Raw material for a "user requirement" for e-gov. Includes source material for presentation to new UK government CIO Ian Watmore on 4 November 2004 and more in a similar vein
13 May 2008
HMRC PAYE / NI Online 2008 - OK
My fourth year of using this HMRC PAYE / NI online service: Another government form successfully submitted ... I hope! All went fairly smoothly; the individual web-pages were reasonably clear; even near the end of the rather tight deadline, the service seemed quite fast; an acknowledgement email arrived promptly. Overall - for people who have broadband - this HMRC online service is much better than the old paper forms.
Update: Don’t miss HMRC’s video podcast which tries to explain this service: It’s easy to mock the upbeat tone and phrases such as “… a simple five step process ...” but it’s a good attempt and reasonably clear to people who have used the paper forms.
Note: Ordinary PAYE employees are shielded from the horrendous complexity of the UK’s Tax and NI system. This video gives a tiny insight.
Wibbis:
1. Instead of using “print” from the web-browser, I’d like the option to download PDFs of the completed forms.
2. Although you’re typing figures taken from PAYE & NI forms, it would still be useful if all boxes had descriptive labels (or even descriptive help) rather than labels such as “1e.”
3. Is it really essential for all UK companies to files this information in the short space between the end of the tax year and the 19th May?
After the local election results the Beeb picked up a “we need to listen"meme running through all the Labour reactions (I can’t list them all, but it was endless). Good news I guess for Opinion Leader, Mori, and the other favoured pollsters. My own concern is whether what they practice really is the sort of deep, respectful listening I’ve observed in the Society of Friends, or whether it’s a sort of disrespectul, suferficial, Amstrad-like listening for the buying signals. ("Watts per channel RMS? I’ll give them watts per channel RMS...etc")
Here is, I fear, our answer, from the great clunking fist himself. What has he done wrong, asks Beeb R4 this Sunday morning?
I’ve spent too little time thinking how we can get our arguments across to the people
Noooooooooooooo no no! Too much time thinking about that. Not enough time cultivating respectful listening in the right way.
Permission to use the OGC logo in any context and in any media must first be obtained in writing from OGC, please contact the OGC Service Desk.
So I hpe they’ve issued written permission to bloggers in Spain
No ven nada raro.Y si le volteamos unos 90 grados. Estas mentes sucias del gobierno siempre liándola. ¿Poco tacto o falta de creatividad? El nuevo diseño del logotipo de la Oficina de Comercio Gubernamental del Reino Unido (OGC - siglas en inglés-), cuyo diseño fue presentado el año pasado, ha sido criticado por sus supuestas connotaciones sexuales que despierta al ser girado 90 grados.
Le nouveau logo de l’OGC (Office and Government Commerce), conçu par l’agence FHD London pour la modique somme de 14 000£ (21 000€ : ça fait quand même 7 000€ par lettre, est l’objet d’un buzz sur Internet, et vous allez voir, ce n’est pas pour rien !
Leggo da Spotanatomy la notizia “curiosa” che l’Office of Government Commerce, l”ente inglese istituito per far chiarezza e aiutare a capire il sistema degli appalti pubblici, ha dovuto cambiare di corsa questo logo (foto in alto) costato ben 14.000 sterline.
Το Βρεατνικό OGC (Offie of government Commerce) αποφάσισε να δημιουργησει ένα νέο Logo. Επένδυσε λοιπόν 14,000 λίρες και εμπνεύστηκε, δε ξέρω απο που το παραπάνω σήμα. Πως σας φαίνεται; Ακριβό; Τώρα; Ο εκπρόσωπος του OGV πάντως δήλωσε “It is true that it caused a few titters among some
and in various other places to which my language skills do not extend
这个LOGO是英国商务部(Office of Government Commerce)花14000英镑请人设计的.网站暂时还没换上这个新的,但已经用于鼠标垫及笔上.天才无处不在,发现原来是酱紫滴(点开看哦.这个设计师真是油菜油菜滴.囧TL. 如果还不明白啥意思,百毒知不道万能!Via PS:谷歌翻译也SO强大嘛,”囧”都能翻译出来.果然,宅文化开始走向世界了
Britain appears to have forged a global lead in onanistic logos.
In cock-up Britain the tax authorities needlessly copy personal data to CDs then lose them. Clinton’s staffers stole the ‘W’s from White House keyboards when the apparently perfectly intelligent George Bush 2 took over at US&A. In Machiavellian Italy an outgoing administration deliberately posts everyone’s tax details, including salary, on the web (in this extraordinary story from the Beeb), apparently to poke Berlusconi in the eye.
Openness about tax is the norm in Scandinavia, but a complete shocker for Italians. Tax-dodging is somewhere between rife and socially acceptable in Italy. The outgoing administration must have been exasperated beyond reason at the thought of a crooked tax dodger getting back into power.
We knew the vast mounds of personal data held often unnecessarily by government were already at risk from nitwits and criminal insiders. We’d better add “piqued outgoing administrations” to the list of risks.
Wibbi government reduced its risk and liability by minimising its holdings of non-essential personal data, anonymising wherever possible, and encrypting the small proportion it is essential to keep? Not that it would have helped Italy here.
Wibbi the technical immortality attributed to Silvio Berlusconi were quickly proved to be a phantasm? Or is that unkind...he is entertaining, in a John Prescottey sort of way.
Wibbi we could take the best of Italy and and the best of Scandinavia and be enlightened and responsible with decent weather, good food and sublime artistic sensibility and sense of humour to boot? Well, we can but ask…
My name is Lindsey I’m a 25 year old homeowner and I would like to pay my council tax. I would like to receive a bill (as much as anyone ever likes receiving a bill) telling me how much I owe and how to pay it.
In the 9 months since I bought my house I have called Southwark council switchboard, the council tax office, and planning department numerous times each time asking to be able to pay my council tax. Initially I was told my house didn’t even exist (it’s a new build and somewhere in the bureaucracy of the inspections they did they forgot to register it). I still haven’t had official confirmation it is even registered.
