midata – still waving, still drowning

The following article was published in Digital by Default News (DbyDN) on 21 August 2014:

Initiative to explore how citizens can be empowered with their own data Five organisations have come together to run a three-month feasibility study to explore how to empower citizens with their own data. The miData Studio initiative is a collaboration between Ctrl-Shift and Milton Keynes Council, the Cabinet Office, Open University and Connected Digital Economy Catapult. The project aims to create an open, collaborative environment where citizens, the council and developers explore how empowering citizens with their own information can enable better services, better quality of life and efficiency in the delivery of public services. The project will develop exemplar use cases that deliver benefit to the council and citizens and the local economy more generally. The project will look for new ways for citizens to gain control of their information, exploring how they can give controlled access to trusted service providers for the services they want or need. It will also act as a pilot for the Cabinet Office’s identity assurance scheme in a local authority context. This overarching project aim is to empower citizens with their own data in a way they can trust. The project will create a space for learning about working with citizens’ data, building a safe environment to try things out and study what works and what doesn’t work. Crucially the project aims to understand how to do this in such a way that individuals are in control of their data.

It was 3 November 2011 when Ed Davey first announced midata:

Today’s announcement marks the first time globally there has been such a Government-backed initiative to empower individuals with so much control over the use of their own data.

Little did we expect then that it would be the best part of three years before anyone started to "explore" how midata might work. But only now, if DbyDN are to be believed, is a "feasibility study" being launched.

In fact, not mentioned by DbyDN, Craig Belsham introduced us to the midata Innovation Lab (mIL) on 2 May 2013. Over the following few months mIL produced five deeply discouraging prototype apps.

Professor Sir Nigel Shadbolt gamely claimed that these five viruses apps would allow us to "get to the future more quickly" and Mr Belsham posted What we learnt from the midata Innovation Lab on 28 November 2013 but mIL has never been heard from again.

Now we have the "miData Studio" instead. And what is the planned output from their feasibility study? Working services? No. Just some "exemplar use cases" – the miData Studio could take even longer to get to the future than mIL.

There will be five "collaborators" in the miData Studio according to DbyDN – "Ctrl-Shift and Milton Keynes Council, the Cabinet Office, Open University and Connected Digital Economy Catapult".

Or should that be six? "The project aims to create an open, collaborative environment where citizens, the council and developers explore how empowering citizens with their own information can enable ...". It looks as though "citizens" also will need to be collaborators.

Or should it be 11? "The project ... will also act as a pilot for the Cabinet Office’s [non-existent] identity assurance scheme  in a local authority context". How can the studio deliver its exemplar use cases if the identity assurance scheme's five surviving "identity providers" aren't collaborating.

And however many collaborators there are, will the identity assurance scheme (RIP) prove any more successful in Milton Keynes than it did in Warwickshire?

It's all very well for DbyDN to say that the miData Studio will explore how citizens "can give controlled access [to their personal data] to trusted service providers" but how is anyone going to overcome Chris Chant's objection that trust is just not on the menu?

"Truth, not trust". That's Mr Chant's watchword. The pursuit of trust is a "doomed strategy".

Do any of the collaborators in the miData Studio have it in their gift to grant citizens control over their personal data? How? "Trust frameworks", as Ctrl-Shift tell us, are like unicorns. They don't exist. There's no way to enforce the rules. Control isn't on the menu any more than trust is. Or empowerment.

What are the prospective investors in the Cabinet Office's identity assurance scheme supposed to make of this project? They thought they were being invited to invest in a service that already exists.

It's only a 225-word article that DbyDN published but it raises a lot of questions.

----------

Updated 29.12.14

Still waving, Mydex published Nine ways the personal data store can transform public services on 23 December 2014. Their contention is that, when it comes to "local authorities and public sector organisations", Mydex:

1) Delivers massive cost savings 2) Increases data quality 3) Enables joined up services and streamlined customer journeys 4) Supports more personalised services 5) Enables citizens to get things done online 6) Reduces risk and ensures compliance 7) Builds trust 8) Supports operations such as identity assurance 9) Saves time, offers convenience and increases satisfaction

Really?

These may well be some of the presents local authorities and public sector organisations would ask Father Christmas for. But is Mydex Father Christmas? Are these presents in Mydex's gift? Who believes that? Why?

And who believes Mydex's claim at the bottom of the page? Remember Sony:

Mydex provides the individual with a hyper-secure storage area to enable them to manage their personal data, including text, numbers, images, video, certificates and sound. No-one but the individual can access or see the data.

