Showing posts with label HMRC. Show all posts
Showing posts with label HMRC. Show all posts

Friday, 29 August 2014

The magic of open data #1

"Sharing information across government databases
will dramatically increase governmental powers –
otherwise the UK government wouldn't have proposed it."
Professor Sir Nigel Shadbolt, Chairman, Open Data Institute


Lough Erne in County Fermanagh, Northern Ireland, "is a particularly scenic waterway, renowned for its beautiful setting. The area is popular for angling and watersports, with waterskiing, Rowing and wakeboarding being amongst the most popular; the stretch of water alongside the Broadmeadow, Enniskillen, has hosted stages of the World Waterski Championships annually since 2005, and in 2007, a pro-wakeboard competition, 'Wakejam' was hosted by the Erne Wakeboard Club (EWC) after successful national wakeboard competitions in the previous years. Canoeing is also a popular recreational sport on the Erne".

That's what it says in Wikipedia and that's where, on 18 June 2013, after a hard day's fishing and wakeboarding, the G8 canoed back to shore and issued their famous Declaration (para.7):
We, the G8, agree that open data are an untapped resource with huge potential to encourage the building of stronger, more interconnected societies that better meet the needs of our citizens and allow innovation and prosperity to flourish.
It is this Declaration that caused David Gauke MP, Exchequer Secretary to the Treasury, blithely to recommend standing the British Constitution on its head so that whereas we used to imagine that personal data submitted to the government would by default be treated as confidential, in future it will instead be treated as open, public and available to all:
... the UK helped secure the G8’s Open Data Charter, which presumes that the data held by Governments will be publicly available unless there is good reason to withhold it. (p.4)
Queen Méabh (Maev)
by Joseph Christian Leyendecker
Is it something in the water? "In Irish mythology and folklore, there are three tales about how the lake was formed and got its name. One says that it is named after a mythical woman named Erne, Queen Méabh's lady-in-waiting at Cruachan. Erne and her maidens were frightened away from Cruachan when a fearsome giant emerged from the cave of Oweynagat. They fled northward and drowned in a river or lake, their bodies dissolving to become Lough Erne ...".

It may not have been a fearsome giant that emerged from the cave of Oweynagat, of course. It may actually have been Rt Hon Francis Maude MP, Cabinet Office Minister, "JFDI", as he's known, who frightened poor Erne and her maidens to death. Whitehall folklore has it that he once told the Information Commissioner's Conference:
I want to bust the myths around the complexities of data sharing ... we aim to find effective ways of using and sharing data for the good of everyone ...
And it may not have been water that they were drinking when the G8 were "helped" – to use Mr Gauke's word – to agree to this inversion of the settled order (para.11-13):
Principle 1: Open Data by Default

We recognise that free access to, and subsequent re-use of, open data are of significant value to society and the economy.

We agree to orient our governments towards open data by default.

We recognise that the term government data is meant in the widest sense possible. This could apply to data owned by national, federal, local, or international government bodies, or by the wider public sector ...
The UK held the Presidency at the time and within limits they could launder their own policy through the G8 but what on earth possessed them to dream up open data by default?

Mr Gauke tries to blame Shakespeare:
Getting to this stage:
The Government published its response to the Shakespeare Review of Public Sector Information on 14 June 2013 ... (p.2)
That's Stephan, by the way, not William.

Stephan Shakespeare is the CEO of YouGov, the polling organisation, and he wrote An Independent Review of Public Sector Information [PSI].

We need to familiarise ourselves at this point with some of the lyrical vocabulary of our ancient and magical land. Here in the UK, Ordnance Survey, the Met Office, the Land Registry and Companies House are the four Trading Funds that together constitute the Public Data Group (PDG). The PDG brings in £143 million a year in revenue for the Exchequer by selling maps and weather forecasts and such like.

And Mr Shakespeare thinks that that's ridiculous. He wants to break the antique spell we live under in the UK and drag the country into the information age by giving away PSI for free to entrepreneurs. The eruption of innovation that results will expand the economy. That's the idea, at least:
It seems a straightforward decision to invest £143m to make Trading Fund data widely available is a relatively small price to pay to leverage wider economic benefits far exceeding this by orders of magnitude. (p.30)
But just when you think you've found a convincing prophet, he goes and spoils it by saying that:
Forecasting future benefits is also hard to predict. How businesses and individuals might use datasets in the future to generate new products and services and by implication impact economic growth, is equally unknown. (p.30)
In other words there isn't the slightest justification he can advance for saying that the unspecified wider economic benefits of giving away this PSI for free would exceed £143 million by uncounted orders of magnitude.

It can't be Shakespeare under whose influence the wetland sprites (Maude and Gauke?) were acting at Lough Erne. Who then?

Perhaps Tim Kelsey.

Mr Kelsey was for a while the Executive Director of Transparency and Open Data in Mr Maude's fiefdom, the Cabinet Office. A magnificent job title, and a doughty champion of open data he is and has been for years – this, for example, is a pronouncement he made in an article published in July 2009, Long live the database state:
If the next government, of whichever party, wants a better public sector it must encourage more use of personal data; not less. What should be done? Data sharing must be made easier, first by removing the legislative obstacles to sharing government databases.

... no one who uses a public service should be allowed to opt out of sharing their records ...

Nor can people rely on their record being anonymised ...
Unfortunately for Mr Kelsey, his so-called "care.data" plan to collect all our previously confidential medical records and give them away to researchers fell apart in February 2014 when patients and doctors lost confidence in him. It can't have been him casting the open data spells four months later at Lough Erne and intoxicating the G8.

Which suggests that the guiding light may have been the charming Professor Sir Nigel Shadbolt, chairman and co-founder of the Open Data Institute, and the author of The spy in the coffee machine – the end of privacy as we know it (2008):

... sharing information across government databases will dramatically increase governmental powers – otherwise the UK government wouldn't have proposed it. (p.95)

... we should never forget that bureaucracies are information-thirsty, and will never stop consuming. Indeed, they will never even cut down. They will break or bend their own rules, and any prior specification of how information use will be limited, or data not shared, is not worth the paper it is printed on. (p.212)
Actually, he isn't the author, he's the co-author of that book, with Kieron O'Hara, his sometime PhD student. And Dr O'Hara is the sole author of Transparent Government, Not Transparent Citizens: A Report on Privacy and Transparency for the Cabinet Office, a work referred to by Stephan Shakespeare in his PSI report (p.34). And Professor Sir Nigel appeared in front of the Public Administration Select Committee (PASC) to give evidence jointly with Stephan Shakespeare. And Tim Kelsey and Professor Sir Nigel are or were both members of the Data Strategy Board and, as such, assisted with the production of Stephan Shakespeare's PSI report (p.4). And so it goes cabalistically on.

When Professor Sir Nigel and Stephan Shakespeare appeared in front of PASC they were bemoaning the fact that the Post Office Royal Mail had just been privatised and had taken the PAF with them onto their balance sheet. The PAF is the Postcode Address File and would have been given away to entrepreneurs for free if our two witnesses had had their way.

The Hon Bernard Jenkin MP, chairman of PASC, agreed.

Somewhat surprisingly.

After all, Professor Sir Nigel and Stephan Shakespeare gave no indication whatever how giving away the PAF for nothing would have made the economy grow.

And the PAF generates income. Naturally the government wanted to realise the best price possible for the Post Office Royal Mail. That's the coffee in the coffee machine you can smell. Wake up.

