Little Brother

Marcus, a.k.a ?w1n5t0n,? is only seventeen years old, but he figures he already knows how the system works?and how to work the system. Smart, fast, and wise to the ways of the networked world, he has no trouble outwitting his high school's intrusive but clumsy surveillance systems.

Cory Doctorow is a coeditor of Boing Boing and the former European director of the Electronic Frontier Foundation. He writes columns for Make, Information Week, the Guardian online, and Locus. He has won the Locus Award three times, been nominated for the Hugo and the Nebula, won the Campbell Award, and was named one of the Web’s twenty-five influencers by Forbes magazine and a Young Global Leader by the World Economic Forum. He hopes you’ll use technology to change the world.

Chapter 1

I’m a senior at Cesar Chavez, High in San Francisco’s sunny Mission district, and that makes me one of the most surveilled people in the world. My name is Marcus Yallow, but back when this story starts, I was going by w1n5t0n. Pronounced "Winston."

Not pronounced "Double-you-one-enn-five-tee-zero-enn"— unless you’re a clueless disciplinary officer who’s far enough behind the curve that you still call the Internet "the information superhighway."

I know just such a clueless person, and his name is Fred Benson, one of three vice-principals at Cesar Chavez. He’s a sucking chest wound of a human being. But if you’re going to have a jailer, better a clueless one than one who’s really on the ball.

"Marcus Yallow," he said over the PA one Friday morning. The PA isn’t very good to begin with, and when you combine that with Benson’s habitual mumble, you get something that sounds more like someone struggling to digest a bad burrito than a school announcement. But human beings are good at picking their names out of audio confusion—it’s a survival trait.

I grabbed my bag and folded my laptop three-quarters shut—I didn’t want to blow my downloads—and got ready for

the inevitable.

"Report to the administration office immediately."

My social studies teacher, Ms. Galvez, rolled her eyes at me and I rolled my eyes back at her. The Man was always coming down on me, just because I go through school firewalls like wet kleenex, spoof the gait-recognition software, and nuke the snitch chips they track us with. Galvez is a good type, anyway, never holds that against me (especially when I’m helping get with her webmail so she can talk to her brother who’s stationed in Iraq).

My boy Darryl gave me a smack on the ass as I walked past. I’ve known Darryl since we were still in diapers and escaping from play-school, and I’ve been getting him into and out of trouble the whole time. I raised my arms over my head like a prizefighter and made my exit from Social Studies and began the perp-walk to the office.

I was halfway there when my phone went. That was another no-no—phones are muy prohibido at Chavez High—but why should that stop me? I ducked into the toilet and shut myself in the middle stall (the farthest stall is always grossest because so many people head straight for it, hoping to escape the smell and the squick—the smart money and good hygiene is down the middle). I checked the phone—my home PC had sent it an email to tell it that there was something new up on Harajuku Fun Madness, which happens to be the best game ever invented.

I grinned. Spending Fridays at school was teh suck anyway, and I was glad of the excuse to make my escape.

I ambled the rest of the way to Benson’s office and tossed him a wave as I sailed through the door.

"If it isn’t Double-you-one-enn-five-tee-zero-enn," he said. Fredrick Benson—Social Security number 545–03–2343, date of birth August 15 1962, mother’s maiden name Di Bona, hometown Petaluma—is a lot taller than me. I’m a runty 5'8", while he stands 6'7", and his college basketball days are far enough behind him that his chest muscles have turned into saggy man-boobs that were painfully obvious through his freebie dot-com polo shirts. He always looks like he’s about to slam-dunk your ass, and he’s really into raising his voice for dramatic effect. Both these start to lose their efficacy with repeated application.

"Sorry, nope," I said. "I never heard of this R2D2 character of yours."

"W1n5t0n," he said, spelling it out again. He gave me a hairy eyeball and waited for me to wilt. Of course it was my handle, and had been for years. It was the identity I used when I was posting on message boards where I was making my contributions to the field of applied security research. You know, like sneaking out of school and disabling the minder-tracer on my phone. But he didn’t know that this was my handle. Only a small number of people did, and I trusted them all to the end of the earth.