Updated 30.12.14

Wikipedia:

Walter Mitty is a fictional character in James Thurber's short story "The Secret Life of Walter Mitty", first published in The New Yorker on March 18, 1939, and in book form in My World and Welcome to It in 1942. Thurber loosely based the character on his friend, Walter Mithoff. It was made into a film in 1947 ... Mitty is a meek, mild man with a vivid fantasy life: in a few dozen paragraphs he imagines himself a wartime pilot, an emergency-room surgeon, and a devil-may-care killer. The character's name has come into more general use to refer to an ineffectual dreamer, appearing in several dictionaries. The American Heritage Dictionary defines a Walter Mitty as "an ordinary, often ineffectual person who indulges in fantastic daydreams of personal triumphs". The most famous of Thurber's inept male protagonists ...

ElReg:

European data law: UK.gov TRASHES 'unambiguous consent' plans The UK government has raised objections to current EU proposals that would require businesses seeking to rely on "consent" as the lawful basis for processing personal data to ensure that that consent has been unambiguously given "for one or more specific purposes". It said those proposals are "unjustified" and called on EU law makers to instead turn to the definition of consent under existing EU data protection rules instead for setting the legal standard businesses would need to achieve for consent under the draft new General Data Protection Regulation ...

The ElReg article is written by Out-Law.com, an outlet of the firm of lawyers Pinsent Masons, who follow this sort of thing and provide expert commentary.

In brief, the EU's 1995 Data Protection Directive is due to be replaced with a much-debated General Data Protection Regulation:

• Should consent for your personal data to be processed be given unambiguously or is that unjustified as the UK government apparently argue? Is it adequate for that consent to be unambiguous or should it be explicit? Under what conditions can data be processed without consent? Is it lawful to create profiles of individuals from their personal data? How can you be said to freely give your informed consent if you actually have no alternative?
• Assuming the 28 members can agree the answers to these questions, and about 3,000 more, how should they set about enforcing the regulation within the EU? And what about the rest of the world – what do the EU do if Russia, say, pays not a blind bit of notice?

As ElReg/Out-Law.com/Pinsent Masons say:

The European Parliament agreed on its version of the Regulation earlier this year and is waiting for the Council to reach its own consensus on the reforms before trialogue discussions on a final version of the text, which would also involve the European Commission, can be opened.

It's a trialogue (?) between the European Council of Ministers, the European Parliament and the European Commission.

That excludes other people.

DMossEsq, for example.

If DMossEsq offers you total control over your personal data, you can safely ignore the offer as having been made by some sad Walter Mittyish character subject to delusions of grandeur.

As it happens, DMossEsq is making no such offer. He recognises that it's not in his gift. But there are other people out there with a "vivid fantasy life". Remember – the power lies with the EU, and not with Walter Mitty.

midata – still waving, still drowning

The following article was published in Digital by Default News (DbyDN) on 21 August 2014:

Initiative to explore how citizens can be empowered with their own data Five organisations have come together to run a three-month feasibility study to explore how to empower citizens with their own data. The miData Studio initiative is a collaboration between Ctrl-Shift and Milton Keynes Council, the Cabinet Office, Open University and Connected Digital Economy Catapult. The project aims to create an open, collaborative environment where citizens, the council and developers explore how empowering citizens with their own information can enable better services, better quality of life and efficiency in the delivery of public services. The project will develop exemplar use cases that deliver benefit to the council and citizens and the local economy more generally. The project will look for new ways for citizens to gain control of their information, exploring how they can give controlled access to trusted service providers for the services they want or need. It will also act as a pilot for the Cabinet Office’s identity assurance scheme in a local authority context. This overarching project aim is to empower citizens with their own data in a way they can trust. The project will create a space for learning about working with citizens’ data, building a safe environment to try things out and study what works and what doesn’t work. Crucially the project aims to understand how to do this in such a way that individuals are in control of their data.

It was 3 November 2011 when Ed Davey first announced midata:

Today’s announcement marks the first time globally there has been such a Government-backed initiative to empower individuals with so much control over the use of their own data.

Little did we expect then that it would be the best part of three years before anyone started to "explore" how midata might work. But only now, if DbyDN are to be believed, is a "feasibility study" being launched.

RIP IDA – gander rejects goose's sauce

No need to say it, it goes without saying, it should be obvious to all but, just in case it isn't obvious to all, IDA is dead.

IDA is the Cabinet Office Identity Assurance programme. And it's dead.

----------

There are 23 problems with UK government IT, Chris Chant told us, and they could all be solved by the adoption of cloud computing, he said.

You may or may not agree but the Government Digital Service (GDS) certainly do. They're all for cloud computing. Like all go-ahead people.