They've had more luck with Companies House:
Free Companies House data to boost UK economy

Companies House is to make all of its digital data available free of charge. This will make the UK the first country to establish a truly open register of business information ...

This is a considerable step forward in improving corporate transparency; a key strand of the G8 declaration at the Lough Erne summit in 2013.

It will also open up opportunities for entrepreneurs to come up with innovative ways of using the information ...
The "digital data available" from Companies House includes the title, name, address, date of birth, nationality and profession of every director and every company secretary of every company in the UK – "the end of privacy as we know it".

Do they imagine that thousands of very bright people haven't been thinking of "innovative ways of using the information" for several decades now? What are they supposed to have missed? Companies House don't say. Just like Stephan Shalespeare, who couldn't tell us how many orders of magnitude his leveraged wider economic benefits would exceed the PDG income by.

There's one obvious application of the Companies House data. Suppose you're a 50 year-old female Hungarian surveyor living in Kent and suppose that you want to establish a false identity for some entrepreneurial purpose. Not so easy in the past but now, with the Companies House data available to you for free, you can search for suitable matches in the comfort of your own home. Thank you Messrs Maude, Gauke, Jenkin, Shadbolt, O'Hara, Shakespeare and Kelsey – the answer to Queen Méabh's prayer.

Apart from that, there's no telling what sort of innovation these people are talking about. It just looks like hope. Or guesswork. Will giving away an entire country's personal data inspire innovation? How? Why? Are there any examples? If it's that easy to create innovation, are the universities wasting their time doing research? Are we wasting our money funding it? Why bother granting corporate tax relief on R&D? Is there no downside? Can nothing go wrong? Which economy will benefit? Suppose the innovators are all Estonian – how does that help the UK economy?

You may not be able to answer those questions and all the other related questions that occur to you. We know that Tim Kelsey can't. Neither can Stephan Shakespeare – he just says that anyone standing in the way of open data wants people to die of cancer and wants children to be unhappy. Shroud-waving. Blackmail.

But Professor Sir Nigel is a different kettle of fish. Very different. Can he answer the questions? Can he move the debate on from the enchanted world of Lough Erne, out of the twilight and into the open?

That is the subject of a future post which if it is ever written will be based on this talk he gave:


Prof. Sir Nigel Shadbolt - The Fifth Paradigm: From Open Data to Social Machines

----------

Updated 26.3.15

God but Tuesday was an odd day.

Tuesday 24 March 2015, out of the blue, inattendu by any of us proles, came the surprising announcement that Public Servant of the Year ex-Guardian man Mike Bracken CBE CDO had been appointed the UK government's Chief Data Officer thereby making him Public Servant of the Year ex-Guardian man Mike Bracken CBE CDO CDO given that he was already the Chief Digital Officer.

Not that that need concern normal people.

But Twitter went wild, as hundreds of breathless congratulations poured in from all over the world the second best one being:


It's a good question. Along with how do you fit it in with being executive director of the Government Digital Service and senior responsible owner of the pan-government identity assurance programme, GOV.UK Verify (RIP)?

The best tweet was:


Rarely can 94 characters have been freighted with quite so much meaning.


Updated 8.10.15

Tim Kelsey's care.data was meant to start operations 18 months ago in April 2014. That's when, for the first time, the medical records maintained by our GPs (general practitioners/family doctors/the primary care providers) were supposed to be collected centrally by NHS England. There was vociferous opposition from patients and GPs centred on the absence of any thought in care.data about the confidentiality of medical records. NHS England postponed the start by about six months to the autumn of 2014, NHS England acts in response to concerns about information sharing – statement from Tim Kelsey, National Director for Patients and Information.

In October 2014 we learned that there wouldn't be a national roll-out, just a regional pilot, "GP-led clinical commissioning groups in four areas of the country are to help develop the care.data programme as it moves into a ‘pathfinder stage’ ...".

And when would this pilot start?

Clearly not in autumn 2014. In December 2014, the Independent Information Governance Oversight Panel said that the care.data pilot could start just as soon as 27 currently outstanding questions were satisfactorily answered and seven tests were passed.

In written evidence to the Health Committee dated 9 February 2015, the chairman of the Health & Social Care Information Centre revealed that over 700,000 people had opted out of care.data and that "the HSCIC does not currently have the resources or processes to handle such a significant level of objections".

In March 2015 Tim Kelsey told us care.data on hold until election.

By June 2015, after the election, you could take your pick. Either those 700,000 people could opt out of care.data but they could forget about receiving any healthcare. Or their opt-outs would be ignored and their data would be sold to insurance companies anyway. Will Jeremy Hunt ensure that “700,000” patient opt-outs are respected?, medCondifential wanted to know, while the Telegraph newspaper warned us that Nearly 1million patients could be having confidential data shared against their wishes.

And now?
Tim Kelsey to leave NHS England

17 September 2015 - 12:00

He has been appointed commercial director at Telstra Health, a division of Australia’s leading telecommunications provider where he will lead development of new digital and mobile solutions for patients, professionals and citizens around the world ...

Updated 3.11.15

There's something odd about a tweet of Nigel Shadbolt's today.

We know that he and Stephan Shakespeare were hacked off at the Post Office Royal Mail keeping control of the Postcode Address File (PAF) when it was privatised.

Maybe so, but that's the law, the PAF was and is the Post Office Royal Mail's intellectual property (IP) and, if there's some value to be derived from it, it would have been remiss of the management to give it up.

Entrepreneurs can still access the PAF, it's not lost to them. They just have to pay for the privilege.

Did the UK economy lose anything thereby? There is this assumption in some versions of the case for open data that free access to data causes innovation and/or that paid access inhibits innovation.

It is questionable whether that assumption is true. There has not yet been an explosion of innovation caused by Companies House's data becoming freely available. The considerable innovations of DueDil, on the other hand, all took place while the data had to be paid for.

Which makes Sir Nigel's use of the word "contaminated" sound more like something coming out of the mouth of a fundamentalist zealot than the urbane academic we are used to.

Flicking through your copy of Volume 38 of the Journal of Contemporary Asia, you will have come across this on p.546 ...
While the bourgeoisie was relatively small, its representative ideology none the less penetrated other classes. Members of the proletariat could be corrupted by modes of thinking characteristic of the bourgeoisie and take up the "stand" of this class (Mao, 1974a: 73; The Polemic, 1965: 33, 421-2). The proletariat was therefore compelled to wage an ideological struggle to divest members of its own class of bourgeois contamination, and to remould the thought patterns of the bourgeoisie (Ch'en, 1970: 107, 117, 123; Mao, 1977b: 409-10, 504).
... and you may agree that we can do without any recurrence of Maoist "ideological struggle", otherwise the speech given today by the eminently bourgeois Matt Hancock, Cabinet Office Minister, on the topic of data-driven government takes on a sinister, minatory hue.

Mr Hancock has established a "Steering Group of digital and data visionaries" who will drive the agenda on data-sharing and data-driven policy-making. That Steering Group includes Sir Nigel, among others. Here's hoping that none of these stoutly proletarian visionaries becomes contaminated.


Updated St Patrick's Day 2016

The G8 fell for it, see above, or at least pretended to fall for it:
We, the G8, agree that open data are an untapped resource with huge potential to encourage the building of stronger, more interconnected societies that better meet the needs of our citizens and allow innovation and prosperity to flourish.
That was back in June 2013.

