-The strategy of obfuscation has been broadly appliedin search, location tracking, private communication, anonymity-and has thus been recognized as an important element of the privacy engineer's toolbox. However, there remains a need for clearly articulated case studies describing not only the engineering of obfuscation mechanisms but, further, providing a critical appraisal of obfuscation's fit for specific socio-technical applications. This is the aim of our paper, which presents our experiences designing, implementing, and distributing AdNauseam, an open-source browser extension that leverages obfuscation to frustrate tracking by online advertisers. At its core, AdNauseam works like a list-based blocker, hiding or blocking ads and trackers. However, it provides two additional features. First, it collects the ads it finds in its 'Vault', allowing users to interactively explore the ads they have been served, and providing insight into the algorithmic profiles created by advertising networks. Second, AdNauseam simulates clicks on ads in order to confuse trackers and diminish the value of aggregated tracking data. A critic might ask: why click? Why not simply hide ads from users and hide users from trackers? The twofold answer reveals what may be distinctive elements of the AdNauseam approach. To begin, we conceptualize privacy as a societal value. Whereas many privacy tools offer solutions only for individual users, AdNauseam is built on the assumption that, often, effective privacy protection must be infused throughout a system. This assumption presents different and interesting engineering challenges. Second, AdNauseam seeks to concurrently achieve the goal of resistance through protest. And since protest frequently involves being vocal, AdNauseam's core design conflicts at times with conceptions of privacy based on secrecy or concealment. While such tensions, and the tradeoffs that result, are not uncommon in privacy engineering, the process of designing and building AdNauseam demanded their systematic consideration. In this paper we present challenges faced in attempting to apply obfuscation to a new domain, that of online tracking by advertisers. We begin with the goals of the project and the implemented features to which they map. We then present our engineering approach, the set of tensions that arose during implementation, and the ways in which these tensions were addressed. We discuss our initial evaluation efforts on both technical and ethical dimensions, and some of the challenges that remain. We conclude with thoughts on the broader issues facing privacy tools that must operate within complex sociotechnical contexts-especially those dominated by actors openly resistant to them-informed by our experience with AdNauseam's ban from Google's Chrome store.
The ad blocking wars [
Our approach builds on prior work that explicitly takes social
values into account during tool design [
The AdNauseam extension attempts to realize three tangible goals
for the context of online tracking via advertising. The first is to
offer protection; protection against for users against malware and
“malvertising” (malicious software that leverages advertising
mechanisms to gain access to users’ systems [
AdNauseam applies obfuscation to the context of tracking by online advertisers. If we compare this context to others where obfuscation has been applied (e.g., search), we notice similarities and differences. In both cases users are confronted with large corporate entities (search engines and advertising networks) whose business models depend on the bulk collection of personal data. And in both cases users have little say in shaping these interactions, except to take-it-or leave it. One difference is that although “leaving it” may be feasible in search, using instead a non-tracking alternative such as DuckDuckGo, it is unclear what alternative exists for those wanting to opt-out of advertising surveillance – cease using the Web? 1 A second difference is the degree to which users want the service provided by the trackers. In search we can assume most users do in fact want (or need) the service offered by the search engine, which also happens to be the tracker. Advertising, by contrast, is not as clear. Tracking aside, some users may find ads useful; while others prefer not to see ads at all, while still others might tolerate non-tracking ads in order to avoid subscription fees. A third, structural difference, is that in search there is a single adversary with full knowledge of both search and meta data, including prior queries, click frequency, results clicked, timing data, prior interest profiles, etc. By contrast, the advertising ecosystem is fractured into multiple actors, including ad-hosting web sites, advertisers, trackers, advertising networks, ad servers, analytics companies, etc., each of which interacts with the user in different ways, and is privy to different aspects of those interactions.
The mapping of goals to features (and to the system modules
described below) was performed as follows: The goal of protection
was implemented at a basic level by the clicking of collected ads,
via the visitation module; and by the blocking of non-visual trackers
and other malware, via the detection module. The former attempts to
protect the user from data profiling via clicks on advertisements, and
the latter from non-visual tracking and potential malware. Expression
was realized through clicks, again via the visitation module, and also
in our implementation of the EFF’s Do Not Track (DNT) mechanism
[
Following a growing body of literature on privacy-by-design [
Additionally we have applied the principle of data minimization to our ad export feature, which allows users to export their aggregate ad collection (as JSON) in order to sync or migrate between machines, to backup, or to share. From our experiences user-testing this feature, we noted that such exports contained potentially sensitive data, specifically users’ click trails (stored as the locations for found ads), possibly over months or even years. When considering how to handle this data we noted that it also existed in the browser’s local storage, which could potentially be accessed by a malicious actor. Thus we subsequently implemented encryption for this data, both in memory and in storage, as well as offering users the option, before each export, to redact ad locations if desired.
a discussion needs to take place with respect to the
“legitimacy” of the desired system given its burden on privacy.”
