Blogzilla

Can the world agree on free speech principles?

2012-01-24T23:39:00.001Z

Prof. Timothy Garton Ash and his team at St Antony's College have just launched their fascinating new free speech project, FreeSpeechDebate:

Ten draft principles for global free speech are laid out, together with explanations and case studies – all for debate. Prominent figures from diverse cultures, faiths and political tendencies are interviewed and asked to comment, through video, audio and text. We have Indian novelist Arundhati Roy on the media and national security in India; Iranian cleric Mohsen Kadivar on Islam and the criminalisation of insults to religion; Chinese academic Yan Xuetong on universal values; former head of the Formula One association Max Mosley on privacy with more to come… The entire editorial content is carefully translated into 13 languages, covering more than 80% of the world's internet users, by native-speakers of those languages (mainly graduate students at Oxford University). Anyone can then contribute to the online discussion in these or any other widely used languages, and there is a facility to give a rough translation of every user-generated comment into most languages using machine translation.

I have greatly enjoyed being an adviser to the project. Here is the two-part interview I recently did with Prof. Ash:

Giving evidence to Privacy and Injunctions Committee

2011-11-29T18:38:00.000Z

Yesterday I gave evidence to Parliament's Joint Committee on Privacy and Injunctions. I tried to explain the difficulties in stopping a specific piece of information appearing anywhere on the Internet, particularly in user-generated content and on social media platforms:

Internet freedom: EU v US

2011-11-12T11:04:00.000Z

A couple of weeks back, I was honoured to give the second seminar in George Washington Law School's distinguished speaker series on Internet Freedom and Human Rights. I discussed Europe's approach to this topic, on which there has been virtual silence in comparison to the debate stimulated by the US State Department.

GW has now posted a video of my talk. Thanks again to Professors Nunziato and Carillo for organising such an enjoyable visit.

ENISA reform at the European Parliament

2011-05-26T14:25:00.008+01:00

This afternoon I'm giving evidence to the European Parliament's industry committee at an expert hearing on the future of the European Network and Information Security Agency. Here is the text of my prepared remarks:

ENISA's role in light of current systemic cybersecurity risks

Last year, with my colleague Prof. Peter Sommer, I carried out a study for the OECD on “Reducing global systemic cybersecurity risk”. We assessed the likelihood and potential consequences of catastrophic failures of information system security, comparing them to other potential “global shocks” such as an international flu pandemic or further financial crisis. Our conclusion was that in the medium term, few single foreseeable cyber-related events have the capacity to propagate onwards and become a full-scale “global shock”.

This does not mean that individual cyber-related events could not generate a great deal of harm and financial suffering; indeed there are many examples where this has already happened. And European societies are becoming increasingly dependent on the availability of the Internet and related communications and computing infrastructures.

Bodies such as ENISA can play in key role in reducing these threats, and ensuring that in the longer term they do not develop into catastrophic global risks. Responses to such shocks limited to the level of the nation state are likely to be inadequate. Coordinated international activity is required, with all the associated problems of reaching agreement and then acting in concert. The European Union has a clear advantage in facilitating and coordinating Member State activity in this field.

The European Commission’s proposal for a regulation concerning ENISA contains a number of measures matching our own recommendations to the OECD, especially in supporting the Digital Agenda for Europe. I want to highlight three key areas: supporting the European Forum of Member States and European Public Private Partnership for Resilience; facilitating EU-wide cooperation and preparedness; and addressing market failures in security.

First: supporting the Member State forum and Public-Private Partnership.

Attacks on systems connected to the public Internet can originate from anywhere on that network. Vulnerabilities in software developed in one country and installed in a second can be exploited remotely from a third. Failures in critical information infrastructures in one nation can cascade into dependent systems elsewhere.

Member States and the private sector need to coordinate their efforts to enhance cyber security levels, develop safe and trusted methods for information sharing about vulnerabilities, block and deter attacks, and improve the resilience of critical infrastructure. Officials will need, if they are not doing so already, to plot out the dependencies of key central government and critical infrastructure systems. They will need to identify points at which computer and communications facilities may become overloaded during catastrophes and arrange for the provision of extra resource and resilience. They will also need to create contingency plans should large important systems fail. ENISA can support all of these efforts through its role in the European Public-Private Partnership for Resilience.

A further role is horizon scanning for future threats arising from changes in the broad cyber world. For example, Member States need to carefully consider the implications of outsourcing and cloud-based systems for the resilience of the services they provide, identifying any new interdependencies that result and how they would deal with catastrophic failure of third-party services. Contracts and Service Level Agreements need to include provisions on availability and liability for security breaches, as well as the geographic location of sensitive data and the level of access of third-party staff. ENISA has published a number of useful reports examining these issues in the last few years.

By procuring and operating more secure systems, governments will reduce the risk of exploitation and failure of their own critical services. They will also incentivise software companies, Internet Service Providers and other companies to create more secure products that can also be sold to the private sector.

All of these activities would benefit from cross-EU planning and support from ENISA in the European Forum of Member States.

Second: facilitating European cooperation and preparedness.

Most of the Member States now have effective government and industry Computer Emergency Response Teams. These CERTs meet and share best practice through groups such as the Forum for Internet Response and Security Teams. This also allows computer security engineers in different countries to get to meet each other and build informal relationships of trust. Such social contacts can, in an emergency, help resolve problems more quickly than via the official formal structures. ENISA could usefully support the work of such groups.

Just as has become common in the financial sector, regulators should conduct regular “stress test” exercises to measure vulnerabilities and ensure the resilience of infrastructure in the face of attack. ENISA can facilitate the European components of the international exercises that are necessary to fully test responses to global threats.

Finally: addressing market failures in information security.

Unlike much 20th-century critical national infrastructure, the Internet is almost entirely developed and managed by private companies. In the long run, the most important role of ENISA (and EU Network and Information Security policy) is to support policymakers in modulating the incentive structures that are causing market actors to under-protect systems. The technology is available to build a much more secure Internet. The key question to ask is why it is not being deployed, particularly in end-user system software.

Companies managing critical infrastructure have incentives to maintain continuity of service to their customers, but without some government intervention they may not be willing to commit resources to protecting wider interests of society. These include public confidence promoted by the general availability of shelter, electricity and gas, and telecommunications. Governments can use legislation, licensing and regulation to impose standards for security and resilience upon operators of Critical Infrastructure. This should become a core concern for regulatory agencies in the water, power, telecommunications, financial services and healthcare sectors.

ENISA can act as a centre of expertise to support the Member States and their critical infrastructure regulators, particularly in setting baseline security standards and modulating market incentives to encourage resilience. It can also usefully act as a centre of expertise supporting the Commission and groups such as the Article 29 Working Party of data protection authorities. This expertise is crucial to the success of highly technology-dependent policy goals such as the protection of Europeans’ fundamental rights to privacy and data protection.

If we are to make the Commission’s plans for “privacy by design” effective, it would be logical to task ENISA with developing urgent plans to ensure suitable standards and infrastructure are deployed, making use of the latest discoveries from EU research programmes. No other agency or regulator has a sufficiently technical EU-wide mandate to overcome the formidable structural obstacles that have so far prevented this from happening.