"Um, not ringing any bells," I said. I’d done some pretty cool stuff around school using that handle—I was very proud of my work on snitch-tag killers—and if he could link the two identities, I’d be in trouble. No one at school ever called me w1n5t0n or even Winston. Not even my pals. It was Marcus or nothing.

Benson settled down behind his desk and tapped his class ring nervously on his blotter. He did this whenever things started to go bad for him. Poker players call stuff like this a "tell"— something that lets you know what’s going on in the other guy’s head. I knew Benson’s tells backwards and forwards.

"Marcus, I hope you realize how serious this is."

"I will just as soon as you explain what this is, sir." I always say "sir" to authority figures when I’m messing with them. It’s my own tell.

He shook his head at me and looked down, another tell. Any second now, he was going to start shouting at me. "Listen, kiddo! It’s time you came to grips with the fact that we know about what you’ve been doing, and that we’re not going to be lenient about it. You’re going to be lucky if you’re not expelled before this meeting is through. Do you want to graduate?"

"Mr. Benson, you still haven’t explained what the problem is—"

He slammed his hand down on the desk and then pointed his finger at me. "The problem, Mr. Yallow, is that you’ve been engaged in criminal conspiracy to subvert this school’s security system, and you have supplied security countermeasures to your fellow students. You know that we expelled Graciella Uriarte last week for using one of your devices." Uriarte had gotten a bad rap. She’d bought a radio-jammer from a head shop near the 16th Street BART station and it had set off the countermeasures in the school hallway. Not my doing, but I felt for her.

"And you think I’m involved in that?"

"We have reliable intelligence indicating that you are w1n5t0n"—again, he spelled it out, and I began to wonder if he hadn’t figured out that the 1 was an I and the 5 was an S. "We know that this w1n5t0n character is responsible for the theft of last year’s standardized tests." That actually hadn’t been me, but it was a sweet hack, and it was kind of flattering to hear it attributed to me. "And therefore liable for several years in prison unless you cooperate with me."

"You have ‘reliable intelligence’? I’d like to see it."

He glowered at me. "Your attitude isn’t going to help you."

"If there’s evidence, sir, I think you should call the police and turn it over to them. It sounds like this is a very serious matter, and I wouldn’t want to stand in the way of a proper investigation by the duly constituted authorities."

"You want me to call the police."

"And my parents, I think. That would be for the best."

We stared at each other across the desk. He’d clearly expected me to fold the second he dropped the bomb on me. I don’t fold. I have a trick for staring down people like Benson. I look slightly to the left of their heads, and think about the lyrics to old Irish folk songs, the kind with three hundred verses. It makes me look perfectly composed and unworried.

And the wing was on the bird and the bird was on the egg and the egg was in the nest and the nest was on the leaf and the leaf was on the twig and the twig was on the branch and the branch was on the limb and the limb was in the tree and the tree was in the bog—the bog down in the valley-oh! High-ho the rattlin’ bog, the bog down in the valley-oh—

"You can return to class now," he said. "I’ll call on you once the police are ready to speak to you."

"Are you going to call them now?"

"The procedure for calling in the police is complicated. I’d hoped that we could settle this fairly and quickly, but since you insist—"

"I can wait while you call them is all," I said. "I don’t mind."

He tapped his ring again and I braced for the blast.

"Go!" he yelled. "Get the hell out of my office, you miserable little—"I got out, keeping my expression neutral. He wasn’t going to call the cops. If he’d had enough evidence to go to the police with, he would have called them in the first place. He hated my guts. I figured he’d heard some unverified gossip and hoped to spook me into confirming it.

I moved down the corridor lightly and sprightly, keeping my gait even and measured for the gait-recognition cameras. These had been installed only a year before, and I loved them for their sheer idiocy. Beforehand, we’d had face-recognition cameras covering nearly every public space in school, but a court ruled that was unconstitutional. So Benson and a lot of other paranoid school administrators had spent our textbook dollars on these idiot cameras that were supposed to be able to tell one person’s walk from another. Yeah, right.

