A recent article in Science has been deleted and a curious editorial comment added to it. The article title is Your heartbeat quietly shapes how your brain processes information, and the editor’s note is:
Editor’s note, 16 September, 3:05 p.m.: Although no specific errors in this story have so far been identified, we have removed it after determining the author was impersonating the identity of an established science journalist, both with the News editors at Science and with sources in the story. Furthermore, two of the quotes provided by the author have since been found in previously published stories by other writers.
The attributed author was Caroline Williams. The real Caroline Williams has written elsewhere:
Fake Caroline update:
The person who was impersonating me managed to get an article published in Science, under my by-line. And they got paid for it!
I’ve seen the pitches (bad), and the email chain between editors who weren’t all that impressed, but googled me and decide to take a punt. When the article came in it was dry, clunky and badly written, but after several rounds of editing they managed to get it into a publishable state. It went online in June and was up until yesterday when it became clear they (and I) had been scammed.
Link to the retraction / editor’s comment here: https://lnkd.in/eSQ2XEAJ
The whole thing makes me feel sick. I know from my work as an editor that the reputational damage is real. Had I pitched a story to them afterwards they would very understandably have said “Hell no!”. Who has the time to do someone else’s job? They tried “me”, “I” didn’t deliver, so no thank you.
I have no idea how many more editors out there have me on their ‘do not commission’ list because of this person’s actions. There may also be several scientists who will not want to talk to me because they’ve had a bad experience with the fake one.
More broadly, if this is a wider scam (and based on what others have told me, I think it is), it is potentially a serious issue for science journalism and journalism in general. And I’m not sure what we can do about that.
On the plus side, I now have some very nice contacts at Science and Nature and plan to write something better for them as soon as possible. And the fact that payment was made opens up the possibility of tracking down who is behind this. Watch this space…
It’s weird. Fake Caroline got nothing out of this but a paycheck, which does make me wonder how much one gets paid for a news article in Science. It can’t be much, given that scientists who publish there get nothing, and are in fact expected to pay the journal for the privilege.
There is a great deal of gain to one’s reputation, but not if you publish under someone else’s name, obviously. You can’t list it on your CV.
It can hurt the real writer’s reputation — now editors might be on the alert that submissions by “Caroline Williams” could be fraudulent. But this is a lot of effort to go to for a weak effect on someone. I can’t believe this elaborate fraud was a devious hit piece.
So now I’m left wondering why anyone would do this. Is there some subtle scam at play?
My guess is that somebody really wants to think of themselves as a science writer, but just isn’t very good at it, so hoped they could get published on the back of somebody else’s reputation. People do all sorts of weird stuff.
Distribute your public key, and then use your private key to sign your work so that anyone else with the public key can verify that it’s yours. Keypair crypto should be one component of any serious authentication mechanism.
AI is probably involved somewhere. The French used to say “Cherchez la femme;” nowadays it’s ….
@beholder – that just moves the problem up a level. Instead of asking “how can we be sure this person is who they say they are?”, we are now asking “how can we be sure that this public key really belongs to the person who the person presenting it claims it does?”, which is arguably a harder question. It’s possibly fair enough provided you establish the key exchange long before you have any reason to need it, or if you’re already a well-established public persona with a reliable means of publishing, but neither of those things are generally true in the cases where we would actually care about it.
To quote the inimitable James Mickens:
[This World of Ours, Usenix, Jan 2014]
I’m not really glad I’m at the end of my career, but I’m thankful I won’t have to deal with the landmines that have appeared in the modern academic publishing ecosystem. Can preprints (arXiv) even survive, given the ease with which someone can take your preprint, have AI rewrite it with minimal changes, and submit it to a journal?
It can’t be much, given that scientists who publish there get nothing, and are in fact expected to pay the journal for the privilege.
Weird, doesn’t appear to be enough of a reward for their actions. Maybe testing a scam in a low-priority field before moving on to bigger targets? Or the culprit has some psychological issue, and this puts the chips in their cookie. Stupid also comes to mind.
Why indeed?
Unfortunately, whatever the “miserly” stipend paid by Science for a piece would represent a substantial sum for many in the world in places where labour is cheap.
“Write” a piece using AI (quote mining from others is a red flag here). Getting it published is the next trick. Here you can use AI and google translate to contact the editors. Heck, the “writer” might even have knowledge in the area and not have used AI beyond translation. Think North Korea, Chinese re-education camps or Myanmar cyber slave camps.
All of those would love the Yankee dollar and for any regime running this crap undermining western academia is just icing on the cake.
I keep thinking I might be paranoid about this sort of thing – but then take a look at what’s accumulated in my spam folder. Scamming is an industrial operation these days.
I would guess the purpose was for a future paper or product to be able to reference the article to give it credibility. I could see some smartphone app that links to one of the health trackers wanting to have something to legitimize their claims to convince you to pay the 9.99 to download their (undoubtedly ai-slop coded) app from the app store.