To conclude: ENISA clearly has a key role to play in the development of a secure and resilient European information society that protects fundamental rights. I can find much to support in the Commission’s proposal to develop its mandate.

Thank you for your attention.

Security and Privacy in Implantable Medical Devices

2011-04-06T09:10:00.003+01:00

Last week I was in Lausanne to speak at a workshop on Security and Privacy in Implantable Medical Devices. It was amazing to see some of the body sensors and actuators being developed by bioengineering researchers and companies. You can see my slides on privacy by design, but I highly recommend some of the other presentations — I was particularly amazed by the Chinese researchers growing tracheas using sheep as "in vivo bioreactors"!

Privacy, trust and biometrics in Bangalore

2011-03-21T06:03:00.005Z

If you're near Bangalore, you might be interested in the talk I'm giving this afternoon at the Indian Institute of Science on Privacy, Trust and Biometrics. This is a hot topic in India right now, due to the government's plans for a high-tech national identity database not so dissimilar to the one recently destroyed in the UK. Hope to see you there!

Hillary Clinton's Internet Freedom 2.0 speech

2011-02-16T11:50:00.007Z

Hillary Clinton gave a second speech yesterday on the subject of Internet freedom. Here is my response, written for Index on Censorship:

Hillary Clinton is right to say “the choices we make today will determine what the Internet looks like in the future”. The US government can have a long-term impact by supporting the development and use of technology in tune with her vision of the “freedom to connect”.

Such technology would make it easy for individuals to debate, organise and protest online without making it trivial for government spies to monitor and suppress those activities. It would widely distribute control, rather than concentrate it in government or corporate hands that can easily choose to extinguish speech — as Amazon did in throwing WikiLeaks off their servers.

It would certainly not come with surveillance functionality built in – as the US, UK and many other western governments require of Internet routers and telephone exchanges and would like to extend to social media sites.

In short: Clinton needs to make sure the Internet’s future public spaces look more like Tahrir Square and less like Tiananmen Square.

The Information Management and Technology Strategies of the NHS Executive

2011-02-15T16:41:00.013Z

This is a second document from Philip Virgo on the history of the NHS National Programme for IT.

THE 1992 & 1998 INFORMATION MANAGEMENT AND TECHNOLOGY STRATEGIES OF THE NHS EXECUTIVE (PAC 1999-2000/38)

Benefits

The key high level statement in Information for Health is:

"The challenge for the NHS is to harness the information revolution to use it to benefit patients"

We have taken this as the principal benchmark against which all investments must be measured. The core purpose of the strategy is to ensure that information is used to help patients receive the best possible care. The strategy will enable NHS professionals to have the information they need both to provide that care and to play their part in improving the public's health. The strategy also aims to ensure that patients, carers and the public have the information necessary to make decisions about their own treatment and care, to access efficiently and conveniently the services they need, and to influence the shape of health services generally.

In order to achieve these benefits the strategy commits to deliver:

Lifelong electronic health records for every person in the country;

Round-the-clock on-line access to patients' records and information about best clinical practice, for all NHS clinicians;

Genuinely seamless care for patients through GPs, hospitals and community services sharing infoimation across the NHS network;

Fast and convenient public access to information and care through on-line information services and use of telemedicine services;

The effective use of NHS resources by providing health planners and managers with the information they need.

These benefits when realised will improve both the quality and convenience of healthcare for the population.

The strategy breaks the work to be done in three implementation phases (1998-2000, 2000-2002 and 2002-05). Given that this seven year strategy was launched at the end of September 1998, the Committee may find it helpful to know our expectations of the key deliverables for:

December 1999
December 2000
December 2002, and
December 2005

together with a brief synopsis of the benefits to be delivered. Annex 1 sets out these expectations.

Performance Management

The NHS Executive will ensure that all Chief Executives are aware of the importance of all this as the fundamental underpinning of many of our other objectives such as achieving clinical governance. They will be performance managed against these plans. A process is being put in place which will relate local spend to local progress against the national targets. This will be closely monitored for each local community at Regional Level, with quarterly reporting nationally.

The full Local Implementation Strategies (plans) will be costed and identify how money from both the Modernisation Fund and other investment sources is being used for specific tasks.

Every effort is being made to clear away previous obstacles to progress, but we must take a long-term view and provide commitment to the NHS in terms of resources being made available in order to achieve our vision and get best value for money out of the investment.

Conclusion

The PAC Chairman suggested that benefits would be fairly measurable. We will be developing more specific measures of progress having assessed the full Local Implementation Strategies. Although we can easily measure results of activity such as the numbers of practices with network connections etc, the real test of all this is whether we have changed the culture and service environment so as to maximise the opportunities provided by information and communications technology to provide a modern and dependable health service.

The ultimate measures of success should be demonstrated through improved patient outcomes, and improvements in patient perceptions of the convenience and quality of care as measured through patient surveys.

Annex 1

MILESTONES AND BENEFITS

Date	Milestone	Benefits
Dec. 1999	Arrangements in place to ensure the NHS Continuity of service over the millennium 1999 copes with the millennium problem	Continuity of service over the millennium period
	Health Informatics Services established	Skilled staff able to support the development and implementation of Local Implementation Strategies for Information for Health
	National IM&T Education, Training and Development Strategy published	Direction for the development of information proficiency, professional development, and information-related learning opportunities for all staff.
Dec. 2000	Patients attending 10 per cent of Acute Hospitals to have integrated Electronic Patient Records that support electronic ordering of tests and results reporting, electronic prescribing and care pathways (Level 3 EPR)	Supports the delivery of better patient services, clinical governance, closer working relationships with Primary Care and supports the flexible management of services.
	All Health Communities have full costed Local Implementation Strategies [1]	By December 2000 all Health Communities should be implementing their Strategies for improving information. These will support Health Improvement Programmes, and Clinical Governance by addressing practical ways of supporting the delivery of joined up and patient-centred services across Health and Social Care organisations.
	Evaluation and dissemination of the work of Electronic Health Record demonstrator communities begun	To demonstrate as early as possible to the rest of the NHS the benefits and issues associated with the introduction of modern electronic record systems.
	National Advisory Body on Confidentiality and Security established	To provide advice and guidance on key issues in improving arrangements for ensuring confidentiality and security in the management of information about health and healthcare.
Dec. 2002	To have enabled primary care staff to take advantage of modern and well managed information technology and information services to achieve better and more consistent patient care.	Examples of the benefits [2] will include: Access to accredited information on treatments and conditions that can be shared with patients Ability to communicate more effectively with secondary care staff to support more efficient transfer of patient care and ongoing shared patient care (eg, electronic referral and discharge; on-line booking of appointments) Faster and higher quality of clinical communications such as test results, second opinions etc between primary and secondary care staff Better internal communications within general practices and primary care groups/trusts Faster communication between the Department of Health/NHS Executive and primary care staff (eg, medical alerts)
	Substantial progress in implementing integrated primary care and community EPRs in 25 per cent of Health Authorities	Either implemented, or agreed and funded plans for implementation of, systems that will deliver integrated information about patients to support better quality care. This will mean practice-based community Trust staff do not have to enter data twice.
	35 per cent of all acute hospitals to have implemented a Level 3 EPR	See above.
	Telemedicine and telecare options considered routinely in all Health Improvement Programmes	Clear assessments made of the benefits to be had from using telemedicine services as part of delivering the Health Improvement Programme priorities.
	A National electronic Library for Health accessible through local intranets in all NHS organisations	By enabling NHS workers within a local health community to have ready access to the National electronic Library for Health from their normal place of work high quality knowledge, eg, concerning guidelines, will be readily available.
	Information strategies as appropriate to underpin completed National Service Frameworks (NSF)	Starting with local implementation of the national cancer information strategy, local information strategies will be developed that support a "whole system" approach to providing better services across local health communities to support the roll-out of specific NSFs.
	Demonstrator Electronic Health Record sites have an initial first generation Electronic Health Record in operation	Community-wide Electronic Health Record demonstrators, and those sites demonstrating more focused aspects of Electronic Patient Records, to have disseminated good practice and lessons learnt.
Dec. 2005	Full implementation at primary care level of first generation person-based Electronic Health Records 100 per cent of acute hospitals with level 3 EPRs	Electronic Health Records (that can provide secure and confidential links to organisation-specific Electronic Patient Records) are in place and used to support the delivery of patient-focused joined-up care across local health communities.
	The electronic transfer of patient records between GPs	The electronic transfer of patient records from any GP practice to any other will improve access to relevant aspects of patients' histories and provide the basis for developing improvements in Electronic Health Records.
	100 per cent of acute hospitals with level 3 EPRs	See above.
	24 hour emergency care access to patient records:	The ability to access the key information from patients' records that is needed to support the provision of emergency care whenever it is required will improve the delivery of good quality care.

