Is Digititis still a greater threat to the on-line world than cyberattack?

| No Comments | No TrackBacks
| More
For all the spend on cybersecurity, it appears that cockup (as with the recent Time Warner down time) still causes more chaos over the Internet that does criminal conspiracy (as with the recent attacks on JP Morgan and others). Meanwhile advertising (and tracking) bloatware can negate the benefits of moving from 7 megs to 70 megs on - especially when it spends it time "negotiating" with your security software - without giving you any say over what is blocked and what is not.   

I am currently helping the Digital Policy Alliance with the invitation lists for an event on 12th September to help "round out" responses to the latest round of consultations on Communications Infrastructure Policy. But one starts involving users, whether business or consumer, it quickly becomes apparent that nominal line speed is just one of the factors that need to be addressed if the objective is services that are fit for purpose. One of the shockers I learned earleir this week was the difference between the time it took to install global connectivity to a third world construction site (whether or not it there are landlines in the area) with providing local connectivity to a similar site between two UK city centres. I am hoping that the UK company which provides the relevant technologies will provide me with a note on the reason why and what should be done if we are serious about reforming the way our sclerotic regulatory and planning systems get in the way of overhauling the UK's economic infrastructure after over a decade of neglect.       

It is also apparent that any consideration of future infrastructure policy has to consider the security of that infrastructure - from cockup and digititis. not just cyberattack.  

A local digital exchange in every market town?

| No Comments | No TrackBacks
| More
Yestrday I posed the question of how the UK moves from a mish mash of semi-incompatible pre-internet fixed and mobile communications networks to a seamless mesh. fit for the post-Internet age, when everything is interconnected.

This morning I received a rather good  answer, sent from a smart-phone at 0.1 mbps from a not-spot in the middle of an area supposedly well served by current fixed and mobile opeators. The suggestion was to bring the centuries old tradition of the market town alongside the modern concepts of carrier neutral data centres and internet peering centres and create a network of  "Local Digital Exchanges". These would provide local digital operations with access to a full range of connectivity products, whether or not these are part of the offering of the dominant local communications service provider(s).

I look forward to more details when the proposer an get better on-line access but this suggestion could help kick-start the inter-operablity to which all pay lip service, while seeking to insert their own lock-ins. 
A couple of days ago I said that the importance of the consultation to get inputs to a new Digital Communications Infrastructure Strategy  cannot be under-estimated. There may be flaws in the "vision" behind the consultation paper but that makes YOUR response all the more important. 

The consultation states (para 2.2) that "Looking ahead 10 -15 years in the communications space is challenging if not near impossible." It then proceeds to do so, with scenarios that are already out of date. Some of the technologies said (in Appendix D) to be "in development" have already been deployed. Several said to be "new to market" have been in use for over a decade. All three scenarios for 2025- 30 already co-exist, sometimes in the same geographic community, stratified by age and skill. And those creating the industries of the future are beginning to migrate accordingly.

The future is what we make it.

The core issue is whether our ambitions are to be constrained by government, regulators, incumbents or by the willingness of consumers and business customers to pay for what is on offer - and therefore of investors to provide the necessary funding.

The elephant in the room is willingness to pay: more particularly, who is willing to pay what, how and when. As with the early railways, progress (around the world, not just in the UK)  is being driven by those who have found ways of pooling needs (including with other utilities) and/or using advance payments and funding from would-be customers to remove the risk from their investment - despite the opposition of canal owners who saw no need to frighten the horses or set fire to the hayfields.  

Many existing networks are creaking under demand from those who do not expect to pay more than they currently do for a mix of fixed line, mobile services (including wifi) and content (whether broadcast, timeshifted or downloaded). But new entrants are building cheaper, more reliable fibre and wireless networks, capable of delivering much better service at lower cost and of handling future change in ways that many legacy networks cannot. Meanwhile those benefiting most from the take-off in on-line traffic and e-commerce (Amazon, Apple, e-Bay, Facebook, Google etc.) are calling for "net neutrality" while paying for little more than the links to their data centres. And those in government who wish us to transact on-line often appear very reluctant to contribute to the investment necessary to enable us to do so.   

The list of those who contributed to the exercise to draft the consultation may help indicate why the scenarios and questions are as they are, when surely the key question is how to ensure that networks support not only current inter-operability standards but are capable of incremental upgrade, as demand, technologies and standards evolve in ways that have not been predicted, let alone fit the business models of the dominant players of the day.

The main inputs, other than from trade associations and other collectives, are from Telcos, Mobile Operators and Broadcasters with past investments and well-established business models to protect. Apart from CISCO, Ericsson and Huawei the voices of those who are building and equipping leading edge networks around the world are missing. So too are the voices of most of the e-tailers, content publishers and social network operators whose traffic is causing our current infrastructures to creak (Amazon, Apple, e-Bay, Facebook, John Lewis, Netflix, Twitter). There appear to be no inputs from those measuring the speed, scale and nature of the growth of traffic flows over a mix of traffic from fixed to mobile to wifi, let alone how much of it flows between networks locally (part of scenario 3) as opposed to via central peering centres. There were no inputs from the alternative network providers who are beginning to provide gigabit services to the business parks and housing complexes left out of the plans of BT and Virgin. Nor from the interest groups representing business users (urban or rural) apart from the FSB who recently condemned our current broadband infrastructure as unfit for purpose  .

Is that the fault of Government for not consulting a much wider audience?

Or is it the fault of those not consulted for being too busy building the future to spend time Whitehall watching and thus "discovering" the opportunity to inputs to the draft. On this front I should plead guilty to not having spotted the importance of the previous exercise and blogged accordingly to drum up inputs, let alone made the time to submit my own views.

Hence my reason for repeating the call for YOU to respond to this consultation - even though it was launched with little fanfare during the silly season.

An "alternative vision" of the current UK communications market may help explain the importance of obtaining views from a much wider audience.

The UK consumer broadband investment model (dating from before the rise of the Internet) is broken.  Prices are falling faster than demand is rising. BT is therefore switching funds from infrastructure investment into improving service to retain existing customers and into a content price war to try to get new ones. Meanwhile BT's rivals are seeking to piggyback on its past investments (e.g. the doubling of Openreach fibre lines over the past year) and the extensions being funded by the taxpayer (via BDUK). They are lobbying for unbundled access (VULA and PIA) at prices which unscramble BT's cross subsidies with its new content business.

Meanwhile the needs of business (large and small) and of those consumers willing to pay up front in order to get world class connectivity are being ignored - except by the newcomers (some well funded, others not) who the incumbents have been seeking to lock out of the market. But some of BT's rivals are now looking to do deals with the newcomers in order to get better, faster access to high value customers and lower cost than via BT. And there is also increasing pressure on BT to offer better deals for those whose want to link their local fibre networks onto BT's national trunking service.

To look at the market another way:

BT's 21CN investment programme (completion delayed by nearly a decade when local loop unbundling wrecked the business model and caused the share price to plummet) is now coming to an end (except for the extensions paid for by Government). Virgin's new owner is planning to build on some of the old cable company infrastructure investments abandoned when NTL and Telewest had to focus on integrating the best of their networks in order to survive. Vodafone appears to be planning to give the bulk of its funds (after upgrading to 4G and investing in overseas networks) back to shareholders and try to get better prices for access to BT's infrastructure - rather than extend the infrastructure it acquired with Cable and Wireless. 

The other mobile operators are also (like Vodafone) looking at infrastructure sharing including with local authorities (e.g. the "Wireless Concessions"). Sky too appears to decided to put its funds elsewhere, while looking at how best to exploit the investments planned by new players like City Fibre. Meanwhile the new alternative networks may have finally broken through BT's successful blocking operation with regard to BDUK funding. From Cumbria and B4RN, through West Oxfordshire and Cotswold Broadband and the other small commuities served by Gigaclear to City Fibre  (with York, Peterborough, Coventry  and now Kirklees) and  ITS (with  Hammersmith and Fulham and othrs)  or the growing number of Hyperoptic networks , we can see a proliferation of local utility  broadband networks springing up, with their finances underpinned by demand from local authorities, commercial centres and business parks, apartment blocks  and housing complexes. We shold not forget, however, that most need to interwork locally with BT even if they do not rely on it for trunking to the London Internet Exchange

At this point I would like to applaud Ofcom (I do not often do so) for realising that the alternative network operatorsm who are beginning to transform the services available to communities left out of the plans of BT and Virginm have also been left out of their market review structure and for commissioning INCA  to help them with a survey to correct this. 

The problem for the incumbents with whom DCMS and Ofcom are used to working is that the UK is used to cheap, slow, always on Internet. Even our supposed "superfast" is fit only for video streaming and low resolution conferencing (e.g. Skype). New players like Hyperoptic have to compete with "free" (or almost "free") for anyone who take an over-priced phone line. However, their ongoing charge (i.e. leaving out initial freebies on both sides) for 100 mbps uncapped (including a telephone service) appears less than any of the BT "unlimited" broadband offerings (whether superfast or infinity). And their gigabit service costs only for only 50% more.

So what about the role of Government and regulators in promoting both competition and investment?

By original discipline I am a historian. I remember looking at the "rigging" of a pair of Royal Commission enquiries into price fixing during the early stages of the Industrial Revolution (when traditional pricing structures were collapsing as new sources of supply opened up and whole trades, such as handloom weaving, exploded and collapsed within a decade or so). By the time the evidence had been collected the market had been transformed. By the time the reports had been agreed the findings (and all the lobbying that had gone into securing them) were of no relevance - save that intervention that would have prevented or delayed that transformation had been avoided.

At London Business School I enjoyed the case studies in Michael Beesley's  course on the regulation of private sector monopolies and his explanation as to why it was futile to even try do  anything more than control price, quality of service and predatory behaviour. The recent histories of Ofcom and Ofgem indicate why he was right.   

Hence also my strong prejudice against Governments or Regulators basing policy on predictions of the future, as opposed to better detecting and responding to change when it happens and on removing the obstacles to change that block new entrants from exploiting better, cheaper ways of meeting user needs, even if only in niche geographic markets or business sectors. 

The pace of change is running well ahead of the timescales for the alternative scenarios in the consultation. They are happening already, in parallel. We need to stop wadting time trying to forecast and instead focus on how to allow and encourage (not discourage) new investors to fund those who will enable the UK to keep abreast of global change.

The questions asked in the consultation are relevant but the main of role of the regulator is to control abusive behaviour and the main role of Government, as in the early years of the railway age (and the Admiralty mail contracts), is as a lead customer - mandating (via PSN) adherence to inter-operability standards for those who want its business. Hence the importance of the City Fibre arrangements with Easynet to be piloted with Kirklees. 

Kirklees is by no means the only council which has to either take 30 - 40% out of its operating costs or grow its revenue base substantially.  Hence the impetus behind the local authority exploration of wireless concessions  to use ubiquitous local wifi to help kick start local economic growth, inprove social cohesion and slash the cost of local on-line public service delivery using their obligations under the Social Values Act as part of the planning and procurement process. Some of the wico plans are already, via coherant "smart city" thinking, helping pull forward Scenario 3 in the consultation. 

Those like Regional Network Solutions who are advising councils on how to get best value from such concessions also emphasise the need for these to operate to international inter-operability standards, not just for seamless connectivity today but also to enable seamless evolution into the world of tomorrow. I recently blogged on the importance of standards but I recommend you also read the comment (to that entry) by Sean Barker on the need to mandate user-driven standards in order to maintain long-term flexibility (he uses the intended life span of the Queen Elizabeth class aircraft carriers to illustrate the issues) avoid supplier lock-in. This is clearly a role for government and, given the way that the Internet itself is creaking badly because major players are not updating the routers they use, the time has come for HMG to follow the US government and include IPV6 compliance as a mandatory part of its own procurement processes.       