[
Some have argued that simply using a quality ad blocker offers similar degrees of protection and expression. Although basic ad blocking may protect individual users, its scope of impact is limited to those users. There is also a need for tools whose impacts reach beyond those individuals who know they exist and possess the sufficient technical competence and confidence to install them. AdNauseam’s aim of polluting aggregate data has the potential to reduce its value to profilers and, more generally, to draw attention to the problematic practices of behavioral advertisers. Although blocking may also realize expressive goals, for example, via industry studies and media reports, the expressed message differs from that of AdNauseam’s. Ad blocker use is generally interpreted by the advertising industry as a rejection of problematic aesthetic aspects of the ad experience, while AdNauseam’s expressive intent specifically targets the industry’s unethical surveillance practices 2. Anecdotal reports from tools users, to which we return briefly below, also suggest qualitative differences of intent in their use of AdNauseam.
Finally, critics have claimed that AdNauseam harms independent
content producers who can no longer support their sites. As this
critique touches a broad array of tools, including standard ad blockers,
it will take us too far afield to address it fully here. However, setting
aside the rejoinder which points out that these sites are enabling
surveillance, or more harshly, “selling out” their visitors, the hope
is that loosening the chokehold of tracking over web and mobile
domains will allow other business models to flourish. Toward this
end we have enabled support in AdNauseam for the EFF’s DNT
mechanism, a machine-verifiable, and potentially legally-binding,
assertion on the part of sites that commit to privacy-respecting
behavior [
Given the goals we hoped to achieve and the set of features to
which these mapped, we set out to identify risks to which users
might be exposed. For each such risk, we considered the degree to
which the user would be exposed when browsing the web using
an unmodified browser, in comparison to the degree of exposure
while using AdNauseam. Finally we considered their exposure using
existing alternatives, ad-blockers like AdBlock Plus [
Increased tracking by advertisers and other data-gatherers Personal data leakage (via clicks, hiding or export)
Harms via malware or “malvertising”
To establish a lower-bound on exposure, we imposed a constraint that
exposure with AdNauseam must be strictly lower on all dimensions
than with an unmodified browser. Conversely, we hypothesized that
the current performance of uBlock, the open-source blocker with
the best performance metrics, would provide an upper-bound on
exposure. As AdNauseam must interact, at least minimally, with
advertising servers in order to fulfill its functions, it would necessarily
expose users to more risk than the current state-of-the art blocker.
For all cases (see Comparative Evaluation below) we were able to
verify that risk to users was diminished with AdNauseam, both in
comparison with the no-blocker case, and to AdBlock Plus, the most
commonly installed blocker [
This module is responsible for the analysis and categorization of
requests following a page view. Such requests, most often to
thirdparties, are first classified according to the type of elements they
realize; whether advertisements, analytics, beacons, social-media, or
functional widgets. The largest proportion of such requests (40-50%)
2This is our intent at least; Google’s recent ban of the software may imply
that this intent is understood.
are made to the first group, on which this module focuses, which
includes ad and ad-tracking services [
In order to categorize such requests, we leverage the capabilities of
the open-source uBlock-Origin [
Requests marked as blockable in AdNauseam are disallowed at the network level, mimicking the behavior of most other blockers, including uBlock, AdBlock Plus, Adblock, and Adguard, which perform blocking on some percentage of requests, and hiding on the remainder. The difference for AdNauseam is that a subset of requests which might be blocked in other blockers must be allowed in AdNauseam; specifically those that result in visual advertisements.3 At the element hiding level, the detection module is invoked incrementally, via content-scripts, as page elements are loaded (or dynamically generated) and inserted into the DOM. Elements marked for hiding are assigned a CSS class that sets their display to invisible, and the surrounding DOM is collapsed so as not to leave blank space on the page. Each hidden element (generally a visual ad) is then passed to the Extraction module.
