER teachers perform. We ask: What is it
that occurs when a teacher and stu-

More Than
dents write code together? What is
learn-able about that joint work? And
how can it further inform computing

the Code:
teaching and learning practice?

Programming as a Social Practice

Learning Rules
In addressing these questions, our
study approaches programming as a
social practice. Almost 30 years ago,
Sherry Turkle and Seymour Papert17

of Rejection in
described the common conception of
programming as one that is funda-
mentally formal: “The prevailing im-

Writing Programs
age of the computer is that of a logi-
cal machine, and . . . programming is
seen as a technical and mathematical
activity.” No one represents this view
better than Edsger Dijkstra,4 who de-
scribed programs as “rather elabo-
rate formulae from some formal sys-
tem” and “an abstract symbol
manipulator which can be turned
into a concrete one by supplying a
LEE SHULMAN, A PAST PRESIDENT of the Carnegie computer to it.” Accordingly, the ac-
Foundation for the Advancement of Learning, tivity of programming is a technical
exercise of the individual program-
identifies the signature pedagogies of professions as mer who produces a correct program
those characteristic forms of teaching and learning from a specification. According to
that “define what counts as knowledge in a field and this view, it is unsurprising that much
computing education research has
how things become known.”13 If there is a signature been devoted to categorizing and
pedagogy for computing, it is surely the writing of code quantifying student errors and mis-
together between a teacher and students: The teacher
key insights
poses a problem, solicits input from students about
˽˽ Programming can be viewed as a social
how to write the code to solve this problem, and weaves practice structured by tacit “rules of
together the suggestions from different students into a the game” rather than a formal exercise
linking specifications to code.
coherent whole. This pattern is so pervasive that ˽˽ An empirical investigation of a joint
anyone who has spent time in a computer science code-writing session between a teacher
and students shows how rules of
classroom has participated in this pedagogical form. programming are uncovered in the reasons
given for rejecting proposed lines of code.
Given its ubiquity, one would think this signature ˽˽ While the code for a program is routinely
pedagogy is well understood. Yet our search of captured in normative forms of instruction
and student notes, the rejection rules
the educational literature yielded not a single prior generally go undocumented.

66 COMMUNICATIO NS O F TH E AC M | M AY 201 8 | VO L . 61 | NO. 5

 conceptions in comparison to the attention from programming tools to puting education] remain unan-
“correct,” or canonical, behavior of designing and supporting communi- swered and would benefit from con-
experts in carrying out this formal ac- ties of learners.” This shift of atten- temporary research in the learning
tivity.8,14 tion from the isolated individual to sciences in sociocultural and situated
Over the past several years, however, participation in social practice has led learning, distributed and embodied
a different view of programming has to considerable research advances in cognition, as well as activity, interac-
emerged, one that sees programming the educational literature over the tion and discourse analysis.”2 It is in
as inherently social. In a 2016 Commu- past several decades.10,11,16 Research in this gap in the literature on the social
nications article, Kafai6 states that computing education is beginning to practices within computing class-
“[c]oding was once a solitary, tool- appear that draws on sociocultural theo- rooms that this study is situated. An
based activity. Now it is becoming a ries of cognition and learning and their important question to consider, then,
IMAGE BY KOSTSOV

shared social practice. Participation methods of empirical investigation. This is is: What does it mean for a practice to
spurred by open software environ- consistent with a 2014 report,2 which be social rather than individual? A
ments and mutual enthusiasm shifts states that “many questions [in com- practice is social because practitioners

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF T HE ACM 67

contributed articles

Figure 1. Presented code from first part of the episode.

class MyArrayList {
private int size;
private Object[] array;

// Javadoc
public MyArrayList() {
array = new Object[DEFAULT _ SIZE];
size = 0;
}

act as if they were following specific recordings were made in both set- (0.4) how do you make something
rules of the game, and an observer can tings from two cameras placed on a like this (1.6) if you were to code up
read these rules off from the practice of ceiling-mounted overhead projector your own ArrayList (0.5) which inci-
the game even if the players never ar- in the center of the room, one point- dentally is this week’s homework
ticulated or are aware of the rules.18 It is ing to the front of the room and one assignment (2.9) how would you do
with this definition of social practice as pointing to the side, augmented by it (2.8) now one approach you could
the joint work of making rules present and later synchronized with audio re- do [Erases center board, writes
in and through practice that we turn to corders placed around the room. ‘class MyArrayList {‘ at the top
an analysis of joint code writing. Chalk and talk. The episode be- of this section].”
gins 21 minutes into a class session Alan makes two statements that
Analysis of a Joint during the second week of the term. have the syntactic form of ques-
Code-Writing Episode In attendance are 30 students occu- tions. Yet in neither case does a stu-
To illustrate how learning to program pying most of the 37 seats in the dent respond. For the second ques-
can be approached as social practice, room. The teacher, Alan (a pseud- tion, Alan responds to his own
and how such an approach can be onym), is in his fifth year of teach- question and begins a presentation
relevant to computing education, we ing in higher education, doing the that lasts almost nine minutes, with
present and analyze an episode from data structures course for the third only two students speaking during
a data structures course taught at a time. Alan stands at the front of the that time for a total of less than 20
small private university in the U.S. classroom, in front of a blackboard seconds. Code is presented as a fait
The episode has been culled from a of three equal sections that spans accompli, a rationale preceding
database that includes video record- the entire front wall. He begins the each line of code (such as “because
ings, photographs, ethnographic ob- episode saying, a “So the question is constructors have no return types”).
servations, and interviews from the The teacher speaks and writes,
entire course, which met for 50 min- a The numbers in parentheses indicate the whereas the students align their
utes three times per week over a 15- length in seconds of a pause in speech. Words bodies and gaze in the direction of
week term. The students and teacher inside parentheses indicate transcriber diffi- the teacher and what he is writing
culty hearing the speaker, with the parenthe-
also met for an additional session sized words being the transcriber’s best guess
on the board, occasionally looking
each week for two hours in a large at what was said. Statements inside square down to their desks as they write
computer laboratory. Audio-visual brackets are transcriber comments. notes. Figure 1 shows the final code
filling the blackboard’s center sec-
Figure 2. Final code for add method. tion at the end of this chalk-and-talk
// Javadoc
session of nine minutes, 10 seconds.
public void add (Object entry) { This session, in which the teacher
if ( size >= array.length ) { writes while providing extensive ver-
resizeArray(array.length + STEPSIZE) bal accounts, is typical of most of
} the class sessions recorded.
array[size] = entry; Thus far, there is little that might
size++;
be thought of as the collective writ-
}
ing of code that includes students as
well as the teacher. Alan’s next state-
ment appears to be more of the
same. He stands in front of the code
he has just produced, faces the class,

68 COMMUNICATIO NS O F TH E AC M | M AY 201 8 | VO L . 61 | NO. 5

 contributed articles

and says, “all right (0.3) how would I then being told a rule as part of feed- In the subsequent turn sequence,
create an add method (6.8) I want to back on why a move does not work. the student continues his earlier ut-
add a new object to myArrayList how In this case, “the rule may be an aid terance, saying “which I believe will
would I do that (4.2).” There are sev- in teaching the game.” In saying be an object you could just call it add”
eral pauses during this turn, and two “right,” Alan makes it evident for ev- and Alan saying “okay (0.5) so I’m go-
statements that have the grammati- eryone to see that the student has ing to make public [writes and speaks
cal form of a question (“how would acted in a way that is consistent with the following words at the same time]
I”). As the pause extends at the end the cultural rules of writing code, void add [writes ‘( ’ ] and it’ll [writes
of this statement, it affords room for without those rules being explicitly ‘Object’ as he speaks the rest of his
anyone to speak, and the shape of stated in advance. turn] take an object what do you want
the discussion will be determined by In the next turn-pair, a student to call that object.” Alan’s writing
what the actors in the setting actual- says, “and (0.4) uh it’s going to need and corresponding speech do three
ly do. It is not clear at this point what to take an argument” after which Alan things at the same time: acknowledge
constitutes an appropriate response writes the word “public” on the next what the student offered, provide a
or who should provide it. For exam- line on the blackboard. This turn-pair positive evaluation in the writing,
ple, it may be another rhetorical can be seen as the response-evalua- and correct and elaborate what was
question to be answered by the tion part of the IRE pattern, with the said while putting it into code. The
teacher. It is only in their unscripted initiation—the “I” part—implicit in teacher, in his actual practice, writes
and irreducibly social transactions the evaluation—the “E” part—of the what is “right.”
that the teacher and the students to- prior IRE. But it is only with this new Rejection rules. Thus far in this
gether work out what this lesson is student response and teacher evalua- episode, all student moves have been
to be as it unfolds. tion that the teacher’s evaluation in marked as correct, with correspond-
Participative code writing. A sig- the prior IRE can be seen as initiating ing writing on the board. The next
nificant shift in the lesson occurs the response and evaluation that fol- several turn-pairs reveal what hap-
when the silence at the end of Alan’s low. That is, this IRE speech pattern is pens when student moves do not fol-
utterance is broken. A student says, neither the teacher’s nor the stu- low the rules of the unstated but pres-
“well you’re going to want your add dents’ alone but is irreducibly spread ent game. In the turn just finished,
[Alan turns toward board] (0.4) uh across them; it is a structure of par- Alan ends with an explicit initiation
method [Alan starts walking to right- ticipation in this game. Only in the in the grammatical form of a ques-
hand third of the blackboard] to be student response can the statement tion, “what do you want to call that
public so you’re going to want some preceding and following be seen as object.” Another student responds
javadoc,” followed by Alan saying initiation and evaluation; and like- with “uh submit,” which is met with
“right” and writing “// javadoc” at wise, only in the teacher initiation no writing and Alan’s comment,
the top of this section of the board. and evaluation is the student’s utter- “submit’s a little strange, submit’s a
Taken together as a unit, these first ance seen as a response. This pattern verb (2.4) any other ideas for what we
three turns at talk may be seen as a of linked, cascading IREs continues what’s a good name for this object
variant of what in educational re- through almost all of this eight-min- that we’re passing in (2.4) [turns from
search has become known as the ute joint-code-writing episode, with student to others in class].” Another
“initiation-response-evaluation” pat- the evaluation part including either student says, “my object,” which
tern, or IRE.7 In the original version an explicit or implicit solicitation for again is not written on the board but
as reported in the literature, the stu- further student response. is instead given an explanation for
dent provides an answer to a query
that is then evaluated. But in the vari- Table 1. Classification of rules offered as reasons for rejecting student responses.
ant here, the three-turn sequence is
an initiation to a social practice Example response-evaluation pair Rule type

(here, writing code), an instance of Student: submit

Naming convention
Alan: submit’s a little strange submit’s a verb
this practice, and feedback as to how
Student: you want to try and do it without resizing first
well the newcomer has done.12 From Alan: and if we don’t have enough room (0.3) we will do
the student perspective, these are Strategic, concerning
the resizing (1.1) and THEN we’ll add the thing and so
order of operations
first instances where they live and in- that in the end when we add we will be guaranteed that
deed partake in such cultural prac- we have the space

tices as writing code. Cultural prac- Student: you need to check if there’s value (0.3) in the Counterfactual or “what could be”
(0.5) slot nine tenth (0.4) tenth slot from the beginning reasoning, in that some possible earlier
tices and the languages that go with Alan: but we don’t know if there’s 10 slots because it state of the program could cause a
them have been called “language could have already been resized problem for the student’s proposal.
games.”18 Ludwig Wittgenstein in- Student: creates (size) (size) Confirms the student’s response but
sists on the fact that language games Alan: yes but let’s not do that quite yet does not write, making this rejection
temporary, a “not yet but soon.”
may be learned before and some-
Student: would it just be size plus one
times “without ever learning or for- Logic error
Alan: it would just be size … because if the size …
mulating rules.” Any game may be
learned by participating in it and

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF T HE ACM 69

contributed articles

the nonacceptance: “eh my object’s a as a teacher. He plays his part in what normative rule. And this earlier kind
little bit too vague.” Collins et al.1 call “cognitive appren- of classroom behavior—this chalk
This code-writing session contin- ticeship,” where expertise is made and talk—is so mundane it goes unno-
ues for another 23 turn-pairs, for sev- visible in an appropriate context, so ticed as a pedagogical choice, repli-
en minutes, 40 seconds total, with students, who are indeed participat- cated in countless online video tutori-
contributions from eight students; ing in the cognitive practice, can see als for introductory programmers,
Figure 2 shows the resulting code. instances thereof. In this sense, the with a talking head and a writing hand
Generalizing across all of these re- “rejection rules” Alan makes visible at the whiteboard, as well as in intro-
sponse-evaluation pairs in the epi- are significantly unlike the kind of ac- ductory programming textbooks and
sode, accepted moves are always counting students do with one anoth- the lecture slides that accompany
translated into correct code and writ- er when they pair-program, where them as canned teacher resources.
ten on the board with no explanation, negative criticism and explicit justifi- Only what is correct is given, accom-
while rejected moves are (in every cation are virtually nonexistent.9 And panied by detailed explanation.
case but one) met with explanations although various other forms of peer In the presentational forms of in-
for their rejection and not written on learning (such as teamwork, group struction, the ways a program and writ-
the board. We summarize with this work in a “flipped” classroom, and ing code can go wrong are missing.
simple rule: What is right is written, Peer Instruction3) often provide “a However, the ways things can go wrong
what is not right is explained. natural context for elaborating one’s are even more essential to knowing a
In looking at these explanations own reasoning,”15 they may nonethe- practice.5 These ways become apparent
for rejection (“submit’s a verb,” “my less fail to provide a context through in the second part of the episode,
object’s too vague”), they can be which expert reasoning (such as where students and teacher together
heard as rules that have been violated these rejection rules) can be made make visible and audible two types of
in the student contribution to the available to students. instances. When students’ program-
game (writing code), for example, Toward a signature pedagogy. But it ming moves are appropriate, they are
that appropriate identifiers for this would be a mistake to see this making accepted without actually stating the
parameter should not be a verb, expert work visible as Alan’s accom- rules, but when the moves are not part
should not be vague. Yet there are plishment alone, as if Alan is the sole of the game, they are rejected and an
qualitatively different kinds of rea- active participant, pouring program- associated rule is articulated. Here,
sons given for rejection from one mer wisdom into passive student con- students are part of playing a game, liv-
case to another. Although we do not tainers. For in the first part of this epi- ing the practice of coding; and with
show the entire transcript here, Table sode, when Alan was presenting code some practice, they will be playing the
1 lists various types of reasoning as something already accomplished game in its solitaire variant or with oth-
about programs the teacher makes and written (Figure 1), he was writing er learners outside the classroom.
visible in his evaluations of student on the board what he was explaining There is a simple but easily overlooked
responses across the entire episode. and explaining each statement he fact about programs for why such rules
These rules evidence Alan’s exper- wrote; that is, the earlier part of this of rejection might be important to
tise as a computer programmer and episode was governed by a different know and share: The number of pro-
grams that is not correct—syntactical-
Table 2. Number of students writing at the end of Alan’s writing or speaking turns, out of ly, semantically, or pragmatically—for
14 students observable in the view frame of the side-facing camera.
any given problem is far, far greater
than the number of correct programs
Number
for the problem. Students here are ac-
of students
writing tive, partnering in the elicitation and
Alan says:
production of rejection rules. Alan
submit’s a little strange submit’s a verb 8
does not simply enumerate lists of
eh my object’s a little bit too vague 5
such rules based, perhaps, on past ses-
sions with other students, to be memo-
and if we don’t have enough room (0.3) we will do the resizing (1.1) and THEN we’ll 5
add the thing and so that in the end when we add we will be guaranteed that we rized and indexed by the current stu-
have the space dents in the room. Rather, Alan
but we don’t know if there’s ten slots because it could have already been resized 3 responds with specific rules particular-
yes but let’s not do that quite yet 3 ized to the responses these students
it would just be size … because if the size … 5 are making at this moment with re-
Alan writes: spect to the program at hand.
public void add (Object entry) { 12
if ( size >= array.length ) { 12 Rules of Rejection
resizeArray(array.length + STEPSIZE) 12 and Their Learn-Ability
array[size] = entry; 11
Throughout this study, we have shown
size++; 12
how the living praxis of writing pro-
grams collectively between students
and teacher can reveal much more

70 COMMUNICATIO NS O F TH E ACM | M AY 201 8 | VO L . 61 | NO. 5

 contributed articles

than the code that is written. Looking Docs document for writing the code, 4. Dijkstra, E.W. On the cruelty of really teaching
computer science. Commun. ACM 32, 12 (Dec. 1989),
at the code in Figure 1 and Figure 2, where the students, in real time and 1398–1404.
there is little that distinguishes them in full view of one another, provide 5. Garfinkel, H. Ethnomethodology’s Program: Working
Out Durkheim’s Aphorism. Rowman & Littlefield,
from one another. Yet the work that the reasons for rejection as com- Lanham, MD, 2002.
characterizes joint code writing (Fig- ments within the document. 6. Kafai, Y.B. From computational thinking to
computational participation in K-12 education.
ure 2) but not teacher presentation It is easy to view code as a purely Commun. ACM 59, 8 (Aug. 2016), 26–27.
(Figure 1) is in the student offerings of formal object and conceive of its pro- 7. Mehan, H. Learning Lessons: Social Organization in
the Classroom. Harvard University Press, Cambridge,
code that are rejected and the teacher duction as a straightforward matter MA, 1979.
rationales for the rejections. It is in of applying generative rules and rou- 8. Miller, C.S. Metonymy and reference-point errors in
novice programming. Computer Science Education 24,
that joint work that opportunities for tines to produce correct code to spec- 2–3 (2014), 123–152.
9. Murphy, L., Fitzgerald, S., Hanks, B., and McCauley, R.
learning computing praxis, the actual ification. With such a perspective, we Pair debugging: A transactive discourse analysis. In
doing of it, exist. Yet in the classroom can study expert behavior in isola- Proceedings of the Sixth International Workshop on
Computing Education Research, 2010, 51–58.
studied—we suspect in most class- tion to try to determine such rules 10. Roth, W.-M. and Jornet, A.G. Situated cognition.
rooms where joint code writing oc- and routines and then seek in novic- WIREs Cognitive Science 4 (2013), 463–478.
11. Roth, W.-M. and Lee, Y.-J. Vygotsky’s neglected
curs—no persistent traces (such as es those deviations and missteps legacy: Cultural-historical activity theory. Review of
in the form of documents) are made that lead them to failure. Here, we Educational Research 77, 2 (2007), 186–232.
12. Roth, W.-M. and Radford, L. Re/thinking the zone of
by the teacher of this most important have taken a different perspective, proximal development (symmetrically). Mind Culture
feature of the joint code writing. What inquiring into the actual work stu- and Activity 17, 4 (2010), 299–307.
13. Shulman, L. Signature pedagogies in the professions.
students themselves are writing can- dents and teachers do together in a Daedalus 134, 3 (2005), 52–59.
not be discerned from the video re- signature pedagogy of the program- 14. Spohrer, J.C. and Soloway, E. Novice mistakes: Are
the folk wisdoms correct? In Studying the Novice
cordings. But what is clear is that more ming practice. Programmer, J.C. Spohrer and E. Soloway, Eds.
students are writing more of the time In examining an episode of joint code Lawrence Erlbaum, Hillsdale, NJ, 1989, 401–416.
15. Teasley, S. Talking about reasoning: How important
after the teacher writes code on the writing as a social accomplishment, we is the peer in peer collaboration? In Perspectives on
board than after the teacher provides find what has been hiding in plain sight Socially Shared Cognition, L. Resnick, J. Levine, and
S. Teasley, Eds. American Psychological Association,
a reason for rejecting a student offer but viewed as unremarkable and hence Washington D.C., 1991, 361–384.
16. Tenenberg, J. and Maria Knobelsdorf, M. Out of our
and does no writing, as evidenced in unremarked upon in the literature. The minds: A review of sociocultural cognition theory.
Table 2. rules for rejection of code are as impor- Computer Science Education 24, 1 (2014), 1–24.
17. Turkle, S. and Papert, S. Epistemological pluralism and
In noting this key feature of joint tant as the generative rules and routines the revaluation of the concrete. In Constructionism, I.
code writing, it can more easily be for producing correct code, since the Harel and S. Papert, Eds. Ablex Publishing Company,
Norwood, NJ, 1991.
made salient to new teachers of pro- space of incorrect code is vastly larger 18. Wittgenstein, L. Philosophical Investigations /
gramming, so the learn-ability of than the space of correct code. What Philosophische Untersuchungen. Blackwell, Oxford,
U.K., 1997.
these moments may be made more might be viewed as failure on the part of
explicit in the teaching practice. We students who offer pieces of code that
Josh Tenenberg (jtenenbg@uw.edu) is a professor in the
hyphenate learn-ability to highlight are rejected can instead be seen as learn- Institute of Technology at the University of Washington,
that in these moments the very abil- able moments, at least as productive as Tacoma, WA, USA.

ity for learning is in the visibility of those offers of their code judged correct. Wolff-Michael Roth (mroth@uvic.ca) is Lansdowne
Professor of Applied Cognitive Science in the Faculty of
the practice as it is being constituted This pedagogical form makes explicit Education at the University of Victoria, British Columbia,
by those present. It is easy for teach- the reasons for rejection that so many Canada.

ers and students alike to become fix- other pedagogical forms leave unex- Donald Chinn (dchinn@uw.edu) is an associate professor
in the Institute of Technology at the University of
ated on the end product, the final plained. In so doing, it makes the in- Washington Tacoma, WA, USA.
code, making such code the sole fo- structor’s cultural knowledge explicit Alfredo Jornet (a.g.jornet@iped.uio.no) is a postdoctoral
cus of instruction, all the while los- and visible to students at a particular researcher in the Department of Education at the
University of Oslo, Oslo, Norway.
ing sight of the accounts that experi- point in time.
David Socha (socha@uw.edu) is an associate professor
enced programmers can, but not in the School of Science, Technology, Engineering and
necessarily will, provide for all of the Acknowledgments Mathematics at the University of Washington Bothell,
Bothell, WA, USA.
wrong turns novices inevitably make We wish to thank Natalie Jolly for
Skip Walter (skip.walter@fticonsulting.com) is the chief
as they struggle to develop a pro- reading early drafts of this article and product officer of the FTI Consulting Technology Segment
gram for a given problem. In addi- the Helen Riaboff Whiteley Center of in Seattle, WA, USA.
tion, to support learn-ability in this the Friday Harbor Laboratories of the
pedagogical praxis, these rules of re- University of Washington for provid-
jection are likely to be at least as im- ing a facilitative writing environment
portant to preserve in some persis- as we completed an early draft.
tent form as the code itself, whether
as written annotations to the code, a References
table to summarize the joint work, 1. Collins, A., Seely Brown, J., and Holum, A. Cognitive
apprenticeship: Making thinking visible. American
or some other form. And for this Education 15, 3 (1991), 6–11.
task, it is possible that new techno- 2. Cooper, S., Grover, S. Guzdial, M., and Beth Simon, B.
A future for computing education research. Commun.
logical tools can also be employed, ACM 57, 11 (Nov. 2014), 34–36.
3. Crouch, C. and Mazur, E. Peer instruction: 10 years of
such as the teacher using a group- experience. American Journal of Physics 69, 9 (2001), Copyright held by the authors.
editable document like a Google 970–977. Publication rights licensed to ACM. $15.00

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF T HE ACM 71

contributed articles
DOI:10.1145/ 3199477

The U.S. State Department’s Internet Freedom

agenda is being adapted to help them communicate
without DNS and IP address filtering.
BY RICHARD R. BROOKS, LU YU, YU FU, OLUWAKEMI HAMBOLU,
JOHN GAYNARD, JULIE OWONO, ARCHIPPE YEPMOU,
AND FELIX BLANC

Internet
Freedom in
West Africa:
Technical Support
for Journalists
and Democracy
Advocates
key insights
˽˽ West African governments try to restrict
access through Internet blackouts and
invasive surveillance, and pro-democracy
movements use the Internet to promote
IN DEVELOPED COUNTRIES, Internet penetration is free and fair elections.

near saturation and population growth is stagnant. ˽˽ Innovative technologies for avoiding
detection produced by criminal botnets
In contrast, the African population is young and are being adapted by legitimate network
services to increase network privacy
growing quickly. UNICEF estimates that by the end and security.

of the century, 40% of the world’s population will be ˽˽ What we viewed as a purely technical
project helped launch a grassroots
African.a Where Africa in May 2016 had 16% Internet movement promoting freedom of
expression, transparency, and democracy
penetration, the McKinsey Global Institute predicted in West Africa that subsequently also
influenced the social, economic, and
a https://www.unicef.org/publications/files/UNICEF_Africa_Generation_2030_en_11Aug.pdf political frameworks there.

