Monday 29 July 2013

John Naughton, welcome to the club

(Hat tip: Philip Virgo)

John Naughton is professor of the public understanding of technology at the Open University. Writing in yesterday's Observer, 28 July 2013, he says:
... no US-based internet company can be trusted to protect our privacy or data. The fact is that Google, Facebook, Yahoo, Amazon, Apple and Microsoft are all integral components of the US cyber-surveillance system. Nothing, but nothing, that is stored in their "cloud" services can be guaranteed to be safe from surveillance or from illicit downloading by employees of the consultancies employed by the NSA. That means that if you're thinking of outsourcing your troublesome IT operations to, say, Google or Microsoft, then think again.

... when your chief information officer proposes to use the Amazon or Google cloud as a data-store for your company's confidential documents, tell him where to file the proposal. In the shredder.
Where have you heard that before?

John Naughton, welcome to the club

(Hat tip: Philip Virgo)

John Naughton is professor of the public understanding of technology at the Open University. Writing in yesterday's Observer, 28 July 2013, he says:
... no US-based internet company can be trusted to protect our privacy or data. The fact is that Google, Facebook, Yahoo, Amazon, Apple and Microsoft are all integral components of the US cyber-surveillance system. Nothing, but nothing, that is stored in their "cloud" services can be guaranteed to be safe from surveillance or from illicit downloading by employees of the consultancies employed by the NSA. That means that if you're thinking of outsourcing your troublesome IT operations to, say, Google or Microsoft, then think again.

... when your chief information officer proposes to use the Amazon or Google cloud as a data-store for your company's confidential documents, tell him where to file the proposal. In the shredder.

Friday 26 July 2013

Instrumenting the kettle

Exclusive: sometimes there is a difference between fiction and reality.

Steve Hewlett is presenting a report at the moment on BBC Radio 4, Privacy Under Pressure. Three episodes, Episode 2 was on Monday 22 July 2013, final episode next Monday, don't miss it, 9 a.m.

Everyone remembers Minority Report, the Tom Cruise film where the murder rate has dropped to zero because the "Precrime" unit intervenes before anyone commits a felony.

What is the use of the internet of things? That's what Steve Hewlett.wanted to know. And there was our very own Professor Sir Nigel Shadbolt to tell him.

You remember Sir Nigel. He's head of the Open Data Institute. And midata. He's the one who thinks that the economy will grow if we give all our public and personal data to innovative app-designers. Him and Stephan Shakespeare. Although neither of them can usually think what these apps might do to be useful and profitable.

And you remember the internet of things.That's when you connect every device in the world to the internet and then monitor them.

Worked a treat for the US Chamber of Commerce. They thought they were controlling the central heating in one of their flats remotely. In fact, the thermostat was busy sending stolen data to the Chinese: "months later, the chamber discovered that Internet-connected devices — a thermostat in one of its corporate apartments and a printer in its offices — were still communicating with computers in China".

All this remote monitoring is a bit intrusive, isn't it, said Steve Hewlett but Sir Nigel reckons not. He says that by "instrumenting" the fridge you'll be able to tell remotely that an old person is eating properly. "Elder care", he calls it. And if you see the kettle being turned on, you'll know that the old person is having a cup of tea.

Sir Nigel has obviously never met an elderly relative of DMossEsq's who, in his dotage, every time you served him dinner, carefully picked it up and put it in the dishwasher – to a remote "elder carer", no doubt that would mean he was doing the washing up.

A lot of people on Steve Hewlett's programme keep saying that the benefits of surveillance are undeniable, it would improve the quality of life, it's very positive. There's one old-fashioned lady who says that permanent surveillance will lead to permanent self-censorship, but what does she know?

Is it worth giving up our privacy just so that we know without taking the trouble to go round in person that some old wrinkly has opened the fridge?

Sir Nigel tackled this question head on. Here he is, delivering the coup de grâce to any demented naysayers. Just imagine, he says, a new world where you look out of the window and see the blue flashing lights, and then someone flies through the door and says "we're here to prevent you from having a heart attack".