So I gave up for a while hoping they would eventually get round to it.......
Then one day I got a business card from Liberata through the door which actually ended up getting lost in the kitchen and covered in food before I found it and realised it might be useful (I might like to add if I didn’t work at Kable I would have no idea who Liberata were and it would have gone straight in the bin). So I followed the biro instruction written on it saying ‘please ring’ and spoke to a nice man called Paul. He seemed to have some idea what was going on and took the details of my property developer. A few weeks later I called him back. Then I emailed. Then I called him back again. I gave him the same details again.
He did at least give me some sort of answer. Apparently it will probably take about 3 months to go through. I will get a bill at some point for a certain amount he thinks.
So 9 months on:
I don’t know how much my council tax will be.
I don’t know when I will get the bill.
I don’t know how long I will be given to pay it off.
I don’t even know who the right person to be chasing at the council is.
WIBBI. Wouldn’t it be better if when a person moved into a new house they were sent their council tax bill, with an explanation of how to pay it and when by? And perhaps in circumstances where this didn’t happen for whatever reason, citizens were offered support rather than feeling like they had to battle to get any kind of information? After all. this is a case of me offering to give them money!
Why is it that the spooky biometrics junkies who want to fingerprint, register and scan us make such rubbish, stilted videos which just feel like lies? And why do they use such satanic muzak? See
Suddenly Japan is added to the list of countries we have to find excuses to avoid visiting. Why is it that the antis have all the humanity, all the best gags and all the media skills? And feel as if they’re telling the truth? And who is more worthy of our trust - the stilted fibbers or the confident, empathetic artists with rocking taste in music?
Security & society: please answer me one simple question
Just back from an IBM “deep dive” into the deep and vexed question of security and society. IBM makes a considerable effort with these, inviting a couple of dozen external people to each of a series of eight events looking at trillion dollar questions with wide social and geographic impact. This is a demanding task, rigorously cross-disciplinary, and ideally needing government input. To work, it needs corporate participants to have gone through some sort of Cluetrain Manifesto metamorphosis (ie to speak in a natural voice not a corporate one) plus a dynamic and energising process and environment (as I write these very words our facilitator joins me in the Tegel Business lounge, we get into good conversation and I nearly miss my plane).
I think my reflections are of three sorts:
- how we approach the exam topic: security and society (see below)
- IBM culture and the culture of security (to follow here)
- the heart of Berlin, what it means and how it has changed (to follow on personal blog)
We met in the very plush Hotel Adlon in Berlin, the reconstructed bombed-out 1920s building on a site by the Brandenburg Gate that lay between East and West, next to the Holocaust memorial, and heavily fortified British and US Embassies.
Parts of the conversation I was frankly uncomfortable with; I’m sure I contributed a fair measure of discomfort. That’s probably no bad thing. I sensed, perhaps unfairly, that we had to fight a “shallow-dive” instinct to look for rich clients with branded security problems to which solutions could profitably be applied. There were hushed conversations about the eye-watering growth in markets for automated analysis of surveillance output and guileless suggestions about how we could derive extra revenues by extracting marketing data from security cameras in shopping malls.
Security people have to be matter-of-fact about unpleasant things. They take refuge in euphemisms, and label or brand their enemies so the threat is more clearly defined. But sometimes they seem hard-wired with dangerously wrong assumptions. We heard that only 2000 people had been “affected” by the World Trade Centre attack, and that we have yet to see the results when something “really significant” happens. In this Weltauffassung ”AQ” is the mainspring of our thinking; the driving business need against which we sell products and services. But...but...but...2000 people were killed in New York; literally millions have been directly “affected”. Meanwhile what has happened in the Congo, Iraq and elsewhere - Katrina, tsunami - is already “really significant”. Hey, there are food riots in six countries as we speak: is that not significant?
Let’s not have a world in which dangerous fringe religious fanatics set priorities for us. Let’s think harder, set our own priorities, and act to pre-empt less enlightened people.
There’s a sense of “our” security. But who are “they”? Who are we frightened of? Why are they scared of us? Aren’t we all in this together?
My alternate reading list for Berlin started with Oxford Research Group’s analysis of the greatest causes of global and regional instability and large-scale loss of life. The top four are:
- Climate change
- Competition over resources
- Marginalisation of the majority world
- Global militarisation
Terrorism - by AQ or anyone else - is terrible, and criminal. But ORG’s evidence does not place it among the top four threats. ORG goes on to argue that our responses to these threats fall broadly into two sorts (tho I note the argument of the radiantly expectant Prof Sadie Creese that these are interrelated):
1. control paradigm – an attempt to maintain the status quo through military means and control insecurity without addressing the root causes, or
2. sustainable security - cooperatively resolve the root causes of those threats using the most effective means available
Note: don’t call the second option “soft”. There’s nothing soft at all about hardcore pacificts. Pulling triggers is easy. Putting up walls or CCTV is easy. Love is hard.
So, my question, which I sought several times without success to have asked, is this:
What is the proportion of our resources (time, money, people, effort, thinking, innovation, technology) we currently put into the first sort of security vs the second? And if we were being entirely rational and evidence-based about the risks we face and the realistic possibilities of our actions having any effect on them, what proportion would we put into the first, and what into the second?
I wasn’t able to persuade the organisers to put this question to the group on the day. So I’ll try now, after the event, to do so alongside the group thank-you emails that are going round. Glad of your comments. Just click “comments” if you’re not already on the comments page, cut the bit below, paste it & complete the percentages (50:50, 80:20, 100:0 or whatever) below:
% of our time/money/resources/innovation effort…
----------------------------
...that we currently invest in
Control paradigm today ---%
Sustainable security today ---%
...that rationally we should invest (once we’e thought about it and considred the evidence) in
Control paradigm ---%
Sustainable security ---%
(Answers are impressionistic. “We” can mean you, your company, country, or the world - it doesnt matter which)
Does this InfoCards press release qualify PR person Kersti as a possible IdealGov author?
