2105: The Year of the Compliance-Created Cyber Confidence Collapse?

| No Comments | No TrackBacks
| More
We are bombarded with messages to promote new security technologies when most organisations the lack skills to make effective use of existing products and services to protect themselves and their customers against fraud and abuse. Too many compete for supposedly competant and experienced experts, rather than retrain those who already know the business. In consequence, turnover among those who can tick the boxes of the certifications in current demand and have a gift of the gab is spiralling up and actual security is spiralling down.  The problems are being compounded by layers of regulation that reward bad practice and open up more vulnerabilities than they address.

The biggest security risk now faced by employers is not outside hackers. It is compliance experts who stay just long enough to help you tick the latest regulatory boxes, having acquired the necesary understanding of your systems and security credentials necessary to do so. The drive by the European Commission to address supposed "data protection" problems, supported by the US obsession with "Data Breach Notification", could not have done a better job in opening up opportunities for serious fraud (both high value and mass market) if they had been actively planned by organised crime.

Autumn 2104 saw an explosion in recruitment effort for supposedly permanent compliance officers, well ahead of cybersecurity specialists and other assorted digerati. The average length of stay is now under 18 months. A quick scan of applicants shows that many have not stayed anywhere for more than a year since before the banking crash.

Next year will probably see the nadir of trust in the on-line world.

Part of the solution is for those who are serious about security to stop recruiting external staff of uncertain provenance (beyond the certification of their technical knowledge) for roles which should never be entrusted to those whose loyalty to the organisation is untested. Instead they should retrain long stay staff, particularly who might otherwise be made redundant or otherwise become disaffected after being passed over. This requires the organisation, however, to be serious about trying to rebuild the reciprocal loyalty that has been put a risk by a decade or more of outsourcing.

They should also start investing for the future by using the growing number of modular degree, apprenticeship and internship programmes to recruit and train the next generation, using the Tech Partnership Funding available and training contracts to enable them to claim exemption from national insurance at the same time as reinforcing loyalty by providing serious CPD training for existing staff. The combination of changes and launches over the past month has dramatically change the cost/risk calculations that should underpin the choice between retraining and recruitment. Add in the need to reinforce staff loyalty and competance to reduce the dangers of insider assisted fraud and it should be a no-brainer. Change does, however, require the Head of Information Security to stop talking cyberbabble and FUD and start talking business cases and staff development programmes with the Finance and HR Directors before putting plans to the Board.  

I started writing on the need for programmes to address our mounting e-crime problems in 2004. In 2011 I blogged on the need to ACT "before the shit hits the fan"  . Earlier this year I warned the crisis was about to come to a head  with an accelerating merry-go-round  for those claiming relevant skills and experience. I then agreed to help e-Skills (now the Tech Partnership) look for employers to help identify gaps in the new cybersecurity learning pathways  supply of training. My subsequent report was accepted and I am currently helping the Tech Partnership identify those training providers trusted by major employers to help them fill skills gaps.  I say "trusted" because training providers, like compliance officers, are among those able to work across security barriers without raising eyebrows.

When prioritising the security skills gaps the technology employers identified "Big Data" (including its use to detect fraud as well as its own vulnerabilities), "Cloud" (from access devices and networks to the hosting centres) and "Mobile" (including "Bring Your Own Device") as their top three. Financial Services commonly have a different, but not necessarily incompatible, perspective. Their focus is on "Identity and Access Management" in all its dimensions. These range from registering, identifying and locating the devices (often BYOD) allowed access to services (often cloud based), to the use of Big Data to analyse digital footprints to decide who should be given access and to monitor their subsequent behaviour (Vetting and Monitoring), including good practice in the use of those services already offering precognition reports based on on-line behaviour: where financial services employers have mixed views.

But the biggest issues are less to do with the technologies that the people processes they should be supporting. What is legal, let alone good, practice in the vetting and monitoring of potential recruits, employees and current or would-be customers?  Hence also the critical nature of my recent blogs on the Government Verify system and the obsession with trying to remove any face-to-face element in the creation of new digital credentials to replace those in which trust has been lost - in order to meet yet another deeply flawed  EU initiative to address the problems of the last century. 

The world has moved on. As part of my work with the Tech Partnership I am helping organise round tables in the New Year to bring together employers, recruitment agencies, training providers and members of relevant professional bodies and interest groups (including CIPD, CPHC, IAAC and SASIG) to identify those willing to work together on training needs analyses and the provision of relevant courses and material to meet the needs of today and tomorrow. 

In some of the most critical areas the first task is to identify what good practice is.

For example one of the areas is reporting: to whom should you report what, how and what should you expect to happen? Here the training needs analysis has to begin by "negotiating" the answers with law enforcement and major ISPs because the answers are not at all clear. The situation is equally unclear with regard to checking the CVs of potential recruits and assessing the probity, not just technical competence of those who could destroy the security of the organisation. Then there is the confusion over what is good practice in monitoring staff behaviour over time, given that signs of stress are more likely to be to do with health, finances or family issues leading to the propensity for mistakes and bad judgement rather than fraud. 

However, the exercise will be of little value unless we also address the reasons why employers are not retraining existing staff and the support for apprentice programmes is poor and may even have been falling . Hence also the importance of the work with which I have also agreed to help the Digital Policy Alliance (I remain a member of the unpaid advisory committee) on why so few employers invest in training. The DPA Skills working group suspended activity for the duration of the House of Lords Digital Skills Select Committee. Instead we urged members to submit evidence. The Committee has received over a thousand pages of evidence and those who have followed the oral hearings will have noticed a number of themes emerging. The DPA Skills group therefore plans to reconvene in February, after the Committee has reported, to discuss how to help implement the recommendations. That will probably entail focussing how to help make the break out from Groundhog Day : the 50 Year long, (to date), cycle of Skills Reports that have never yet lead to action. 

The Chancellor made a great start this month by exempting apprentices aged under 25 from National Insurance and funding some excellent Tech Partnership programmes but that will not be in time address the compliance-created cybersecurity crisis of 2015 as short-stay insiders help loot those organisation which place no value on corporate loyalty - unless employers make good use of the funding available for CPD programmes.  

The UK On-line landscape is being transformed in the week before Christmas

| No Comments | No TrackBacks
| More
The pledge by the mobile operators to spend £5 billion tackling mobile not spots   helps explain the speed of the EE (with £2 billion of its debts) sale to BT and the latter's plans for a £2billion rights issues plus £3 billion of extra debt

The City appears to have welcomed BT plans but they appear to take it to within a £billion of risking its current Baa2 debt rating. That the mobile operators pledge is only for 90% of the UK adds further confirmation for the need for a new approach to addressing the needs of the final 10%. Meanwhile the pressures to improve mobile cover for those in "rural" Inner London (where BT often claims it has no business case for improving fixed broadband) are increasing  with exercises like Syed Kamall's "No Bars" campaign  backed by the Evening Standard .

The good news is that the cost of tackling not spots can be cut by up to 80% by organising practical co-operation in making available shared mast sites and wayleaves.  The issues (including both economics and politics!) are different in urban areas to those in the countryside but shortly after Christmas I expect to be able to invite members of the  all-party Digital Policy Alliance to a round table to pool practical experience regarding addressing inner city and business park "not spots", including model agreements, early in the New Year.  This is part of the promised follow up  to the meeting I organised on 12th September  to help drum up inputs to the consultation on Digital Infrastructure Investment.

The economic value of work addressing notspots to enabling initiatives like Microsoft's support for Retail Week  to have serious impact on mainstream UK business cannot be overstated.  In the blog on my Digbeth experience, (when I learned why our forecasts  of demand are so wrong). I referred, albeit in disguised form, to the transformation of a transport business at the heart of the local retail supply chain, from voice messages and paperwork to text and images between the smart phones of the boss and his drivers and customers, stored in a cloud.