72 COMM UNICATIO NS O F THE ACM | M AY 201 8 | VO L . 61 | NO. 5

 Opposition supporters protest at the Place de la Nation in Burkina Faso’s capital Ouagadougou, November 2, 2014.

in 2013 that by 2025 the penetration sub-Saharan Africa, including both lation lives in countries that do not al-
rate will be approximately 50%b and the Sahel desert and lush rain forests. low effective freedom of expression.d,e
that 600 million Africans will be using Many local languages from distinct lan- This article discusses Internet free-
the Internet,c producing approximate- guage groups are spoken, along with dom in West Africa. In April 2016, we
ly $75 billion in annual e-commerce the former colonial languages, includ- completed a project sponsored by the
activity and contributing $300 billion ing French, Spanish, Portuguese, and U. S. State Department’s Bureau of De-
IMAGE BY ISSOUF SANOGO/ AF P/GET T Y IMAGES

to African GDP. English. The region includes thriving mocracy, Human Rights, and Labor,
West Africa is a diverse region in democracies like Ghana (with press whose goal was to promote online
freedom ranked by Reporters Without freedom of expression by West African
b https://www.mckinsey.com/industries/high- Borders better than France and the U.K.) activists. To this end, we implemented
tech/our-insights/lions-go-digital-the-inter- and repressive regimes like Equatorial a distributed proxy network and held
nets-transformative-potential-in-africa Guinea (with press freedom ranked by
c According to http://www.internetworldstats.
com/stats.htm, there are approximately 320 mil-
Reporters Without Borders at the level d https://freedomhouse.org/sites/default/files/
lion Internet users in North America and approx- of Cuba, Eritrea, Iran, and North Korea). FH_FTOP_2016Report_Final_04232016.pdf
imately 630 million Internet users in Europe. The majority of the West African popu- e https://rsf.org/en/ranking

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF T HE ACM 73

contributed articles

annual training sessions. Our proxy tion, limiting their populations’ ability ing it difficult to regulate the export of
counters Internet censorship and sur- to share opinions, organize, and create these technologies.
veillance, following a design loosely democratic alternatives. For these gov- Repressive governments subject
modeled on criminal botnets. ernments, the traditional press is eas- dissenting voices to denial-of-service
Our training sessions provided par- ier to control than the Internet. They (DoS) attacks that are inexpensive,g dif-
ticipants the skills they needed to pro- can physically intervene in print and ficult to attribute, and make objection-
tect their freedom of expression, bring- broadcast media operations. Newspa- able viewpoints unavailable. Govern-
ing together a regional community of per distribution networks are expen- ments hire cheap, unskilled laborers
bloggers, technologists, journalists, sive to maintain and easily disrupted. to flood websites with either pro-gov-
and democracy advocates. Trainees In almost every country, radio and tele- ernment “50-cent army” or abusive
from multiple countries found they vision broadcasters are controlled, or troll comments. If all else fails, a gov-
were facing similar problems. licensed, by the government. ernment can simply shut off the In-
In contrast to traditional media, it is ternet and other telecommunications
Internet Freedom inexpensive and less risky to put a web technologies during politically sensi-
Though freedom of expression is guar- server online in another country. In tive times. In 2017, the governments of
anteed by Article 19 of the United Na- countries where the population does Cameroon, the Democratic Republic
tions Universal Declaration of Human not trust traditional media, social me- of Congo, and Gabon all used Internet
Rights (http://www.un.org/en/universal- dia has emerged as an alternative. As blackouts as a political tool.
declaration-human-rights/index.html), more voices become available to the To protect the freedom of expres-
the world’s ability to access informa- population, fearing a loss of control, sion guaranteed in Article 19, NGOs
tion and openly express opinions is repressive governments invest in tech- and Western governments try to foster
tenuous and unevenly distributed. The nologies for shriveling and censoring Internet freedom. Technical tools, like
non-governmental organization (NGO) Internet traffic. Firewalls can block The Onion Router, or Tor,h Psiphon,i
Freedom House’s 2016 report on press the domain name system (DNS) and/ uProxy,j and Lantern,k provide proxy
freedom said that global press free- or Internet Protocol (IP) addresses of services for evading national firewalls.
dom was at its lowest point in 12 years.f offending news sites (such as The New Trainers teach at-risk populations to
Non-democratic countries with York Times). Internet surveillance tools use the Internet securely, avoid sur-
poor human rights records maintain using deep packet inspection (DPI) veillance, and circumvent censorship.
power by tightly controlling informa- can block network sessions containing NGOs lobby governments and interna-
sensitive keywords. DPI tools are often tional groups to put in place laws and
f https://freedomhouse.org/sites/default/files/ considered “dual-use,” along with le- policies to safeguard the public’s free-
FH_FTOP_2016Report_Final_04232016.pdf gitimate network management, mak- dom of expression. Our project promot-
ed Internet freedom within West Africa,
West African freedom surveys populations from the CIA World Factbook, 2016 (https://www.cia.gov/ producing a censorship-circumvention
library/publications/the-world-factbook/); RSF columns from Reporters Sans Frontières,
2010 and 2017 (https://rsf.org/en/ranking); and FH FIW columns from Freedom House Free-
tool and building a West African user
dom in the World, 2010 and 2017 (https://freedomhouse.org/report-types/freedom-world). community. This article documents
our experiences.
West African press freedom. As
Country Population 2010 RSF 2017 RSF 2010 FH FIW 2017 FH FIW Users
shown in the table here,l freedom of ex-
Benin 10,741,458 70 78 Free Partly Free 8
pression in Africa is being confronted
Burkina Faso 19,512,533 49 42 Partly Free Partly Free 5
by special challenges. Approximately
Camer. 24,360,803 129 130 Not free Not Free 8
40% of the countries in sub-Saharan
Chad 11,852,462 112 121 Not Free Not Free 6 Africa (over 38% of the population)
Cote d'Ivoire 23,740,424 118 81 Not Free Partly Free 39 live in countries whose press freedom
Congo (Kinshasa) 81,331,050 148 154 Not Free Not Free 2
Djibouti 846,687 110 172 Partly Free Not Free 3
Equat. Guinea 759,451 167 171 Not Free Not Free 1 g Reports (2016) suggest distributed DoS (DDoS)
Gabon 1,738,541 107 108 Not Free Not Free 1 attacks can be ordered online for as little $5
Gambia 2,009,648 125 143 Partly Free Not Free 15
per hour; https://www.incapsula.com/blog/
unmasking-ddos-for-hire-fiverr.html
Guinea 12,093,349 113 101 Not Free Not Free 4
h https://www.torproject.org/
Liberia 4,299,994 84 94 Partly Free Partly Free 2 i https://psiphon3.com/en/index.html
Mali 17,467,108 26 116 Free Partly Free 1 j https://www.uproxy.org/
Niger 18,638,600 104 61 Partly Free Partly Free 1 k https://getlantern.org/
l Population statistics from The CIA World
Nigeria 186,053,386 146 122 Partly Free Partly Free 4
Factbook (https://www.cia.gov/library/publi-
Sierra Leone 6,018,888 91 85 Partly Free Partly Free 3 cations/the-world-factbook/); RSF rankings
Senegal 14,320,055 93 58 Partly free Partly Free 7 from Reporters Without Borders, 2010 and
Togo 7,756,937 60 86 Partly Free Partly Free 12 2017, with 1 as best (such as Norway) and 180
RSF = Reporters Without Borders
as worst (such as North Korea); and qualita-
FH FIW = Freedom House Freedom In the World tive rankings from Freedom House Freedom
in the World, 2010 and 2017 (https://freedom-
house.org/report-types/freedom-world).

74 COM MUNICATIO NS O F TH E AC M | M AY 201 8 | VO L . 61 | NO. 5

 contributed articles

is ranked by Freedom House as “not ists. Bloggers use multiple platforms Internet censorship and attacks on
free,” and more than 61% of the popula- to express opinions and inform local free speech in West African countries
tion lives in countries ranked as “partly populations about political, economic, have not attracted as much attention as
free.” The West African countries with and ecological developments. Journal- censorship in countries like China and
the lowest press-freedom rankings are ists were dedicated to their profession Iran. Only limited information has been
The Gambia and Equatorial Guinea.m in situations with limited monetary available regarding network surveil-
The Gambia is a small, English-speak- reward and real physical danger. Some lance and censorship in West Africa, let
ing country surrounded by larger, of those we trained were international alone use of censorship-circumvention
French-speaking Senegal. Many Gam- correspondents working in West Africa tools there. Although our project was
bian journalists have lived in exile to for international broadcasters, includ- not intended to collect statistics, we
avoid persecution. Its 2016 election, ing representatives of the Committee learned the reality of the situation from
which removed the former strongman, for the Protection of Journalists, Inter- the trainees. We generated reports that
may yet change its ranking. Equatorial national Federation of Journalists, and circulated among the human rights
Guinea is a small, Spanish-speaking local journalist unions. The “users” community. The fact that Freedom
country between Cameroon and Ga- column in the table lists the number of House increased the number of sub-Sa-
bon, with large oil reserves producing participants from each country,p not in- haran countries in its Freedom on the Net
revenues that go mainly to the ruling cluding international correspondents. reportst since 2010 indicates increased
family. Trainees told us that Equatorial Our activist community included awareness by the international commu-
Guinea blocks access to social media. human rights and technical activists. nity of the situation in the region.
Freedom House gave both coun- The region has a growing open source
tries the lowest possible ranking for and maker community that is politi- Our Project
political rights in 2016. Independent cally engaged, promoting economic, Clemson University and Syre Inc. de-
of our work, a pan-African group aug- social, intellectual, and political demo- signed our project to adapt the U.S.
mented Article 19 by drafting a com- cratic development in the region. Ap- State Department’s Internet Free-
prehensive African Declaration on proximately 15% of our participants dom agenda to the needs of West Af-
Internet Rights and Freedomsn to put were female, and approximately 20% rica. We recruited the NGO Internet
in place African norms in support of were primarily technical activists; the Without Borders (Internet Sans Fron-
online freedom of expression. remaining 80% were about evenly split tières) as a liaison with the human
Other countries in the region have between bloggers and professional rights community in sub-Saharan Af-
relatively positive rankings for their journalists. These numbers are inexact rica. The project had two main objec-
press freedom. We had participants in part because participants were not tives: develop secure messaging tools
from Benin, which is ranked as “partly easily categorized, and some had their based on author Brooks’s research at
free,” with one of the better rankings in own businesses providing both con- Clemson University tailored to local
West Africa (Reporters Sans Frontières tent and technical services. needs; and provide bilingual (English
ranks Benin next to Italy). Training par- Internet influence. All participants and French) training for the West Af-
ticipants from Benin still feared legal used the Internet, including social- rican user community.
proceedings meant to intimidate po- media platforms, giving them a strong Proxy networks. Tools are available
litical speech. During our training ses- voice. The government of The Gambia for circumventing censorship, many
sions, 2012 to 2016, the status in some recognized the power of the Internet in providing proxy connections to Inter-
countries improved. Côte D’Ivoire (Ivory 2013 by passing a law that punishes its net users. A local client initiates a con-
Coast) moved from “not free” to “partly use to “spread dissatisfaction with the nection to a remote server through an
free,” and Senegal’s rankings improved. government” with fines over $100,000 encrypted “tunnel,” and the remote
The only available statistics for Internet and 15 years in jail.q The influential Ba- computer executes actions requested
Freedom in Africa can be found in Free- lai Citoyenr (Burkina Faso) and Y’en a by the local host, returning results to
dom House’s series of Internet Freedom Marres (Senegal) movements had used the local host through the tunnel.
Reports,o which increased the number the combined influence of musicians We now discuss the Tor, Psiphon,
of African countries it covers from six in and web activists to bring about free Lantern, and uProxy proxy systems.
2011 to 16 in 2016. Unfortunately, only and fair democratic elections since Proxy networks and virtual private
two West African countries—The Gam- 2011. Repressive governments and networks (VPNs) help users circum-
bia and Nigeria—were included, thus free-expression activists alike were vent surveillance and censorship but
limiting our ability to provide objective aware of the power of the Internet and are not perfect solutions:
demographics here. new media, using them to advance National firewall. A national fire-
Activist community. We worked their agendas. wall can track remote connections,
with bloggers, journalists, and activ- detect DNS/IP addresses used by
p See the table for demographic and human proxies, and block suspect addresses.
rights data on the countries discussed here. Censors use DPI to identify addresses
m https://freedomhouse.org/sites/default/files/ q https://freedomhouse.org/report/freedom- with suspect content;
FH_FTOP_2016Report_Final_04232016.pdf net/freedom-net-2015
n http://africaninternetrights.org r English translation: “A citizen’s broom sweeps
o https://freedomhouse.org/report-types/free- clean.” t https://freedomhouse.org/report/freedom-
dom-net s English translation: “We are fed up.” net/freedom-net-2015

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF T HE ACM 75

contributed articles

Proxy connections. Proxy connec- by maintaining a set of reserve (bridge)

tions can be security risks at both ends. addresses that become available as
Clients can have sessions spied on by needed, though this set of nodes some-
the proxy server. Servers can be made times is scarce. Tor is also implement-
responsible for client actions that
seem to be from the local machine; and Non-democratic ing pluggable transportw (PT) layers
that modify the network transport
Latency and jitter. Increased latency
and jitter hinder user acceptance.4
countries with layer and disguise Tor traffic. Unfortu-
nately, each PT is usually supported by
Even users aware of local censorship poor human only a small number of bridges; a PT
and surveillance risks tend to use fast-
er direct Internet connections.
rights records can also produce a fingerprint that can
be detected.
Each proxy has its own strategy for maintain power by uProxyx is a browser extension for
overcoming these drawbacks. Psi-
phonu is a one-hop proxy with multiple
tightly controlling Chrome and Firefox that allows us-
ers to share their Internet connec-
modes, including one that hides its use information, tion with others. It was developed by
of encryption. It avoids nation-state
firewall blocking by running a large, limiting their Google Ideas, now the Jigsaw subsid-
iary of Alphabet, in conjunction with
international park of proxy nodes that populations’ ability Lantern and the University of Wash-
are difficult to enumerate and provid-
ing access options that obfuscate the to share opinions, ington. uProxy functionality is rough-
ly similar to CGI-Proxy we used in our
connection. The proxy nodes are pro-
vided by Psiphon, making Psiphon po-
organize, and system. Ideally, a friend of a user in a
repressive country would volunteer to
tentially liable for criminal abuse. (An create democratic provide a friend with a proxy connec-
online system allows Chinese users to
rank the speed and stability of existing
alternatives. tion. In this scenario, the friend risks
being potentially responsible for ille-
proxy solutions, https://cc.greatfire. gal activities done by the proxy client,
org/en; from here on, we include, in and the client could be spied on by the
parentheses, its ranking of each proxy friend. Alternatively, the proxy con-
as of June 2017, if the proxy was pres- nection can be through a commercial
ent in the survey.) For example, Psi- provider. This second scenario is basi-
phon (11) users have to trust Psiphon cally equivalent to using a commercial
not to spy on proxy connections and VPN. As with Psiphon, the user has to
exploit session information. trust the commercial VPN. Many users
The Torv (9) proxy network tunnels do not have friends available in coun-
connections through three, separately tries outside the firewall, and countries
encrypted hops. To protect user privacy, with national firewalls often block the
entry into the Tor network is normally service providers (such as Github and
through a small number of trusted Gmail) uProxy relies on.
guard nodes. Tor provides advice to Lanterny (6) is a product of Brave
help exit-node providers minimize New Software, a nonprofit providing
their legal risk, primarily by telling a distributed proxy, bootstrapping
ISPs in advance that the node is a Tor initial connections through Google
exit node. Exit nodes have been used to Talk servers, but does not provide
spy on users in the past. It is unwise to anonymity, aiming instead to provide
send personally identifiable informa- efficient access to websites. If a site is
tion through Tor. Tor’s use of two addi- not blocked locally, Lantern will load
tional network connections to increase the material directly and not use the
anonymity adds more latency and jitter proxy. If a webpage is blocked local-
than one-hop proxies. Many countries ly, Lantern will retrieve the webpage
block Tor. Iran has blocked SSL/TLS through a proxy connection. Lantern
connections, which block Tor. China maintains a distributed set of proxies
blocks connections to IP addresses for the user. Users can allow their con-
that run Tor. China looks for the TLS nection to be shared. All traffic passing
cipher lists that indicate Tor use. Some through the Lantern peer-to-peer sys-
countries actively probe and blacklist tem is encrypted. The distributed na-
nodes they suspect of providing ac-
cess to Tor. Tor counters such blocks
w https://www.torproject.org/ docs/pluggable-
transports
u https://psiphon3.com/en/index.html x https://www.uproxy.org/
v https://www.torproject.org/ y https://getlantern.org/

76 COMM UNICATIO NS O F THE AC M | M AY 201 8 | VO L . 61 | NO. 5

 contributed articles

ture of Lantern reduces, but does not ing sessions, with individual users To access our network, clients use
eliminate, the risks of proxy use. Since deciding whether or not to be a proxy the network protocol in Figure 1 to
only part of the session would be sent server after talking face-to-face with find the address of a remote proxy.
through an individual proxy exit node, potential proxy clients. They have a dynamically updated list
the likelihood that an exit node would Our users made fully informed de- of DNS names used to connect to our
be blamed for the acts of a malicious cisions as to whether or not to share proxy network. It attempts to open
user are reduced. Similarly, the amount their network connection. The risk of a Secure Shell (ssh) session through
of information an exit node can harvest acting as a proxy in this setting is less a DNS tunnel to our authentication
from a naive user is reduced. than with Tor and similar to sharing a node. Password-less ssh credentials
Our proxy design. We developed network connection with a colleague verify that the connection is from one
and deployed a network of peer-to-peer through uProxy. It is difficult to com- of our authenticated users. When au-
proxies for our user community that pare this risk with the risk of being an thentication succeeds, the local node
included journalists, human rights exit node for Lantern, where users pro- receives the DNS name of a proxy
activists, political dissidents, and tech- vide small slices of their bandwidth to clearinghouse node.
nology activists from the region. Our strangers. With our system, users pro- The local node opens a second DNS
technical goal was to adapt tools used vide a vetted colleague with an entire tunnel to the clearinghouse and uses
in the botnet community to avoid DNS session. We are the only proxy we are Secure Copy through the DNS tunnel
and IP-address filtering. Many botnets aware of that automatically blocks the to retrieve the IP address of the node/
remain active for years despite our best use of proxy servers when the political proxy it can use to access the Internet
efforts to stop them. stance of the exit server’s country could for the current session. Our protocol
Unlike Tor, Psiphon, and Lantern, pose a risk. design and implementation included
which are open to the public, our tool We did not conduct extensive perfor- a number of innovations adapted from
resembles uProxy in that it is deployed mance comparisons between our tool criminal botnets to counter Internet
by a small, trusted, authorized user and the other proxy networks. It is prob- censorship, especially DNS/IP filtering.
community. It is similar to Lantern in ably fair to assume that the connection The following sections describe the
that our clearinghouse maintains a dy- speed and jitter of the one-hop proxies, techniques we used to avoid tracking
namic list of proxies available for im- including ours, are roughly equivalent. and detection.
mediate use. Unlike other proxies, we The observed network throughput of the To establish secure communica-
vetted the people invited to our train- connection is one factor we considered in tion to our system’s authentication
ing sessions, and they helped define choosing the proxy location. Worth not- servers, we had to bypass firewalls
the rules we enforce in maintaining ing is that the performance of our tool in and network filters and found that
the network. To reduce the risk of us- Africa was quite different from when we many malicious botnets use DNS to
ing a proxy, we did the following: tested it in North America and Europe. communicate covertly.1 DNS is of in-
Informed users of risks. We explained The Internet in Africa uses less wired in- terest for several reasons: it is glob-
the risks involved in being a proxy serv- frastructure, and a number of 4G wireless ally deployed and used; its filtering
er, with users allowed to opt out of be- providers compete for business in the ur- typically blocks attempts to connect
ing proxies for others; ban centers. to a blacklisted set of sites; and its
Established a trustworthy user com-
munity. We provided the system to a Figure 1. Nodes find their remote proxy partner using DNS tunneling to access a proxy
clearinghouse hidden by a fast flux connection.
small set of users, all individually vet-
ted by our partners. Most were profes-
sional journalists, well-known blog-
Request service Signed certificate 1
gers, and/or human rights activists. All
had strong professional credentials; Statistical data
Return DNS of real DNS server
Protected privacy. We limited access if authentication is done Authentication
DNS server
to the network to only authenticated us- Client 1 Re
ers and kept no records of user sessions; qu
es
Re ts
Adopted community-defined stan- tu er
vic
Request rn e
dards. We enlisted users in defining the service
IP
a
code of conduct to be respected by the if a ddr
ut ess
ho es
user community; riz fo
at r Admin tools
Recognized political boundaries. ion pr
is oxie
do s
We maintained a matrix segregat- ne
ing countries by security agreements Request service
Signed certificate 2
and shared infrastructure, with proxy
nodes chosen only from countries not Choose two proxies Forward DNS on a regular base
Real
friendly with the local users’ govern- Client 2 DNS server
ments; and (proxy 1)
in other countries
Created a sense of community. We
had the user community meet at train-

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF T HE ACM 77

contributed articles

packets and records are rarely validat- al Environment for Network Innova- script on the forum that would pro-
ed by the ISP, allowing DNS servers to tions (GENI) network.z vide the system with the current list of
be impersonated. These factors make We also regularly changed the DNS names.
DNS suited for use as a covert commu- server’s domain names. In practice, In practice, we had no difficulty with
nication channel. we chose them from Latin-alphabet- sinkholing and never had to use the
Besides DNS tunneling, we also language words taken from Wikipe- second approach.
adapted “fast flux” ideas created by dia. One alternative to this approach Hardened environment. We gave
botnets to protect our users. The would be to algorithmically generate users a hardened networking envi-
term fast flux refers to frequent redef- domain names3 using an algorithm ronment consisting of a bootable, en-
inition of the IP addresses affiliated like the one in Fu et al.2 To further ob- crypted Linux USB drive (Linux Mint-
with a DNS name. In current botnets, scure the network, we used dynamic aaaa), a set of scripts that create and
one symbolic DNS name is affiliated DNS services to register our domain remove a temporary environment on
with a large number of IP addresses. names, allowing individuals to regis- Windows (encrypted using 7-Zipab), or
The IP addresses are given “short ter, at no cost, subdomains to any of an Android app. When using the first
time to live” values and swapped out a large set of volunteer root domains. two, no software would be installed
frequently, generally less than three This is useful, since the root domains on the user’s machine, and care would
minutes. The result is a DNS name are quite varied and have no direct be taken to avoid leaving data traces
that cannot be reliably tied to any connection to our project. for later forensic analysis. Users had
computer through its IP address (see Criminal botnets are known to have to safeguard only the encrypted USB
Figure 2). been “sinkholed,” or a law-enforce- drive. Unlike the proxy tools discussed
Nodes in the fast flux tend to ment agency anticipates the domain earlier, we did not assume the user
work as proxies for a “mothership” name that will be used and then reg- computer could be kept secure from
that wants to be hidden, effectively isters that name. This allows law en- local authorities.
avoiding detection and tracking by forcement to identify and isolate the The hardened environment would
providing a moving target. This is infected nodes, effectively disman- automatically launch a browser using
largely why botnets have been so tling the botnet. We used the following CGIProxyac to access a remote proxy
difficult to stop, even when law en- strategies to avoid sinkholing: node launched in the hardened envi-
forcement and tech vendors might Refreshed DNS names. Each node ronment. CGI-proxy connections all
conspire to track down and neutral- regularly received, during its session, use TLS, thus limiting DPI’s ability to
ize them. 5 Our approach applied a list of DNS names the authentication identify suspect communications.
this concept to our authentication server would use in the future when Client hardening encrypted the
and proxy-distribution servers to the current DNS name would no lon- work environment so even if the soft-
add an additional layer of redun- ger be available. ware would be lost or fall into the wrong
dancy and survivability. The proxy- Hidden Tor service. We maintained hands, the risk of a user data breach
distribution server determined what a Tor hidden service with a user fo- and disclosure of the proxies would be
proxy would be used by the client. rum. Should users be disconnected greatly reduced. A strong password was
As with botnet fast flux, the servers from the service, we would provide a required for users to extract data and
moved frequently to different physi- use our tool.
cal and logical locations on the Glob- z https://www.geni.net/# Should hostile users acquire a copy
of our tool, the amount of damage they
Figure 2. Fast flux. could inflict on the system would be
limited. Our user community became
rather close, and it is quite likely we
10.10.0.3
would have been informed of arrest,
HTTP Get detention, or physical threats, in which
www.example.com
case we would have disabled the user’s
Response DNS query: access to the system. Even if we were
www.example.com Fast-changing
DNS-cached records unaware of a user’s compromise, our
192.168.2.5 matrix of political alliances and shared
HTTP Get www.example.com:
www.example.com 10.10.0.3 infrastructure would have guaranteed a
response: www.example.com:
Response 10.10.0.3 192.168.2.5
192.168.2.5 DNS Server aa Linux Mint provides full disk encryption to
10.5.3.1 www.example.com: counter viruses and keyloggers on users’ lap-
10.5.3.1 10.5.3.1
HTTP Get top computers; https://www.linuxmint.com/
www.example.com ab 7-Zip is portable software for compressing or
zipping files secured with encryption; http://
Response www.7-zip.org/
ac CGI-proxy is a tool comparable to uProxy that
lets nodes without web servers function as a
proxy for others; https://www.jmarshall.com/
tools/cgiproxy/

78 COMM UNICATIO NS O F THE AC M | M AY 201 8 | VO L . 61 | NO. 5

 contributed articles

compromised node could connect only move that user’s credentials from the
to nodes of no possible interest to local authorization node.
authorities. Any attempt to enumerate Lessons learned. During deploy-
network addresses providing proxy ac- ment, we learned a number of impor-
cess would have never provided infor-
mation of interest to a local regime. Repressive tant lessons:
Qualitatively different. The Internet
To the best of our knowledge, this is a governments and in Africa is qualitatively different from
the Internet in Europe and the U.S.
free-expression
unique feature of our approach.
Peer-to-peer proxies. The list of proxy Wired connections are rare and power
nodes we maintain includes only those
that are currently active. In addition to
activists alike were disruptions are common. Most connec-
tions use 4G wireless in urban areas;
proxy servers in Africa, we maintained aware of the power Test as soon as possible. Start test-
at least four active proxy servers on the
GENI network for approximately 50 us-
of the Internet and ing the tool in the local environment
as soon as possible. Our first version,
ers. The clearinghouse kept up-to-date new media, using which we tested in Europe and the U.S.,
information on the quality of the net-
work connections to proxy nodes that them to advance delivered extremely poor quality of ser-
vice on African networks;
let us do load balancing. Members of their agendas. Enlist local technologists. Enlist local
our user community also acted as prox- technologists into the project for test-
ies for each other, as shown in Figure 1. ing early in the process if possible. Once
We gave each user the choice of we began using colleagues in Abidjan
whether or not to act as a proxy server. and Abuja to test our system, we were
This option had not been anticipated able to find timing errors more quickly;
at the beginning of the project but was Use local technologists. Use local
requested by users during training. We technologists to support other users.
originally assumed solidarity with the Many web activists who were part of co-
community would lead it to provide se- working spaces made themselves avail-
cure connections for each other. Many able on short notice to help journalists;
expressed concern over how authori- Listen to the local participants. Listen
ties could misuse information harvest- to the local participants to learn their
ed through eavesdropping on proxy security problems, many of which we
sessions on their nodes. could not have anticipated. We had as-
Internet Without Borders (http:// sumed users would be eager to serve as
internetsansfrontieres.org/) devel- proxies for their colleagues, but many
oped a matrix identifying countries were, in fact, hesitant. This is reason-
with either mutual defense agree- able for people living under authoritar-
ments or the same telecommunica- ian regimes, and we were naive not to
tions providers. Proxy connections have foreseen it;
are made only through countries that Apply local lessons. We adapted war
are not friendly with local govern- games from African training and used
ment and various providers. We did it as a class exercise for our college
this to protect our user community. students who found ways to evade our
Proxy connections were encrypted surveillance we had not anticipated.
while passing from the client through We added those tools to the next set of
the network to the proxy but in clear training sessions; and
text when leaving the proxy. By forc- Make no assumptions. Do not make
ing connections through a country assumptions about the local security
not aligned with the home country, situation based on rules of Western
it becomes functionally impossible law enforcement. Warrantless search-
for the home country’s political au- es occur. Some users had problems
thorities to survey the session. Should with informers within their own local
a node become compromised and networks. The political situation can
used to harvest the addresses of our be changed for the better by the local
users, the home country authorities population when it has access to in-
would be able to harvest only the IP formation. Participants in our train-
addresses of users in countries with ing were in groups (rap singers and
which they do not have friendly rela- web activists working together) that
tions. The user community grew close even managed to bring about regime
and was often aware when a member change, removing entrenched govern-
was detained, thus allowing us to re- ments from power.