Adherance to international standards also makes much easier for failing network operators, large or small, to be taken over and consolidated, or broken up, with seamless transition for their customers (unlike the trauma that followed the collapse of Worldcom or the problems faced by those local authorities  who fell for the more recent profit share promises of Gowex).

The diagram on page 56 of Section 5 of the consultation paper illustrates why it is so difficult for incumbent players to raise funds at economic cost. Prices are falling faster than demand is rising. The same analysis could, however, have been done before each of the railway booms of the 19th Century. The lead investors in the railway floatations were nearly always eastate owners, merchants and businessmen who wanted cheaper, faster access to market for their coal, farm produce or manufactures than was provided by the canals. Later they were joined by those who wished to build whole new communities (c.f. Metroland, unusual only because the railway company itself was allow to exploit its land holdings). Many railways never much, if any, profit for shareholders but they transformed the communities they served.

Hence my regular calls to make it much easier to draw in infrastructure investment from those whose commercial centres and business parks will rise in value as well as from house-holders and businesses willing to pay up front for a three to five year service. In practice I expect many of the networks to then be bought up, or at least operated, by a relatively small number of national and global players (provided they were designed, built and equipped to global inter-operability standards) as were most of the railways built by the Stephenson's (or the original telephone companies).

I suspect, however, that enabling and encouraging customer (including local authority and other public sector) and community funding for local utility networks (built and equiped to international standards) may be the only way to bring forward investment of the scale and nature needed to give the UK a world-beating communications infrastructure - just as it gave us world-beating railway system and created our original water, gas and electricity utilities.

To conclude,. Speak now  or live with the consequences.

P.S. 20th August I have been getting some very interesting feedback - including the idea of a "local internet exchange" in every market town to help pull through both inter-operability and resilience.

Now is your opportunity to help change the future of the UK economy, not just of communications infrastructure policy.

| No Comments | No TrackBacks
| More
The importance of the consultation on inputs to a new Digital Communications Infrastructure Strategy  cannot be under-estimated. The Treasury/DCMS Consultation may have been launched during the silly season (August 6th) but it is anything but silly.

I apologise for not blogging earlier on this opportunity for you to help drag UK communications policy forward into the 21st century.  I spend my summer break in a not-spot (infrastructure not upgraded since the last century) where I needed twenty minutes of clean signal to download anything more than e-mail headings, let alone send an e-mail or browse the net.

[Do not feel sorry for me. I sat by the window sipping whisky, watching the seals scratch themselves and the buzzards hunt for lunch, while the solar panels charged my smart phone and netbook as they sought a 2G signal from the other side of the Loch. Feel sorry for those for whom this is their year round service - not just a break from the on-line merry-go-round]. 

Much of the background material in the Digital Communications Infrastructure consultation document is myopic. Some say that indicates how little officials have appreciated the changes under way. Others say if reflects the antiquity of parts of the infrastructure. More-over publicity for the consultation has been muted and its timing might seem to imply HMG is going through the motions and in not serious. But the politicians are serious and the consequences of a lack of response other than from those contacted will be profound. An example of the latter can be seen in the statements regarding user expectations in Ofcoms recently updated guidance on network security . No attributable inputs to the consultation that led to that update were received other than from BT, KCOM, Sky, EE, Vodaphone, Three, Verizon, DWP and the ICO. It appears there were no inputs from network users, large or small, other than from Government.

The importance of the responses to the questions in the Infrastructure consultation cover letter (see below) can be seen from recent news cover confirming that BT's investment programme (other than to acquire sporting rights to give away to stop the loss of revenue to Sky, Talk Talk, Virgin and others) or funded by government has come to an end and Openreach is now focussed on service improvement.

When I have been able to digest the consultation paper and the e-mails I have received commenting on it, I will plan to juxtapose these with material on recent attempts to open up the sclerotic UK market to more effective competition and on other opportunities to not only influence the political and regulatory agendas at both UK and EU level, but bring forward no risk, rapid payback investment in bottleneck removal without waiting for the result of the consultation.

In the mean time, this consultation offers the start point for bringing about changes as profound as those triggered by the studies on which I worked back in 1978 -9 which led to telecommunications liberalisation and privatisation and the revolution that followed.

Do respond. Including on the questions that are not asked.

Speak now or live with the conseuences.

"Dear Stakeholder

The Chancellor for the Exchequer has today launched a consultation published jointly by the Department for Culture, Media and Sport (DCMS) and Infrastructure UK seeking evidence to inform a new Digital Communications Infrastructure Strategy.

DCMS' Connectivity, Content and Consumers report identified a need to develop a longer term strategy to build on the UK's strong digital foundations. The strategy will consider the measures needed, from Government and others, to ensure that the UK has the infrastructure in place to meet user demand and to continue to benefit from world-class communications networks as technology and the digital economy develop further over the next ten to fifteen years.

We are not consulting on a draft strategy or on specific policy proposals. The consultation instead poses a set of intentionally broad questions to draw out evidence on the expected demands of business and consumers on technology and infrastructure. It also asks for views on the challenges likely to be faced in providing the infrastructure to meet those demands.

The questions are grouped according to the following themes:
•         the role of Government;
•         scenarios of possible user demand and technological developments set against a backdrop of a range of influencing factors;
•         how the regulatory framework could change to maintain competition and to facilitate provision of infrastructure to meet demand; and
•         the scale of private investment required, and by when and by whom.

We would welcome your responses to the consultation, which will close on 1 October 2014.
You can find the consultation document, along with details of how to respond, on the Government website: https://www.gov.uk/government/consultations/digital-communications-infrastructure-strategy-consultation

If you have any questions about the consultation please email the team at dcisconsultation@culture.gsi.gov.uk.
"

I remind you of the value of releasing your submissions to the press and of placing them on websites for easy reference, whether or not the department does so.

This makes it easier for those actions which do not require any change of government policy to gather pace as soon as investors perceive the necessary critical mass of support and investment analysts ask pertinent questions. An example of the latter might be: "Is the sum of the parts of BT worth more than the whole and is its "national role" therefore the main factor, apart from management ambition, militating against break up?". If so: "What should be the role of government, apart from maintaining  a "golden share" in those parts which are part of the critical national infrastructure."

Time has moved on but the stakes today are as high as they were in 1979 and the need for radical thinking is every bit as great.

The good news is that we see the impact of BT's £2.5 billion investment over recent years and of the Government's £1.2bn add-on funding . On-line purchases have risen sharply in the wake of broadband improvements . The use of video streaming services such as Netflix is also rising. The bad news is that the headline take-up of BT Infinity appears to have been below expectations and its overall revenues are falling. Hence its retrenchment and focus on giving away sports content and also improving service  

But if that is BT's foward strategy then much of the UK (urban as well as rural) faces economic stagnation and social exclusion - unless it can draw in infrastructure investment from:

  • Virgin (as with its 100,000 homes extension in East London),
  • Sky (although it now appears focussed on deals to exploit infrastructure investments by others),
  • Arqiva (probably about to receive a new injection of funds for long term investment if the UK climate looks ripe),
  • Mobile and Wifi Operators (faced with soaring consumer volumes but not revenues and therefore planning to better exploit location independent business and service markets).
  • Sovereign wealth and pensions funds looking for ways of investing in broadband utilities, large and small: using a kaleidoscope of business models (involving local authorities, business parks, commercial and social landlords and self help groups) to turn risk investment into boringly safe long term returns.

We should also remember that in Sweden the incumbent telco became an anchor tenant of many of the shared municipal communications utilities when it ran out of investment funds. Some of BT recent succesful wifi and public service delivery bids indicate that it too is exploring alternative business models as its costs of borrowing rise because it is viewed as as a media company rather than a utility.

When I tried to work out likely UKIP technology policies, based on the views of some of its new MEPs regarding "capitalism not corporatism" and the issues local to their areas, I realised that in their eyes the UK faces a simple choice:

Is it to become a sink for imported content with our high streets bankrupted by extra-terratorial and untaxed (except in Ireland or Luxembourg) on-line e-tailers?

or

Is to once again be a global hub for trusted, wealth creating and taxpaying businesses, setting its own agenda?

I will not go into whether that really is the choice we face. I would merely say that those who think UKIP is wrong have not only to convince the voters but need to bear in mind that UKIP is particularly strong in parts of the UK which do not have globally competitive business connectivity and do not even have that choice.

Hence the importance of this consultation. 

Is the BT Business Broadband monopoly about to crumble? How will it respond?

| 3 Comments | No TrackBacks
| More
I recently blogged on the demand aggregation exercise being organised by the City of London  A couple of days later I received a note on the current state of INCA plans in response to the recent Federation of Small Business report on how small businesses are often left out of the national superfast broadband rollout.

INCA membership has grown rapidly over the past year and now includes those ready, willing and able to provide high speed broadband services in areas that BT deems commercially unviable, provided a critical mass of businesses want the fast, symmetric, low cost access they can provide.  INCA has therefore teamed up with the Federation of Communications Services to develop a network of projects in enterprise zones and business parks around the country.

The first project to go live was not in a deeply rural area, but in the heart of Shoreditch, London (need door to Smithfield, still sloughed with rural crapband). The Perseverance Works, home to 90 SMEs, has just contracted a project with Fibre Options to deliver gigabit broadband speeds for a fraction of the price charged by BT for a 'leased line', the only high speed broadband alternative available to them (Infinity is not available in the City of London because ...) .
 
INCA members like CityFibre, with a range of 'Gigabit City' projects (beginning with York, Coventry and Peterborough), aim to cover all premises in their area, including all the local businesses. Other INCA members like MLL TelecomITS Technology Group, Gigaclear
and Hyperoptic have developed high speed services, using fibre and wireless technologies, specifically to fill the business park gaps left by BT. The City Fibre interchange arrangements with Sky and Talk Talk being piloted in York and the interconnection services offered by Fluidata and others mean that the pieces are now in place for consumers to benefit from investment in local networks where the return is underpinned by business demand. 
 
The movement in the market also means that a growing number of fund managers are looking at the opportunities now that business contracts mean fibre networks can be assessed as utility leasing deals rather than risk investments. The tragedy is that BT and Virgin appear trapped in a price war with Sky which they cannot win and therefore lack the funds to compete. That situation will get worse as BT's leased line monopoly comes under growing threat and the mobile operators improve the availability of ubiquitous (i.e. mix of fibre, wifi and mobile) 4G, eating further into traditional telecoms revenues.

Where does that leave government policy. The good news is that local authorities, both urban and rural are beginning to use the new generation of BDUK schemes (from vouchers to bids for innovation funding) to break out of the straightjacket framework about which I have been so rude in the past. 

The bad news is that not all have been successful - in some cities lack of engagement with local business and lack of publicity for voucher schemes means that the take up has been pathetic. In others, the rush to contract has let them to ignore industry advice (e.g. warnings about the Gowex business model over a year ago) and fall for superficially attractive exclusive deals which appear to bar mainstream UK wifi services from their city centres.

This does not, however, mean that the reimposition of central planning would provide other than uniform mediocrity. Provided the use of international inter-operability standards, (not just the subset used in the BDUK contract with BT) is mandated the way will be open for new players to seamlessly take over the operations of those that fail - unlike the Digital Region which will need to be reworked after its purchase from bankruptcy by Geo.

