midata – nudging you into an interactive flashbased graph

There's so much wrong with midata, the Department for Business Innovation and Skills initiative to "empower" all us consumers, that you may forget the delightful loopiness of its proposed benefits:

If organisations try to share customer data with each other they invade individuals’ privacy and risk breaching the Data Protection Act. The result is duplication, waste and missed opportunities ... Tallyzoo, a service dedicated to self monitoring, allows users to measure anything from their caffeine intake to the number of times they cut their grass. Users collect data using a mobile device or website program which creates interactive flashbased graphs enabling them to spot trends and patterns in their consumption habits, work, health and fitness goals. Data is manipulated so that users can share statistics and compare the end results ... Access to such data represents a ‘holy grail’ data to companies because it explains why people do what they do and predicts what they are going to do next.

Silly old privacy laws. They just get in the way. They're synonymous with waste and duplication. They stand in the way of interactive flashbased  graphs of our coffee consumption and lawn-mowing. With midata choice engines we'll be able to predict the future and control it.

Which mooncalf would fall for this unlikely sales pitch? Cui bono?

There are many answers but one obvious one is Whitehall's Behavioural Insights Team.

They're not having much luck. Most people ridicule the team's nudging job. Their behavioural insight is limited. Tasked with getting UK retailers to sign up to midata, they failed and have now resorted to legislation – the very tool they're meant to abjure.

How could their performance be improved? What would help the Behavioural Insights Team to do its job?

These questions must have haunted Sir-Gus-now-Lord O'Donnell, head of the team's advisory board. And then along came midata. midata and its attendant app-writers, churning out choice engines to help people make life-style decisions, vehicles which could be tuned, perhaps, by Whitehall – who are footing the bill, after all, let's face it – tuned to influence, or nudge people's decisions in a chosen direction, an officially preferred direction ...

----------

Just after writing the word "pitch", just before "Cui bono", an email appeared from Alan Mitchell, the man who thinks midata will allow us to tell the future more accurately than horoscopes:

Please forward this newsletter to colleagues if you think they will find the content useful. Anyone can sign up to receive the newsletter by joining our registered [sheltered?] community here. We only send the newsletter to people who request to receive it.

Would you like to join this registered community? Perhaps this sample will help to nudge you:

We have published a short, informative paper, ‘midata: where next?’ ... It summarises the new focus areas of the programme and showcases a prize winning example straight from the recent inaugural, ground-breaking midata Hackathon of what innovation and value can be achieved in a new midata-enabled world ... In a series of blog posts we’ve ... discussed how, by opening up a new private sector market of Identity Providers which can act on an individual’s behalf, the Government is kick starting an ecosystem of enriched, trusted data sharing, stimulating innovation and cost saving opportunities ... There is further investment in the quantified self space as Canadian company Retrofit announces $8 million in new funding ...

----------

Added 1.4.13: Nike+ FuelBand and Google Glass: what next for the 'quantified self'?

midata – nudging you into an interactive flashbased graph

There's so much wrong with midata, the Department for Business Innovation and Skills initiative to "empower" all us consumers, that you may forget the delightful loopiness of its proposed benefits:

If organisations try to share customer data with each other they invade individuals’ privacy and risk breaching the Data Protection Act. The result is duplication, waste and missed opportunities ... Tallyzoo, a service dedicated to self monitoring, allows users to measure anything from their caffeine intake to the number of times they cut their grass. Users collect data using a mobile device or website program which creates interactive flashbased graphs enabling them to spot trends and patterns in their consumption habits, work, health and fitness goals. Data is manipulated so that users can share statistics and compare the end results ... Access to such data represents a ‘holy grail’ data to companies because it explains why people do what they do and predicts what they are going to do next.

Silly old privacy laws. They just get in the way. They're synonymous with waste and duplication. They stand in the way of interactive flashbased  graphs of our coffee consumption and lawn-mowing. With midata choice engines we'll be able to predict the future and control it.