Matt Hancock, Cabinet Office Minister, fell for it, or so he said, when he launched the current consultation on data-sharing:
There is huge potential for improving citizens’ lives through data sharing in the UK. The consultation we launch today will help make sure we get data right and bolster security whilst making people’s lives better.
The Chancellor fell in with falling for it in yesterday's Budget:
1.251 This Budget sets out steps to ensure the benefits of digital technology are felt by all businesses and individuals. The government will ... provide up to £5 million to develop options for an authoritative address register that is open and freely available – making wider use of more precise address data and ensuring it is frequently updated will unlock opportunities for innovation ...
The Government Digital Service plan to declare the new national identity assurance scheme to be live in a few weeks time. It's nothing but a machine for collecting your personal information and sharing it widely in the UK and abroad, out of your control.

The pretence that these initiatives are intended to expand the economy is just that, a pretence. Opening up data to all and sundry does not cause innovation.

The G8 Declaration is quire clear. The intention is to invert the Constitution (p.4) ...

... the UK helped secure the G8’s Open Data Charter, which presumes that the data held by Governments will be publicly available unless there is good reason to withhold it.

... all in the name of the bone-headed plan to compile the registers which, together, will constitute a "single source of truth" for Government as a Platform.


Updated 22.3.16

The information-sharing paradox

The G8, we were saying on St Patrick's Day, and the Cabinet Office and the Treasury all want to make more data open. Once it is available to all at no cost, innovation will be the inevitable result and the economy will expand by orders of magnitude, according to Stephan Shakespeare of YouGov, although he can't explain how – where there should be a coherent argument, there's just a hole.

It's not just the G8, the Cabinet Office and the Treasury. Companies House have fallen for it, too. And now they're having to confront the obvious problem, Our register: advice on protecting your personal information. (Don't get your hopes up. Their advice is useless.)

And it's not just the UK. The sensible Australians have got the bug. In the name of their "National Innovation and Science Agenda", Oz government wants much more personal data sharing, hat tip Kat Hall.

This is a global epidemic. With no solution. Because how do you combat a global epidemic? With massive information-sharing ...


Updated five days after St George's Day 2016

As noted on St Patrick's Day, please see above, there is a national log-rolling exercise being conducted in respect of open data. That exercise was assisted yesterday with the publication by Sir Jeremy Heywood, the Cabinet Secretary, of Open data - the revolution is here.

"Open data is data that anyone can access, use or share ... It really has changed people's lives for the better: the value is well proven", says Sir Jeremy.

"The value is well proven"? Follow Sir Jeremy's link and you will find reference to a PwC report, research from Lateral Economics, a McKinsey estimate, a CapGemini study, a Transport for London claim, the results of some Open Data Institute research and the findings of the Landsat Advisory Group that the 42 year-old Landsat mission has not been a waste of public money.

The value of open data remains well questionable. When Sir Jeremy follows up with "I believe the Civil Service can play a central role in harnessing these benefits", the question arises what benefits?

It gets worse. "At both national and local level, government holds huge amounts of data and more is generated every day. People rightly expect us to protect their personal data. But with general and anonymised data we can now achieve things that would have been considered impossible only a decade ago" – what impossible things can Sir Jeremy do now?


"The Government has already published over 27,000 datasets, covering almost £200 billion of public spending, since launching data.gov.uk in 2010. We have done this to be open and transparent about the information we hold ...". OK so far, Sir Jeremy's data.gov.uk is a Good Thing, to the extent that it helps the public to hold the government to account ...

... but then we get "but also so that others, inside and outside of government, can take that data and use it to build new and exciting products and services". What exciting products and services? Sir Jeremy's Companies House, for example, has opened up the personal information of hundreds of thousands of company directors (none of it anonymised by the way) and there's not a single exciting product or service to be seen as a result.

It is only prudent to be well sceptical about Sir Jeremy's assumption that open data inspires innovation and causes the economy to expand and improves people's lives.

Also about his claim that personal information will be treated with respect by his Government Digital Service (GDS), the bizarrely-chosen seat of his Government Data Programme, "... we are aiming to transform the way government stores, manages and uses data. The data team at Government Digital Service is ...".

The Privacy and Consumer Advisory Group have devised a set of nine principles for identity assurance. While claiming to abide by all nine, GDS have flouted the lot with their GOV.UK Verify (RIP) identity assurance scheme which is due to go live tomorrow. Sir Jeremy's revolution is here, indeed.


Updated 1.5.16 1

There was a documentary about the Queen on telly the other day. The programme covered the abdication of the disgraceful wrong 'un Edward VIII and the accession of George VI. There is evidence that, on the King's untimely death, Lord Mountbatten sought to bring back the wrong 'un and have him re-enthroned. At which point in the programme one transcendently magnificent lady, a cousin of the Queen's, delivered herself of the following: "it was always said of Lord Louis that if he swallowed a nail he would shit a corkscrew".

Let's call that property mountBatten(). It's a relation between any number of nails of any sort and any number of corkscrews of any sort. It's obviously not a very pleasant property. But in politics it can be occasionally necessary, all hewn of crooked timber as we most unfortunately are, it has its place.

Not least, we expect our cabinet secretaries to possess it. They must have thousands of other properties as well but it must be the case that cabinectSecretary.mountBatten(). Otherwise they can't do the job and they're no use to us.

When Sir Jeremy Heywood sort of promises that we can all enjoy the imprecise benefits of open data while nevertheless retaining our anonymity, as he did the other day, as noted above, it must be clear to everyone that this is more at the corkscrew end of the body politic's digestive tract than the nail end.

You can forget anonymity if the open data initiative that we are promised for this month, May 2016, proceeds. Professor Ross Anderson says so. So does Professor Martyn Thomas. Professor Sir Nigel Shadbolt looks as though he may agree.

They're just professors, of course, what do they know, you may ask. But it's not just them. GDS also have warned about the risk posed to anonymity by open data:
Update, 29 March 2016: We are now able to publish a CSV file (663 kb) containing the data used for the web tool for 7 of the 9 demographic variables provided by the ONS omnibus survey. This is combined with our model's estimate of the individual's probability of being verified by certified companies over time. This is the maximum number of variables we could make public, whilst preserving the anonymity of respondents.

Updated 1.5.16 2

The Electoral Commission once engaged the Government Digital Service (GDS) to do some data-mining work. It didn't go well. It was a painful experience. It ended in failure. The Commission's July 2013 report on the exercise includes:
• There were considerable delays to the original timetable for establishing this pilot. A significant cause of the delays was the lack of capacity and resources within Cabinet Office (and the Government Digital Service (GDS), which is part of Cabinet Office) due to their workload related to the transition to IER ...

• For the national data mining, Cabinet Office’s original intention was that pilot areas should adopt a fairly standardised approach to checking the data received and contacting the individuals identified, to ensure that results were comparable. In practice, however, the nature and extent of follow up work varied widely.

• Much of this variation was caused by practical difficulties, for example the need to spend more time than expected in ensuring the accuracy of the data received. However, some of the variation could have been avoided if there had been fewer delays and a greater level of support provided by Cabinet Office to pilot areas. In particular, a few areas told us they felt unsupported and were unclear about what to do ...

• It is not possible to produce an overall figure for the cost of this pilot. This is because we do not have final costs for all pilot areas or any costs for Cabinet Office (including GDS), who conducted much of the work.

• We are also therefore unable to estimate the cost per new elector registered or the likely cost of any national rollout. Any estimates of these would need to include the cost of coordinating and managing the pilot (the role taken by Cabinet Office in this pilot), as any future work with data mining would require some form of central coordination ...