There are a many business groups now lobbying for action on business broadband, in addition to those representing  areas (inner city as well as rural) where investment in 21st century communications infrastructures is unlikely unless councils add in their own communications infrastructure and service budgets. As vice- chairman policy studies for the Conservative Technology Forum, I would find it most helpful if more of the players were to come together via the Digital Policy Alliance with a view to putting the same arguments to all parties - so that we can work out where we differ on fundamentals as opposed to bells and whistles.

That would encourage and enable officials to bring forward those actions on which we are in violent agreement to before the next election - thus saving over a year.


I should add that even the argument as to whether it is better to rely on market forces (including local municipal enterprise) or on central planning (including the role of Ofcom as more than a competition and standards regulator) appears to lead to splits within the parties rather than between them and need not delay practical progress within existing policy frameworks.

However, what is helpful to me is less important than what is helpful to the next generation and to the one after that who will have to live the mess we will make of the future of the UK if we try to second guess the future and are wrong. Hence my lack of faith in the Government, even if advised by me, picking winners. 







Why does the Bletchley Park Trust wish to airbrush Colossus out of history?

| 1 Comment | No TrackBacks
| More
The Daily Mail press cover for the visit of the Duchess of Cambridge to Bletchley
includes a photograph of Collossus, hidden among the fashion photographs. That was more than was evident on the day. Apparently the Trust took down all the signs leading to the Colossus site, locked all the gates and invited none of team who helped the rebuild and ran the school visits and tours during Bletchley's lean times before the lottery donation. 

Why? 

And why has there been no acceptance of the many offers to help mediate the dispute between the Trust and the Museum that is getting in the way of fund-raising for both?

There appear to be a number of reasons: from commercial, through personal to the legacy of Bletchley's cold war role, in which some of the Computer museum's supporters and volunteers played parts which are still secret. 

The commercial disputes range from rivalry for funding, tenancy agreements and the role of volunteers in a "modern" museum.  There seem to be many "obvious" ways forward, given goodwill on both sides, but the role of volunteers is more complex when some have memories that are still covered by the Official Secrets Act.  

The personality disputes appear more complex and some appear to date back to the cold war "tensions" regarding the role of the UK security services that were brought to a head by the actions of Peter Wright and his colleagues over what they supposedly learned in the course of surveillance operations. We are still living with consequences of the termination of plans to be more open about the nature and governance of UK surveillance operations that followed Wright's publication of Spycatcher after he had been denied a pension.

That brings us to the apparent policy of removing reference to the symbiotic relationship between the surveillance and computing : from sigint and cryptanalysis to search engines and deep packet inspection, from Colossus to the ICL 2900 series (the design of which was, in significant part, dictated by the requirements of the lead customer for the 2980 - GCHQ).

The current dispute is symptomatic of our inability to have an informed, rational and constructive debate on how to reconcile privacy, surveillance and security (personal not "just" state) in a democratic society.

We take sides, backing the "the Guardian" or "GCHQ".

Meanwhile the statements of those who actually understand today's use of the "Big Data" techniques and technologies pioneered at Bletchley commonly combine intellectual schizophrenia, moral hypocrisy and greed (whether for research funding or commercial gain).

Hence the importance of breaking down the barriers between the Theme Park and the Museum . We need to fund both sets of activity, properly, but also to join them, so that our children and grandchildren can learn the truth, not just the mix of simplifications and myths, interspersed with a few lies (some necessary, most not) that we feed those too immature to handle the truth. I hope that we might also use the opportunity to undo some of the damage done by Peter Wright and publicly contrast the governance structures of GCHQ (which so frustrated him - and for very good reason - as he himself demonstrated) with those of other agencies and of the private sector suppliers in whom they have so misplaced their trust (including those who designed the systems abused by Edward Snowden and then vetted and employed him).     

Are you suffering from Crapband in the City? Tell the Corporation.

| No Comments | No TrackBacks
| More

The problem of crapband (slow and unreliable mobile and as poor fixed line services) in the City of London and its effect on global competitiveness are summarised in a video clip by the Common Councilman for Bishopsgate . The Corporation recently conducted a survey and has now, unlike Ofcom, identified a market failure and is looking at what action it can take without being accused of "state aid" (as BT accused Birmingham when it sought to organise a Stokab solution to rejuvenate its original industrial heartland).  

The City of London believes, of course, in making markets work and is known to be exploring a variety of options.

These include:  

  1.  introducing new players (whether private led or a Stockholm-style joint venture) to provide ubiquitous fibre and/or to improve 3G and 4G cover using the City assets (as has been done by other Cities across the UK, beginning with London's traditional rival, Westminster)
  2. the use of simplified planning procedures to require all new-build office to have fibre and ducting  capability and co-ordinate street works to reduce civil engineering costs and improve speed to market
  3.  the identification of clusters of high demand, using demand registration programmes to help give investors confidence that they are financing a low risk utility projects
As yet none of the incumbent suppliers appears to have taken the rising tide of discontent seriously but the charges being quoted to SMEs in the City (plus £7 - 10,000 p.a.) appear to be three to four times the annual charge for domestic fibre to premises where the latter is available.

The Corporation's exploration of the third option has therefore moved forward with a YouTube video inviting registrations of interest and a new survey of demand from its 13,000 businesses, msot them SMEDs and 25% of them high tech, as well as its 9,000 residents, 
.
Meanwhile, over the border, in Shoreditch , I am told that a consortium is moving ahead with using publicity for the Government voucher scheme to support a demand aggregation exercise to make it easier for alternative suppliers to supply fibre and transform the prospects of those priced out of the Tech City complex   


I look forward to hearing the response to exercises being done by the Corporation of London to identify demand and whether these are to be made available to potential suppliers and their backers. I add the backers because I look forward to seeing the consequences when investment analysts pick up on evidence both of the latent demand and of the reluctance (or inability) of incumbent suppliers to satisfy that demand.

I was recently given sight of an analysis of the anticipated impact on BT of a rise in interest rates before the end of its current price wars with Sky, Virgin and Talk Talk. Apparently BT's "decision" that it is a content provider, not a publisher, has caused a significant rise in its cost of capital. Its borrowings are said to be rising while its investment plans (other than those funded via BDUK contracts) are falling. Hence the rumblings of support in some quarters for exploring a break-up of BT - provided a way is found of ensuring that the critical infrastructure roles (including the surveillance operations it conducts on behalf of GCHQ) remain under UK control.   

In the meantime I would urge those who live or work in the City and are suffering from the current market failure to respond to watch the video and register their interest and also to complete the survey contact their Common Councilmen. The City is unusual in that businesses have the vote. If they instead vote with their feet and move to where they can get affordable broadband that is fit for purpose, the consequences could be dire for UK as a whole, not just the CIty.

The rest of you who are suffering from crapband can, of course, now be assured that you are not being discriminated against, any more than the rest of British business, as suppliers cut prices in a fight for consumer market share in a shrinking market. Yes I did say "shrinking market". Overall consumer spend on on-line connectivity and content is now stagnant or falling - as the major players seek to give away each other's bread and butter in the hope of jam tomorrow.

The consequences of all those price wars and freebie offers do not look good if some of the analyses predicting an end to the bubble of debt-funded investment are correct. The share price of tech stocks with business models based on consumer or advertising spend look to tumble later this year when interest rates start to rise. Meanwhile there are many thousands, perhaps millions, of savers, plus businesses with cash reserves and pension and sovereign wealth getting out of dodgy government debt, looking for safe long term returns from utility investments.

The politics and economics of broadband have suddenly become even more "interesting".

 

Why inter-operability standards are essential for an open and competitive market

| 1 Comment | No TrackBacks
| More

Bryan Glick's summary of the "Big IT v. SME's" debate and the need to change supplier behaviour raises many questions, not least "how we bring about genuine competition?".

A little while ago, when blogging on the need for robust policies to preserve competition in the on-line world as a whole  I promised to reprise my script to a recent BASDA (the Business Software Developers Association) conference. I was asked to address the importance of inter-operability standards. These are boring but essential to genunine competition. Without  effective action on standards, the lobbyists of the oligopolists can still make a credible case to "Sir Humphrey" that the Minister will be happier with hiring consultants to plan a high cost/risk "delayed big bang" project (i.e. promises today, problems tomorrow: for his successor) than a low cost/risk incremental change programme. The former is safer for the minister - he will have moved on before the chickens come home to roast. The latter opens up the potential for criticism while the minister is still in office, whether the trials work (post code lottery because only a few have benefited) or not (waste of time/money, however small).

Chi Onwurah is correct in saying that we still need the big suppliers. If government is seeking to contract 25% of its business to SMEs that mean the big suppliers will still account for up to 75%, But securing value for money, with systems and contracts that can evolve over time, as needs and technologies changes, require fundamental changes in behaviour on the part of both government and its suppliers, small as well as large. The era of painfully negotiated, comprehensive and inflexible outsourcing contracts and PFI deals is coming to an end. Its demise will, however, be neither easy nor painless, unless and until major suppliers can find democratically accountable, (for public money and quality of service), ways of working flexibly and profitably with "families" of nimble, low overhead, innovators. Some suppliers are well down this route. But even they face problems because they risk cannibalising bread and butter revenue streams in favour of a reduced share of lower margin new business. The true winners are those (as yet only a handful) who have worked out how to use the opportunity to jobs back to the UK while dramatically cutting their off-shore, outsourced costs: the "win, win, win" strategy. 

I was, however, accused of "scaremongering" when I blogged on the possible implications of a recent criticism of a ministerial refusal to plough good money after bad until the end-user trials of the people processes the technology was to support had demonstrated success. I should therefore make a couple of disclaimers before I reprise the script I used when speaking to BASDA last month.

First as an occasional journalist and regular blogger:

I first wrote for Computer Weekly in 1973, when part of my London Business School Master's project appeared as a ten part series on "Why Computer Systems Fail" (£15 per thousand words was good drinking money in those days). I have been an occasional contributor ever since. I have also written for others. I even had a column in Computing for some years. I started this blog in September 2007 when I was "convenor" (alias programme advisor) for the CW500. The aim was (and still is) to put political matters into IT context and IT matters into political context, mainly for the benefit of Heads of IT (whatever the current titIe of the poor sod who carries the can for delivering systems that work), for users (alias victims) and for investors (from finance directors to fund-managers).

Apart from occasional speaking engagements and advice on thought leadership opportunities I have not worked for a supplier since I left ICL in 1977. I then had five years outside IT as a corporaate planner for a UK-based multi-national before joining the NCC, originally to set up a technology assessment operation. When I left the NCC in 1986, I took with me the operation that I had joined the NCC to create: helping banks, fund managers and major users to appraise new technologies and the associated investment opportunities. That has entailed both avoiding vested interests and taking a cool look at innovations and market enthusiasms. 

Second as a volunteer, unpaid, politician:

In 1978 I was co-founder of the Conservative Computer Forum. About the same time, I volunteered as an ASTMS representative (I paid the political levy and remain a member of Unite) on the TUC studies for the Labour Party on the impact of new technology. Some of the studies on which I worked appeared in the policy papers of both sides in 1979: e.g. telecoms liberalisation and the micros in schools programme. Others did not: e.g. telecoms privatisation and IT Year. 

 In 1981 I was one of the co-founders of the all-party Parliamentary IT Committee (PITCOM). Shortly afterwards I stood down as chairman of the Conservative Computer Forum (after joining the National Computing Centre I was barred from appearing on party political platforms). In 1993 I agreed to organise the re-launch of EURIM. Until 2010 (when I stood down as Secretary General of EURIM) I devoted my energies to working on an all-party basis.