@2, @4: It’s worse than that. In no particular order:
• The meme goes against the entire history of cryptology, in assuming that “hard to reverse given what we know now” is the same thing as “hard to reverse given what we don’t know now, in general and in public.” Once upon a time, the Vigenere multialphabetic substitution cipher was presumed to be unbreakable… and the less said about codebreaking during the first half of the twentieth century (even limited to just what has been made publicly known and verifiable), the better.
• The meme assumes that none of those who built the systems also embedded back doors, despite the questionable nature of some of their sponsors (as to intentional embedding) or haste to publish/exploit (otherwise).
• Given the tendency of people to store their various keys as backups in the “cloud,” think anyone might be able to compromise both keys without even attacking the system, then start using typosquatted electronic addresses (substituting unicode 0410, a cyrillic character, for a capital A)?
• The entire system still rests upon choosing an initial key sequence (“password” used to generate the two keys)… and we know pretty well that people don’t do that well, and machines relying upon “random number algorithms” only a little bit better. This not-so-subtly undermines the “but there are so many possible solutions that no one will break it!” defense all by itself.
The resemblance of “it’s too hard to crack public-key systems” to the fun-house mirror of creationist “computational complexity” arguments is a bit too much to do more than snicker at before all the caffeine has hit. Both ignore the most-obvious dependency of all: That the next “calculation” is at minimum contextualized by all that came before it. The math behind and implementations of public-key cryptography try to make this a virtue, but depend upon some untestable assumptions.
@4 Dunc
Well, I said “one component”, not “the entire authentication system”. Keypair crypto has its theoretical weaknesses and practical weaknesses, chief among them (a.) a suitable quantum algorithm running on a yet-to-be-demonstrated powerful enough machine, (b.) not giving away your private key, and (c.) trusting that an authoritative public key repository is up to date. It requires some basic computer skill on the publisher’s part, which may be too much to ask — letting them handle money is apparently not too much to ask. Anyone besides the publisher with access to the signed document and public key can double-check their verification.
@6 Jaws
You do a good job outlining many of the ways to use crypto badly, but you don’t sound like you’re familiar with modern crypto if the Vigenere cipher is your go-to example (I use Dual_EC_DRBG as a modern example of a known compromised cryptosystem), nor modern KDFs nor modern CSPRNGs.
I include that in the category of giving away your private key.
You can also directly generate the private key with a high-entropy source.
This may get worse and worse until we no longer know what’s real or not. Maybe SKYNET will fix things once and for all.
Well I never get impersonated … not sure whether to be sad or happy…
They did it to see if they could, because they could. If you can pass yourself off as a well established journalist because more $$$, successfully and with low effort, why wouldn’t you? And of course you pick on magazines like Science or Nature because the checking for credentials is relatively low. Few readers, relatively, and it is easier to get away with. You try that with Entertainment Tonight or ESPN and you will be detected way faster and the outrage will be way greater.
Just more fence testing I reckon, and worryingly successful too. They got a long, long, way before detection.
Beholder @10:
I used Vigenere as an example because it (a) is really easy to research with reasonably-available internet and print sources, (b) has a really easy to explain cracking method, (c) had decades of reputation as uncrackable that persisted for several decades further after it had been cracked… and (d) due to its age doesn’t fall within any restrictions I have regarding more-recent issues/systems. For example, I can’t even say the “V” word, the one that’s one letter off from the title of a Shakespeare play. (It’s not that “I’d have to kill you” if I said anything — it’s that They would come and kill me.)
High-entropy sources are fine, to an extent; it’s the conversion to a useable key that then runs into potentially exploitable with enough computing power vulnerabilities.
Jaws @ 14: Spooky: even Google AI lies about it… badly:- Q: “the “V” word, the one that’s one letter off from the title of a Shakespeare play.” A: “The word you are looking for is Veneer.It is exactly one letter off from the Shakespeare play The Merchant of Venice (or simply Venice as the core location/title element).”
ok, so it’s not Vamlet, Vacbeth, Vothello, Vomeo and Juliet, Venry IV Part 1, or Voriolanus.
I give up.
A Vigenère cipher can be unbreakable if the key has the same length as the plaintext, and doesn’t match any previously-used key.
@14, 15, 16: ARRGH! What’s the “V” word??? I promise there won’t be any killing…
Guessing the “V word” could be the anatomically accurate form(s?) for women’s reproductive parts namely vagina or vulva perhaps?
@ ^ “forms”, terms, same diff yeah? Dóh! Mea culpa.
The V to which I refer is the place where there are “Two Gentlemen of” and a feud between the
Sharks and JetsMontagues and Capulets. There’s one letter different in there, and by not actually saying it I’m exploiting a loophole in those restrictions (“Yeah, we know, but sign it anyway”).