What do you do if an email appears in your intray from someone called Kersti Klami? I should add the subject line is perfectly repeatable in polite company. Anyway, I opened it and had a look. It turns out that she is a PR person working for some company called Racehorse or Fusion or something. Here’s what she has to say:
In light of recent information security breaches in the public sector, I though that the readers of Ideal Government would be interested to hear that ten local authorities across the UK are part of a pioneering pilot to share confidential information more securely. Instead of discs or login systems, they will be using Microsoft CardSpace online IDs to access sensitive documents. Eduserv (a not-for-profit organisation whose Athens access and identity management system is used by 98% of UK universities to access different online learning resources), will provide the local authorities with online IDs and manage the authentication system.
A few key points:
Recent security breaches in the public sector have highlighted the need to enhance IT security in the public sector: BBC just revealed that 13 local authorities in London alone have lost or misplaced confidential data in the last year
Using online IDs - or information cards - makes it easier for local authorities to share information in a secure manner
The local authorities use their online IDs to share internal documents relating to the Shared Learning Group that collaborates on innovative IT solutions in line with the Transformational Government strategy
There are plans to extend the project, providing all employees, residents and businesses their own online IDs. This will enable people to deal more easily and securely with their local authority, and to use their information cards for other web-services as well, e.g. online banking and shopping
Please note that this announcement is under embargo until tomorrow.
Ten Local Authorities Collaborate in a Pioneering Project to Share Sensitive Information More Easily and Securely
‘World’s First Large-Scale Use of Information Cards in the Public Sector’[1]
Eduserv to Streamline Access and Identity Management
Future Plans to Provide All Councils and Residents with Information Cards
Bath, 17th April 2008 – Eduserv, the not-for-profit IT services group, today announces the launch of a pioneering project to enable ten local authorities[2] to easily and securely access confidential information using Microsoft Windows CardSpace information cards.
The ten local authorities form part of the Shared Learning Group, which helps to share best practice and collaborate on innovative IT solutions in line with the aims set out in the Transformational Government strategy[3]. In the first instance, these local authorities will use their online IDs to share internal documents relating to the Shared Learning Group.
Eduserv, the developer of the widely-used Athens and OpenAthens access and identity management (AIM) systems, will provide project members with CardSpace information cards and manage the authentication system. The Shared Learning Group will be able to access and share documents securely, as well as take part in discussions relating to the group on a dedicated portal.
As the authentication process occurs in a secure local environment rather than in the Web browser, information cards offer greater security than traditional log-in systems. By employing CardSpace, users are less likely to fall victim of a phishing attack, whereby an unauthorised entity attempts to acquire sensitive information by masquerading as a trustworthy website.
Geoff Connell, CIO, London Borough of Newham and Chairman of the Shared Learning Group, comments: “To our knowledge, this is the world’s first information card implementation in the public sector. However, recent security breaches have highlighted the need to enhance IT security in governmental organisations. Using information cards makes it easier for the group to share information in a secure manner. In addition to extra security, Eduserv’s technology saves us valuable time and administrative resources.”
Ed Zedlewski, CIO and deputy CEO of Eduserv, says: “Local authorities hold ever increasing volumes of electronic data, which need to be accessed in a timely and secure manner. Eduserv‘s expertise in integrating technologies and in service delivery has demonstrated that combining information cards with OpenAthens can deliver the efficiencies that allow organisations to safely collaborate and share important information. Combining these technologies will provide a convenient way for users to manage their online identity in their own environment, enabling the individual to control where they store and how they release the credentials by which they are recognised.”
Geoff Connell adds: “We decided to work with Eduserv on this pioneering project because of the organisation’s expertise in creating and managing large scale AIM solutions. Over 4 million students and researchers in UK colleges and universities, the NHS and organisations worldwide use Athens and OpenAthens, Eduserv’s AIM systems, to access online information resources. The goal of the Shared Learning Group is to help UK local authorities to improve the efficiency and security of their AIM processes – we’re confident that with Eduserv we’ll achieve this.”
In addition to access and identity management, the Shared Learning Group focuses on employee productivity, flexible and collaborative working, business integration, child protection solutions, performance management, and maximising ICT support for council members.
###
_____
[1] Geoff Connell, CIO, London Borough of Newham
[2] London Borough of Newham, London Borough of Bromley, Derby City Council, the Isle of Man, Kent County Council, London Borough of Lewisham, Rotherham Metropolitan Borough Council, Sunderland City Council, Wakefield Metropolitan District Council and Warwick District Council
Eduserv is a not-for-profit, professional IT services group with the mission to realise the benefits of IT for learners, researchers and the institutions that serve them. Eduserv achieves its charitable mission through the provision of sustainable services and funding research and development. Services include:
Secure access to online resources (Athens and OpenAthens)
Licence Negotiation & Management – (Chest)
Managed web hosting
Content management (CMS) and web development.
Trading surpluses are used to support work across the education sector.
For more information about Eduserv please visit www.eduserv.org.uk or contact:
Is this the Microsoft PR machine in overdrive? They can be pretty full-on (I have examples, believe me). No, I take it at face value as an Eduserv press release, and a milestone in public-sector identity practice. Anyway, the inventor of the product in question was round to dinner just last night with two Microsoft colleagues. It was a delight to see them and they were all too polite to mention deployments.
Kersti: I commend you. This is the first press release published on Idealgov becauase it is pertinent and interesting (we’ve posted many that are worthy of ridicule). So I’m glad I didn’t delete it thinking it was spam. If you are able to take the Cluetrain Manifesto medicine and speak in a normal voice - not a voice of PR - you’re welcome to have author rights here and keep us in touch with how this is going.
John Harrison always said education would be the sector that starts to get this right first.