I got back to class and sat down again, Ms. Galvez warmly welcoming me back. I unpacked the school’s standard-issue machine and got back into classroom mode. The SchoolBooks were the snitchiest technology of them all, logging every keystroke, watching all the network traffic for suspicious keywords, counting every click, keeping track of every fleeting thought you put out over the net. We’d gotten them in my junior year, and it only took a couple months for the shininess to wear off. Once people figured out that these "free" laptops worked for the man—and showed a never-ending parade of obnoxious ads to boot—they suddenly started to feel very heavy and burdensome.

Cracking my SchoolBook had been easy. The crack was online within a month of the machine showing up, and there was nothing to it—just download a DVD image, burn it, stick it in the SchoolBook, and boot it while holding down a bunch of different keys at the same time. The DVD did the rest, installing a whole bunch of hidden programs on the machine, programs that would stay hidden even when the Board of Ed did its daily remote integrity checks of the machines. Every now and again I had to get an update for the software to get around the Board’s latest tests, but it was a small price to pay to get a little control over the box.

I fired up IMParanoid, the secret instant messenger that I used when I wanted to have an off-the-record discussion right in the middle of class. Darryl was already logged in.

> The game’s afoot! Something big is going down with Harajuku Fun Madness, dude. You in?

> No. Freaking. Way. If I get caught ditching a third time, I’m expelled. Man, you know that. We’ll go after school.

> You’ve got lunch and then study hall, right? That’s two hours. Plenty of time to run down this clue and get back before anyone misses us. I’ll get the whole team out.

Harajuku Fun Madness is the best game ever made. I know I already said that, but it bears repeating. It’s an ARG, an Alternate Reality Game, and the story goes that a gang of Japanese fashion-teens discovered a miraculous healing gem at the temple in Harajuku, which is basically where cool Japanese teenagers invented every major subculture for the past ten years. They’re being hunted by evil monks, the Yakuza (aka the Japanese mafia), aliens, tax inspectors, parents, and a rogue artificial intelligence. They slip the players coded messages that we have to decode and use to track down clues that lead to more coded messages and more clues.

Imagine the best afternoon you’ve ever spent prowling the streets of a city, checking out all the weird people, funny handbills, street maniacs, and funky shops. Now add a scavenger hunt to that, one that requires you to research crazy old films and songs and teen culture from around the world and across time and space. And it’s a competition, with the winning team of four taking a grand prize of ten days in Tokyo, chilling on Harajuku bridge, geeking out in Akihabara, and taking home all the Astro Boy merchandise you can eat. Except that he’s called "Atom Boy" in Japan.

That’s Harajuku Fun Madness, and once you’ve solved a puzzle or two, you’ll never look back.

> No man, just no. NO. Don’t even ask.

> I need you D. You’re the best I’ve got. I swear I’ll get us in and out without anyone knowing it. You know I can do that, right?

>I know you can do it

>So you’re in?

>Hell no

>Come on, Darryl. You’re not going to your deathbed wishing you’d spent more study periods sitting in school

> I’m not going to go to my deathbed wishing I’d spent more time playing ARGs either

> Yeah but don’t you think you might go to your deathbed wishing you’d spent more time with Vanessa Pak?

Van was part of my team. She went to a private girl’s school in the East Bay, but I knew she’d ditch to come out and run the mission with me. Darryl has had a crush on her literally for years—even before puberty endowed her with many lavish gifts. Darryl had fallen in love with her mind. Sad, really.

> You suck

> You’re coming?

He looked at me and shook his head. Then he nodded. I winked at him and set to work getting in touch with the rest of my team.