• The reasons that so many existing electors and ineligible individuals were returned on the data include poor data specifications from Cabinet Office ...

• Inconsistent address formatting and incomplete addresses are likely to have contributed to the significant numbers of existing electors returned in the data (Cabinet Office could not provide the data which would have allowed for a definitive assessment) ...

• In order to answer this question [Is data mining a cost effective way of registering new electors?], we would need to assess the cost benefit of data mining by, for example, calculating the cost per new elector registered. However, we are unable to do this as Cabinet Office could not provide details of their expenditure on the pilot. As they managed the process and conducted much of the matching and data processing, their costs could be significant and are crucial in reaching any realistic assessment of cost effectiveness ...

– The addresses appeared to be more complete than those held in other national databases but a poor data specification from Cabinet Office meant that the format was inconsistent ...

The findings from this pilot do not justify the national roll out of data mining ...

In addition, there were numerous issues in this pilot with the communication and support provided by Cabinet Office ...

Cabinet Office need to ensure that they maintain good communication between themselves, the data holding organisations and EROs [electoral registration officers] throughout the process, including after data from the national databases has been returned to EROs ...
It's a long time ago, of course, well before yesterday, but there is no evidence of GDS making any more successful trips into the world of data science.

Later that year, on 16 October 2013, Mike Bracken, who was chief executive of GDS at the time, gave a speech to the Code For America Summit. "The Efficiency and Reform Group have saved about £10 billion of Whitehall costs", he told delegates, and "this figure represents about 4% of the UK's gross domestic product".

No. £10 billion was about 0.6% of GDP at the time, not 4%. That sort of a mistake must bring tears to the eyes of the Office for National Statistics (ONS). Mr Bracken nevertheless became the government's chief data officer in March 2015.

He left GDS last September, 2015. It's not obvious that GDS have since developed any greater respect for numbers. They say that their forlorn identity management scheme, GOV.UK Verify (RIP), can only go live if the account creation success rate reaches a minimum of 90%. It's currently 70%. GDS want GOV.UK Verify (RIP) to go live anyway.

"In May we will be publishing the latest instalment of our next National Action Plan as part of the Open Government Partnership". That's what the Cabinet Secretary said the other day.

The ONS are in on that plan. So are the ODI, the Open Data Institute. And data.gov.uk ...

... and GDS. How did they get in there? Their inclusion can't be based on their record. It's not exactly an example of data science in action, is it.

The magic of open data #1

"Sharing information across government databases
will dramatically increase governmental powers –
otherwise the UK government wouldn't have proposed it."
Professor Sir Nigel Shadbolt, Chairman, Open Data Institute


Lough Erne in County Fermanagh, Northern Ireland, "is a particularly scenic waterway, renowned for its beautiful setting. The area is popular for angling and watersports, with waterskiing, Rowing and wakeboarding being amongst the most popular; the stretch of water alongside the Broadmeadow, Enniskillen, has hosted stages of the World Waterski Championships annually since 2005, and in 2007, a pro-wakeboard competition, 'Wakejam' was hosted by the Erne Wakeboard Club (EWC) after successful national wakeboard competitions in the previous years. Canoeing is also a popular recreational sport on the Erne".

That's what it says in Wikipedia and that's where, on 18 June 2013, after a hard day's fishing and wakeboarding, the G8 canoed back to shore and issued their famous Declaration (para.7):
We, the G8, agree that open data are an untapped resource with huge potential to encourage the building of stronger, more interconnected societies that better meet the needs of our citizens and allow innovation and prosperity to flourish.

Wednesday, 15 May 2013

"When it comes to cyber security QinetiQ couldn’t grab their ass with both hands"

So said Bob Slapnik, vice president at HBGary, the security experts "detecting tomorrow's threats today", as reported by Bloomberg, the company that's been using its financial information terminals to spy on its clients. So says the New York Times, the company whose cyberdefences were breached in 2012 by the Chinese, seeking to stop people being rude about Prime Minister Wen Jiabao. Although the Chinese say they didn't.

You can see why Mr Slapnik was cross back in 2010. QinetiQ had just won a contract to advise the Pentagon on how to counter cyberespionage despite QinetiQ's own computer systems having been comprehensively hacked for the previous three years.

But talk about the pot calling the kettle black, one reason QinetiQ's inability to grab its ass with both hands came to light was an examination of the documents hacked out of HBGary in 2011 by Anonymous, the cybervigilantes previously derided as mere "script kiddies", who were so piqued by Aaron Barr, HBGary's CEO, pretending that he had infiltrated them that Anonymous ...
... infiltrated HBGary’s servers, erased data, defaced its website with a letter ridiculing the firm with a download link to a leak of more than 40,000 of its emails to The Pirate Bay, took down the company’s phone system, usurped the CEO’s twitter stream, posted his social security number, and clogged up fax machines ... 'You brought this upon yourself. You’ve tried to bite the Anonymous hand, and now the Anonymous hand is bitch-slapping you in the face', said the letter posted on the firm’s website ...
That's according to Dr Thomas Rid, who finishes his report with: "the attack badly pummeled the security company’s reputation". Yes, you can see how it would, but HBGary (detecting yesterday's threats tomorrow) had been commissioned to sort out QinetiQ's cybersecurity problems so circumspice, Mr Slapnik.

Not to be left out, Bloomberg had been targeted by the same Chinese hackers in pursuit of the same object – keeping Mr Wen's business dealings out of the news. Fail. Everyone who is anyone had been hacked. The Pentagon briefed "about 30" defence contractors like QinetiQ about Chinese hacking in 2007-08, too late to stop the Chinese acquiring so much information on Lockheed Martin's F-22 and F-35 fighter jets that it's doubtful now whether it's worth deploying them. Ditto the designs for the US combat helicopter fleet, drones, satellites and military robotics, all of which were copied from QinetiQ's computers.

Bloomberg's computers weren't hacked straight from China. The Chinese tried to come in via computers they had taken over in various US universities. Same modus operandi, NASA complained to QinetiQ that it was under attack by the Chinese via QinetiQ's computers and would QinetiQ please sort it out. Investigators into that hack found that you could just sit in the car park and connect to QinetiQ's network via an unsecured wifi. They also found that the Russians had been stealing trade secrets from QinetiQ for 2½ years.

Towards the end, the Chinese had access to 13,000 internal passwords at QinetiQ and they could do pretty much whatever they wanted: "by 2009, the hackers had almost complete control over TSG’s computers". TSG is QinetiQ's Technology Solutions Group, whose boss reckoned that investigating all this hacking took too long. "You finally have to reach a point where you say let’s move on" and, indeed, he has now moved on.

HBGary weren't the only security experts trying to sort out QinetiQ. Mandiant were in there (and at the New York Times) and suggested using two-factor authentication to log on to the QinetiQ network, the way those of us with a Lloyds business account do. No, said QinetiQ, and off went all their robotics designs.

HBGary's counter-espionage software was installed on 1,900 QinetiQ computers but it wouldn't run on a lot of them and when it did it missed some rogue software and reported some benign software and it slowed the machines down so users did what they always do and deleted it. HBGary accused another consultant, Terremark, part of Verizon, of withholding information and Terremark said damned if they were telling HBGary anything, their clunky software was alerting the hackers to the investigation.

Two months after the all-clear, the FBI had to tell QinetiQ they were losing data again and all the consultants came back and tried to clear out the malware they had missed last time round. Meanwhile, the Chinese have got bomb disposal robots on the market that look remarkably like QinetiQ's but they're cheaper.