In 2010 I agreed to do a three year term as chairman of the Conservative Technology Forum with a remit to try get the younger generation to do as we had done in 1978-9: collating industry inputs into peer-reviewed recommendations for submission to those responsible for drafting party policy. I made clear that I still regarded most matters IT and tele-communications as cross-party rather than partisan and would continue to seek support for all-party, pan industry studies where practical.

I stood down as chairman of the CTF on March 31st but remain Vice-chairman (Policy Studies). The list of topics for which CTF is currently seeking volunteers and submission is on their website . The nearest Labour equivalents are probably Labour Digital   and the Digital Government programme although Labour has also announced studies into Digital Skills and on the Digital Creative Industries. When speaking to industry audiences, including via this blog, I strongly encourage listeners and readers to be active via the party of their choice - because the silent majority gets what is deserves - ignored.
        
Now to the meat of this blog: the script I used when speaking to BASDA on why action on inter-operability standards is as important as action on public sector skills if we really do wish to change the behaviour of government and its suppliers towards using IT to serve the community. This is relevant to the issues raised by Bryan because without such action, we risk perpetuating practices condemned as unfit for purpose by the National Audit Office, the Public Accounts Committee and the Public Administration Select Committee     


I apologise for sloppy blogging: I should have said oligopoly not cartel yesterday

| No Comments | No TrackBacks
| More
Chris Keeler correctly pulled me up for using the work "Cartel" yesterday when I should have said "oligopoly". Do read his comment and my response.

This was very sloppy, especially since I had myself made the distinction when the accusations first emerged some years ago with the Public Administration Select Committee report which triggered the OFT investigation

Does Labour really plan to scrap incremental change and return to "delayed big bang" for government IT projects?

| 2 Comments | No TrackBacks
| More
No wonder the cartel who brought us the NHS National Plan for IT, the re-creation of the BT communications monopoly, overpriced and inefficient PFIs and all those other massively expensive, wasteful and under-performing central government "delayed big bang projects" are cosying up to those planning the Labour Party Digital Government strategy. Just read the Labour plans to scrap the incremental change programme that Ian Duncan Smith has finally succeeded in imposing on DWP and its suppliers.

I have blogged on this theme many times before , linking what was happening with the DWP programme, despite clear ministerial instructions on the need to follow an incremental path in line with good professional practice for major change programmes. Now it is apparent that at least part of Labour Party is still in thrall to those who advised them on IT policy during the run up to 1997 election.

I liked many of the questions being asked in some of the calls for evidence for the Digital Government consultations organised by Chi Onwurah: albeit I thought they focussed on the tactical rather than the strategic. Now we can begin to understand that focus.  Whatever recommendations come out of the studies, the cartel who have run UK public sector ICT for the past twenty years still expect to be able to recoup their recent losses after a Labour victory.

Those who wish to prove them wrong need to submit robust inputs to the Labour and LibDem policy studies, not just those of the Conservatives.

The divisions are not along party lines. There are similar divisions in all parties, between those technophiles who believe that this time we have learned from the past and that better planned BIG projects using BIG data will do it better, faster, using the latest cloud technology and those who believe that the problems are to do with BIG organisations (including BIG suppliers and BIG consultancies) planning BIG projects which cannot be delivered before the requirements and organisational structures, let alone the technologies, have changed.

The time has come to follow good practice. By all means think ambitious and integrated vision and architectures. But then think frameworks for co-operation across silo boundaries, focus on inter-operability standards at all levels and rebuild public sector delivery skills around incremental change projects which help build and reinforce those frameworks.

In this context I welcome the long overdue re-orientation of DWP around pilot pathways to identify and test the people processes before investing in technology. "Merely" employing an army of expensive consultant to look at theory is no substitute.

Meanwhile if we want a review of a progamme that is in trouble let us take a good look at "Civil Service Learning" - arguable the most important programme of them all, assuming we wnat to rebuild the skills of central government as an intelligent customer. The core quesitons do not relate to costs but to the number of officials, receiving which training to which standards over the past year.            








The feedback to my blog last week , on the review of the new cyberskills frameworks, revealed some interesting divisions of opinion with regard to training programmes in general. One of the most interesting was that between those with existing in-house programmes for mainstream skills and those without: with the former looking at how to extend these to include security skills (see section 4. in my previous blog) and the latter recounting problems with unmotivated trainees. 

What comes through is the importance of learning from the experience of those who have been successful in using well-planned internship programmes, "try before you buy", to reduce the risk- as well as from those whose attempts were less successful.

I am an enthusiast for such programmes. I used work experience trainees to turn round the NCC Microsystems Centre: the flagship awareness programme of the early 1980s. It had been created in the middle of a growing skills crisis with no attention to a sustainable business model. It was haemorrhaging staff because it paid according to national wage scales in the middle of London. The trainees enabled us to turn crass awareness programmes into cash flows that, in turn, enabled us to hire them. But I was only to do so with the committed support of the remaining consultants and operations staff - who enjoyed both the feel good factor of teaching and the ability to bring fresh minds to bear on the problems that were emerging in the "real" world before the academics had theorised them out of context.

The e-Skills cyber security internship program builds on the experience gained during last year's  IAAC pilot , involving 100 applicants, 50 Universities and 50 companies.  If you are serious about growing your own skills base before you are overwhelmed by the growing tsunami of threats  then you should get in touch before the programme is over-subscribed and while the boundaries are still flexible.

But you should also take a look at the past experience with cyber security internship programmes on which it builds.

The conclusions drawn by Mike St John Green in his report on the IAAC pilot are tentative - but it is only 22 pages and I recommend reding them all. You will find also other patterns that tally with the experience of other industries over many decades.

My own experience with studies into IT skills shortages and solutions dates back to the aftermath of decimalisation. My MSc project at the London Business School (MSc06 1971 - 3) was on the link between failed computer systems and the lack of skills to understand the business requirement and what was practical with the resources available: time and people being more important than budget and technology available. For that project I looked not only at the studies that led to the original formation of the National Computing Centres but had free run of the files of the British Institute of Management to do an analysis of the success and failure of training courses and programmes over the 1960s and 70s.

There are a few key messages for employers planning to use internship programmes to take the risk out of recruiting trainees:

1)    The staff, who are to work alongside interns and work experience trainees, must not only be supportive but have clear "rules of engagement", including how to provide confidential positive (as well as negative) feedback to both those supervising the training programme and their own line management.

When I had responsibility for the NCC Microsystems Centre in the early 1980s, (using work experience trainees to run the reception desk and demonstration facilities, act as helpers on hands-on training courses and provide practical help to SMEs), the attitudes of my line staff were central to giving the trainees the early responsibility that enabled them to blossom. [alumni of the centre can comment, including on the "in-house pun" that I only spotted after drafting, direct to me via Facebook].

I knew I would get rapid feedback on how they were performing - and things never got as far as me having to give a formal warming, as opposed to public praise for the job subsequently well done. One  individual, who subsequently ran major programmes in the Middle East, never knew how close he came to "the bums rush" - or perhaps he did and my staff did not tell me.  Also we gave everyone basic sales training, beginning with group viewings of the early John Cleese videos. This did wonders for attitude issues.

2)    Internships are more likely to be successful when you are recruiting from an organisation (school, college, university, welfare to work programme etc.) with whom you have a relationship and who will try to match the student with the placement.

We took our work placement students from a provider on the equivalent of today's "welfare to work" programmes. Most came from the "Threshold" programme (two placements as part of a double sandwich course). Apart from a couple who dropped out inside the first week, all repaid the time we spent on them and had got permanent jobs, half of them with us, before the end of the course. Given that we were in the centre of London paying Manchester salaries, I could not have run the operation without them.

3)    Within four weeks you should know whether an internship will work (on both sides).  Your staff will have worked out not only how to handle any attitude issues (those running the scheme should have given you advance warning and said why they thought the individual worth the effort) but how to turn these to advantage.  However it will take at least 6 - 12 weeks before you begin to cover the effort put in by you and your staff.

In the Microsystems Centre the first placement (of the double sandwich we commonly used) was genuinely pro-bono. We used the interview and first couple of days to make it easy for those who did not like what they saw to drop out before we wasted our time and theirs. As Mike St John Green mentions in this report, some of the best do not inteview well so we relied more on the references from the placement agency and their behaviour in the period we had them immediately before and after the "formal" interview. We then hoped to motivate them for the second half of their course, to keep in touch and to get them back for their second placement. It usually worked and they were earning their keep within a couple of weeks of starting the second placement.  
 
4)     If you pay peanuts, you get monkeys. Unless the interns are on a course that pays their expenses you should pay minimum wage (or London living wage) and provide assistance with accommodation if they do not live within easy travel distance. As soon as you have decided you want to keep them you should consider putting them onto a formal apprenticeship agreement. 

We were not permitted to pay our work experience trainees (they were on a government funded programme which included a modest payment) but when we assigned them to work for SMEs (who paid us only for the supervising consultant) we made clear that we expected the client to "show their appreciation" for a job well done: (£hundreds of pounds of credit at a book, record or wine shop was not unusual in return for installing a micro-computer based stock control, ordering and invoicing package, including file loading and staff training). 

I retained the trainees who was able to subsequently hire, despite being unable to pay them more than provincial wages, by giving them accelerated responsibility. But the financial pressures on youngsters today are such that I doubt I could justify the cost of external training without a contractual agreement akin to that which I agreed with ICL when they sponsored me on the London Business School Masters Programme (1971 - 3). That contract was very similar to that in Strathclyde v. Neal, the test case that is the basis for most current contracts.     
 
5)     There is no well-structured market for internships. Most current programmes are built around a summer "season" - befiore and after the exam results, competing for school-leavers who failed to get the University place and graduates not already picked up via the mainstream HR milk round. To get the pick of the crop you need to plan ahead, getting HR to include Information Security in the packages they promote to their chosen schools and Universities and/or to join in one of the tailored programmes, like those run by e-Skills.

You should, however, also look at alternative sources, including those who made poor choices and dropped out or graduated from the wrong course or University or who graduated during the recession and are coming off stop-gap post graduate courses or are seeking better than is being offered by their welfare to work programme.

One of the best of the alternative sources is women returners, taking a particular look for those seeking to return to work after caring for elderly relatives if you want them to be available to work unsocial hours.  This market is weven less well sructured. It is worth beginning by looking at those who have left your own organisation, including user managers and supervisors.  You should also look at co-operation with others so as to get economies of scale in promoting the opportunities you collectively offers.

6)    Many current government supported skills programmes, particularly those for cyber security are  built round those who qualify for public sector security clearance. If your aim is to acquire staff to handle global security in a post Snowden you want those who will be equally trusted by clients in Brazil, India, China and Russia and have the necessary languages. That gives you far more flexibility because UK citizenship is not a pre-requisite.
There is therefore a strong incentive to participate in the main cyber security programmes with a view to trawling those who will never qualify for "eyes only" security clearance.   

7)    I could go on but instead I would urge you to contact those running the e-Skills internship programmes and also consider using linked programmes like the Cyber Security Challenge, the Computer Clubs  for Girls and Cyber Champions if you wish to trawl for a wider choice.