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF T HE ACM 79

contributed articles

African dissidents to come to France as

political refugees. For the third year, we
held two training sessions in Abidjan
but dropped the one in Paris. During the
first two years, we had already educated
the members of the diaspora in France
who were most influential and were hav-
ing difficulty getting visas approved to
travel to France to participate.
Participants. We received a large num-
ber of applicants who recognized the
importance of secure Internet use for
their own projects. Although most were
natives of West Africa, a few were also
from Europe. The Europeans worked
for NGOs involved in the region or for
international organizations or were
Fadel Barro (2-L), a leader of Le Y’en a Marre (We’re Fed Up) movement, and Oscibi Johann (2-R), journalists working for international
a leader of Burkina Fasos Le Balai Citoyen (Citizens Broom), at a press conference in Kinshasa. broadcasters. The training groups in-
cluded members of the International
Proxy system comparison. Such sys- direct connections to proxy nodes has Federation of Journalists, the Commit-
tems vary according to how proxy nodes made them vulnerable to traffic finger- tee for the Protection of Journalists, and
are chosen. Tor and Lantern users rely printing, blacklisting, and active prob- several NGOs that preferred to not be
on public proxy nodes, though public ing. Our use of fast flux was different identified. Most of the African partici-
proxy nodes have been used to spy on from these existing tools. By frequently pants were either journalists or bloggers,
users. Psiphon runs its own proxies changing the DNS and IP addresses as- many also influential activists.
and has access to incoming and outgo- sociated with our proxy, it should have One participant had set up an on-
ing traffic. uProxy forces users to find been more difficult to use such tech- line election-monitoring system that
their own proxy nodes. We were able niques to disable our system. However, was largely responsible for his coun-
to provide users with a community of traffic fingerprinting would still be pos- try’s first peaceful democratic transi-
professionally vetted colleagues they sible for identifying our use of DNS tun- tion of power. Another worked with
could meet face to face. neling, and our use of DNS tunneling a group of rap musicians and tech
Proxies also route traffic differently. required very few, small messages. To activists who had mobilized their lo-
Psiphon connects users directly with date, this has not been a problem. cal populations to protest a planned
nodes located mainly in Western coun- Training sessions. We sought out change in the local constitution that
tries. When not using the connection local activists who were most capable would have let the local strongman
of a friend, uProxy uses cloud connec- of contributing to our training ses- remain in power for more than 27
tions through Digital Ocean (sites in sions. We posted advertisements, used years. Enough protesters took part to
North America, Europe, Bangalore, social networks, and took advantage convince the country’s army to ask the
and Singapore), Facebook, Github, or of our connections within the Afri- strongman to leave the country, lead-
Google. Such a connection can be dif- can diaspora to recruit a diverse set of ing to a free and fair election.
ficult to access from countries with ac- participants. Our plan was to have two Participants not able to take part in
tive censorship; for example, many are sessions each year from 2014 to 2016, the training included a blogger from
blocked in China. Tor routes are cho- one in Abidjan, Côte D’Ivoire, and one Mali who continued reporting from
sen from nodes distributed throughout in Paris, France. We chose Abidjan, his city even while it was occupied by Al
the world. Users can specify preferred since it is a major commercial center Qaeda and a journalist working in the
nodes (and therefore countries) for en- for West Africa with excellent travel Central African Republic during a vio-
try and exit. Lantern’s routing assumes connections. As Abidjan is a member lent civil conflict between Christians
individuals are not being targeted. Proxy of the Economic Community of West and Muslims.
routes include nodes in the local coun- Africa, citizens of almost all countries Participants reported a number of
try. We assumed our users were being in our target area did not need a visa to threats to Internet freedom in the region:
PHOTO BY F EDERICO SC OPPA /A FP/ GET T Y IM AGES

targeted. We routed traffic to proxy travel there. It also has a stable political In Gambia. Journalists would be
nodes located at either U.S. research climate. Training in Abidjan was held held by the National Intelligence Agen-
universities or in a West African coun- at a computer training facility at Uni- cy until they allowed access to their
try not allied with a local government. versité Felix Houphouet Boigny. email messages;
To the best of our knowledge, ours As the former colonial power, France In Togo. Journalists worried that
is the only proxy that explicitly consid- still has strong cultural and economic communications networks would be
ers political tensions in choosing how ties to most West African countries. shut down during elections and jour-
to route proxy traffic. The way Tor, Psi- There is also a large African diaspora in nalists detained following sensitive
phon, Lantern, and uProxy maintain greater Paris, and it is not unusual for mobile phone conversations;

80 COMM UNICATIO NS O F THE ACM | M AY 201 8 | VO L . 61 | NO. 5

 contributed articles

In the public interest. Some activists nal exam for the training. The training plaint was the fact that the training fa-
were jailed for putting online apoliti- personnel acted as the “national intel- cilities were not adequate (3.69 out of 5),
cal information that was clearly in the ligence agency” that would block access which is understandable given the lim-
public interest; and to Internet sites and sniff the network ited funds, time, personnel, or a com-
Forced to flee. Following training, at for “evidence.” Concrete evidence of us- bination of reasons. The most frequent
least three activists were forced to flee ers accessing “politically sensitive” in- complaint about the training facilities
their country of origin due to threats formation would cause them to be “im- was the quality of the local Internet con-
of imprisonment or physical harm prisoned,” or expelled from the game. nection. We received the following user
due to their online presence. Other The trainees were divided into suggestions for improvement: provide
participants helped them find safe ha- groups, with players in the same group information on mobile phone security;
ven in other countries. working together. Each player would provide information on telephone wire-
There is a very active maker commu- choose a role in the game by picking a taps; provide guidance on how to collect
nity in West Africa, including a number of piece of paper from a hat. Each team information on state surveillance infra-
free-software activists. The local tech com- included an “agent provocateur” who structure; and provide guidance on how
munity is socially engaged, creating mak- would inform the “national intelli- to work around Internet blackouts.
er spaces that promote technical literacy gence agency” of suspicious activity.
within the region. By bringing these local The first scenario involved reporters Africtivistes Movement
technicians into our training sessions, we trying to collect information about cor- During the final year of the course, many
were able to provide the democracy advo- rupt officials and the second an armed trainees, who had initially met at our
cates local contacts who could provide insurgency resembling Boko Haram. training sessions, worked together to
them technical support as needed. The game scenarios required train- create the Africtivistes movementaf and
Curriculum. The training curricu- ees to apply the tools they had been League of African Bloggers and Cyber-
lum concentrated on Internet free- given without help from the instructors. Activists for Democracy, which held its
dom. We surveyed the global situation, They indeed had to prove their ability to first annual meeting in Dakar, Senegal,
discussed surveillance and censorship outwit them. We found this to be very November 25, 2015. The initial team
technologies, and taught the user com- useful, as it was popular with the train- was lead by Cheikh Fall (@cypher007),
munity the necessary skills. In addition ees, allowing them to gain confidence in who helped Y’en a Marre put in place
to teaching them to use our proxy, we their ability to use the tools. And embed- an election-monitoring tool in Senegal,
tutored them in the use of Tor, Psi- ding “informers” in the scenarios was Justin Yarga (@y_jus), who worked as
phon, and encrypted email. an essential aspect of the game, forcing a web liaison for Balai Citoyen as it led
In the second and third years, we users to think about the security of their pro-democracy protests in Burkina
added new topics and deployed a Frien- internal communications and seriously Faso, and Aisha Dabo (@mashanubian),
dica open source social-network site at contemplate possible threat models. a Gambian journalist. They assembled
a .onion address on the dark web. We After using these scenarios for in- 150 activists from 35 countries repre-
found that providing the community structing journalists, the author Brooks senting the major online movements in
a private, secure forum it could reach integrated them into his computer-en- sub-Saharan Africa. Attendees included
only through Tor helped its members gineering security course at Clemson Youssou N’Dour, a major world-music
understand the tool would give them University. In addition to it being a use- star who was a former Minister of Cul-
access to items unavailable through ful exercise for the course, his students ture in Senegal and current minister-
normal means. Previously, the stu- managed to find some tools (notably adviser to the President of Senegal. We
dents had noticed Tor’s latency more anonymous chat services) for use in the provided onsite security training for the
than its strong points. Once they were war game he had not previously consid- Africtiviste delegates and helped them
used to using Tor for communicating ered. The insights he gained from his set up their own dark web forum.
within the community, such commu- students became part of the following The Africtivistes movement is co-
nication became a habit. We found year’s security seminar in Abidjan. ordinating national pro-democracy
that people teaching the use of privacy Training surveys. An anonymous sur- activities into a pan-African force. We
tools should introduce them in ways vey (bilingual in English and French) were able to help many of them simply
that emphasize their unique abilities. was performed at the end of each train- by giving access to other people fac-
Otherwise, students would be more ing session. Participant satisfaction ing similar problems. The Africtivistes
likely to notice some deficiency of the with the training scored an average of group is currently working to help a
user interface, like, say, latency. 4.4 out of 5 on our five-point scale.ae number of national actions, including:
War (role-playing) game. We devel- Participants rated both the appropriate- #Sassoufit. Trying to convince the
oped role-playing game scenarios where ness and effectiveness of the project at President of Congo Brazzaville to re-
trainees would have to cooperate and 4.6. They disagreed strongly (1.4) with spect his country’s constitution and
share information to win. A detailed the idea that Internet freedom is not a enforce the term limit of 30 years on
introduction of the game is available problem in West Africa. The main com- the current president;
online,ad and we used the game as a fi- #Article59 Togo. Trying to convince
ae All questions used a five-point scale ranging
the government of Togo to respect
ad https://clemson.box.com/s/4knwbrq4j27zn0w from strong disagreement (1) to strong agree-
4iig2at0wanymza4t ment (5); af http://www.africtivistes.org/!/

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF T HE ACM 81

contributed articles

term limits, as written, in its national mentation as to Internet censorship the support we received from our sem-
constitution; and surveillance in the region. Since inar participants and the Fondation
Benin Vote 2016. Trying to establish then, numerous reports have indi- Robert Fiadjoe pour le Qualité and
an online election-monitoring system cated many of the more authoritarian to thank the editor and reviewers for
to make the country’s presidential countries in the region have purchased their thoughtful reviews and sugges-
election more transparent; and deployed sophisticated network- tion of improvements to this article,
#StopBokoHaram. Protesting expan- surveillance tools from companies in greatly improving its quality.
sion of the Boko Haram insurrection Western democracies. We have found
into Cameroon and persuade the inter- no documentation on Chinese involve- References
1. Dietrich, C.J., Rossow, C., Felix, Freiling, C., Bos, H.,
national community to intervene; and ment in Internet surveillance in the Van Steen, M., and Pohlmann, N. On botnets that use
#Mauritanie. Protesting actions tak- region. On the contrary, China is in- DNS for command and control. In Proceedings of the
Seventh European Conference on Computer Network
en to imprison human rights activists vesting in local networking infrastruc- Defense (Gothenburg, Sweden, Sept. 6–7). IEEE
Computer Society Press, 2011, 9–16.
arrested for working against the mod- ture, and we have anecdotal evidence 2. Fu, Y., Yu, L., Hambolu, O., Ozcelik, I., Husain, B.,
ern slave trade in Mauritania. of individual Chinese citizens helping Sun, J., Sapra, K., Du, D., Beasley, C., and Brooks,
R. Stealthy domain-generation algorithms. IEEE
The Africtivistes movement is on- the African population learn to evade Transactions on Information Forensics and Security
going and has brought together the censorship of social media. 12, 6 (June 2017), 1430–1443.
3. Hagen, J. and Luo, S. Why Domain-Generating
sub-Saharan human rights, blogging, The Internet in Africa is qualitative- Algorithms? Trend Micro, Aug. 18, 2016; http://blog.
journalism, and tech communities into ly different from the Internet in North trendmicro.com/domain-generating-algorithms-dgas
4. Roberts, H., Zuckerman, E., and Palfrey, J.
a common front. Plans are underway America and Europe. There is much Circumvention Landscape Report: Methods, Uses, and
to create a new generation of security less wired infrastructure, and most Tools. The Berkman Center for Internet & Society
at Harvard University, Cambridge, MA, 2007; http://
training sessions where local trainees users rely on 4G wireless links. The cyber.harvard.edu/sites/cyber.harvard.edu/files/2007_
will train yet others to use the tools we reliability of network and electrical in- Circumvention_Landscape.pdf
5. Silva, S.S.C., Silva, R.M.P., Pinto R.C.G., and Salles, R.M.
would provide. Remote technical sup- frastructure is not assured. We found Botnets: A survey. Computer Networks 57, 2 (Feb.
port will be provided by author Brooks’s it difficult to assure the performance 2013), 378–403.

team at Clemson. of our tools without them being tested

Richard Brooks (rrb@g.clemson.edu) is a professor
in the region. On the other hand, the of computer engineering in the Holcombe Department
Conclusion McKinsey Group has estimated that of Electrical and Computer Engineering at Clemson
University, Clemson, SC, USA.
Our project ended in the spring of 2016, in 2025 the Internet in Africa will in-
Lu Yu (lyu@g.clemson.edu) is a postdoctoral fellow
with its technical products having been volve approximately 600 million us- of computer engineering in the Holcombe Department
taken over by the Internet Without Bor- ers buying $75 billion in e-commerce of Electrical and Computer Engineering at Clemson
University, Clemson, SC, USA.
ders NGO that had expressed interest goods and services, and the Internet
in deploying our tool for other user will add approximately $300 billion Yu Fu (fu2@g.clemson.edu) is a staff engineer at Palo
Alto Networks, Palo Alto, CA, USA.
communities. Our training sessions to the region’s economy.ag
Oluwakemi Hambolu (ohambol@g.clemson.edu) is a
were successful in many ways, some we Demographically and financially, Ph.D. student in the Holcombe Department of Electrical
could not have foreseen: the sub-Saharan Internet is growing, and Computer Engineering at Clemson University,
Clemson, SC, USA.
Influential activists. A large number and we are witnessing an ongoing
John Gaynard (jgaynard@gmail.com) has taught
of influential activists in the region are struggle between authoritarian gov- innovation at ESIEE Engineering School in Paris, France,
now aware of the larger international ernments and local democracy activ- and the OU Business School, U.K., and spent much of his
professional career consulting on strategic and telecoms
struggle for Internet freedom; ists taking place largely over the Inter- issues in French West Africa.
Trainees. A number of trainees used net. While in many ways the Internet Julie Owono (julie@internetsansfrontieres.org) is a
our materials and tools to hold their is helping the pro-democracy forces, lawyer and Executive Director of Internet Without Borders
(https://internetwithoutborders.org/).
own local training sessions to spread it is also helping keep non-democratic
Archippe Yepmou (archippe@internetsansfrontieres.org)
their new knowledge; governments in place. is a musical composer and President of Internet Without
Local participants. We trained local Borders (https://internetwithoutborders.org/).
participants on a range of tools, includ- Acknowledgments Félix Blanc (fb.blanc@gmail.com) is head of
public policy in Internet Sans Frontières (https://
ing ours, for using the Internet securely We would like to acknowledge the internetwithoutborders.org/) and a research fellow in the
while avoiding censorship and surveil- support of the U.S. State Depart- Center for Technology and Society in the Law Department
of the Getulio Vargas Foundation, Rio de Janeiro, Brazil.
lance; and ment’s Bureau of Democracy, Hu-
Like-minded colleagues. Many par- man Rights, and Labor in part for this ©2018 ACM 0001-0782/18/5
ticipants connected with like-minded work through Internet Freedom for
colleagues throughout the region with West Africa grant number SLM-AQM-
whom they could collaborate. 12GR1033. The statements in this arti-
Plans are under way to expand this cle are the opinions of the authors and
work by having Internet Without Bor- do not reflect the positions of the U.S.
ders deploy our technology to support government or the U.S. Department
other user groups and Africtivistes cre- of State. We also wish to acknowledge
ating a new set of training sessions de- Watch the authors discuss
rived from our original curriculum. ag https://www.mckinsey.com/industries/high- their work in this exclusive
Communications video.
Before working with local activists, tech/our-insights/lions-go-digital-the-inter- https://cacm.acm.org/videos/
we were unable to find reliable docu- nets-transformative-potential-in-africa internet-freedom-in-west-africa

82 COMMUNICATIO NS O F TH E ACM | M AY 201 8 | VO L . 61 | NO. 5

 DOI:10.1145 / 3 1 9 75 44

The data comes from multiple optimal sources

in parallel, helping reduce addressing and
data-acquisition latency.
BY XIAONAN WANG

Data
Acquisition
in Vehicular
Ad Hoc
Networks
WITH THE AMOUNT of multimedia data large and growing
larger, low-latency data acquisition represents an
important practical goal for emerging Internet of
Vehicles applications. Multihoming could help reduce
such latency because it could let a single node use
multiple addresses to acquire data in parallel.
Network researchers are thus trying extending the k-anycast model to help
to extend multihoming to vehicular acquire data in parallel.
ad hoc networks (VANETs), aiming to Vehicles on the road today include
reduce latency in the Internet of Ve- abundant computer processing and
hicles. But in VANETs with multihom- storage, producing demand for con-
ing, a vehicle must be able to perform n
addressing processes to be configured key insights
with addresses with n global network
prefixes (GNPs). And getting a vehicle ˽˽ Because there is so much multimedia
data, low-latency data acquisition could
to use addresses with different GNPs help ensure vehicles get what they need.
to acquire data in parallel through the
standard communication models is ˽˽ Acquiring multimedia data through
vehicular ad hoc networks helps deliver
a significant engineering challenge. the data to networked vehicles.
Here, I propose an address-separation
˽˽ The k-anycast model can be extended to
mechanism so vehicles can be con-
vehicular ad hoc networks so they can
figured with addresses with different acquire data in parallel and help reduce
GNPs in a single addressing process, latency in data acquisition.

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF T HE ACM 83

contributed articles

necting VANETs to the Internet so including one GNP;2 that is, a node data from providers in parallel via uni-
they can acquire a variety of multime- must perform n addressing processes cast, anycast, or multicast.
dia data.1,6,12 In multihoming, one IP to be configured with addresses with n Wang9 proposed a k-anycast com-
domain is identified by n (n ≥ 2) GNPs, GNPs, leading to considerable address- munication model in the IPv6 net-
and a node can be configured with ing latency; and work with one GNP. In the k-anycast
n addresses with different GNPs.7 A Data acquisition. In unicast and any- model,9 one k-anycast group consists
node would use these addresses to cast models, a node acquires data from of k-anycast members that cooper-
acquire data in parallel, thus reduc- a single provider. In multicasting, a ate to provide data in parallel; that
ing data-acquisition latency.3–5 How- multicast address works only as a desti- is, a user can acquire data from more
ever, network researchers trying to nation address. Each destination mul- than one member in parallel, greatly
extend multihoming to VANETs must ticast member receives a copy of data reducing data-acquisition latency.
first address two main technical chal- from a particular source, so a multicast Due to the efficiency of the k-anycast
lenges:3 member actually acquires data from a model, vehicle-network researchers
Addressing. A node usually performs single provider. A node cannot use ad- are looking to take advantage of the
an addressing process with addresses dresses with different GNPs to acquire k-anycast idea. Addressing and data-
acquisition latency can thus be re-
Figure 1. Architecture. duced through multihoming and the
k-anycast model. Based on my pro-
AR 1-1-2/GNP 1-1-2
AP1-2 AR 2-1-2/GNP 2-1-2
posed architecture for VANET with
AR 1-1-1/GNP 1-1-1AR AP2-2 multihoming, a vehicle can be con-
2-2-1/GNP 2-2-1 AR 2-2-2/GNP 2-2-2
AR 2-1-1/GNP 2-1-1 AR 2-3-1/GNP 2-3-1 figured with addresses with different
AR 1-2-1/GNP 1-2-1
GNPs through a single addressing
process, substantially reducing ad-
dressing latency. Also based on my
AP1-3 proposed architecture, the k-anycast
AP2-3
model can be extended through a
AP1-1/AP2-1
single GNP9 to VANET with multiple
GNPs so the vehicle would use ad-
dresses with multiple GNPs to ac-
quire data from different k-anycast
AR 1-1-3/GNP 1-1-3
members in parallel, thus reducing
AR 1-3-1/GNP 1-3-1 AR 2-1-3/GNP 2-1-3 data-acquisition latency.
AR 1-4-1/GNP 1-4-1 AP1-4 AR 1-4-2/GNP 1-4-2 AP2-4 There are two main differences be-
M1 AR 2-4-1/GNP 2-4-1 M2 tween the data-acquisition mechanism
G 1={ GNP1-1-1, GNP1-1-2, GNP1-1-3, GNP1-2-1, GNP1-3-1, GNP1-4-1, GNP1-4-2} I propose and the one suggested by the
G 2={ GNP2-1-1, GNP2-1-2, GNP2-1-3, GNP2-2-1, GNP2-2-2, GNP2-3-1, GNP2-4-1} k-anycast mechanism:9
Multiple GNPs. The data-acquisition
mechanism based on the i-anycast
Figure 2. Addressing. model9 works in the IPv6 network with
a single GNP, whereas the one I pro-
pose works in VANETs with multiple
AP1-2 acquires G 1 AR 1-1-1/GNP 1-1-1
AR 1-2-1/GNP 1-2-1 GNPs; and
A single GNP. In Wang,9 the optimal
AR 1-1-2/GNP 1-1-2 k-anycast members that cooperate to
provide data are selected based on one
GNP, whereas the optimal k-anycast
AP1-3 acquires G 1
Table 1. k-anycast address.
V 1 acquires
7 addresses
AP1-1 acquires G 1 k-anycast ID Reserved
w 128-w

AR 1-3-1/GNP 1-3-1
AR 1-4-1/GNP 1-4-1 AR 1-1-3/GNP 1-1-3
AR 1-4-2/GNP 1-4-2 Table 2. Content address.
AP1-4 acquires G 1
M1
k-anycast ID Part ID set
G 1= { GNP 1-1-1, GNP 1-1-2, GNP 1-1-3, GNP 1-2-1,
w 128-w
GNP 1-3-1, GNP 1-4-1, GNP 1-4-2}

84 COMMUNICATIO NS O F TH E AC M | M AY 201 8 | VO L . 61 | NO. 5

 contributed articles

members are chosen based on mul- quire data from different optimal k- Case 1. A vehicle outside an AP’s
tiple GNPs. anycast members in parallel. communication range receives the
Anycast is different from k-anycast. Neig-AP, and the vehicle forwards the
In anycast, a node acquires data from Addressing Neig-AP and repeats the operation;
one anycast member, whereas in k-any- In order to reduce the address-con- Case 2. A vehicle within an AP’s
cast, a node acquires data from more figuration latency in VANET with communication range receives the
than one k-anycast member in parallel. multiple GNPs, I propose address Neig-AP, then updates the destination
separation as a way to achieve the ad- address in the Neig-AP with the ad-
Architecture dressing, whereby a vehicle in Mx per- dress of the AP, forwards the Neig-AP,
In DAVM, a VANET consists of access forms only one addressing process to and repeats the operation; and
points (APs) and vehicles and is con- be configured with a globally unique Case 3. An AP receives the Neig-AP,
nected to the Internet through access node ID and is uniquely identified then updates Gx by performing the union
routers (ARs). The lanes enclosed by px through this node ID during its life- operation, as shown in Equation (6).
(px ≥ 2) APs construct a vehicular mul- time. The vehicle then combines its
tihoming domain (VMD) Mx, and each node ID with each GNP in Gx to con-
AP is denoted by APx–y (1 ≤ y ≤ px). APx– struct globally unique addresses with
y links with rx–y (1 ≤ rx–y) AR(s) denoted different GNPs. A vehicle can thus be Ends. The process ends, as shown in
by ARx–y–z (1 ≤ z ≤ rx–y) that identifies one configured with addresses with differ- Figure 2.
GNP denoted by GNPx–y–z. Mx can thus ent GNPs through a single addressing In this data-acquisition process,
be defined by GNP set Gx, as shown in process. APx–y might employ a positioning
Equation (1). One vehicle in Mx can use Node ID space. If a node ID is w- method 10 to determine the VMD one
each GNP in Gx to construct an IPv6 bits long (w is a positive integer) and Neig-AP comes from. As shown in
address and utilize the addresses with the number of APs is 2a (1 ≤ a <w–1, a Figure 2, AP1–1 in VMD M1 receives
different GNPs to acquire data from is a positive integer), then the node ID one Neig-AP from APx–y (x=1, 2≤ y ≤4)
providers in parallel. As shown in Fig- space [1, 2w–2] is divided into 2a parts, and establishes GNP set G1 defin-
ure 1, two VMDs, M1 and M2, are includ- with each part for one AP. The mth (1≤ ing M 1. Likewise, AP x–y (x = 1, 2 ≤ y ≤
ed. The lanes enclosed by APx–y (x = 1, 1 m ≤ 2a) AP’s node ID A(m) is shown in 4) also acquires G 1 by receiving one
≤ y ≤ 4) form VMD M1, which is defined Equation (2), and the mth AP’s node ID Neig-AP. In this way, AP x–y (x = 1, 1 ≤ y
by GNP set G1, and the lanes enclosed space [L(m), U(m)] is shown in Equa- ≤ 4) acquires G1.
by APx–y (x = 2, 1 ≤ y ≤4) construct VMD tion (3) and Equation (4). Each AP thus Address construction. A vehicle V1
M2, which is defined by GNP set G2. has a unique node ID and maintains its in Mx that begins to move uses a hard-
globally unique node ID space. ware ID (such as a media-access con-
trol, or MAC, address) as a temporary
address and acquires a node ID from
the nearest AP APx–y based on the fol-
lowing three-step process:
In DAVM, one VMD is defined by a Sends. V1 sends one N-Req message
GNP set and the VMD-based architec- to APx–y;
ture yields two main benefits: Marks the node. The APx–y receiving
Address separation. A single VMD the N-Req returns one N-Rep message
can help achieve the proposed address- where the payload includes the as-
separation mechanism in VANET signed node ID and GNP set Gx defin-
through multihoming to help reduce GNP set. In DAVM, an AP stores the ing Mx, then marks the node ID as “as-
addressing latency. In the address- GNP sets defining the VMDs it belongs signed”; and
separation mechanism, a vehicle in to. In Mx, APx–y can acquire GNPx–y–z by Sets its node. The V1 receiving the N-
one VMD is configured with a globally receiving a router advertisement from Rep sets its node ID to the node ID in
unique node ID through a single ad- ARx–y–z. When APx–y acquires the GNP set the N-Rep and stores Gx, as shown in
dressing process, then combines the x–y, as shown in Equation (5), it then per- Figure 2.
node ID with each GNP in the GNP set forms the three operations to acquire Gx: Since APx–y’s node ID space is glob-
defining the VMD to construct globally ally unique, the node ID that APx–y as-
unique addresses with different GNPs. signs to V1 is also unique. A V1 config-
A vehicle can thus be configured with ured with a globally unique node ID
addresses with different GNPs through then combines its node ID with each
a single addressing process; and Broadcasts. APx–y sets Gx to Gx–y and GNP in Gx to acquire a globally unique
In parallel. A VMD can help broadcasts one Neig-AP message where IPv6 address. In Figure 2, V1 is located
achieve the k-anycast model in the the payload is Gx–y–z. in M1, which is defined by G1. When
VANET with multiple GNPs to re- Performs operations. Following re- V1 acquires a unique node ID from
duce data-acquisition latency; that ceipt of the Neig-AP, a vehicle or AP per- AP1–1, it then combines the node ID
is, a vehicle in one VMD can use the forms acquisition operations based on with each GNP in G1 to acquire seven
addresses with different GNPs to ac- three cases: unique IPv6 addresses.

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF T HE ACM 85

contributed articles

Figure 3. Data acquisition.

A 2 with K1
A 1 with K1 Start

Network

Network V1 construct g IPv6 addresses Si

AR2 /GNP 2
AR 1/GNP 1/GNP 5 V1 construct g content addresses Di

V1 sends g data request messages Ri

V1
Ri reaches ARi
Network Network

AR3 /GNP3 /GNP 6

AR4 /GNP4 /GNP 7 ARi routes Ri to optimal k-anycast
member Ai

A 4 with K1 A 3 with K1
M1
G 1= { GNP 1, GNP 2, GNP 3, GNP 4, GNP 5, GNP 6, GNP 7} Ai returns a data response message Ei

(a)
Ei reaches ARi and ARi routes Ei to V1
AR 4 AR 2 V1 AR 1 AR 3
R2(S2,D 2) R1(S1,D 1)
V1 receive g data response messages
R4(S4,D 4) R3(S3,D 3) in parallel
Forward R2 to A2 and Forward R1 to A1 and
Receive E2 from A2 Receive E1 from A1
Forward R4 to A4 and Forward R3 to A3 and
Receive E4 from A4 E2(D 2,S2) E1(D 1 ,S 1) Receive E3 from A3 End
E4(D 4,S4) E3(D3 ,S3)

Acquire a whole content (c)

(b)

Data Acquisition construct a k-anycast group uniquely Vehicle V1 is located in Mx, as defined
In the k-anycast model with a single specified by the k-anycast address. The by GNP set Gx, and acquires content
GNP,9 one k-anycast group consists k-anycast address structure consists of C1 identified by k-anycast address K1
of k-anycast members that coopera- w-bit k-anycast ID field and reserved through the following five-step process:
tively provide data in parallel. A user field whose value is zero (see Table Selects. V1 selects g (2 ≤ g ≤ |Gx|)
can thus acquire data from differ- 1). In DAVM, a particular content C is GNPs from Gx to construct g address-
ent k-anycast members in parallel, divided into q (q ≥ 2) parts, with each es denoted by Si (1 ≤ i ≤ g) where the
greatly reducing acquisition latency. part cu (q ≥ u ≥ 1) uniquely identified by node ID is V1’s node ID and then con-
In order to achieve the main DAVM part ID du, as shown in Equation (7). A structs g content addresses denoted
objective of reduced data-acquisi- vehicle would use a content address to by Di. In Di, the k-anycast ID is the
tion latency, network researchers achieve k-anycast communications, same as the ID in K1, and the part ID
are trying to extend the k-anycast with a content address consisting of set is Pi that defines the data parts Bi,
idea with one GNP9 to VANET with the k-anycast ID and part ID set (see as shown in Equation (8), where ci–j (1
multihoming so vehicles are able to Table 2). The k-anycast ID specifies the ≤ j ≤ |Pi|) is the data part identified by
use addresses with different GNPs to type of desired content, and the part element di–j in Pi. This way, Bi satisfies
acquire data from different optimal ID set indicates the specific parts of Equation (9);
providers in parallel. the content.
In DAVM, a single k-anycast address
defines one type of content, and all
providers able to provide that content

86 COMMUNICATIO NS O F TH E AC M | M AY 201 8 | VO L . 61 | NO. 5

 contributed articles

Table 3. Notation.