All of which is just by way of introductory remarks. Setting the scene.

Remember Skyscape? The cloud computing company owned by just one man? The company with contracts from the MOD, HMRC and the Government Digital Service (GDS)?

GDS never did respond to the letter asking them how they had seen fit to entrust GOV.UK to a one-man company. But HMRC did. Twice. Which is very proper of them.

The HMRC response came from Phil Pavitt, HMRC's Director General Change, Security and Information. He said (22 October 2012):
Skyscape’s services are provided through a number of key, or “Alliance”, Partners. These partners are industry leading organisations that provide services in the data centre or “cloud” arena such as EMC (storage  and security services), Cisco (networking) and Ark Continuity (UK based high security data centres) ...

... data security remains integral to HMRC and a pre-requisite of any of our data being migrated to Skyscape is for their solution, including all the constituent parts, to be formally accredited by CESG (the Communications-Electronics Security Group) to Impact Level 3 (IL3) ...

This accreditation is expected imminently, at which point HMRC will be in a position to begin securely moving data over to Skyscape and decommissioning our old servers ... will be re-competed to ensure HMRC continues to take advantage of innovative, secure and low cost solutions ...

It should also be noted that for security reasons HMRC does not discuss details of the data that it holds, or where it stores it, however we are able to confirm that by using Skyscape HMRC data will continue to be kept in accordance with existing legislation and HMRC security policies ...

The data, which will be securely stored by Skyscape, currently resides on several hundred servers, across multiple HMRC office locations. This change will consolidate that data and place it into a small number of secure and highly resilient cloud data centres hence improving the security of the data, the efficiency of managing that data ...
and (28 November 2012):
I must reiterate our assurance that using Skyscape HMRC data will continue to be kept in accordance with existing legislation and HMRC security policies.

When fully operational, Skyscape Cloud Services Ltd will securely host all HMRC data currently held on office File and Print Servers (FAPS) ... FAPS do not hold the definitive tax records for the UK and these records remain distributed across a number of secure systems.

HMRC routinely risk assesses and tests the security of our solutions and services. Our secure connection to Skyscape will be delivered in line with HM Government standards to protect our data, with ongoing assurance checks throughout the life of this service ...

Data security remains integral to HMRC and a pre-requisite of any of our data being migrated to Skyscape is for their solution, including all the constituent parts, to be formally accredited by CESG (the Communications-Electronics Security Group) to Impact Level 3 (IL3). All security aspects of the service will have to be proven in line with HM Government security standards. This will include the need to ensure the ‘cloud’ is hosted in a UK domiciled, secure data centre(s) and operated by staff with appropriate security clearance ...
It's not just HMRC. Here's GDS in their Government Digital Strategy:
We know that our users often find it hard to register for our online services, so it is
vital that we offer a more straightforward, secure way to allow our users to identify
themselves online while preserving their privacy ... (p.34)

Legality, security and resilience

Transactional services will be redesigned to:
  • be robustly protective of the security of sensitive user information
  • maintain the privacy and security of all personal information ... (p.46)
And here's Mydex, one of the UK's eight identity providers, writing about PDSs (personal data stores):
Personal Data Stores create a single, secure, easy-to-access store for such information so that when we need it it’s at our finger tips ... (p.8)

... the PDS can create one single message informing them of the fact that the card has been lost. It can then be sent securely, direct to their systems ... (p.9)

... behind each payment there is a hugely sophisticated system of highly secure data ‘handshakes’ taking place across a complete eco-system of supporting players ... (p.14)

Etc ...
Skyscape is in an alliance with QinetiQ. That doesn't bode well. But it's not just QinetiQ. The Pentagon felt it necessary, remember, to brief about 30 contractors on cybersecurity. They all have problems. Are any of them capable of grabbing their ass with both hands?

Judging by the daily diet of cyberattack stories, no. Cybersecurity looks like a myth. Just bear that in mind whenever a supplier offers you security.

----------

(Hat tip: Anonymous @ 3 May 2013 10:31, see also the excellent 'Chinese' attack sucks secrets from US defence contractor in ElReg®)

----------

Updated 22.5.14

There were bound to be consequences.

With all these allegations of Chinese hacking flying around, the US had to do something. And now they have. 19 May 2014:
America sues China over corporate spying
America's fraught trading relationship with China turned even more hostile on Monday, after Washington filed an unprecedented lawsuit against Beijing for corporate spying.

The US Department of Justice accused members of China’s military, the People’s Liberation Army, of stealing sensitive information from major energy and metal companies, including Alcoa, the aluminium producer, and Westinghouse, which makes nuclear reactors.
The post above was written three weeks before the Edward Snowden revelations. We now know what we didn't in mid-May 2013 that the US is quite capable of a bit of hacking themselves. It's not just China.

Which may be what China had in mind in their initial response to the US suing them. They called the US a "high-level hooligan". Not entirely impolite – it's better than being a low-level hooligan.

Then they raised the stakes, by calling the US a "mincing rascal". It's not clear which international law being a mincing rascal contravenes. But it sounds bad. China wins phase one of the epithet war.

This whole cybersecurity and countersecurity business is fraught with dilemmas. Ethical, legal, diplomatic and trade dilemmas.

Given that you are a rascal, is it better to be a mincing one than not? It's not clear.

And then there's the FBI problem.

Like everyone else, they're trying to recruit infosec/information security experts. These experts are exceptional people. Few and far between, an inordinate number of them lead lives fuelled on drugs, 21 May 2014:
Wacky 'baccy making a hash of FBI infosec recruitment efforts

... FBI Director James Comey ... reportedly told the White Collar Crime Institute that he needs a “great work force” to compete with the black hats, but “some of those kids want to smoke weed on the way to the interview”.
Ethics, the law, diplomacy or trade? Which one will win?

Trade. It often doesCisco to Obama: get NSA out of our hardware. Etc ...


Updated 19.1.15

China now knows what most people in the west are catching up with: that the F-35 Joint Strike Fighter is a lemon.

The latest round of managed information release by Edward Snowden via Spiegel (one of a series) includes the snippet that Chinese security services copied “terabytes” of data about the aircraft ...
Please see also China calls Snowden's stealth jet hack accusations 'groundless'. "Lockheed Martin is producing the F-35 for the U.S. military and allies in a $399 billion project, the world's most expensive weapons program.".

So much for the security of Lockheed Martin's computer systems.

Lockheed Martin must be among the best in the business. The security business. And $399 billion should buy you the best of ... just about everything. And yet "the F-35 Joint Strike Fighter is a lemon".

Charming old stick-in-the-muds that they are, the Government Digital Service may believe that they can offer the public a secure national identity scheme, GOV.UK Verify. But they really can't expect us to believe it. Not now.


Updated 25.5.15

John Bercow mood music

"Read our blog", said the self-proclaimed Digital Leaders on 25 May 2015, and pointed us all at a 12 February 2015 blog post by John Bercow MP, Speaker of the House of Commons, British democracy and the digital revolution.

Mr Speaker established a special Commission in late 2013 to "consider how the digital revolution has changed or might further develop British representative democracy".

The Commission has reported now. It sets five targets. And target #4 is:
By 2020, secure online voting should be an option for all voters.
 Feasible?

Just reading over the post above, you can't help noticing that Lockheed Martin of all people couldn't keep the design of the F-35 Joint Strike Fighter secure. Ditto the F-22. Ditto the designs for the US combat helicopter fleet, drones, satellites and military robotics, all of which were copied from QinetiQ's computers. But Mr Speaker thinks that on-line voting could be secure.

