Shakespeare's take on property

Stephan Shakespeare, the founder of  YouGov, has published An Independent Review of Public Sector Information.

His idea is that we can expand the economy and increase general wellbeing if a cadre of brilliant data scientists is given access to the huge amounts of public sector information (PSI) held by the UK government. He also has his sights set on our personal data – open that data to being processed, and intelligent lifestyle decisions can be made for us by apps.

Who does this data belong to?

Shakespeare is consistent – the data belongs to "the citizen", "the public", "citizens":

My recommendations fall into five basic themes ... defining the principles of ownership: it all belongs to the citizen, not to the government (p.6) We should remain firm in the principle that publicly-funded data belongs to the public (p.6) Simply put, the strategy is ... Recognise in all we do that PSI, and the raw data that creates it, was derived from citizens, by their own authority, was paid for by them, and is therefore owned by them. It is not owned by employees of the government. All questions of what to do with it should be dealt with by the principle of getting the greatest value back to citizens, with input not just from experts but also citizens and markets. This should be obvious, but the fact that it needs to be constantly reaffirmed is illustrated by the way that even today, access to academic research that has been paid for by the public is deliberately denied to the public, and to many researchers, by commercial publishers, aided by university lethargy, and government reluctance to apply penalties; thereby obstructing scientific progress. (p.9) The strategy should explicitly embrace the idea that all PSI is derived from and paid for by the citizen and should therefore be considered as being owned by the citizen. It is the therefore the duty of government to make PSI as open as possible to create the maximum value to the nation. (p.11) Data that is derived from the activity of citizens must be seen as being at least co-owned by them and returning value to them, though the investment of business in collecting and processing the data should also be respected. There are government initiatives such as Midata, a government led project that works with businesses to give consumers better access to the electronic personal data that companies hold about them. The project recognises that data about citizens belongs to them and that they should have a way of claiming and using their ownership. Midata is currently about empowering consumers – government itself should explicitly embrace the Midata initiative to empower citizens by returning key data it holds on citizens back to them (pp.17-8)

Data is valuable. A business that takes that raw material and adds value to make a profit should pay for it. If they don't pay for it, then its ownership is being expropriated from the people it belongs to. We don't expect that. Most businesses pay for their raw materials. There is no reason to make an exception here.

The implication is clear. Any businesses which exploit the public's data should pay a licence to use it and/or they should pay a PSI tax (public sector information) and the licence fees and PSI tax payments collected by the Exchequer should be used to reduce personal income tax and employees' National Insurance payments.

Strikingly, that is not Shakespeare's conclusion. He says:

This data, to optimise its value to society, must be open, shareable and, where practical, it should be free (p.7) Some good progress has been made in opening up data for public sector sharing and reuse. But restrictive licensing, applied to key PSI, limits the opportunity for businesses, especially SMEs, to make effective use of PSI as an underpinning business resource. (p.13)

Shakespeare starts from an Obamaesque you-didn't-build-that-bridge position but finishes by expropriating the public because otherwise "businesses, especially SMEs" would have their opportunities limited.

He may be right. Even so, it's a remarkable change of direction during the exposition of his recommendations – one minute the data belongs to the public and next minute it doesn't.

Shakespeare's take on property

Stephan Shakespeare, the founder of  YouGov, has published An Independent Review of Public Sector Information.

His idea is that we can expand the economy and increase general wellbeing if a cadre of brilliant data scientists is given access to the huge amounts of public sector information (PSI) held by the UK government. He also has his sights set on our personal data – open that data to being processed, and intelligent lifestyle decisions can be made for us by apps.

Who does this data belong to?

Shakespeare, Google and our new government

The world is now in the second phase of the web revolution. So says the political pollster Stephan Shakespeare in his report, An Independent Review of Public Sector Information.

In Phase 1, the revolutionary winners – Shakespeare's Robespierre heroes listed on p.5 of his report – rose to the top on the basis of the unprecedented ease of communication between suppliers and consumers:

Google, Ebay, Facebook, Amazon, PayPal, Yahoo, Microsoft, Twitter, Apple – the companies through which our daily lives are run ...

