Comment by withinrafael | Hacker News Reader

Comment by withinrafael | Hacker News Reader

Additional details are present in the unpublished rule (document 2019-27649 [1][2]).

-- cut --

Geospatial imagery “software” “specially designed” for training a Deep Convolutional Neural Network to automate the analysis of geospatial imagery and point clouds, and having all of the following:

1. Provides a graphical user interface that enables the user to identify objects (e.g., vehicles, houses, etc.) from within geospatial imagery and point clouds in order to extract positive and negative samples of an object of interest;

2. Reduces pixel variation by performing scale, color, and rotational normalization on the positive samples;

3. Trains a Deep Convolutional Neural Network to detect the object of interest from the positive and negative samples; and

4. Identifies objects in geospatial imagery using the trained Deep Convolutional Neural Network by matching the rotational pattern from the positive samples with the rotational pattern of objects in the geospatial imagery.

Technical Note: A point cloud is a collection of data points defined by a given coordinate system. A point cloud is also known as a digital surface model.

-- cut --

[1] https://www.federalregister.gov/documents/2020/01/06/2019-27...

[2] https://s3.amazonaws.com/public-inspection.federalregister.g...

The export ban is on the software? Not the algorithm itself? And would it be broad enough that all AI and QI frameworks like PyTorch, Tensorflow and Qiskit would fall under its purview.

These restrictions seem to flow from a mental model that still views software as a product purchased in a shrink-wrapped box. Rather than the services based model currently extant.

That is the point, to delay the adversary from gaining access to completed technology. An example is foreign adversaries purchasing PS3s with Linux to quickly access cheap computing power.

Whether frameworks are at risk is limited to the wording of the ban and then the final determination comes from a judge hearing the case. The chilling effects are real and its possible framework development may very well be hampered due to the unknowns you have pointed out in your post

The PS3 thing is a contrived example or this really was happening?

Real! Check out number 1 here: https://www.visualcompliance.com/blog/?p=185

Cool, thanks. I will check it out!

And would it be broad enough that all AI and QI frameworks like PyTorch, Tensorflow and Qiskit would fall under its purview.

No.

They look like they are targeting a specific piece of commercial software.

An algorithm is an idea and it's hard to enforce ideas from spreading. Similar to how it is difficult to patent an algorithm. In the patent world you would have better luck tying that algo to a machine and patenting that.

I think the same concept applies here. Software is the machine that embodies the algorithm. Its tied to a company and to dollars.

What this will also mean is that startups that work in this space will need to watch out who they get funding from. If the VC is not US-based, CFIUS oversight may kick in.

This overly specific intersection of requirements is how you target a single product in legislation.

Ah, I was scratching my head reading through it thinking about how unlikely it must be for something to have all of those properties. But if they were tailor made for a single product that makes sense.

Looks to me like it fits all those "model training on a GUI" packages people are selling today.

That will place the US in a large economical disadvantage for those.

Can anyone comment on who the specific vendor or what specific product might be? The AND-criteria makes this restriction pretty narrow, and the GUI requirement alone rules out practically everything I can think of.

I saw a great example of this when I was looking at VA gun laws today. They have an exception structured as follows: Virginia law exempts from these requirements any firearms shows held in any town with a population of not less than 1,995 and not more than 2,010, according to the 1990 United States census [1]

[1] https://lawcenter.giffords.org/gun-shows-in-virginia/

"The provisions of this section shall not apply to firearms shows held in any town with a population of not less than 1,995 and not more than 2,010, according to the 1990 United States census."

https://law.lis.virginia.gov/vacode/title54.1/chapter42/sect...

Any idea which town the law refers to? I looked at the 1990 census data [1] and the closest thing I could find is a town called Appalachia with 1994 people.

[1] https://www2.census.gov/library/publications/decennial/1990/...

Gosh! There are like thousand github repos that do these stuff. This could become a tool to prosecute a lot of unwanted people like DeCSS.

Could you please provide a few github links?

Object detection in aerial images is a rather booming field with 100s of papers published on the topic and contests going on in top conferences. I wouldn't be surprised if OSM is also doing some of this.

In about 5 minutes I could find these:

https://github.com/search?q=geospatial+deep+learning

https://github.com/search?q=satellite+images+deep+learning

https://github.com/search?q=aerial++deep+learning

https://github.com/search?q=aerial+object+detection

It looks like these don't meet (1) because they don't have "a graphical user interface that enables the user to identify objects"

With a GUI and everything? I find it hard to believe there are a thousand projects doing that.

Lots of interesting precedent to come out of it as well. By putting code on Github, an American website, as a developer are you actually exporting it? Or are the people cloning the repo reaching into America and extracting it?

If it is considered exporting, is github the exporter, or is the developer. Just like a company might produce a metal widget but another company procures and exports it, the original company that made the widget isn't the exporter.

I would not be suprised if we get something along the lines of "Unfortunately, this repository is currently unavailable in your country" sometime soon. Many websites still completely block EU users post GDPR, e.g. Chicago Tribune.

So that would mean I, as a foreigner, will have to do a little work to import it instead. That won't stop a lot of technically literate people.

Remember how it was done the last time the idiotic US government did the same stunt with crypto.... Zimmerman (PGP) physically printed and bound books containing the full OCR-happy font of the source code.

Evidently to the dinosaurs in Congress, a physical book is something COMPLETELY DIFFERENT than a file online.

us and non-us mirrors, bxa notices, oh my!

Imagine a world where your project dependencies can be deprecated by import/export law.