The reason was nothing to do with awareness campaigns or consultancy advice. It was that the fibre to every tenant on the business park was accompanied by high speed, high reliability, secure, wifi. The boss could be confident in relying on sending photos of paperwork to his drivers. They could respond in kind, equally confidently. Both could rely on GPS positioning to show where everyone, including at the collection and delvery points, was.

It was not rocket science. It did not require clever teenagers or apps.

But it did require confidence that the technology, partiucarly mobile and wifi, would be reliablw.

Now think of all those high street retailers and inner city businesses whose wifi and mobile cover is, at best, flakey. The deal made between the Secretary of State and the Mobile operators should help 90% of UK business. But think also of all those farmers and rural SMEs (including much of our tourist industry) whose choice is, realistically, between satellite and wet string. Hence my Christmas greetings to you all

Christmas indigestion for UK on-line retailers: what really is the effect of the new pan-EU VAT regime?

| No Comments | No TrackBacks
| More
If you have not yet read any of the arguments over what the new pan-EU VAT regime means for UK-based on-line retailers (large, small or micro) or are wondering how it will be implemented and enforced I recommend you do not do so over Christmas.

It will merely give you a mix of apoplexy and indigestion leading potentially to rancorous arguments with any relatives who work outside the community of internationalist digerati.
I would, however, remind you that ehat has happened is all your fault.

When I was Secretary General of EURIM (now the Digital Policy Alliance"), I used to regularly warn of the dangers of Euro Ping-Pong during meetings on the e-Commerce Directive and allied initiatives,hosted for us by then Electronic Commerce Association (now GS1), rapporteured for me by Will Roebuck while the Commission was consulting (and it did) before it gave up on trying to the right thing (whatever that might have been) and "harmonised" on Brussels fudge. And I gave up and focussed on UK-centric issues where I could make a difference.

Those who are serious about wanting to sort out the resultant mess should give rather more support to our successors, particularly the DPA plans to "support" (including inserting the necessary corporate, political and social "rockets") exercises to turn the current "reform" programme into the action plans needed for the EU to survive the next decade. I have great respect for the rapporteurs who are ready to support the DPA plans (I chose most of them and they have turned out even better than I expected) but they can only help produce balanced and representative results if those who will be affected by the chaos that is to come actually join, to help cover the overhead costs, and are then active in making their views known and working together on that which they can agree.

We now face the consequences of past compromises as governments world wide (not just within the EU) scramble for tax revenues while the world economy spirals downwards.  Governments face a triple fiscal whammy as the growing impact of the Ukraine dispute and associated sanctions coincides with the decision of Saudi Arabia to cripple its political enemies and erstwhile competitors and the US decision to rein  in its budget deficit. One "side effect" is that the on-line world will, in future, have to compete with the high street on efficiency and convenience, not just tax avoidance.

Christmas Stocking Fillers for Digital Government Anoraks: 1) The Government Verify Invitation to tender.

| No Comments | No TrackBacks
| More
Press cover for the latest phase of the Government Online Identity framework is beginning to emerge. The invitation to tender to become one of up to ten suppliers for the Government Verify Framework was dated on Friday 12th December and published on 17th with a deadline for submission of  6th February.  On 12th December the Government Identify Assurance blog carried a reminder that the deadline for submissions of interest in the pilot accreditation programme for suppliers was Monday 15th December. The UKAS notice was issued on November 24th giving three week notice, but UKAS is one of those quangoes of which  no-one has ever heard until they learn that they cannot do something because it has not been accredited. I therefore suspect the reminder was either because no-one had responded or because just one response looks like a 'fix'.

Do read the invitation to tender because it is the first time that the scale and nature of what is intended for this programme will have become clear to many.

Insomniacs will also need the supporting documentation on the CCS Agreements . Two documents have parts redacted. There is provision for changes to reference documents, but it's not clear which version is to be used for the bid, and some of those currently linked to from the Government Direct blogs have been stated as being well out of date.

Jugglers or Zen experts may be needed to sort out the limitations on how many times subcontractors can be used, but the risk of delay from challenges from lawyers must also be of interest as the contract mechanism is designed to ensure there's a loser. If someone comes 6th, say, and is then excluded, but would have been included, with exactly the same bid, if there had happened to have been a 7th, they would seem to have a very strong case for complaint on a restriction to trade.

It is also the first time that 3.5 million businesses, let alone those providing their accounting and payroll software, will have an opportunity to appreciate the changes they would have to make in order to play, allowing for the scope of the unanswered questions on the business model and therefore the uncertainty of take-up by anyone other than those parts of the public sector which are given no option.

That leads to a core question. What is the business case, apart from a questionable interpretation of the European Union Regulation on Electronic Identities and Electronic Trust Services?

The good news is that final draft of the regulation was watered down from that which the Digital Policy Alliance described as a "Massive European Own Goal"  after it had consulted its and called for inputs from others  and after my own attempt to draw attention to the ticking time bomb, including for DWP and the Universal Credit .

It is, however, a moot point as to whether the UK needs do anything beyond stating which existing identity and trust services it will accept for on-line authentication.

It is not as though this is a new market. As I have pointed out before  the issues are not new either. UK and US law on electronic signatures has been clear since 1867 (Supreme Court of New Hampshire judgement on whether a cable authentication is a signature)  and we have nearly as many government departments and agencies with fingers in the idenity and autnentication policy pots as we have commercial offerings in what is better viewed as the "Identity and Access Management" market.  Other governments, not part of the self-appointed D5 have quietly just done it: Roman Law countries also have a variety of solutions, usually based on "Electronic Notary" services.

Only the digerati who wish to treat our personal information as their oil  have a clear "business case" for change and they should be aware that the price of oil can come crashing down after the cartel collapses.

That said, it would be good if Cabinet Office were to have some sensible bids for recognition under the Government Verify programme from organisations that really do merit our trust. In my own case, I would trust Experian but would not wish to provide them with any information about me that they do not already have, in order to check my identity. Also I personally would not wish to have to trust any organisation based outside the UK to authenticate my dealings with HMG.  I should add that while it might have some value over current processes,  I have little faith that Verify will be much, if at all, more secure than the South Korean National Identity system or those of any of the other 'D5 leaders'.

I also await an explanation of the downward trend of 'live performance'  but am delighted to report that the new system is stated as being required to work in Welsh (albeit in a parenthetical remark).

Merry Christmas and a Happy New Year to all festive-season bidders.

A Christmas Message for the Digerati on the practical meaning of social inclusion

| No Comments | No TrackBacks
| More

A Christmas Message for the Digerati on why we need to give priority to social inclusion not to "digital by default".  : Luke 2.7 "... because there was no room for them in the inn".  

Joseph to Innkeeper: "But I can show you the confirmation from the "Inns'R US" App on my tablet"

Have an off-line Christmas and a user-friendly New Year

As in previous years I have split what I would have spend on Christmas Cards between Barnados and the Salvation Army 

For nearly forty years most  IT employers have declined to take on trainees or retrain older staff but  have queued up to employ those with two years of more of supposed experience. Only the skills in demand have changed. There is no shortage of talent, only of employers who will work with local schools, colleges and universities to identify and train that which is not being properly harnessed - including that in their own work force! 

I have regularly talked of the need for Tax Free Training since exempting trainees from National Insurance and PAYE was identified by the National Computing Centre members ("The IT Skills Crisis: A Prescription for Action - 1987, based on 215 responses from 1420 IT employers) as the only Government skills initiative that would make a real difference.

I was therefore delighted with the news in the Autumn Statement that apprentices aged under 25 will be exempted from National Insurance, thus effectively cut their employment cost by around 20%.   The other great advantage of putting trainees (whether school leavers,  graduates or post graduates) onto formal training contracts is that costs (as per the test case of Sthraclyde Regional Council v. Neal) can be recovered if they leave prematurely  - thus giving a "guaranteed" return to the employer.

But what about all those older staff whose skills need updating, or those who being cross-trained from other disciplines for all those roles that need hybrids? 