[1] Once these plans have been agreed between local health communities and NHS Executive regional Offices in spring 2000, we will have a precise picture of the local activity which will need to take place in each local health community. The sequence and detail of these activities will vary across the NHS as there is not a common starting point. We are clear that over the lifetime of the strategy the sum of all the activity must ensure that all the local health communities have accomplished the common nationally uniform targets.

[2] While many of these benefits are partly quantifiable and measurable, the most significant impact on both patients and the services offered will come through the cultural change and education of staff that will be associated with them.

NHS Executive

17 December 1999

Public Accounts Committee hearing on the NHS Information Management Strategy

2011-02-15T14:44:00.005Z

Philip Virgo has written an excellent summary of the continuing problems of the National Health Service's National Programme for IT. As useful background he has dug up the following evidence given to the House of Commons Public Accounts Committee back in 1999.

MINUTES OF EVIDENCE
TAKEN BEFORE THE PUBLIC ACCOUNTS COMMITTEE
MONDAY 1 NOVEMBER 1999

Members present:
Mr David Davis, in the Chair
Mr Alan Campbell
Mr Ian Davidson
Mr Geraint Davies
Ms Maria Eagle
Mr Barry Gardiner
Mr Alan Williams

SIR JOHN BOURN KCB, Comptroller and Auditor General, further examined.
MR JAMIE MORTIMER, Treasury Officer of Accounts, H M Treasury further examined.

REPORT BY THE COMPTROLLER & AUDITOR GENERAL: THE 1992 & 1998 INFORMATION MANAGEMENT AND TECHNOLOGY STRATEGIES OF THE NHS EXECUTIVE (HC 371)

Examination of Witnesses
SIR ALAN LANGLANDS, Chief Executive, NHS Executive, and MR FRANK BURNS, Chief Executive, Wirral Hospital NHS Trust, examined.

Chairman

1. This afternoon the Committee will take evidence on the 1992 and 1998 Information Management and Technology Strategies of the NHS Executive, the Report done by the Comptroller and Auditor General. We have before us Sir Alan Langlands and Mr Frank Burns. Good afternoon again, Sir Alan, and welcome back. You are a regular visitor. Now, you are familiar with our methods, so I will go straight into questions to get started on this. My first question for you is this: one of the essentials of any IT strategy is that it is based on systematic and rigorous assessments of the business needs. To what extent did you undertake assessments of the needs of the NHS at each level in developing the 1992 and 1998 IT strategies?
(Sir Alan Langlands) Well, I think it is important to recognise that each of these strategies was conditioned by the government policy at the time in relation to the NHS. The 1992 Strategy was drawn, if you like, from the previous Government's White Paper Working for Patients which introduced the internal market into the NHS and the 1998 Strategy was drawn essentially from the 1997 White Paper which talked of a different NHS with the internal market abolished and a greater emphasis than ever before on quality and the integration of services. In both cases, however, there was regular dialogue with people working in the Service and indeed people beyond the Service to assess needs. As far as I can trace it back, around the late 1980s and early 1990s there was systematic consultation with the Service, there were a number of working groups, there was a series of consultation documents and papers for decision that went to the then NHS Management Executive, there was discussion with Ministers, and there were detailed papers and detailed guidance documents issued to the Health Service. In 1996/97, again in the run-in to the 1998 Strategy, there was a lot of consultation and, if anything, I think it went wider with the clinical professions, with social services, with people working in the education sector and with the industry. That whole process of assessing the position, assessing the needs at that time was undertaken by Frank Burns, who is on my right, who spent about a year doing some of the early discussion and then 15 months on secondment in the NHS Executive taking this whole thing forward. The result was the publication of the Strategy Information for Health' in 1998 which captures the Government's current position on these issues.

2. Now, the Government has decided to support the implementation of this Strategy with the investment of about £ 1 billion, and paragraph 5.19 outlines that, but the Comptroller and Auditor General's Report points out that you did not produce an overall business case, assessing the costs and benefits, nor do you have a lifetime expenditure plan, so on what basis then did you assess that the investment was justified? I am actually referring to item 10, I think it is, in the summary. (Sir Alan Langlands) I think the investment of about £1 billion based on the lifetime of the Strategy, which takes us to 2005, is probably an underestimate given the sort of money that is likely to be spent in the NHS already on this subject. We are dealing here with a huge change, with a very ambitious Strategy. The Government are very keen to ensure that we move towards life-long health records for everyone, very keen to ensure that professional staff in the Health Service have 24-hour access to records and that they have information about good practice, and they are very keen to build on what is happening in other industries and other parts of government in relation to the use of network technology to spread information around the system quickly, so seen in the context of the sort of scale and the complexity of the Health Service, this is a massive investment. As I say, the figure is broad-brush. I think the key point here is that there is no intention of committing money or spending money until business cases are worked through for each component part of the Strategy so that the Government's line is to say, "This is the likely expenditure over that period, but each component of the Strategy will then be broken down and will go through the appraisal of the business planning process", and we are already doing that. I think there is a central point here that we see the Strategy as a sort of broad statement. We agreed with the Treasury that it would not be subject to a formal business planning process, but it was subject to expert review and it was allowed to be published on the basis that we would follow up with a very detailed performance programme management framework, which we circulated to the NAO, and it was agreed that we would have business cases for individual projects. We are meeting all of these conditions, so my point is, I think, that no public money is expended on this until we go through the correct procedures of each point in the process.