Now we're in the next revolutionary phase, he says (also p.5):

Phase 2 sees an equivalent leap, this time in the capacity to process and learn from data. Is that exciting? It couldn't be more exciting: from data we will get the cure for cancer as well as better hospitals; schools that adapt to children’s needs making them happier and smarter; better policing and safer homes; and of course jobs. Data allows us to adapt and improve public services and businesses and enhance our whole way of life, bringing economic growth, wide-ranging social benefits and improvements in how government works.

Shakespeare's theme is that, if only they're given enough of our personal data, then intelligent scientists can run our daily lives for us even more intimately than in Phase 1, the quality of government will improve and, what's more, the economy will grow.

Before we consider those propositions, let's quickly remind ourselves about some of Shakespeare's heroes:

• Google, Facebook, Amazon, PayPal, Apple, et al, have, indeed, made a fortune and acquired enormous power often, it seems, beyond the reach of mere governments. That owes precisely nothing to Shakespeare or to the UK initiative he now advocates.
• Apple relies on a brilliant combination of slave labour in the third world and adolescent fashion-consciousness in the first. Their popularity survived not only the slave labour and the high prices they charge, but also the revelation that their iPhones track your every move.
• Enviably clever of them, PayPal act like a bank but they're not – most of the difficult know-your-customer work is done for them by real banks, on whose backs PayPal get a free ride, charging whatever commission and transaction fees they judge they can get away with.
• Amazon has built a quasi-monopoly and now chisels its suppliers' margins in the same way the UK supermarkets are always accused of impoverishing farmers. At the same time, Amazon has started increasing the commission it requires from traders who rely on its digital floorspace to sell their wares.
• That is common knowledge. Less widely appreciated is Amazon's dominant position in "cloud computing". Amazon Web Services already stores a lot of our data "in the cloud" where it is under their control, and seeks through predatory pricing to gain control of a lot more.
• Google and Facebook entered Phase 2 of the revolution years before Shakespeare drew our attention to it. They make their money by selling all the personal information we users of their services give them for free to marketing companies, see for example Martin Sorrell: if you don’t eat your children, someone else will. They are forever facing government enquiries in Europe and the US into their unsatisfactory privacy policies. You can get a hollow laugh out of the fact that they don't always understand those privacy policies themselves. But no other comfort.
• Google's wings were not even clipped when it was revealed that they had "accidentally" collected information about all our WiFi networks while filming the entire country for their StreetView product. This "accident" carried on for years, all over the world. The whole point about Google is that they don't make mistakes.
• Most of Shakespeare's heroes make microscopic corporation tax payments to the countries they profit from, see for example GDS and their friends, where there are 47 links for you to follow by way of evidence to support that statement.

"Is that exciting? It couldn't be more exciting ...". We may all join in Shakespeare's admiration of red-blooded capitalism in action. But in what way do these heroes – these latter-day pied pipers of Hamelin – demonstrate, as Shakespeare suggests, "improvements in how government works"?

Shakespeare, Google and our new government

The world is now in the second phase of the web revolution. So says the political pollster Stephan Shakespeare in his report, An Independent Review of Public Sector Information.

In Phase 1, the revolutionary winners – Shakespeare's Robespierre heroes listed on p.5 of his report – rose to the top on the basis of the unprecedented ease of communication between suppliers and consumers:

Google, Ebay, Facebook, Amazon, PayPal, Yahoo, Microsoft, Twitter, Apple – the companies through which our daily lives are run ...

Now we're in the next revolutionary phase, he says (also p.5):

Phase 2 sees an equivalent leap, this time in the capacity to process and learn from data. Is that exciting? It couldn't be more exciting: from data we will get the cure for cancer as well as better hospitals; schools that adapt to children’s needs making them happier and smarter; better policing and safer homes; and of course jobs. Data allows us to adapt and improve public services and businesses and enhance our whole way of life, bringing economic growth, wide-ranging social benefits and improvements in how government works.

Shakespeare's theme is that, if only they're given enough of our personal data, then intelligent scientists can run our daily lives for us even more intimately than in Phase 1, the quality of government will improve and, what's more, the economy will grow.