Notation Description
Sends. V1 sends g data-request mes- T Addressing latency
sages denoted by Ri in which the des- TA-Req Node ID request latency
tination address is Di and the source TA-Rep Node ID response latency
address is Si; b Data rate
Routs. Based on Si, Ri is routed to ARi, t Delay of transmitting a bit between neighbors
which specifies the GNP in Si. Based on tMax Delay of transmitting a message with maximum size between neighbors
Di, ARi routes Ri to the optimal k-anycast sMax Maximum size of a message
member Ai with k-anycast address K1. l Distance between a vehicle and the nearest AP
Based on Pi in Di, Ai returns a data-re-
sID-Req/sID-Rep Size of one N-Req/N-Rep
sponse message Ei whereby the destina-
TC Data acquisition latency
tion address is Si and the payload is Bi;
TReq Data request latency
Further routs. Based on the GNP in
TRep Data response latency
Si, Ei is routed to ARi and then, based on
li Distance between ARi and the nearest member
the node ID in Si, Ei is routed to V1; and
li ′ Distance between ARi and a vehicle
Receives data. V1 can thus receive g
sReq /sRep Size of a data request/response message
data-response messages from differ-
ent k-anycast members in parallel, as
shown in Figure 3.
In Figure 3a, V1 is located in M1, Table 4. Simulation parameters.
which is defined by G1 and connects
with Ri (1 ≤ i ≤4), and the k-anycast Parameters Values
group includes four members, Ai, that Vehicle density 0.01vpm(vehicles/m)
provide content C1, as defined by k- Data rate 2Mbps
anycast address K1. C1 is divided into Number of lanes 2
fours parts, with each part defined by Transmission radius 300m
part ID di. V1 constructs four content Speed 20m/s
addresses Di whereby the k-anycast ID MAC IEEE 802.11p
is the same as the ID in K1, and the part Mobility model Freeway
ID set is Pi. V1 selects four GNPs, GNPi, Simulation time 600s
to construct four addresses, Si. V1 then Rounds 20
sends four data-request messages Ri Confidence level 0.95
in which the source address is Si and
the destination address is Di. Based
on Si, Ri reaches ARi, which routes Ri
to the optimal k-anycast member Ai. nearest AP, and sID-Req/sID-Rep is the size of
Based on Pi in Di, Ai returns a data- an N-Req/N-Rep. Following the descrip-
response message Ei whereby the des- tion of performance evaluation, the da-
tination address is Si and the payload ta-acquisition latency TC consists of the
is the content parts, Bi, as defined by data-request latency TReq and data-re-
Pi. Based on the GNP in Si, Ei is routed sponse latency TRep, as shown in Equa-
to ARi. Based on the node ID in Si, Ei is tions (13), (14), and (15), in which li is
routed to V1, which receives different the distance between ARi and the near-
parts of C1 from different k-anycast est k-anycast member, li is the distance
members in parallel. between ARi and a particular vehicle,
and sReq/sRep is the size of a data request/
Performance Evaluation response message. The notations used
Following the earlier description of in DAVM are listed in Table 3.
data acquisition, the addressing laten-
cy TA consists of the node ID request la- DAVM is evaluated in ns-2 using the
tency TA-Req and the node ID response la- simulation parameters in Table 4 in
tency TA-Rep, as shown in Equations (10), which the number of k-anycast mem-
(11), and (12), in which b is the data bers is equal to g. DAVM is compared
rate, t is the delay in transmitting a bit with the addressing standard2 and the
between neighbors, tMax is the delay data-acquisition scheme with a single
in transmitting a message with maxi- GNP9 called Data Acquisition One
mum size sMax between neighbors, l is GNP, or DAOGNP, as shown in Figure
the distance between a vehicle and the 4 and Figure 5.

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF T HE ACM 87

contributed articles

Figure 4. Addressing latency. ˲˲ Extends multihoming to VANET;

˲˲ Extends the k-anycast idea with one
DAVM Standard GNP to VANET with multihoming so ve-
hicles can use addresses with different
30 GNPs to acquire data from multiple k-
anycast members in parallel; and
˲˲ Provides the address-separation
mechanism so vehicles can obtain mul-
Latency (ms)

20
tiple addresses with different GNPs
through a single addressing process.
My future work will aim to take advan-
10 tage of the powerful computing capabili-
ties and abundant storage resources of
APs to help improve addressing and data
0 acquisition in VANET with multihoming.
2 3 4 5
Acknowledgment
Number of addresses
This work is supported by the 333
Project Foundation (grant number
Figure 5. Data-acquisition latency. BRA2016438), CERNET Innovation Proj-
ect (grant number NGII20170106), and
DAVM DAOGNP National Natural Science Foundation of
China (grant number 61202440).
300
References
1. Amadeo, M., Campolo, C., and Molinaro, A.
Information-centric networking for connected
vehicles: A survey and future perspectives. IEEE
Latency (ms)

200 Communications Magazine, 54, 2 (Feb. 2016), 98–104.

2. Droms, R., Bound, J., Volz, B., Lemon, T., Perkins, C.,
and Carney, M. Dynamic Host Configuration Protocol
for IPv6 (DHCPv6), RFC 3315. Internet Engineering
Task Force, Fremont, CA, 2003; http://www.ietf.org/
100 rfc/rfc3315.txt
3. Gladisch, A., Daher, R., and Tavangarian, D. Survey on
mobility and multihoming in future Internet. Wireless
Personal Communications 74, 1 (Jan. 2014), 45–81.
4. Islam, S., Hashim, A.H.A., Habaebi, M.H., and Hasan,
0 M.K Design and implementation of a multihoming-
based scheme to support mobility management in
2 3 4 5 NEMO. Wireless Personal Communications 95, 2 (Feb.
2017), 457–473.
g 5. Khatouni, A.S., Marsan, M.A., and Mellia, M. Video
upload from public transport vehicles using
multihomed systems. In Proceedings of the IEEE
Conference on Computer Communications (San
As in Figure 4, with the increase in provide the data are selected based on Francisco, CA, Apr. 10–14). IEEE Computer Society
the number of addresses, the address- multiple GNPs, whereas in DAOGNP, Press, 2016, 306–307.
6. Omar, H., Zhuang, W., and Li, L. Gateway placement
ing latency in the standard increases, the optimal k-anycast member are se- and packet routing for multihop in-vehicle Internet
whereas the addressing latency in DAVM lected based on a single GNP; and access. IEEE Transactions on Emerging Topics in
Computing 3, 3 (Mar. 2015), 335–351.
tends to be stable. Such stability follows Single address. In DAVM, a vehicle 7. Troan, O., Miles, D., Matsushima, S., Okimoto, T., and
Wing, D. IPv6 Multihoming Without Network Address
from DAVM including an address-sepa- uses addresses with different GNPs to Translation, RFC 7157. Internet Engineering Task
ration mechanism and a vehicle using acquire data from optimal k-anycast Force, Fremont, CA, 2014; http://www.ietf.org/rfc/
rfc7157.txt
a single addressing process configured members through different routing 8. Vegni, A.M. and Loscri, V. A survey on vehicular social
with multiple addresses with different paths in parallel, whereas in DAOG- networks. IEEE Communications Surveys & Tutorials
17, 4 (Apr. 2014), 2397–2419.
GNPs. As a result, addressing latency is NP, a node uses a single address with 9. Wang, X. Analysis and design of a k-anycast
only minimally affected by the number a single GNP to acquire data from rela- communication model in IPv6. Computer
Communications 31, 10 (Oct. 2008), 2071–2077.
of addresses. In the standard, only a tively optimal k-anycast members. 10. Wang, X. and Zhong, S. Research on IPv6 address
single addressing process is performed configuration for a VANET. Journal of Parallel and
Distributed Computing 73, 6 (June 2013), 757–766.
for each GNP, so the addressing latency Conclusion 11. Wang, X. and Zhu, X. Anycast-based content-centric
grows with the number of addresses. As My observation that multihoming MANET. IEEE Systems Journal PP, 99 (Nov. 2016), 1–9.
12. Zheng, Z., Lu, Z., Sinha, P., and Kumar, S. Ensuring
shown in Figure 5, with the increase in and k-anycast can help lower data-ac- predictable contact opportunity for scalable vehicular
GNPs, the data-acquisition latency in quisition latency to extend multihom- Internet access on the go. IEEE/ACM Transactions on
Networking 23, 3 (Mar. 2015), 768–781.
both DAVM and DAOGNP decreases, ing and k-anycast to VANET is what
but DAVM involves less data acquisition led me to propose DAVM as a way to Xiaonan Wang (nina_99999@163.com) is a professor in the
latency for two main reasons: reduce data-acquisition latency. My Computer Science and Engineering Department of Changshu
Institute of Technology, Jiangsu, Changshu, China.
Based on multiple GNPs. In DAVM, results show DAVM works for three
the optimal k-anycast members that main reasons: © 2018 ACM 0001-0782/18/05 $15.00

88 COM MUNICATIO NS O F TH E ACM | M AY 201 8 | VO L . 61 | NO. 5

 ACM Books M MORGAN & CLAYPOOL
&C P U B L I S H E R S
Publish your next book in the
ACM Digital Library
ACM Books is a new series of advanced level books for the computer science community,
published by ACM in collaboration with Morgan & Claypool Publishers.
I’m pleased that ACM Books is directed by a volunteer organization headed by a
dynamic, informed, energetic, visionary Editor-in-Chief (Tamer Özsu), working
closely with a forward-looking publisher (Morgan and Claypool).
—Richard Snodgrass, University of Arizona

books.acm.org ACM Books

◆ will include books from across the entire
spectrum of computer science subject
matter and will appeal to computing
practitioners, researchers, educators, and
students.
◆ will publish graduate level texts; research
monographs/overviews of established
and emerging fields; practitioner-level
professional books; and books devoted to
the history and social impact of computing.
◆ will be quickly and attractively published
as ebooks and print volumes at affordable
prices, and widely distributed in both print
and digital formats through booksellers
and to libraries and individual ACM
members via the ACM Digital Library
platform.
◆ is led by EIC M. Tamer Özsu, University of
Waterloo, and a distinguished editorial
board representing most areas of CS.

Proposals and inquiries welcome! Association for

Contact: M. Tamer Özsu, Editor in Chief
Computing Machinery
booksubmissions@acm.org Advancing Computing as a Science & Profession
review articles
DOI:10.1145/ 3129340
Previously, a series of studies root-
Tracing 20 years of progress in ed in psychology rather than in com-
puter science investigated the role of
making machines hear our emotions acoustics of human emotion (see, for
based on speech signal properties. example, references8,16,21,34). Blanton,4
for example, wrote that “the effect of
BY BJÖRN W. SCHULLER emotions upon the voice is recognized
by all people. Even the most primitive

Speech
can recognize the tones of love and fear
and anger; and this knowledge is shared
by the animals. The dog, the horse, and
many other animals can understand the

Emotion
meaning of the human voice. The lan-
guage of the tones is the oldest and most
universal of all our means of communica-
tion.” It appears the time has come for

Recognition
computing machinery to understand it
as well.28 This holds true for the entire
field of affective computing—Picard’s
field-coining book by the same name
appeared around the same time29 as

Two Decades in a
SER, describing the broader idea of
lending machines emotional intelli-

Nutshell, Benchmarks,
gence able to recognize human emo-
tion and to synthesize emotion and
emotional behavior.

and Ongoing Trends Until now, the broader public has

experienced surprisingly little auto-
matic recognition of emotion in every-
day life. In fact, only few related com-
mercial products have found their
way to the market, including the first-
ever hardware product—the “Handy
Truster”—which appeared around the
turn of the millennium and claimed to
COMMUNICATION WITH COMPUTING machinery has be able to sense human stress-level and
become increasingly ‘chatty’ these days: Alexa, Cortana,
key insights
Siri, and many more dialogue systems have hit the
consumer market on a broader basis than ever, but do ˽˽ Automatic speech recognition helps
enrich next-gen AI with emotional
any of them truly notice our emotions and react to them intelligence abilities by grasping the
emotion from voice and words.
like a human conversational partner would? In fact, the ˽˽ After more than two decades of research,
discipline of automatically recognizing human emotion the field has matured to the point where
it can be the “next big thing” in speech
and affective states from speech, usually referred to as user interfaces, spoken language
processing, and speech analysis for
Speech Emotion Recognition or SER for short, has by now health, retrieval, robotics, security, and
surpassed the “age of majority,” celebrating the 22nd a plethora of further applications. This is
also shown in the benchmarks of more
anniversary after the seminal work of Daellert et al. in
ILLUSTRATION BY VAULT49

than a dozen research competitions held

in the field to date.
199610—arguably the first research paper on the topic. ˽˽ While deep learning started in this field a
However, the idea has existed even longer, as the first decade ago, it recently pushed to end-to-
end learning from raw speech data—just
patent dates back to the late 1970s.41 one of a couple of current breakthroughs.

90 COMMUNICATIO NS O F TH E ACM | M AY 201 8 | VO L . 61 | NO. 5

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF T HE ACM 91
review articles

deception contained in speech. Ap- timally quantify the time axis.32 Start-
proximately 10 years later, the first ing with representing emotion in an
broad-consumer market video game adequate way to ensure proper fit with
appeared. “Truth or Lies” (THQ) was the psychology literature while choos-
equipped with a disc and a micro-
phone for players to bring the popular Approaching ing a representation that can well be
handled by a machine, two models
“Spin the Bottle” game to the digital
age. Unfortunately, the meta-review
the automatic are usually found in practice. The first
model is discrete classes, such as the
service metacritic.com reported only recognition of Ekman “big six” emotion categories,
a score of 28 out of 100 based on only
six reviews from professional critics.
emotion requires including anger, disgust, fear, happi-
ness, and sadness—often added by
The tech side seemed premature: re- an appropriate a “neutral” rest-class as opposed to
viewers complained about “unstable
tech” and “faulty software” that failed
emotion a value “continuous” dimension ap-
proach that appears to be the favored
to achieve what it promised—detect representation. approach today.17 In this second ap-
lies from human speech. However, the proach, the two axes arousal or activa-
first success stories can be observed tion (known to be well accessible in
at this time; including the European particular by acoustic features) and
ASC-Inclusion projecta that reports valence or positivity (known to be well
encouraging observations in open tri- accessible by linguistic features17) pre-
als across three countries for a seri- vail alongside others such as power
ous video game that teaches autistic or expectation. One can translate be-
children in a playful way how to best tween the categories and dimensions
show emotions. Interestingly, a recent such as ‘anger’→{negative_valence,
study shows that voice-only as modal- high_arousal} in a coarse quantization.
ity seems best for humans’ empathic Other aspects of modeling include the
accuracy as compared to video-only or temporal resolution17 and the qual-
audiovisual communication.22 ity and masking of emotion, such as
Here, I aim to provide a snapshot acted, elicited, naturalistic, pretended,
of the state-of-the-art and remaining and regulated.
challenges in this field. Of course, over Annotation. Once a model is decided
the years further overviews have been upon, the next crucial issue is usually
published that the reader may find of the acquisition of labeled data for train-
interest, such as references2,6,15,20,38 or ing and testing that suits the accord-
on the broader field of affective com- ing emotion representation model.13 A
puting17,43 where one finds an overview particularity of the field is the relatively
also on further modalities such as facial high subjectivity and uncertainty in the
expression, body posture, or a range of target labels. Not surprising, even hu-
bio-sensors and brain waves for the rec- mans usually disagree to some degree
ognition of human emotion. These sur- as to what the emotion should be ex-
veys cover progress up to 2013, but quite pressed in the speech of others—or any
a bit has happened since then. Further, other modality accessible to humans.13
this short survey is the first to provide Self-assessment could be an option,
an overview on all open competitive and is often used when no information
challenges in this field to date. Finally, to annotators is available or easily ac-
it distills a number of future tendencies cessible, such as for physiological data.
discussed here for the first time. Suitable tools exist, such as the widely
used PANAS, allowing for self-report
The Traditional Approach assessment of positive and negative
Let’s start off by looking at the conven- affect.39 Yet, self-reported affect can
tional way to build up an engine able to be tricky as well, as no one has exact
recognize emotion from speech. knowledge or memory of the emotion
Modeling. First things first: ap- experienced at a moment in time. Fur-
proaching the automatic recognition ther, observer rating can be a more ap-
of emotion requires an appropriate propriate label in the case of automatic
emotion representation model. This emotion recognition that today largely
raises two main questions: How to rep- targets assessment of the expressed
resent emotion per se, and how to op- emotion, rather than the felt emotion.
Likewise, external annotation may
a http://www.asc-inclusion.eu be more focused on the emotion ob-

92 COMM UNICATIO NS O F THE ACM | M AY 201 8 | VO L . 61 | NO. 5

 review articles

served and being indeed observable. chine-learning algorithm. This is an ber of functionals is often used such
Likewise, usually five or more exter- ongoing active subfield of research in as moments, extremes, segments,
nal raters’ annotations—particularly the SER domain—the design of ideal percentiles, or spectral functionals,
in the case of crowdsourcing—form features that best reflect the emotional for example, as offered by the openS-
the basis of the construction of tar- content and should be robust against MILE toolkitc that provides predefined
get labels, for example, by majority environmental noises, varying lan- feature sets that often serve as base-
vote, or average in the case of a value guages, or even cultural influences. line reference in the research compe-
continuous emotion representation.17 Most of the established ones are rath- titions in the field. The current trend
Further, elimination of outliers or er low level, such as energy or spectral is to increase the number of features
weighting of raters by their agree- information, as these can be robustly up to some several thousands of brute-
ment/disagreement with the majority determined. Yet, in the synthesis of forced features that was often in stark
of raters can be applied, for example, emotion, there is a strong focus on contrast to the sparse amount of train-
by the evaluator weighted estimator prosodic features, that is, describing ing material available in this field.17,38,43
(for example, Schuller and Batliner32). the intonation, intensity, and rhythm Textual features. Going beyond
Such weighting becomes particularly of the speech next to voice quality fea- how something is said, textual features
relevant when crowdsourcing the la- tures. The automatic analysis of emo- as derived from the automatic speech
bels, such as in a gamified way, for ex- tional speech often adds or even fo- recognition engine’s output are mostly
ample, by the iHEARu-PLAY platform.b cuses entirely on spectral features, looking at individual words or se-
In the case of value continuous label such as formants or selected band- quences of these such as n-grams and
and time representation, for example, energies, center of gravity, or roll-off their posterior probability to estimate
for continuous arousal assessment, points and cepstral features such as a particular emotion class or value.23
raters often move a joystick or slider MFCC or mel-frequency bands as well Alternatively, bag-of-word approaches
in real time per emotion dimension as linear prediction coefficients.2,15,38 are highly popular, where each textual
while listening to the material to rate. Based on frame-by-frame extraction, entity in the vocabulary of all mean-
This poses a challenge to time align one usually derives statistics by apply- ingful entities—from now on referred
different raters’ annotations, as delays ing functionals that map a time series to as words—seen during vocabulary
and speed variations in reaction time of frames with varying length onto a construction usually forms a textual
coin the annotation tracks. Such de- scalar value per segment of choice.2,6 feature.18 Then, the frequency of occur-
lays can be around four seconds,37 and The length may vary with the unit of rence of the words is used as actual fea-
time warping enabled alignment algo- analysis, such as voiced or unvoiced ture value. It is possibly normalized to
rithms should be preferred. In the case sound, phoneme, syllable, or word. A the number of occurrences in the train-
of discretized time, that is, judgment second of audio material or shorter ing material, or to the current string of
per larger segment of speech, pairwise can be recommended considering the interest, length of the current string,
comparisons leading to a ranking have trade-off of having more information or represented by logarithm, in binary
recently emerged as an interesting al- at hand versus higher parameter vari- format, and so on. Linguistically moti-
ternative, as it may be easier for a rater ability if the length of the analysis win-
to compare two or more stimuli rather dow is further increased. A high num- c http://audeering.com/technology/opensmile
than find an absolute value assignment
for any stimulus.17 Figure 1. A current speech emotion recognition engine.
To avoid needs of annotation, past
works often used acting (out an experi- The chain of processing follows from the microphone (left) via the signal processing side of
ence) or (targeted) elicitation of emo- preprocessing and feature extraction (dark orange boxes) via the machine learning blocks (light
tions. This comes at a disadvantage be- orange) to encoding of information to feed into an application. Dashed boxes indicate optional
cause the emotion may not be realistic steps. Five databases are shown in red. Crowdsourcing serves labeling efforts in the first place.
or it may be questionable whether the ASR = Automatic Speech Recognition.
right data collection protocol was fol-
lowed such that the assumptions made Crowd
Emotion
on which emotion is finally collected Model
Sourcing
Application

would hold. In the present big data era,

simply waiting for the emotion sought Codebook Data Knowledge Encoding
to become part of the collected data
seems more feasible aiming at collec- Vector Adaptation / Learnt Decision-level
Audio Capture Optimisation
tion of emotion “from the wild” rather Quantisation Enhancement Model Fusion

than from the lab.

Pre-Processing Segment-level Space Transfer Off- / Online Confidence
Audio features. With labeled data + ASR Features Optimisation Learning Learning Estimation

at hand, one traditionally needs char-

acteristic audio and textual features Frame-level
Features
Segmentation Reduction
Feature-level
Fusion
Decision
before feeding data into a suited ma-

b https://ihearu-play.eu

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF T HE ACM 93

review articles

vated clustering of word variants may frequent use of word fragments, and factors. As training a holistic model is
be applied, such as by stemming or so on. In particular, non-verbal vo- difficult due to the almost entire ab-
representing morphological variants calizations such as laughter, hesita- sence of such richly annotated speech
like different tenses. Also, “stopping,” tions, consent, breathing, and sighing data resources that encompass a wide
or the elimination of entities that do frequently occur, and should best be variety of states and traits, weakly su-
not occur sufficiently or frequently or recognized as well, as they are often pervised cross-task labeling offers an
seem irrelevant from a linguistic or ex- highly informative as to the emotional alternative to relabel databases of emo-
pert’s point of view, can be considered. content. Once recognized, they can be tional speech in a richer way.
However, in the recent years of in- embedded in a string. Efficient data collection. An ever-
creasingly big textual and further data Acoustic and linguistic feature infor- present if not main bottle neck since
resources to train from, the represen- mation can be fused directly by concat- the beginning is the scarcity of
tation type of the word frequencies, as enation into one single feature vector speech data labeled by emotion. Not
well as stemming and stopping, seem if both operate on the same time level, surprising, a major effort has been
to have become increasingly irrel- or by late fusion, that is, after coming made over the last years to render
evant.33 Rather, the retagging by word to predictions per feature stream.23 data collection and annotation as
classes, such as part-of-speech tagging, The latter also allows for representa- efficient as possible.17,38,43
for example, by groups such as noun, tion of different acoustic or linguistic Weakly supervised learning. Semi-
verb, or adjective, semantic word groups feature types on different time levels. supervised learning approaches could
such as standard linguistic dimensions, As an example, one can combine bags- prove successful in exploiting addition-
psychological processes, personal con- of-phonemes per fixed-length chunk of al unlabeled data, once an initial en-
cerns, and spoken categories as in the audio with turn-level word histograms gine was trained.12,25 The idea is to have
LIWC toolkitd or even the translation to in a late(r) fusion manner. the machine itself label new previously
affect categories or values by linguistic Peeking under the engine’s hood. unseen data—ideally only if a meaning-
resources such as SenticNete and oth- Now, let us look under the hood of an ful confidence measure is exceeded.
ers, or via relationships in ConceptNet,f entire emotion recognition engine However, it seems reasonable to keep
General Inquirer,g WordNet,h and in Figure 1. There, one can see the human labeling in the loop to ensure a
alike, can help to add further meaning- features described here are the most sufficient amount of quality labels. Ac-
ful representations. characteristic part of a speech emotion tive learning can help to reduce such hu-
A promising recent trend is to use ei- recognizer —the rest of the processing man labeling requirements significant-
ther soft clustering, that is, not assign- chain is mainly a conventional pattern ly. The machine preselects only those
ing an observed word to a single word recognition system, and will thus not unlabeled instances for human label-
in the vocabulary or more general con- be further explored here. Some blocks ing, which seem of particular interest.
sideration of embedding words such in the figure will be mentioned in Such interest can be determined, for
as by word2vec approaches or convo- more detail later. Others, such as the example, based upon whether a sample
lutional neural networks. Alternatively, learning part or, which classifier or re- is likely to be from a class or interval
recurrent neural networks—possibly gressor is popular in the field, will be on a continuous dimension that has
enhanced by long short-term memo- illustrated by the practical examples previously been seen less than others.
ry33—and other forms of representation from research competitions’ results Further, the expected change in model
of longer contexts seem promising. shown below. parameters of the learned model can be
It should be noted that the tradition- the basis—if knowing the label would
al field of sentiment analysis is highly En Vogue: The Ongoing Trends not change the model, there is no in-
related to the recognition of emotion Here, I outline a number of promis- terest in spending human-labeling ef-
from text, albeit traditionally rather ing avenues that have recently seen forts. An extension can be to decide on
dealing with written and often longer increasing interest by the community. how many and which humans to ask
passages of text.33 This field offers a Obviously, this selection can only rep- about a data point.
multiplicity of further approaches. A resent a subset, and many others exist. As mentioned earlier, emotion is
major difference is given by the uncer- Holistic speaker modeling. An im- often subjective and ambiguous. One
tainty one has to deal with in spoken portant aspect of increased robust- usually must acquire several opinions.
language—ideally, by incorporating ness is to consider other states and However, the machine can gradually
confidence measures or n-best alterna- traits that temporarily impact on the learn “whom to trust when” and start
tive hypotheses from the speech recog- voice production. In other words, one with the most reliable labeler, for ex-
nizer. Also, spoken language naturally is not only emotional, but also poten- ample, measured by the individual’s
differs from written text by lower em- tially tired, having a cold, is alcohol average agreement with the average
phasis on grammatical correctness, intoxicated, or, sounds differently be- labeler population. If the label deviates
cause being in a certain mood. Like- from what the machine expects, a next
wise, modern emotion recognition en- opinion can be crowdsourced—ide-
d http://liwc.wpengine.com gines should see the larger picture of a ally from the labeler who in such case
e http://sentic.net
f http://conceptnet.io
speaker’s states and traits beyond the would be most reliable. Putting these
g http://www.wjh.harvard.edu/ inquirer emotion of interest to best recognize two ideas—semi-supervised and active
h http://wordnet.princeton.edu it independent of such co-influencing learning —together, leads to the par-

94 COMM UNICATIO NS O F THE ACM | M AY 201 8 | VO L . 61 | NO. 5

 review articles

ticularly efficient cooperative learning using synthesis of emotional speech,

of machines with human help.24 In this or simply to enrich the model of neu-
approach, the machine decides based tral speech by using non-emotional
upon its confidence in its estimate synthesized speech.26 This can be ben-
whether it can label the data itself,
such as in case of high confidence. If An important eficial, as one can generate arbitrary
amounts of speech material at little ex-
it is not sufficiently confident, it evalu-
ates whether asking a human for aid
aspect of increased tra cost varying the phonetic content,
the speaker characteristics, and alike.
is worth it. The overall process can be robustness is to Ideally, one could even ad-hoc render
executed iteratively, that is, once newly
labeled data either by the machine or a
consider other a phonetically matched speech sam-
ple in different emotions to find the
human is obtained, the model can be states and traits closest match. A similar thought is fol-
retrained, which will mostly increase
its reliability and confidence. Then, the
that temporarily lowed by the recent use of generative
adversarial network topologies, where
data that had not been labeled in a pre- impact on voice a first neural network learns to synthe-
vious iteration might now be labeled
by the machine or considered as worth production. size training material, and another to
recognize real from synthesized mate-
labeling by a human. Monitoring im- rial and the task of interest.5 Obvious-
provements on test data is mandatory ly, transfer learning can bridge the gap
to avoid decreasing reliability. between artificial and real speech. In
If no initial data exists to start the future efforts, a closer and immediate
iterative loop of weakly supervised coupling between synthesis and analy-
learning, but similar related data is sis of emotional speech could help ren-
at hand, transfer learning may be an der this process more efficient.
option.11 To give an example, one may If no annotated data is available,
want to recognize the emotion of child and no emotional speech synthesizer
speakers, but has only adult emotional is at hand, unsupervised learning could
speech data at hand. In such case, the help if the knowledge of the emotion
features, the trained model, or even is not needed explicitly and in human-
the representation, and further aspects interpretable ways. An example is the
can be transferred by learning from the integration of information on emotion
data to the new domain. A broad num- in a spoken dialogue system: if features
ber of transfer learning and domain that bear information on the emotional
adaptation algorithms exists and have content are used during unsupervised
been applied in this field, such as in clustering of emotionally unlabeled
Abdelwahab and Busso.1 An interest- speech material, one may expect the
ing option of data enrichment can be clusters to represent information re-
to include other non-speech audio: as lated to emotion. The dialogue system
perception of certain emotional as- could then learn—best reinforced—
pects such as arousal or valence seem how to use the information on the cur-
to hold across audio types including rent cluster in a dialogue situation to
music and general sound, one can decide on its reaction based on obser-
seemingly train a speech emotion rec- vations of human-to-human dialogue.
ognizer even on music or sound, as Likewise, at no point would someone
long as it is labeled accordingly.40 know exactly what the clusters repre-
Obviously, transfer learning can sent beyond designing the initial fea-
help to make the types of signal more ture set for clustering to reflect, say,
reusable to train emotion recognition emotion; yet, the information could be
engines across these audio types. Even used. Should no speech data be avail-
image pretrained deep networks have able, rule-based approaches could be
recently been used to classify emotion used, which exploit the knowledge ex-
in speech based on spectral repre- isting in the literature. A basis will usu-
sentations at very impressive perfor- ally be a speaker normalization. Then,
mance by the auDeep toolkit.i Should one measures if the speech should,
collecting and/or labeling of speech for example, be faster, higher pitched,
data not be an option, also synthesized or louder to assume a joyful state. Yet,
speech can be considered for training given the oversimplification of a high-
of acoustic emotion models—either dimensional non-linear mapping
problem, such an approach would, un-
i https://github.com/auDeep/auDeep fortunately, have limits.