Once a visual element has been detected and hidden, we must then determine whether it is in fact an advertisement. If so, the extraction module of the system must extract the properties needed by the Visualization and Visitation modules. These properties include timestamp, size, content-URL, target-URL, page-detected-on, etc. Text-only ads, as often found on search engines, present a different challenge, as these are generally served inline along with page content rather than requested from a 3rd-party server. In these non-image cases, several additional fields are aggregated to form the content payload (title, description, tagline) and there is no content-URL linking to an external resource. To enable extraction of such data, AdNauseam includes a custom set of CSS selectors used to parse specific DOM attributes from text-ad sites (Google, Ask, Bing, etc.). Such filters run only on specific domains where text-ads have been previously discovered.
In order to facilitate transparency regarding tracking and profiling by advertisers, AdNauseam provides users with interactive visualizations of their collected ad data. These visualizations provide both 3Interestingly, it is exactly this standard combination of functions—hiding and blocking—that Google cites as being in violation of its Terms of Service, a claim discussed below in the Distribution section. high-level displays of aggregate data (see Figure 1), as well as the option to inspect individual ads for a range of data. A number of derived functions provide additional metrics (i.e., the total estimated charge to advertising networks for the ads visited for a page, site or time-period, as in Figure 2). Ads may be filtered and sorted by date, topic-category, ad-network, page-category, etc. The visualization module is a distinct contribution of AdNauseam that attempts to a) provide users with greater insight concerning their interactions with advertisers, and b) enable interested users and researchers to study the ad data collected. To facilitate the latter, we include mechanisms for importing and exporting ad data sets (as JSON) from within the extension. The use of this data for further research, with appropriate mechanisms for user consent, is an area of future work.
This module simulates clicks (or visits) on collected ads, with the intention of appearing to the serving website (as well as to advertisers and ad networks) as if the ad had been manually clicked. Currently, these clicks are implemented via AJAX, which simulates requests (matching headers, referer, etc.) that the browser would normally send. This provides users with protection against potential malware in ad payloads, as responses are not executed in the browser, and JavaScript, Flash, and other client-side scripting mechanisms are not executed. Similarly, AdNauseam blocks incoming cookies in responses to ad visits. The likelihood that a particular ad will be clicked depends on the user-configurable click-probability setting described further below.
What are the expected results of visiting some percentage of each user’s collected ads? First, the data profiles of these users stored by advertising networks and data brokers may be polluted, as users’ actual interests are hidden by generated clicks. This both protects individual users (assuming they have clicked, or may click, some ad in the future) as well as the larger user community, as aggregate statistics are less accurate and thus less valuable. Second, as advertisers must now potentially pay publishers for decoy clicks, a degree of mistrust is introduced into the economic model that drives the system. This is perhaps the most compelling argument for this strategy, as it could, given adequate adoption, force advertisers to change their behavior, either by developing new algorithms to filter such clicks, and/or by adopting more privacy-friendly policies (e.g., the EFF’s Do Not Track mechanism).
Although not often discussed in an engineering context, the distribution issues we experienced highlight concerns we imagine will be only more relevant with the growing influence of corporate players of the software ecosystem.
The prototype for AdNauseam was initially developed as a Firefoxonly extension available in Mozilla’s addon store. In our production release, we added Opera and Chrome support and made the extension available in the Opera and Chrome stores respectively. We distributed upwards of 50,000 copies of the software over the subsequent six months, with the majority via Google’s Chrome store. In January of 2017 however, we learned that Google had banned AdNauseam from the store, and further, had begun disallowing even manual installation or updates, effectively locking users out of their own saved data, all without prior notice or warning.
Google responded to our requests for justification by saying that AdNauseam had violated the following clause of the Store’s Terms of Service: “an extension should have a single purpose that is clear to users.”4 The single purpose of AdNauseam, we would argue, is quite clear—namely to resist the non-consensual surveillance conducted by advertising networks, of which Google is a prime example. We do recognize that Google might prefer users not to install AdNauseam, as it opposes their core business model, but the Terms of Service do not (at least thus far) require extensions to endorse Google’s business model. Moreover, this is not the justification cited for the ban. Whether or not one is an advocate of obfuscation, it is disconcerting to know that Google can make a privacy extension, along with stored data and preferences, disappear without warning. Here it is a countersurveillance tool that is banned; perhaps tomorrow it will be a secure chat app, or password manager. For developers, who, incidentally, must pay a fee to post items in the Chrome store, this is cause for concern. Not only can one’s software be banned without warning, but comments, ratings, reviews, releases and statistics are removed as well.