That's Sir Nigel's charming picture of the new world he's trying to create. Or intelligently design. "Precare", anyone?

Sir Nigel has obviously never met Steven Grisales. And he's not going to meet him, because Steven Grisales is dead. He was murdered by a 15 year-old who was out on parole probation and evaded surveillance by the simple act of removing his electronic tag.

The story is told by Dominic Lawson in the Sunday TimesClarke plays a deadly game of tagging, 17 June 2012: "Last Wednesday Liz Calderbank, the chief inspector of probation, released a report on electronically monitored curfews, which deserves that overused term 'devastating' — it revealed that 59% of tagged offenders are known to have breached the terms of their curfew".

Perhaps in next Monday's episode Steve Hewlett will settle the question whether the benefits of giving up our privacy really are indubitable. Will the future look like Sir Nigel's idyllic dream? Or will it be more like the squalid nightmare which is surveillance today in the UK, as revealed by Liz Calderbank?

----------

Updated 4.8.14

iKettle: The Wi-Fi kettle review

Hat tip


Updated 24.10.16

"Global internet outages continue as second wave of hacker attacks cripples web servers" – that's what it said in the Daily Telegraph newspaper last week, with more than usual first-hand experience: "Hundreds of popular websites were taken offline for hours on Friday after a critical internet point was hit by multiple cyber attacks ... Hackers brought sites including Twitter, eBay and The Telegraph offline for millions of users after targeting Dyn, a New Hampshire-based company that is responsible for routing internet traffic".

ElReg provided some technical detail. It seems that a lot of dumb devices attached to the internet of things (IoT) were used to launch an onslaught on this company Dyn. Devices including the WiFi kettle above, possibly. Apparently it's terribly easy to do and the caper may have been undertaken by bored children.

Messrs Shadbolt and Shakespeare (please see above) may have their enthusiasm for the IoT undimmed by this episode. You may think differently, though. If bored children knock out the Government Digital Service's GOV.UK Verify (RIP) next time, and if you foolishly rely on that underwhelming identity assurance scheme, then you will cease to exist.


Updated 21.1.17

RIP: Steve Hewlett: Radio 4 presenter dies at the age of 58

Instrumenting the kettle

Exclusive: sometimes there is a difference between fiction and reality.

Steve Hewlett is presenting a report at the moment on BBC Radio 4, Privacy Under Pressure. Three episodes, Episode 2 was on Monday 22 July 2013, final episode next Monday, don't miss it, 9 a.m.

Everyone remembers Minority Report, the Tom Cruise film where the murder rate has dropped to zero because the "Precrime" unit intervenes before anyone commits a felony.

What is the use of the internet of things? That's what Steve Hewlett.wanted to know. And there was our very own Professor Sir Nigel Shadbolt to tell him.

You remember Sir Nigel. He's head of the Open Data Institute. And midata. He's the one who thinks that the economy will grow if we give all our public and personal data to innovative app-designers. Him and Stephan Shakespeare. Although neither of them can usually think what these apps might do to be useful and profitable.

And you remember the internet of things.That's when you connect every device in the world to the internet and then monitor them.

Worked a treat for the US Chamber of Commerce. They thought they were controlling the central heating in one of their flats remotely. In fact, the thermostat was busy sending stolen data to the Chinese: "months later, the chamber discovered that Internet-connected devices — a thermostat in one of its corporate apartments and a printer in its offices — were still communicating with computers in China".

Biometrics – Hollywood v. Kingston upon Thames

Exclusive: sometimes there is a difference between fiction and reality.

Steve Hewlett is presenting a report at the moment on BBC Radio 4, Privacy Under Pressure. Three episodes, Episode 2 was on Monday 22 July 2013, last episode next Monday, don't miss it, 9 a.m.

Everyone remembers Minority Report, the Tom Cruise film where people are identified by the patterns of their irises. As they walk around the shopping mall, personally tailored advertisements invite them to enjoy special offers in the shop they're just passing.

Politicians may believe that this technology already works and is available today. It isn't. Senior civil servants and journalists may believe it but they're wrong, too.