According to an August 2007 article in the FT, contracts will be awarded for suppliers to the NIS this Spring. Now. But will any suppliers bid? After all:
• The NIS may turn out to be a smaller system than suppliers expected and there may be less money to make out of it as a result. Crosby has ruled that the high volume of transactions that go through the banks and the big retailers are not on the menu. There is no reason for suppliers to expect the NIS to be involved in DWP benefit claims nor in the health service nor education. Scotland may refuse to use the NIS, and Wales, too. Its advocates always claim that the NIS will be used to prove everyone’s right to work in the UK but IPS failed to provide the ID checking service they promised. And it may be that, far from everyone aged 16 and over, only certain sections of the population will be fingerprinted.
• The timescales are stretching. Far from starting at the end of 2009, as previously planned, the NIS will not start to be rolled out in earnest now until 2012. And given IPS’s track record, suppliers would be well advised to allow for more delays.
• As the economy dips, people will want more assurance that their stealth tax money is being well spent. Hard to provide that assurance, when a number of prospective suppliers have already pulled out of the bidding, the House of Commons Science and Technology Committee are just as unimpressed with IPS’s plans as Crosby and the biometrics on which the NIS depends are unreliable.
• There are alternatives to the NIS. Identity assurance could be provided by the banks and/or the mobile phone companies and/or the utility companies and/or the credit referencing agencies. The NIS could become irrelevant. These other systems could be more effective and could come on-stream earlier than IPS’s 15-year timetable – a surprisingly relaxed timetable, given that we’re talking here about the UK’s response to crime and terrorism.
• Suppliers to the NIS would be victims of the lack of trust in the government identified by Crosby – they would be tarred with the same brush.
• IPS is not some unstoppable behemoth with a mandate to monitor everyone in the UK. On the contrary, it is a supplicant, in sales talks with prospective customers, and it hasn’t closed a single deal yet.
• Suppliers will be dependent on IPS and IPS are vulnerable. They are dependent on Labour and Labour treat the NIS like a political football. If the Lib Dems or the Conservatives come to power, the NIS will be cancelled, as its equivalent was in Australia, and suppliers cannot expect to be bailed out.
So now how sensible does it look for a supplier to invest in this project? Which sensible chief executive would commit the funds? Why? What return is sensibly to be expected? What price risk?
Is this “security & society index” the right start point for creating ideal e-enabled government?
Thanks to my good mate JJ I’ve been invited to an interesting-looking session in Berlin looking at “security & society”. I’m looking forward to it, and wondering what sort of homework to do. Our hosts have sent over some facts to get us thinking. It’s worked. They’ve got me thinking. Whaddyerreckon?
Security and Society Index
The below is a cross-section of statistics to provide context for some of the key issues on the topic of security.
Personal Security
Closed-circuit television (CCTV) cameras in public places in the U.K.: 5 million
Average number of times a Briton is filmed on CCTV in one day: 300
Crime reduction in UK credited to CCTV: 5%
Americans using the same password for most online accounts: 63%
Average number of people with access to a patient’s records during a hospitalization: 150
Computers that are daily controlled by malicious bots: 40%
Unique samples of malicious software discovered in 2007: 5 million
Increase in number of unique samples of malicious software over 2006: 5X
Average time before an unprotected online computer becomes infected with a virus: 20 minutes
Hours of victim’s personal time required to reclaim stolen identity: 600
Commercial Security
Personal-data records compromised by security breaches last year: 162 million
Total arrests made in conjunction with these security breaches: 19
Cost to companies per compromised record last year: $197
Estimated cost of all compromised records last year: $32 billion
Size of the worldwide security software market in 2007: $9.1 billion
Growth rate of security costs over IT budgets: 3X
Total losses worldwide due to phishing attacks last year: $3 billion
Estimated cyber crime market size: $100 billion
Global mobile operators hit by mobile device infections last year: 83%
IT executives who do not monitor their databases for suspicious activity: 40%
Organizations worldwide that have separate information security departments: 27%
Cost of corporate espionage to the world’s 1,000 largest companies: $45 billion
Corporate security breaches perpetrated by employees or contractors: 70%
Societal Security
Number of people crossing national borders every second: 25
Average Foreign Direct Investment loss due to increase risk of terrorism: $16 billion
Potential economic impact per 100,000 persons of a bioterrorist attack: $26.2 billion
Cost to vaccinate 100,000 people against such attack: $16.3 million
Total costs per 100,000 lives caused by all natural disasters worldwide in 2003: $22 billion
Annual number of people given terrorist risk-assessment scores by the USA’s Automated
Targeting System: 431 million
Accuracy of Automated Targeting System: 99.9%
Annual number of false alarms by Automated Targeting System: 431,000
Reduction of Middle East & South Asia’s Internet capacity due to damaged undersea cable: 70%
Duration of YouTube.com’s global outage due to interference by Pakistani government: 2 hours
What I want to take to Berlin is a good set of facts but above all the right frame of mind to have a constructive discussion about the ideal way to get to secure e-enabled society. There’s more to it than I can yet see here.
The next decade holds mind-bending promise for businesses. Globalization is prying open vast new markets.
Technology is plowing ahead, fueling--and transforming--entire industries, creating services we never
thought possible. Clever people worldwide are capitalizing every which way. But because globalization and
technology are morally neutral forces, they can also drive change of a different sort. In short, despite the
aura of limitless possibility, our lives are evolving in ways we can control only if we recognize the new
landscape. It’s time to take an unblinking look. We have entered the age of the faceless, agile enemy.
From London to Madrid and Nigeria to Russia, stateless terrorist groups have emerged to score blow after
blow against us. Driven by cultural fragmentation, schooled in the most sophisticated technologies, and
fueled by transnational crime, these groups are forcing corporations and individuals to develop new ways of
defending themselves. The end result of this struggle will be a new, more resilient approach to national
security, one built not around the state but around private citizens and companies. That new system will
change how we live and work--for the better, in many ways--but the road getting there may seem long at
times.