Shakespeare – principles, statistics and mooncalves

He's a big topic, Shakespeare. You can't say everything about him that needs to be said in one post. But we have to start somewhere. With the foundations.

"In October 2012, I was invited by government to lead an independent review of Public Sector Information (PSI) to explore the growth opportunities of, and how to widen access to, the wealth of information held by the public sector." That's the "foundation", Mr Shakespeare says (p.3), of his latest diversion, An Independent Review of Public Sector Information.

Born in the Warwickshire town of Stratford-upon-Avon Mönchengladbach, Stephan Shakespeare (né Kukowski), just making sure we've got the right Shakespeare, is the founder of YouGov, one of the polling organisations which have replaced political principle in the tragedy which is national debate in the UK with market research.

What we need, says Shakespeare, now Chair of the Data Strategy Board, on the basis of his review and of a report by the respected Constitutional experts, Deloitte ("Deloitte analysis quantifies the direct value of PSI at around £1.8bn with wider social and economic benefits taking that up to around £6.8bn"), is more data and more data scientists.

Why?

It's those shackles again.

Yes, it's another bloody revolution, "The Revolution, Phase 2: How Britain Can Be The Winner" (p.5):

If we play it right we can break free of the shackles of a low-growth economy in which government and the public sector are seen as a resource drag and an obstacle, and they instead become key drivers of a transforming process ... Ensuring that the process of government is optimised for progress, and does not corrupt into an obstacle to progress, requires continuous data and the continuous analysis of data.

It already has huge quantities of data, of course, so why does the state need even more? If the data the state already has isn't sufficient to turn it into a "key driver of a transforming process", what guarantee is there that even more data will achieve that transformation?

Is Mr Shakespeare any closer to answering those questions than one of the characters in his huge dramatis personae, Mr Stephen Childerstone?

A data-enabled online market place will create new services that will take your data and do some really interesting things with it.

What "new services" and what "really interesting things"?

Leave those questions hanging for the moment and let's move on.

Shakespeare complains that a lot of public sector information (PSI), is salted away in silos and needs to be consolidated and centralised in one place and, just for good measure, it needs to become real-time information (pp.7-8):

For instance, at the moment health data comes through a variety of unconnected channels and into many different silos. It is hard for researchers to gain access to its full value. Advances in technology not only now allow us to collect data at source in real time, but also enable more practical linkage and accessibility.

There could be good reasons for those silos, good reasons why the Constitution has evolved the way that it has in its fuddy-duddy principled old Darwinian way establishing legal barriers all over the place but, if you start like an intelligent designer or even a creationist, you won't see them. The good reasons. So they won't exist.

All you'll see is an unwelcome obstacle to the statistics you need to promote the quantified self space, the space inhabited by us mooncalves, the governed.

And that's the other thing Shakespeare needs. Not just breaking down the walls of the silos that warehouse weather data and the data on motorway traffic flow – recognisably public data – he needs more personal data to transform the government into a key driver of progress.

We mooncalves are so stupid. So uninformed. Which of us hasn't gone to bed, careworn, with the weight of human fallibility on our shoulders and woken up saying (p.7):

We should invest in developing real-time, scalable, machine-learning algorithms for the analysis of large data sets, to provide users with the information to understand their behaviour and make informed decisions.

And what does that imply for public sector information (PSI)?

Article E of Shakespeare's strategy says (p.10):

Privacy is of the utmost importance, and so is citizen benefit.

Phew. Our privacy is of the utmost importance.

But tarry. There are two quantities which are of the "utmost importance". There's "citizen benefit" as well. What happens if they conflict?

The answer is given in Article A (p.9):

Simply put, the strategy is: Recognise in all we do that PSI, and the raw data that creates it, was derived from citizens, by their own authority, was paid for by them, and is therefore owned by them. It is not owned by employees of the government. All questions of what to do with it should be dealt with by the principle of getting the greatest value back to citizens, with input not just from experts but also citizens and markets. This should be obvious, but the fact that it needs to be constantly reaffirmed is illustrated by the way that even today, access to academic research that has been paid for by the public is deliberately denied to the public, and to many researchers, by commercial publishers, aided by university lethargy, and government reluctance to apply penalties; thereby obstructing scientific progress.