What is available, is a technology claiming to recognise your face – not your irises. Steve Hewlett interviewed James Orwell, a face recognition expert at Kingston University.

How well does face recognition work in a shopping mall today? Hundreds of times better than it used to, said Dr Orwell, but still not well enough. If we had one million people's faces on file and we searched for a match using an image caught by an overhead CCTV today, we'd probably be able to narrow it down to the nearest 5 percent.

That is, we'd know that the person who's just been filmed isn't among these 950,000, he or she is one of the remaining 50,000 people on file. Probably.

Useless. And here he is, saying it.

Minority Report-style biometrics may work in Hollywood. They don't work in Kingston.

Biometrics – Hollywood v. Kingston upon Thames

Exclusive: sometimes there is a difference between fiction and reality.

Steve Hewlett is presenting a report at the moment on BBC Radio 4, Privacy Under Pressure. Three episodes, Episode 2 was on Monday 22 July 2013, last episode next Monday, don't miss it, 9 a.m.

Everyone remembers Minority Report, the Tom Cruise film where people are identified by the patterns of their irises. As they walk around the shopping mall, personally tailored advertisements invite them to enjoy special offers in the shop they're just passing.

Politicians may believe that this technology already works and is available today. It isn't. Senior civil servants and journalists may believe it but they're wrong, too.

Thursday 25 July 2013

"Identity providers" – GDS issue the black spot

One UK citizen said:”I pay the government to identify and verify me when I am born (birth certificate), when I marry (marriage certificate), when I die (death certificate) and when I travel (passport and driving licence). Why should I then have to pay an outside private organisation to verify who I am when I transact with the government online, when I've already paid the government? Let the government – possibly the passport service that is also the national records office – be my identity provider of choice.”
The UK is the proud possessor of not just one "identity provider", not two, but no less than eight of them. Digidentity and Verizon. The Post Office and Experian. Mydex and Ingeus. Cassidian and PayPal.

It's been hard for them. Initially, the Department for Work and Pensions (DWP) offered the "identity providers" £240 million to get the Identity Assurance Programme (IDAP) up and running in the UK. Then ex-Guardian man Mike Bracken stepped in and cut the offer to £30 million. By the time contracts were awarded, that figure was down to £25 million.

The idea was to have IDAP "fully operational" for DWP by March 2013. Four months ago. It wasn't operational then, and it still isn't.

Has IDAP been shelved? Or cancelled? No. Digital by Default News tell us that HMRC will be the first public body to use IDAP.

(It may help to explain that Digital by Default News "is one of a new portfolio of Contentive websites providing critical, real-time intelligence in a wide range of niche industry verticals".)

So things are looking up for the "identity providers"? All those years of hard work negotiating the terms of IDAP and now, at last, it's paid off and they're going to get their hands on the identities of tens of millions of individual and corporate taxpayers' identities?

No.

Take another look at that Digital by Default News article, Citizens would prefer government-owned identity provider. Yes, it spends a bit of time saying that "the scheme will be run by eight private sector organisations which will hold digital ‘passports’ for enrolled UK citizens, enabling them to access online government services".

But the bulk of the article is about how no-one wants private sector "identity providers", what we really want, apparently, we "citizens", is for the old Identity & Passport Service (IPS) to be our one and only "identity provider". "Identity providers", it is saying, "we don't need you, we don't want you, we can do better without you, your presence has delighted us long enough, do not stand upon the order of your going".

The Senior Responsible Owner for IDAP is ex-Guardian man Mike Bracken, see above. He is also the chief executive of the Government Digital Service (GDS), responsible for making public services digital by default, and he's probably the de facto publisher of Digital by Default News N [please see comments below].

What is he up to? He's alienated DWP, the UK's biggest-spending department of state, he's alienated the eight "identity providers" on whom IDAP depends and now he's got no-one left to turn to – the whole point about IPS is that it failed.

He's promising to provide HMRC with identity assurance, having promised and then failed to provide it to DWP last March.