GDS have been responsible for the CloudStore for just over a year now. It's been a patchy service, admittedly, but central and local government departments were enjoined to buy all their IT requirements there. Or from the Digital Services framework, a rival website that suddenly appeared, or from the Digital Marketplace, which is due to replace the CloudStore at the end of next month.

"Help test the Digital Marketplace alpha - your comments will be used to design the beta version of the Digital Marketplace", said GDS. So someone did. You can, too. Just nip in to the beta version, enter "identity" in the Show services box, and look what you get – 518 hits.

That's 518 identity-related services available to any users of the Digital Marketplace. No need to reinvent the wheel, someone else has already done the hard work, just buy the components you need and assemble them into the identity assurance service you need. It's quick, it's cheap and it's open.

That's the spirit of cloud first. Don't pretend that government is different from other IT organisations. Don't waste years developing your own solutions. Take advantage of the products and services that already exist. All 518 of them, in this case.

That's what GDS say.

Except that, although that's good enough for everyone else, it won't do for GDS and their identity assurance service. Oh no.

No, they're different, they need to write their own identity hub. Because of course there aren't any available off the shelf. And they need to pay five "identity providers" to develop bespoke dialogues to create on-line digital identities as though no-one's ever done that before.

23 well-known mistakes to choose from, they're trying to make them all, with the predictable result that IDA is years late and probably over budget ...

... but we don't know that because the Major Projects Authority ignore the development of an identity assurance system for 60 million Brits and don't report on it, not major enough, ...

... the whole project is shrouded in secrecy by GDS, an organisation which claims to promote openness: "As our design principles say, if we make things open, we make things better".

Happy days on the identity assurance team :) @cjwferguson pic.twitter.com/HkjohexgoM — The delightful Janet Hughes (@JanetHughes) August 22, 2014

What would Chris Chant say?

Oddly enough, we know the answer. He says it's a waste of time. The "trust framework" on which IDA relies cannot be achieved. That's the 24th problem. "Truth, not trust", he says. You'll never achieve trust. It's a "doomed strategy". RIP.

----------

Updated 24.6.15

Government as a Surveillance Platform (GaaSP)

In the ten months since the post above was published IDA has made little progress:

• Its name has been changed to "GOV.UK Verify (RIP)".
• "Identity providers" have become "certified companies".
• The word "registration" and its cognates have been lopped off IDA's vocabulary – now, people "have their identity verified for the first time", they no longer "register" with GOV.UK Verify (RIP).
• Ditto the word "secure" and its cognates. GDS now offer "safety", not "security".

In particular, nothing was heard of GDS's identity hub – that part of GOV.UK Verify (RIP) which securely safely connects government departments and "identity providers" together with us proles.

Nothing, that is, until the other day when The Register magazine ("ElReg", to its friends) spotted an article by four academics,  Toward Mending Two Nation-Scale Brokered Identification Systems.

As most sentient beings will know, the academics first define several properties which it is desirable for an identity hub to possess and then demonstrate that GDS's identity hub doesn't. They conclude that as it stands the hub is not secure, it does not protect our privacy, it could provide the platform for mass surveillance and it "conflicts with the political sensitivities that arguably lead to the rejection of identity cards".

Unlike most of us, ElReg have actually talked to one of the academics, Mr George Danezis, and they quote him as follows: "This is a field where a number of solutions already exist ... maybe it was a case of 'not done here' syndrome". Or as we might say, it's alright for the dumb geese to go out and buy a hub off the shelf, but we ganders need our own special one.

RIP IDA – gander rejects goose's sauce

No need to say it, it goes without saying, it should be obvious to all but, just in case it isn't obvious to all, IDA is dead.

IDA is the Cabinet Office Identity Assurance programme. And it's dead.

----------

There are 23 problems with UK government IT, Chris Chant told us, and they could all be solved by the adoption of cloud computing, he said.

You may or may not agree but the Government Digital Service (GDS) certainly do. They're all for cloud computing. Like all go-ahead people.

Cloud computing goes up in smoke

Cloud computing, we have been told for years, is a no-brainer. It's cheaper than operating your own IT facilities in-house. It's more flexible – you can scale up and down as required. It's more secure. And it's greener.

Some organisations have expressed reservations but they have been ignored. Politicians, civil servants, the media and, of course, the suppliers of cloud computing services have succeeded in presenting cloud as a set of technologies which it is responsible to adopt.

Amazon, Google, Apple and Microsoft, among others, have thrived as a result. Businesses all over the world have been outsourcing their IT to these cloud computing suppliers, destroying their in-house competence and happily making themselves dependent on/beholden to outsiders.

Not just businesses, but governments, too.