For obfuscation to function effectively as a means of
countersurveillance, the noise generated must exhibit a high degree of
indistinguishability with regards to data the system intends to capture;
that is, it must be difficult for an adversary to distinguish injected
4In the one subsequent email we received, a it was stated that a single
extension should not perform “both blocking and hiding,” a claim that is
difficult to accept at face value, as most blockers (including uBlock, AdBlock
Plus, Adguard, etc.) perform both blocking and hiding, and have not been
banned.
noise from the data it is attempting to collect [
For example, following a software-generated ad click, we must decide whether the DOM for the response should be parsed and executed, and whether scripts should be allowed to run. In current AdNauseam versions, visits are implemented via AJAX requests, which means that no DOM is constructed from the response, and scripts are not executed. While protection is maximized here (against malicious code embedded in ads), obfuscatory power may be diminished. For example, one attack we have noted is from an adversary who, upon receiving a click request, sends a preliminary response containing code that executes, within the DOM, the actual request for the ad’s target. If the code in the preliminary response never runs, then, from the advertising network’s perspective, the click is never executed. We have experimented with solutions that address this issue (including executing clicks in sandboxed invisible tabs), but have yet to settle on a cross-platform solution that adequately protects user from potential malware/malvertising. For now we leave this as future work.
We have spoken of the expressive capabilities of data obfuscation generally, and of AdNauseam specifically. But how does this design goal relate to detectability (the degree to which an adversary can detect usage of the tool). Abstractly conceived, expression and detectability appear to lie at opposite ends of a spectrum; that is, if a tool is undetectable to an adversary, its expressive capability is minimal, at least in relation to the adversary. Thus, if expression is a goal of an obfuscation tool, designers may wish, perhaps counterintuitively, to make its use detectable. If a goal of the tool is social privacy—the pollution of aggregate data collected by trackers—then, one might argue, the tool should be undetectable, so that the adversary cannot simply discard all data from those discovered to be using the tool. It appears, at least in a simplistic analysis that a tool cannot simultaneously achieve expressivity and protect social privacy5.
To address this tension, we adapt the design of the
userconfigurable query-frequency in TrackMeNot [
6As a variety of factors influence detectability, the actual assertion of such a linear relationship would require supporting evidence. ads are clicked, there is a higher likelihood the adversary will infer the use of AdNauseam and may choose to discard all click data from the user in question. In this case personal protection may be achieved as the user is no longer profiled, but there is no immediate gain in social protection. (As noted earlier, however, the fractured online advertising ecosystem makes this less obvious than, say, in the domain of search.) At the extreme left, the tool’s clicks are undetectable (as there are none), and AdNauseam then functions like a standard blocker, simply blocking and hiding ads.
Detectability by an adversary is not, however, the only measure of a tool’s expressive powers, as there may be other audiences that developers seek to impress. Take the case of ScareMail (mentioned in Related Work below), an obfuscation tool that appends an algorithmically-generated narrative containing NSA “trigger” words to the end of sent emails. Users are able to express resistance to the recipients of their emails irrespective of whether the adversary, presumably the email provider, is able to detect its use. Whether ScareMail is actually a “privacy tool,“ or simply a tool for social protest focusing on email privacy, is a question we will not take up here. Our purpose, instead, is to argue that the expressive potential of software need not be mapped only and directly to detectability by the actor identified as the adversary. This would rule out subtle forms of social expression that we are seeing; for example, where users have spontaneously sought ways to share their ad collections online.
Qualitative evaluation was performed iteratively throughout development, often guided by solicited and unsolicited feedback from various constituencies, including users, developers, reviewers at Mozilla and Opera, and a range of privacy and security advocates. When considering how to evaluate the software, the question of whether AdNauseam in fact “worked” seemed at first to be most obvious and simple to address. We soon realized, however, that the meaning of this question shifted as users’ goals, expectations, and perceived risks varied. Evaluating AdNauseam on the basis of feedback from the various constituencies was often a two-part process: first determining user orientations, and then examining feedback in light of their goals, concerns, and priorities. Additionally, beyond the technical issues with which we grappled, a subset of critiques consistently addressed ethical concerns. Thus we have split the discussion below into technical and ethical components.