Why does he think that? What does he know that Lockheed Martin and QinetiQ don't?

And Sony. What does Mr Speaker know that Sony don't know?

Remember Sony?
For two weeks or so now [we said in December 2014], we have all watched as Sony's private and confidential correspondence has been published by hackers, personal details about the stars of their films have been revealed and the value of the company's intellectual property has been destroyed.
If Mr Speaker can obtain endorsements from Lockheed Martin, QinetiQ and Sony to the effect that they have good reason to believe that he knows how to deliver secure on-line services including electronic voting, maybe we'll believe that his target #4 is feasible. Otherwise, no, his words are just John Bercow mood music.

"When it comes to cyber security QinetiQ couldn’t grab their ass with both hands"

So said Bob Slapnik, vice president at HBGary, the security experts "detecting tomorrow's threats today", as reported by Bloomberg, the company that's been using its financial information terminals to spy on its clients. So says the New York Times, the company whose cyberdefences were breached in 2012 by the Chinese, seeking to stop people being rude about Prime Minister Wen Jiabao. Although the Chinese say they didn't.

You can see why Mr Slapnik was cross back in 2010. QinetiQ had just won a contract to advise the Pentagon on how to counter cyberespionage despite QinetiQ's own computer systems having been comprehensively hacked for the previous three years.

Monday, 21 January 2013

Skyscape Cloud Services push the boat out

Time was, when you went to the cinema, there was always an advert for the local curry house.

These short promotional films followed rules from which no deviation was permitted.

The cameraman had to have the shakes. The soundtrack had to be just as unsteady, as though it was hanging on, rather listlessly, and didn't much care if it lost its grip.

The first grainy shot would have the proprietor, off-centre, trying to smile naturally and failing. All expense spared, the film would cut to a close-up of congealed entrails in a cracked bowl and then pull back to show a lot of worryingly pasty-faced people with no make-up sitting round a table and looking as though they might try eating the entrails. Or not.

Finally, without warning, it would stop being daylight and while the sound recordist replaced the sitar music with something more Hawaiian a voice-over would explain to us that the restaurant was just three doorways from this very venue, as though we didn't know, next to the betting shop.

It's always been a mystery. What happened to the professionals who made these gems? Where are they now? Let's face it, we miss them, it's part of our heritage.

Mystery solved. Take a look at this. Five-and-a-half minutes of Skyscape Cloud Services – Storage as a Service on EMC Atmos.

Let the whole thing waft over you and then try to answer a few questions:
  • How much training was the graphic designer given? Any?
  • Why didn't they just re-record the voice-over instead of editing it, apparently with a trowel?
  • Who is being advertised? Skyscape? Or EMC?
  • What are they selling and why should you buy it?
  • How far are they from the betting shop?
  • Can you remember anything about the film you've just seen?
It's a hugely nostalgic five-and-a-half minutes. Especially when you realise that HMRC have contracted with this company, probably Skyscape but maybe EMC, to store a lot of our data currently kept at HMRC local offices. And that GDS, the Government Digital Service, have contracted with them to host GOV.UK, the website on which all public services are supposed soon to depend.

Does this little film inspire you with the confidence to host your website and store your data with Skyscape/EMC? Or would you rather eat the congealed entrails after all?

Skyscape Cloud Services push the boat out

Time was, when you went to the cinema, there was always an advert for the local curry house.

These short promotional films followed rules from which no deviation was permitted.

The cameraman had to have the shakes. The soundtrack had to be just as unsteady, as though it was hanging on, rather listlessly, and didn't much care if it lost its grip.

The first grainy shot would have the proprietor, off-centre, trying to smile naturally and failing. All expense spared, the film would cut to a close-up of congealed entrails in a cracked bowl and then pull back to show a lot of worryingly pasty-faced people with no make-up sitting round a table and looking as though they might try eating the entrails. Or not.

Finally, without warning, it would stop being daylight and while the sound recordist replaced the sitar music with something more Hawaiian a voice-over would explain to us that the restaurant was just three doorways from this very venue, as though we didn't know, next to the betting shop.

It's always been a mystery. What happened to the professionals who made these gems? Where are they now? Let's face it, we miss them, it's part of our heritage.

Wednesday, 28 November 2012

HMRC, Skyscape and a 2nd response from Phil Pavitt

G-Cloud, GDS, HMRC and Skyscape, the company with just one director, who owns all the shares – Whitehall SNAFU
Open letter to Lin Homer, Chief Executive, HMRC, asking about the wisdom of entrusting their data (our data) to the cloud with Skyscape Cloud Services Ltd.
Response from Phil Pavitt, Director General Change, Security and Information, HMRC, on behalf of Lin Homer.
Open letter to Phil Pavitt.
28 November 2012
Response dated 26 November 2012 from Phil Pavitt, please see below:

[Skyscape has subsequently changed its name to UKCloud: "London – August 1, 2016 – Skyscape Cloud Services Limited, the easy to adopt, easy to use and easy to leave assured cloud services company, has today renamed and relaunched as UKCloud Ltd (www.ukcloud.com), to reinforce the company’s exclusive focus on supporting the UK public sector in the digital transformation of services".]


HMRC and Skyscape Cloud Services Ltd

Dear Mr Moss

Thank you for your letter of 24 October 2012 expressing your concerns in respect of Skyscape Cloud Services Ltd suitability to host HMRC data. I apologise for the delay in responding to you.

Further to my reply of 22 October, I wanted to provide you with some more information to alleviate your concerns. I must reiterate our assurance that using Skyscape HMRC data will continue to be kept in accordance with existing legislation and HMRC security policies.

When fully operational, Skyscape Cloud Services Ltd will securely host all HMRC data currently held on office File and Print Servers (FAPS). FAPS support the work of many HMRC offices and hold data for a wide range business purposes e.g. administrative and customer related. FAPS do not hold the definitive tax records for the UK and these records remain distributed across a number of secure systems.

HMRC routinely risk assesses and tests the security of our solutions and services. Our secure connection to Skyscape will be delivered in line with HM Government standards to protect our data, with ongoing assurance checks throughout the life of this service.

As emphasised in my letter of 24 October, in order to deliver through G-Cloud, Skyscape were required to meet a set of mandatory criteria set out by Government Procurement Services (GPS) including financial standing and Experian risk assessments. Additionally, HMRC carried out its own standard taxation and financial compliance checks before awarding the contract and Skyscape passed the standards set by HMRC and Government.

All G Cloud contracts are let on a one year basis, with exit provisions agreed to transfer the data to a new supplier should this prove necessary.

Data security remains integral to HMRC and a pre-requisite of any of our data being migrated to Skyscape is for their solution, including all the constituent parts, to be formally accredited by CESG (the Communications-Electronics Security Group) to Impact Level 3 (IL3). All security aspects of the service will have to be proven in line with HM Government security standards. This will include the need to ensure the ‘cloud’ is hosted in a UK domiciled, secure data centre(s) and operated by staff with appropriate security clearance. We are also carrying out internal accreditations including Internal Risk Management and Accreditation Document Set (RMADS) and PSN risk assessments.

I trust that this answers your concerns and you are able to appreciate our decision to contract with Skyscape.