In the UK, central government has contracted with third party suppliers to store a lot of their data (our data) and to operate many of their applications. They plan to put more data and applications into the cloud as soon as possible. They have created the G-Cloud team (government cloud) and CloudStore, a virtual supermarket where government departments can buy cloud services. And they have lured local government into doing the same, mocking local authorities who fail to follow the fashion.

The government initiative was championed by the charismatic Chris Chant.

Now it appears that the sales pitch was all wrong.

Who says?

Chris Chant.

For some months now, he's been tweeting teasers about trust and truth, e.g.

Cloud security - Truth better than trust - find out why soon .. http://t.co/OKTzTlK91H@G_Cloud_UK @RainmakerCXO — Chris Chant (@cantwaitogo) June 19, 2014

"Truth better than trust" – what does that mean? At first, nothing. But the other day it became clear. Chris is linked to an organisation called Rainmaker and Rainmaker is promoting an Estonian product called Guardtime. And what does Guardtime do? Guardtime "brings integrity, transparency and accountability to digital society". And not a moment too soon, because:

With an estimated 95% of all enterprise networks having been compromised, it is no surprise that every day the news headlines inform us of a new data breach, a new loss of intellectual property, more damaged reputations and increased legal liability. Indeed, the loss of intellectual property and personal information has been described as the biggest transfer of wealth in history.

How do we stop our property being stolen like this? Use Guardtime.

And how does Guardtime help? Take a look at Cloud Insecurity and True Accountability, a primer for CIOs on Guardtime and Keyless Signature Infrastructure (KSI) for Attributed Networking written by Matthew C. Johnson, CTO of Guardtime (hat tip Tim Hanley).

Reading the primer may not help you to understand how Guardtime works. It is reminiscent of blockchains, the technology underlying Bitcoin. But what is clear is that its advocates including Chris Chant believe that it is needed because you can't trust the suppliers of cloud computing services:

Handing over competition sensitive, Personally Identifiable Information (PII), or related Intellectual Property information to a Cloud Provider is indeed an exercise in extreme trust without the ability to independently verify Cloud Provider coherence to purported security guarantees, controls, and associated contracts. In 2014, in light of the CSA [the Cloud Security Alliance] assessment and analysis of threats to Cloud Providers [The Notorious Nine: Cloud Computing Top Threats in 2013], as well as governments’ perceived nefarious interactions with the telecommunications and data storage, social media, and search industries [see Edward Snowden passim]; it has become evident that blind trust in the service provider is a doomed strategy.

Weirdly, Chris Chant and Tim Hanley's Guardtime tweets telling us that G-Cloud's "doomed strategy" can't be trusted are posted on G-Cloud's Twitter timeline. Make of it what you will.

----------

Updated 8.8.14 #1

"Some organisations have expressed reservations" about cloud comptuting, it says in the post above, "but they have been ignored". Which organisations?

Back in October 2012 we listed several. The OECD, for example, and ENISA, the EU's Network and Information Security Agency, who said that cloud computing "should be limited to non-sensitive or non-critical applications and in the context of a defined strategy for cloud adoption which should include a clear exit strategy". It's time to bring the list up to date.

For the moment, let's add just one name to the list – the Law Society.

In April 2014 the Law Society issued a practice note for its members – solicitors in England and Wales. Lawyers are meant to protect their clients' data and keep it confidential. The practice note sets out a number of matters on which lawyers should satisfy themselves before using cloud computing.

Read the practice note, and you'll see that it's very hard for lawyers to obtain that satisfaction. Read the Guardtime Primer, and you'll see that it's impossible.

If Guardtime and Rainmaker and Chris Chant and Tim Hanley are right, it follows that members of the Law Society shouldn't use cloud computing.

Updated 8.8.14 #2

"What", you will have been asking yourself, "about the Public Services Network (PSN)?".

Just to remind you:

The Public Services Network (PSN) will substantially reduce the cost of communication services across UK government and enable new, joined-up and shared public services for the benefit of citizens. PSN is creating one logical network, based on industry standards, and a more open and competitive ICT marketplace at the heart of the UK public sector.

Gluttons for punishment can pursue their further researches on the PSN website.

The rest of us can take refuge in a chatty little 22-pager issued in January 2014 by the Cabinet Office, Public Services Network – PSIIF Trust Framework v1.0. "PSIIF" denotes Public Sector Internal Identity Federation. And (para.1.1):

A trust framework is made up of Business (Legal/Commercial/Policy), Technical and Implementation/Operational obligations on the members and providers of services within the PSIIF. This document defines the obligations, the mechanisms in place to ensure these are met and how these fit into the technical operation of the federation.