I wasn’t always into ARGing. I have a dark secret: I used to be a LARPer. LARPing is Live Action Role Playing, and it’s just about what it sounds like: running around in costume, talking in a funny accent, pretending to be a superspy or a vampire or a medieval knight. It’s like Capture the Flag in monster-drag, with a bit of Drama Club thrown in, and the best games were the ones we played in Scout Camps out of town in Sonoma or down on the Peninsula. Those three-day epics could get pretty hairy, with all-day hikes, epic battles with foam-and-bamboo swords, casting spells by throwing beanbags and shouting "Fireball!" and so on. Good fun, if a little goofy. Not nearly as geeky as talking about what your elf planned on doing as you sat around a table loaded with Diet Coke cans and painted miniatures, and more physically active than going into a mouse-coma in front of a massively multiplayer game at home.

The thing that got me into trouble were the minigames in the hotels. Whenever a science fiction convention came to town, some LARPer would convince them to let us run a couple of six-hour minigames at the con, piggybacking on their rental of the space. Having a bunch of enthusiastic kids running around in costume lent color to the event, and we got to have a ball among people even more socially deviant than us.

The problem with hotels is that they have a lot of nongamers in them, too—and not just sci-? people. Normal people. From states that begin and end with vowels. On holidays.

And sometimes those people misunderstand the nature of a game.

Let’s just leave it at that, okay?

Class ended in ten minutes, and that didn’t leave me with much time to prepare. The first order of business was those pesky gait-recognition cameras. Like I said, they’d started out as face-recognition cameras, but those had been ruled unconstitutional. As far as I know, no court has yet determined whether these gait-cams are any more legal, but until they do, we’re stuck with them.

"Gait" is a fancy word for the way you walk. People are pretty good at spotting gaits—next time you’re on a camping trip, check out the bobbing of the flashlight as a distant friend approaches you. Chances are you can identify him just from the movement of the light, the characteristic way it bobs up and down that tells our monkey brains that this is a person approaching us.

Gait-recognition software takes pictures of your motion, tries to isolate you in the pics as a silhouette, and then tries to match the silhouette to a database to see if it knows who you are. It’s a biometric identifier, like fingerprints or retina-scans, but it’s got a lot more "collisions" than either of those. A biometric "collision" is when a measurement matches more than one person. Only you have your fingerprint, but you share your gait with plenty other people.

Not exactly, of course. Your personal, inch-by-inch walk is yours and yours alone. The problem is your inch-by-inch walk changes based on how tired you are, what the floor is made of, whether you pulled your ankle playing basketball, and whether you’ve changed your shoes lately. So the system kind of fuzzes out your profile, looking for people who walk kind of like you.

There are a lot of people who walk kind of like you. What’s more, it’s easy not to walk kind of like you—just take one shoe off. Of course, you’ll always walk like you-with-one-shoe-off in that case, so the cameras will eventually figure out that it’s still you. Which is why I prefer to inject a little randomness into my attacks on gait-recognition: I put a handful of gravel into each shoe. Cheap and effective, and no two steps are the same. Plus you get a great reflexology foot massage in the process. (I kid. Reflexology is about as scientifically useful as gait-recognition.)

The cameras used to set off an alert every time someone they didn’t recognize stepped onto campus.

This did not work.

The alarm went off every ten minutes. When the mailman came by. When a parent dropped in. When the groundspeople went to work fixing up the basketball court. When a student showed up wearing new shoes.

So now it just tries to keep track of who’s where, when. If someone leaves by the school gates during classes, their gait is checked to see if it kinda-sorta matches any student gait and if it does, whoop-whoop-whoop, ring the alarm!

Chavez High is ringed with gravel walkways. I like to keep a couple handsful of rocks in my shoulder bag, just in case. I silently passed Darryl ten or fifteen pointy little bastards and we both loaded our shoes.

Class was about to finish up—and I realized that I still hadn’t checked the Harajuku Fun Madness site to see where the next clue was! I’d been a little hyperfocused on the escape, and hadn’t bothered to figure out where we were escaping to.

I turned to my SchoolBook and hit the keyboard. The web browser we used was supplied with the machine. It was a locked-down spyware version of Internet Explorer, Microsoft’s crash-ware turd that no one under the age of forty used voluntarily.