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF T HE ACM 95

review articles

Data-learned features. As the quest textual word handling, or speech com-

for the optimal features has dominated ponent audio words by executing non-
the field similarly as the ever-lacking negative matrix factorization or alike,
large and naturalistic databases, it and creating audio words from compo-
is not surprising that with increased
availability of the latter the first can The “neuro”- nents of audio.
The “neuro”-naissance or renais-
be targeted in a whole new way, that
is, learn features from data. This bears
naissance or sance of neural networks has not
stopped at revolutionizing auto-
the charm that features should be opti- renaissance of matic speech recognition. Since the
mally fitted to the data. Further, high-
er-level features could be learned. On
neural networks first publications on deep learning
for speech emotion recognition (in
the downside, one may wonder about has not stopped Wöllmer et al.,42 a long-short term
potentially decreased generalization
ability across databases. Below, two
at revolutionizing memory recurrent neural network
(LSTM RNN) is used, and in Stuhlsatz
currently popular ways of learning fea- automatic speech et al.35 a restricted Boltzman machines-
ture representations are introduced.
The idea to cluster chunks of au- recognition. based feed-forward deep net learns
features), several authors followed this
dio into words to then be able to treat idea to learn the feature representa-
these just like textual words during tion with a deep neural network, for
further feature extraction, for example, example, Cibau7 and Kim et al.19 Con-
by histogram representation as “bag of volutional neural networks (CNN) were
audio words” was first used in sound also successfully employed to learn
recognition, but has found its way into emotional feature representations.27
recognition of emotion in speech.31 The first end-to-end learning system
Interestingly, these form some kind for speech emotion recognition was
of modeling in between acoustic and recently presented by a sequence of
linguistic representation depending two CNN layers operating at differ-
on the low-level features that are used ent time resolutions: 5ms first, then
as basis.31 As an example, one may use 500ms followed by a LSTM RNN at
wavelet or cepstral coefficients and highly impressive performance.37,k In
cluster these to obtain the audio words future topologies, one may consider
and the vocabulary built up by all found stacking neural layers with different
audio words. An even simpler, yet of- purposes such as speech denoising,
ten similarly effective way is random feature extraction, feature enhance-
sampling k vectors as audio words, that ment, feature bundling, for example,
is, executing only the initialization of by use of a bottleneck layer, and clas-
k-means. Then, the actual feature could sification/regression with memory.33
be frequency of occurrence per audio Confidence measures. Given the
word in a larger time window such as a higher degree of subjectivity of the task
second, a turn, or alike, for example, by and imperfect recognition results, the
the openXBOW tool.j provision of confidence measures of an
Split-vector quantization allows you emotion estimate seems mandatory
to group the basis features to derive in any application context.17 However,
several histograms, for example, one the estimation of meaningful inde-
for prosodic features and one for spec- pendent confidence measures beyond
tral features. The construction of this direct measures coming from the
vocabulary is the actual data-injection machine-learning algorithm, for ex-
step during feature learning, as speech ample, distance to the hyperplane in
data will be needed to reasonably build kernel machines, softmax functions
it up. There exists a huge potential of at the output layer of neural networks,
unexploited, more elaborate forms of or alike, has hardly been researched
audio words, such as variable length in SER.17 Four main directions seem
audio-words by clustering with dynam- promising: 1) Automatic estimation of
ic time warping, soft-assignments of human labelers’ agreement on unseen
words during histogram calculation, data: instead of training the emotion
audio-word embeddings, audio-word as a target, one can train a classifier
retagging or hierarchical clustering, on the number of raters that agreed on
such as the part-of-speech tagging in
k A recent toolkit is found at https://github.com/
j https://github.com/openXBOW/openXBOW end2you/end2you.

96 COMM UNICATIO NS O F THE ACM | M AY 201 8 | VO L . 61 | NO. 5

 review articles

the label or, the standard deviation or the SER engine observed on that data. results as the data is likely to be highly
alike in case of a regression task. Then, In case of a regression task, the linear dissimilar. 4) Estimating acoustic deg-
by automatically estimating human error or other suited measures can be radation or word error rate. On a final
agreement on novel data, one obtains used as target. 3) Estimating the simi- note, reliable confidence measures are
an impression on the difficulty of the larity of the data to the training data can also the heart-piece of efficient weakly
current emotion prediction. In other be another option. A possible solution supervised learning.
words, one learns to estimate for new is training a compression autoencoder
data if humans would agree or likely (a neural network that maps the feature Coming Clean: The Benchmarks
disagree on its emotion. Ideally, this space input onto itself to learn for ex- But how reliable are SER engines? This
can be targeted as a multitask problem ample a compact representation of the can partially be answered looking at the
learning the emotion and human agree- data) on the data the emotion recogni- research challenges held in the field up
ment in parallel. 2) One can train a sec- tion was trained upon. Then, the new to now. While the first official competi-
ond learning algorithm to predict errors data to be handled can be run through tion event with properly defined train
of the emotion recognition engine. To the autoencoder. If the deviation be- and test sets and labels unknown to
this end, one needs to run the trained tween input and output of the autoen- the participants—the Interspeech 2009
emotion recognizer versus the develop- coder is high, for example, measured by Emotion Challengel—dates back nine
ment data to then train the confidence Euclidean distance, one can assume low
estimator on the errors or non-errors of confidence in the emotion recognition l http://compare.openaudio.eu.

Benchmark results of the SER challenge events.

Databases = the basis of data used in the competitions. Note that sometimes only subsets
have been used. Only challenges are listed that provided audio only results (thus excluding, for
example, AVEC 2014 and EmotiW since 2015). Some abbreviations here are obvious, others
include lng=language (by country code ISO 3166 ALPHA-2 where “–” indicates an artificial lan-
guage). hrs/spks/# = hours/speakers/number of data points. Task gives the number of classes
or the dimensions =(A)rousal, (V)alence, (P)ower, (E)xpectation. “·2”= a binary classification
per dimension. oS = openSMILE (feature extractor with standardized feature sets). EC = Inter-
speech Emotion Challenge. CRNN = CNN followed by a recurrent neural network with LSTM. RF
= Random Forests. SVM/R = Support Vector Machines/Regression. BoAW = Bag-of-Audio-Words.
UA = Unweighted Accuracy. WA = Weighted Accuracy. MAP = Macro Average Precision. PCC =
Pearson’s Correlation Coefficient. CCC = Concordance Correlation Coefficient. Baseline results
follow the order under each “task.”

Challenge Database lng Quality hrs/spks/# task unit # feat model baseline

EC 09 FAU AEC DE lab 9.1/51/18216 2/5 chunk 384 oS SVM .677/.382 UA

ComParE 13 GEMEP – lab ~.6/10/1260 AV·2/12 turn 6373 oS SVM .750/.616/.409 UA

AVEC 11 SEMAINE UK lab 3.7/24/50350 AVPE·2 word 1941 oS SVM .412/.558/.527/.592 WA

AVEC 12 SEMAINE UK lab 3.7/24/50350 AVPE word 1841 oS SVR .014/.040/.016/.038 PCC

AVEC 13 AViD DE lab 240/292/864k* AV sgmt 2268 oS SVR .090/.089 PCC

AVEC 15 RECOLA FR VoIP 2.3/27/202527 AV sgmt 102 oS SVR .228/.068 CCC

AVEC 16 RECOLA FR VoIP 2.3/27/202527 AV sgmt 88 oS SVR .648/.375 CCC

– CRNN .686/.261 CCC

BoAW SVR .753/.430 CCC

AVEC 17 SEWA DE VoIP 3/64/106896 AV sgmt BoAW SVR .225/.244 CCC

EmotiW 13 AFEW 3.0 US film ~.8/315/1088 7 clip 1582 oS SVM .2244 WA

EmotiW 14 AFEW 4.0 US film ~1.0/428/1368 7 clip 1582 oS SVM .2678 WA

MEC 16 CHEAVD CN film/TV 2.3/238/2852 8 clip 88 oS RF .2402 MAP/.2436 WA

MEC 17 CHEAVD 2.0 CN film/TV 7.9/527/7030 8 clip 88 oS SVM .392 MAP/.405 WA

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF T HE ACM 97

review articles

years by now, several further followed. novel affect tasks on atypical and self- question would be how these results
In 2011, the first AudioVisual Emo- assessed affect. relate to acceptable rates for human-
tion Challenge (AVEC 2011) took place, One would wish to compare these machine applications. Such numbers
which also featured a speech-only track. challenges in terms of technical or are unfortunately also largely missing
By now, seven annual AVEC challenges chronological improvements over the and would need to be provided by ap-
took placem—in 2015 physiological sig- years. However, as the table indicates, plication developers stemming from
nal information was added for the first the same database was used only once according usability studies. To provide
time. The Interspeech Computational in two challenges with the same task a statement non-the-less, the technol-
Paralinguistics challengE (Interspeech definition (AVEC 15/16). There, one ogy can already be used in a range of
ComParE) series revisited SER as task notices a striking improvement in applications as outlined above, and
in 2013. Meanwhile, challenges con- the baseline of this challenge in the seems to improve over time, reaching
sidering media-material such as clips more recent edition. It seems desir- closer to human performance.
of films appeared, namely the annual able to rerun former tasks more often
(since 2013) Emotion in the Wild Chal- for a better comparability across years Moonshot Challenges?
lenge (EmotiW14) run, and the new rather than having a mere provision of Seeing the ongoing trends in the field,
Multimodal Emotion Challenge (MEC snapshots. However, the table shows one may wonder what is left as high
2016 and MEC 2017n). A loser relation that the task attempted was becoming hanging fruit, grand challenge, or even
to emotion in speech is given in further increasingly challenging, going from a moonshot challenge. Certainly, sev-
challenges such as MediaEvalo (“affec- lab to voice over IP to material from eral further steps must be taken before
tive (2015) /emotional (2016) impact of films with potential audio overlay. SER can be considered ready for broad
movies” task). Further, one would want to see the consumer usage “in the wild.” These
The accompanying table presents an results of these events set into rela- include robustness across cultures
overview on the challenges and their re- tion with human emotion percep- and languages as one of the major
sults to date that focused on SER. Inter- tion benchmarks. Again, this is not white spots in the literature. A num-
estingly, all challenges used the same straightforward for the following rea- ber of studies show the downgrades
feature extractor for the baselines. For sons: the ground truth does not exist in one may expect when going cross-
comparison, the AVEC 2016 results a reliable way—the data was labeled by language in terms of acoustic emotion
for end-to-end learning37 and Bags-of- a small number of humans in the first recognition.3 As to cross-cultural stud-
Audio-Words31 are further given, which place. Comparing it to the perception ies, these are still particularly sparse,
are no official baselines. At press time, of other humans on the test data would and there exists practically no engine
the series MEC is rerun, and the series thus not be entirely fair, as they would that is adaptive to cultural differenc-
ComParE is calling for participation likely have a different perception from es at the time. Beyond cross-cultural
for their 2018 reinstantiations offering those who labeled the training and robustness, such against atypicality
test data. Further, there simply is no must be further investigated. For ex-
perception study available on these ample, a few studies deal with emotion
m http://sspnet.eu/avec201x, with x ∈[1–7]
n http://www.chineseldc.org/htdocsEn/
sets, indicating another white spot in portrayal of individuals on the autism
emotion.html the tradition of challenge culture in spectrum.30 Further, the assessment of
o http://multimediaeval.org the field. Perhaps the more important emotion of speaker groups has hardly
been targeted. In a first step, this re-
Figure 2. A modern speech emotion recognition engine. quires dealing with far-field acoustics,
but it also must ideally isolate speakers’
Ideally, this engine experiences life-long learning 24/7 to analyze and voices to analyze overlapping speech
synthesize emotion across languages and cultures. It gains feedback from in search of emotional cues to then
the crowd in cooperative, gamified, and reinforced ways learning end-to- come to a conclusion regarding
end and transferring gained knowledge. For a holistic understanding, it a groups’ emotion. A potentially
integrates contextual knowledge such as other speaker states and traits. more challenging task may then be
the recognition of irony or sarcasm as
well as regulation of emotion. Differ-
Human-
Speech
Computer
ences between the acoustic and the
Data linguistic channels may be indica-
Interface
tive, but the research up to this point
Speech is limited. Next, there is little work to
Model Emotion Mic/
be found on speaker long-term adap-
Engine Speaker
tation, albeit being highly promising.
A genuine moonshot challenge,
however, may be to target the actual
Knowledge emotion of an individual sensed by
Crowd
speech analysis. Up to this point, the
gold standard is to use other human
raters’ assessment, that is, ratings or

98 COM MUNICATIO NS O F TH E AC M | M AY 201 8 | VO L . 61 | NO. 5

 review articles

annotations, as an “outer emotion”, as an Union’s HORIZON 2020 Framework emotion recognition using an enhanced co-training
algorithm. In Proceedings ICME. (Beijing, P.R. China,
perceived by others, as learning target. Programme under the Grant Agree- 2007). IEEE, 999–1002.
Obviously, this can be highly different ment No. 645378. 26. Lotfian, R. and Busso, C. Emotion recognition using
synthetic speech as neutral reference. In Proceedings
from the “inner emotion” of an indi- of ICASSP. (Brisbane, Australia, 2015). IEEE,
vidual. To assess it, one will first need References
4759–4763.
27. Mao, Q., Dong, M., Huang, Z. and Zhan, Y. Learning
a ground truth measurement method, 1. Abdelwahab, M. and Busso, C. Supervised domain salient features for speech emotion recognition
adaptation for emotion recognition from speech. In using convolutional neural networks. IEEE Trans.
for example, by deeper insight into Proceedings of ICASSP. (Brisbane, Australia, 2015). Multimedia 16, 8 (2014), 2203–2213.
the cognitive processes as measured IEEE, 5058–5062. 28. Marsella, S. and Gratch, J. Computationally modeling
2. Anagnostopoulos, C.-N., Iliou, T. and Giannoukos, human emotion. Commun. ACM 57, 12 (Dec. 2014), 56–67.
by EEG or other suited means. Then, I. Features and classifiers for emotion recognition 29. Picard, R.W. and Picard, R. Affective Computing, vol.
one will also have to develop models from speech: a survey from 2000 to 2011. Artificial 252. MIT Press Cambridge, MA, 1997.
Intelligence Review 43, 2 (2015), 155–177. 30. Ram, C.S. and Ponnusamy, R. Assessment on speech
that are robust against differences 3. Bhaykar, M., Yadav, J. and Rao, K.S. Speaker emotion recognition for autism spectrum disorder
between expressed emotion and the dependent, speaker independent and cross language children using support vector machine. World Applied
emotion recognition from speech using GMM and Sciences J. 34, 1 (2016), 94–102.
experienced one—potentially by de- HMM. In Proceedings of the National Conference on 31. Schmitt, M., Ringeval, F. and Schuller, B. At the border
Communications. (Delhi, India, 2013). IEEE, 1–5.
riving further information from the 4. Blanton, S. The voice and the emotions. Q. Journal of
of acoustics and linguistics: Bag-of-audio-words for
the recognition of emotions in speech. In Proceedings
voice which is usually not accessible Speech 1, 2 (1915), 154–172. of INTERSPEECH. (San Francisco, CA, 2016). ISCA,
5. Chang, J. and Scherer, S. Learning Representations of
to humans such as the heart rate, skin Emotional Speech with Deep Convolutional Generative
495–499.
32. Schuller, B. and Batliner, A. Computational
conductance, current facial expres- Adversarial Networks. arxiv.org, (arXiv:1705.02394), Paralinguistics: Emotion, Affect and Personality in
2017.
sion, body posture, or eye contact, 32 6. Chen, L., Mao, X., Xue, Y. and Cheng, L.L. Speech
Speech and Language Processing. Wiley, 2013.
33. Schuller, B, Mousa, A. E.-D., and Vasileios, V. Sentiment
and many further bio-signals. emotion recognition: Features and classification analysis and opinion mining: On optimal parameters
models. Digital Signal Processing 22, 6 (2012),
Obviously, one can think of many 1154–1160.
and performances. WIREs Data Mining and
Knowledge Discovery (2015), 5:255–5:263.
further interesting challenges such 7. Cibau, N.E., Albornoz. E.M., and Rufiner, H.L. Speech 34. Soskin, W.F. and Kauffman, P.E. Judgment of emotion in
emotion recognition using a deep autoencoder. San word-free voice samples. J. of Commun. 11, 2 (1961), 73–80.
as emotion recognition “from a chips Carlos de Bariloche, Argentina, 2013, 934–939. 35. Stuhlsatz, A., Meyer, C., Eyben, F., Zielke, T., Meier, G.
bag” by high-speed camera capture of 8. Darwin, C. The Expression of Emotion in Man and and Schuller, B. Deep neural networks for acoustic
Animals. Watts, 1948. emotion recognition: Raising the benchmarks. In
the vibrations induced by the acoustic 9. Davis, A., Rubinstein, M., Wadhwa, N., Mysore, G. J., Proceedings of ICASSP. (Prague, Czech Republic,
waves,9 in space, under water, and, of Durand, F. and Freeman, W.T. The visual microphone: 2011). IEEE,5688–5691.
Passive recovery of sound from video. ACM Trans. 36. Tosa, N. and Nakatsu, R. Life-like communication
course, in animal vocalizations. Graphics 33, 4 (2014), 1–10. agent-emotion sensing character ‘MIC’ and feeling
10. Dellaert, F., Polzin, T. and Waibel, A. Recognizing session character ‘MUSE.’ In Proceedings of the 3rd
emotion in speech. In Proceedings of ICSLP 3, International Conference on Multimedia Computing
Conclusion (Philadelphia, PA, 1996). IEEE, 1970–1973. and Systems. (Hiroshima, Japan, 1996). IEEE, 12–19.
11. Deng, J. Feature Transfer Learning for Speech
In this article, I elaborated on making Emotion Recognition. PhD thesis, Dissertation,
37. Trigeorgis, G., Ringeval, F., Brückner, R., Marchi, E.,
Nicolaou, M., Schuller, B. and Zafeiriou, S. Adieu
machines hear our emotions from Technische Universität München, Germany, 2016. features? End-to-end speech emotion recognition
12. Deng, J., Xu, X., Zhang, Z., Frühholz, S., and Schuller,
end to end—from the early studies on B. Semisupervised Autoencoders for Speech Emotion
using a deep convolutional recurrent network. In
Proceedings of ICASSP. (Shanghai, P.R. China, 2016).
acoustic correlates of emotion8,16,21,34 Recognition. IEEE/ACM Transactions on Audio, IEEE, 5200–5204.
Speech, and Language Processing 26, 1 (2018), 31–43.
to the first patent41 in 1978, the first 13. Devillers, L., Vidrascu, L. and Lamel, L. Challenges
38. Ververidis, D. and Kotropoulos, C. Emotional speech
recognition: Resources, features, and methods. Speech
seminal paper in the field,10 to the first in real-life emotion annotation and machine learning Commun. 48, 9 (2006), 1162–1181.
based detection. Neural Networks 18, 4 (2005),
end-to-end learning system.37 We are 407–422.
39. Watson, D., Clark, L.A., and Tellegen, A. Development
and validation of brief measures of positive and
still learning. Based on this evolution, 14. Dhall, A., Goecke, R., Joshi, J., Sikka, K. and Gedeon, negative affect: the PANAS scales. J. of Personality
T. Emotion recognition in the wild challenge 2014: and Social Psychology 54, 6 (1988), 1063.
an abstracted summary is shown in Baseline, data and protocol. In Proceedings of ICMI 40. Weninger, F., Eyben, F., Schuller, B.W., Mortillaro, M.,
Figure 2 presenting the main features (Istanbul, Turkey, 2014). ACM, 461–466. and Scherer, K.R. On the acoustics of emotion in audio:
15. El Ayadi, M., Kamel, M.S., and Karray, F. Survey on What speech, music and sound have in common.
of a modern engine. Hopefully, cur- speech emotion recognition: Features, classification Frontiers in Psychology 4, Article ID 292 (2013), 1–12.
rent dead-ends, such as the lack of rich schemes, and databases. Pattern Recognition 44, 3 41. Williamson, J. Speech analyzer for analyzing pitch or
(2011), 572–587. frequency perturbations in individual speech pattern
amounts of spontaneous data that al- 16. Fairbanks, G. and Pronovost, W. Vocal pitch during to determine the emotional state of the person. U.S.
low for coping with speaker variation, simulated emotion. Science 88, 2286 (1938), 382–383. Patent 4,093,821, 1978.
17. Gunes, H. and Schuller, B. Categorical and 42. Wöllmer, M., Eyben, F., Reiter, S., Schuller, B., Cox, C.,
can be overcome. After more than 20 dimensional affect analysis in continuous input: Douglas-Cowie, E. and Cowie, R. Abandoning emotion
Current trends and future directions. Image and
years into automatic recognition of Vision Computing 31, 2 (2013), 120–136.
classes—Towards continuous emotion recognition
with modeling of long-range dependencies. In
emotion in the speech signal, we are 18. Joachims, T. Learning to classify text using support Proceedings of INTERSPEECH. (Brisbane, Australia,
vector machines: Methods, theory and algorithms.
currently witnessing exciting times of Kluwer Academic Publishers, 2002.
2008). ISCA, 597–600.
43. Zeng, Z., Pantic, M., Roisman, G.I., and Huang, T.S. A
change: data learned features, synthe- 19. Kim, Y., Lee, H. and Provost, E.M. Deep learning for survey of affect recognition methods: Audio, visual,
robust feature generation in audiovisual emotion
sized training material, holistic archi- recognition. In Proceedings of ICASSP, (Vancouver,
and spontaneous expressions. IEEE Trans. Pattern
Analysis and Machine Intelligence 31, 1 (2009), 39–58.
tectures, and learning in an increas- Canada, 2013). IEEE, 3687–3691.
20. Koolagudi, S.G. and Rao, K.S. Emotion recognition
ingly autonomous way—all of which from speech: A review. Intern. J. of Speech Björn W. Schuller (schuller@tum.de) is a professor
can be expected to soon lead to the Technology 15, 2 (2012), 99–117. and head of the ZD.B Chair of Embedded Intelligence
21. Kramer, E. Elimination of verbal cues in judgments for Health Care and Wellbeing at the the University of
rise of broad day-to-day usage in many of emotion from voice. The J. Abnormal and Social Augsburg, Germany.
health, retrieval, security, and further Psychology 68, 4 (1964), 390.
22. Kraus, M.W. Voice-only communication enhances
beneficial use-cases alongside—after empathic accuracy. American Psychologist 72, 7 © 2018 ACM 0001-0782/18/5 $15.00
years of waiting36—the advent of emo- (2017), 644.
23. Lee, C.M., Narayanan, S.S., and Pieraccini, R.
tionally intelligent speech interfaces. Combining acoustic and language information
for emotion recognition. In Proceedings of
INTERSPEECH, (Denver, CO, 2002). ISCA, 873–876. Watch the author discuss
Acknowledgments 24. Leng, Y., Xu, X., and Qi, G. Combining active learning and his work in this exclusive
semi-supervised learning to construct SVM classifier. Communications video.
The research leading to these results Knowledge-Based Systems 44 (2013), 121–131. https://cacm.acm.org/videos/
has received funding from the Europe- 25. Liu, J., Chen, C., Bu, J., You, M. and Tao, J. Speech speech-emotion-recognition

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF T HE ACM 99

Check out the new acmqueue app
FREE TO ACM MEMBERS
acmqueue is ACM’s magazine by and for practitioners,
bridging the gap between academics and practitioners
of computer science. After more than a decade of
providing unique perspectives on how current and
emerging technologies are being applied in the field,
the new acmqueue has evolved into an interactive,
socially networked, electronic magazine.

Broaden your knowledge with technical articles

focusing on today’s problems affecting CS in
practice, video interviews, roundtables, case studies,
and lively columns.

Keep up with this fast-paced world

on the go. Download the mobile app.

Desktop digital edition also available at queue.acm.org.