For those who would like to get their HR team in on the ground floor of a more ambitious operation, and ensure that it also covers cyber security and not just digital skills, then I also suggest you get them to take a look at the plans for the "Good Careers Guide"
I recently agreed to help e-Skills engage financial services employers in reviewing their cyber security skills programmes, not just to find the gaps but also those willing to help fill them. So far I have found some good news and some bad news. The good news was that those concerned with recruiting information security staff thought the current frameworks (see the City and Guilds Documentation for Level 3 and Level 4 Apprentices plus the appendix mapping these onto existing industry qualifications for a detailed example of their practical implementation)  were a good checklist. The bad news was that almost all employers are looking for experienced staff, not trainees - and few have the skills in-house to organise a training programme. There is, however, serious interest in using the frameworks on a modular basis to upgrade the skills of those in post and to cross-train users who understand the business.   

I am now on the second phase of my study: circulating a draft report for feedback with the aim of identifying those interested in using early participation in the follow up to gain competitive advantage by developing and retaining the skills they need to protect themselves and their customers against fraud and abuse.

I am happy to send copies of that report to those with responsibility in their organisation managing and controling risk, reducing vulnerability and combating abuse. I am even happier to supply copies to those with responsibility for recruiting, developing and retaining the skills necessary. You can e-mail me for a copy and/or e-mail e-skills directly for an invitation to participate. Please include your name, job title, responsibilities, organisation and the areas and skills of most interest. If you can put the latter in order of priority that would be most helpful.

In the mean time readers may be interested in the headlines from my draft report. Some are obvious, in retrospect. Others may well be controversial, particularly for those who put their own agendas above that of preserving the reputation of the City of London as the premier, globally trusted, international, on-line trading hub.     

1.     The UK Financial Services Industry is Internationally focussed not UK-Centric

Financial services career paths are increasingly global. Major players are concerned to meet overseas, particularly US, regulatory standards, not just those of the UK. The US is not, however, the only, or even the most important, trading partner and global customers (e.g. sovereign wealth funds) expect their activities to protected against all-comers (including "our" security, surveillance, and cyberwarfare operations as well as "theirs"). This gives the opportunity to take a lead in setting global professional and security standards. It also, however, means that UK-centric requirements and co-operation arrangements are of limited interest.

2.     Cyber is a turn-off and information Security is boring. The drivers are a mix of fraud prevention, resilience, customer confidence and compliance

Few directors are interested in "information security" and "cyber" is a turn-off. Boards are, however, concerned about the consequences of insecurity:  impersonation, fraud, industrial espionage, sabotage, extortion and other forms of abuse and predatory behaviour. The skills sought come under a variety of headings: from compliance through intelligence, investigation and risk to security.

Commitment to action on skills, other than to fill known vacancies, appears unlikely without support from Board members who are seriously concerned to ensure compliance with regulatory requirements, maintain customer confidence, handle the transition to secure mobile transactions (already over 50% and accelerating) and improve the corporate ability to respond rapidly and effectively to major incidents.

That is because policy and budgets for recruitment and training are rarely controlled by members of the professional bodies currently engaged with the cyber security or information assurance agendas.  

3.     Understanding of the business is essential for those roles which cannot be "co-sourced". Most require skills mixes which cut across professional boundaries.

The days of "in-house" or "outsourced" are gone but attitudes are still different according to whether functions are handled in-house or "co-sourced" using shared service operations (e.g. to handle fraud reporting and investigation cross an industry sector) and trusted partners (e.g. retainers with audit practices and others to help with major incidents). 

Risk management and security roles in financial services require understanding of the business (objectives, constraints, priorities and vulnerabilities) and cut across people and technology processes as well as across electronic and physical security.  Few are purely "cyber" and many of these are more concerned with fraud prevention and resilience rather than information security.

Information Security is subordinate to those with responsibility for "Risk", "Fraud" and "Compliance", except where it is directly involved with the design, acceptance testing, operation and monitoring of people and technology processes and supporting systems. Many of those with cross-cutting roles have come in from other disciplines and need cross-training in information security.

Financial services employers therefore wish to mix and match modules from a variety of disciplines to update and broaden the skills of those who they already in place more than they wish to use these to develop the skills of new recruits. In consequence success entails co-operation with the Financial and Legal Skills Partnership , Skills for Justice , The Security Institute  and others.

4.     It is easier to get support for Continuous Professional Development and update programmes but widespread use of outsourcing presents serious complications with regard to delivery.

Outsourcing and co-sourcing mean that even large organisations often have in-house security teams that are too small for customised skills development programmes. More-over many security professionals are self-employed, individually accredited and/or responsible for their own training. Most employers are currently focussed on external recruitment to fill those in-house roles which cannot be filled by training users with security skills more easily than by educating outsiders to understand the business.

It is therefore easier to get interest in, but not necessarily commitment to, support for frameworks for "continuous professional development". Those with graduate intake and apprenticeship programmes for accountants, bankers and lawyers might be persuaded to extend these to include information security skills. However, given the limited number of employers able to organise in-house apprenticeship or CPD programmes, a better way forward might be to get recruitment agencies, HR consultancies, colleges and universities, to look at the economics of providing this as a service to local employers and/or alumni.

5.     There are significant issues to do with updating and marketing

The content needed in the modules will evolve over time in line with changing threats, technologies, opportunities and market structures. Generic structures which seek to avoid obsolescence by avoiding reference to particular technologies are, however, difficult for employers to relate to. They are concerned with developing the skills to address current problems - not looking into the fog of future needs.    

6.     A variety of marketing fronts and delivery channels will be needed to promote and present the content in forms to which the target audiences of employers and employees will relate.

.....

7.     The skills gaps identified to date:

Within most of the gaps identified there is a need for modules at all levels from process specification and system design, through operations, to end-user training, plus end-over-end performance monitoring. The frameworks and materials necessary to fill several of the gaps have potential global markets.

Some of the gaps below are addressed by the Financial and Legal Skills Partnership (FLSP), albeit with specifications focussed on the people processes to meet accounting, legal and regulatory requirements. Others are similarly addressed by Skills for Justice and the Security Institute.

The mechanisms for co-operation in ensuring the delivery of "joined up" material, covering both technology and people processes, when, where and how employers require are unclear.

7.1  Putting risks into business context and justifying spend

 

This requires an understanding of the business, an ability to quantify and balance the risks it faces (including of losing business because of intrusive or slow security processes) and turn problems into opportunities. The skills are not specific to information security but do require an understanding. It may be worth exploring use of the COBIT framework for linking security to business objectives.

 

7.2  Mobile: including identity, authorisation, data access, transactions and privacy

 

Most current programmes were planned before the transition to mobile gathered pace. Mobiles now account for over half of all financial services transactions and there are skills gaps at every level from system and application design, through the use of trusted computing technologies (including to identify the device and location being used and, with less certainly, the individual using the device), to educating end-users in personal security and safety using their own or corporately issued devices.    

 

7.3   Investigation: inc. forensics and the collection/preservation of evidence & co-operation with law enforcement

 

This is best organised in co-operation with the programmes planned by the National Crime Agency, City and Metropolitan Police, Crown Prosecution Service and others. The reasons are partly to ensure common standards and partly because training together is a good way of building the trust that is essential for co-operation. The programmes also needs to cover international processes because few major incidents are purely intra-UK. This area would benefit from close co-operation with Skills for Justice and those organising similar programmes to serve other parts of the globe, including, but confined to, the EU and US.

 

7.4   Asset Recovery: inc. local co-operation with overseas law enforcement and others

 

Financial services organisations are usually more concerned with asset recovery under civil law, rather than the cost and uncertainty of securing action under criminal law. The techniques available and disciplines involved overlap with 7.3 above and 7.5 and 7.6 below but are by no means identical.   

 

7.5   Governance/compliance: including Anti-money laundering, know your customer, suspicious activity reporting, customer protection, data retention/protection etc.

 

Financial services have a great many governance and compliance requirements which require technology support or the vetting of those who provide technology support. These include "know your customer",  anti-money laundering, suspicious activity reporting, data retention as well as protection, bring your own device policies, red flag behaviours, zero tolerance, bribery, corruption and customer protection. FLSP has modules covering many of these from a legal perspective. The technology perspective also needs to be covered.

 

7.6   Intelligence led Security: direction, collection, analysis, reporting

 

Direction and reporting require understanding of the organisation's objectives, priorities and culture (including to make reports on risks and threats meaningful to those running the business). Collection (logging, reporting, open source etc.) and Analysis (from historic log analysis to the real time use of big data tools) can be outsourced but the skills are in short supply (see 7.10).

 

 

7.7   Identity Management: including individuals, organisations and trusted devices

 

A prime need is for the skills to make effective use of the many ID systems and methodologies in current use and to enable the organisation to work with suppliers and customers using different approaches.  A particular problem is to bridge the different approaches of public and private sector. There is also the need to manage corporate identities, including on-line and along supply chains.  

 

7.8   Access Control: who has access to what, under what circumstances, inc. age verification

 

This is much wider than Data Protection but similarly links to identity management and authorisation. It may benefit from being organised in co-operation with other regulated industries (e.g. Credit Reference, On-Line Gambling and Adult Content) where reputations for security and privacy are core.

 

7.9   Authorisation Processes: inc. PCI-DSS and those of major suppliers/customers inc HMG

 

These should include both the evolving authorisation processes of the card and payment clearing industries and those of HMRC (including for  Real Time Information from employers), DWP (for inter-actions with employers and Local Government), Cabinet Office and others for those who have dealings with the public sector. This area may benefit from being organised in co-operation with Local Government, HMRC and DWP, all of whom have large numbers of staff to be trained at all levels from overall process and system design to end-user routines and guidance on handling exceptions.    

 

7.10        End User Skills and Processes: including access control and authorisation

 

Many large organisations run programmes to train all staff (i.e. not just those in call centres or on help desks) in basic security (how to reduce the risk of falling victim to social engineering and what to do if you think you have), the control of access to systems and information (particularly personal information on staff or customers) and incident reporting. There is a case for working with those organising such programmes on a commercial basis and with the CPNI Homer team to produce generic frameworks which can be used by those organising such programmes and for certificating those covered (e.g. all our staff are certified to XYZ). 

 

7.11         Incident Response: damage limitation, through notification requirements to public relations:

 

This cuts across a great many disciplines from those involved with handling the immediate response and restoring service through those handling the consequences (including technical, regulatory, customer relations etc.) to those handling image and reputational issues.

 

7.12        Big Data: both for detection and for protection

 

The skills needs range from understanding and using the techniques to analyse traffic and logs for detection and investigation purposes, through real-time authentication based on pattern analysis and  the means of assessing the security of services provided by others, to protecting data retained for analytical purposes or because of regulatory and law enforcement requirements. These range in level from the ability to understand and use packaged services operated by others separately or in partnership (e.g. Trend and IBM with "Deep Discovery" and "QRadar") to those to develop and maintain such services on a customised basis.

 

7.13        Website Security, including and the handling of abuse and impersonation

 

Nominet has produced some useful material in this area but there is a need to also ensure sites meet legal and regulatory requirements (e.g. under the e-Commerce Directive), are secured against hacking and abuse and contain routines for reporting abuse or impersonation (and responding to such reports) which help enhance confidence. There is also a need to address the security issues and exploit the opportunities raised by the transition from IPV4 to IPV6.

 

7.14        Vetting and personal behaviour

 

Financial services organisation are concerned with the motivation and not just competence of staff. A number of professions (e.g. the Chartered Institute of Securities and Investment) have mandatory programmes to develop attitudes towards good practice. There are also regulatory and statutory requirements in several sectors. This cross relates to 7.10 and FLSP has specifications covering the recruitment, selection and retention of colleagues. The issues do, however, go further and there is a good for co-operation with both CPNI and the Chartered Institute of Personnel Development on shared modules covering processes for CV checking and behaviour monitoring (including over social media).     