Yours sincerely

Regards

Phil Pavitt
HMRC Director General Change, Security and Information

HMRC, Skyscape and a 2nd response from Phil Pavitt

G-Cloud, GDS, HMRC and Skyscape, the company with just one director, who owns all the shares – Whitehall SNAFU
Open letter to Lin Homer, Chief Executive, HMRC, asking about the wisdom of entrusting their data (our data) to the cloud with Skyscape Cloud Services Ltd.
Response from Phil Pavitt, Director General Change, Security and Information, HMRC, on behalf of Lin Homer.
Open letter to Phil Pavitt.
28 November 2012
Response dated 26 November 2012 from Phil Pavitt, please see below:

[Skyscape has subsequently changed its name to UKCloud: "London – August 1, 2016 – Skyscape Cloud Services Limited, the easy to adopt, easy to use and easy to leave assured cloud services company, has today renamed and relaunched as UKCloud Ltd (www.ukcloud.com), to reinforce the company’s exclusive focus on supporting the UK public sector in the digital transformation of services".]


HMRC and Skyscape Cloud Services Ltd

Dear Mr Moss

Thank you for your letter of 24 October 2012 expressing your concerns in respect of Skyscape Cloud Services Ltd suitability to host HMRC data. I apologise for the delay in responding to you.

Further to my reply of 22 October, I wanted to provide you with some more information to alleviate your concerns. I must reiterate our assurance that using Skyscape HMRC data will continue to be kept in accordance with existing legislation and HMRC security policies.

When fully operational, Skyscape Cloud Services Ltd will securely host all HMRC data currently held on office File and Print Servers (FAPS). FAPS support the work of many HMRC offices and hold data for a wide range business purposes e.g. administrative and customer related. FAPS do not hold the definitive tax records for the UK and these records remain distributed across a number of secure systems.

HMRC routinely risk assesses and tests the security of our solutions and services. Our secure connection to Skyscape will be delivered in line with HM Government standards to protect our data, with ongoing assurance checks throughout the life of this service.

As emphasised in my letter of 24 October, in order to deliver through G-Cloud, Skyscape were required to meet a set of mandatory criteria set out by Government Procurement Services (GPS) including financial standing and Experian risk assessments. Additionally, HMRC carried out its own standard taxation and financial compliance checks before awarding the contract and Skyscape passed the standards set by HMRC and Government.

All G Cloud contracts are let on a one year basis, with exit provisions agreed to transfer the data to a new supplier should this prove necessary.

Data security remains integral to HMRC and a pre-requisite of any of our data being migrated to Skyscape is for their solution, including all the constituent parts, to be formally accredited by CESG (the Communications-Electronics Security Group) to Impact Level 3 (IL3). All security aspects of the service will have to be proven in line with HM Government security standards. This will include the need to ensure the ‘cloud’ is hosted in a UK domiciled, secure data centre(s) and operated by staff with appropriate security clearance. We are also carrying out internal accreditations including Internal Risk Management and Accreditation Document Set (RMADS) and PSN risk assessments.

I trust that this answers your concerns and you are able to appreciate our decision to contract with Skyscape.

Yours sincerely

Regards

Phil Pavitt
HMRC Director General Change, Security and Information

Monday, 26 November 2012

HMRC soon to be Pavittless

Computer Weekly, 22 November 2012:
Phil Pavitt has stepped down as HMRC’s CIO to join insurance giant Aviva as global director of IT transformation ...

Under his role at Aviva Pavitt will be tasked with simplifying the firm’s IT services, and modernising and digitising its business.
DMossEsq readers have met Mr Pavitt a couple of times.

Back in May he forgot that the UK already has a Government Gateway and doesn't need GDS – the Government Digital Service – to develop a new one, even if they could.

More recently, he was deputed by Lin Homer, Chief Executive of HMRC, to explain why HMRC have decided to store all our tax records with a one-man company, Skyscape Cloud Services Ltd:
  • Let's hope he has time to explain this transformational decision to the public before he leaves HMRC.
  • And let's see if Aviva, in the name of "modernisation", will store all their insurance records in the cloud and instantly lose control of them.

HMRC soon to be Pavittless

Computer Weekly, 22 November 2012:
Phil Pavitt has stepped down as HMRC’s CIO to join insurance giant Aviva as global director of IT transformation ...

Under his role at Aviva Pavitt will be tasked with simplifying the firm’s IT services, and modernising and digitising its business.
DMossEsq readers have met Mr Pavitt a couple of times.

Sunday, 4 November 2012

Cloud computing – how to lose control of your data #94

It's Sunday. Give us a break
Cloud computing is supposed to be cheaper than the alternatives. How many times have we heard that some new management fashion will save us money? How many times can we fall for it? How many times has it turned out to be true? Exactly.

Cloud computing is meant to be more efficient, more reliable, more trusted, more flexible, more scalable, more resilient, more modern, more transformative, ... In each case, the claim is either false or, at best, unproven.

No need to keep banging on about it, the point has been made.

Sign up for cloud computing, like what Her Majesty's Government has in the UK, and you lose control of your data. You want to go out of business? Go ahead. Up to you. Stick your data in the cloud.

We know that. It's all a bit relentlessIt's Sunday. Give us a break.

The gift that keeps on giving
Actually, there's another reason to avoid cloud computing, one that hasn't been mentioned so far on DMossEsq, a new answer to the question why is it foolish to store your data in the cloud.

Kim Dotcom, mega
Still very young, Mr Schmitz
or Dotcom
or Kimble (c.f. The Fugitive)
will be all of 39 years old
on 21 January 2013
6'6" tall and weighing 290lb, the only reason Kim Dotcom (né Schmitz) didn't go to prison after being found guilty on 11 counts of fraud was that ... he was under age at the time of the offences and the judge put it all down to youthful foolishness.

Like most teenagers, he had hacked into NASA. And Citibank. He had also found out how to make international phone calls for free and, unlike most teenagers, had a nice little sideline selling access to these free telecommunications facilities.

He got off the 11 fraud charges with a suspended sentence. And the 10 data espionage charges. But when the insider trading charges started to look a bit serious, he decamped to Thailand. The Thais extradited him back to Germany and he finally served a stretch there. Five months on remand. Quite right, too.

Mr Dotcom loves playing computer games, particularly Modern Warfare 3.

That is not a recognised sign of intellectual achievement, you say.

As you wish. But some people are better at problem-solving than others. How good are you? There are over 15 million players of Modern Warfare 3 worldwide and Mr D was ranked #1, only falling to #2 after a sojourn in a New Zealand prison, about which, more anon.

He also loves cars. Driving in Morocco one day, he became impatient with the car in front and rammed it off the road. These things happen. How was he to know it was being driven by the chief of police?

Kim next set up shop in Hong Kong, picked up a few fines for false declarations to the stock exchange and for marketing a hedge fund that had many fine qualities, like artificial intelligence, but didn't happen to exist and the good ship Dotcom next struck land in New Zealand.

Megaupload
But before that, while in Hong Kong, he had set up a real company, Megaupload. A cloud services company, with 150 staff and and revenues of $175 million p.a., Megaupload had 60 million users, or 180 million according to some reports, it was ranked #13 among all the websites in the world and accounted for 4% of web traffic. Worldwide.

If New Zealand had any qualms about Kim Dotcom's application for residence, the thought of uploading some his money into New Zealand seems to have allayed them. He rented the most expensive house in the country, he laid on a $600,000 fireworks display in Auckland and he donated $50,000 to the mayor's re-election campaign.

Mr Dotcom was rich.

