A sepia tone of what seems to a young Black girl with her eyes covered by a black rectangle (censor style) with white letters reading "Don't Believe The Hype (remix)"

Beware the AI Hype Cycle

In the months I been seeking my next job in nonprofit tech, I’ve learned that the sector is quite invested in using AI right now. There are so many important applications of LLMs and machine learning, in fact we’ve all been using it for years to do things like sorting our inboxes, analyzing complex data, finding the perfect digital asset for a specific purpose, and showing the perfect next video for our interests. I don’t want to give those things up. (OK, maybe that last one sometimes.)

Frankly, I worry that seeming critical of AI will negatively impact my employment prospects, but there’s a reason that I have a reputation as a trustworthy and ethical tech leader. And I hope that there are still organizations that would rather have an honest technologist instead of one that never challenges them. There are real benefits but we have to tell the truth about the fact that there are also real harms to our organizations, our communities, and our planet from reliance on AI.

I suspect the current normalization of generative AI as simply part of how we all work now is much more based in marketing hype than practical nonprofit sector experience. I learned about the AI hype cycle from researchers like Timnit Gebru and Emily Bender. I’ve been following them since 2021 when Gebru and others were fired from Google’s AI ethics team when their bosses objected to their groundbreaking co-authored paper on LLMs called “On the Dangers of Stochastic Parrots: Can Language Models Be Too Big? 🦜“.

The adoption that big tech wants us to believe is “inevitable” is much more driven by the fact that companies are cramming it in to every piece of software whether users want them to not. Business experts have made it clear that Big Tech is over leveraged in the AI sector. If we don’t use it enough, they don’t make the profit they need. We don’t need AI to survive as much as it needs us to live.

In their latest article, Bender and Gebru once again bring us back down to earth:

The AI industry has even suggested that popular, bipartisan anti-data-center activism is a “distraction” from attempts to regulate the impending, scary, “superhuman” machines these companies are building. According to the AI industry, we should be more worried about a fictional machine god than about the climate catastrophe that these data centers exacerbate, the asthma suffered by those living near them, the rising electricity bills of the public subsidizing them, or the water that is redirected to cooling them.

– Don’t be fooled by this summer of AI hype, 9/22/26

As nonprofits and community-oriented people continue to learn and experiment with AI, it’s essential that we stay focused on the real requirements of our missions and the real consequences of our choices. As Flava Flav taught us, don’t believe the hype!

A closeup of art that has tiny mirrors with circles cut out woven into a chainlink fence

A human starts the loop, a human can stop it

In the social good side of the tech world (hashtag nptech), I hear people and institutions talk about the necessity of having “a human in the loop” when working with AI. This usually means that a responsible person reviews output from an LLM before it gets out in the wild. This is a low standard, but it’s not wrong. I hope to see more discussion of what having a human in the loop means for agentic AI, which is generally sold to us as a way to reduce human labor (for better or worse).

But let’s be serious. Humans need to be more than “in the loop.” Humans need to be held accountable for the results of their actions. Software does not build itself. Agents do not tell themselves when to run. When we talk about these tools as if they “went rogue” and “hacked into” things, we are removing the humans that built the tool, configured the sandbox, and gave the instructions.

AI is not people (nor are corporations but that’s another rant). As written in a 1979 IBM training manual, “A computer can never be held accountable, therefore a computer must never make a management decision.”

Software can’t be bound by the law, but its creators can and they must.

Simplified illustration of elder elephants protecting small ones as they cross a river.

Accessible resources for safety & security

Today I want to share three excellent guides for keeping your self and your community safe. I love how they use clear language and understandable images to convey information. I’ve had these tabs open in my browser for months so I figured I should post there here so I’ll always know where to find them.

My absolute favorite is this zine by the Climate Defense Project that uses elephants to teach about security culture. Developing a culture of good safety practices is one of the most important things any organization or group can do. More than rules about which tools to use and how, this enables people to make good choices and be aware of how their actions impact others who may be more vulnerable.

Continue reading “Accessible resources for safety & security” →
AI Framework for an Equitable World NTEN

A much-needed AI framework for a more equitable world

Since losing my job in a round of budget-cutting layoffs at MomsRising (where I spent 10 years building web sites, IT systems, security protocols, and trainings) I have been seeking a new opportunity to help a progressive organization or campaign to more effectively use technology in support of grassroots organizing for political change. One of the things I have found in every CTO and IT Director position I see is that everyone wants to use AI now, but not everyone is sure why or how.

I am so grateful to have received a scholarship to enroll in classes to earn NTEN’s AI for Nonprofits Professional Certificate. I have been following the discussion around AI safety and ethics for many years, including as MomsRising’s Senior Director of Internal Technology and Security. This certificate program is giving me more practical tools for how to create and guide AI applications that can serve movement organizing while still staying true to our progressive values like justice, equality, and mutual care.