Which mooncalf would fall for this unlikely sales pitch? Cui bono?

midata and identity assurance – BIS and DWP lure the British public into danger

Hat tip: Dave Birch

Questions have been raised about the advisability of creating population registers on the web.

The Department for Business Innovation and Skills (BIS) have an initiative called "midata" which would require us to enrol in identity registers in the cloud, please see for example Cybersecurity – good news at last, from midata.

The Department for Work and Pensions (DWP) have an initiative called "Universal Credit" which would require us to ditto, please see for example Identity assurance – convenient? It'll make your life so much easier.

The objections to subscribing to on-line population registers are manifold and include the dangers of cybercrime.

What dangers of cybercrime?

Take a look at this, from Reuters, 20 November 2012:

Man arrested in Athens over ID theft of most of Greek population ATHENS | Tue Nov 20, 2012 12:14pm EST (Reuters) - Greek police have arrested a man on suspicion of stealing the personal data of roughly two thirds of the country's population, police officials in Athens said on Tuesday. The 35-year old computer programmer was also suspected of attempting to sell the 9 million files containing identification card data, addresses, tax ID numbers and license plate numbers. Some files contained duplicate entries, police said. Greece's population is 11 million ...

BIS and DWP promise us, of course, that the midata and Universal Credit registers will be held in secure websites. No doubt. But then the Greek population register was supposed to be secure, too. Not much help, is it?

Surely this must be a one-off, you object? No. You're forgetting last year's Jerusalem Post, 24 October 2011:

'Contract worker stole all Israelis' personal information' By JPOST.COM STAFF LAST UPDATED: 10/24/2011 13:16 Information was used to create searchable database; computer technician put the database on Internet for anyone worldwide to access. A contract worker from the Labor and Welfare Ministry was charged with stealing the personal information of over nine million Israelis from the Population Registry, the Justice Ministry announced Monday after a media ban was lifted. The worker electronically copied identification numbers, full names, addresses, dates of birth, information on family connections and other information in order to sell it to a private buyer ...

And so it goes on ...

BIS and DWP are luring the British public into danger. It is at the very least irresponsible of them to do that. Why are they doing it?

It's up to them to answer that question.

Meanwhile, you are strongly advised to resist their invitations.

midata and identity assurance – BIS and DWP lure the British public into danger

Hat tip: Dave Birch

Questions have been raised about the advisability of creating population registers on the web.

The Department for Business Innovation and Skills (BIS) have an initiative called "midata" which would require us to enrol in identity registers in the cloud, please see for example Cybersecurity – good news at last, from midata.

The Department for Work and Pensions (DWP) have an initiative called "Universal Credit" which would require us to ditto, please see for example Identity assurance – convenient? It'll make your life so much easier.

The objections to subscribing to on-line population registers are manifold and include the dangers of cybercrime.

What dangers of cybercrime?

midata, consumption patterns and choice engines – the natural habitat of the stupid

People are forever ringing DMossEsq asking what is the key selling point of midata.

Here, once and for all, is the definitive answer.

Open the Impact Assessment for midata, turn to p.3 and read – it's all in there:

What are the policy objectives and the intended effects? Giving consumers access to their transaction data will enable consumers to make better informed decisions and choose products which offer them the best value. This in turn will reward firms offering the best value because they will be able to win more customers, increasing competition and leading to lower prices, improved efficiency and greater innovation. It will allow consumers to analyse and then improve their consumption patterns, particularly by enabling third party ‘choice engines’ to process transactional data on behalf of consumers and advise them on their consumption habits and potential switching options. We expect the release of information to stimulate innovation in and expansion of third party choice engines.

"Choice engines". What a phrase. Who won the office sweepstake last week for that one?*

The idea behind midata is that you should store all your transaction data in a personal data store (PDS) hosted in the cloud, on the web, by a trusted third party like, say, Mydex. Some innovative juvenile writes an app which, given the evidence of your consumption patterns, recommends the best play to go to see in London. You give Mydex permission to share your data with WhatsOnApp® and a stream of unwanted phone calls ensues, trying to get you to see Chicago. Ditto health apps – eat more broccoli. And financial apps – earn more interest, save with Bear Sterns.