The 50% aid (up to £500) from the Tech Partnership  (new name of e-Skills)  is per module, per person  and is not age-related. Thus an organisation running a programme of half a dozen modules to train a couple of users in those information security tasks which should never be contracted out could claim £6,000 towards the cost 

I would like to think that this is the start of a progress towards a level playing field for employers seeking to give world-class skills to their UK workforces to compete against those who import skills or off-shore jobs. My full evidence to the House of Lords Select Committee is now available on-line and I would also like to think that it (and perhaps more importantly the reaction to it) helped secure the announcement in the Autumn Statement.   

Yesterday I learned why our forecasts of broadband demand are so wrong

| No Comments | No TrackBacks
| More
Yesterday I attended the excellent INCA Super Connected Cities seminar in Birmingham at which two contrasting examples of the effect of providing fibre services to commercial centres and business parks were presented. A light switched on in my head. Neither analysis has yet been published and I plan to blog again with links when they are. One illustrated the effect of providing a high reliability 100mbs service to all tenants, without charging seperately. The other illustrated the effect of separate charging, according to speed, with the fastest service priced akin to the previous leased lines.

Thomas_Cook_Building,_Leicester,_one third.jpgOne of the users of the first service, the boss of a very traditional SME, had seen no need for computerisation but been perpetually complaining about the poor fixed and mobile phone service and was drowning in paper. He started using his smart phone to photograph orders and dispatch notes. He now photographs all documentation and files it digitally. Another user, a media distribution company, had been planning to relocate. it is now able to handle its business on-line instead of by courier and has been able to grow dramtically. An IT firm was able to cut timescales for quoting for new business from weeks to days by video-conferencing with users in major clients over details. The transformations did not, however, lead to average traffic volumes using more than a fraction of the new capacity (although this had gone up by a factor or 2 to 5 fold). It was the reliability of service when needed - with sudden short-lived bursts of traffic not leading to service degradation - that had led to the changes in user behaviour.  Traffic often spiked to around 50% of capacity even though the daily average was under 5%. 

In the case of the second service the effects had been far less dramatic. Many tenants used the opportunity to cut their communications bills instead of taking advantage of improved connetivity and reliability for the same cost.  The speaker presenting this service ended by calling for action to educate users as to the benefits of faster, more reliable services. He words echoed the call for such action that I have heard at meetings of the Broadband Stakeholders Group.

A light switched on. I realised that forecasting capacity requirements by talking of average traffic volumes is like planning a new railway network based on average traffic volumes. Most of the railway lines into London are empty for most of the time, save for the queues at junctions or into the terminals during rush hour. 

One of the speakers in the following session (on ways of looking at the investment case) had to drop out and I found myself taking his place after that light-bulb moment. It may be helpful if I reprise what I said, bearing in the mind that the INCA seminar took place in Digbeth, one of the areas that Birmingham sought to rejuvenate on the back of a shared dark fibre network.

"Good afternoon, I would like to go fast backwards to 1845. We are guests of the Digbeth Chamber of Commerce and the Birmingham Small Arms Trade Association. We are at the heart of the global defence trade. Their factories around us are working flat out, connected by canal to every major port and thus the world, producing the guns to enable all races and nations to more efficiently kill each other. We have been asked by DCNS (the department for canals, newspapers and sport) and OfCom, their regulator, whose remit has just been extended to cover railways and postal services, for forecasts of the scale and nature of demand for freight and passenger traffic over the next decade - to help plan the switch from canals to railways.

I pick 1845 because Thomas Cook agreed a permanent arrangement with the Midland Counties Railway Company in 1844. And in 1846 he was bankrupted when the costs of a tour of Scotland for 350 people from Leicester ran ahead of their willingness to pay for extras. But within six years, he had arranged travel and accomodation for over 165,000 visitors to the Great Exhibition of 1851. In total over 6 million people, a third of the population of the UK, made that journey, an average of a million a month...  "  

I went to ask whether anyone had actually made any money from Quadplay over the past twenty years, as opposed to destroying tens of $billions of shareholder value, trying to invade market with different cultures, disciplines and business models, as opposed to making partnership deals with those who understood them...

I then called for action to remove the regulatory barriers to business models which are attractive to investors looking for opportunities underpinned by 3 - 5 year service contracts with those who stand to benefit most - such as those whose homes, hotels, workshops  or business parks will increase in value if better connected or those whose £billions in off-shore profit (from the advertising funded services that are clogging our current networks with monitoring and surveillance bloatware) are now at risk.   

My fellow panelists took radically approaches in looking at the problems of funding new services. We agreed that this was a "two bottle" problem and we were standing between delegates and the reception.   I would, however, like to congratulate INCA for organising another excellent event, introducing players who had not previously met and helping progress action and not just informed debate. I now have to follow up on the actions I promissed, regarding the removal of obstacles which add to the cost and delay of network upgades and new build.    

Rural Payments Agency opens up routines for farmers with no digital or credit footprints to bypass Government Verify

| No Comments | No TrackBacks
| More
I have been very business over the last week but hope to make time over the week-end to blog my responses to the Autumn statement, particularly a welcome for:
  • the exemption of apprentices aged under 25 from national insurance (should help transform the UK IT skills scene by providing a less unequal playing field with our overseas competitors),
  • the reform of business rates (to also be exploited for communications infrastructure) and
  • the less unequal tax playing field for UK-based and overseas on-line players (to make the latter compete on quality of service instead of tax avoidance).
  • the extension of the BDUK voucher scheme
I plan to also respond to the recent Labour party Digital Government submission, beginning with those recommendations with which, as a tribal Tory, I strongly agree - such as the need to:
  • give priority for public service delivery to those in most need and
  • to take a good look at which is ethical with regard to digital by default and big, open, data, particularly that which should belong to you and me. 
and to say that BDUK has actually done a rather good job, given the situation that ministers  inherited in 2010. Read my comments on the Computer Weekly interview with Ed Vaizey on Broadband Progress before you faint.

However, more immediately, I ecommend that all digital by default enthusiasts watch the recent evidence session of the EFRA Select Committee enquiry on the ability of farmers to use the new on-line claims services by the spring 2015 deadline.

The first witness was Sean Williams who effectively said that everything was going according to plan and that the plans had agreed with Local SAuthorities did not include priority for those with the worst current connections, let alone helping them meet Rural Payments Agency timescales. Those affected should therefore use satellite.  We also learned that most of the 90 submissions to the Committee called for "Digital Community Hubs". I had not realised just how strong the support was already for these when I referred to the trend towards the local digital interconnection hubs in my submission to the Digital Communications Infrastructure Strategy consultation. Sean Williams said that BT would connect anyone who made a good business case. Watch this space because the key to their sustainable and future-proof success is "any-to-any" connectivity.

When Henry Robinson and Charles Trotman of Country Land and Business gave evidence we learned that 12,000 farmers (11%) have no digital footprint at all and four exchanges are still on dial-up, with no upgrade plans in sight. They reiterated the CLAB call for a Universal Service obligation and reminded us that, thanks to contention and other issues, "up to 2 mbs" is nothing like the same as the reliable delivery of at least 2 mbs.

As the session politely progressed, with all participants maintaining straight faces, the dry comedy continued with some splendidly polite "understatements": 

- from "as the broadband meanders" (for those next to a cabinet who are being served from one 4 kilometres away)

- to "and what have you learned [from the customer feedback via three pilot assisted digital centres] other than swearwords". 

Mark Grimshaw, chief executive of the Rural Payments Agency, described how the Rural Payment Agency had re-learned both customer services and agile methodology. It now has a three week software upgrade cycle in response to feedback and the discovery of the need to structure services and the "customer journey" round the way that farmers, as opposed to the expert consultants think they need. He wryly contrasted that with nearly a decade of "delayed big bang", waiting years to discover what should have been discovered with pilot systems before confirming the specification for roll out. 