3. Well, I am sure others will come back on that, Sir Alan. You did actually sign off this Report or the Department did and item 10 says that the 1998 IT Strategy has no full business case.
(Sir Alan Lan glands) Well, indeed, and I am accepting that, Chairman.

4. Let me, if I may, just ask the Treasury about that. How can you justify expenditure in excess of 1 billion, not just 1 billion, without an overall business case?
(Mr Mortimer) Well, we are not doing that. We are insisting that all projects in excess of the Department's delegated limit need to be subject to a business case. What we have not done-

5. But a piecemeal one, by the sounds of it.
(Mr Mortimer) Well, taking one project at a time.

6. I thought that is what "piecemeal" meant.
(Mr Mortimer) We did not think it was sensible to insist on a business case for the whole of the Strategy, and we did agree the Strategy subject to the three points that Sir Alan has outlined, and one of those points, and we made it very clear indeed, was that all projects above the delegated limit required a business case and Treasury approval.

7. Again I suspect people will come back on that. Let me come back to you, Sir Alan. In the light of the delays and cost overruns on projects and programmes under the 1992 Strategy, which are noted in the Report at paragraphs 3.10 and 3.14, what confidence do you have that projects forming part of the 1998 Strategy will be delivered on time and to cost? This is a sort of fairly to-the-point current question really, I suppose.
(Sir Alan Langlands) Yes. I think the NAO Report, if you like, gives some confidence in that it is very clear that the 1998 Strategy is at this stage an improvement on the previous position. I am perfectly prepared to accept that there were some avoidable problems in relation to the 1992 Strategy, but equally I think running right through this Report is a sense of just how big and how complex these things are, how quickly technology is changing and I think it is unrealistic to think that everything in this field will go perfectly, so I do not expect the 1998 Strategy to be trouble-free. All of this is premised on huge technical change and also great behavioural change amongst staff in the NHS, but I think we have learnt a number of lessons. I think the Government is adopting a more directive approach in relation to the 1998 Strategy using earmarked money which was not the case before. I think that the performance programme framework that we sent you shows greater coherence than we had before and I think we are putting a much stronger performance management line in place and a much greater emphasis on local implementation strategies. We are trying to meet the NAO points on setting clear objectives, on mapping interdependencies, on monitoring expenditure. The criticisms that run through the Report in relation to 1992 we accept and we are putting in place as each business plan goes through the Treasury rigour on all of these points, so I think we have learnt a number of important lessons and I would like to think that we are no different in that respect from most other big, complex organisations in either the public or the private sector. The other thing that I think is very significant this time around is that on the publication of the 1998 Strategy by the previous Secretary of State in 1998 we had almost universal support from the professional staff at the NHS and I think there is a real feeling in the Service that this plan is there to support clinical practice and that management information and other sort of analytical information that we might need in order to plan and administer the Service is a by-product of that, so I have a strong feeling in clinical circles that we have got it the right way round this time.

8. That leads me to two further questions. One of the lessons learned, not just by the NHS, but by other government IT projects, is the need for the appropriate skills to be available. What have you done to ensure that the NHS and, for that matter, GP practices have access to the appropriate skills?
(Sir Alan Langlands) Well, this, as you rightly point out, is complicated in an organisation that employs a million people where nearly half of these are clinicians, half non-clinical staff. The first thing we have done is establish, if you like, this IT theme at the heart of clinical education. I have got a publication here which, just by virtue of having the labels for each of the professional training groups on the front, shows that we are dealing with almost 30 different groups, so we have got 30 different clinical groups hooked up to the idea that there is a need to imbed learning about health information in their undergraduate and postgraduate programmes. We also in relation to non-clinical staff are having early discussions with the University for Industry and with one of the main Health Service trade unions to try and encourage the generic skills development among all grades of staff. We have a national, being looked at in the next couple of weeks, a national education and training strategy. We are very keen that at a local level there is a named person responsible for education and training and we have developed tools for assessing, if you like, information and computer literacy at a local level. On the specific point about GPs, we have got a very clear programme linked to the implementation of GPnet which is a scheme whereby we will exchange information between GP surgeries and hospitals and we have built into our accreditation mechanisms for the first time for GP systems a requirement to include information about training, so investing, if you like, in the mainstream staff of the Health Service and investing in the skills of specialist staff who have already health informatic skills is our overall approach.

9. The next question is fairly straightforward: what improvements in healthcare and service will the public get for this £1 billion investment?
(Sir Alan Langlands) I think if you think of a world where we have electronic patient records easily accessible 24 hours a day, the key point will be access to information so that if you are taken to an A&E department, it will be possible to ensure that clinicians have your full set of records available no matter where you live in the country, and I think that is a huge change. I think there will be benefits, and they are very difficult to measure, but benefits to accrue from the notion that through electronic libraries and other methods the clinical staff of the Health Service will keep their practice up to date. We have some very specific programmes of information going on in relation to the Government's main priorities of coronary heart disease, mental health and cancer services which are aimed at tracking the speed with which people go through the system, aimed at setting and monitoring performance against national standards, for example, in relation to breast cancer and colorectal cancer and other cancer sites, and we are trying to improve the cancer registration process, so there are examples that I think will quickly have a direct impact on clinical practice and, therefore, ultimately benefits to patients both in terms of convenience and the sort of care they receive.

10. This is a question to which the answer can be as long as you care to make it, but since most of the benefits would be, I would have thought, fairly measurable, fairly clear cut at least, could I ask you for a note on this particular thing, setting out what progress you expect to make in terms of benefits arising from this investment'. Finally, I have to ask you this, it is almost required at this time of the year: the Committee reported in August that because of the millennium bug, 9 per cent of NHS bodies had a severe risk of material disruption, but what is the figure now?
(Sir Alan Langlands) The figure now, I think, published last week is zero. We have been given, if you like, the all-clear by the independent assessment process, Action 2000. We have one further return to come in from people in the Health Service dated the end of October and we have a final check, if you like, at the end of November, but the independent assessment and my current assessment is that there is no risk of material disruption in the NHS. We have checked more than 300,000 systems and we have spent more than £340 million in trying to tackle this problem, so at the moment we think we are very well prepared.

Mr Gardiner

11. Could I begin by asking the Treasury just so I am clear on the guidance that my understanding is that Treasury guidance sets out the importance of justifying programmes as a whole where there are a number of expenditures that are linked together. Is that actually correct?
(Mr Mortimer) No. I think that what we do is that we require business cases on projects above £1 million and to the extent that the programmes involve projects costing above that amount, then those business cases come to the Treasury and the Treasury give or deny approval.

12. That is not what it says here, but that is fine. Can I then ask, is it not the case that one of the findings of the Report on the 1992 Strategy is that one of the problems with that was that there had not been a sufficient business appraisal, a complete and overall business appraisal done across the whole project at the time?
(Mr Mortimer) I am not quite sure what point you are referring to, whether you are criticising the lack of a business case for the whole Strategy or

13. At the moment I am just seeking clarification and I do assure you that I am just seeking clarification.
(Mr Mortimer) Well, I can interpret your question in two ways. One is that you may be saying that the overall Strategy should have had a business case, and we did not think that that would be very sensible. We thought that all the important projects should be properly appraised individually and so we fell back on the arrangement of insisting on Treasury approval for individual projects above £1 million (whole life costs). There is also an issue because, of the six projects and programmes examined by the NAO, two ongoing programmes involved a large number of cases, but they all fell below the delegation limit, so the Treasury did not actually review any of the projects, so that may be your criticism. There is a case for saying there should be some form of Treasury review where there are lots of individual projects falling just below the threshold for each particular programme, but what happened was strictly in accordance with the rules operating at the time.