You know what the PSN is, and the PSIIF. And you know what a trust framework is. One more thing (also para.1.1):

The PSIIF will exist and be operated within the framework of the Public Services Network Authority (PSNA), but will extend to G-Cloud services and potentially 3rd Sector organisation providing service to the public sector that are not directly connected to the PSN, which have a requirement to identity the public servants using those services.

Now flick forward to Section 3 – Trust Model (para.3.1):

The establishment of trust between different organisations has always been a significant challenge in the development of effective Single Sign On across the public sector. Different organisations can have quite different interpretations of acceptable minimum levels of identity verification and of authentication, as well as a healthy scepticism about whether their fellow members are truly following their declared policies. This issue is not restricted to identity but has historically applied also to networks and shared services. The development of the Public Sector Network requires that all participants in the network have trust in all users of the network to ensure that all organisations protect their endpoints. The same holds true for all users of G-Cloud services. The PSN and G-Cloud have implemented an accreditation and compliance model that allows all organisations to trust all users of the PSN and G-Cloud at the stated level of trust ...

"The PSN and G-Cloud have implemented an accreditation and compliance model that allows all organisations to trust all users of the PSN and G-Cloud at the stated level of trust"?

No.

Things have changed since January.

By the end of July, G-Cloud had moved to a system of self-accreditation:

The transition to the new G-Cloud Security Approach, which asks for self-assertion, and the Digital Marketplace will be soon coming into effect. This means that suppliers on G-Cloud will no longer need to get Pan Government Accreditation (PGA). G-Cloud will stop accepting submissions for PGA from 30th of July 2014.

Now how much can "all organisations trust all users"?

And that's not the only change.

If Estonia and Guardtime and Rainmaker and Chris Chant and Tim Hanley are right, you can never achieve trust anyway. Trust isn't on the menu and it's a "doomed strategy".

In that case, bang goes G-Cloud. Bang goes IDA, the identity assurance service (RIP). And bang goes the PSN.

What do the G-Cloud team have to say in response?

Nothing. Not a thing. Chris Chant and Tim Hanley have undermined the legitimacy of G-Cloud and effectively accused the team of leading people on, under false pretences, but either the team haven't noticed or they don't consider those charges to be worthy of a response.

Not so, Chris Chant. Two big changes – (a) self-accreditation and (b) the notion of a trust framework is a nonsense. And what does he say? Rien ne change, nothing has changed:

@DMossEsq @tim_hanley @G_Cloud_UK @RainmakerCXO @GuardTime >>> but I'm sure they will profit from its existence "rien ne change" — Chris Chant (@cantwaitogo) August 8, 2014

You can only admire the chutzpah.

Updated 12.8.14

Things will never be the same again. http://t.co/yRNOoZy0E7 pic.twitter.com/xYzlDg5IKK
— Rainmaker Solutions (@RainmakerCXO) June 18, 2014

Cloud security - Truth better than trust - find out why soon .. http://t.co/OKTzTlK91H@G_Cloud_UK @RainmakerCXO
— Chris Chant (@cantwaitogo) June 19, 2014

Cloud security - Truth better than trust - find out why soon .... http://t.co/OKTzTlK91H @G_Cloud_UK @RainmakerCXO
— Chris Chant (@cantwaitogo) June 24, 2014

Undeniable proof, truth, not trust, is essential for any network or data storage asset.. http://t.co/OKTzTlK91H @G_Cloud_UK @RainmakerCXO
— Chris Chant (@cantwaitogo) July 4, 2014

"Russia backs law on web data storage" Another reason we need truth not trust @G_Cloud_UK http://t.co/oZUutd04tA
— Chris Chant (@cantwaitogo) July 5, 2014

Chris Chant Cloud security - Truth better than trust, find out why soon .... http://t.co/OKTzTlK91H @G_Cloud_UK @RainmakerCXO
— Chris Chant (@cantwaitogo) July 7, 2014

Cloud security - Truth better than trust - find out why soon .. http://t.co/OKTzTlK91H @G_Cloud_UK @RainmakerCXO
— Chris Chant (@cantwaitogo) July 14, 2014

Cloud security >> Truth better than trust, find out why soon .. http://t.co/OKTzTlK91H @G_Cloud_UK @RainmakerCXO
— Chris Chant (@cantwaitogo) July 23, 2014

Cloud security - Truth is better than trust, find out why soon .. http://t.co/OKTzTlK91H @G_Cloud_UK @RainmakerCXO
— Chris Chant (@cantwaitogo) July 28, 2014

24hrs to go until @RainmakerCXO totally disrupts UK Cloud security capability. Truth better than trust. http://t.co/OKTzTlK91H @G_Cloud_UK
— Chris Chant (@cantwaitogo) July 30, 2014