There was a problem when the mayor later had trouble remembering this donation. What would you do, you who have never played Modern Warfare 3? Kim recorded a song called Amnesia. See? Problem-solving. Some people are good at it.

Megaupload was so big that it rented no less than 1,100 servers from another cloud services company, Carpathia, to store all the data people kept handing over.

Got it. You're going to lecture us about contracts. Users may have a contract with one cloud services supplier (e.g. Megaupload) but, if that company hands the users' data over to another cloud services supplier (e.g. Carpathia) with whom the users have no contract, then they have lost control of their data. Ha!

Wrong. Everyone knows that already. That's not a new reason to beware the perils of cloud computing. Think again ...

Hollywood loves a swashbuckler
Not this one they don't.

According to Hollywood, Megaupload has cost them $500 million. It was a seat of piracy, Hollywood's intellectual property rights were being stolen by felons illegally uploading films and TV programs to Megaupload.

That's just my point, you say, you shouldn't be making light of the activities of a seedy criminal.

No-one is making light of anything, least of all Mr Dotcom, who may be a criminal but he is entertaining as well, both, the one doesn't exclude the other.

And not so fast with the "criminal". His Megaupload crimes are alleged. He hasn't been found guilty of them. There's a law. The Digital Millennium Copyright Act (DMCA), which protects the suppliers of a website from the illegal activities of the users of that website. Without that, Sergey Brin of Google would spend his whole time in prison because of all the porn on YouTube. So stick that in your pipe, Roundhead, smoke it and inhale.

DMCA and the evidence against Kim Dotcom were presumably considered by a grand jury and on 5 January 2012 he was indicted on charges of online piracy, racketeering, copyright infringement, and money laundering. That was in Virginia. In the US.
But Mr Dotcom was in New Zealand.

I know. You're going to hold forth on RICO, the Racketeer Influenced and Corrupt Organizations Act, the law they said would only ever be used against suspected gangsters, when opponents of its introduction suggested that its powers were so useful that prosecutors would be unable to resist the temptation to charge everyone with offences under RICO. No, no, said the legislators, that will never happen. But of course it has.

You mean like the surveillance laws here in the UK? The ones they said would only ever be used against suspected terrorists and now local councils use them for fly-tipping offences and dogs fouling the pavement and parents lying about living in the catchment area for desirable schools? No. Completely wrong. Everyone already knows about that. The question is what new reason is there to believe that it's foolish to store your data in the cloud? If all else fails, as teachers used to tell their students, try reading the question.

Due process
The indictments are in Virginia and Dotcom's in Auckland. What would Clarice Sparrow Starling do?

She would probably have a quiet word with her opposite numbers in New Zealand's Government Communications Security Bureau (GCSB). Point out how much appreciated it would be if they could help in this matter. She might maybe exert a bit of pressure. US tariffs on New Zealand lamb imports could be lifted. Or they could be increased. Extraordinary rendition? That kind of thing.

Kim Dotcom appears in court in Auckland in January.
The US wants New Zealand to extradite him
to face internet piracy allegations.
Photograph: AFP/Getty Images
Whatever the FBI said, GCSB went into action immediately. They put Dotcom under surveillance and two weeks later, on 19 January 2012, they got the assault rifles out, started up the helicopter and armed police invaded the Dotcom manor, impounded his possessions right, left and centre, arrested Kim, locked him in prison and froze his assets worldwide.

Which made it hard for him to pay his rent. Or his lawyers. When he was finally allowed access to a bit of his money, the lawyers argued successfully that it was against the law for GCSB to put New Zealand citizens under surveillance, including Kim Dotcom, and that the arrest warrant had been wrongly drafted – too non-specific.

The Prime Minister of New Zealand has subsequently apologised for these mistakes to Mr Dotcom personally and to New Zealanders in general and he has confirmed that GCSB officers mistakenly allowed FBI officers, who happened coincidentally to be present, to take copies of Mega Kim's impounded disk drives.

Prime Minister Key's re-election prospects are in doubt. So are President Obama's. Kim Dotcom blames him personally for his enforced stay in Mt Eden prison, Auckland.

At some point, Mrs Dotcom gave birth to their fourth and fifth children, girl twins, and Kim toyed with the idea of sending the placenta to the FBI to check for pirated DNA, another solution that would never have occurred to you, would it, but let's leave him there, he's clearly quite big enough to look after himself, and turn our attention instead to Kyle Goodwin.

OhioSportsNet
Back in January, the FBI took control of all Megaupload's domain names and their computers and they told Carpathia to keep the 1,100 servers Megaupload rented from them untouched.

The FBI also managed to freeze Megaupload's bank accounts.

Given that Megaupload is a Hong Kong company, how?

Bloomberg think it's something to do with one of Mr Dotcom's fellow defendants having a US address and being an "alter-ego" of the company. Any port in a storm.

Thing is, among the 60 million users of Megaupload, just a couple of them may not be copyright pirates or pornographers. Some of them, like Kyle Goodwin, may run their own legitimate business in Ohio, filming sports events for local high schools, and streaming the footage to sports coaches and the doting parents of the athletes. And Mr Goodwin would kind of like his footage back, please, he's got a business to run, Megaupload have no objection to the return of his data and neither have Carpathia but the courts have:
  • Who says it's his data, the US government asks? Or as their lawyers put it: “Mr. Goodwin has yet to demonstrate whether he has an interest in any property seized by the government ... the mere fact that he may claim, for example, an initial copyright to a version of the files he uploaded is not sufficient to establish that he has an ownership interest in the property that is the subject of this motion”.
  • Suppose we look at what is allegedly Mr Goodwin's data and find he's been infringing copyright? Then what? If he doesn't have "clean hands", we just might start doing a bit of indicting in Ohio.
  • But look, we can't possibly entertain Mr Goodwin's request. It would take ages.
  • And suppose everyone else started asking for their data back, too? Then where would we be?
  • And Carpathia are moaning, too, claiming that it's costing them $9,000 a day to keep these pestilential 1,100 servers out of use. Far as we're concerned Carpathia can just delete all the data on them, all 25 petabytes of it (that's 25 million gigabytes), a course of action various fussy defence lawyers have asked Carpathia please to not pursue.
http://www.megaupload.com today

Your data
And there, ladies and gentlemen, we have the answer.

Mr Goodwin is being represented by lawyers from the Electonic Frontier Foundation (EFF) and they say that "the [US] government maintains that Mr. Goodwin lost his property rights in his data by storing it on a cloud computing service ... both the contract between Megaupload and Mr. Goodwin ... and the contract between Megaupload and the server host, Carpathia ..., likely limit any property interest he may have in his data".

Sign a cloud computing contract and you lose the rights to your property.

The question was, what new reason is there to believe that storing your data in the cloud is a mistake?

And the answer is that you're going to have the devil of a job getting your solicitor to nip over to Quantico to prove that it's yours at all. And as for actually getting it back, forget it. The courts don't have time for all that nonsense. Easier just to delete it.

They wouldn't do that to HMRC and all our tax data stored on Skyscape Cloud Services Ltd's servers. Would they? There are 60 million of us for goodness sake. That could never happen. Could it? And then there's GDS and all our state benefits data stored on ditto ...

Don't you worry about that. Whitehall aren't worried. Don't you worry.

----------

Updated 5.11.12

Philip Johnston, Daily Telegraph, 'Whitehall has its head stuck in the cloud'


Updated 21.2.17

Andrew Orlowski, ElReg, 'NZ High Court rules US can extradite Kim Dotcom after all'