Failing with DWP is one thing. But HMRC is different. The state relies on HMRC raising about £600 billion of tax every year. Failure is unthinkable. No tax, no state.

The question was, what is he up to, and the answer is, who knows, ex-Guardian man Mike Bracken's tactics are incomprehensible, the only point that is clear is that this is the end of IDAP, the end of digital-by-default, which can't work without identity assurance, the end of GDS, the end of midata and Individual Electoral Registration and maybe the end of G-Cloud, too – on 1 June 2013 GDS took over responsibility for G-Cloud.

IDAP never was going to work. Its failure could nevertheless have been long and drawn-out, and expensive. Thanks to this latest slap in the face of the "identity providers", we taxpayers may be lucky – quicker and cheaper failure.

Who do we thank?

Step forward Neil Fisher. Mr Fisher is vice president of Global Security Solutions at Unisys Corporation. He is responsible for the opinion poll results on which the Digital by Default News article is based. They fell for it hook, line and sinker.

He is also, of course, the Cassandra who told ex-Guardian man Mike Bracken and Francis Maude that any project with the word "identity" in its name is doomed.

Thank you.

"Identity providers" – GDS issue the black spot

One UK citizen said:”I pay the government to identify and verify me when I am born (birth certificate), when I marry (marriage certificate), when I die (death certificate) and when I travel (passport and driving licence). Why should I then have to pay an outside private organisation to verify who I am when I transact with the government online, when I've already paid the government? Let the government – possibly the passport service that is also the national records office – be my identity provider of choice.”
The UK is the proud possessor of not just one "identity provider", not two, but no less than eight of them. Digidentity and Verizon. The Post Office and Experian. Mydex and Ingeus. Cassidian and PayPal.

It's been hard for them. Initially, the Department for Work and Pensions (DWP) offered the "identity providers" £240 million to get the Identity Assurance Programme (IDAP) up and running in the UK. Then ex-Guardian man Mike Bracken stepped in and cut the offer to £30 million. By the time contracts were awarded, that figure was down to £25 million.

The idea was to have IDAP "fully operational" for DWP by March 2013. Four months ago. It wasn't operational then, and it still isn't.

Has IDAP been shelved? Or cancelled? No. Digital by Default News tell us that HMRC will be the first public body to use IDAP.

(It may help to explain that Digital by Default News "is one of a new portfolio of Contentive websites providing critical, real-time intelligence in a wide range of niche industry verticals".)

Wednesday 24 July 2013

The rise of the captive cloud

• PASC should rescue the good idea of SME competition
from the clutches of G-Cloud

• PASC should look carefully at the way competition is being operated
in G-Cloud

Whitehall misfeasance
The Public Administration Select Committee (PASC) published its report on Government Procurement on 16 July 2013:
The public sector spends £227 billion each year buying a range of goods, services and works, £45 billion of which is spent by Whitehall Departments. The Ministry of Defence alone spends £20 billion a year. By improving the efficiency and effectiveness of procurement, the Government has an opportunity not only to save the taxpayer significant sums of money, but also to drive economic growth. (p.1)
 PASC say that the public is getting poor value for money and that:
There are clear shortcomings in the ability of the Civil Service to run effective and efficient procurement. The Civil Service shows a consistent lack of understanding about how to gather requirements, evaluate supplier capabilities, develop relationships or specify outcomes. (p.3)
This record of misfeasance in public office goes back at least 30 years and shows few signs of improvement:
Whilst we welcome the Government’s initiatives to centralise procurement, we note that progress so far has been painfully slow and sporadic. It is clear from our evidence that this is because, despite the centralising mandate given to the Cabinet Office by a Cabinet Committee, inter-departmental cooperation is poor. (p.4)
At worst, this soap opera is about suppliers charging the biggest number they can think of for poor quality service and about incompetent satraps paying them.

SMEs
What hope is there for the taxpayer that his or her money will stop being wasted?