You've got to be a bit stupid anyway to open a midata account in the first place and store all your personal data in the worldwide wild West of the web with a third party you've never met and have no reason to trust. Even more stupid to go on to share your personal data with unknown third party apps.

But then, you are stupid, aren't you.

That's what BIS must assume. You're the sort of person who can't choose what clothes to buy for the Summer without having an app to help you, see A midata future: 10 ways it could shape your choices.

Advocates of midata are forever promising an "ecosystem" of apps developers. That's not the answer to the question. They're more likely to create a natural habitat of the stupid.

----------

* Probably DMossEsq, come to think of it, see Have you ever had breakfast with Sophia Loren? (2003), p.81:

The choices made, the preferences expressed, are a function of my personality, if you like, of my character. That's using your language. In my language, personality or character is a choice engine. And choices are made to maximise rewards.

midata, consumption patterns and choice engines – the natural habitat of the stupid

People are forever ringing DMossEsq asking what is the key selling point of midata.

Here, once and for all, is the definitive answer.

Open the Impact Assessment for midata, turn to p.3 and read – it's all in there:

What are the policy objectives and the intended effects? Giving consumers access to their transaction data will enable consumers to make better informed decisions and choose products which offer them the best value. This in turn will reward firms offering the best value because they will be able to win more customers, increasing competition and leading to lower prices, improved efficiency and greater innovation. It will allow consumers to analyse and then improve their consumption patterns, particularly by enabling third party ‘choice engines’ to process transactional data on behalf of consumers and advise them on their consumption habits and potential switching options. We expect the release of information to stimulate innovation in and expansion of third party choice engines.

"Choice engines". What a phrase. Who won the office sweepstake last week for that one?*

Identity assurance – convenient? It'll make your life so much easier

Have DWP and GDS taken leave of their senses

suggesting that we should trust unknown third parties

with our user IDs and passwords?

Yes.

The Department for Work and Pensions (DWP) identity assurance press release the other day naming seven of the UK's "identity providers" (IDPs) was commendably short. Every word counted:

13 November 2012 – Providers announced for online identity scheme The Post Office, Cassidian, Digidentity, Experian, Ingeus, Mydex, and Verizon are the successful providers chosen to design and deliver a secure online identity registration service for the Department for Work and Pensions. The identity registration service will enable benefit claimants to choose who will validate their identity by automatically checking their authenticity with the provider before processing online benefit claims. The Minister for Welfare Reform Lord Freud said: "We are working with cyber security experts to ensure we are clear about the threats to the online process and we are confident that the providers announced today will offer an effective, safe and free to use identity service for future online benefit claims." As well as offering a safe and secure system, providers will be required to offer a simplified registration process, minimise the number of usernames and passwords a customer will need to remember and reduce the costs incurred across Government for the management of Identity Assurance. The online Identity Assurance model will be incorporated into Universal Credit as it’s developed and rolled-out. Over time Identity Assurance will become available to all UK citizens who need to access online public services.

"... providers will be required to ... minimise the number of usernames and passwords a customer will need to remember ..." – what's that all about?

At the moment, you have to know separate user IDs and passwords for logging onto Facebook, for example, Twitter, Amazon, eBay, PayPal, your bank, HMRC (self-assessment), HMRC (VAT returns), etc ... That is very inconvenient.

GDS, the Government Digital Service, the people behind identity assurance – remember, ex-Guardian man Mike Bracken is not only chief executive of GDS but also the senior responsible officer owner for the government's identity assurance programme – want to make your life more convenient.

So what they propose is that you give all those user IDs and passwords to your chosen IDP and let them log on for you. You still have to remember the user ID and password you use to log onto your IDP. But as long as you can do that, you're fine, your IDP will remember all other user IDs and passwords and log on for you.

That's obviously convenient. But is it wise?