Read how Cloud security has changed in the UK from today, why truth is better than trust and how @RainmakerCXO helps http://t.co/Cep1casBDs
— Chris Chant (@cantwaitogo) July 31, 2014

Today is the day everything changes for cloud security in Europe - truth not trust - @RainmakerCXO @G_Cloud_UK
— Chris Chant (@cantwaitogo) July 31, 2014

Need to know exactly where in the cloud your data is >> see http://t.co/Cep1casBDs & discover truth not trust for your @G_Cloud_UK purchase
— Chris Chant (@cantwaitogo) August 1, 2014

Uk orgs and citizens no longer have to have confidence in that their data is secured, they can now verify the fact” http://t.co/po6adhIO8d
— Chris Chant (@cantwaitogo) August 4, 2014

Why you need #Guardtime - TRUTH because trust can never be enough @RainmakerCXO http://t.co/OwTdmO0Qdw
— Chris Chant (@cantwaitogo) August 5, 2014

"Rien ne change", says Chris Chant on 8 August 2014.

Which is strange when you see what he was saying on 30 July 2014 about how Rainmaker "totally disrupts UK cloud security capability" ...

... and what he was saying on 31 July 2014 about how "Cloud security has changed in the UK from today" and "today is the day everything changes for cloud security in Europe" ...

... and then there's that Rainmaker tweet on 18 June 2014 which he retweeted, "things will never be the same again".

He used to think that Guardtime would change everything. Now he doesn't. What changed?

----------

He's been quite busy promoting Guardtime – there are 15 tweets alongside.

Guardtime's message is perfectly clear.

They say :

Trust of a Cloud Service Provider is nonsense without the instrumentation and metrics to develop a formal sight picture into how reliable they really are and what they are doing with your data, services, and applications. (p.7)

and

How can you possibly trust the service provider to say, ‘it’s not our fault, we are not liable’, when there is no evidence to confirm or contradict the statement and what little evidence that might be presented is entirely shaped from the perspective of that service provider. (p.8)

and

Cloud Service Providers have been hesitant and stonewalling integrity verification and transparency technologies. The reason? Compromise of your data or exploitation may or may not indemnify them for losses and has direct effects on insurance and reinsurance of both your and their assets. If they (or you) can’t prove what was lost or compromised on their watch and how it occurred – if the evidence doesn’t exist, they can claim they are not liable. “Prove it”. (p.11)

and

Today, the Cloud Provider cannot provide proof you can trust that your company’s hosted data, applications, and services have integrity – that your critical data has not been manipulated without your knowledge or that it has been migrated to unauthorized locations (stolen) or altered. (p.13)

To overcome those problems, Guardtime say, you should use their Keyless Signature Infrastructure (KSI).

They may or may not be right but Chris Chant certainly agrees with them. 15 times.

You'll never get trust, he says, but at least with Guardtime you'll get the truth, which is "essential for any network or data storage asset", he was telling us on 4 July 2014.

Essential. I.e., without Guardtime, cloud computing customers are missing something important, "trust can never be enough" (5 August 2014). With Guardtime, "Uk orgs and citizens no longer have to have confidence in that their data is secured, they can now verify the fact" (4 August 2014).

That seems clear enough. But then, would you believe it, something else changed and now Chris says there's nothing wrong with using the cloud even if you don't have Guardtime:

@DMossEsq @tsingleton @G_Cloud_UK Oh please!
— Chris Chant (@cantwaitogo) August 10, 2014

It's getting very hard to keep up with Chris's changes. Trust is hard. Truth is hard. Meaning is hard.

Perhaps Mr Singleton can help. Shed some light on the matter. He's the boss of the G-Cloud team. Is using the cloud without Guardtime a "doomed strategy" or isn't it?

Updated 9.9.14

It's not just Chris Chant and Tim Hanley who now support the Rainmaker contention that trust in the cloud can never be achieved. They are joined at Rainmaker by several other senior former Whitehall officials:

• Mark Forth – Mark spent the majority of his career as a Civil Servant and has worked as the Commercial Director for HMRC, Home Office and DCLG ...
• Jan Joubert – Jan has extensive experience in the technology industry and supported the development of the UK G-Cloud market by ...
• Michael Bateman – Michael took G-Cloud through its first and second iterations ...
• Rhys Sharp – Ex-CTO at SCC, Advisor to HMG on G-Cloud programme, Senior Strategy consultant to Legal & General, Co-Op Financial Services (oops) ...
• Mark Poole – Ex-Chief of Staff, Cabinet Office e-Delivery Team, System and Service Implementation and Integration specialist – Defra, Home Office ...
• Peter Fagan – Ex-Security Manager – Government Gateway Critical National Infrastructure, GovConnect, GCF email scanning service, IA review for 2011 Census, National Lottery franchise assessments, original CLAS scheme member ...