This week, I took a class created by Amy Sample Ward and Tristan Penn about the AI Framework for an Equitable World that was created in a community process led by NTEN in 2023. I greatly appreciate this approach which shows how assessment and impact are essential, on-going elements of any AI intervention. Below is a diagram of the framework. This is exactly the type of useful resource that I and any nonprofit IT leader can use to develop tools and processes that are both more effective and less harmful. I look forward to putting this into use soon!

AI Framework for an Equitable World. 

A diagram with 3 connected loops. 

Assessment: Input, outcomes, accountability 

Impact: Individual, organization, system 

Intervention: Design, develop, deploy

Learn more and download the full report at https://www.nten.org/posts/publication/artificial-intelligence-framework-for-an-equitable-world

screenshot of 15 domains that are spoofs of lotusmedia.org

An easy way to reduce the ability of scammers to spoof your domain

I recently participated in NTEN‘s new cybersecurity community, and learned about this wonderful easy tool called DNStwist. All you have to do is enter your own domain name (eg: lotusmedia.org in my case) and it scans global domain registries for common variations designed to trick a reader into thinking it’s your domain.

A very common phishing technique is to send an e-mail seeming to be from your organization that sends people to what seems like your website. Both the e-mail address and URL might look almost exactly like yours, especially to someone who is not paying attention. Often scammers will add an element of urgency which adds to the user’s confusion and lead them to take action before thinking it through clearly.

After running this scan which shows 15 domains spoofing mine, my next step as an organization would be to block all of these addresses from e-mailing anyone in my workspace. Unfortunately I don’t have any way to stop an external internet user from visiting and mistaking one of these sites for mine. So be alert and make sure you always know who is behind what you’re looking at!

Continue reading “An easy way to reduce the ability of scammers to spoof your domain” →
DrupalCon 2016 group photo - I'm in there somewhere

An Open Web for Who?

In the Drupal community we’re hearing the term “Open Web” being used a lot lately. The Pantheon hosting service has used it to justify their platforming hate groups such as the “Alliance Defending Freedom.”

And now the Drupal Association has issued their own Open Web Manifesto which specifically references inclusion and diversity as requirements while expressing no awareness or concern about how the “Open Web” is being used as a dog whistle for free speech absolutists that don’t mind seeing many of us marginalized, attacked, and pushed out of the community.

Continue reading “An Open Web for Who?” →

RIP Twitter

I have been using Twitter actively since 2006 and have had the best of times as well as the worst of times there. It’s very likely to stop existing as we know it very soon, which is a real shame. It didn’t have to be that way. I would like to write more about what it’s meant to me and the world but for now I want to share this urgent advice that I wrote up for my colleagues this morning.

The Twitter situation is not a drill. It could stop working at any moment, and until it does the nastiest trolls will be running amok. I recommend you do a few things on your personal accounts:

  • Put alternate ways for people to follow you in your bio. Could be Instagram, Facebook, Mastodon, TikTok, Tumblr, Discord, whatever.
  • Turn on 2-factor authentication if you haven’t already. You must use an app (like 1Password or Google Authenticator) and not SMS to authenticate. Also enable Password reset protect.
  • Request an archive of your Twitter data. You will have to authenticate for this by e-mail and not SMS. It can take a day or two but you’ll get an e-mail when it’s ready to download.
  • Consider making your tweets private so that you have to manually approve new followers.
  • You may want to deactivate your account, but DO NOT DELETE it. That could allow others to take your old name.
  • Even if you’re not signed up for Mastodon, run this FediFinder tool and download a list of your follows’ addresses on Mastodon and other federated services. (You can decide whether to use it later.)

Am I hacked again?

UPDATE: Hackers attempted to take over my domain but didn’t quite get away with it this time. Dreamhost was much more helpful this time than when I was attacked in 2013.

I’m 99% sure that my domain hosting and Twitter account are under attack right now. I can’t access either account and this is almost exactly what happened in 2013 when someone hacked half a dozen of my online accounts so he could get into @ruby thinking he could sell it on a hacker forum. This didn’t go well for him, but it was also an enormous pain in the ass for me.

You can see the whole story starting here: https://lotusmedia.org/tag/hacked/page/5

Five things that Drupal site builders need developers to know

This weekend I was pleased to present a brand new talk at DrupalCamp Asheville. I’ve been wanting to attend this camp for years since it’s the only one in North Carolina. This year my calendar was finally open and I was planning to attend in person, but of course that was not meant to be.

Many Drupal developers consider site builders to be one of the most important types of users they are building for. The project lead regularly talks about how to “Improve the site builder experience” in his state-of-Drupal keynotes. But how well do developers really understand site builders and what we do? I put together this presentation to help people understand the realities and constraints of being a site builder.

Below is a video of the talk. It’s only about 35 minutes long. This was my first time presenting it. If I do this talk again in the future I’ll include more examples to illustrate each point.

https://www.drupalasheville.com/2020/session/five-things-site-builders-need-developers-know

Mapping police brutality

I’m sure this only scratches the surface because it only tracks incidents of police violence that are reported on Twitter but I really appreciate folks (including Durham lawyer Greg Doucette) for putting this together.

See also The Guardian‘s site The Counted, which they created to track police killings in 2015 because no-one else was even doing it.