Many researchers? Commercial publishers? Lethargic universities? Reluctant governments? Get rid of the lot of them, along with the legal barriers, in the name of scientific progress. Your personal data belongs to citizens, not to you.

This is, as noted at the start, just the overture. The prelude. But there's Shakespeare's lesson #1 already firmly established – forget privacy, you mooncalf statistics.

Shakespeare – principles, statistics and mooncalves

He's a big topic, Shakespeare. You can't say everything about him that needs to be said in one post. But we have to start somewhere. With the foundations.

"In October 2012, I was invited by government to lead an independent review of Public Sector Information (PSI) to explore the growth opportunities of, and how to widen access to, the wealth of information held by the public sector." That's the "foundation", Mr Shakespeare says (p.3), of his latest diversion, An Independent Review of Public Sector Information.

Born in the Warwickshire town of Stratford-upon-Avon Mönchengladbach, Stephan Shakespeare (né Kukowski), just making sure we've got the right Shakespeare, is the founder of YouGov, one of the polling organisations which have replaced political principle in the tragedy which is national debate in the UK with market research.

What we need, says Shakespeare, now Chair of the Data Strategy Board, on the basis of his review and of a report by the respected Constitutional experts, Deloitte ("Deloitte analysis quantifies the direct value of PSI at around £1.8bn with wider social and economic benefits taking that up to around £6.8bn"), is more data and more data scientists.

Why?

midata and the South Sea Bubble

"Insolvency" has been much on our lips for the past five years and the Department for Business Innovation and Skills (BIS) maintains a useful website to teach us all about it.

In 1720, with the national debt standing at £30 million, the government borrowed £7 million at 5 percent p.a. from the South Sea Company so that it could carry on a war with France and granted the company in return a monopoly over trade with South America.

The company's share price promptly went through the roof, inspiring the famous Bubble – people went mad investing in useless businesses thinking they were guaranteed to make a fortune. At the height of the mania, BIS tell us:

A company was promoted “For carrying-on an undertaking of great advantage but no-one to know what it is”. After receiving £2,000 from subscribers the promoter emigrated.

No-one knew what they were going to get but they handed over £2,000 anyway. That could never happen now.

Here we are 293 years later and BIS operate 'Craig Belsham's midata blog', to which one Stephen Childerstone has contributed a post, How we are working to protect consumer’s data. (Good luck with that, Mr Childerstone.)

And what do we find?

A data-enabled online market place will create new services that will take your data and do some really interesting things with it.

What "new services" and what "really interesting things"? midata looks like nothing so much as a latter-day "undertaking of great advantage but no-one to know what it is". None of us knows what we're going to get but we're expected to hand over our personal data anyway.

midata and the South Sea Bubble

"Insolvency" has been much on our lips for the past five years and the Department for Business Innovation and Skills (BIS) maintains a useful website to teach us all about it.

In 1720, with the national debt standing at £30 million, the government borrowed £7 million at 5 percent p.a. from the South Sea Company so that it could carry on a war with France and granted the company in return a monopoly over trade with South America.

The company's share price promptly went through the roof, inspiring the famous Bubble – people went mad investing in useless businesses thinking they were guaranteed to make a fortune. At the height of the mania, BIS tell us:

A company was promoted “For carrying-on an undertaking of great advantage but no-one to know what it is”. After receiving £2,000 from subscribers the promoter emigrated.

No-one knew what they were going to get but they handed over £2,000 anyway. That could never happen now.

"When it comes to cyber security QinetiQ couldn’t grab their ass with both hands"

So said Bob Slapnik, vice president at HBGary, the security experts "detecting tomorrow's threats today", as reported by Bloomberg, the company that's been using its financial information terminals to spy on its clients. So says the New York Times, the company whose cyberdefences were breached in 2012 by the Chinese, seeking to stop people being rude about Prime Minister Wen Jiabao. Although the Chinese say they didn't.

You can see why Mr Slapnik was cross back in 2010. QinetiQ had just won a contract to advise the Pentagon on how to counter cyberespionage despite QinetiQ's own computer systems having been comprehensively hacked for the previous three years.