Bimonthly issues free to ACM Professional Members.
Annual subscription $19.99 for nonmembers.
 research highlights
P. 102 P. 103
Technical Never-Ending Learning
Perspective By T. Mitchell, W. Cohen, E. Hruschka, P. Talukdar, B. Yang,
Breaking the Mold J. Betteridge, A. Carlson, B. Dalvi, M. Gardner, B. Kisiel,
of Machine Learning J. Krishnamurthy, N. Lao, K. Mazaitis, T. Mohamed, N. Nakashole,
E. Platanios, A. Ritter, M. Samadi, B. Settles, R. Wang, D. Wijaya,
By Oren Etzioni
A. Gupta, X. Chen, A. Saparov, M. Greaves, and J. Welling

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF T H E ACM 101

research highlights
DOI:10.1145/ 3 1 9 1 5 1 1

Technical Perspective
To view the accompanying paper,
visit doi.acm.org/10.1145/3191513 rh

Breaking the Mold

of Machine Learning
By Oren Etzioni

THE FIELD OF ARTIFICIAL INTELLIGENCE 4. More broadly, what is NELL un-

is rife with misnomers and ma- able to learn, and what AI architec-
(AI)
chine learning (ML) is a big one. ML The following ture is necessary to go beyond these
is a vibrant and successful subfield, paper describes limitations?
but the bulk of it is simply “function The paper articulates both the key
approximation based on a sample.” the NELL system, abstractions underlying NELL and its
For example, the learning portion which aims limitations, which suggest avenues for
of AlphaGo—which defeated the hu- future work in its concluding discus-
man world champion in the game of to learn to identify sion section.
GO—is in essence a method for ap- instances of concepts In a world that has become ob-
proximating a non-linear function sessed with the latest deep neural net-
from board position to move choice, in Web text. work mechanism, and its performance
based on tens of millions of board on one benchmark or another, NELL
positions labeled by the appropriate is an important reminder of the power
move in that position.a As pointed out another style of research: exploratory
in my Wired article,4 function approx- research that seeks create new para-
imation is only a small component of digms and substantially broaden the
a capability that would rival human 1. The system has been running capabilities and the sophistication of
learning, and might be rightfully at CMU for over five years, and its machine learning systems.
called machine learning. knowledge base is available online
Tom Mitchell and his collaborators for inspection and download here: References
1. Banko, M., Cafarella, M.J., Soderland, S., Broadhead,
have been investigating how to broad- http://rtw.ml.cmu.edu/rtw/ M. and Etzioni, O. Open information extraction from the
en the ML field for over 20 years under 2. The work is also an instance of Web. IJCAI, 2007.
2. Caruana, R. Multitask learning: A knowledge-based
headings such as multitask learning,2 ‘Reading the Web,’ a paradigm that of source of inductive bias. In Proceedings of the 10th
International Conference on Machine Learning. (San
life-long learning,7 and more. The fol- was inspired by Mitchell’s WebKB Mateo, CA, USA, 1993). Morgan Kaufmann, 41–48.
lowing paper, “Never-ending Learn- project.3 The paradigm led to the 3. Craven, M. DePasquo, D., Freitag, D., McCallum, A.,
Mitchell, T.M., Nigam, K. and Slattery, S. Learning to
ing,” is the latest and one of the most KnowItAll system,5 Open Information extract symbolic knowledge from the World Wide
compelling incarnations of this re- Extraction,1 and much more. Web. In Proceedings of the AAAI/IAAI, 1998.
4. Etzioni, O. Deep learning isn’t a dangerous magic genie.
search agenda. The paper describes 3. The paper both places the work in It’s just math. Wired (June 15, 2016); https://www.
the NELL system, which aims to learn context (“Learning in NELL as an ap- wired.com/2016/06/deep-learning-isnt-dangerous-
magic-genie-just-math/.
to identify instances of concepts (for proximation to EM”) and identifies key 5. Etzioni, O., Cafarella, M.J., Downey, D. Popescu, A-M,
example, city or sports team) in Web lessons from the effort (“To achieve Shaked, T. Soderland, S., Weld, D.S. and Yates, A.
Unsupervised named-entity extraction from the Web:
text. It takes as input more than 500M successful semi-supervised learning, An experimental study (2005); http://bit.ly/2F5MZlf
sentences drawn from Web pages, an couple the training of many different 6. Gibley, E. Google AI algorithm masters ancient game
of Go. Nature (Jan. 27, 2016); http://www.nature.com/
initial hierarchy of interrelated con- learning tasks.”). news/google-ai-algorithm-masters-ancient-game-of-
cepts, and small number of examples As is often the case with outstand- go-1.19234.
7. Thrun, S. and Mitchell, T.M. Learning one more thing.
of each concept. Based on this infor- ing research, the work raises many IJCAI, 1995.
mation, and the relationships be- open questions including:
tween the concepts, it is able to learn 1. Could one, with the benefit of Oren Etzioni is Chief Executive Officer of the Allen
Institute for Artificial Intelligence, Seattle, and professor
to identify millions of concept in- hindsight, reimplement NELL in a of computer science at the University of Washington,
stances with high accuracy. Over time, radically more efficient fashion where Seattle, WA, USA.
NELL has also begun to identify rela- iterations of the learning process take
tionships between concept classes, mere seconds?
and extend its input concept set. 2. What is the end-state of NELL’s
The NELL project is important and learning process?
unique for a number of additional 3. While NELL taught us a lot about
reasons: continuously running semi-supervised
learning systems, it is still unable to per-
a Of course, this is an oversimplification but it
form increasingly challenging learning
suffices for our purposes here. See AlphaGo in tasks over time. What are the next steps
Nature6 for an in-depth presentation. in the life-long learning paradigm? Copyright held by author.

102 COMM UNICATIO NS O F T H E ACM | M AY 201 8 | VO L . 61 | NO. 5

 DOI:10.1145 / 3 1 9 1 5 1 3

Never-Ending Learning
By T. Mitchell, W. Cohen, E. Hruschka, P. Talukdar, B. Yang, J. Betteridge, A. Carlson, B. Dalvi, M. Gardner, B. Kisiel,
J. Krishnamurthy, N. Lao, K. Mazaitis, T. Mohamed, N. Nakashole, E. Platanios, A. Ritter, M. Samadi, B. Settles, R. Wang,
D. Wijaya, A. Gupta, X. Chen, A. Saparov, M. Greaves, and J. Welling

Abstract (e.g., the spam filter) given a training set of input/output

Whereas people learn many different types of knowledge pairs {〈xi, yi〉} of that function. Other machine learning
from diverse experiences over many years, and become paradigms exist as well (e.g., unsupervised clustering, topic
­better learners over time, most current machine learning modeling, reinforcement learning) but these paradigms
systems are much more narrow, learning just a single func- also typically acquire only a single function or data model
tion or data model based on statistical analysis of a single from a single dataset.
data set. We suggest that people learn better than comput- In contrast to these paradigms for learning single func-
ers precisely because of this difference, and we suggest a tions from well organized data sets over short time-frames,
key direction for machine learning research is to develop humans learn many different functions (i.e., different
software architectures that enable intelligent agents to also types of knowledge) over years of accumulated diverse
learn many types of knowledge, continuously over many experience, using extensive background knowledge
years, and to become better learners over time. In this learned from earlier experiences to guide subsequent
paper we define more precisely this never-ending learning learning. For example, humans first learn to crawl, then
paradigm for machine learning, and we present one case to walk, run, and perhaps ride a bike. They also learn to
study: the Never-Ending Language Learner (NELL), which recognize objects, to predict their motions in different cir-
achieves a number of the desired properties of a never-end- cumstances, and to control those motions. Importantly,
ing learner. NELL has been learning to read the Web 24hrs/ they learn cumulatively: as they learn one thing this new
day since January 2010, and so far has acquired a knowledge knowledge helps them to more effectively learn the next,
base with 120mn diverse, confidence-weighted beliefs (e.g., and if they revise their beliefs about the first then this
servedWith(tea,biscuits)), while learning thousands of change refines the second.
interrelated functions that continually improve its reading The thesis of our research is that we will never truly under-
competence over time. NELL has also learned to reason over stand machine or human learning until we can build computer
its knowledge base to infer new beliefs it has not yet read programs that, like people,
from those it has, and NELL is inventing new relational pred-
icates to extend the ontology it uses to represent beliefs. We • learn many different types of knowledge or functions,
describe the design of NELL, experimental results illustrat- • from years of diverse, mostly self-supervised experience,
ing its behavior, and discuss both its successes and short- • in a staged curricular fashion, where previously learned
comings as a case study in never-ending learning. NELL can knowledge enables learning further types of knowledge,
be tracked online at http://rtw.ml.cmu.edu, and followed on •  where self-reflection and the ability to formulate new
Twitter at @CMUNELL. representations and new learning tasks enable the
learner to avoid stagnation and performance plateaus.

1. INTRODUCTION We refer to this learning paradigm as “never-ending

Machine learning is a highly successful branch of artificial learning.” The contributions of this paper are to (1) define
intelligence (AI), and is now widely used for tasks from spam more precisely the never-ending learning paradigm,
filtering, to speech recognition, to credit card fraud detec- (2) present as a case study a computer program called
tion, to face recognition. Despite these successes, the ways the NELL which implements several of these capabili-
in which computers learn today remain surprisingly narrow ties, and which has been learning to read the Web 24hrs/
when compared to human learning. This paper explores an day since January 2010, and (3) identify from NELL’s
alternative paradigm for machine learning that more closely strengths and weaknesses a number of key design fea-
models the diversity, competence and cumulative nature of tures important to any never-ending learning system. This
human learning. We call this alternative paradigm never- paper is an elaboration and extension to an earlier over-
ending learning. view of the NELL system.27
To illustrate, note that in each of the above machine
learning applications, the computer learns only a single 2. RELATED WORK
function to perform a single task in isolation, usually from Previous research has considered the problem of design-
human labeled training examples of inputs and outputs ing machine learning agents that persist over long periods
of that function. In spam filtering, for instance, training
examples consist of specific emails and spam or not-spam
The original version of this paper appeared in the
labels for each. This style of learning is often called super-
Proceedings of the 29th AAAI Conference on Artificial
vised function approximation, because the abstract learning
Intelligence (Austin, TX, Jan. 25–30, 2015), 2302–2310.
problem is to approximate some unknown function f : X → Y

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF T H E ACM 103

research highlights

of time (e.g., life long learning38), and that learn to learn39 3. NEVER-ENDING LEARNING
by various methods, including using previously learned Informally, we define a never-ending learning agent to be a
knowledge from earlier tasks to improve learning of subse- system that, like humans, learns many types of knowledge,
quent tasks.11 Still, there remain few if any working systems from years of diverse and primarily self-supervised experi-
that demonstrate this style of learning in practice. General ence, using previously learned knowledge to improve sub-
architectures for problem solving and learning (e.g., SOAR sequent learning, with sufficient self-reflection to avoid
Laird et al.21, ICARUS Langley et al.22, PRODIGY Donmez plateaus in performance as it learns. The never-ending
and Carbonell15, and THEO Mitchell et al.26) have been learning problem faced by the agent consists of a collection of
applied to problems from many domains, but again none of learning tasks, and constraints that couple their solutions.
these programs has been allowed to learn continuously for To be precise, we define a never-ending learning problem
any sustained period of time. Lenat’s work on Automated to be an ordered pair consisting of: (1) a set L = {Li} of
Mathematician (AM) and Eurisko24 represents an attempt learning tasks, where the ith learning task Li = 〈Ti, Pi, Ei〉 is
to build a system that invents concepts, then uses these as to improve the agent’s performance, as measured by per-
primitives for inventing more complex concepts, but again formance metric Pi, on a given performance task Ti, through
this system was never allowed to run for a sustained period, a given type of experience Ei; and (2) a set of coupling con-
because the author determined it would quickly reach a pla- straints C = {〈φk, Vk〉} among the solutions to these learning
teau in its performance. tasks, where φk is a real-valued function over two or more
Beyond such work on integrated agent architectures, learning tasks, specifying the degree of satisfaction of the
there has also been much research on individual subprob- constraint, and Vk is a vector of indices over learning tasks,
lems crucial to never-ending learning. For example, work on specifying the arguments to φk.
multitask transfer learning10 suggests mechanisms by which
learning of one type of knowledge can guide learning of = (L, C) (1)
another type. Work on active and proactive learning15, 40 and where, L = {〈Ti, Pi, Ei〉}
on exploitation/exploration trade-offs5 presents strategies by
which learning agents can collect optimal training data from C = {〈φk, Vk〉}
their environment. Work on learning of latent representa-
tions2, 29 provides methods that might enable never-ending Above, each performance task Ti is a pair Ti ≡ 〈Xi, Yi〉 defining
learners to expand their internal knowledge representations the domain and range of a function to be learned .
over time, thereby avoiding plateaus in performance due to The performance metric Pi : f → R defines the optimal
lack of adequate representations. Work on curriculum learn- learned function for the ith learning task:
ing3 explores potential synergies across sets or sequences
of learning tasks. Theoretical characterizations of cotrain-
ing4 and other multitask learning methods1, 32 have provided
insights into when and how the sample complexity of learn- where Fi is the set of all possible functions from Xi to Yi.
ing problems can be improved via multitask learning. Given such a learning problem containing n learning tasks,
There is also related work on constructing large knowl- a never-ending learning agent outputs a sequence of solu-
edge bases on the Web—the application that drives our NELL tions to these learning tasks. As time passes, the quality of
case study. The WebKB project,13 Etzioni’s early17 and more these n learned functions should improve, as measured by
recent18 work on machine reading the Web, and the YAGO37 the individual performance metrics P1 . . . Pn and the degree
project all represent attempts to construct a knowledge base to which the coupling constraints C are satisfied.
using Web resources, as do commercial knowledge graph To illustrate, consider a mobile robot with sensor inputs
projects at Google, Yahoo!, Microsoft, Bloomberg, and other S and available actions A. One performance task, 〈S, A〉,
companies. However, unlike NELL, none of these efforts has might be for the robot to choose actions to perform from any
attempted a sustained never ending learning approach to given state, and the corresponding learning task 〈〈S, A〉, P1, E1〉
this problem. might be to learn the specific function f1 : S → A that leads
Despite this relevant previous research, we remain in the most quickly to a goal state defined by performance metric
very early stages in studying never-ending learning methods. P1, from training experience E1 obtained via human teleoper-
We have almost no working systems to point to, and little ation. A second performance task for the same robot may be
understanding of how to architect a computer system that to predict the outcome of any given action in any given state:
successfully learns over a prolonged period of time, while 〈S × A, S〉. Here, the learning task 〈〈S × A, S〉, P2, E2〉 might be
avoiding plateaus in learning due to saturation of learned to learn this prediction function f2 : S × A → S with high accu-
knowledge. The key contributions of this paper are first, to racy as specified by performance metric P2, from experience
present a working case study system, an extended version E2 consisting of the robot wandering autonomously through
of an early prototype reported in Carlson et al.8, which suc- its environment.
cessfully integrates a number of key competencies; second, Note these two robot learning tasks can be coupled by
an empirical evaluation of the prototype’s performance over enforcing the constraint that the learned function f1 must
time; and third, an analysis of the prototype’s key design fea- choose actions that do indeed lead optimally to the goal
tures and shortcomings, relative to the goal of understand- state according to the predictions of learned function f2.
ing never-ending learning. By defining this coupling constraint φ(L1, L2) between the

104 COMM UNICATIO NS O F T H E ACM | M AY 201 8 | VO L . 61 | NO. 5

solutions to these two learning tasks, we give the learning retraining itself to improve its competence. The result so far
agent a chance to improve its ability to learn one function by is a Knowledge Base (KB) with approximately 120mn inter-
success in learning the other. connected beliefs (Figure 1), along with millions of learned
We are interested in never-ending Learning agents that phrasings, morphological features, and Web page structures
address such never-ending learning problems = (L, C), NELL now uses to extract beliefs from the Web. NELL is also
especially in which the learning agent now learning to reason over its extracted knowledge to infer
new beliefs it has not yet read, and it is now able to propose
• learns many different types of inter-related knowledge; extensions to its initial manually-provided ontology.
that is, L contains many learning tasks, coupled by
many cross-task constraints, 5. NELL’S NEVER-ENDING LEARNING PROBLEM
• from years of diverse, primarily self-supervised experi- Above we described the input-output specification of the
ence; that is, the experiences {Ei} on which learning is NELL system. Here we describe NELL’s never-ending learn-
based are realistically diverse, and largely provided by ing problem 〈L, C〉 in terms of the general formalism intro-
the system itself, duced in Section 2, first describing NELL’s learning tasks
• in a staged, curricular fashion where previously learned L, then its coupling constraints C. The subsequent section
knowledge supports learning subsequent knowledge; that describes NELL’s approach to this never-ending learning
is, the different learning tasks {Li} need not be solved problem, including NELL’s mechanisms for adding its own
simultaneously—solving one helps solve the next, and new learning tasks and coupling constraints.
• where self-reflection and the ability to formulate new rep-
resentations, new learning tasks, and new coupling con- 5.1. NELL’s Learning Tasks
straints enables the learner to avoid becoming stuck in Following the notation in Equation (1), each of NELL’s
performance plateaus; that is, where the learner may learning tasks consists of a performance task, perfor-
itself add new learning tasks and new coupling con- mance metric, and type of experience 〈Ti, Pi, Ei〉. NELL faces
straints that help it address the given learning problem . over 4100 distinct learning tasks, corresponding to distinct
functions fi : Xi → Yi it is trying to learn for its distinct per-
4. CASE STUDY: NEVER-ENDING LANGUAGE LEARNER formance tasks Ti = 〈Xi, Yi〉. These tasks fall into several
The Never-Ending Language Learner (NELL), an early pro- broad groups:
totype of which was reported in Carlson et al.8, is a learning Category Classification: Functions that classify noun
agent whose task is to learn to read the Web. The input-output phrases by semantic category (e.g., a Boolean valued func-
specification of NELL’s never-ending learning problem is: tion that classifies whether any given noun phrase refers to
a food). NELL learns different Boolean functions for each
Given: of the 293 categories in its ontology, allowing noun phrases
to refer to entities in multiple semantic categories (e.g.,
• an initial ontology defining hundreds of categories (e.g., “apple” can refer to a “Food” as well as a “Company”). For
Sport, Athlete) and binary relations that hold between each category Yi NELL learns at least five, and in some cases
members of these categories (e.g., AthletePlaysSport(x,y) ), six distinct functions that predict Yi, based on five different
• approximately a dozen labeled training examples for views of the noun phrase (different Xi’s), which are:
each category and each relation (e.g., examples of Sport
might include the noun phrases “baseball” and
“soccer”),
Figure 1. Fragment of the 120mn beliefs NELL has read from the
• the Web : an initial 500mn Web pages from the ClueWeb Web. Each edge represents a belief triple (e.g., play(MapleLeafs,
2009 collection,7 augmented in 2017 by the addition of hockey), with an associated confidence and provenance not shown
the ClueWeb 2012 collection6 to form a collection of here. This figure contains only correct beliefs from NELL’s KB—it has
1.233bn Web pages. In addition, Google has granted many incorrect beliefs as well since NELL is still learning.
NELL access to 100,000 Google Application Program
NELL knowledge fragment football
Interface (API) search queries each day. uses
equipment climbing
•  occasional interaction with humans (e.g., through Canada
skates helmet
Sunnybrook
NELL’s public Website http://rtw.ml.cmu.edu); Miller uses
equipment city
country hospital Wilson
company
politician CFRB hockey Detroit GM

Do: Run 24hrs/day, forever, and each day: Pearson

Toronto
radio

hired play hometown

airport competes
home town with
• read (extract) more beliefs from the Web, and remove city Maple Leafs
Stanley
Cup won Red
company city won
old incorrect beliefs, to populate a growing knowledge stadium team
Wings
Toyota

base containing a confidence and provenance for Connaught city

stadium league league
acquired
city paper
each belief, stadium
Air Canada
Centre
member NHL
Hino created
plays in
•  learn to read better than the previous day. Globe and Mail
economic
sector
Sundin Prius
writer automobile
Skydome Toskala
NELL has been running non-stop since January 2010, Milson Corrola

each day extracting more beliefs from the Web, then

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF T H E ACM 105

research highlights

• Character string features of the noun phrase (e.g., whether training example . Positive examples are high
the noun phrase ends with the character string “… confidence beliefs in NELL’s knowledge base, and
burgh”). This is performed by the Coupled Morphological negative examples are constructed by changing the
Classifier (CMC) system,8 which represents the noun value of Y to form a belief triple which is not in NELL’s
phrase by a vector with thousands of string features. knowledge base.
• The distribution of text contexts found around this noun
phrase in 1.233bn English Web pages from the
ClueWeb2009 and ClueWeb2012 text corpus (e.g., how Learned Embeddings obtains an top-1 accuracy of 0.88
frequently the noun phrase N occurs in the context when classifying new noun phrases into NELL’s 293
“mayor of N”). This is performed by the Coupled Pattern categories. Figure 2 shows a visualization of the learned
Learner (CPL) system.9 embeddings using t-SNE.25 In general, the learned
• The distribution of text contexts found around this noun embeddings nicely reflect the semantics of the noun
phrase through active Web search. This is performed by phrases and categories. Figure 2a displays the embed-
the OpenEval system,36 which uses somewhat different dings of 280 categories in NELL. We can see that seman-
context features from the above CPL system, and uses tically similar categories tend to be close to each other.
real time Web search to collect this information. For example, there is a cluster about body parts (on the
• Hypertext Markup Language (HTML) structure of Web top) and a cluster about room items (in the bottom).
pages that mention the noun phrase (e.g., whether the Figure 2b further shows three specific room-item cat-
noun phrase is mentioned inside an HTML list, along- egories and the noun phrases surrounding them. We
side other known cities). This is performed by the Set can see that items belonging to kitchens, bedrooms,
Expander for Any Language (SEAL) system.41 and bathrooms are generally well separated. We also
• Visual images associated with this noun phrase, when find that items that can belong to multiple categories
the noun phrase is given to an image search engine. tend to locate on the boundaries. For example, “brush”
This is performed by the Never Ending Image Learner and “shoe” could be both a bedroom item and a bath-
(NEIL) system,12 and applies only to a subset of NELL’s room item.
ontology categories (e.g., not to non-visual categories
such as MusicGenre). • Relation Classification: These functions classify pairs
•  Learned vector embeddings of the noun phrases. This is of noun phrases by whether or not they satisfy a given
performed by the Learned Embeddings (LE) module relation (e.g., classifying whether the pair
which has not been previously described, so we sum- 〈“Pittsburgh,” “U.S.”〉 satisfies the relation “CityLocated-
marize the approach in some detail here. LE44 learns a InCountry(x,y)”). NELL learns distinct boolean-valued
vector embedding for each noun phrase associated classification functions for each of the 461 relations
with each NELL entity, a vector embedding for each of in its ontology. For each relation, NELL learns four
the 293 categories in NELL’s ontology, and a matrix distinct classification functions based on different
embedding to represent the Generalizations relation feature views of the input noun phrase pair.
that relates each NELL entity to the general categories Specifically, it uses the two classification methods
to which it belongs. We employ a neural network archi- CPL and OpenEval based on the distribution of text
tecture to learn these vector and matrix embeddings, contexts found between the two noun phrases on
training them on each NELL iteration to maximize Web pages, and it uses the SEAL classification method
their fit to the beliefs in NELL’s current knowledge based on HTML structure of Web pages. These meth-
base. Note this knowledge base is updated on each ods are described above in the list of Category
NELL iteration in response to the combined results of Classification methods. NELL furthermore uses the
all of NELL’s reading and inference modules. LE module described above to learn to predict rela-
Specifically, LE quantifies its confidence in the asser- tion instances from learned vector embeddings of
tion that Generali­zation(X, Y) using the scoring func- noun phrases and learned matrix embeddings for
tion: , where vX and vY are relations. Above we described the algorithm used by
i i
d-dimensional vectors representing noun phrase Xi LE to learn vector embeddings for NELL entities and
and NELL category Yi respectively, and where M is a d × for NELL categories, and to learn a matrix embedding
d matrix representing the Generalization relation. The for the 〈x1, Generalization, x2〉 relation. The same
vector embedding vX is constructed by first averaging algorithm is used to learn a matrix embedding Mr
i
the vectors of the words in the noun phrase, then con- for each NELL relation r. As in the case of the
catenating to this vector the word vector of its head Generalization relation, LE then assigns a confidence
noun. These vectors are initialized with pre-trained score S(〈x1, r, x2〉) to each possible relation triple
vectors for each word, obtained from Wieting et al.42 according to the formula ,
These word vectors are then fine tuned during train- where vx1 and vx2 represent the learned vector embed-
ing, and used to produce the noun phrase vectors as dings for x1 and x2, and where Mr is the learned matrix
described above. During training, LE minimizes a embedding for relation r. In general we find LE’s infer-
ranking loss for each ences about relations other than Generalization are
positive training example 〈Xi, Yi〉, paired with a negative less accurate than for the Generalization relation.

106 COM MUNICATIO NS O F TH E ACM | M AY 201 8 | VO L . 61 | NO. 5

Figure 2. t-SNE visualization of the embeddings learned by LE.

celltype
lymphnode
artery vein
muscle bodypart bone
nerve braintissue

bedroomitem
wallitem flooritem
hallwayitem furniture
buildingfeature
householditem
bathroomitem
tableitem kitchenitem

(a) Embeddings of the semantic categories.

Noun phrases

concept:bedroomitem

Semantic categories
concept:bathroomitem
concept:kitchenitem

(b) Embeddings of the noun phrases and semantic categories.

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF T H E ACM 107

research highlights

This may be due in part to the smaller number of visual images, which is handled by the NEIL system with
training examples for these relations, and may in part its own training procedures.
be due to the greater suitability for our approach to
semantic category assignment (i.e., predicting the 5.2. NELL’s Coupling Constraints
Generalization) compared to predicting other rela- The second component of NELL’s never-ending learning
tions such as PersonFoundedCompany(). task is the set of coupling constraints which link its learning
• Entity Resolution: Functions that classify whether tasks. NELL’s coupling constraints fall into five groups. We
pairs of noun phrases are synonyms. NELL’s knowl- describe them below as hard logical constraints. However,
edge base represents noun phrases as distinct from NELL uses these primarily as soft constraints that can be vio-
the entities to which they can refer. This is essential lated at some penalty cost.
because polysemous words can refer to multiple types
of entities (e.g., the word “coach” can refer to a type of • Multi-view co-training coupling. NELL’s multiple meth-
“person,” or a type of “vehicle”), and because synony- ods for classifying noun phrases into categories (and
mous words can refer to the same entity (e.g., “NYC,” noun phrase pairs into relations) provide a natural co-
“New York City” and “Big Apple” are synonyms for the training setting,4 in which alternative classifiers for the
same entity). In order to deal with polysemy, NELL same category should agree on the predicted label when-
simply allows a noun phrase to be classified into mul- ever they are given the same input, even though their
tiple categories if there is strong evidence according predictions are based on different noun phrase fea-
to its reading methods. To deal with synonymy, NELL tures. To be precise, let vk(z) be the feature vector used by
learns explicit functions that classify noun phrase the kth function, when considering input noun phrase z.
pairs by whether or not they are synonyms (e.g., For any pair of functions fi : vi(Z) → Y and fj : vj(Z) → Y that
whether “NYC” and “Big Apple” can refer to the same predict the same Y from the same Z using the two differ-
entity). This classification method is described in ent feature views vi and vj, NELL uses the coupling con-
Krishnamurthy and Mitchell.20 For each of NELL’s straint (∀z)fi(z) = fj(z). This couples the tasks of learning
293 categories, it co-trains two synonym classifiers. fi and fj.
One classifier is based on string similarity between • Subset/superset coupling. When a new category is added
the two noun phrases (e.g., “NYC” and “New York to NELL’s ontology, the categories which are its imme-
City” have similar string features). The second is diate parents (supersets) are specified (e.g., “Beverage”
based on similarities in the beliefs NELL has extracted is declared to be a subset of “Food.”). When category C1
(e.g., if NELL’s KB believes that “NYC” and “New York is added as a subset of category C2, NELL uses the cou-
City” have the same mayor, this is evidence that the pling constraint that (∀x)C1(x) → C2(x). This couples
assumed two city names may be synonyms, though learning tasks that learn to predict C1 to those that
belonging to the same country might not be evidence learn to predict C2.
that two city names are synonyms). NELL learns for • Multi-label mutual exclusion coupling. When a category
each of its categories (e.g., “city”), what are the cate- C is added to NELL’s ontology, the categories that are
gory specific types of knowledge that are evidence of known to be disjoint from (mutually exclusive with) C
synonymy, and which types of string features indicate are specified (e.g., “Beverage” is declared to be mutually
synonymy. exclusive with “Emotion,” “City,” etc.). These mutual
•  Inference Rules among belief triples: Functions that map exclusion constraints are typically inherited from more
from NELL’s current KB, to new beliefs it should add to general classes, but can be overridden by explicit asser-
its KB. For each relation in NELL’s ontology, the corre- tions. When category C1 is declared to be mutually
sponding function is represented by a collection of exclusive with C2, NELL adopts the constraint that
restricted Horn Clause rules learned by the Path (∀x)C1(x) → ¬C2(x).
Ranking Algorithm (PRA) system.19, 23 • Coupling relations to their argument types. When a rela-
tion is added to NELL’s ontology, the types of its argu-
Each of the above functions f : X → Y represents a per- ments must be defined in terms of NELL categories
formance task Ti = 〈X, Y〉 for NELL, and each maps to the (e.g., “zooInCity(x,y)” requires arguments of types
learning task of acquiring that function, given some type “Zoo” and “City” respectively). NELL uses these argu-
of experience Ei and a performance metric Pi to be opti- ment type declarations as coupling constraints between
mized during learning. In NELL, the performance met- its category and relation classifiers.
ric Pi to optimize is simply the accuracy of the learned •  Horn clause coupling. Whenever NELL learns a Horn
function. In all cases except one, the experience Ei is a clause rule to infer new KB beliefs from existing
combination of human-labeled training examples (the beliefs, that rule serves as a coupling constraint to
dozen or so labeled examples provided for each category augment NELL’s never ending learning problem
and relation in NELL’s ontology, plus labeled examples 〈L, C〉. For example, when NELL learns a rule of the
contributed over time through NELL’s Website), a set form (∀x, y, z)R1(x, y) ∧ R2(y, z) → R3(x, z) with probabil-
of NELL self-labeled training examples corresponding to ity p, this rule serves as a new probabilistic coupling
NELL’s current knowledge base, and a huge volume of constraint over the functions that learn relations R1,
unlabeled Web text. The one exception is learning over R2, and R3. Each learned Horn clause requires that