The new services have been tested to work at 500 kbs but even that may not be reliably delivered over circuits supposedly running at "up to 2 mbs" because of contention. They are therefore being restructured to save automatically whenever the service goes down. Meanwhile the approach behind the first Government Verify service to be accredited did not work with those who inherited their farms and have never had to borrow or request credit. The RPA has therefore had to reinstate a routine to bypass Verify and allow farmers to register direct.[I seem to recollect that this tallies with a court case which found that citizens have a legal right to be able to deal direct with government departments and not have to do so via intermediaries].
Finally Jonathan Owen, chief executive of the National Association of Local Councils described, among a series of other splendid points, how the provision of 100 mbps services had led to 20% improvements in "business efficiency", e.g. hotel bookings and orders for rural businesses.

I do look forward to the report of the EFRA Select Committee. 

The pan-European rush to create a new generation of communications monopolies and put up prices

| No Comments | No TrackBacks
| More
Further to my recent blog on why the possible BT - O2 or EE merger is born of weakness or strength, one of my readers has drawn my attention to Benoit Felten's recent analysis of the pan-european attempts to shut out competition from new network operators and create a new generation of monopolies to protect the past from the future. It is well worth reading for its demolition of the idea that competition is bad for investment because it depresses prices.

A contrast between the history of the railways in Britain, the Continent and the United States also illustrates that while competition may not always be good for investors, it appears to encourage rather than deter overall investment. It also leads to faster, better cheaper and more reliable services and pulls through economic growth. Has the time come for some trust-busters, akin to those who broke up the US railroad cartels before the First World War? 

Is a telecoms merger (BT and O2 or EE) born of weakness good for UK plc?

| 2 Comments | No TrackBacks
| More
The news that BT is in talks with both O2 and EE in order to re-enter the mobile market should come as no great surprise but is it good?

BT spun-off what was then Cellnet and mortgaged its exchanges when it was faced with £30 billion of debt after local loop unbundling destroyed the business case for its plans to deliver broadcast quality video to the home by 2002.

BT's recent capital spend on communications infrastructure, as opposed to that funded by government, has been little more than that necessary to cover preventive maintenence, replacing obsolete equipment so that can now make use of the fibre to within a mile of most UK homes that it already had over a decade ago. 

Meanwhile O2 and EE have struggled to fund the upgrading of their networks to overcome notspots and bottlenecks as traffic volumes rise faster than revenues, let alone to to meet their obligations and promises for 4G. Hence their desire to offer infrastructure sharing rather than roaming.

Meanwhile global infrastructure funds are said to have tens of £billions looking for opportunities to build 21st century hybrid networks providing gigabit services at a fraction (said by some to be as low as 20 -25%) of the costs currently being quoted for new build, let alone operation.

Is a "mere" share swop between market dominant but financially weak players good for the UK plc, or will it serve to deter the new investment that is needed?

A more positive view is, however, that the merged operations will be so "financially challenged" that, like the Swedish incumbent, it will have no realistic alternative to joining its current competitors in becoming "lead tenants" for the new generation of infrastructure only utilities, akin to Stokab, that are beginning to sprout around the UK

I look forward to readers comments.


Where is the Cabinet Office Identity Programme going?

| No Comments | No TrackBacks
| More
Over the past few weeks I have received a flow of e-mails regarding the status of the Cabinet Office IDAP programme.  

Is it making steady progress towards creating a market framework for inter-operable identity systems?

Or is it muddying the waters by trying to coerce users into new and unproven systems for their dealings with government while the rest of the world moves on?

The alterantive "proven" systems range from the Government Gateway (using by millions, including all small firms for their tax affairs) through the third party services provided by the members of the DCTE, (the European trade association for Digital Trust services) to the identity and access management systems used by industry (from airports through banks to on-line retailers) to identity and give layered access to visitors, customers, employees and contractors.

I find it difficult to understand whether the Government data Service is undertaking genuine voluntary customer trials or whether groups of users are being given Hobson's choice - e.g. use the new system or stop farming in an attempt to get a bandwagion rolling.

I therefore asked Mark King of Broadsail one of the independent consultants who has been tracking UK and EU debate on electronic signatures on behalf of his clients, to comment. Before you read on you might, however, care to begin by viewing the video of his presentation to a BCS-EEMA event last January.

His "observations". Including on how and why UK ID policy has got to where it is today, are below:

"The government programme for identification of people for online public services has been very focussed on be being seen to respect privacy, which covers more than data protection, notably in respect of user control. One of the drivers was a reaction to the previous government's ID card scheme, which also included a national population register, and that has also been cancelled rather than downgraded to fill missing but unfashionable considerations such as people's jury service status.

Instead of adopting a recognised, existing, privacy-friendly model such as that used in Canada, possibly as a result of the empty coffers, the decision was taken to re-use existing credentials, despite the problem that those suitable for consumers weren't built for giving out benefits.

Re-use of employee credentials was also investigated, but Government agencies are reluctant to allow staff ID to be used for purposes other than which they were designed, and with no commercial case for other employers to participate, this was amended. There was no enthusiasm for increasing risk by opening up if there was no benefit for the organization.

After a DWP initiative was announced in the EU official journal (OJEU) and then pulled, a call went out for a framework contract for 'Identity Providers', with the expectation that banks, supermarkets and other familiar organisations would participate. It was initially a DWP lead, but was novated to Cabinet Office when it became clear how gentle the Universal credit roll out was going to be. Far from being a gravy train, it required participants to invest, but also accept very strict terms as to what else could be done with the data. The only responses were from those not on the envisaged list. They must have been prepared to take the considerable risk of investing, unaware of the extent, or had some separate political motivation. As in Ireland, the Post Office was an obvious contender, and it qualified as being technically private, although some people remained confused about being redirected to the Post Office when they were trying to go online and not use the post.

The group of eight in the framework were a disparate mixture, with at most two of them being household names, although they might have used different branding. Only five went through to a delivery contract, and public testing started on 21 October 2014 with just one.

An unpaid group of privacy experts were brought together to agree the principles for the programme. Had this been done before going out to contract it any principles would have carried more weight than putting them out for public consultation three months after the system was due to become operational.

More-over, public endorsement of the principles by a cabinet minister precluded (and still precludes) civil servants from debating the issues in public.

The group's remit was also extended beyond privacy to general user concerns (but, it seems, not non-users); it is not clear if sufficient additional experts were called in, nor who has time to provide unbiased pro bono advice for such an extended period.

The user was not allowed to be able to chose to be consistently associated with a permanent identifier such as a National Insurance or NHS number, but rather a matching data set including 'current address' and date of birth - use of both of which are deprecated by online security advice. Nor is the user allowed ...

Should Broadband advertising be 'legal, decent, honest and truthful'? If so ...

| 1 Comment | No TrackBacks
| More

Further to my recent blog on the way in which the Advertising Standards Authority has been accused of approving serious "misrepresentation" of the broadband offerings from dominant suppliers and thus helping prolong the current distortion of the market, I have received a number of responses as to what their approach should now be.

I particularly liked that from Dave Cullen, now with ITS , which has been providing high speed networks using hybrid (fibre and wireless) technologies for urban centres , business parks and rural communities for nearly 20 years.  The recent rapid growth of ITS (taking over smaller operators as well as winning ever more and bigger contracts) is indicative of the way the UK communications infrastructure market has changed over the past 18 months and now offers the prospect of genuine competition and growth.

Dave believes that, regardless of whether there is a good case for challenging BT's claim of "19 million fibred homes" as "mis-representation", the providers of alternative networks should ask the ASA to follow the logic of its own judgement.

Given that the ASA position appears to be that the issue is around customer's service expectations and performance, it should be pointed out that Fibre to the Cabinet cannot  deliver  the claimed 'up to' levels of performance more than about 700 metres from the cabinet - and that distance is as the copper meanders, not as the crow flies.