One source of hope is the plan to give more government contracts to small and medium-sized enterprises (SMEs). They are more innovative than the behemoths who normally have government contracts let to them, and more competition might reduce prices and improve quality:
To help achieve this aspiration, the Cabinet Office has introduced a number of measures to remove barriers facing SMEs seeking to win government contracts. These include a policy to remove “pre-qualification questionnaires from lower value contracts, except where security is a consideration” and “the introduction of Contracts Finder” to allow “unprecedented transparency to the range of opportunities available”. (p.13)
That hope expires one page later.

Duty of care
The G Cloud/Cloudstore Framework

The G Cloud/Cloudstore framework provides an online catalogue of ICT services for the UK public sector managed centrally by the Government Procurement Service ...

The Government expects that CloudStore will help small and medium-sized businesses to contract directly with the public sector, as it has simplified the requirements for joining this framework. (p.14)
Two ideas are being conflated and PASC have, arguably, fallen for it.

Giving SMEs the chance to win government contracts is one idea. Cloud computing is a separate idea. SMEs being allowed to compete is quite independent of the introduction of cloud computing. And cloud computing is quite independent of SMEs competing – there are huge, non-SME cloud computing service suppliers like Apple and Google and Amazon and Microsoft.

"Cloud computing" means losing control of your data. It is a bad idea. It is an abdication of Whitehall's duty of care.

PASC should rescue the good idea of SME competition from the clutches of G-Cloud.

Competition
And PASC should look carefully at the way competition is being operated in G-Cloud, specifically by the Government Procurement Service and the Government Digital Service, which took over responsibility for G-Cloud on 1 June 2013.

Everyone is or should be conversant with the concept of the captive insurance company. Whitehall have created their own equivalent, in the form of the captive cloud company.

There are 458 suppliers accredited to G-Cloud according to PASC (p.14), many of them long-established SMEs with a track record that bears inspection.

So how did Skyscape, a company only incorporated on 3 May 2011, manage to be accredited by the Government Procurement Service? And how did it win four G-Cloud contracts – with HMRC, the MoD, the Home Office and the Government Digital Service – against the competition of long-established SMEs?

It looks as if Whitehall have created in Skyscape a captive cloud company. Skyscape recruited as its Commercial Director one Nicky Stewart, previously G-Cloud Head of ICT Strategy Delivery at the Cabinet Office, and Whitehall started filling this shell with valuable contracts. That looks like a distortion of the market and the opposite of the proper operation of competition.

Only separate
If Whitehall are allowed by PASC to confuse SME competition with cloud computing, the danger is that public administration will become dependent on the large cloud computing suppliers. Once dependent on them prices will go up, and a new oligopoly of contractors will exert power. Competition will be snuffed out by a cartel and we taxpayers will be back where we started, being fleeced, while the satraps look on with impunity.

The rise of the captive cloud

• PASC should rescue the good idea of SME competition
from the clutches of G-Cloud

• PASC should look carefully at the way competition is being operated
in G-Cloud

Whitehall misfeasance
The Public Administration Select Committee (PASC) published its report on Government Procurement on 16 July 2013:
The public sector spends £227 billion each year buying a range of goods, services and works, £45 billion of which is spent by Whitehall Departments. The Ministry of Defence alone spends £20 billion a year. By improving the efficiency and effectiveness of procurement, the Government has an opportunity not only to save the taxpayer significant sums of money, but also to drive economic growth. (p.1)
 PASC say that the public is getting poor value for money and that:
There are clear shortcomings in the ability of the Civil Service to run effective and efficient procurement. The Civil Service shows a consistent lack of understanding about how to gather requirements, evaluate supplier capabilities, develop relationships or specify outcomes. (p.3)
This record of misfeasance in public office goes back at least 30 years and shows few signs of improvement:
Whilst we welcome the Government’s initiatives to centralise procurement, we note that progress so far has been painfully slow and sporadic. It is clear from our evidence that this is because, despite the centralising mandate given to the Cabinet Office by a Cabinet Committee, inter-departmental cooperation is poor. (p.4)
At worst, this soap opera is about suppliers charging the biggest number they can think of for poor quality service and about incompetent satraps paying them.