 

7.15        Support for Small Firms, generic and those in the supply chains of large firms

 

This should include the skills to implement, advice and support the audits by IASME or CREST that are to be made mandatory for SMEs supplying Government net and well as any other requirements from Banks, Insurance Companies (including PCI-DSS etc.). There is also a need to look at support for micro-businesses (e.g. the FSB members who are too small for IASME. The skills in this area are likely to cut across all others at the "foundation" level.

 

7.16        Process Control: alias SCADA, Internet of Things, Ubiquitous computing

 

This was not part of the remit for this exercise but serious interest and potential volunteers to help address the issues were found.

 

8.             Current Action Plans

 

8.1  Follow up on contacts made with ...

8.2  Work with ... on surveys to obtain views on which skills are in short supply and the priorities of those interested in participating in joint action.  

8.3  Follow up on contacts made with ... to look at organizing activities to identify employers willing to work together on skills issues.

8.4  Follow up on discussions with recruitment agencies and others to explore business models for commercially attractive (to all sides) co-sourced CPD and apprenticeship programmes.

8.5  Identify security suppliers interested in helping specify material that will help current and potential customers make effective use of their products and services.

8.6  Identify training providers interested in participating in the programmes with a view to supporting apprentices, those following continuous professional development or cross training programmes or those wishing to simply fill skills gaps   

I look forward to receiving comments, particularly from those with responsibility for protecting their employer and its customers and in helping with the specification, organisation and delivery of materials, courses and qualifications to fill some of the gaps above. I would also be interested in comments on how best to reconcile the various intra-UK, intra-EU and intra-NATO agendas with those of truly global players.

I am of the personal opinion that co-operation in education and training in the best means of reconciliation - but I remember being trained in the same signal school as those who were to man the signals rooms of the destroyers we had sold to Shah of Iran. We were strictly segregated. I subsequently came to appreciate the reasons. That said, the risk management and security teams of global trading operations have long needed to organise co-operation against common (criminal) adversaries between those whose governments do not trust either other.  The development of cyber espionage and warfare merely adds a new dimension to the tensions between merchants and warlords that goes back to the dawn of civilisation.   

 

 

I am in the process of revising the interim report of my review of the new Cybersecurity apprenticeship and continuous professional development frameworks from the perspective of financial services employers. [see the P.S. at the end of this blog for more details]  

The first message, which came as no great surprise, was that there is no shortage of talent, only of employers willing to help unleash that talent.

The second message is that (outside the security suppliers and consultancies) few of those who control recruitment and training budgets are interested in "information security" and "cyber" is a boadroom turn-off, not a turn on.

Boards are, however, very concerned about the consequences of insecurity:  impersonation, fraud, industrial espionage, sabotage, extortion and other forms of abuse and predatory behaviour.


The skills being sought to help reduce the risk of these come under a variety of headings (from compliance through intelligence, investigation and risk to security). Few HR departments have the in-house ability to organise relevant programmes and most are uncertain where to get advice.  In consequence inaction is common - other than external recruitment to fill immediate vacancies as competition for experienced staff accelerates - and many organisations are like rabbits faced by lampers.  

The third message is that those (mainly suppliers, consultancies and audit practices) seeking to double or quadruple the size of their security operations (in order to help clients handle the tsunami of trouble ahead) know that they have not only to organise in-house apprenticeship, cross-training and update programmes but also to diversify their sources of recruitment - as competition for well-motivated graduates increases nearly as fast as that for those with a couple of years of practical experience at some-one else's expense.

Hence the importance of the first Cyber Security Challenge regional event to bring together potential recruits and employers looking for talent. This is being hosted by the Bucks New University (which has put security into the School of Management) in their sports hall in High Wycombe, near the heart of the Thames Valley, where the competition for talent is at its greatest.

The event is on Friday 4th July 10am - 5pm and is targeted at anyone with an interest in the sector - including school pupils in their final year or those that have just left, as well as students in further education, and those of all ages looking to move into a career in cyber security.

In addition to a careers fair supported by Challenge sponsors and regional businesses, the Challenge event on 4th July will also include:
 
    A Morning Session: Seminar for local SMEs wanting to discover more about the cyber security threats facing them and solutions to help protect their company. Participants to this free event will find information on related government initiatives, including advice and guidance on ways to safeguard their business.

    An Afternoon Session: Seminar for girls and women considering a Cyber Security role, from those already in the industry to share knowledge and experience, network and mentor.  Any individual or organisation interested in supporting the recruitment and retention of women in cyber security is encouraged to take part.

    All Day Drop In Session: Cyber Security Challenge UK - including a guide to what it takes to play and succeed in its yearlong mixtures of virtual competitions and face to face cyber real world scenarios.

For more information and to book your place either as an industry delegate or an exhibitor, please contact  Steph Aldridge
 
This is the public registration link, including for schools and students:

 P.S. I would still like to hear (by 20th June) from financial services employers interested in helping review the new skills frameworks and in commenting on any changes and extensions they would like to see in order to better meet their needs. You will find detail of what is currently being, including how one qualifications provider is putting flesh on the frameworks, in the City & Guilds handbooks for Level 3  and Level 4 and the technical content for Level 4, which maps the material against relevant industry materials and examinations, including for CISCO. Comptia, Linux, Microsoft, Oracle and VMware qualifications.

Some of the gaps identified in my interim report are already being addressed in the new definitions for Cyber Intrusion Analyst and Operator and for Software Tester . Some of the others, such as mobile security and small firms support, were covered (at least at the lower levels) at a recent meeting with on the City & Guilds Tech Bac.
 

There is no privacy in the global on-line village but do we really want Google to censor the gossip?

| No Comments | No TrackBacks
| More
The recent EU judgement against Google does not require "a total rethink of basic freedoms" as supposedly claimed by Professor Floridi. But it does raise profound issues. 

"There is no  privacy in a village" but every so often a local gossip might be ducked or burned as a witch after breaching too many confidences or causing too much mischief. There is no privacy in the on-line global village and Google has close to a monopoly over our access to gossip (alias information). Its rapid response to an overdue application of existing law is therefore most welcome. It is also more nuanced and practical than at first appears as I mentioned in my blog yesterday . Its response takes account of the fragmented muddle of EU law, where "harmonisation" based on carefully drafted ambiguities (which all can accept and interpret differently), reinforces de facto fragmentation.   

The language attributed to Professor Floridi is over the top but do we really want Google to be a pro-active censor? Or do we want it to "merely" obey the law and to be better able to stop relaying that which is libellous, inaccurate and/or private (such as our own postings on social media which some-one has claimed the right to turn into "the new oil" without our informed consent).

Google's "guilt" in the EU case was, however, rather narrower. It concerned its failure to act on a complaint that its search engine rankings "made available" reports of the original debt but not of its discharge. That may go to the heart of its current business model. It does not raise questions about "fundamental freedoms".

Professor Floridi does, however, raise other, more important issues. 

Do we really want Google to act alone in fixing the problem?

If so we risk turning it into the Judge Dredd of the on-line world.

Or do we want Google to help create an arms length regime that applies to all?

If so, who will work with it (given commercial rivalries and mistrust) and what will they create - giving the probable mis-trust of any US-centric solution and the state of debate on Internet Governance (however defined)?

Other industries faced by similar situations have used organisations like CEDR (the Centre for Effective Disputes Resolution to help them create independent disputes resolution services, national, regional and international, under a variety of legal regimes. CEDR was created in 1990 with the support of the CBI and the Law Lords. It is now Global with offices and services based in the Middle and Far East, where disputes may cut across legal and regulatory traditions, not "just" jurisdictions.

The time has surely come for the Internet Community to follow a similar path.

Might this judgement and the dilemma faced by Google provide the catalyst?

I happen to trust Google more than I do most European (as opposed to UK) Courts but would not be happy to see it as judge and jury over what should or should not be accessable via its services. I would, however, expect it to abide by the law, using an independent appeals process to defuse disputes. Its initial response to  the EU judgement therefore looks sensible and the speed of response shows that it had anticipated the need. What comes next is, however, much more significant.

The impossible suddenly becomes practical: Google to abide by EU law - but only for EU national sites

| No Comments | No TrackBacks
| More
The news of Google's "U" turn over the "Right to be Forgotten"  is most welcome. This is one Turkey that has not forgotten how to fly. It also reminds us that most of what we are told about the Internet is untrue . That which is possible or impossible depends more on the advice from the corporate lawyers of the dominant players than from the engineers who keep it running.

Hence the small print of the Google announcement - which can be seen as another step towards the Balkanisation of the Internet  The "right to be forgotten" will only apply to the national websites across the EU.   

I would prefer to see it, however, as a sign of the maturity and subtlety of Google's approach to the pressures it faces and the lack of progress towards a pan-European Single Market despite all the harmonisation (alias formally agreed amibiguities). We can already see the problems that will arise, beginning with applications in the UK to delete references to criminal convictions that are not time expired and have not been over-turned on appeal.

Perhaps I was wrong to say that I thought Google's shares were over-valued. It may already be planning its way into a break-up that will make its shareholders even richer - just as the main beneficiaries from the break up of Standard Oil included the Rockefeller family.  

P.S. There is another angle to the right to be forgotten. This morning finally I got fed up with sluggish response times from my browser so I deleted the "history" including the cookies. The improvement was dramatic. I have yet to see what I have lost by doing so - although I would have prefered a selective choice, instead of all or nothing.

P.P.S. 11.30 - Jim Prideaux , who wipes his electronic footprint as carefully as his other footprints and fingerprints, has just pointed out that Google requires a photo ID. This appears to mean that those without recent driving licences or passports cannot request to be forgotten. I leave others to follow this thread into ever more interesting places.






UKIP's On-line Policy: stuff the corporate and regulatory turkeys, listen to the users and stop wasting taxpayer's money.

| 2 Comments | No TrackBacks
| More
UKIP is often described by commentators as a party of inarticulate and angry protest for those ignored by the political establishment, who will come to their senses at the next general election. When I compared UKIP's local government results with pages 11 and 12 of  the slides which accomanied Lord Ashcroft's analysis of their performance in the local government elections last week I realised that this interpretation is both right and wrong.

The towns where they are most likely to get their first MPs include those hit hardest by the Common Market Fisheries policy: Grimsby, Yarmouth, Lowestoft. It is no accident that UKIP has a clearer and more articulate policy on fisheries than the mainstream parties. Fishermen are also more techno-savvy than most land-lubbers, having used a wide variety of local and global on-line communications technologies (alias radio), from Morse to Inmarsat, for over a century - to hunt, catch and land those fish for which there is currently a good price. They have also seen their industry destroyed by collusion between Westminster and Brussels.

But that is not what is most likely to drive UKIPs technology policy. The UKIP demographic  (C1, C2 and D, including most small businessmen and self employed) is also the Sky Demographic - which BT has just invaded in an attempt to get sports content traffic to drive th e take-up of BT Infinity, where it is available. It is no coincidence that UKIP also tends to be strong in areas where BT Infinity is not available and crapband (both urban and inner city) has a tendency to freeze and collapse when popular events are at their most exciting.

Shortly after Tim Aker (formerly with the Taxpayers Alliance) became Head of Policy and Patrick O'Flynn (chief political commentator of the Daily Express) became Head of Communications, a cogent article  on the use of alternative broadband technologies to support rural lifestyles was repeated in UKIP Daily . Meanwhile, on the other side of London, Diane James,  is a veteran of the Ewhurst broadband saga  and her colleague, Ray Finch, worked for one of the Cable TV companies for 20 years, supposedly entering politics because his wife wanted him to bore others with his enthusiasm.