But talk about the pot calling the kettle black, one reason QinetiQ's inability to grab its ass with both hands came to light was an examination of the documents hacked out of HBGary in 2011 by Anonymous, the cybervigilantes previously derided as mere "script kiddies", who were so piqued by Aaron Barr, HBGary's CEO, pretending that he had infiltrated them that Anonymous ...

... infiltrated HBGary’s servers, erased data, defaced its website with a letter ridiculing the firm with a download link to a leak of more than 40,000 of its emails to The Pirate Bay, took down the company’s phone system, usurped the CEO’s twitter stream, posted his social security number, and clogged up fax machines ... 'You brought this upon yourself. You’ve tried to bite the Anonymous hand, and now the Anonymous hand is bitch-slapping you in the face', said the letter posted on the firm’s website ...

That's according to Dr Thomas Rid, who finishes his report with: "the attack badly pummeled the security company’s reputation". Yes, you can see how it would, but HBGary (detecting yesterday's threats tomorrow) had been commissioned to sort out QinetiQ's cybersecurity problems so circumspice, Mr Slapnik.

Not to be left out, Bloomberg had been targeted by the same Chinese hackers in pursuit of the same object – keeping Mr Wen's business dealings out of the news. Fail. Everyone who is anyone had been hacked. The Pentagon briefed "about 30" defence contractors like QinetiQ about Chinese hacking in 2007-08, too late to stop the Chinese acquiring so much information on Lockheed Martin's F-22 and F-35 fighter jets that it's doubtful now whether it's worth deploying them. Ditto the designs for the US combat helicopter fleet, drones, satellites and military robotics, all of which were copied from QinetiQ's computers.

Bloomberg's computers weren't hacked straight from China. The Chinese tried to come in via computers they had taken over in various US universities. Same modus operandi, NASA complained to QinetiQ that it was under attack by the Chinese via QinetiQ's computers and would QinetiQ please sort it out. Investigators into that hack found that you could just sit in the car park and connect to QinetiQ's network via an unsecured wifi. They also found that the Russians had been stealing trade secrets from QinetiQ for 2½ years.

Towards the end, the Chinese had access to 13,000 internal passwords at QinetiQ and they could do pretty much whatever they wanted: "by 2009, the hackers had almost complete control over TSG’s computers". TSG is QinetiQ's Technology Solutions Group, whose boss reckoned that investigating all this hacking took too long. "You finally have to reach a point where you say let’s move on" and, indeed, he has now moved on.

HBGary weren't the only security experts trying to sort out QinetiQ. Mandiant were in there (and at the New York Times) and suggested using two-factor authentication to log on to the QinetiQ network, the way those of us with a Lloyds business account do. No, said QinetiQ, and off went all their robotics designs.

HBGary's counter-espionage software was installed on 1,900 QinetiQ computers but it wouldn't run on a lot of them and when it did it missed some rogue software and reported some benign software and it slowed the machines down so users did what they always do and deleted it. HBGary accused another consultant, Terremark, part of Verizon, of withholding information and Terremark said damned if they were telling HBGary anything, their clunky software was alerting the hackers to the investigation.

Two months after the all-clear, the FBI had to tell QinetiQ they were losing data again and all the consultants came back and tried to clear out the malware they had missed last time round. Meanwhile, the Chinese have got bomb disposal robots on the market that look remarkably like QinetiQ's but they're cheaper.

All of which is just by way of introductory remarks. Setting the scene.

Remember Skyscape? The cloud computing company owned by just one man? The company with contracts from the MOD, HMRC and the Government Digital Service (GDS)?

GDS never did respond to the letter asking them how they had seen fit to entrust GOV.UK to a one-man company. But HMRC did. Twice. Which is very proper of them.