Evaluation of obfuscation-based strategies for counter-surveillance
is often relatively straightforward. Take search, for example. One can
extract query logs from tool users, containing both user-generated
and software-generated queries, and then attempt to separate the two,
either manually or automatically; in the latter case, by running
bestpractice machine-learning (or other) algorithms. Although one may
not know the exact capabilities of the adversary, evaluators can make
educated guesses as to the type of attacks to be considered, whether
timing, query content, side-channel, or other means (for details of
such evaluations in the search case, see [
At first glance, evaluating AdNauseam would seem to call for a similar approach in which one measures the difficulty with which an 7We may still argue that the socio-economic cost of filtering is prohibitively high, or that the tool is successful in terms of expression, but these are nontechnical concerns which we must bracket for the moment. adversary, using standard techniques, can distinguish user clicks from generated clicks. However, there are three distinct cases to consider, depending on what ads, if any, are seen by the user. In the first case, where a user enables ad-hiding, disables DNT exceptions, and does not provide a whitelist, no ads are visible to the user, and there are no true clicks for an adversary to discover. This is also true for the second case in which the only ads visible are those of DNT-respecting sites (AdNauseam’s default settings). As such sites by definition do not track users, there are again no true clicks to discern. The third case applies for users who see non-DNT ads, either because they have disabled hiding entirely, or because they have manually whitelisted sites. Here we must consider the tool’s detectability determined in large part by the user-selected click-probability. If this probability is set high enough that detection is possible, the adversary may simply discard all clicks from the user in question; a result similar to that obtained from a successful blocking-only strategy, except with an enhanced expressive component (as the adversary must both recognize the tool and then take action to perform the filtering). While this may be considered a success for some users, as they are no longer profiled via click-data, since the data is discarded there is no net gain in what we have referred to as social privacy. If click-probability is low enough, however, that the tool’s actions are not detectable, then in order to evaluate the degree of social protection provided, we need to asses both a) the indistinguishability of the clicks, and b) the impact that successful decoy clicks have on the resulting users profile (a complex question we return to in the Future Work below). Of course even if requests themselves are indistinguishable, there may still be side-channels available to adversaries, as discussed above. For the moment we leave the specifics of such evaluations to future work.
1) Comparative: To further evaluate performance we compare
AdNauseam with commonly used blockers on a range of dimensions,
relating both to protection (number of 3rd parties contacted) and
usability (page-load speed and memory efficiency). Tests were first
run without any extension, then with AdNauseam, Adblock Plus [
In adopting the philosophy of data obfuscation AdNauseam seeks
to shield users from the inexorable and inappropriate probes of
services and third parties. Choosing obfuscation, however, means
taking seriously the ethical critiques it has drawn, including charges
of dishonesty, wasted resources, and polluted databases. Addressing
these issues, Brunton and Nissenbaum [
The second charge asks whether obfuscation imposes a lower collateral costs than alternatives for achieving similar ends. Comparing the purported cost of AdNauseam against alternative approaches involves uncertainties we are unable to tackle here. But, by the same token, this dearth of concrete evidence poses a challenge to critics who accuse ad blockers—and AdNauseam—of harming the web’s economy. Even if one holds that the “best” resolution would be societal-level regulation, there has been little progress on this front. As important as seeking credible alternatives, however, is weighing the purported costs of using AdNauseam. Among the latter, the harm of “wasting” network bandwidth or server resources is ironic at best, given the vast amount of bandwidth used by advertisers and trackers, the performance degradation resulting from loading this unwanted content, and the financial toll on those paying for fixed data plans. From an ethical perspective, it is questionable whether the term “waste” is appropriate at all. For those who deliberately choose to use AdNauseam it offers a potential escape from inappropriate profiling. In our view, this is not a worthless endeavor.