I had a copy of Firefox on the USB drive built into my watch, but that wasn’t enough—the SchoolBook ran Windows Vista4Schools, an antique operating system designed to give school administrators the illusion that they controlled the programs their students could run.

But Vista4Schools is its own worst enemy. There are a lot of programs that Vista4Schools doesn’t want you to be able to shut down—keyloggers, censorware—and these programs run in a special mode that makes them invisible to the system. You can’t quit them because you can’t even see they’re there.

Any program whose name starts with $SYS$ is invisible to the operating system. It doesn’t show up on listings of the hard drive, nor in the process monitor. So my copy of Firefox was called $SYS$Firefox—and as I launched it, it became invisible to Windows, and thus invisible to the network’s snoopware.

Now that I had an indie browser running, I needed an indie network connection. The school’s network logged every click in and out of the system, which was bad news if you were planning on surfing over to the Harajuku Fun Madness site for some extracurricular fun.

The answer is something ingenious called TOR—The Onion Router. An onion router is an Internet site that takes requests for web pages and passes them onto other onion routers, and on to other onion routers, until one of them finally decides to fetch the page and pass it back through the layers of the onion until it reaches you. The traffic to the onion routers is encrypted, which means that the school can’t see what you’re asking for, and the layers of the onion don’t know who they’re working for. There are millions of nodes—the program was set up by the U.S. Office of Naval Research to help their people get around the censorware in countries like Syria and China, which means that it’s perfectly designed for operating in the confines of an average American high school.

TOR works because the school has a finite blacklist of naughty addresses we aren’t allowed to visit, and the addresses of the nodes change all the time—no way could the school keep track of them all. Firefox and TOR together made me into the invisible man, impervious to Board of Ed snooping, free to check out the Harajuku FM site and see what was up.

There it was, a new clue. Like all Harajuku Fun Madness clues, it had a physical, online and mental component. The online component was a puzzle you had to solve, one that required you to research the answers to a bunch of obscure questions. This batch included a bunch of questions on the plots in do¯jinshi—those are comic books drawn by fans of manga, Japanese comics. They can be as big as the official comics that inspire them, but they’re a lot weirder, with crossover storylines and sometimes really silly songs and action. Lots of love stories, of course. Everyone loves to see their favorite toons hook up.

I’d have to solve those riddles later, when I got home. They were easiest to solve with the whole team, downloading tons of do¯jinshi files and scouring them for answers to the puzzles.

I’d just finished scrap-booking all the clues when the bell rang and we began our escape. I surreptitiously slid the gravel down the side of my short boots—ankle-high Blundstones from Australia, great for running and climbing, and the easy slip-on/slip-off laceless design makes them convenient at the never-ending metal detectors that are everywhere now.

We also had to evade physical surveillance, of course, but that gets easier every time they add a new layer of physical snoopery— all the bells and whistles lull our beloved faculty into a totally false sense of security. We surfed the crowd down the hallways, heading for my favorite side-exit. We were halfway along when Darryl hissed, "Crap! I forgot, I’ve got a library book in my bag."

"You’re kidding me," I said, and hauled him into the next bathroom we passed. Library books are bad news. Every one of them has an arphid—Radio Frequency ID tag—glued into its binding, which makes it possible for the librarians to check out the books by waving them over a reader, and lets a library shelf tell you if any of the books on it are out of place.

But it also lets the school track where you are at all times. It was another of those legal loopholes: the courts wouldn’t let the schools track us with arphids, but they could track library books, and use the school records to tell them who was likely to be carrying which library book.

I had a little Faraday pouch in my bag—these are little wallets lined with a mesh of copper wires that effectively block radio energy, silencing arphids. But the pouches were made for neutralizing ID cards and toll-book transponders, not books like—

"Introduction to Physics?" I groaned. The book was the size of a dictionary.

Excerpted from Little Brother by Cory Doctorow

Copyright © 2008 by Cory Doctorow

Published in May 2008 by Tom Doherty Associates, LLC

All rights reserved. This work is protected under copyright laws and reproduction is strictly prohibited. Permission to reproduce the material in any manner or medium must be secured from the Publisher.