Maybe there's something in it. Maybe all this talk of "trust frameworks" really is a waste of breath.

Maybe, for example, tScheme is wasting its time. tScheme and every EU member state. The Department for Business Innovation and Skills's paper on electronic signatures turned up yesterday and there, on p.6, we read that:

tScheme Limited (see: http://www.tscheme.org/index.html) is the UK’s Trusted List Scheme Operator (TLSO) and creates, hosts and maintains the UK’s Trust Service-status List (TSL) on behalf of the Department for Business, Innovation and Skills (BIS). Every Member State has its own TSL and each of these is referenced from a central list that is maintained by the Commission (see: EU Trusted list certificate providers - further info and policy).

If Rainmaker are right, Rainmaker and all those senior officials, then yes, tScheme is wasting its time.

Updated 2.10.14

Yesterday the UK abandoned the tax discs we have always displayed in our windscreens to demonstrate that we have paid our Vehicle Excise Duty (VED).

That led to a last-minute flurry of people trying to pay their VED using the new system recently deployed by the Driver and Vehicle Licensing Agency (DVLA) on GDS's award-winning GOV.UK.

Ever fashionable, GDS insist on using the cloud. The VED system is deployed in the cloud, we must assume, and you can write the script yourselves.

You know about the cloud. Capacity expands instantaneously to meet demand, it's resilient, nothing can knock it over.

Except that, according to the Guardian and all other media outlets:

DVLA tax disc renewal website buckles under pressure of high demand Tax disc renewal site taken offline by ‘unprecedented demand’ as new service comes online and tax disc by post is phased out The DVLA’s new vehicle tax site has crashed due to the large volume of people attempting to renew their tax online after paper discs were abolished in favour of digital records. The site was experiencing more than 6,000 visits a minute at 9.43pm on Tuesday, according to the DVLA, but remained up but by Wednesday morning when the new rules came into effect it was overwhelmed.

This is getting embarrassing. Again. You could drive an untaxed coach and horses through that cloud sales patter.

Cloud computing goes up in smoke

Cloud computing, we have been told for years, is a no-brainer. It's cheaper than operating your own IT facilities in-house. It's more flexible – you can scale up and down as required. It's more secure. And it's greener.

Some organisations have expressed reservations but they have been ignored. Politicians, civil servants, the media and, of course, the suppliers of cloud computing services have succeeded in presenting cloud as a set of technologies which it is responsible to adopt.

Amazon, Google, Apple and Microsoft, among others, have thrived as a result. Businesses all over the world have been outsourcing their IT to these cloud computing suppliers, destroying their in-house competence and happily making themselves dependent on/beholden to outsiders.

Not just businesses, but governments, too.

In the UK, central government has contracted with third party suppliers to store a lot of their data (our data) and to operate many of their applications. They plan to put more data and applications into the cloud as soon as possible. They have created the G-Cloud team (government cloud) and CloudStore, a virtual supermarket where government departments can buy cloud services. And they have lured local government into doing the same, mocking local authorities who fail to follow the fashion.

The government initiative was championed by the charismatic Chris Chant.

Now it appears that the sales pitch was all wrong.

Who says?

John Vine will be missed

E-borders system inspector to step down, hat tip Kable/government computing:

Chief immigration inspector John Vine will step down after overseeing 50 reports including review of key e-borders project in 2013

Among those 50 was the report on his May 2010 inspection of Manchester Airport.

Several senior civil servants all the way up to the level of Sir David Normington had asserted that face recognition machines would keep the border safe by matching passengers to photographs in their passports. These machines would be more reliable than human beings and cheaper.

How did they know?

Answer, these officials based their conclusions on trials carried out at Manchester Airport.

And what did John Vine say at para.5.29 in his report?

We could find no overall plan to evaluate the success or otherwise of the facial recognition gates at Manchester Airport and would urge the Agency to do so [as] soon as possible.

The matter is described in Whitehall on trials. The prattish belief in the effectiveness of mass consumer biometrics persists nevertheless.

Mr Vine will be missed.

John Vine will be missed

E-borders system inspector to step down, hat tip Kable/government computing:

Chief immigration inspector John Vine will step down after overseeing 50 reports including review of key e-borders project in 2013

Among those 50 was the report on his May 2010 inspection of Manchester Airport.

Several senior civil servants all the way up to the level of Sir David Normington had asserted that face recognition machines would keep the border safe by matching passengers to photographs in their passports. These machines would be more reliable than human beings and cheaper.

How did they know?