14. My understanding was that there was Treasury guidance that said it was important to justify programmes as a whole where there were a number of expenditures which were linked together and that that was actually done in correspondence with the NHS Executive. Sir Alan, perhaps you could come in at this point
(Mr Mortimer) Sorry, but I know what you are referring to now. It is true that the Green Book does say that, if individual projects are interrelated, then the proposals should be looked at as a whole. The view we took was that we wanted to examine the individual projects and, if there were interdependencies, these should be identified. We certainly are not saying that interdependencies should be ignored; they should be properly taken into account, but we thought that this could be done by looking at free-standing projects.

15. Sir Alan, would you care to add anything or subtract anything?
(Sir Alan Langlands) No. I think we have the same position and the important point I want to underline is that we are not jibbing at the principle of having to make a business case before committing new money. That is clear and accepted. Where we do differ in the interpretation of the guidance from the NAO Report, although if you look at paragraph 2.8 you can see the ambivalence coming through there as well, where we do differ is that we do not think it is necessary to have to go through a full-blown business case process for a strategy document which is essentially a general statement of direction covering a diverse range of issues. We prefer to get down to the detail and talk hard facts around specific projects.

16. Let me ask you this then: is it not the case that one of the possible benefits of an overall business case that demonstrates precisely the benefits of doing the project as a whole is that you can use it to persuade the NHS bodies themselves to put in the required investment'?
(Sir Alan Langlands) Well, I do not think so. The business case process on that scale, if it were possible, and I honestly doubt very much if it is possible, I cannot read our existing Strategy and think through step by step how that could be converted into the option appraisal business planning process, but if it were possible, I think the end result would be a technical document, the sort of thing that the Department of Health sends to the Treasury all the time, which would have no chance of winning hearts and minds in the NHS. The key points, the sort of points I have been labouring about faster access and integration of services, the things that the Government wants to highlight at the moment would be lost in a sea of detail, so the idea to get the strategic direction out, to use that to condition behaviour, commitment and involvement of people in the NHS and then to work through each part of the Strategy in a detailed way, again I am not disputing the need for that technical work to be done, but it is the point at which it is done that is the key difference between us.

17. One of the criticisms in the Report is that links between the projects in the 1992 Strategy were not stated in the individual project business cases and as a result of that links were lost and it was difficult to demonstrate the value to the NHS bodies themselves. You would reject that as a criticism of the 1992 Strategy, would you'?
(Sir Alan Langlands) No, I do not reject that because the interdependencies here are very important. In fact, there are interdependencies with other things as well, with staffing issues and the Government's strategy on trying to improve clinical quality that go beyond the strategy. These are very complicated issues. I am sure that the 1992 Strategy did have a number of interdependencies in it. I am sure that these were not always adequately drawn out in the way in which the direction was set and discussed with the Health Service and I am happy to accept that as a criticism. I do not think it will happen this time for two reasons. One is that we are putting a higher premium on very detailed local implementation plans which have to make the connections from a patient's perspective and a clinical perspective. Prefacing each of our individual business cases we are going to have a map that shows the linkages and we are over-arching that with a programme and performance management framework' which did not previously exist. This is much more of an interventionist approach, a driven approach, a controlled approach than we had in 1992. So my contention is that we have learned our lessons. We are trying to incorporate them in the way we do things this time.

18. Let me try and restate that in order to see that I have understood you clearly. You agree that there were failings in the 1992 Strategy. You accept the criticism that was made in the Report which is that linkages were lost and opportunities and therefore costs were incurred as a result of that, but the specific way in which the 1992 Strategy is criticised, that is for not presenting an overall business case that could have made those links at the beginning you say will not result in the same problems this time because you are building it from the base up and you are developing those links from the base up. Is that a correct understanding of what you are telling the Committee?
(Sir Alan Langlands) I think there are two things I would disagree with. One is, I do not think we lost ground on costs or cost control as a result of perhaps missing some of the interdependencies. Two, I would not as a uniform point say that everything in 1992 was wrong because I do not think it was. Without it we would not have some of the important building blocks that we need now. My last point is not to suggest that everything is now bottom-up but to suggest that is an important part of an approach which is bottom-up in terms of local implementation plans and top-down in terms of an agreed national programme, probably with national mandating of certain parts of the strategy and national control of not all but a lot of the new expenditure in this area. So it is top-down and bottom-up which I think is probably the only way of handling it.

19. You said there that you disagree that costs were unnecessarily incurred in the 1992 Strategy. Is it correct that the NHS Executive did not monitor costs incurred by the NHS bodies in implementing the programmes of the 1992 Strategy and overall NHS expenditure on the 1992 Strategy is not known?
(Sir Alan Langlands) Some of it is known, as the Report sets out.

20. I said overall expenditure is not known.
(Sir Alan Langlands) Overall we still do not monitor the detailed expenditure of individual health bodies on IT.

21. So how can you be confident that no costs have been incurred that should not have been had the links correctly been made if you do not know what the overall costs are?
(Sir Alan Langlands) We can be confident from a national point of view. We would expect local people to be confident about their local position and to be tracking and assessing that. All of these local bodies are subject to detailed audit processes. None of them in this period had their accounts qualified as a result of any problems of that nature.

22. So what you are telling me is the information is all there but nobody has actually drawn it all together, is that right? (Sir Alan Langlands) There is information there. It would be a huge task to draw together on behalf of the whole of the NHS and, indeed, every study that is made of this by the Audit Commission or by the NAO Report is sampled. The NAO Report is based on visits to four per cent of the total health bodies in the country, 20 organisations. The other 96 per cent will probably reflect the same patterns and the same problems, but to get into the other 96 per cent in detail would be a major task. We are doing it at the moment in relation to the absolute detail of the year 2000 and we are checking a register of 300,000 systems. It would be impossible to cover the waterfront from one national organisation. We would be paralysed by the monitoring and we would not achieve any action. 23. I think the difficulty I have with what you are saying is that you are saying that the 1992 Strategy did not actually have any overall control of the expenditure, it did not have that information. One of the nice things about the brief that was circulated to Members today was it suggested that one of the session objectives might be to help the NHS Executive to avoid similar problems with the 1998 Strategy. The way that this Committee works is critical. It seems there is a role here for drawing lessons out of 1992 and hoping that they do not recur. I think what you are telling me is that the lessons that the Report draws about this aspect of the failings of 1992 either have not been learned or not agreed with but that is not going to be different in 1998 and that concerns me. Are you going to have overall expenditure control for the 1998 Strategy? (Sir Alan Langlands) Yes. My comments relate to 1992. What you have to remember about 1992 is that we were operating in the Health Service an internal market. There was very little direct control over the activities of trusts who are the main groups involved in this process. We were monitoring against three or four national financial parameters. This time round, as I said to you at the beginning when we were talking about bottom-up, •we are going to have local implementation strategies for the national strategy drawn up by 100 health bodies around the country coordinating the activities of 400 and these are going to be costed. So for the first time we will have a handle on this at a local level and at a national level a handle on the additional resources that are likely to be allocated over the next five years.