The HMRC response came from Phil Pavitt, HMRC's Director General Change, Security and Information. He said (22 October 2012):

Skyscape’s services are provided through a number of key, or “Alliance”, Partners. These partners are industry leading organisations that provide services in the data centre or “cloud” arena such as EMC (storage  and security services), Cisco (networking) and Ark Continuity (UK based high security data centres) ... ... data security remains integral to HMRC and a pre-requisite of any of our data being migrated to Skyscape is for their solution, including all the constituent parts, to be formally accredited by CESG (the Communications-Electronics Security Group) to Impact Level 3 (IL3) ... This accreditation is expected imminently, at which point HMRC will be in a position to begin securely moving data over to Skyscape and decommissioning our old servers ... will be re-competed to ensure HMRC continues to take advantage of innovative, secure and low cost solutions ... It should also be noted that for security reasons HMRC does not discuss details of the data that it holds, or where it stores it, however we are able to confirm that by using Skyscape HMRC data will continue to be kept in accordance with existing legislation and HMRC security policies ... The data, which will be securely stored by Skyscape, currently resides on several hundred servers, across multiple HMRC office locations. This change will consolidate that data and place it into a small number of secure and highly resilient cloud data centres hence improving the security of the data, the efficiency of managing that data ...

and (28 November 2012):

I must reiterate our assurance that using Skyscape HMRC data will continue to be kept in accordance with existing legislation and HMRC security policies. When fully operational, Skyscape Cloud Services Ltd will securely host all HMRC data currently held on office File and Print Servers (FAPS) ... FAPS do not hold the definitive tax records for the UK and these records remain distributed across a number of secure systems. HMRC routinely risk assesses and tests the security of our solutions and services. Our secure connection to Skyscape will be delivered in line with HM Government standards to protect our data, with ongoing assurance checks throughout the life of this service ... Data security remains integral to HMRC and a pre-requisite of any of our data being migrated to Skyscape is for their solution, including all the constituent parts, to be formally accredited by CESG (the Communications-Electronics Security Group) to Impact Level 3 (IL3). All security aspects of the service will have to be proven in line with HM Government security standards. This will include the need to ensure the ‘cloud’ is hosted in a UK domiciled, secure data centre(s) and operated by staff with appropriate security clearance ...

It's not just HMRC. Here's GDS in their Government Digital Strategy:

We know that our users often find it hard to register for our online services, so it is vital that we offer a more straightforward, secure way to allow our users to identify themselves online while preserving their privacy ... (p.34) Legality, security and resilience Transactional services will be redesigned to: be robustly protective of the security of sensitive user information maintain the privacy and security of all personal information ... (p.46)

And here's Mydex, one of the UK's eight identity providers, writing about PDSs (personal data stores):

Personal Data Stores create a single, secure, easy-to-access store for such information so that when we need it it’s at our finger tips ... (p.8) ... the PDS can create one single message informing them of the fact that the card has been lost. It can then be sent securely, direct to their systems ... (p.9) ... behind each payment there is a hugely sophisticated system of highly secure data ‘handshakes’ taking place across a complete eco-system of supporting players ... (p.14) Etc ...

Skyscape is in an alliance with QinetiQ. That doesn't bode well. But it's not just QinetiQ. The Pentagon felt it necessary, remember, to brief about 30 contractors on cybersecurity. They all have problems. Are any of them capable of grabbing their ass with both hands?

Judging by the daily diet of cyberattack stories, no. Cybersecurity looks like a myth. Just bear that in mind whenever a supplier offers you security.

----------

(Hat tip: Anonymous @ 3 May 2013 10:31, see also the excellent 'Chinese' attack sucks secrets from US defence contractor in ElReg®)

----------

Updated 22.5.14

There were bound to be consequences.

With all these allegations of Chinese hacking flying around, the US had to do something. And now they have. 19 May 2014:

America sues China over corporate spying America's fraught trading relationship with China turned even more hostile on Monday, after Washington filed an unprecedented lawsuit against Beijing for corporate spying. The US Department of Justice accused members of China’s military, the People’s Liberation Army, of stealing sensitive information from major energy and metal companies, including Alcoa, the aluminium producer, and Westinghouse, which makes nuclear reactors.

The post above was written three weeks before the Edward Snowden revelations. We now know what we didn't in mid-May 2013 that the US is quite capable of a bit of hacking themselves. It's not just China.

Which may be what China had in mind in their initial response to the US suing them. They called the US a "high-level hooligan". Not entirely impolite – it's better than being a low-level hooligan.