Therefore, as a minimum, BT should be obliged to clearly state the "risks" associated with their product within EVERY ad, in much the same way as mortgage and loan companies have to warn that "Interest rates can go up as well as down; your home is at risk if your do not keep up repayments... etc"

BT should similarly be required to say: "our fibre optic service relies on copper for your final connection; it cannot guarantee superfast speed or quality to premises using copper cables longer than 700m from your connected cabinet..."

The same would, of course, apply to those whose "fibre" services also depend on reselling the BT Openreach fibre to the cabinet services. It would give BT an incentive to repromote its own fibre to the premises service, instead of hiding it away lest too many customers ask for it and thus overload its creaking backhaul infrastructure. It would, of course, also give its resellers (incuidng Sky and Talk Talk) an added incentive to offer "crapfree" (i.e. no copper, rust, alluminium or other pollutant) broadband using rival local fibre and wireless to the premises providers.  

Why IT Projects Fail - forty years on and what is new?

| No Comments | No TrackBacks
| More
One of latest downloads from the Computer Weekly website is entitled "The psychology of IT projects: why they fail"  It is almost 40 years to the day since Computer weekly published the last in a series of ten articles on "Computer Assisted Bankrupcy" based on my London Business School project: "Business Appreciation: a study of the business training needs of DP staff and the current calamitous consequences of its absence".

When it comes to the reasons that IT systems fails, the pace of change has been about the same as the development of my literary style - including my love of alliterative headlines. 

The more interesting question is - why do we never learn? In the public sector it is because good practice is punished hardest when it matters most , hence the reasons the lessons of how to acheive success are commonly ignored . At least the private sctor has more interesting reasons - but they too remain boringly similar. I leave you to read the download.

Advertising Standards Authority wrecks attempts to promote "genuine" fibre broadband

| 2 Comments | No TrackBacks
| More
I have just been told of the Advertising Standards Authority ruling that copper to the home from a fibre connected cabinet can be called "fibre". Meanwhile, it would appear that those offering "true" fibre connections cannot drop the "up to" in front of the speeds they offer.

Even more interesting is the revelation in the small print of the supporting material that as recently as last year BT still hoped to offer genuine fibre to the premises to 25% of the UK. That ambition appears to have have fallen by the wayside with the squeeze on its investment programme resulting from invasion of the content market and consequent price wars - with headlines offering "fibre" for £2.50 a month (rising to X after a given period), provided you take it over a copper line for which you pay £12.50 a month (rising to Y after a given period).

It is clear that those offering future proof fibre to the router/femto connectivity need a new headline slogan over which they can police copyright - so as to ensure that it is not misused by those with market dominance and advertising budgets large enough to sway the judgement of a self-regulator. I have a bottle of House of Lords whisky for the best suggestion.

Ideas to date include: "full fibre", "home fibre" and "crap (copper, rust, aluminium and other pollutants) free fibre".

I would also welcome a good definition of "crapband". The current working definiton is: a service which delivers a speed that is, at best, less than 25% of the advertised "up to".               
P.S. Copyright is reserved on the terms "full fibre", "home fibre", "crapfree fibre" and "crapband" (unless some-one else can demonstrate they have already used them). Free license will be given to those offering fibre to the home router and/or local mast or femto.

City of London to use market forces to bulldoze broadband blockages while Vodafone parks tanks on BT's lawn

| No Comments | No TrackBacks
| More

The Corporation of the City of London has just voted to publicise and build on their surveys of local broadband supply and demand  with a two stage project. The first stage is to identify the range of solutions that are available and to map demand for fibre broadband, building by building, in the Square Mile. The stated aim in the press releases is to use "this information to 'nudge' fibre suppliers into providing connections that SMEs can afford".

The second stage is to address growing complaints over mobile and wifi cover with a major  upgrade to wireless voice and data services, using City Corporation street furniture and buildings for extra masts and connections.

Mark Boleat, Policy Chairman of the City of London Corporation that looks after the Square Mile business district, said: 'The 13,500 SMEs in the Square Mile employ many people, are vital energisers of the business environment and need the right tools to deliver productivity both in the City and the adjoining areas that are fostering growth. This project will help close the digital divide by putting  superfast broadband within reach of far more of our vital SMEs, and help residents and visitors, too.'

The City of London Corporation, the elected body which runs the global business hub around St Paul's, has been pushing hard to improve connectivity for SMEs who can't afford the £500 a month needed for a big-league business connection, and for its 8,000 residents. Both the building-by-building fibre survey of the Square Mile and a tender for a wireless service will begin in January 2015.

The Square Mile is behind others, including its traditional rival the City of Westminster, when it  comes to using its street furniture and building to help pull through upgrades to mobile and wifi cover. However, it looks to be in the lead when it comes to organising a building by building survey with the aim of helping alternative network providers create a genuinely competitive business broadband market.

The Corporation may not be alone in this for long. The Countryside Alliance plans to work with the Actual Experience BBfix project  to identify not only the services actually received in rural areas but also some of the reasons for poor performance. When I first heard of their plans I thought, "why do we need another mapping exercise?".

I then drilled down into the detail of the maps currently available and what they measure and reflected on discussion at the launch of the Broadband Stakeholder Group report on "Out of Home Usage"  and took a look at how the different "maps" illustrate the supposed broadband and mobile cover across the constituency of Rochester and Strood, a BT near monopoly  serving a UKIP stronghold (rather like Clacton in fact). The picture they give is remarkably rosy compared to the reality found by politicians and party workers as they canvas the area.

The twin approaches of building by building surveys and measurements of actual experience, not just nominal speeds, could help blow apart cosy debate over what we do, or do not need, and help enable market forces to compensate for regulatory failure. Then came the press cover for the announcements from Vodafone, now that it has sorted out the national backhaul network that it acquired from Cable and Wireless.

I suspect the reality is rather different.The headlines are about Vodafone doing deals with BT and others for local access and content, leading to head-to-head competition between BT, Virgin, Sky and Talk in the quad play market. According to investment analysts like those at Redburn, BT's capital spend is falling, not rising and it has neither the funding nor the incentive to invest in both infrastructure and content. Meanwhile Virgin is extending its local reach and Sky and Talk Talk are exploring connectivity deals with alternative network providers.

The Vodafone announcements might be better seen as a very public warning to BT to stop planning to re-enter the mobile market via wifi and instead to include them within upgraded Openreach services as a shared utility for all to use. Meanwhile Vodafone is well positioned to not only reduce what it pays to BT for backhaul but offer services to BT's competitors, local alternative network providers and business users. It will be interesting to see it offers next spring to those in the Cities of London and Westminster as well as to those whose local fibre plans are constrained by the availability of affordable backhaul (see page 4 of the BSG "Out of home experience" report. Will it also seek to take a lead in providing seamless local, national and pan-european roaming to business customers, whether or not it is compelled to do so by regulators?  Is this part of its positioning for the world of smart cars, buildings, cities and infrastructures ?

The UK broadband market, including the future of digital infrastructure investment, just became much more interesting. 

On the eve of the meeting of the Internet Engineering Task Force last March, the Conservative Techology Forum held a meeting  at which there was general agreement  that the time had come for more openness about the  governance procedures of GCHQ in order to help rebuild confidence  after Edward Snowden's revelations.  There was also discussion as to whether those procedures were more or less opaque than those of the on-line service providers, who collect and store the fine detail of our on-line footprints. 

When the IETF had a session with MPs of all parties on the following evening, we heard of the "breaking of the Social Contract that underpinned the Internet". I then blogged on the issues raised during the reception afterwards when leading figures from the IETF and ISOC were candid about the challenges they faced in structuring honest and constructive debate between engineers as opposed to allowing lawyers to dictate the future.  

Since March we have many more attacks on the governance processes of UK and US law enfircement and surveillance services, with no recognition that they are very different.  US based companies (and their lobbyists) would like the UK to copy the court-driven processes with which they have to live back home -  where locally elected judges can authorise, for example, the collection of data to enable investigations into the tax affairs of their political opponents. 