24. Do you have any firm expenditure plans for the 1998 Strategy?
(Sir Alan Langlands) Yes, we will have.

Mr Gardiner: Thank you.

Chairman: Mr Davies?

Mr Davies

25. Before coming to Sir Alan can I just ask for a confirmation from the Treasury on a point made earlier. Was it the case that the Treasury said there would be no business plan for expenditure under £100 million? (Mr Mortimer) No.

26. What was the threshold? I must have misheard you.
(Mr Mortimer) The threshold for the 1992 Strategy was business cases were required for projects over £l million.

27. Thank you very much. Sir Alan, there are wide and ambitious headings for the strategy to embrace up until 2005, but it strikes me from listening to you that you have got no real idea about how much more than £1 billion we might spend on IT by 2005. Would it be reasonable to say that in your view there is some probability that we might spend £2 billion by 2005?
(Sir Alan Langlands) It is possible that we might spend more than fl billion, but that would have to be justified at each stage by clearing business cases through the Treasury. So my first point is that the £1 billion relates to a national figure. It is being tightly controlled in the Department of Health. It is only allocated against approved business cases. in the five-year period until 2005 it could be less than £ 1 billion or it could be more, but any variation from that figure would be as a result of conscious decisions.

28. There is a list of infrastructure projects in terms of NHS numbers, e.g. administrative registers, NHS networking, GP health authority links. I assume you have allocated that £ 1 billion which has been earmarked according to those headings with some justification or is it still a bit vague?
(Sir Alan Langlands) We have allocated it this year. Ministers have yet to take decisions on next year and subsequent years.

29. Which of those headings do you think is most likely to be overspent?
(Sir Alan Langlands) I do not think they will be overspent because the emphasis will be on tight control of these funds.

30. The impression I get from listening to you is that the hearts and minds of the new Government are behind the Health Service, IT is very important, etcetera and £l billion out of the extra £21 billion the Government has promised is relatively small. Are you operating on the basis that money is easy and if you need it you can ask for it and if you spend £1.5/2 billion that will be alright, because that is what I am hearing?
(Sir Alan Langlands) I am certainly not operating on that basis and money is not easy and the £l billion does not relate directly to the £21 billion because they are both operating over different timescales. The timescale for the £21 billion that the Government are adding to the Health Service budget is for the three-year period of the Comprehensive Spending Review this year and the next two years. The £l billion, which is an estimate, stretches until the year 2005 and is subject to detailed applications through business cases to draw that money down for the Health Service. I am certainly not blasé about it.

Chairman: I am afraid we cannot stretch the answer any longer. We have to go and vote now.

The Committee suspended from 5.08pm to 5.11pm for a division in the House

Chairman: We will restart. I will ask Mr Davies to carry on.

Mr Davies

31. This Committee has seen a long chequered history of IT management in terms of national insurance systems, passport systems, Ministry of Defence systems which have been very costly and chaotic, gone over budget and not been within the time constraints of those contracts. Have you learned any lessons in terms of IT management from other government departments making such a hash in this area?
(Sir Alan Langlands) I think we have learned a lot of the lessons that are rehearsed in this Report around project management. We have learned some lessons of our own over the years. Some of the issues that we have had to deal with in this Committee in relation to NHS computing have been to do with accountability and propriety, but others have had to do with the need to match hard developmental systems and infrastructure kit with softer investments in training and development. Others have been about the rigour of the business planning process and the project management process. We are learning all the time and we will look carefully at the problems that others experience not just in the public service but in the private sector where these things do not surface so clearly as they do here.

32. Is there any coherence imposed from the centre on the thousands of systems you have got in place or is it very much up to the local authority to make decisions and therefore a mixed bag?
(Sir Alan Langlands) I think until now issues of procurement have often been localised and as I said earlier, we have lived through a time when delegation was the name of the game in the Health Service, devolution of responsibilities, but we are looking at the moment at procurement in some detail on a whole NHS basis. We are having discussions with suppliers about a different form of PFI. We are having discussions with the CCTA about being able to draw on government catalogues for systems. We are thinking of piloting a collaborative procurement from an agreed short-list of suppliers so that local organisations have some discretion but limited discretion. A lot of this is happening in the NHS Executive itself. A lot of it we are getting support on from something that has been set up in the Treasury called the Public Sector Productivity Panel. So we are drawing through that group expertise from the public and the private sector to smarten up our act.

33. That is good to know. Do you think there is a danger in terms of the in-built obsolescence of the PH/IT contracts insofar as you commit the public sector to ten or 20 years of payments for a service and then because of other shifts such as the behavioural changes in the community you end up with an obsolete service that could be provided at a quarter of the cost and bad value for an inappropriate service?
(Sir Alan Langlands) There may be if they are badly handled, but we have no evidence of that. I used the term PFI in the broadest sense. What we are really looking at here are different foims of public-private partnership.

34. Fine, PPP. What I am getting at is that there is in-built modernization into your contract specification for service delivery so these services will not become out-of-date.
(Sir Alan Langlands) The broad point I am trying to make is that we are operating on a different basis. I think we are discussing PFI here soon. We are operating on much shorter timescales to accommodate advancing technology.

35. I have two points to make. One is that IT is moving so fast that something you buy now will be out of date in ten years' time. The other is the nature of services to the customer. Because he/she may have different needs the demographic profile will be different. Have you put things in place so those adjustments can be made?
(Sir Alan Langlands) These are precisely the points that are being studied by our own group and by the productivity panel. The short-term issue is important both from a technological point of view and also in terms of keeping our own clinicians on board, the leading edge of whom are very up to speed on the technology. As the generations change the constant demand from GPs and the others working in the Health Service is to have the most up-to-date systems we can offer. So that point is a good one and is being taken on board.

Mr Davies: Thank you. I will leave it there.

Maria Eagle

36. Was the 1992 Strategy a success?
(Sir Alan Langlands) I think it was a success to the extent that it established some very important bits of infrastructure that have allowed us to build and move forward. I think there are, as I acknowledged right at the beginning, some shortcomings and some problems which are highlighted in the Report and which I acknowledge.

37. How do you know all that if you have not evaluated the outcome of the various projects? Is it just a general impression you get?
(Sir Alan Langlands) Because we know what works in practice. The point of evaluation is raised in the Report. I do not want to duck it. It is our intention to evaluate, but we can only evaluate at the point at which a system is working. The NHS Number, for example, in its early stages could not be evaluated.

38. Are you saying that you cannot evaluate the Number or are you saying that you cannot evaluate the project? There is a difference.
(Sir Alan Langlands) I am saying that we cannot evaluate the effect of the project in day to day use until we have-

39. That is because it is not in day to day use.
(Sir Alan Langlands) Well, it is in day to day use to the extent that 74 per cent of the activity now in the hospital sector is based on the latest figures of people using the NHS Number.