“The Hallmarks of a Totalitarian State”
By Josh Ward, Der Spiegel, March 27 2008
http://www.spiegel.de/international/germany/0,1518,541025,00.html
Germany’s high court has declared laws enabling British-style total surveillance of drivers illegal. Privacy
advocates and commentators applaud the ruling, but they ask if the court is trying to stop the laws from
snowballing into a police state—or just water them down.
Germany’s Federal Constitutional Court declared Tuesday that laws allowing police to indiscriminately scan
license plates using electronic surveillance devices and match them against databases kept by law
enforcement and state officials were unconstitutional—at least if strict provisions weren’t placed on the
practice.
This decision is the second large privacy decision handed down by the court in recent days. Less than two
weeks ago, the court ruled that spying on personal computers and online activity violates the right to privacy
and was therefore, in most cases, unconstitutional.
This has done nothing less than establish a new “fundamental right” for the 21st century, according to
German observers.
Strategies against Industrial Espionage – Manager Lounge in Munich
By Renate Lüdke, manager-magazin.de, February 5 2008
http://www.manager-magazin.de/koepfe/karriere/0,2828,533148,00.html
German companies suffer from losses of over eight billion Euro each year through industrial espionage.
Approximately half of all German companies, especially small and medium businesses, have been affected
by data theft in the past two years. “Germany as world champion for high-tech export is highly eligible for
industrial espionage,” warns security expert and EU consultant Felix Juhl in the context of this year’s first
local manager lounge in Munich.
Defending oneself against espionage is difficult, but not impossible. First, it has to be detected, however,
which is not always that simple. It often only becomes obvious when original and plagiarized product clash at
trade fairs; or if the copied product fails – such as medication with life-threatening components or faulty
technology in cars.
A good prevention strategy is paramount. Firewall, antivirus programs and PIN-secured printers are a good
start. But one should also know that printers can save up to five gigabytes of data, shredders can have
integrated scanners, meeting rooms can be wiretapped from as far as 70 meters, and there are giveaways
which are made to spy on you.
Aggressors Enter through the Data Cable
By Thorsten Riedl, Süddeutsche Zeitung, March 27 2008
Viruses, worms, Trojans, armies of remote-control computers for mail attacks: The criminals’ creativity is
boundless. And according to experts, they attack business computers more often than ever in order to make
money. They blackmail companies by threatening to shut down data services or internet sites or they steal
information electronically. Especially mid-market companies, who do not have sufficient IT-specialists, lack
awareness for such risks. Therefore, it is important to sensitize all employees.
While the programming of virus programs used to be a boasting of technical skills – often amongst youths –
the tools are much more intricate now and the goal is to make money. Many cases where money was lost
never become public because people are scared that this will have more negative effects. But every now and
then, there are big cases such as when Russian hackers shut down the internet sites of several Estonian
institutions for several days, for example the biggest bank of the country.
Apparently, one third of all betting agencies pays protection money because otherwise, their websites are
bombarded with inane inquiries which make the companies’ computers crash. Thus, customers cannot get in
contact with the system and the companies’ existence is endangered.
Interview with Udo Helmbrecht, President, German Federal Office for Security in Information Technology:
The German Federal Office for Security in Information Technology advises small and medium businesses
(SMBs) to make sure that their data is secured adequately, both physically and technically. Many SMBs are
not aware that their know-how in industries such as defence, electronics, optics, aerospace, energy,
environment or automotive makes them a prime target for attacks, especially from Asia and emerging
markets.
It has become easier than ever to spy on companies. While data had to be copied and smuggled out of the
company in former times, it can now be carried out on a little USB-stick. Plus, people are not aware that e-
mails are about as safe as postcards if they are not encrypted. Therefore, it is important that companies,
especially SMBs, become aware of the fact that IT-security is top priority.
As your business becomes more collaborative and global, the risks to your company’s trade secrets rise
proportionally. Fortunately, there are new strategies to protect the data that allows you to compete.
Most IT organizations approach the risk to IP the way they approach all IT security: focusing on the corporate
perimeter and developing security tactics and policies from the system level up. Instead, CIOs must take a
top-down approach. What’s required today is a counterintelligence mind-set that assumes someone,
somewhere, wants your data, along with multiple layers of defense to thwart would-be cyberspies and
respond when (not if) they get through your defenses.
In today’s global economy, the number of insiders within any organization has increased dramatically if you
count external partners among them. “Organizations now have to deal with employees connecting from
home offices, the local Starbucks and shady hotels,” says John Bumgarner, research director for security
technology at the US Cyber Consequences Unit. “They also have to deal with business partners and
customers having access to their networks via VPNs, dial-up connections and Web portals, any of which can
be used to compromise the organization’s resources.”
The vast majority of IP loss incidents are simple errors: posting information to externally facing Web sites
wrongly assumed to be protected or including confidential information in a reply to an e-mail that includes
external recipients. The most successful hacks, says Bumgarner, occur because attackers get lucky,
stumbling across vulnerability while scanning thousands of IP addresses. But the most dangerous attacks
are deliberate.
Without a clear idea about which IP assets most need protecting, CIOs may put their security dollars in the
wrong places. But as with cybercrime generally, perimeter defense goes only so far. Companies need a
cyberdefense strategy that is multilayered with different types of protection at each layer.
One strategy, called “defense in depth”, derives from the military technique for slowing down rather than
trying to stop the advance of an adversary. The model applies when the question is not if, but when, hackers
will break in. “If you reinforce one area, [attackers] will look to another,” says James Lewis, director and
senior fellow with the Centre for Strategic and International Studies. “The job is to reduce the chance that
they’ll be able to get in.”
Look at the new technologies for collecting personal information, and the dangers of abuse.