The differences  between the governance processes of GCHQ and Fort Meade can cause tension,  but on balance, the result has almost certainly helped resist the trend toward unaccountable autocracy in both nations - at least on the part of government, if not on the part of the shrinking cartel which now controls the access of most of us to the Internet .

Until publication of Sir Ian Lobban's  valedictory speech we had, however, almost nothing on public record about how GCHQ's interprets UK  governance, including the determination of its staff to resist the pressures of politicians  to gather dirt on their opponents (as in France or the US) let alone their opposition to the routine mass surveillance of which it is accused and of which so many of its attackers  are themselves guilty.

Remember that when an Internet Service Provider says its monitoring operations are to "improve customer service", you are NOT the customers they mean. They mean those who pay them for analyses of the data they have collected about YOU. Even much of the free ad-blocking software is funded by those who pay for loopholes, alias whitelists  .

If information is the new oil, has the time come to break up the Rockefeller Empire?

If so, we should also remember than within a decade the Standard Oil of New Jersey was bigger than the parent had ever been.

Hence my comments on the importance of also looking at the business models of the Googlettes when looking at those attacked by Robert Hannigan for aiding and abetting terrorists and  criminals .

The collective response of the ISPs  was predictable - albeit not necessarily wrong.

At this point, however, we need to look at the evidence available on the balance of public opinion and think long and hard about what that evidence really means - assuming we are serious about democratic values and holding dominant commercial players, as well as government, to account.  

When I blogged on IT at this years' party conferences, I pointed out the IPSOS Mori data showing that the public trusted law enforcement  and central government with rather more than they trusted their Telco or Internet service provider.
This morning the daily YouGov poll was on attitudes to Internet regulation.  When I voted the tally was running at :

  • Much more regulation of the Internet 18%,
  • A bit more regulation 32%,
  • Currently about right 29%,
  • A bit less 7%,
  • Much less 5%,
  • Don't know 8%.
Digging deeper indicates that consumers  are more concerned about fraud, abuse and bullying than about cyber-terrorism. The claim that mobile roaming to reduce the number of not-spots should not go ahead because it makes surveillance harder  is therefore likely to get short shrift, were it even true.  I am awaiting details from my moles but suspect the reality is that the mobile operators want any excuse to avoid national roaming and have yet to come up with an alternative solution to the not-spot problem, other than infrastructure sharing. 

Meanwhile the urban mobile traffic of much more interest to the surveillance services is increasingly being off-loaded onto wifi-hotspots. I therefore commend the Matt cartoon in the Daily Telegraph on November 6th: One country yokel to another saying "I wanted to become a jihadist but round here  the internet's too slow and there's no mobile phone cover"

The time has indeed come for a fresh look at responsibilities of those who take £billions in untaxed profits out of the UK while claiming they are unable to protect their customers from abuse. As part of that review we should, however, also look at the reliance of state surveillance systems on outdated communications architectures that stand in the way of allowing the UK's digital infrastructure to evolve in line with customer needs into a world of ubiquitous, seamless, mobile, connectivity.

That almost certainly means tapping, instead, into the systems used by ISPs and their advertising (and other) "customers", to follow the every move of those whose communications they are monitoring, including via the GPS locations of the devices they use.

Such an approach raises many questions and the answers need to be based on genuine public consultation not hurried discussions with vested interests.  In the meantime  I urge all those concerned about  addressing the not-spot problems, urban as well as rural, to respond to the DCMS consultation on mobile roaming.

The announcement of  Environment and Rural Affairs Select Committee  enquiry into "Rural broadband and digital only services"  should be just in time to spur government into joined up action before the start of the 2015 Election Purdah.The terms of reference  put debate over rural broadband into the context of the demands of the Rural Payments Agency that access to its services be digital by default . The absurdity of these demands (and lack of practical attention to the means of delivering "assisted digital" to those without adequate on-line access) has just been compounded by the decision to force farmers to also use the new Government Verify Service instead of the Government Gateway accounts they use for tax purposes. The consequences of this decision were all too predictable. It should also be remembered that the pilots are the stalking horse for the Cabinet Office attempt to force millions of small firms and all those who make individual tax claims, to similarly move from the Government Gateway, instead of simply offering them the new service as an alternative.

It is as though those taking the decisions concerned are closet UKIP supporters determined to "take-out" not only the current Government's rural MPs but also the digital by default enthusiasts of the opposition. Or is it merely a short term ploy to help meet DEFRA's targeted spending cuts - by making it impossible for farmers to claim anything in the period to March 31st 2015.  

Either way, it signifies political disaster for the Government - even before we begin to consider the implications for all those, other than farmers, who live in rural areas who are losing their buses, post offices, market town bank branches - for whom this is clearly the thin end of a very big wedge threatening to exclude them from public services  ... and drive them into the arms of UKIP.

I therefore urge all those with friends and relatives living in rural not-spots (who will not be aware of the Select Committee enquiry because they are unable to browse the web in the first place)  to let them know of opportunity to make their views known before November 19th and to offer to email submissions for them if they cannot get on-line to do so themselves.

I also suggest that All Party Rural Services Group, SPARSE, ACRE, the Countryside Alliance and Country Land and Business offer to collate the views of their members and supporters and that the Federation of Small Businesses offers to collate the views of their 100,000 or so rural members.

P.S. I would also like to take this opportunity to promote a modest suggestion  to make it easier for those in rural areas to deal with all those offering to help them via the growing plethora of fragmented grant and loan schemes: The Gov.UK Unified Grant Applications Form (GAF1) . The "business case" is obvious. The only credible argument against is the job preservation of those who want to be seen to be doing something, even if only wasting the time of everyone else, but do not actually have much, if any, money to give out.


The churn of information security staff is even more dangerous than the shortfalls in quality and quantity

| No Comments | No TrackBacks
| More
You might like to scroll down and read the last paragraph of this blog entry first.   "The Consultant" was first published in 1978 during the run up to a previous "IT Skills Crisis". It was based on a cautionary industry case study. Think what has changed since. Be afraid. Be very afraid.

Last year a Frost and Sullivan survey indicated that chief information security officers around the world were more concerned about staff shortages than hacktivism or cyber-terrorism, with over half having under-staffed departments and demand for skills growing at 10% per annum. 
We have had regular IT Skills crises over the past 50 years but the overall shortage has rarely been more than 15% (1987-9 "crisis", "cured" by the 1991 recession: page 17 of 1996 IT Skills Trends report). The 2014 RSA Conference was told that the current shortfall for Information Security staff is 25% and recent US legislation cited a vacancy rate in the Department of Homeland Security alone of 22%. Hence the sharp rise in US spend on cyber security skills programmes. 

As yet, the equivalent UK programmes are significantly more modest but competition for experienced staff, the salaries on offer for those with the skills in most demand and staff turnover have all accelerated sharply since I forecast trouble earlier this year

I therefore spent much of Quarter 2 helping e-Skills trying to get employers in the Financial Services sector to look at the skills frameworks for information security apprentices (both pre- and post- graduate) and continuous professional development and identify any changes needed to help meet their needs.

I blogged on my interim report in June  and you will find a summary below, headlining areas where those I contacted could find little or no relevant training on offer.  I am about to go back the employers to find out who they would trust to train their staff, with a view to inviting the named providers to co-operate on needs analyses and short course modules for launch in Quarter One of 2015.

First, however, I should comment on why the rising turnover rate is even more dangerous than the shortages.  Annual turnover among supposedly permanent staff has rarely been more than 20% (1987 - 90 and again during the run-up to Y2K) and the 2013 ISC2 Information Security Workforce study  found a churn of barely 11% p.a. among its professional members. However, a more recent Ponemon study found a churn rate of 25% among technical information security staff, rising to over 30% among managers and 40% among CISO and Security Directors.

There appears to be a growing gulf between those who focus on giving skills in current demand to loyal, long stay staff, while training their own "apprentices" (of all ages), and those who say this is too difficult and would rather bid against each other for plausible individuals who claim to already have the skills and experience being sought.  