Take a look at the seven IDPs. Which one would you trust with the user ID and password for your bank accounts? And why? You've never heard of them, have you? Apart from the Post Office. They may all be eminently trustworthy. But suppose some ne'er-do-well teenager with Asperger's hacks into them and just steals all the user IDs and passwords?

Remembering all those user IDs and passwords ourselves may be unavoidable. It may be the price we pay for security. It might be convenient to have someone do our remembering for us but, if we lose our security as a result, it wouldn't be wise.

Have DWP and GDS taken leave of their senses suggesting that we should trust unknown third parties with our user IDs and passwords?

----------

Updated 16.2.15

In the intervening two-and-a-bit years since the post above was written the notions of secure websites and secure communications have died a thousand times. Remember Sony. Take a look at yesterday's Telegraph, Hackers steal £650 million in world's biggest bank raid. Think back to QinetiQ.

Your only option is to minimise your inevitable losses. Make sure that if one set of defences is breached they aren't all breached. Maintain distinct logon ID-and-password combinations for each on-line service you use.

The Government Digital Service continue to try to breathe life into the corpse of their Identity Assurance programme (IDA). The service is now known as "GOV.UK Verify". GDS continue to ask us to believe against all the evidence that it is secure.

And they continue to advocate having as few logon ID-password combinations as possible on the grounds that that is convenient and the Devil take the risks. No bank would recommend that. But then the banks are liable to compensate you if your bank account is emptied by hackers. GDS aren't. If you're hacked as a result of using GOV.UK Verify, you pay.

The BBC have been drafted in to promote GOV.UK Verify. Here's an extract from BBC Radio 4's World At One news programme, 23 January 2015:



David Alexander, the CEO of Mydex, is interviewed. Mydex is one of the five "identity providers" left at GDS's identity assurance funeral. Use a Mydex personal data store (PDS), says Mr Alexander towards the end of the extract, and let that log on to all your other services for you. That will be much more convenient.

Take him, for example. Currently, he says, he has 705 logon ID-password combinations for on-line services he uses. That's awfully inconvenient. How much better to store them all in his PDS and let Mydex log on to these 705 services for him.

But hang on a minute. If one of those 705 services is hacked at the moment, he's left with 704 services that haven't been hacked. Follow his recommendation, use a Mydex PDS, and one security breach opens the door to all 705 services.

You don't need to be a genius at risk assessment to recognise the disproportionate danger of the PDS idea.

Mr Alexander is in 705 times more danger if he uses GDS's GOV.UK Verify than if he doesn't.

If someone offers you the convenience of a single logon ID-password combination, run a mile.

RIP IDA.

Identity assurance – convenient? It'll make your life so much easier

Have DWP and GDS taken leave of their senses

suggesting that we should trust unknown third parties

with our user IDs and passwords?

Yes.

The Department for Work and Pensions (DWP) identity assurance press release the other day naming seven of the UK's "identity providers" (IDPs) was commendably short. Every word counted:

13 November 2012 – Providers announced for online identity scheme The Post Office, Cassidian, Digidentity, Experian, Ingeus, Mydex, and Verizon are the successful providers chosen to design and deliver a secure online identity registration service for the Department for Work and Pensions. The identity registration service will enable benefit claimants to choose who will validate their identity by automatically checking their authenticity with the provider before processing online benefit claims. The Minister for Welfare Reform Lord Freud said: "We are working with cyber security experts to ensure we are clear about the threats to the online process and we are confident that the providers announced today will offer an effective, safe and free to use identity service for future online benefit claims." As well as offering a safe and secure system, providers will be required to offer a simplified registration process, minimise the number of usernames and passwords a customer will need to remember and reduce the costs incurred across Government for the management of Identity Assurance. The online Identity Assurance model will be incorporated into Universal Credit as it’s developed and rolled-out. Over time Identity Assurance will become available to all UK citizens who need to access online public services.

"... providers will be required to ... minimise the number of usernames and passwords a customer will need to remember ..." – what's that all about?