108 COMM UNICATIO NS O F T H E ACM | M AY 201 8 | VO L . 61 | NO. 5

 learned functions mapping from noun phrase pairs to learning, performing an E-like step and an M-like step on
relations labels for R1, R2, and R3 are consistent with each iteration through the loop. During the E-like step, the
this Horn clause; hence, they are analogous to NELL’s set of beliefs that form the knowledge base is re-estimated;
subset/superset coupling constraints, which require that is, each reading and inference module in NELL pro-
that functions mapping from noun phrases to cate- poses updates to the KB (additions and deletions of spe-
gory labels should be consistent with the subset/ cific beliefs, with specific confidences and provenance
superset constraint. information). The Knowledge Integrator (KI) both records
these individual recommendations and makes a final deci-
NELL’s never ending learning problem thus contains sion about the confidence assigned to each potential belief
over 4100 learning tasks, inter-related by over a million in the KB. Then, during the M-like step, this refined KB is
coupling constraints. In fact, NELL’s never ending learning used to retrain each of these reading and inference mod-
problem 〈L, C〉 is open ended, in that NELL has the ability to ules, employing module-specific learning algorithms for
add both new consistency constraints in the form of learned each. The result is a large-scale coupled training system
Horn clauses (as discussed above) and new learning tasks, in which thousands of learning tasks are guided by one
by inventing new predicates for its ontology (as discussed another’s results, through the shared KB and coupling
below). constraints.
Notice that a full EM algorithm is impractical in NELL’s
6. NELL’S LEARNING METHODS AND ARCHITECTURE case; NELL routinely considers tens of millions of noun
The software architecture for NELL, depicted in Figure 3, phrases, yielding 1017 potential relational assertions among
includes a KB which acts as a blackboard through which NELL’s noun phrase pairs. It is impractical to estimate the prob-
various learning and inference modules communicate.a As ability of each of these potential latent assertions on each
shown in Figure 3, these software modules map closely to E-like step. Instead, NELL constructs and considers only
the learning methods (CPL, CMC, SEAL, OpenEval, PRA, and the beliefs in which it has highest confidence, limiting
NEIL) for the different types of functions mentioned in the each software module to suggest only a bounded number
previous section, so that NELL’s various learning tasks are of new candidate beliefs for any given predicate on any
partitioned across these modules. given iteration. This enables NELL to operate tractably,
while retaining the ability to add millions of new beliefs
6.1. Learning in NELL as an Approximation to EM over many iterations, and to delete beliefs in which it sub-
NELL is in an infinite loop analogous to an Expectation- sequently loses confidence. In addition, NELL enforces its
Maximization (EM) algorithm14, 30 for semi-supervised consistency constraints in a limited-radius fashion on each
iteration (i.e., if one belief changes, the only other beliefs
a
 The KB is implemented as a frame-based knowledge representation influenced are those coupled directly by some constraint;
which represents language tokens (e.g., NounPhrase:bank) distinct from compositions of constraints are not considered). However,
non-linguistic entities to which they can refer (e.g., Company:bank, across multiple iterations of its EM-like algorithm, the
LandscapeFeature:bank), and relates the two by separate CanReferTo(noun influence of any given belief update can propagate through-
phrase, entity) assertions.
out the knowledge graph as neighboring beliefs are them-
selves revised.
Figure 3. NELL’s software architecture. NELL’s growing knowledge
base (red box) serves as a shared blackboard through which its
6.2. Knowledge Integrator in NELL
various reading and inference modules (green box) interact. On each
NELL iteration the knowledge base is first updated by integrating The KI integrates the incoming proposals for KB updates.
proposals from the various reading and inference modules. The For efficiency, the KI considers only moderate-confidence
revised knowledge base is then used to retrain each of these candidate beliefs, and re-assesses confidence using a lim-
modules. ited radius subgraph of the full graph of consistency con-
straints and beliefs. As an example, for each new relational
NELL architecture triple that the KI asserts, it checks that the entities in the
relational triple have a category type consistent with the
Knowledge base
relation, but does not consider using new triples as a trig-
Beliefs Knowledge
integrator
ger to update beliefs about these argument types during the
Candidate same iteration. Over multiple iterations, the effects of con-
beliefs
straints propagate more widely through this graph of beliefs
and constraints. In Pujara et al.35 a more effective algorithm
is proposed for the joint inference problem faced by NELL’s
Text Orthographic URL specific Human
context classifier HTML advice KI; we believe it will be helpful to upgrade NELL’s KI in the
patterns patterns
(CPL) (CMC) (SEAL)
future to use this approach.

Learned
embeddings
Actively
search for
Infer new
beliefs from
Image
classifier
Ontology
extender
6.3. Adding Learning Tasks and Ontology Extension
web text old in NELL
(LE) (OpenEval) (PRA) (NEIL) (OntExt)
NELL has the ability to extend its ontology by invent-
ing new relational predicates using the OntExt system.28

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF T H E ACM 109

research highlights

OntExt searches for new relations by considering every lexeme (plus preposition where available), and object triples
pair of categories in NELL’s current ontology, to search for (e.g., <horse, eat, hay>, <john, eat with, fork>) found by pars-
evidence of a new, frequently discussed relation between ing the 500 mn English Web pages in NELL’s initial cache of
members of that category pair. It performs this search in Web pages from ClueWeb2009.
a three step process: (1) Extract sentences mentioning VerbKB is guided by NELL’s knowledge about the seman-
known instances of both categories (e.g., for the category tic categories to which the subject and object belong. The
pair 〈drug,disease〉 the sentence Prozac may cause migraines groups of <subjectCategory verbCluster, objectCategory> pat-
might be extracted if prozac and migraines were already terns discovered by VerbKB are proposed as new typed
present in NELL’s KB). (2) From the extracted sentences, relations for NELL. For example, VerbKB has proposed
build a context by context co-occurrence matrix, then clus- that the group of verbs {have, experience, suffer, survive,
ter the related contexts together. Each cluster corresponds sustain, bear, endure, tolerate} represents a potential new
to a possible new relation between the two input category NELL relation PersonHaveDisease(person,disease), when
instances. (3) Employ a trained classifier, and a final stage these verbs occur with a subject belonging to the NELL cat-
of manual filtering, before allowing the new relation (e.g., egory “Person” and an object of NELL category “Disease.”
DrugHasSideEffect(x,y) ) to be added to NELL’s ontology. VerbKB has clustered 65,000 verb lexemes (+prepositions)
OntExt has added 62 new relations to NELL’s ontology; a which cover 98% of all verb mentions in ClueWeb2010 and
sample is shown in Figure 4. Note the invention and intro- has proposed a collection of 86,000 verb clusters (58,000 of
duction of each new relation into NELL’s ontology spawns which are non-singleton clusters) as new relations to NELL.
a number of new tasks. These include new “learning to Because this very large number of proposed relations raises
read” tasks, to classify which noun phrase pairs satisfy scaling issues for NELL’s current hardware and software, we
the relation, based on different views of the noun phrase are currently exploring ways to scale up NELL, and ways to
pair. Each new relation also spawns a new task of learning select among these proposed relations by relying on NELL’s
Horn clause rules to infer this new relation from others, Twitter interfacec followers to decide (as described in Pedro
and of course the new relation also becomes available for and Hruschka31) which among these relations will be most
representing new rules that infer instances of other NELL interesting for NELL to learn. Although we are still working
relations. to incorporate this into routine use by NELL’s never-ending
In addition to the OntExt algorithm for proposing new execution run, we are optimistic that this will provide a sig-
relations, we have more recently developed the verb knowl- nificant increase in the coverage and capability of NELL’s
edge base (VerbKBb) which proposes new relations on a much learned knowledge.
larger scale.43 Verbs and verb phrases naturally express rela-
tions between noun phrases, and can provide the high cov- 6.4. Self-Reflection and Self-Evaluation
erage vocabulary of relation predicates required to represent One important capability we wish to add to NELL is the abil-
beliefs in arbitrary text. VerbKB groups semantically similar ity to self-reflect on, and self-evaluate its own performance,
verb patterns by analyzing the statistics of all subject, verb to enable it to focus its learning efforts where it most needs
improvement. Although NELL’s architecture does not yet
have such a self-reflection component, we have recently
b
 http://gourierverb.azurewebsites.net. developed and tested the key algorithms that will enable it
to estimate the accuracies of thousands of functions it is
Figure 4. Sample of relations automatically discovered by learning, based solely on the unlabeled data it has access to.
NELL’s OntExt algorithm. When NELL adds a newly discovered The key theoretical question here is “under what conditions
relation to its ontology, its learning algorithms are automatically
can unlabeled data be used to estimate accuracy of learned
triggered to seek new instances. For example, since adding
these new relations NELL has added hundreds of instances of functions?” Surprisingly, we have found that there are con-
buildingFeatureMadeFromMaterial including (tiles, porcelain) ditions under which the observed consistency among differ-
and (garage doors, steel), and thousands of instances of ent learned functions applied to unlabeled data can be used
clothingGoesWithClothing including (tee shirt, jeans), (tuxedo jacket, to derive highly precise estimates of accuracies of these func-
tie) and (gloves, warm coat).
tions, and that these methods work well for accuracy estima-
Sample of self-discovered NELL relations tion in NELL.
For example, in Platanios et al.32 we show that if one has
athleteWonAward clothingGoesWithClothing three or more approximations to the same function (e.g.,
animalEatsFood bacteriaCausesPhysCondition
NELL’s different learned classifiers that predict whether
languageTaughtInCity buildingFeatureMadeFromMaterial
clothingMadeFromPlant emotionAssociatedWithDisease a noun phase refers to a city, based on different views of
beverageServedWithFood foodCanCauseDisease the noun phrase), if these functions are more accurate
fishServedWithFood agriculturalProductAttractsInsect than chance, and if their errors are independent, then
athleteBeatAthlete arteryArisesFromArtery the rates at which these functions agree on the classifica-
athleteInjuredBodyPart countryHasSportsFans
arthropodFeedsOnInsect bakedGoodServedWithBeverage
tion of unlabeled examples can be used to solve exactly
animalEatsVegetable beverageContainsProtein for their accuracies. While NELL comes close to meeting
plantRepresentsEmotion animalCanDevelopDisease
foodDecreasesRiskOfDisease beverageMadeFromBeverage
 https://twitter.com/cmunell.
c

110 CO MM UNICATIO NS O F T H E ACM | M AY 201 8 | VO L . 61 | NO. 5

 these conditions, in general it does not satisfy the assump- iterations), the knowledge base nevertheless continues to
tion that its different functions make completely inde- grow overall. This ongoing growth is due in part to the fact
pendent errors. However, we found it possible to weaken that NELL’s ontology extension module is adding new pred-
the assumption of independent errors, and effectively icates to the ontology over time (e.g., athleteInjuredBody-
replace it by a prior stating that more independent errors Part(athlete, bodyPart)), creating the opportunity for NELL
are more probable. Experimental results show that these to acquire new beliefs that it could not even represent in its
algorithms, run on NELL’s learned functions for 15 rep- original ontology.
resentative categories, yield accuracy estimates that devi- Beyond the volume of beliefs, consider the accuracy of
ate on average less than 0.01 from the true accuracies. In NELL’s reading competence over time. To evaluate this, we
Platanios et al.33 we introduce a related Bayesian approach applied different versions of NELL obtained at different
which also leverages the fact that NELL is learning to pre- iterations in its history, to extract beliefs from its cache of
dict many different functions for each input noun phrase, English Web pages, plus the world wide Web as accessed
hence leveraging the full mulit-view, multi-task nature of through NELL’s reading modules. We then manually
NELL’s learning problem. Finally, in Platanios et al.34 we evaluated the accuracy of the beliefs extracted by these
also propose a probabilistic logic approach that further different historical versions of NELL, to measure NELL’s
leverages the information provided by logical constraints evolving reading competence. To obtain different versions
between the outputs of the functions that NELL is learning of NELL over time, we relied on the fact that NELL’s state
to predict (e.g., a noun phrase that refers to a city has to at any given time is fully determined by its KB. In particu-
also refer to a location). lar, given NELL’s KB at iteration i we first had NELL train
itself on that KB plus unlabeled text from the Web, then
7. EMPIRICAL EVALUATION had it apply its trained methods to a test set of unlabeled
Our primary goal in experimentally evaluating NELL is to Web text to propose a rank-ordered set of confidence-
understand the degree to which NELL improves over time weighted beliefs. We evaluated the accuracy of these
through learning, both in its reading competence, and in beliefs to measure NELL’s evolving competence at differ-
the size and quality of its KB. ent points in time.d
First, consider the growth of NELL’s KB over time, from In greater detail, we first selected 12 different points in
its inception in January 2010 through July 10, 2017, dur- time to test NELL’s reading competence: iterations 166, 261,
ing which NELL completed 1064 iterations. The left panel 337, 447, 490, 561, 641, 731, 791, 886, 960, and 1026. These
of Figure 5 shows the number of beliefs in NELL’s KB over iterations span from the inception of NELL in January 2010
time, and the right panel of Figure 5 shows the number of through November 2016. For each of those iterations, we
beliefs for which NELL holds high confidence. Note that trained NELL using the KB from that iteration, then evalu-
as of July 2017, NELL’s KB contains approximately 117mn ated its reading competence over a representative sample of
beliefs with varying levels of confidence, including 3.81mn 18 categories and 13 relations (31 predicates in total) from
that it holds in high confidence. Here, “high confidence” NELL’s initial ontology. Each iteration-specific trained ver-
indicates either that one of NELL’s modules assigns a con- sion of NELL was then applied to produce a ranked list of
fidence of at least 0.9 to the belief, or that multiple modules the top 1000 novel predictions, omitting any prediction cor-
independently propose the belief. responding to a noun phrase or relation instance for which
As Figure 5 illustrates, NELL’s KB is clearly growing, NELL had received human feedback at any point in its his-
though its high confidence beliefs constitute only about 3% tory. To estimate NELL’s reading competence at each point
of the total set of beliefs it is considering. Although NELL we first created a pool of test instances to manually anno-
has now saturated some of the categories and relations in tate. For each iteration to be evaluated, this pool included
its ontology (e.g., for the category “Country” it extracted the top 10 ranked predictions for each predicate, 20 more
most actual country names during the first few hundred predictions sampled uniformly at random from ranks 11
to 100, and an additional 20 from ranks 101 to 1000. This
Figure 5. NELL KB size over time. Total number of beliefs (left) and provided 50 (potentially overlapping) instances per predi-
number of high confidence beliefs (right) versus iterations. Left plot cate from each iteration, averaging about 350 instances per
vertical axis is tens of millions, right plot vertical axis is in millions. The predicate over all iterations. We manually annotated each
horizontal axis covers NELL iterations from January 2010 until July 2017.
of these instances as correct or incorrect, yielding approxi-
All beliefs High-confidence beliefs mately 11,000 total annotated beliefs regarding 31 predi-
×107 6
4 ×10
12
cates, which we used to evaluate NELL’s learned reading
Candidate beliefs (in 10’s of millions)

3.5
10 competence at each iteration.
3
8
The results of this evaluation are summarized in Figure 6,
2.5
which shows the improvement in NELL’s reading compe-
6 2

1.5
tence over time, as measured by NELL’s estimated Mean
4
1
2
0.5 d
  To be precise, for NELL iterations prior to and including November 2014,
0 0 we used test data from the Web as of November 2014. For evaluations of
0 200 400 600 800 1000 1200 0 200 400 600 800 1000 1200
Iterations Iterations NELL’s competence in November 2015 and November 2016, we instead used
the Web as it existed on those dates.

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF T H E ACM 111

research highlights

Average Precision (MAP) over this sample of 1000 most con- feedback (an average of 1,467 per month). Note the large
fident predictions for each of these 31 predicates. Taken burst of feedback from iteration 100 to 177. During the first
together, the results in the Figure 6 and the results of Figure 5 two years, the bulk of feedback was provided by members
show that over several years NELL’s reading accuracy, and of the NELL research project, though in more recent years
the accuracy of its most confident beliefs have grown at the most of the feedback is now crowdsourced, that is, provided
same time that the volume of beliefs in the knowledge base by external visitors to the NELL Website, or by followers of @
has also grown by millions. CMUNELL on Twitter.
Next, we summarize feedback from humans to NELL. In addition to the above aggregate measures of NELL’s
This feedback is nearly all negative feedback identifying behavior, it is interesting to consider its detailed behavior for
NELL’s incorrect beliefs. Figure 7 shows the distribution of specific predicates. Here we find that NELL’s performance
this negative feedback from humans to NELL over its first varies dramatically across predicates: the precision over
802 iterations, which is very similar to the distribution of NELL’s 1000 highest confidence predictions for categories
feedback in more recent iterations. During this period, such as “river,” “body part,” and “physiological condition”
NELL received on average 2.4 negative feedback labels per is well above 0.95, whereas for “machine learning author”
predicate, per month, for a total of 85,088 items of negative and “city capital of country(x,y)” accuracies are well below
0.5. One factor influencing NELL’s ability to learn well is
whether it has other mutually exclusive categories to learn—
this mutually exclusive relationship provides a coupling con-
Figure 6. Evolution of NELL reading accuracy over time. The
straint that typically yields valuable negative examples. For
vertical axis shows the estimated Mean Average Precision over the
1000 most confident predictions for a representative sample of 18 instance, many of NELL’s errors for the category “machine
categories and 13 relations in NELL’s ontology. The horizontal axis learning author” are computer science researchers (e.g.,
represents NELL iterations from January 2010 through November “Robert Kraut”) who do not happen to work in the area of
2016. machine learning—NELL would presumably learn this cat-
Mean average precision egory better if we added to its ontology other categories such
0.6 as “HCI author” to provide examples that are usually mutu-
ally exclusive. Another factor is the number of actual mem-
0.55
bers of the category: for example, the category “planet” has
0.5
only a small number of actual members, but NELL is search-
Mean average precision

ing for more, so it proposes members such as “counter earth”

0.45 and “asteroid ida.” In some cases, NELL performs poorly for
a predicate due to a particular error which propagates due to
0.4 its bootstrap-style learning from unlabeled or self-labeled
data. For example, for the category “sports team position”
0.35
NELL has numerous correct members such as “quarterback”
0.3 and “first base,” but it has acquired a systematic error in hav-
ing a strong belief that phrases ending with “layer” (e.g.,
0.25
0 200 400 600 800 1000 1200
“defence layer” and “cloud layer”) refer to sports positions.
Iterations While some do, most do not, yet NELL has no easy way to
determine this.
It is important to realize that as NELL progresses, the
task of adding the next new belief to the knowledge base
naturally becomes more difficult. NELL’s redundancy-
Figure 7. Human feedback to NELL over time. Each bar in this
histogram shows the number of NELL beliefs for which humans
based reading methods tend to extract the most fre-
provided negative feedback, during a 78 iteration interval. This quently-mentioned beliefs earlier (e.g., for the category
averages out to 2.4 items of feedback per month, per predicate in “emotions” NELL first extracted frequently mentioned
NELL’s ontology. Human input to NELL has been dropping over time, emotions such as “gladness” and “loneliness”). But once
even as its reading accuracy has been increasing. it has extracted the frequently mentioned instances which
×104 are easiest for its statistically-based methods, it later can
3
only grow the KB by extracting less frequently mentioned
Number of negative feedbacks

2.5 beliefs (e.g., later the emotions it was able to add were
2
more obscure instances such as “incredible lightness,”
“cavilingness,” and “nonop-probriousness,” as well as
1.5
some non-emotion phrases).
1 This increasing difficulty over time seems to be inher-
ent to the task of never-ending learning. Meeting this
0.5
challenge in NELL suggests several opportunities for
0
100 178 256 334 412 490 568 646 724 802
future research: (1) add a self-reflection capability to NELL
Iterations to enable it to detect where it is doing well, where it is
doing poorly, when it has sufficiently populated any given

112 COMM UNICATIO NS O F T H E AC M | M AY 201 8 | VO L . 61 | NO. 5

category or relation, enabling it to allocate its efforts in a (e.g., river, city). Each new relation NELL introduces leads
more intelligently targeted fashion, (2) broaden the scope to new learning tasks such as learning to extract the rela-
of data NELL uses to extract beliefs, for example by includ- tion from text, and learning to infer instances of the relation
ing languages beyond English,16 image data as well as from other beliefs.
text, and new continuous streams of data such as Twitter, Organize the set of learning tasks into an easy-to-increas-
(3) expand NELL’s ontology dramatically, both by rely- ingly-difficult curriculum. Given a complex set of learning
ing more heavily on automated algorithms for inventing tasks, it will often be the case that some learning tasks
new relations and categories, and by merging other open- are easier, and some produce prerequisite knowledge for
source ontologies such as DBpedia into NELL’s ontology, others. In NELL, we have evolved the system by manually
and (4) add a new generation of “micro-reading” methods introducing new types of learning tasks over time. During
to NELL—methods that perform deep semantic analy- NELL’s first six months, its only tasks were to classify noun
sis of individual sentences and text passages, and which phrases into categories, and noun phrase pairs into rela-
therefore do not need to rely on redundancy across the tions. Later, once it achieved some level of competence at
Web to achieve accurate reading. We are currently actively these, and grew its KB accordingly, it became feasible for
exploring each of these directions. it to confront more challenging tasks. At that point, we
introduced the task of datamining the KB to discover use-
8. DISCUSSION ful Horn clause rules, as well as the task of discovering new
Based on the above empirical analysis, it is clear that NELL relational predicates based on NELL’s knowledge of cat-
is successfully learning to improve its reading competence egory instances. A key open research question is how the
over time, and is using this increasing competence to build learning agent might itself evolve a useful curriculum of
an ever larger KB of beliefs about the world. In this paper, learning tasks.
we present NELL as an early case study of a never-ending NELL also has many limitations, which suggest addi-
learning system. What are the lessons to be learned from tional areas for research into never-ending learning agents:
this case study? Our experience with NELL suggests four
useful design features that have led to the successes it has • Self reflection and an explicit agenda of learning sub-
had—design features we recommend for any never-ending goals. At present, NELL suffers from the fact that it has
learning system: a very weak ability to monitor its own performance and
To achieve successful semi-supervised learning, couple the progress. It does not notice, for example, that it has
training of many different learning tasks. The primary reason learned no useful new members of the “country” cate-
NELL has succeeded in learning thousands of functions gory for the past year, and it continues to work on this
from only a small amount of supervision is that it has been problem although its knowledge in this area is satu-
designed to simultaneously learn thousands of different rated. Furthermore, it makes no attempt to allocate its
functions that are densely connected by a large number of learning effort to tasks that will be especially produc-
coupling constraints. As progress begins to be made on one tive (e.g., collecting new Web text describing entities
of these learning tasks, the coupling constraints allow the about which it has only low confidence beliefs). It is
learned information to constrain subsequent learning for clear that developing a self-reflection capability to
other tasks. monitor and estimate its own accuracy, and to plan
Allow the agent to learn additional coupling constraints. specific learning actions in response to perceived
Given the critical importance of coupling the training of needs, would allow the system to use its computational
many functions, great gains can be had by automatically effort more productively.
learning additional coupling constraints. In NELL, this is • Pervasive plasticity. Although NELL is able to modify
accomplished by learning restricted-form probabilistic many aspects of its behavior through learning, other
Horn clauses by data-mining NELL’s KB. NELL has learned parts of its behavior are cast in stone, unmodifiable.
hundreds of thousands of probabilistic Horn clauses and For example, NELL’s method for detecting noun
related probabilistic inference rules which it uses to infer phrases in text is a fixed procedure not open to
new KB beliefs it has not yet read. As a side effect of creating ­learning. In designing never-ending learning agents,
new beliefs which are subsequently used to retrain NELL’s it will be important to understand how to architect the
reading functions, these Horn clauses also act as coupling agent so that as many aspects of its behavior as possi-
constraints to further constrain and guide subsequent joint ble are plastic—that is, open to learning. Otherwise,
learning of NELL’s reading functions for relations mentioned the agent runs the risk of reaching a performance
by the Horn clause. plateau in which further improvement requires modifi-
Learn new representations that cover relevant phenom- cations to a part of the system that is not itself
ena beyond the initial representation. To continuously modifiable.
improve, and to avoid reaching a plateau in performance, •  Representation and reasoning. At present, NELL uses a
a never-ending learning system may need to extend its simple frame based knowledge representation, aug-
representation beyond what is initially provided. NELL mented by the PRA reasoning system which performs
has a primitive but already-useful ability to extend its rep- tractable but limited types of reasoning based on
resentation by suggesting new relational predicates (e.g., restricted Horn clauses. NELL’s competence is already
RiverFlowsThroughCity(x,y) ) between existing categories limited in part by its lack of more powerful reasoning