This gulf also exposes the real danger. A lot is aid about the need for soft skills. Unfortunately, the most eloquent can include the "front men" for organised crime. In the last century (how long ago that sounds) I used to warn that the organised crime families of South London (where I grew up) were encouraging the brightest of the next generation to go on computer science courses and specialise in information security: not just to learn for themselves but to befriend the high fliers and identify their preferences (sex, gambling, drugs etc.) with a view to future "co-operation".

I was therefore appalled when looking at current information security skills frameworks to see how little attention there is to processes for selecting and vetting recruits (even topics as basic as "how to check a CV" appear missing) and for monitoring personal behaviour (where is there anything about processes for colleagues to report concerns over suspicious behaviour?). 

The relevant paragraph in my report to e-Skills read as follows: " Financial services organisations are concerned with the motivation and not just competence of staff and several sectors and professional bodies have mandatory requirements (e.g. the Chartered Institute of Securities and Investment programmes to develop and assess attitudes towards good practice). The FLSP has specifications covering the recruitment, selection and retention of colleagues. There is a good case for co-operation with the CPNI  and the Chartered Institute of Personnel Development (CIPD)  on shared modules, including processes for CV checking and behaviour monitoring (including over social media)."  I was therefore delighted to learn last week that the CIPD was not only happy to lead on work in this area but has already assigned staff to do so.

The context and full list of areas that need to be better addressed was included in the summary of my report:

Key Constraints and opportunities

•    The UK Financial Services Industry is internationally focussed not UK-Centric.
•    The drivers are a mix of fraud prevention, resilience, customer confidence and compliance.
•    A focus on cyber and information security results in contact being delegated to those with operational rather than budget responsibility.
•    Roles which do not require understanding of the business are increasingly "co-sourced", to joint operations serving a peer group and/or to trusted partners providing securities services. Those roles which are not outsourced commonly require skills mixes which cut across professional boundaries.
•    It is therefore easier to get support for adding security components to employers' existing training and continuous professional development and update programmes but the degree of "outsourcing" and "co-sourcing" means that the in-house skills to organise such additions are often lacking.
•    It appears (needs to be confirmed) that it is more effective to promote action on the part of those with budget and strategy responsibility via sector-based peer groups.

The Skills Gaps identified to date

•    There was favourable comment on the e-Skills "Learning Outcomes Draft"  as a check list to aid the assessment of recruits

•    The Generic Gaps, common to all sectors, found to date were:

o    Mobile: including identity, authorisation, data access, transactions and privacy
o    Big Data: both for detection and for protection
o    Cloud: including secure access and regulatory and liability issues
o    Website Security, including and the handling of abuse and impersonation
o    App Security, including the application of security by design disciplines
o    Collaboration across cultural and professional boundaries  
o    Process Control: alias SCADA, Internet of Things, Ubiquitous computing

•    The Sector Specific Gaps, albeit often with common underlying disciplines and technologies, were:
o    Putting risks into business context and justifying spend
o    Intelligence led Security: direction, collection, analysis, reporting
o    Access Control: who has access to what, under what circumstances
o    End User Skills and Processes: including for access control and authorisation
o    Vetting and personal behaviour
o    Identity Management: including individuals, organisations and devices
o    Authorisation Processes: including PCI-DSS, HMG, major suppliers/customers
o    Governance/compliance: inc. AML, KYC, SARS, Data Retention and Protection
o    Support for Small Firms, generic and those in the supply chains of large firms
o    Incident Response: damage limitation, notification, consequent liability, public relations etc.
o    Reporting: what to report to who and how, what response to expect.
o    Investigation: forensics, evidence collection/preservation, co-operation with law enforcement
o    Asset Recovery: local (not just in the UK) and cross border

Action Plan

Organise follow up activities to identify priorities, those willing to comment on their needs in sufficient detail to enable suppliers to address them, plus those willing to work together to achieve common objectives in identifying, recruiting and harnessing talents.


Please contact me if you already provide relevant training, are looking for it or would like to help organise and deliver relevant modules. I also remind you that a sector skills council needs to act as a clearing house for those looking at all levels (from end-user and SME, through pre- and post- graduate apprenticeship to continuous professional development) and all channels (from on-line moucs to personalised  face-to-face).   

There are serious business  opportunities in this space which are better addressed  by using the sector skills partnership and exploiting the evolution of e-Skills into the Tech Partnership In that context I also recommended reading the report on which current BIS cyber security strategy appears to be based . I do not agree with the emphasis on commerical opportunities with regard to the SME marketplace (unless the arguments elsewhere about the need for segmentation are taken to also apply to the SME marketplace) but it is, otherwise, more thoughtful and thought-provoking than most such studies.

My big concern is, however, that those who seek to recruit cyber-security specialists on the open market, as oppose to retraining existing long-stay employees, lay themselves open to recruiting skilled insiders who will unlock their defences without them ever knowing  who was responsible.

Younger generations will not have had the opportunity to read or watch "The Consultant"  written by John McNeill, one of the founders of Logica. It was supposedly based on a case study he used when advising clients on the risks of hiring information security consultants whose provenance they did not know.

Plus ca change ...

When IT fails to meet politics: why the non-discussions at the 2014 party conferences were so dangerous.

| No Comments | No TrackBacks
| More
 Antony Walker's summary of the differences between the Labour, Conservatives and LibDem conferences  on the TechUK website Is excellent but should  be read alongside a rather less polite commentary in the Register on the similarities between them. There are overlaps between the indivduals involved in the "Number One in Digital" exercise, (which he aptly describes as a "Beta version" of a policy study) and those who have volunteered to help the Conservative Technology  Forum Digital Infrastructure working group (the second of the CTF policy studies to get under way).  Both groups mix digital enthusiasts and political activists with "determined optimists" (scarred from trying to deliver improvements in practice), although the balance is different. 

The bigger differences are, however, within the parties.

They reflect tensions between the different interest groups trying to influence politicians of all parties. They particularly reflect a growing gulf between the lobbyists of currently dominant suppliers and the electorate - the users whose needs their clients claim to meet, while not listening to their concerns or, worse, patronising them. "You can tell some-one from IT, but will they listen."  

Most of the world is now on-line . It has lost its naive faith in the good will, let alone competence, of its current suppliers. Antony Walker may well be correct in thinking the Labour Party gives a higher priority to those who lack the skills to use conventional PC-based technologies but activists in all parties appear equally concerned about those who cannot get a connection or signal that is fit for purpose for transactions over mobiles. I was genuinely delighted with his perception of the embrace of a "Schumpeterian model of discontinuity"  within Conservative thinking (by original discipline I am an economic historian). But this can also be found within the other parties. Schumpeter, like Marx, believed in the death of capitalism and UKIP supporters would argue  that the Westminster village has sold out and only they believe in "capitalism not corporatism"

The similarities between the mainstream parties should facilitate co-operation in identifying who is lobbying for what and why. But we need to remember that the stakes may be even higher than the untaxed $billions currently haemorrhaging from the UK into offshore tax havens or supposedly being lost to piracy. We need to address the issues that divide the industry and set the "digital by default" and "big data" enthusiasts against the bulk of the electorate, (if research by IPSOS Mori is to be believed). We also need to address the  practical issues of delivery that set both Local Authorities and the "Silos of State" (and their respective Shadow  Ministers) against the Cabinet Office (and the Shadow Cabinet Office team).