These days, data about people’s whereabouts, purchases, behavior and personal lives are gathered, stored
and shared on a scale that no dictator of the old school ever thought possible. Most of the time, there is
nothing obviously malign about this. Governments say they need to gather data to ward off terrorism or
protect public health; corporations say they do it to deliver goods and services more efficiently. But the
ubiquity of electronic data-gathering and processing—and above all, its acceptance by the public—is still
astonishing, even compared with a decade ago. Nor is it confined to one region or political system.
Across the rich and not-so-rich world, electronic devices are already being used to keep tabs on ordinary
citizens as never before. Closed-circuit television cameras (CCTV) with infra-red night vision peer down at
citizens from street corners, and in banks, airports and shopping malls. Every time someone clicks on a web
page, makes a phone call, uses a credit card, or checks in with a microchipped pass at work, that person
leaves a data trail that can later be tracked. Every day, billions of bits of such personal data are stored, sifted,
analyzed, cross-referenced with other information and, in many cases, used to build up profiles to predict
possible future behavior. Sometimes this information is collected by governments; mostly it is gathered by
companies, though in many cases they are obliged to make it available to law-enforcement agencies and
other state bodies when asked.
What does seem to worry people is the sheer volume of information now being kept on them and the degree
to which it is being made accessible to an ever wider group of individuals and agencies. The government is
now developing the world’s first national children’s database for every child under 18. The National Health
Service database, already the biggest of its kind in Europe, will eventually hold the medical records of all
53m people in England and Wales.
Even more controversial is Britain’s National Identity Register, due to hold up to 49 different items on
everyone living in the country. From 2009, everybody is to be issued with a “smart” biometric ID card, linked
to the national register, which will be required for access to public services such as doctors’ surgeries,
unemployment offices, libraries and the like—leaving a new, readily traceable, electronic data-trail.
As a series of leaks in the past few years has shown, no data are ever really secure. Laptops containing
sensitive data are stolen from cars, backup tapes go missing in transit and hackers can break into databases,
even the Pentagon’s. Then there are “insider attacks”, in which people abuse the access they enjoy through
their jobs. National Health Service workers in Britain were recently reported to have peeked at the intimate
medical details of an unnamed celebrity. All of this can lead to invasions of privacy and identity theft. As the
Surveillance Studies Network concludes in its recent report on the “surveillance society”, drawn up for
Britain’s information commissioner, Richard Thomas, “The jury is out on whether privacy regulation...is not
ineffective in the face of novel threats.”
The Spy in Your Pocket
By Kristina Dell, Time Magazine, March 19, 2006, Copyright 2008 Time Inc. All rights reserved.
http://www.time.com/time/magazine/article/0,9171,1174705,00.html
The embrace of mobile phones has far outpaced efforts to keep what we do with them private. That has
cleared the way for a cottage industry devoted to exploiting phone numbers, calling records and even the
locations of unsuspecting subscribers for profit. A second business segment is developing applications like
anonymous traffic monitoring and employee tracking. It’s not just the con artists who are a worry. Every new
mobile-phone technology, even a useful, perfectly legal one, comes with unintended privacy concerns.
Most mobile phones are powerful tracking devices, with globalpositioning systems (GPS) inside. Companies
combine GPS data with information about users to create practical applications. One technology allows
rental-car companies to track their cars with GPS. For about $26 a month per employee, a boss can se up a
“geofence” to track how workers use company-issued cell phones or even if they go home early.
AirSage, for example, gets data from wireless carriers to monitor drivers’ cell-phone signals and map them
over road grids. That lets it see exactly where gridlock is forming and quickly alert drivers to delays and
alternative routes. The data it gets from carriers are aggregated from many users and scrambled, so no one
can track an individual phone.
Younger Workers and Data Security
By James E. Gaskin, Network World, March 13, 2008
http://www.linuxworld.com/columnists/2008/031008gaskin.html
Smart phones, portable music players and social network addiction make for happy Millennials, but sad
security officers. There are almost as many Millennials - born between 1980 and 2000 - as there are Baby
Boomers. Call them the Internet Generation, Echo Boomers or whippersnappers, there’s a bunch of them
now hitting the job market.
Fortune Magazine called the Millennials “the most high-maintenance, but also most high-performing
workforce in the history of the world.” And they’re driving big companies with strict security guidelines crazy
with their demands to use Facebook and Instant Messaging, download any new program they see on the
Web, and sneer at anything not Web-enabled.
It’s one thing to have products that help you stop an employee from copying data to her iPod (and Symantec
does), but another to mesh old-line security people with young “let’s all share everything and talk about it on
MySpace” employees.
Inside the Global Hacking Service Economy
By Scott Berinato, CSO Online, September 2007
http://www.cio.com/article/135500/
This article details the new criminal “service” model for hacking has developed across the globe, full-fledged
e-commerce operations that are slick and accessible, with comprehensive product offerings and a strong
customer focus.
Climate Change ‘Threatens’ European Security
By Tony Barber, Financial Times, March 11 2008
http://www.ft.com/cms/s/0/2b4df7fe-eef5-11dc-97ec-0000779fd2ac,dwp_uuid=70662e7c-3027-11da-ba9f-
00000e2511c8.html
Climate change poses serious security risks for the European Union, ranging from sharper competition for
global energy resources to the arrival of numerous “environmental migrants”, warns a report prepared for an
EU summit.
The report is the EU’s first in-depth study of the impact of global warming on the bloc’s foreign and security
policies. It identifies several regions where climate change appears all too likely to threaten the EU’s security
or damage its political and economic interests.
“The multilateral system is at risk if the international community fails to address the threats. Climate change
impacts will fuel the politics of resentment between those most responsible for climate change and those
most affected by it ... and drive political tension nationally and internationally,” the report warns.
The full gamut of dangers facing Britain, from terrorist plots to disasters caused by climate change, is to be
spelt out by the Government in the form of an annual national threat register, Gordon Brown announced.