Cybersecurity – good news at last, from midata

Cybercrime
The magnificent power of the web is a double-edged sword. It makes it easy for us all to do our banking on-line. And it makes it easy for cybercriminals to defraud us. Huge brains are working on the side of law-abiding web users and they're holding the line. Thanks to them, fraud is held down, just, to acceptable levels. That could change. Huge brains are working on committing fraud and if they make any serious progress, eBanking and eCommerce in general could have to stop – there is no law of nature that says that eCommerce must be feasible. The web is a dangerous place to do business.

midata
Nevertheless, the Department for Business Innovation and Skills (BIS) want to "empower" consumers by getting us all to store all our transactions on-line, on the web, in the cloud, on the servers of unknown so-called "trusted" third parties or their sub-contractors. Is that a good idea? Given the incidence of cybercrime, aren't BIS behaving irresponsibly? With midata, they're inciting their parishioners to take serious and unnecessary risks. They're trying to take powers to force banks, phone companies, energy companies, retailers and others to put all our transaction data on the web.

"Oi, you two, Tesco, Sainsbury's, get over 'ere",

BIS are effectively saying,
pointing at the flames,

"and bring the petrol".

Impact assessment
Luckily, this proposed legislation requires an impact assessment, listing the putative benefits and the associated risks, please see Impact Assessment for midata – in case of any enquiries, ring Craig Belsham or David Miller.

You remember David Miller. He's the BIS economist who said at the 9 August 2012 open forum that it's very difficult to say if midata would boost the economy. It might. It might not.

Anyway, they're onto it. Under Key assumptions/sensitivities/risks on p.4 it says:

Consumer transaction data held by firms can be valuable commercial information. There is a risk that the existence of a power to compel firms to release this data to consumers may reduce their incentive to collect the information. To minimise this risk the power will only refer to ‘raw’ factual information. Any extension of the sectors beyond energy, mobile telecoms and personal banking/ credit cards will be subject to criteria aimed at promoting price transparency. Consumers will have more of their information in an easily accessible format this could pose a risk of an increase in identity theft or fraud.

"Consumers will have more of their information in an easily accessible format this could pose a risk of an increase in identity theft or fraud" – quite. So, is midata off the menu? Too risky?

Not a bit of it.

Solved
Turn to para.123 on p.48:

123. Consumers will increasingly have more of their information in an easily accessible format. With increasing amounts of this data held on home computers or with third party intermediaries, it may increase the likelihood of identity theft or fraud. This may lead to consumers increasing their own cyber security to mitigate this risk. The Government and members of the midata Interoperability Board are undertaking a programme of work to identify and address these issues, which will conclude before any secondary legislation is brought forward.

"The Government and members of the midata Interoperability Board are undertaking a programme of work to identify and address these issues" – sorted. It's hard to think of any sizeable organisation in the world from the Pentagon on down who won't be ringing Craig and David.

Cybersecurity – good news at last, from midata

Cybercrime
The magnificent power of the web is a double-edged sword. It makes it easy for us all to do our banking on-line. And it makes it easy for cybercriminals to defraud us. Huge brains are working on the side of law-abiding web users and they're holding the line. Thanks to them, fraud is held down, just, to acceptable levels. That could change. Huge brains are working on committing fraud and if they make any serious progress, eBanking and eCommerce in general could have to stop – there is no law of nature that says that eCommerce must be feasible. The web is a dangerous place to do business.

midata
Nevertheless, the Department for Business Innovation and Skills (BIS) want to "empower" consumers by getting us all to store all our transactions on-line, on the web, in the cloud, on the servers of unknown so-called "trusted" third parties or their sub-contractors. Is that a good idea? Given the incidence of cybercrime, aren't BIS behaving irresponsibly? With midata, they're inciting their parishioners to take serious and unnecessary risks. They're trying to take powers to force banks, phone companies, energy companies, retailers and others to put all our transaction data on the web.

"Oi, you two, Tesco, Sainsbury's, get over 'ere",

BIS are effectively saying,
pointing at the flames,

"and bring the petrol".