For the second year running IPSOS  MORI and the Royal Statistical Society organised event at all three parties using data analysing public trust in various groups. This year the analyses distinguished between trust in organisation as a whole and trust in their ability and/or willingness to look after our personal data.  The "trust deficit" for internet service providers was greater than that for government and significantly greater than that for law enforcement. The shows clearly now much the public dislike and distrust the advertising funded business models of Google, Facebook and  Twitter but feel they have no choice.  That is a very dangerous position for even dominant players to be in. It helps explain why George Osborne singled out the tax avoidance behaviour of the technology companies 

Antony Walker mentions the LibDem enthusiasm for a Digital Bill of Rights. This appears to be shared across the rank and files of all parties (although the IPSOS Mori data  is not split by political allegiance). David Willetts led a very informal Conservative Technology Forum  discussion that was supposedly to be about Cybersecurity but homed in on the need to reconcile the privacy, surveillance, confidence and choice agendas in ways that would help position the UK as a globally trusted location of choice.

One of the more unpleasant messages for the ISP and Internet communities is that UK voters appear to trust GCHQ rather more than they do Google and to trust the Metropolitan Police (for all its problems) rather more than they do Microsoft. It also appears that they would prefer to support effective action against on-line predators than protect an increasingly illusory anonymity and support information sharing across government while being higly suspicious about sharing between industry players or between government and industry.
Were UKIP to offer user choice, in line with such priorities as part of a technology manifesto reflecting  views common to  ream which won them the European elections in May. the response of the other parties might well cause industry lobbyists  to pay rather more attention to the need for realistic responses to Sir Tim Berners-Lee's call for a Magna  Carter  for the web. He put that call into commercial and political context   in his address to the Lord Mayor, Aldermen and Common Council of the Corporation of London when he accepted  his honorary freedom  It was the first event I have attended as a Court Liveryman of the Worshipful Company of Information Technologists and it was good to see how well his challenging comments went down. His text does not appear to be available on-line (an odd piece of censorship given that, as part of the ceremony,  it was formally entered into the official roll of the City in front of several hundred  witnesses) but he built on the past role of London, working with its peers, from the days of the Hanseatic League onwards, in imposing international agreed standards of behaviour on the governments  of the day.
Another thread of discussion during the reception in the crypt undeer the Old Library after his speech, was the state of play with campaign being run to improve the quality and speed of broadband connections available to small firms in the City  That leads me back to a topic that was almost taboo at the party conferences: Broadband. When  I asked the audience at the informal launch of the CTF Digital Infrastructure study  if they were content with their broadband less than half a dozen hands went up. When I asked if the were fed up with their service, about 30 hands went up. The other half of the audience was disenfranchised, having a glass in one hand and a plate of sandwiches in the other. There is a strong groundswell of political discontent, particularly among those trying to put their SMEs on-line or to grow high tech businesses. 

There was similar frustration among those pressured to use "digital by default" public services over lines that freeze or go down when they try to download documents from government websites or complete transactions on-line.   It may be no accident that UKIP, which is said by many to be more effective than the mainstream parties in its use of social media, appears to be gaining strength in areas with poor broadband.  The digital infrastructure issues do, however go well beyond "mere"  broadband and my own views on the scale of change under way are now on record .

All three party conferences featured events on skills and training, particularly apprenticeships and the cost of education. The issue of employers who import skilled staff rather than train their own is another area where there was a disconnect between IT industry lobbyists and the party faithful.  Conservative and Labour MPs may express support in private for a "smart immigration" policy but few would dare do so in public - unless and until the concepts are fleshed out, particularly the means of deterring and reducing abuse, as with the group of "skilled programmers" with impeccable paper qualifications, who lost contact with their courier and were discovered to be almost illiterate, with little English and no computer knowledge.     

The pressures are mounting for an exercise which  addresses the reasons why we have yet another round of domestic skills shortages and (or rather mismatches) and finds constructive ways forward for a world in which career paths and R&D teams are increasingly global and UK universities depend  on fees from overseas students. Unless the mainstream parties find realistic policies which address both skills and immigration we risk pressure to add further layers  of  irrational, ineffective and counter-productive controls, which deter those whose skills and enterprise we want while allowing in those we do not.  Hence the reason the CTF 21st Century Skills working group is tasked to try to address the meaning of "smart immigration" as well as the means of breaking out of ground hog day.

Once again, however, this is an exercise that is much better addressed on an all-party basis and, as requested at the first meeting of the Digital Policy Alliance skills group, I have summarised the material I have on file in a submission to the current House of Lords enquiry  There are some obvious ways forward that could command consensus support across all political parties but these are incompatible with the current staffing models of several major  technology employers.  Hence the need either to persuade those employers to help pilot the business models of the future or to help their, as yet, embryonic future competitors put them out of business.

Perhaps that is where there is a real difference between the parties - "persuade" and "help" rather than "plan" or "regulate" . But, in practice, even that difference is more imaginary than real. Meanwhile UKIP would  argue that the big difference is that they wish to see such issues debated in public rather than behind doors in Westminster.

They will have that wish, because, for good or ill, the 2015 election campaign is now under way. Remember that those who do not speak out get stitched up. Join the party of your choice and be active including via their policy forums. 

P.S. I have just been browsing the most recent Yougov. Apparently over 80% think taxing Google properly would be a good idea but only 20% think HMG will succeed. Half support more Internet regulation and nearly 70% support more surveillance to help prevent terrorism. Interestingly while 60% feel that social media have had a positive effect on society, only 14% feel it has been very positive. I was surprised to discover just how well my own prejudices (alias well informed opinions) gell with the majority of Yougov respondents. I had thought I was more of a maverick but found myself in the minority on only a handfull of issues - some of which surprised me - such as the strong support for windmills.   

There is no shortage of cybersecurity talent - only of employers willing to retrain their existing staff or recruit trainees

| No Comments | No TrackBacks
| More
I have said this before and I will say it again, when I blog on the next stage of the work with which I have agreed to help e-Skills, but the objective of this blog is to draw your attention to some of  the FREE training available to upgrade the basic security skills of all staff, whether in large firms or SMEs.

BIS recently e-mailed its contact lists to draw to attention the launch of 3 new free cyber security online training courses, funded by the National Cyber Security Programme. These courses are aimed at all levels, from young people through to existing employees and, according to BIS, represent an excellent opportunity to develop skills in the IA arena.


Introduction to Cyber Security MOOC

The new Introduction to Cyber Security Massive Open Online Course (MOOC) will begin its first run on 13 October.  The free online course has been developed by the Open University in conjunction with BIS, GCHQ and the Cabinet Office.  It will cover subjects such as network security, the threat landscape, cryptography, malware and how to manage security risks.  The course is open to everyone - from young people considering study or a career in cyber security, to existing employees wanting to improve their knowledge and skills, or members of the public interested in staying safe online.
8 modules will be delivered over an 8 week period, with each module expected to take around 2 to 3 hours of study.  The course will be run 4 times a year for 3 years, and has the potential to reach 200,000 students in this time.
Thousands have already registered for the first run of the course, but the beauty of a MOOC is that there is no limit on the number of students taking the course.  This means that there is still time to sign up.  Click here to register or ask for more information
Cyber Security Training for Lawyers and Accountants

On 6 October BIS launched a free online training course to help members of the legal and accountancy professions protect themselves and their clients from cyber- attacks.  This will help UK businesses protect themselves from information breaches and other threats that could potentially cost them millions of pounds.
The course will increase awareness of common cyber risks and threats they may experience in the workplace and how to prevent and deal with them. It provides advice on how to safeguard digital information, raise awareness of cyber issues amongst clients and gives examples of how to deal with issues such as information breaches in the workplace. It has been developed by BIS in partnership with the Law Society; the Institute for Chartered Accountants in England and Wales (ICAEW) and Solicitor's Regulatory Authority and can be accessed online via the Law Society website.  The course takes around an hour to complete.
Responsible for Information Training for SMEs

Also launched on 6 October by the National Archives was a short e-learning course which provides guidance to small companies on how they can better protect their data and get to grips with the risks associated with information security. This builds on the successful public sector "Responsible for Information" training which has been delivered to more than 200,000 civil servants.  The course can be accessed online and takes around an hour to complete.


Find recent content on the main index or look in the archives to find all content.


Recent Comments


-- Advertisement --