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF T H E ACM 113

research highlights

components; for example, it currently lacks methods produce ever-improving modifications to itself in prin-
for representing and reasoning about time and space. ciple. A second, related issue is whether its learning
Hence, core AI problems of representation and trac- mechanisms will make these potential changes, con-
table reasoning are also core research problems for verging in practice given a tractable amount of compu-
never-ending learning agents. In addition, recent tation and training experience.
research in natural language has shown that work-
ing wth non-symbolic vector embeddings of words, Acknowledgment
phrases and entities, learned via deep neural networks, We thank the anonymous reviewers for their constructive
has many advantages. In NELL, the recent addition of comments, and thank Lucas Navarro, Bill McDowell, Oscar
the LE method has similarly yielded improvements in Romero and Amos Azaria for help in the empirical evalua-
NELL’s ability to extract new instances of categories tion of NELL. This research was supported in part by DARPA
and relations. However, an even more dramatic adop- under contract number FA8750-13-2-0005, by NSF grants
tion of vector embeddings learned via deep networks IIS-1065251 and CCF-1116892, by AFOSR award FA9550-
would be possible, for example, providing a continu- 17-1-0218, and by several generous gifts from Google and
ous space of category and relation predicates repre- Yahoo!. We also gratefully acknowledge graduate fellow-
sented by vectors and matrices, fundamentally ship support over the years from Yahoo, Microsoft, Google,
changing the framing of the ontology extension prob- Fulbright, CAPES, and FAPESP.
lem (i.e., if every relation is represented by a matrix,
the set of possible matrices is the set of possible rela-
tions in the ontology). References
1. Balcan, M.-F., Blum, A. A PAC-style 15. Donmez, P., Carbonell, J.G. Proactive
model for learning from labeled learning: cost-sensitive active
and unlabeled data. Proc. of COLT learning with multiple imperfect
The study of never-ending learning raises important (2004). oracles. In Proceedings of the 17th
­conceptual and theoretical problems as well, including: 2. Bengio, Y. Learning deep architectures ACM conference on Information and
for AI. Foundations and Trends in knowledge management (2008),
Machine Learning 2, 1 (2009), 1–127. ACM, 619–628.
• The relationship between consistency and correctness. 3. Bengio, Y., Louradour, J., 16. Duarte, M.C., Hruschka Jr., E.R. How
Collobert, R., Weston, J. Curriculum to read the web in portuguese using
An autonomous learning agent can never truly perceive learning. In Proceedings of the 26th the never-ending language learner’s
annual international conference principles. In Intelligent Systems
whether it is correct—it can at best detect only that it is on machine learning (2009), ACM, Design and Applications (ISDA), 2014
internally consistent. For example, even if it observes 41–48. 14th International Conference on
4. Blum, A., Mitchell, T. Combining (2014), IEEE, 162–167.
that its predictions (e.g., new beliefs predicted by labeled and unlabeled data with co- 17. Etzioni, O.e.a. Web-scale information
NELL’s learned Horn clauses) are consistent with what training. Proc. of COLT (1998). extraction in knowitall (preliminary
5. Brunskill, E., Leffler, B., Li, L., results). In WWW (2004).
it perceives (e.g., what NELL reads from text), it cannot Littman, M.L., Roy, N. Corl: A 18. Etzioni, O.e.a. Open information
distinguish whether that observed consistency is due to continuous-­state offset-dynamics extraction: The second generation.
reinforcement learner. In Proceedings Proc. of IJCAI (2011).
correct predictions and correct perceptions, or incorrect of the 24th Conference on Uncertainty 19. Gardner, M., Talukdar, P.,
predictions and correspondingly incorrect perceptions. in Artificial Intelligence (UAI) (2012), Krishnamurthy, J., Mitchell, T.
53–61. Incorporating vector space similarity
This is important in understanding never-ending learn- 6. Callan, J. Clueweb12 data set (2013) in random walk inference over
ing, because it suggests organizing the learning agent http://lemurproject.org/clueweb12/. knowledge bases. Proc. of EMNLP
7. Callan, J., Hoy, M. Clueweb09 data (2014).
to become increasingly consistent over time, which is set (2009) http://boston.lti.cs.cmu. 20. Krishnamurthy, J., Mitchell, T.M.
precisely how NELL uses its consistency constraints to edu/Data/clueweb09/. Which noun phrases denote
8. Carlson, A., Betteridge, J., Kisiel, B., which concepts. Proc. of ACL
guide learning. A key open theoretical question there- Settles, B., Hruschka Jr, E.R., (2011).
fore is “under what conditions can one guarantee that Mitchell, T.M. Toward an architecture 21. Laird, J., Newell, A., Rosenbloom, P.
for never-ending language learning. SOAR: An architecture for general
an increasingly consistent learning agent is also an AAAI 5, 3 (2010a). intelligence. Artif. Intel. 33, (1987),
9. Carlson, A., Betteridge, J., Wang, R.C., 1–64.
increasingly correct agent?” Platanios et al.32 provides Hruschka Jr., E.R., Mitchell, T.M. 22. Langley, P., McKusick, K.B., Allen, J.A.,
one step in this direction, by providing an approach Coupled semi-supervised learning for Iba, W.F., Thompson, K. A design for
information extraction. Proc. of WSDM the ICARUS architecture. SIGART
that will soon allow NELL to estimate its accuracy based (2010b). Bull. 2, 4 (1991), 104–109.
on the observed consistency rate among its learned 10. Caruana, R. Multitask learning. 23. Lao, N., Mitchell, T., Cohen, W.W.
Machine Learning 28 (1997), 41–75. Random walk inference and learning
functions, but much remains to be understood about 11. Chen, Z., Liu, B. Lifelong machine in a large scale knowledge base. Proc.
this fundamental theoretical question. learning. Synthesis Lectures on of EMNLP (2011).
Artificial Intelligence and Machine 24. Lenat, D.B. Eurisko: A program that
• Convergence guarantees in principle and in practice. A Learning 10, 3 (2016), 1–145. learns new heuristics and domain
second fundamental question for never-ending learn- 12. Chen, X., Shrivastava, A., Gupta, A. concepts. Artif. Intel. 21, 1–2 (1983),
Neil: Extracting visual knowledge 61–98.
ing agents is “what agent architecture is sufficient to from web data. In Proceedings of 25. Maaten, L.v.d., Hinton, G. Visualizing
guarantee that the agent can in principle generate a ICCV (2013). data using t-SNE. J. Machine Learning
13. Craven, M., DiPasquo, D., Freitag, D., Res. 9, Nov (2008):2579–2605.
sequence of self-modifications that will transform it McCallum, A., Mitchell, T., Nigam, K., 26. Mitchell, T.M., Allen, J., Chalasani, P.,
from its initial state to an increasingly high perfor- Slattery, S. Learning to extract Cheng, J., Etzioni, O., Ringuette, M.N.,
symbolic knowledge from the world Schlimmer, J.C. THEO: A framework
mance agent, without hitting performance plateaus?” wide web. In Proceedings of the 15th for self-improving systems. Arch. for
Note this may require that the architecture support per- National Conference on Artificial Intel. (1991), 323–356.
Intelligence (1998). 27. Mitchell, T., Cohen, W., Hruschka, E.,
vasive plasticity, the ability to change its representa- 14. Dempster, A., Laird, N., Rubin, D. Talukdar, P., Betteridge, J., Carlson, A.,
Maximum likelihood from incomplete Dalvi, B., Gardner, M., Kisiel, B.,
tions, etcetera. One issue here is whether the architecture data via the EM algorithm. J. R. Stat. Krishnamurthy, J., Lao, N., Mazaitis, K.,
has sufficient self-modification operations to allow it to Soc. Series B (1977). Mohamed, T., Nakashole, N.,

114 CO M MUNICATIO NS O F TH E ACM | M AY 201 8 | VO L . 61 | NO. 5

 Platanios, E., Ritter, A., Samadi, M., Unlabeled Data: A Probabilistic Logic
Settles, B., Wang, R., Wijaya, D., Approach (2017). preprint, https:// T. Mitchell (tom.mitchell@cs.cmu.edu), A. Carlson and N. Lao, Google Inc.,
Gupta, A., Chen, X., Saparov, A., arxiv.org/abs/1705.07086. Carnegie Mellon University, USA. USA.
Greaves, M., Welling, J. Never-ending 35. Pujara, J., Miao, H., Getoor, L., Cohen, W.
learning. In AAAI Conference on Knowledge graph identification. ISWC W. Cohen, B. Yang, J. Betteridge, T. Mohamed and R. Wang, Research
Artificial Intelligence (2015), AAAI, (2013). B. Dalvi, M. Gardner, B. Kisiel, carried out while at Carnegie Mellon
2302–2310. 36. Samadi, M., Veloso, M.M., Blum, M. J. Krishnamurthy, K. Mazaitis, University, USA.
28. Mohamed, T., Hruschka Jr., E.R., Openeval: Web information query N. Nakashole, E. Platanios, M. Samadi,
Mitchell, T.M. Discovering relations evaluation. In AAAI (2013). D. Wijaya, A. Gupta, X. Chen, and A. A. Ritter, Ohio State University, USA.
between noun categories. In 37. Suchanek, F.M., Kasneci, G., Saparov, Carnegie Mellon University, USA.
Proceedings of the 2011 Conference Weikum, G. Yago: A Core of Semantic B. Settles, Duolingo, USA.
on Empirical Methods in Natural Knowledge. In 16th international E. Hruschka, Federal University of São
Language Processing (2011), World Wide Web conference (WWW Carlos, Brazil. M. Greaves, Alpine Data Labs, USA.
Association for Computational 2007) (2007), ACM Press, New York,
Linguistics,Edinburgh, Scotland, UK, NY, USA. P. Talukdar, Indian Institute of Science, J. Welling, Pittsburgh Supercomputing
1447–1455. 38. Thrun, S., Mitchell, T. Lifelong robot India. Center, USA.
29. Muggleton, S., Buntine, W. Machine learning. Rob. Auton. Sys. 15, (1995),
invention of first-order predicates 25–46.
by inverting resolution. Inductive logic 39. Thrun, S., Pratt, L. (eds) Learning to
programming (1992), 261–280. learn, Kluwer Academic Publishers,
30. Nigam, K., McCallum, A., Thrun, S., Norwell, MA, USA, 1998.
Mitchell, T. Text classification using 40. Tong, S., Koller, D. Active learning
labeled and unlabeled documents. for structure in bayesian networks.
Machine Learning 39 (2000), 103–134. IJCAI (2001).
31. Pedro, S.D., Hruschka Jr, E.R. 41. Wang, R.C., Cohen, W.W. Language-
Conversing learning: Active independent set expansion of named
learning and active social entities using the web. Proc. of ICDM
interaction for human supervision (2007).
in never-ending learning 42. Wieting, J., Bansal, M., Gimpel, K.,
systems. In Advances in Artificial Livescu, K. Towards universal
Intelligence–IBERAMIA 2012 paraphrastic sentence embeddings.
(Springer, 2012), 231–240. In Proceedings of the International
32. Platanios, E.A., Blum, A., Mitchell, T.M. Conference on Learning Representa­
Estimating Accuracy from Unlabeled tions (ICLR) (2015).
Data. Proc. of UAI (2014). 43. Wijaya, D.T. VerbKB: A Knowledge
33. Platanios, E.A., Dubey, A., Mitchell, T.M. Base of Verbs for Natural Language
Estimating Accuracy from Unlabeled Understanding. Ph.D. Dissertation,
Data: A Bayesian Approach. In Carnegie Mellon University, 2016.
Proceedings of the International 44. Yang, B., Mitchell, T. Leveraging
Conference on Machine Learning (2016). knowledge bases in lstms for
34. Platanios, E.A., Poon, H., Mitchell, T.M., improving machine reading.
Horvitz, E. Estimating Accuracy from ACL (2017).
© 2018 ACM 0001-0782/18/5 $15.00

He was the conscience of the

computing industry...and paid for it.
The first full-length biography of Edmund Berkeley,
computing pioneer, social activist, and founding
member of the ACM. It is an historical narrative of a
man ultimately in favor of engineering peace, instead
of war, and how his career was ultimately damaged by
politicians determined to portray him as a Communist
sympathizer. Berkeley’s life work provides a lens to
understand social and political issues surrounding the
early development of electronic computers which ties
directly to current debates about the use of autonomous
intelligent systems.

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF T H E ACM 115

Text Data Management and Analysis covers the major concepts, techniques, and ideas in
Text Data Management and Analysis covers the major concepts, techniques, and ideas in
information retrieval and text data mining. It focuses on the practical viewpoint and includes
information retrieval and text data mining. It focuses on the practical viewpoint and includes
many many
hands-on exercises
hands-on designed
exercises designed with
witha acompanion softwaretoolkit
companion software toolkit (i.e.,
(i.e., MeTA)MeTA) to help
to help readers
readers
learn how
learnto
howapply techniques
to apply of information
techniques of informationretrieval andtext
retrieval and textmining
mining to to real-world
real-world text data.
text data. It It
also shows readers
also shows howhow
readers to experiment
to experimentwithwithandandimprove someofofthethe
improve some algorithms
algorithms for interesting
for interesting
application tasks.tasks.
application The The
book cancan
book be be usedasasa atext
used text for
for computer science
computer science undergraduates
undergraduates and graduates,
and graduates,
library and information scientists, or as a reference for practitioners working on
library and information scientists, or as a reference for practitioners working on relevant problemsrelevant problems in in
managing and analyzing
managing and analyzing text data. text data.
 CAREERS

Purdue University ˲˲ Data Science Shenzhen is also a popular tourist destination and
Assistant/Associate Professor of Practice ˲˲ Artificial Intelligence was named one of the world’s 31 must-see tourist
˲˲ Computer Systems (including Networks, Cloud destinations in 2010 by The New York Times.
The Department of Computer Science at Purdue Computing, IoT, Software Engineering, etc.) SUSTech is a pioneer in higher education re-
University is soliciting applications for Professor ˲˲ Cognitive Robotics and Autonomous Systems form in China. The mission of the University is to
of Practice positions at the Assistant or Associate ˲˲ Cybersecurity (including Cryptography) become a globally recognized research university
Professor level to begin Fall 2018. These are newly which emphasizes academic excellence and pro-
created positions offering three- to five-year ap- Applicants should have an earned Ph.D. degree motes innovation, creativity and entrepreneurship.
pointments that are renewable based on satisfac- and demonstrated achievements in both research SUSTech is committed to increase the diver-
tory performance for faculty with primary responsi- and teaching. The teaching language at SUSTech is sity of its faculty, and has a range of family-friendly
bilities in teaching and service. Applicants should bilingual, either English or Putonghua. It is perfect- policies in place. The university offers competitive
hold a PhD in computer science or a related field, ly acceptable to use English in all lectures, assign- salaries and fringe benefits including medical in-
or a BS degree in computer science or a related dis- ments, exams. In fact, our existing faculty members surance, retirement and housing subsidy, which
cipline and commensurate experience in teaching include several non-Chinese speaking professors. are among the best in China. Salary and rank will
or industry. Applicants should be committed to ex- Established in 2012, the Southern University commensurate with qualifications and experience.
cellence in teaching, and should have the ability to of Science and Technology (SUSTech) is a public We provide some of the best start-up pack-
teach a broad collection of core courses in the un- institution funded by the municipal of Shenzhen, ages in the sector to our faculty members, includ-
dergraduate curriculum. Applicants will also be ex- a special economic zone city in China. Shenzhen ing one PhD studentship per year, in addition to a
pected to develop and supervise project courses for is a major city located in Southern China, situ- significant amount of start-up funding (which can
undergraduates. Review of applications and candi- ated immediately north to Hong Kong Special be used to fund additional PhD students and post-
date interviews will begin on April 1, 2018, and will Administrative Region. As one of China’s major docs, research travels, and research equipments).
continue until the positions are filled. gateways to the world, Shenzhen is the country’s To apply, please provide a cover letter iden-
The Department of Computer Science offers fastest-growing city in the past two decades. The tifying the primary area of research, curriculum
a stimulating and nurturing educational environ- city is the high-tech and manufacturing hub of vitae, and research and teaching statements, and
ment with thriving undergraduate and graduate pro- southern China. As a picturesque coastal city, forward them to cshire@sustc.edu.cn.
grams and active research programs in most areas
of computer science. Additional information about
the department is available at http://www.cs.purdue.
edu. Salary and benefits will be competitive.
Purdue University’s Department of Computer
Science is committed to advancing diversity in all
areas of faculty effort, including scholarship, in-
struction, and engagement. Candidates should Tenure-Track Faculty Positions in Computer Engineering, Computer Science, and Data Sciences
address at least one of these areas in their cover The newly launched Zhejiang University/University of Illinois at Urbana-Champaign Institute (the ZJU-UIUC Institute) invites highly qualified
letter, indicating their past experiences, current candidates for multiple tenure-track faculty positions at all levels and in areas of engineering and science that match its multidisciplinary
mission. We especially seek candidates in computer engineering, computer science, and data sciences.
interests or activities, and/or future goals to pro-
The ZJU-UIUC Institute is an engineering college on the new Zhejiang University (ZJU) International Campus in Haining, China, about 120 km
mote a climate that values diversity, and inclusion. southwest of Shanghai. The ZJU-UIUC Institute conducts teaching and research in broad program themes of engineering and system sciences;
Applicants are strongly encouraged to apply information and data sciences; and energy, environment, and infrastructure sciences. Undergraduate degrees are offered in civil engineering,
online at https://hiring.science.purdue.edu. Al- computer engineering, electrical engineering, and mechanical engineering.
ternately hard-copy applications may be sent to: Applications are welcome from relevant engineering disciplines, and especially from computer engineering, computer science, information
Professor of Practice Search Chair, Department engineering, data science, and advanced analytics. The Institute has interdisciplinary interests and graduate programs that address but are not
limited to high performance computing, data science and engineering, communications and networking, intelligent infrastructure and urban
of Computer Science, 305 N. University St., Pur- systems, digital manufacturing, environmental sustainability, energy and water integration, and atomic-scale materials and processes. Classes
due University, West Lafayette IN 47907. A back- and student activities are conducted in English.
ground check will be required for employment. Successful candidates will initiate and lead collaborative research and teaching, and perform academic and professional service duties
Purdue University is an EEO/AA employer. All associated with the ZJU-UIUC Institute. They will be leaders for teaching and research innovation, giving students a meaningful and interactive
individuals, including minorities, women, indi- engineering education.
• Assistant professor candidates must have an earned doctorate, excellent academic credentials, strong research plans, and an
viduals with disabilities, and veterans are encour-
outstanding ability to teach effectively. Additional industry, post-doctoral, professional service, or internship experiences are preferred.
aged to apply. • Mid-career candidates must be established leaders in their field; exhibit strong records of teaching, publication, and funded research;
and demonstrate participation in interdisciplinary collaborations.
• Senior appointments are available for persons of international stature seeking to build substantial interdisciplinary research and
Southern University of Science and teaching programs.
Technology (SUSTech) The Institute will recommend its qualified candidates for the One Thousand Talent Program for Young Outstanding Scientists, China.
Tenure-Track Faculty Positions The search process will continue until positions are filled or through June 30, 2018. Salary and research initiation support will be
commensurate with qualifications and competitive with international norms, and housing benefits are provided. There is additional support for
laboratory initiation. Application materials should include a cover letter with current contact information including email address, a complete
The Department of Computer Science and Engi-
curriculum vitae, statements of research and teaching goals, and the names of three or more references. Please submit applications at http://
neering (CSE, http://cse.sustc.edu.cn/en/), South- zjui.illinois.edu or to zjuihr@zju.edu.cn. For more information, please visit http://zjui.zju.edu.cn.
ern University of Science and Technology (SUS- ZJU and UIUC are renowned for their engineering and computer science programs, and have a long history of collaboration. The ZJU-UIUC
Tech) has multiple Tenure-track faculty openings Institute leverages a new campus and creates a unique student experience of multidisciplinary collaboration, technical leadership, teamwork,
at all ranks, including Professor/Associate Profes- and creative excellence. Individuals with diverse backgrounds, experiences, and ideas who embrace and value diversity and inclusivity are
encouraged to apply and all qualified applicants will receive consideration for employment without regard to race, national origin, disability, age,
sor/Assistant Professor. We are looking for out-
or other personal characteristics.
standing candidates with demonstrated research Contact Person: Xisha (Emma) Zhang, Email: zjuihr@zju.edu.cn, Tel: +86 (571) 8757 2511
achievements and keen interest in teaching, in Web: http://zjui.zju.edu.cn, http://zjui.illinois.edu
the following areas (but are not restricted to):

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF T H E ACM 117

CAREERS

TENURE-TRACK AND TENURED POSITIONS

ShanghaiTech University invites highly qualified
candidates to fill multiple tenure-track/tenured
faculty positions as its core founding team in the School of Information Science and
Technology (SIST). We seek candidates with exceptional academic records or demonstrated
ADVERTISING
strong potentials in all cutting-edge research areas of information science and technology.
They must be fluent in English. English-based overseas academic training or background
IN CAREER
is highly desired. OPPORTUNITIES
ShanghaiTech is founded as a world-class research university for training future generations
of scientists, entrepreneurs, and technical leaders. Boasting a new modern campus in How to Submit a Classified Line Ad: Send an e-mail to
Zhangjiang Hightech Park of cosmopolitan Shanghai, ShanghaiTech shall trail-blaze a new
education system in China. Besides establishing and maintaining a world-class research acmmediasales@acm.org. Please include text, and indicate
profile, faculty candidates are also expected to contribute substantially to both graduate the issue/or issues where the ad will appear, and a contact
and undergraduate educations.
name and number.
Academic Disciplines: Candidates in all areas of information science and technology
shall be considered. Our recruitment focus includes, but is not limited to: computer Estimates: An insertion order will then be e-mailed back to
architecture, software engineering, database, computer security, VLSI, solid state and
nano electronics, RF electronics, information and signal processing, networking, security, you. The ad will by typeset according to CACM guidelines.
computational foundations, big data analytics, data mining, visualization, computer vision, NO PROOFS can be sent. Classified line ads are NOT
bio-inspired computing systems, power electronics, power systems, machine and motor
drive, power management IC as well as inter-disciplinary areas involving information commissionable.
science and technology. Deadlines: 20th of the month/2 months prior to issue date.
Compensation and Benefits: Salary and startup funds are highly competitive,
commensurate with experience and academic accomplishment. We also offer a
For latest deadline info, please contact:
comprehensive benefit package to employees and eligible dependents, including on- acmmediasales@acm.org
campus housing. All regular ShanghaiTech faculty members will join its new tenure-track
system in accordance with international practice for progress evaluation and promotion. Career Opportunities Online: Classified and recruitment
Qualifications: display ads receive a free duplicate listing on our website at:
• Strong research productivity and demonstrated potentials; http://jobs.acm.org
• Ph.D. (Electrical Engineering, Computer Engineering, Computer Science, Statistics,
Applied Math, Artificial Intelligence, Statistics or related field);
• A minimum relevant (including PhD) research experience of 4 years. Ads are listed for a period of 30 days.
Applications: Submit (in English, PDF version) a cover letter, a 2-page research plan, For More Information Contact:
a CV plus copies of 3 most significant publications, and names of three referees to: ACM Media Sales
sist@shanghaitech.edu.cn. For more information, visit http://sist.shanghaitech.edu.cn/
NewsDetail.asp?id=373 at 212-626-0686 or
Deadline: The positions will be open until they are filled by appropriate candidates. acmmediasales@acm.org

A personal walk down the

computer industry road.
BY AN EYEWITNESS.
Smarter Than Their Machines: Oral Histories
of the Pioneers of Interactive Computing is
based on oral histories archived at the Charles
Babbage Institute, University of Minnesota.
These oral histories contain important messages
for our leaders of today, at all levels, including
that government, industry, and academia can
accomplish great things when working together in
an effective way.

118 COM MUNICATIO NS O F TH E AC M | M AY 201 8 | VO L . 61 | NO. 5

 last byte

[ C ONTI N U E D FRO M P. 120] And the covers, had all but fallen apart. I tore a
policy? Not a word. page trying to zoom it.
“Worse than I expected,” I said. The A to Z, all dog- Irene released a folding table from
“Yes,” said Clarkson. “It’s always eared pages and the wall, with a bang that echoed.
worse than you expect, and it’ll go on “Now, lad,” she said, “let’s see what
getting worse.” Sellotaped covers, you’ve got.”
I shrugged. “What can we do?” had all but fallen I opened the briefcase and heaved out
Clarkson leaned closer. “Here’s the two thick stacks of A4 that crammed
what you can do. Keep that card. Check apart. I tore a page it. Irene put on reading glasses and
out the reference on your father’s trying to zoom it. peered at a few sheets, tilting them this
maps. Don’t, whatever you do, look way and that.
it up online. Borrow the map, or buy “Typed on a typewriter,” she said
your own copy—in a shop, with cash. approvingly, “with handwritten cor-
See if your dad has an A to Z of the old rections. This is the real thing all
hometown. Borrow that, and arrange right.” She indicated a corner in
to borrow your father’s car at short no- which an electric kettle and some
tice. Ten days before the next election, Even I knew what that was—a hu- mugs sat on an old chair. “Make your-
you’ll get a delivery. Take the package man version of a workplace rights app. self a cup of tea, and I’ll go let the lads
and sign for it. Inside will be a brief- “Oh,” I said. “More than I need to and lasses in.”
case, quite heavy. Tell your partner that know?” The “lads and lasses” turned out to
you have to go away for a couple of days. “Why?” be four old men and two old women,
Leave your phone at home . . . ” “Security.” who set about their work. Within two
“What?” I said. She shot me a look as she turned a hours, the press was rolling.
“That’s crucial,” said Clarkson. key in the lock of a steel door. It took me a little longer to under-
“Better yet, leave it with your partner, “Don’t be daft, lad. Now put both stand what was going on.
or a friend who lives locally, and ask hands to this and give it a push.” A week later a woman I knew from
them to carry it around.” I set the briefcase down on the floor, the Party hammered on my door at an
“But I’d be lost without it!” and shoved. The hinges were well ungodly hour.
“Exactly,” said Clarkson. “That’s the oiled, but the door was heavy. It swung “Out,” she said. “Station. Now.”
point. Go to the map reference. Near- open and I followed her in. Ancient Her car was overloaded with news-
by, you’ll see a big old oak tree. Look fluorescents flickered on overhead. papers. She dropped me off at the
among the roots, and go to the address The chamber was large. What wasn’t station with a bundle to give away to
you find there.” stacked with oil-drum-size rolls of pa- anyone who would take a copy. At ev-
“And then?” per and barrels of ink was occupied by ery station and shopping center in
“Hand over the briefcase, and go a machine of blue-anodized steel with the country, others would be doing
home.” dials and rotary handles, alongside a the same. We’d blanket the land with
This sounded far too much like a row of cabinets. The air smelled of old paper—leaflets, newssheets, posters,
drug or bomb delivery for my liking. I concrete and oil. placards—whose production and dis-
said as much. The door clicked shut behind me. tribution owed nothing to the net.
“If you’re worried,” said Clarkson, “What is this?” I had a shock when I jumped
“phone the Leader’s office and ask for “A printing press,” said Irene, scorn- out of the car. Our opponents had a
me. You’ll get a reply: ‘He’s sound.’ If fully. team already at the station, handing
you’re happy with that, put the phone “I mean, what is this place?” out copies of their free newspaper.
down. If not, insist on speaking to me. “Part of the old Regional Seats of They’d had the same idea. Or we’d
You won’t get through to me, and you’ll Government network. Mothballed and had a leak, our elaborate precautions
never hear of this again.” sold off. We bought it. Underground all for naught.
Two days later, I phoned, and put print shop, left over from the last Cold My fury faded. It didn’t matter.
the phone down on the reply. War.” Now they had to fight us on the same
Whatever this was, I was in. “And now in use in the current one?” ground—and the ground was level.
“Something like that. D’you get here We lost that election, but we got de-
# # # all right?” mocracy back.
“Yes, fine,” I said, untruthfully.
“I used to be father of the chapel,” Clarkson’s map reference had tak- Ken MacLeod (kenneth.m.macleod@gmail.com) is the
author of 17 novels, from The Star Fraction (Orbit Books,
Irene confided as she hurried along the en me to a moorland crossroads. I’d London, 1995) to The Corporation Wars: Emergence
tramped to the nearest lonely tree, (Orbit Books, London, 2018). He blogs at The Early Days
dim-lit concrete corridor. For a woman of a Better Nation (http://kenmacleod.blogspot.com) and
in her 90s, she was remarkably quick where I’d found a tobacco tin so old it tweets as @amendlocke.
on her feet. didn’t have a health warning. Inside
“The what?” I said. was a scrap of paper, with handwrit-
“In the print union, it’s what we ten address and postcode. The A to Z,
called the branch secretary.” all dog-eared pages and Sellotaped © 2018 ACM 0001-0782/18/05 $15.00

MAY 2 0 1 8 | VO L. 6 1 | N O. 5 | C OM M U N IC AT ION S OF T H E ACM 119

last byte

From the intersection of computational science and technological speculation,

with boundaries limited only by our ability to imagine what could be.

DOI:10.1145/3197548 Ken MacLeod

Future Tense
Free Press
When all online news and comment can be digitally manipulated,
some might recall a more trustworthy way to spread the word.

I BARELY RECOGNIZED Clarkson. He would

have been the last of my high school ac-
quaintances I’d have expected to meet
at a Party event—some policy-launch
shindig, all tepid canapés, foul coffee,
and wobbly display boards—but there he
was, 10 years older. Trim beard, sharp tie.
“Oh, by the way,” he said, after the
mutual reintroductions, “is your old
man still in the Ramblers?”
“He stretches his legs on the moors
occasionally,” I said.
Clarkson put down his formerly
fizzy water and stepped forward.
“He still has a car?”
“Uh huh.”
“And … let me think … he hails
from”—Clarkson named a Northern
industrial town—“doesn’t he?”
“Yeah,” I said.
“Great, great!” Clarkson rubbed his
hands, and stepped forward again. “I
have something for you.”
He passed me a business card. It
predictably proclaimed him a “busi- “Profile?” I gave him a suspicious “Sorry,” he said, not shifting. “We
ness consultant.” look. “What’s all this about?” need to talk. Quickly and quietly.”
“Turn it over,” said Clarkson. Throughout, Clarkson had been “OK,” I said, still wary.
A string of numbers and letters, backing me into a corner. I didn’t like Clarkson waved vaguely behind his
inked carefully—an Ordnance Survey it, and let him know. shoulder. Half a dozen people here
map reference. were reporters, their head-mounted
“What does that—?” camera-mics discreetly hidden by stra-
“Just slip the card in your shirt pock- “It’s always worse tegic locks of hair. “Take a look at this
IMAGE BY AND RIJ BORYS ASSOCIAT ES/SHUT TERSTOCK

et,” said Clarkson. event on your phone,” he said.

I backed off a little. I could smell the than you expect, “Oh, I know what to expect,” I said.
last thing he’d eaten, a wafer of damp and it’ll go on “No, really.”
oatcake with a dab of hummus and a I searched on the hashtag for the
sliver of smoked salmon. getting worse.” event. It brought up two sex scandals,
“You know how to read it?” he said. a corruption allegation, an embar-
“Sure,” I said. “My dad has a book- rassing social media post by one of
case full of OS maps.” the speakers from when she was 12
Clarkson’s cheek twitched. “Fits the years old, and a dubious link to an oil
profile.” company. [C O NTINUED O N P. 119]

120 COMM UNICATIO NS O F T H E ACM | M AY 201 8 | VO L . 61 | NO. 5

 Connect with our
Community of Reviewers

“I like CR because it covers the full

spectrum of computing research, beyond the
comfort zone of one’s specialty. I always
look forward to the next Editor’s Pick to get
a new perspective.”
- Alessandro Berni
ThinkLoud

www.computingreviews.com