A new-style civil defense network, modeled on the Second World War air-raid wardens – “but without the
uniforms” – is also to be set up. Members of the public can join it to help local authorities and emergency
services at a time of national crisis.
As he announced a national security strategy, the Prime Minister made it clear that he wanted the public to
be more involved and better informed about the threats facing this country over the next ten to twenty years.
Robert Hannigan, the Prime Minister’s intelligence and security adviser, confirmed that as part of the
attempts to be more open about security threats, the heads of MI6, MI5 and GCHQ would soon be required
to give evidence in public to MPs. They will appear before the parliamentary Intelligence and Security
Committee (ISC).
The Cabinet Office White Paper emphasized that the overarching aim of the security strategy was to enable
“people to go about their daily lives freely and with confidence”, and with a “reasonable assurance of safety”.
Return-to-work freelancer gets unceremoniously flamed in The Reg
El Reg invited me to do my first piece of frelance journalism for several years - an article about Microsoft’s acquisition of Stefan Brands’ U-Prove work. I was never a brilliant journalist and I’m a bit rusty; the piece was longwinded and late. The Reg’s readers give pretty short shrift to most things anyway.
In the dozen or so comments, readers are offended by the suggestion that Jacqui Smith the Home Secretary is a pretty smart woman. Anonymous Coward retorts, for example
Her utterances in post have been utterly without personality; and her entire career would fit better with the theory she’s an energetic loyalist slogger not an imaginitive thinker.
Eponymous Cowherd takes a similar view.
The fact is that few politicians would score that well in a test on tech issues which the average Reg reader would sail through. But they’re called on to apply themselves more or less to every issue Parliament debates or that their constituents come up with. They’re ultimate generalists. I can’t produce Jacqui Smith’s examn results to defend my remarks but I stand by the sentiment that you dont get to be Britain’s first woman Home Secretary without being a smart woman. Furthermore, we won’t get the chance to put to her how important these developments in Internet security and privacy are if we approach her in a dismissive and insulting way. We’ve got to the stage where the intelligent generalist needs to understand the importance of privacy-enhancing technologies in general and minimum disclosure tokens in particular. We need to think carefully how to engage in that conversation.
Meanwhile jubtastic1 and others haul me up, with some justification, for not explaining Dr Brands limited disclosure credentials very clearly. On rereading the article I think that’s a fair cop. Sorry! It’s not insulting to anyone to say 99.9% of us will never understand the maths of Stefan’s solutions - I have a maths A-level and I couldn’t even name the symbols in many of his equations let alone prove whether they add up correctly to something to which I can entrust my personal details online.
Stefan did patiently explain U-Prove to me in a new and different way with analogies based on soap bars with shapes stamped underneath. The problem, as I said, is that he’s solved an emerging problem which, though serious and real, has no simple analogy in the tangible world. Nor does his solution have an analogy in the visible and tangible world; a number of its benefits are counterintuitive.
I guess his video animations are a helpful explanation to which I should have linked earlier. But I have to make it clear again to those who want to _really_ understand his work I’m not the man who can help. I dont _really_ understand it. Anyway, it’s not me that matters, and the world’s cyptographers are not the only ones who matter. Jacqui Smith matters. Ollie Letwin understood it when a FIPR colleague and I explained it to him a few years ago (and a half-hour meeting lasted 90 minutes). The challenge is: how can we ensure the importance of this is put to the Home Secretary? How can it be done in a way that is persuasive?
No2ID pulled off a major coup with its mayoral hustings. Ken didnt show up and was branded a coward by the-man-whom-Ministers-are forbidden-from-calling-Boris, who promised to cut his ID card and “sprinkle it on my cornflakes”. Details from BBC below.
And CAAT has won a High Court ruling that the Government acted unlawfully when it curtailed a corruption investigation into BAE Systems’ Al Yamamah arms deals with Saudi Arabia.
Earlier on Tuesday evening, Mr Paddick and Mr Johnson took part in a debate organised by NO2ID, which campaigns against identity cards and the “database state”.
Mr Livingstone declined to attend, prompting Mr Johnson to brand him a “confirmed chicken”.
The panel, which also included Left List candidate Lyndsey German, UKIP’s Gerard Batten and Jenny Jones, standing in for Green candidate Sian Berry, were united in their condemnation of the government’s ID card scheme...Mr Paddick told the meeting that like his party leader, Nick Clegg, he would rather go to prison than carry an ID card - and he criticised the use of Oyster travel card records to track people’s movements, saying it was “the beginning of a police state”.
“I resent the fact that just because I have auto top-up on my Oyster card, that means Transport for London can monitor exactly where I am whenever I go by bus and whenever I go to an underground station”.
He said he would restrict the use by police of Oyster data and congestion charge cameras, except for suspected terrorist offences and violent crime - a pledge echoed by Mr Johnson.
Mr Johnson attacked ID cards as “morally and economically bankrupt” and pledged to cut his card up and “sprinkle it on my cornflakes”.
He went further than party leader David Cameron by speaking out against the issuing of ID cards to non-EU migrants, which begins this year, saying it was “creepy and wrong”.
Can the ICS avoid the classic largescale IT project design problems?
DCSF recently published a summary of an evaluation of the Integrated Children’s System (ICS), which raises a number of significant issues for the continued and successful implementation of the scheme by local authorities. The research, carried out by York University and funded by the department draws attention to:
• The unanticipated scale of organisational change which the implementation of a complex system such as ICS brought about.
• Difficulties in system commissioning and contracting by local authorities - a long-standing issue between local authorities and suppliers which was magnified by the size and scope of the ICS.
It highlights the need for greater cooperation between users in managing IT contracts to ensure that what is delivered is fit for purpose and maximises the benefits of having electronic social care records.
• The need for improvements in social work training to ensure that qualified workers are knowledgeable about the research and conceptual base of the ICS, and are enabled to develop their analytical skills.