But it is not just the predatory behaviour of BT that has angered those who just elected to the European Parliament. For example, Janice Atkinson  is "involved in a business called www.gotradelive.com which is similar to Amazon and eBay, but has a reverse auction and cataloguing facility and is free. Unlike Amazon and eBay, we pay our UK taxes, employ UK nationals and campaign against corporatism and to return to good old-fashioned capitalism."

Will UKIP become the home for the competitors to Amazon, eBay, Google and also to those who do not believe that our personal information is their oil - to do with as they wish? If so, my recent blog on what happens when young Turks become old gobblers is apposite. UKIP has a big constituency of consumer anger and frustration with the patronising attitudes of Big Data enthusiasts and Internet industry lobbyists on which it could draw. 

It has also demonstrated that it fully understands how to use social media and to mix on-line and off-line advertising to good effect.

When it comes to regulatory issues the UKIP team is likely to also include Margot Parker (one-time head of the European Promotional Products Association), Steven Woolfe (a former general counsel for hedge funds and more recently legal and regulatory consultant to Financial Institutions) and Amjad Bashir, their small firms spokesman.  We might therefore make a reasonable guess that UKIP MEPs are likely to favour genuinely open and competitive, but probably unsubsidised, broadband for business plus rigorous action against predatory behaviour by dominant players in on-line markets.

How that support will be expressed and turned into action is, however, less clear.  

The Personal Declaration by Gerard Batten, likely to once again be their chief whip, is that he will not vote in favour of any legislation that does not undermine the European Union or facilitate UK withdrawal - because that would be to admit the legitimacy of the European Parliament.

He says that he will therefore abstain, rather than support that which is in Britain's interests.

It should, however, be noted that Gerard was a salesman for BT for 28 years and protecting incumbents (old or new) from change is not what the rest of UKIP appears to be about.

What happens when UKIP and its new anti-statist, anti-corporatist, pro-capitalist and pro-choice allies across the rest of the EU meet will therefore be interesting.

Will they join forces against the massed ranks of the Brussels Lobbyists and bring a chilling whiff of democracy into the hot house?

Or will they allow themselves to be picked off, venting their spleen but achieving nothing, not even UK withdrawal, because only the Conservatives have promised a referendum on membership?

At this point I should declare my own position - I would much prefer to see reform to withdrawal - but if the current introverted, protectionist, bureaucratic, kleptocracy cannot be adequately reformed I will vote, however reluctantly, for "Brexit". Having spent over thirty years trying to help bring about reform I will be very sad if I have to admit that UKIP was right. In the mean time I would love to see co-operation in Brussels, if not necessarily in the UK, to bring about change - because the EU in its current form does not deserve to survive.       

I look forward to blogging again on this topic during the run up to the party conference season.

P.S. I have received a comment from "geo-investigator" (loath to go through the hassle of registering in order to comment himself) as follows:

"With regard to your penultimate sentence in the blog article, it may be of interest that the European Ombudsman, Emily O'Reilly, has said she will launch a (non-binding) investigation into the composition and transparency of the European Commission's many expert groups that advise on  policy and legislation. O'Reilly has stated that "it is of utmost importance for these groups to be balanced and to work as transparently as possible so that the public can trust and scrutinise their work." For example, it seems that ~80% of the expert groups linked to the commission's tax department, DG taxation and customs union, represent corporate interest, while 62% of members of groups tied to DG enterprise were from the business community. There are apparently no common rules on the selection of experts, and no means for the EU's other institutions to scrutinise the work of the groups.

The investigation could provide an impetus to the new intake of MEPs to ensure that transparency, wide-ranging consultation and accountability are written in to the selection process of experts, so that the public interest is not subordinated to corporate interests when key decisions on policy and legislation are made. But the question has to be asked - why is this not the case now?

Experts differ, and can be selected to line up on one side of an issue against another, perhaps to be decided by an 'independent' arbitrator. The problem may link uncomfortably to
the secret negotiations taking place around TTIP and the fact that many see this as a major threat to democracy, not least because of the proposal to subject ISDS cases to secretive offshore arbitration panels that bypass domestic courts and override the will of parliaments. The ability of companies to sue nation states, under a specially-created parallel legal system, is completely new for any trade agreement between states that have well-developed legal systems.

Geo-investigator is very well informed on the topics that he covers and last night I attended a briefing organised by the European Movement and the Konrad Adenauer Stiftung on the "meaning" of what is happening (and why). It emerged that opposition to TTIP may be one of the few items on which the UKIP. the Front Nationale and the other "protest" parties (of left and right) are likely to find common cause, other than on the ending of untramelled "freedom of movement.

His comments on the need to reform the selection of "experts" are also interesting.  Their pay and status, compared to their earning potential if they are genuinely expert, is one problem. The routines for appointment are another.  


 
We have a rash of publicity claiming that the latest FCC position on Net Neutrality will destroy the Internet as we know it. From the US Library Lobby to the Startrek Lobby there are a wide variety of views but the success of Netflix challenges the cartels which control our access to the Internet (from Telcos and Cable Companies through Operating Systems and Browsers to Search Engines and Content). It undermines their business models - including the illusion that take-overs and mergers (the latest is AT&T and DirectTV) to create vertical integration (triple and quaduple play) will return better value to shareholders - let alone better service and choice for customers. At the recent INCA conference we heard from the head of BBC Digital that Netflix already generates significantly more UK Internet traffic than the BBC iPlayer - and both are in their infancy. Meanwhile the markets have stopped growing. Players appear to be competing for share of a finite consumer and business "budget" (alias willingness to pay from static or falling disposable incomes) for communications and content

The current tangled web of crapband (cheap, slow, overloaded, copper circuits), fibre to the cabinet, urban wifi and national 3G networks is groaning with overload while consumers expect the levels of service claimed in the adverts. Of course we need to better address the way that conflicts betwen recommended security products and the tracking software used by ISPs, advertisers and others can result in users experiencing more sluggish performance over faster lines. But, even so, the case for fibre to femto (whether on a mast or in a domestic router) would be overwhelming - if those who put up the funding reaped the reward.

Instead we have a "net neutrality" debate, with varying definitions of "net" and "neutrality" as current and would-be monopolists try to eat each others lunch: telcos call for cheap content,  content providers want cheap carriage, advertising funded players want both and those with more money than sense pay fancy prices to take each other over, vertically integrate and cross subsidise [thus deluding themselves as well as regulators and others as to what is actually profitable while they try to lock in their customers]. 

In the US the FCC is considering striking down laws in the 20 or so States that block local municipalities from building fibre networks to challenge the local crapband monopolies of cable operators who are charging Netflix a premium as part of a locally regulated, ever upwards, price spirals. The FCC can see that model of the Chattanooga Fibre Choo Choo (funded by the electricity company as part of a local smart metre and grid programme) is steaming off into the distance as an engine of local economic regeneration.

Meanwhile in the UK, George Soros is backing Hyperoptic and Sky and Talk Talk have linked up with City Fibre to explore a variety of "risk free" roll-out models, underpinned by demand from the residents of up-market apartment blocks, the tenants of business parks and commercial centres and the operators of 4G networks. Other business models include that used by Hammersmith and Fulham to grasp the opportunity to cut the cost of service delivery at the same time as meeting economic dvelopment and job creation objectives at little or no up-front cost. And the approach to rural broadband is about to be transformed in the area serving the Prime Minister's constituency.    

Meanwhile the EU Court has mounted a long overdue challenge to those who believe they have a "right" to collect and collate our personal data, including our browsing and viewing habits, and refine it into the new oil of information, without obtaining our informed consent, let alone paying us a royalty. I like to think that the tools now being promoted to supposedly foil the surveillance operations of GCHQ and the NSA will find their true use in protecting our privacy from the customers of the Reform Government Surveillance alliance. That may, of course, already be their true target market, but those offering privacy enhancing services appear more scared of being moved down the search engine rankings of the monopolists than of being blacklisted by the NSA.  Meanwhile the energy companies are supposedly creeping into the same market as are the suppliers of a growing range of consumer devices and those hacking into their communications , siphoning off some very personal data (alias "oil") before it is refined.

Christmas is coming and yesterdays young Turks, today's Turkeys (alias incumbent monopolists) may be about to get stuffed as markets and customer choices and priorities change and voters turn against attempts by governments and regulators to protect the present, let alone the past, against the future. That is why the Internet giants of today are the biggest spenders on lobbying in Washington, Brussels and Westminster - fearful of what would happen if users (alias voters) really were permitted an informed choice. 

Those who think that the time has come to do to Google what was done to Standard Oil, should remember that the greatest single beneficiary of that break up was the Rockefeller family. The surge of growth that followed meant the value of their shareholdings in the newly liberated companies soared. The future, like the past, is another place. Many of the  Googlettes might well similarly thrive once freed from the suspicion of being part of a monopolist that uses search engine rankings to enable its acolytes to invade the markets of others.  

Last week I spoke to a BASDA event on why healthy, open and competitive markets are critically dependent on inter-operability standards at all levels and between all levels.  Later this week I hope to make time to reformat that script as a blog entry. 

Why an all girls team is likely to win the cybersecurity challenge - if any enter.

| No Comments | No TrackBacks
| More
The press cover for the first of the 2014 Cybersecurity Challenge competitions in Wired and the BBC illustrates the problem of attracting women into security related careers - even though we now know that women were not only 70% of the overall workforce at Bletchley Park, but provided several of the elite codebreakers and ran much of the operation with not a fit man of military age in sight (save for a few math prodigies, engineers from Dollis Hill and  BTM and the officers who handled liaison with the Military).

The women programmed and operated the Bombes and Collossi and ran the Registry: alias the Sigint processing operation that was central to the success of the entire operation. [Then, as now, the signal headers and routing information, alias "communications data", alias "meta data" was often more important than the message content].

That is not, however, one of the "messages" that GCHQ, NSA (or Google) wish us to understand - let alone appreciate because of the consequences if we were to fully understood the implications for our personal privacy and security in a world where everyone is tracking what we do on-line and claiming the right to refine the new "oil" for sale to ...

No wonder those creating the myths for the actors in the theme park have no wish to have visitors listening to elderly volunteers who remember the reality, including the transition to the Cold War. Hence the importance of the schools programme run by the museum.  
      
There is a splendid (albeit sometimes using terminology that is annoying for someone as politically incorrect as myself) paper on the gender biases at Bletchley . These reflected those of the armed forces at the time and led to a complaint that the women were treated as girls - not equals.

But many, indeed most, were "girls":

Rosalind Hudson , the youngest of the 13 cryptanalysts in Hut 8 was only 15.

Few were over 25. 

Mavis Batey (said by some to be more gifted than Turing) was only 19 when she and Margaret Rock broke the Italian Enigma system in time for a surprise Italian fleet attack on a troop convoy to be turned into the Royal Navy's last "fleet action", the Battle of Matapan.

Dilly Knox's comment, when fighting in vain for Margaret Rock (who was older) to be placed in the right pay grade, because she was "quite as useful as some of the professors", should be seen as a direct comparison with Alan Turing, whose nickname was "Prof".

The team of Batey and Rock went on to break the four wheel Abwehr (German Secret Service) Enigma Code and enable the system to be reverse engineered in time for the Double Cross System, central to the success of the Sicily and Normany Invasions. Meanwhile Turing's intellectual peer, fiancee (but not for long) and successor in running Hut 8 (albeit with a man nominally in charge to handle the military interface), Joan Clark , was similarly airbrushed out of history - perhaps because she was still working for GCHQ when FW Winterbotham broke the secret of Enigma in a book which misled readers as much as it informed them.