40. Is that administratively or clinically?
(Sir Alan Langlands) Both.

41. Both?
(Sir Alan Langlands) Yes.

42. So 74 per cent of all activity in the NHS relating to correspondence about individual patients is based on the NHS Number as a sole identifier of the patient?
(Sir Alan Langlands) In the hospital service.

43. In the hospital service?
(Sir Alan Langlands) In the hospital service, not in the NHS as a whole, not in general practice.

44. Certainly not in general practice because it is them that are not using it, is it not?
(Sir Alan Langlands) Some are using it. Those that are, if you like, the leaders in relation to the development of NHSnet are using it but they are not all using it yet. This is an ambitious project.

45. You have not evaluated the success or otherwise of NHS Number. That is accurate, is it not?
(Sir Alan Langlands) It is accurate but it is our intention to do so.

46. When?
(Sir Alan Langlands) At the point at which we think that we can evaluate it in use.

47. This seems to be circular. You will not evaluate it until it is being used and it is not being used so you will not evaluate it.
(Sir Alan Langlands) But it will be used.

48. How can we tell whether the project is a success or not?
(Sir Alan Langlands) If the traffic that I am talking about, and I am putting a figure of 74 per cent on it at today, started as traffic in April 1996 with a figure of 16 per cent, that seems to represent progress to me, that we are embedding this system and this way of doing things in the NHS over time and discarding the previous systems.

49. It sounds as if you are only going to be willing to evaluate it when you can come up with a positive evaluation. That is what it sounds like.
(Sir Alan Langlands) I think that the use of the Number, which has absolute support in the clinical community as a key to not only ensuring the transfer of infoi illation but the safe transfer of information in terms of protecting patient confidentiality, replacing 23 previous systems or previous formats, is something which will be successful and that will be successful in order to move this on. I have no doubt there will be points where we could learn about the implementation of that change, and I have no doubt we will be able to identify some faults that led to delay or some faults in communications or in the way we handled the training and development of staff that contributed to this taking longer than expected.

50. Sir Alan, you accept that you have not evaluated the success or otherwise of NHS Number, for example, that element of the 1992 Strategy?
(Sir Alan Langlands) That is what it says in the report and I accept that point.

51. You accept that. I am glad you accept that because that is what it says in the report. In Appendix D there are some examples of impacting problems that reduce the impact of the projects and the programmes examined. If you turn to page 65 this relates to NHSnet which is another project that you have not evaluated yet. Yes?
(Sir Alan Langlands) Yes.

52. If we look at paragraph 11 it says that there are 361 organisations connected to the Net but nearly all of them are health authorities and acute trusts. Less than ten per cent of GP practices are fully linked although there are some GPs who are. How can something like NHSnet possibly deliver what is expected of it in the 1998 Strategy if primary care and GPs are not linked to it?
(Sir Alan Langlands) It will not.

53. It will not?
(Sir Alan Langlands) It will not but GPs will be linked. One of the early commitments of the Government post-publication of the Strategy is to achieve GP linkage using NHSnet which will be a secure internal system that will allow information to be passed through different parts of the system. We are working on a very detailed project at the moment to draw GPs into that system.

54. You appear in giving some of the answers that you have given to me this afternoon to be in part evaluating the success or otherwise of these individual projects. If you can sit here and tell me that 74 per cent of transactions, as it were, in acute hospitals at the moment use NHS Number and the report can tell me how many organisations are connected to NHSnet, why are you not in a position to evaluate the overall impact of the project? It seems that some of the information you are giving and some of the information in here is doing just that.
(Sir Alan Langlands) I think we can to the extent that we know how much we have spent on it nationally. We can to the extent that we know how many people are hooked up. These are basic bits of information but for me that does not represent a proper evaluation of the project, of what went wrong, what went badly and what some of the costs and benefits might be, for example, in terms of doctors or nurses having to process fewer bits of information. The trouble is you cannot have just one of these things, you have to have NHSnet, you have to have messaging systems in order to use the Number to exchange information in a meaningful way between different parts of the system.

55. Of course, that is absolutely true. When one looks at the 1998 Strategy, I am not sure to what extent it is virtual reality, it represents a fantastic vision if it can be achieved.
(Sir Alan Langlands) Yes.

56. The point is that if one element of it falls down it will not be achieved. How are you to learn from the 1992 Strategy if you are not evaluating what has gone right and what has gone wrong? It rather gives the impression that you are feeling around in the dark and hoping that it will all be already by 2005.
(Sir Alan Langlands) We are absolutely committed to a process of evaluation. I think there are some imperatives, if you like, to making this whole system work. There are imperatives around language arid the use of clinical terms, a discussion we have had here before.

57. We have.
(Sir Alan Langlands) Which is subject to a very detailed three stage evaluation process. The NHS Number is an essential building block. The network and the ability of people to use the network is an essential building block. All of these things have to be put in place.

58. It is quite clear from previous experience, and I think that the NHS Executive has had a lot of experience in attempting to implement IT changes and systems, not all of it happy.
(Sir Alan Langlands) Some of it more than ten years ago.

59. Yes.
(Sir Alan Langlands) The notion that that is allowed to drag into 1999 is just ludicrous.

60. Not all of it happy. I am suggesting that one can learn from mistakes. I was not having a go at some of the previous reports that you have been in front of us about. You now have had a long experience in the NHS Executive of implementing IT schemes, systems, strategies, whatever.
(Sir Alan Langlands) Yes.

61. And actually trying to do it. You have had successes and you have failures and of course you end up here when you have failures. You know as well as anybody that one of the big problems with implementing IT is slippage, missed milestones. If you look at page 33, figure 6, relating to the 1992 Strategy you can see there a diagram which indicates some of the slippage that there has been against original milestones of the projects in 1992, some of it significant. If we then look at the back page of the Executive Summary of Information for Health, which is the vision thing that has been sent out to clinicians, etc., there are some pretty ambitious targets there I would say for implementing to a significant degree high levels of the 1998 Strategy. For example, in the medium term, by March 2002, everybody should be using NHSnet for appointment bookings, referrals, radiography, laboratory request results in all parts of the country. That requires all GPs to be signed up for a start off.
(Sir Alan Langlands) It certainly does.

62. Do you think that this implementation programme and the timetable set out there is ambitious or do you think that it is achievable?
(Sir Alan Langlands) I think that it is ambitious. I think it is achievable if it is funded and if there is focused and systematic management of these changes at both a national and local level. The point I think I would want to make in relation to figure 6 and the table of objectives you are looking at is that experience in the past suggests that some of these things may slip because of some sort of management failure or some misreading about how a new system or new approach would be handled in the Health Service but some of it "slips" for very good reasons.

63. Like the Read Codes not working, for example, that would cause some significant slippage, would it not?
(Sir Alan Langlands) I think that they are working. My confident prediction is that the Read Codes linked to the new arrangement with SNOMED, the new partnership, which is an equal 50-50 partnership, will result in a universal language for health care and health care information around the world. People all over the world are looking at the SNOMED Read work.