• The challenge of reflecting the involvement and voices of the children and families themselves within an electronic system.
• The need for greater support for social workers to use the system appropriately with disabled children and, more particularly, to manage the challenge of assessing children who may be at different developmental stages for different dimensions of their lives.
Supporting and in places improving or intervening in the lives of children living in complicated and at times dysfunctional family settings is enormously skilled work. To make a positive contribution to keeping children safe and well, it seems obvious that an electronic record system must support and promote the authoritative but sensitive, nuanced best practice of social work and other professions - not provide a technocratic, un-feeling underpinning infrastructure. It is therefore concerning that the research uncovered disagreement about
whether the quality of social work practice has been promoted by the system, particularly in relation to direct work with children and their families and carers.
How those experiencing public services FEEL is critical to judging ‘success’ - especially in social care. So alarm bells should ring when research indicates some social workers felt strongly that the documents produced using the system, such as the care plans, were not suitable for sharing with service users: being considered to be too long, the language within them inappropriate and complex, and the information within them too dense to be shared. Some social workers complained that the use of the system obscured information about the family context and resulted in the loss of the ‘stories’ of children’s lives. And critically,
some social workers in the study perceived that they spent more time on record keeping in the office and less time working directly with children and families.
In the full research report, one interviewee said it took 10 times as long to do a care plan under ICS, which meant they were being taken away from the “real social work” of interacting with children and families. (Intriguingly, in the sole piece of emboldened text, the DCSF summary highlights that
In none of the cases examined, however, was data entry social workers’ predominant activity.
Thank goodness for that!
Community Care and El Reg both pick up the story and highlight the fact that the department’s summary downplays or loses some of the more negative elements of the evaluation. Community Care notes that the full research piece highlights complaints by social workers that the ICS was promoting form-driven social work that could threaten the profession’s values and good practice:
Researchers concluded that the system, based on a series of tick-box forms, was not tailored to individual children, and failed to ask important questions of some children while asking others that were irrelevant, resulting in “bland analyses”. The report said: “The process was felt to diminish analysis and risk assessment. There were particular concerns about risk because it was unclear where the information would be located.”
Despite a clear softening of messages, it seems to me that there’s plenty in the DCSF’s own summary for the implementation teams to work on, if they really want to get the ICS right and avoid the classic technical, social and behavioural problems which have best large IT implementations in the recent past. It’s worrying therefore that The Register quotes the department dismissing the research completely:
because “the research does not provide a sound basis on which to judge the potential value of the ICS”.
WIBBI we look back in 3 years and can see the ICS was an exemplar of excellence (listening, responding, testing, adjusting), and not a repeat of the problems designed into the CSA IT system.
I dont really get this. An eyewitness made a contempory note of Meg Hillier telling the Home Affairs Select cttee
The National Identity Register, essentially, will be a secure database; ...hack-proof, not connected to the Internet...not be accessible online; any links with any other agency will be down encrypted links.
The National Identity Register, essentially, will be a secure database; it will not be accessible online; any links with any other agency will
be down encrypted links.
Why ws that toned down? If it’s not accessible online what is the use of it? Will people have to send CDs to each other? But if it is linked live to other agencies isnt that online?
Also, now we’re procuring the damn thing, do we know what will be on the card? Do we know how people authenticate the card, and what they can check?
I suspect it’s too much to try to get answers to all these questions. What would be really great is if we could get a list of all the outstanding questions about how the Benighted Scheme is supposed to work. Vey glad of any help and thoughts. Delighted to get contributions and clarifications form our loyal readers inside IPS.
I can’t reveal the identity or affiliation of any participant at the tasty and interesting dinner I attended last night. I believe (under the revised Rule) I can say it was at the House of Lords. I can definitely say there are some very dodgy memes flying around.
One is the notion that we can decline to “buy into” the European legislative framework and case law behind the UK’s data protection act and data sharing plans. The European Convention on Human Rights and Data Protection directive have legal force here. We can’t just dismiss them as Euro-constiutional claptrap, insufficiently pragmatic for us Brits (any more than I can say I think our laws on tax or whatever aren’t quite right and that I don’t really “buy into them").
Another is a distinct, probably unintended but seriously wrong elitist vibe which suggests it’s intolerable for the media to intrude into the lives of those who run the country, therefore the top 5% need extreme protection from revelations about their private lives. But when conversation turns to hoi polloi people are spoken of as immigrant tax-dodging scroungers of social services and healthcare. Our national situation is one requiring monolithic ID management and a toxic soup of data sharing. Facing the national problems we do a general loss of privacy isn’t a great price to pay.
People who desperately need a giro cheque will give away any amount of personal information to feed the kids. That’s why they need every bit as much statutory and practical privacy protection as anyone else. We’re all in this together. Just as we’re equal in the eyes of the law so too the systems we create must be good enough for one and all of us in how they protect our personal data and leave us in control of our own lives.
By all means put casual service-sector workers in businesses with 125% staff turnover (Rentokil, apparently) on 50% emergency tax rates while the employers and the system works out who they are, and that they haven’t claimed their allowances already.
The other weird meme is this self-repairing bubble of mutual self-congratulation. Reasonable people tell you in all seriousness that everything is fine and that Whitehall generally and the CIO profession in particular is doing a great job. The same people will reel off a list of dire specific shortcomings, whether it’s procurement processes, large government web sites, political interference, Transformational Government, Connecting for Health, DirectGov search. But as fast as they acknowledge specific shortcomings, the bubble of self-belief self-heals. I can’t work that one out. Surely there are some mistaken assumptions underlying this?
Let's say what we want from e-enabled government. Let's observe government first-hand. Let's say "Wouldn't It Be Better If" (WIBBI). Become an ethnographer of bureaucracy today! It beats getting frustrated with public services.
Anyone is free to comment. Or mail
with an article if you want to be an author. I'll post it up and send you a password. This whole thing is supported by Kable.