Perhaps that airbrushing was thorough because of the "girls" who went on to have careers at the heart of Cold War espionage (albeit the talents of many others were sadly neglected).

Dilly Knox's "Epitaph on Matapan to Mussolini":

"These have knelled your ruin, but your ears were far away
 English Lassies rustling papers through the sodden Bletchley day"

appears to have remained classified until after the last of the Bletchley "girls" had retired from GCHQ. And some of what they did, while rustling those papers, has still not been released.

So how do we attract the Hudsons, Batey's, Rocks and Clarks of today?

- bearing in mind that one of the most subtle practitioners on the "Dark Market" is said to be a woman, not just a man masquerading as one. I assume the reason we know she really is a "she" is that she is among those on the staff of GCHQ and the NSA who increasingly frequent the various forums - as they begin to pay more attention to protecting us, not "just" the state.

That leads me to the quote from Stephanie Daman, CEO of the challenge and previously Head of Group Information Risk for HSBC  which concludes the BBC article on the challenge:

"Do we really think GCHQ operations affect us on a daily basis? I would say it's the banking system, or the ability not to do your Waitrose shop. At another level it's the ability to have electricity in your house.

Cybersecurity underpins so many things - GCHQ is just a small piece of a much bigger puzzle. I can understand why it might be troubling for some people, but I think the focus on GCHQ misses the much broader picture."

One of the things I learned from the first Women into IT Campaign [1988 - 92 and we raised the intake from barely 10% to over 30% only to see it fall back again afterwards as the lessons were ignored] was "Vive La Difference". On average women are very bit as good as men at most of the functions in IT (markedly better at some) - but tend to have a different approaches to problems. One of those is a desire to understand the context and the objectives, as opposed to "playing with technology for its own sake". That is why I would expect teams of girls to be rather better at identifying what motivates the Flag Day Associates and who they are, not just how they operate and how to protect against them.  

The issue is to get the girls to understand not only why they are likely to succeed and to enjoy themselves but also the range and variety of constructive careers to which success will open the door. And that depends on employers who want to be able to assess the best of the talent coming out of out schools and colleges understanding how and why they should support the Cybersecurity Challenge - including this competition and those being organised to get the youngsters of today to look at the careers of the future and how to attract their peers.

I will blog on the latter later. This is enough for now.  
   

A suitable job for a woman: fund raising exercise for Bletchley TNMOC educational programmes

| No Comments | No TrackBacks
| More
I have blogged before on the unfortunate separation of the National Museum of Computing (home of Colossus and the related computing and cybersecurity education programmes) from the new Bletchley Theme Park . I have also commented on the way Bletchley showed how eminently suitable women are for many of the key roles in information security and cyberwarfare : unlike the Snowden's or Winterbotham's of this world, who put public recognition before confidentiality.

I recently demonstrated my luddite credentials by paying the postage for a mailshot in support of a fundraising exercise in support of some of the museum's educational programmes. Part of my reasoning was to test the hypothesis that letters reamin the best means of getting through to those suffering from electronic overload. I should perhaps add that I recently came across one organisation that has reverted to hand written envelopes with postage stamps when it wants to get attention. What I did not appreciate when I made the contribution was that it would be matched by funds from a £million donor.

The main objectives of the appeal which I supported were to fund:

• dynamic learning materials and activities to promote a better understanding of the use of ciphers in
modern life, cyber crime prevention and the education and career opportunities in this sector

 

• ways to encourage girls to explore the subject of computing by better presentation of artefacts and activities

 

• pre- and post-visit learning materials so that students get the most from their visit -- these are intended to include audio and video material of the artefacts, applications and interviews with computer professionals who are changing our world

 

• access to the latest technology to promote an understanding of the legacy of earlier technologies.

Among the planned deliverables is a follow up to the award winning package of the history of computing targeted specifically at encouraging girls to appreciate that computing and security really are suitable jobs for a women. Events and activities are also being planning in co-operation with the Cyber Security Challenge and the groups that bring together women currently working in security.

The non-luddites among you will find donation details for the main appeal here.

If fibre to business communities has payback in months not years, why is it not happening? What is missing?

| No Comments | No TrackBacks
| More
I have received interesting feedback to my blog on the way that crapband is crippling the UK's creative industry clusters in Soho and Mayfair, forcing them to relocate to those parts of Shoreditch and Manchester which have fibre to the studio. Simple arithmetic appears to indicate that social and commercial landlords can get rapid, low risk, payback from helping fund fibre networks akin to those in a growing number of communities around the world, to service their tenants. Many such projects are variations on Stokab  the fibre utility network, serving Stockholm. But the different messages from the original academic evaluation of Stockab compared to other municipal networks and that sponsored by Google point to big differences in the underlying business and funding models.

The most significant is the way in which the investors derive benefit, if any. The different models are not new. They were found with the canals and railways.

The biggest beneficiaries were those who helped promote lines in order to transform their businesses (farms, fisheries, factories, mines and quarries) to serve new markets or to exploit the rise in land and property values around the new stations: Metroland was unusual only in that the railway company itself made some of the money from the associated property development.

The biggest losers were those who bought shares in railway companies floated by consortia of businessmen and property developers who were more interested in cheap, reliable services than dividend streams.

Meanwhile UK became the workshop of the world on the back of building railway and steamship lines that enabled, for example,the jewelry quarter of Birmingham to create distribution networks that enabled it to dominate the world market for pen nibs and similar metalware for decades on end.     

When we say that the Internet revolution is akin to the steam age revolution, the parallels are closer than most commentators realise: from how innovation and growth was financed to how early leaders leveraged monopoly positions from one market to another, until they came up against opponents with whom it was cheaper to do deals than to compete. Hopefully, it is only a matter of time before the cartel that runs the US-centric Internet comes up against a Theodore Roosevelt who will put muscle back into the anti-trust movement (as when the US railway cartel stranglehold  on interstate commerce was broken up). 

Now to put this into the context of the business case for landlords to work with their tenants on commissioning community broadband projects (to global inter-operability standards) that they can "contract" to BT, Virgin, Sky, Arqiva or who-ever (large or small) to maintain and operate and exploit on an ongoing basis.

There is growing volume of evidence (UK, EU and US) that fibre to the premises adds between 5% and 20% to property values (surveys average around 10%). According to Rightmove crapband (i.e. anything less than so-called "superfast") can cut 20% off a house price while a Halifax survey last year indicated that 2/3rd of buyers would pay 3% more for good broadband and nearly a quarter would pay 10%. That would put the value of a good domestic broadband connection in the range £5,000 - £16,000

The value for businesses is much higher, depending on the nature of the business. Thus the absence of world class (as perceived by the French and the rest of the EU) local broadband for the start of the Tour de France in Barnsley this year would not only be nationally embarassing but could be measured in tens of £millions of lost ongoing benefit (tourism etc,) for the local economy. According to Sam Knows the date has slipped from "Spring" to end June. I suspect that means the exchange will be ready to handle the news media but not to enable local hotels and restaurants to take advance on-line bookings from visitors from around the world without paying intermediaries in areas with better broadband connections.

The BT price for consumer Fibre to the Premises is now an 18 month contract for £99 per month: £1,782, plus £750 connection charge, plus a distant dependent charge (£200 for up to 200 metres from the exchange, £600 for 200 - 399 metres, £1,000 for 400 - 599, £1,400 for 600 - 799, £1,800 for 800 - 999, £2,500 for 1,000 - 1,499 , £3,500 for 1,500 - 1,999 and by quotation above this), plus some sundries.

This  equates to a connection cost, including 18 months service,  of £2,750 to £6,000.

Many new build providers claim they can significantly undercut this offering which is, in any case, only  available at about 300 exchanges, such as parts of the area served by West Malling, and supposedly coming soon to more, from Croglin (a tiny community in Cumbria in the catchment area of B4RN *, hence the complaints about predatory practice) to Whitehall .

In other words, the business case for new players to enter the market would be a no brainer, were the benefits to accrue to those putting up the funding without intermediaries, including central and local government, regulators, monopolists and others getting in the way.

I have seen many attempts to model the cost and value of broadband roll-out over the past two decades and have advised a fewl. Most were as over-complicated and fanciful as the average PFI deal: combining the worst elements of inefficient outsourcing and over-priced leasing, obfuscated under layers of consultancy and accountancy jargon, drafted by those with little or no grasp of the cost of capital beyond what one might expect from a PPE Graduate, let alone of the technologies and service delivery disciplines involved.

One of my contemporaries at London Business School was a manager in British Rail at the time of privatisation. He was instructed to help prepare the privatisation of the rolling stock, according to criteria dictated by "experts" from the Treasury and their equally expert consultants. He read the pages of analysis with growing disbelief, but was told that the  "policy" could not be questioned by lesser mortals. He asked if a management buy-out might be considered. He was told it might indeed be helpful - because the market was thought to be sticky for such an "innovative" privatisation - but that he and his colleagues would be suspended, on full pay, for the duration of any bidding exercise.

He consulted our mutual tutor at LBS, who informed him that if looked like a duck, quacked and waddled it would probably lay the same type and quality of eggs and taste the same when cooked. Equally helpfully, he introduced him to a couple of fund managers. He then mortgaged his house to get an equity stake but expected to be seriously outbid by cleverer and better funded competitors. To his surprise his team won their bid, based on the simple, risk free, guaranteed minimum life, leasing and maintenance deal which was what the Roscos really were. I8 months later, after the markets realised what they had done, the team was bought out by a group with access to cheaper finance. He became the richest of my classmates (although some of the others later went on to make even more). He and his colleagues made no attempt to defend the deal when it was investigated  by the Public Accounts Committee, other than to say that they had stuck by the rules which they had  advised against. They were the only ones exonerated in the final PAC report.    

I do not expect to get similarly rich advising consortia on how to turn the current morass of misunderstanding, misinformation, ignorance and incompetance to advantage but I am happy to help others do so - provided that their schemes are at least as much in the public interest as the inter-woven mix of property  development and financial engineering that created metroland around a railway that never made a profit.

Meanwhile, those who wish to learn more from those who can help them transform the market should attend the INCA event on the 8th May which I have previously mentioned.  I am told there are still places available.

P.S. Dolphinholme now has a Gigabit to the village hall and I have just been sent a copy of a letter from Hyperoptic to the residents of an up-market housing complex regarding one of their demand agregration exercises in co-operation with the "building management team". It refers to services already provided into over 150 developments in the UK. Their business case appears to be based on an uplift of "up to 5%" in the property value in return for an upfront commitment of £1,750 for a gigabit service for two years (100 megs is £1,140 for two years). 

P.P.S.I am further behind the curve than I thought - George Soros put £50 million into into Hyperoptic last year and a number of funds are currently looking for opportunities, provided they are alongside heavyweights and not just enthusiasts.

* Declaration of Interest: The funds in which I have interests (and advise) currently have investments in Alcatel Lucent, Avanti, B4RN, BSkyB, BT, Colt, IBM, ITV, Netcall, Rocksafe Europe and Vodafone as well as a number of Construction and Property Companies and Utilities that should do very nicely out of a boom in shared infrastructure investment.    

Find recent content on the main index or look in the archives to find all content.

Archives

Recent Comments

Clerkendwell on Is your database really n... : The pressure to monitor usage to justify public se...

 

-- Advertisement --