Answer, these officials based their conclusions on trials carried out at Manchester Airport.

And what did John Vine say at para.5.29 in his report?

We could find no overall plan to evaluate the success or otherwise of the facial recognition gates at Manchester Airport and would urge the Agency to do so [as] soon as possible.

The matter is described in Whitehall on trials. The prattish belief in the effectiveness of mass consumer biometrics persists nevertheless.

Mr Vine will be missed.

Mooncalf Economics Ltd

Here's a dilly of a press release issued yesterday by the Department for Business Innovation and Skills jointly with Companies House:

Free Companies House data to boost UK economy Companies House is to make all of its digital data available free of charge. ... As a result, it will be easier for businesses and members of the public to research and scrutinise the activities and ownership of companies and connected individuals ... It will also open up opportunities for entrepreneurs to come up with innovative ways of using the information ... Business Secretary Vince Cable said: "The government firmly believes that the best way to maximise the value to the UK economy of the information which Companies House holds, is for it to be available as open data. By making its data freely available and free of charge, Companies House is making the UK a more transparent, efficient and effective place to do business" ... Minister for the Cabinet Office Francis Maude said: "The UK is an international leader in open data because it sharpens accountability, exposes waste and informs choice over public services. It is also the raw material of our age, providing opportunities for entrepreneurs to create new data-led businesses and fuel growth as part of this government’s long-term economic plan" ...

It raises a few questions:

Free [how much will that cost?] Companies House data to boost UK economy [how?] Companies House is to make all of its [whose data is it really?] digital data available free of charge [how much will that cost?]. ... As a result, it will be easier for businesses and members of the public to research and scrutinise the activities and ownership of companies and connected individuals [easier to find the name, address, age, nationality and profession of officers of the company – would that be a good thing? Why?] ... It will also open up opportunities for entrepreneurs to come up with innovative ways of using the information [such as?] ... Business Secretary Vince Cable said: "The government firmly believes [why?] that the best way to maximise the value to the UK economy of the information which Companies House holds, is for it to be available as open data. By making its data freely available and free of charge, Companies House is making the UK a more transparent [in what way?], efficient [in what way?] and effective [in what way?] place to do business" ... Minister for the Cabinet Office Francis Maude said: "The UK is an international leader [is it? Would that be a good thing?] in open data because it sharpens accountability, exposes waste and informs choice over public services [suppliers of public services are not always registered with Companies House, e.g. the Cabinet Office]. It is also the raw material [traditionally, businesses pay for their raw materials. Companies and partnerships have paid to submit their data to Companies House. Why should others have access to it for free? Especially if they are able to make money out of it themselves?] of our age, providing opportunities for entrepreneurs to create new data-led businesses [such as?] and fuel growth [how?] as part of this government’s long-term economic plan" ...

Does anyone  know the answers? Apart from Vince Cable, Francis "JFDI" Maude, Nigel Shadbolt, Stephan Shakespeare and Tim Kelsey – we know they don't.

----------

Hat tip:

----------

Updated 27.7.18

It's four years since we posed the question above what innovative ways would entrepreneurs find to use Companies House's free information. We returned to the matter a month later in connection with open data and, in December 2015, in connection with public sector information.

Now at last we have the answer, Half a million companies followed: "Once you've registered for CHS you can begin following companies you have an interest in. When a company updates their details you’ll receive an email telling you what’s changed".

You've always been able to monitor companies using DueDil's Monitor service. Or, indeed, Companies House's own WebCheck service: "You can also choose to monitor a company, and receive email alerts of any new documents filed at Companies House" (© Crown Copyright 2014).

The answer is none. There has been no innovation. Four years and a lot of wasted effort later, nothing has happened. So much for transforming government end-to-end.

Mooncalf Economics Ltd

Here's a dilly of a press release issued yesterday by the Department for Business Innovation and Skills jointly with Companies House:

Free Companies House data to boost UK economy Companies House is to make all of its digital data available free of charge. ... As a result, it will be easier for businesses and members of the public to research and scrutinise the activities and ownership of companies and connected individuals ... It will also open up opportunities for entrepreneurs to come up with innovative ways of using the information ... Business Secretary Vince Cable said: "The government firmly believes that the best way to maximise the value to the UK economy of the information which Companies House holds, is for it to be available as open data. By making its data freely available and free of charge, Companies House is making the UK a more transparent, efficient and effective place to do business" ... Minister for the Cabinet Office Francis Maude said: "The UK is an international leader in open data because it sharpens accountability, exposes waste and informs choice over public services. It is also the raw material of our age, providing opportunities for entrepreneurs to create new data-led businesses and fuel growth as part of this government’s long-term economic plan" ...