What's there to imagine? We already live in such a world.

Actually, when we buy lab equipment from the US we have to fill out paperwork saying that it will not be used to produce weapons, and that it will not be resold to "bad" countries.

Probably there is some precedent by considering e.g. if Lockheed or FedEx is the exporting company if there have been cases where weapons got exported to unwanted actors. Probably github is like FedEx in these cases.

Governments don’t make laws to fight other countries. They have armies for that. They make laws to control their citizens.

The "graphical user interface" bit is weird. I suppose you are fine if the software is driven entirely by keyboard shortcuts.

IMO that's an indication that this was made for a specific piece of software and trying to limit the collateral damage.

Yes, it seems very specific.

Same here. They are framing a specific software, possibly a very specific business deal from happening.

Maxar

Not so weird. Palantir put a GUI on Hadoop/whatever and that was enough to sell it to every government for citizen inspection. It’s the GUI that gets the contracts, not the technology alone.

If a government

1) wants to acquire a geospatial imagery recognition program;

2) does not have the tech themselves;

3) can import the underlying tech without interface;

I highly doubt a restriction on GUI export will stop them.

But in the mind of the geniuses that make up the US Congress, it does.

How will anyone operate a computer without GUI? That’s impossible! /s

3) will stop them from buying an off the shelf commercially-ready product. Yes, they can develop one from scratch, but only at enormous cost and difficulty relative to simple dollars.

It'll stop them from buying it from the US. They can just buy it from China instead.

Correct.

You can't get a contract without marketing/sales interaction with the customers.

Customers at a high enough level to sign off on a payment with 7-9 zeroes following the number are not generally programmers (or, if they were, they haven't been working at the coal face for decades): they're senior managers or civil servants.

A GUI front end is a really amazing marketing tool for any piece of software insofar as GUIs are designed to expose all the internal configuration variables and controls in a visually appealing, or even intuitive, manner that is accessible to non-programmers. Like the folks signing the big checks.

(Here's a second possibility: we know it's possible to use CAPTCHAs to crowdsource recognition of objects. Maybe they're trying to prevent export of a NN training system that uses unwitting mechanical turks for quality control?)

Absolutely correct! I used to sell expensive software for Lisp Machines and what sold it was the UI that was dual purpose: for development and for demos to management that they could understand.

BTW, off topic, but I love your books!

“Please select the images that show US military bases to proceed”

The GUI is specifically mentioned for training (tagging) of positive/false-positives that the ML then incorporates.

If you think about tagging it is something you need a GUI for unless you are lucky enough to have pre-tagged samples.

Eg: the famous Silicon Valley hotdog AI. You either need to have a GUI to allow users to select hot dogs and not hot dogs in a bunch of images, or you need a bunch of images already tagged.

I thought input method is orthogonal to whether it’s a GUI. I think GUI is meant as opposed to text console or eg audio (like a phone dial-in service); it doesn’t necessarily mean a touch screen like I think you’re implying.

Yes. Or, the software will export everything into some common format, that could be opened with any GIS viewer, and we've just gotten around the restriction?

It seems strangely ambiguous:

"(geospatial imagery) and (point clouds)" or "geospatial (imagery and point clouds)"?

Point 4 requires the use of geospatial imagery, so any point-cloud-only product would be exempt, it seems?

The document doesn't define "geospatial imagery", but that could surely include hobby and commercial drone footage of the ground. Perhaps even ordinary photography from security cameras that have user-define object identification features? That would make it really quite broad.

But all we need to do is not normalize color, and then everything's exempt!

Was doing similar work on a project using sonar imaging for the bottom of water bodies to much of what they're excluding. Not sure how concerned they'd be with identify freshwater creatures and riverbed structures...

You’re forgetting that how the word “and” works in English is often not the same as logical AND, e.g. in “give me a list of people who live in New York and Los Angeles” the “and” means OR.

Good point. Though I think "and" in those other cases really means something like "additionally" or "plus" rather than OR. You sentence could be written "... list of people who live in NY and people who live in LA.".

But it's still confusing here. If they mean it applies to both imagery software and point cloud software, then point cloud software would be excluded in point 2 because it doesn't have pixels or color (if lidar/etc). So it must be software that uses both. That makes more sense if it's aimed at a specific existing product.

So image recognition APIs like ones provided by AWS and GCP should be affected by this due to #2 and #3, no? Or the “provides a graphical user interface” part applies to all points?

Edit: I overlooked “have all of the following”.

Well, it says "having all of the following", so I think an API is fine.

Oh, sorry, didn’t see that. Seems kinda pointless then.

The main restriction is "“specially designed” for training a Deep Convolutional Neural Network to automate the analysis of geospatial imagery and point clouds".

And having a GUI. It appears you can simply export a binary framework (with or without source) and let the buyer build an interface on top of it. Building an interface is not terribly advanced work and can be done by fresh bootcamp grads even...

Strangely given that it has to meet all requirements, doesn't that mean multiple people could release two or three different projects that work together?

Although saying "well technically" as you get dragged off for waterboarding may not make you feel better.

For me as a non-US person, this reads like a spec sheet for “here’s something you should build, because there’s customers waiting”.

So is Esri worried?

That would have been my guess at who this is aimed at too. Lots of applications outside the military and spook shops but that's always been the primary customer.

With a GUI lol, phew.

Yeah almost nothing will fall under that. Build your own GUI (if you ever need one).

Looks like a nice concise list of key features for someone to reimplement.

Reply on news.ycombinator.com