One of the most aggressive charges leveled at AdNauseam is that
it perpetuates “click fraud.” Since obfuscation and fraud both involve
forms of lying that disrupt entrenched systems, it is important to
evaluate whether the two forms are alike. To carry this out, we
consulted various definitions: “[Click] fraud occurs when a person,
automated script or computer program imitates a legitimate user of a
web browser, clicking on such an ad without having actual interest in
the target of the ad’s link” [
We readily admit that a primary aim of AdNauseam is to disrupt
business models that support surreptitious surveillance. It does not
follow however that AdNauseam is responsible for the demise of free
content on the web. First, it is not, as we make clear on the project
page, advertising that is the primary target of the project, but rather
the tracking of users without their consent. Contextual advertising
that does not involve tracking can certainly support free content just
as it has in the past. Second, web content is not actually ‘free’ as
this argument implies. The development of the Internet has been
supported largely by government funding (and thus by taxpayers)
since its beginning. In fact, vast infrastructure and energy costs are
still born in large part by taxpayers, not to mention the potentially
species-threatening cost to the environment posed by increasing data
traffic [
The strategy of obfuscation has been broadly applied—in search
[
Other relevant work, described in [
Two early tools addressing surveillance integrate ad-blocking with
some broadly-defined social good: AddArt [
AdNauseam provides individuals with the means to express their commitment to online privacy without the need to depend on the good will or intervention of third-parties. Although fully functional, AdNauseam is perhaps best considered as a proof of concept for a particular approach to privacy, that is, privacy through obfuscation. As discussed, AdNauseam’s potential lies in its capacity to protect individuals against data profiling, as well as simultaneously providing a proactive means of expressing one’s views to monolithic and largely uninterested corporations. Going forward, a scientific approach to evaluating AdNauseam’s performance, or the performance of any system adopting obfuscation, needs a rigorous means of measuring success—namely, evidence that decoy clicks have been registered and have an impact on the resulting profile. Such needs are likely to turn not only on the statistical analysis of signal-to-noise ratios, but also on a practical understanding of how click data is actually mined and used, and the extent to which it influences aspects of user profiles. This would allow future iterations of obfuscation-based tools to be both effective and efficient in the noise they produce.
Future work could take several directions. In the near term we hope to better answer the question of how to perform indistinguishable clicks without exposing users to potential harms via downloaded content, as discussed above. Though complex, P2P approaches for the sharing of obfuscation data between users is a ripe area of future work, with users potentially visiting the ads detected by peers as a means of both shielding their data and maximizing indistinguishability. A central challenge here would be meeting functional criteria while not compromising the design constraints discussed early in this paper, e.g., transparency and independence from third-parties. Finally, beyond the technical, work exploring the motivations and qualitative experiences of users who select obfuscation tools could shed light on the unique potential such tools might offer in additional domains.
AdNauseam operates in a technologically and socially complex environment, one in which user data is perceived to be highly valuable. For individuals, however, recorded patterns potentially open a window into their lives, interests, and ambitions. Thus surveillance via advertising is not only a source of individual vulnerability, but also interferes with the rights to inquiry, association, and expression that are essential to a healthy democratic society. Consequently, there remain tensions between individual users, collective social and political values, and the economic interests of publishers and advertisers. In a better world, this tension would be resolved in a transparent, trust-based accommodation of respective interests. Instead, concerned users find little transparency and few credible assurances from advertisers that privacy will ever trump the pursuit of profit. Thus trust-based mutual accommodation gives way to an adversarial relationship, one in which we must leverage all the strategies at our disposal. Our success in this endeavor will depend in part on how well we share our experience applying known strategies to new contexts, in concrete and specific detail, according to an evolving set of best practices, as we have attempted above.
We conclude with a philosophical point. In some of the most revealing exchanges we have had with critics, we note a palpable sense of indignation, one that appears to stem from the belief that human users have an obligation to remain legible to their systems, a duty to remain trackable. We see things differently; advertisers and service providers are not by default entitled to the externalities of our online activity. Rather, users should control the opacity of their actions, while powerful corporate entities should be held to the highest standards of transparency. Unfortunately this is the opposite of the status quo; our trackers want us to remain machine-readable so that they can exploit our most human endeavors (sharing, learning, searching, socializing) in the pursuit of profit. AdNauseam attempts to represent an alternative position.
The authors wish to thank all those who have helped with the creation and spread of AdNauseam, particularly Sally Chen, Leon Eckert, Cyrus Suen, and Emily Goldsher-Diamond. This paper has been greatly improved by comments from our (anonymous) reviewers, our “shepherd” Ero Balsa, and Seda Gürses; specifically for her substantive guidance throughout the writing process and her unflagging support of productive, cross-disciplinary work, no matter the difficulty. Finally, thanks go to Mushon Zer-Aviv, for his profound contributions to all aspects of the project.
This publication has been supported in part by grants from US NSF CNS/NetS 105833, US NSF SATC 1642553, and the Research Grants Council of Hong Kong, China (Project No. CityU 11669616)