Then they raised the stakes, by calling the US a "mincing rascal". It's not clear which international law being a mincing rascal contravenes. But it sounds bad. China wins phase one of the epithet war.

This whole cybersecurity and countersecurity business is fraught with dilemmas. Ethical, legal, diplomatic and trade dilemmas.

Given that you are a rascal, is it better to be a mincing one than not? It's not clear.

And then there's the FBI problem.

Like everyone else, they're trying to recruit infosec/information security experts. These experts are exceptional people. Few and far between, an inordinate number of them lead lives fuelled on drugs, 21 May 2014:

Wacky 'baccy making a hash of FBI infosec recruitment efforts ... FBI Director James Comey ... reportedly told the White Collar Crime Institute that he needs a “great work force” to compete with the black hats, but “some of those kids want to smoke weed on the way to the interview”.

Ethics, the law, diplomacy or trade? Which one will win?

Trade. It often does. Cisco to Obama: get NSA out of our hardware. Etc ...


Updated 19.1.15

Snowden doc leak 'confirms' China stole F-35 data China now knows what most people in the west are catching up with: that the F-35 Joint Strike Fighter is a lemon. The latest round of managed information release by Edward Snowden via Spiegel (one of a series) includes the snippet that Chinese security services copied “terabytes” of data about the aircraft ...

Please see also China calls Snowden's stealth jet hack accusations 'groundless'. "Lockheed Martin is producing the F-35 for the U.S. military and allies in a $399 billion project, the world's most expensive weapons program.".

So much for the security of Lockheed Martin's computer systems.

Lockheed Martin must be among the best in the business. The security business. And $399 billion should buy you the best of ... just about everything. And yet "the F-35 Joint Strike Fighter is a lemon".

Charming old stick-in-the-muds that they are, the Government Digital Service may believe that they can offer the public a secure national identity scheme, GOV.UK Verify. But they really can't expect us to believe it. Not now.


Updated 25.5.15

John Bercow mood music

Read our blog on British democracy and the Digital Revolution at http://t.co/alafrPQitC — Digital Leaders (@DigiLeaders) May 25, 2015

"Read our blog", said the self-proclaimed Digital Leaders on 25 May 2015, and pointed us all at a 12 February 2015 blog post by John Bercow MP, Speaker of the House of Commons, British democracy and the digital revolution.

Mr Speaker established a special Commission in late 2013 to "consider how the digital revolution has changed or might further develop British representative democracy".

The Commission has reported now. It sets five targets. And target #4 is:

By 2020, secure online voting should be an option for all voters.

 Feasible?

Just reading over the post above, you can't help noticing that Lockheed Martin of all people couldn't keep the design of the F-35 Joint Strike Fighter secure. Ditto the F-22. Ditto the designs for the US combat helicopter fleet, drones, satellites and military robotics, all of which were copied from QinetiQ's computers. But Mr Speaker thinks that on-line voting could be secure.

Why does he think that? What does he know that Lockheed Martin and QinetiQ don't?

And Sony. What does Mr Speaker know that Sony don't know?

Remember Sony?

For two weeks or so now [we said in December 2014], we have all watched as Sony's private and confidential correspondence has been published by hackers, personal details about the stars of their films have been revealed and the value of the company's intellectual property has been destroyed.

If Mr Speaker can obtain endorsements from Lockheed Martin, QinetiQ and Sony to the effect that they have good reason to believe that he knows how to deliver secure on-line services including electronic voting, maybe we'll believe that his target #4 is feasible. Otherwise, no, his words are just John Bercow mood music.

"When it comes to cyber security QinetiQ couldn’t grab their ass with both hands"

So said Bob Slapnik, vice president at HBGary, the security experts "detecting tomorrow's threats today", as reported by Bloomberg, the company that's been using its financial information terminals to spy on its clients. So says the New York Times, the company whose cyberdefences were breached in 2012 by the Chinese, seeking to stop people being rude about Prime Minister Wen Jiabao. Although the Chinese say they didn't.

You can see why Mr Slapnik was cross back in 2010. QinetiQ had just won a contract to advise the Pentagon on how to counter cyberespionage despite QinetiQ's own computer systems having been comprehensively hacked for the previous three years.