64. When is the SNOMED Read work to be completed'?
(Sir Alan Langlands) And are envious of it.

65. When is it to be completed?
(Sir Alan Langlands) The new work will be completed by the end of 2001.

66. So it will be Read SNOMED, the new whatever it ends up being called, I hesitate to think of an acronym.
(Sir Alan Langlands) It will be called SNOMED Clinical Terms.

67. SNOMED, the "Read" is being quietly dropped?
(Sir Alan Langlands) Not being quietly dropped, being deliberately dropped. Clinical Terms is the UK standard that we are using.

68. To what extent do you expect there to be slippage in this ambitious implementation programme which I have got in the Executive Summary but it will be in the full document?
(Sir Alan Langlands) I cannot predict to what extent there can be slippage. What I can do is ensre that there are effective programme management and project management systems in place. I cannot predict because I really cannot predict the extent to which funds will flow into these projects. I cannot necessarily predict complications down the track in terms of problems with suppliers, in terms of winning the commitment of health professionals to the changed process. That is not an excuse for not trying and not pursuing these things as vigorously and as systematically as we can.

69. Do you believe as a result of your experience on the 1992 Strategy that the correct lessons have been learned for the 1998 Strategy?
(Sir Alan Langlands) I think important lessons have been learned. I think the report we have before us acknowledges that.

70. Do you think that despite the fact that there are now some good trends in the sense that you now do not have the internal market and competition which means that everybody is keeping themselves to themselves and not necessarily wanting to co-operate, that there are some long-term trends that mean that this kind of thing may be operating in a more friendly environment? Do you believe that even with that friendlier environment and the promised funding of a billion pounds, although I noticed you said that it was probably an under-estimate and you appeared to say to the Chairman right at the beginning that it was basically a figure that was plucked out of the air, or that was how your comment came across to me,--
(Sir Alan Langlands) I can tell you the exact basis of the figure if that helps.

71. Yes.
(Sir Alan Langlands) The working assumption of Government at the moment is that there is an allocation of 70 million this year, an allocation of 175 million next year but that is yet to be confirmed with ministers who are taking a look at the overall Health Service budget and do not make allocations until probably later this month, and then in the following three years, which takes us up to 2005, the figure goes up to 275 million. So the end result, if you like, is an injection of 275 million per year made up of these three components.

Maria Eagle: Unfortunately I have run out of time so I cannot take you up on that.

Mr Williams

72. How will you achieve the long-term objectives in the context of the three year spending review?
(Sir Alan Langlands) The theory of the three year spending review is that that gives you greater certainty. We have found in developing this strategy that without working on a period of five to seven years we were in difficulties so we have had to make broad estimates. As I have said before, each of these components will be agreed and approved by the Treasury on a regular basis. There is a general point about the NHS and the comprehensive spending review and that is simply that whilst money is allocated on a three year cycle the biggest variable, given that we spend 80 per cent of our money on staffing, the biggest variable, which is pay, is still negotiated on an annual cycle. So when I say that ministers have yet to take a decision in relation to next year's expenditure on IT that is partly because they do not know what the pressures on the NHS might be next year in relation to pay and in relation to other things that are new. For example, we have just spent 153 million on a new meningitis vaccine which we could not have predicted would be available and ready for use this year. We are having to look at these things stage by stage in the real world.

73. As Geraint Davies said, quite rightly, and we understand the predicament, when you are dealing with rapidly changing technology you cannot envisage what is going to become available in a relatively short time in the future and this seems to make it very difficult for you to plan any more effectively in the next period than you did in the last.
(Sir Alan Langlands) I think certain things are happening that are important. Firstly, the people working in the Health Service as the generations change more and more come through a school and university system where the use of information technology is the norm. So, if you like, having had a problem in 1992 that said one of our difficulties was training people to use these systems effectively, we now can find ourselves in a position where staff arriving straight out of medical school or nursing school or university are saying "we want the most up to date system as quickly as possible, please" or "we worked in X hospital which seems to have very good systems and we are now in Y hospital and we have been driven back to paper based systems". There is a huge pressure to change from the NHS staff and 1 think a realisation that the use of this technology helps people. It saves on doctors' time, it saves on nurses' time. There is a motivation there that was not always there. Equally, I think it is ludicrous to suggest that the NHS can remain the only organisation where you have to tell the organisation every time you have contact with it what your name, address, postcode and everything else is. This should be once in a lifetime information. The system needs to be made simpler from the public's point of view. The other point that I think is really crucial at the moment is the speed with which other forms of science and technology are developing means that we have to have very good systems for keeping our staff up to date so that the latest advances in medicine, drugs, guidelines and standards are available to them in a digestible form. It is a huge sea change that we are dealing with here.

74. That I well understand. I am not saying this critically but that makes me increasingly dubious as to the idea that there can be any sort of long-term certainties, objectives, that themselves do not need to be varied in the light of technological change, not just IT change.
(Sir Alan Langlands) I think there can be a direction of travel for the long-term and the relatively short-term, five or six years, which is what the Strategy is, but I think we have got to be shrewd enough to adjust that and improve it and develop it in the light of changing circumstances. This process of strategy development in business planning and investment decisions requires a constant iteration to make sure that we are always making, if you like, up to date decisions and that does add to the difficulty and some of the uncertainties.

75. If I ask you just straightforwardly, did you get a billion pounds worth of value out of the expenditure since 1992, could you tell me?
(Sir Alan Langlands) The figure of a billion pounds does not relate to 1992. The figure I think quoted in the NAO report is something like £152 million. I could tell you in terms of some of the points that Ms Eagle was raising with me. I could tell you in terms of some crude numbers but I do not think I could tell you in terms of how it has changed the life of the average nurse. I can think of practical examples where nurses say to me that they are spending a lot less of their time transcribing information from one document to another. just in Warrington Hospital last week I saw a nurse in the orthopaedic ward taking down detailed patient notes on her little lap top as she went round the ward, feeding that information into her nurse record system, communicating with the social care department on discharge, communicating with the orthopaedic consultants about the timing of surgery. She can say it has transformed her life. At one level I can give you anecdotal examples, at another level I can give you broad national figures, but getting to the heart of the real value of these things can only be done on a whole Health Service basis at a local level. That is one of the reasons why we are putting such a premium on these local implementation plans which have to link to education, evaluation, proper project management.

76. We looked previously at HISS and RISP and in the case of HISS you were saying it was successful but what emerged was that after an expenditure of 106 million, if I remember correctly, we were getting a three per cent rate of return on it which was very low at that time, How can you tell this Committee with any certainty that we have had value for money out of what has been spent since 1992?
(Sir Alan Langlands) I do not think I can tell you with any certainty but I think I can tell you that the infrastructure projects that we have pursued have real value in relation to allowing us to build for the future. I think I can tell you that national expenditure on these things was pretty tightly controlled and they were subject to some rigour. In figures 5 or 6 of the paper we score something like 80 per cent against the Treasury's criteria. I think I can tell you with some confidence, supported by the NAO, that the 1998 Strategy has learned some lessons from the past and that in itself has a value.

77. But, as Maria Eagle pointed out, we are told by the NAO that the NHS Executive did not monitor the costs incurred by NHS bodies in implementing the projects and overall NHS expenditure on it is not known. That does not seem consistent with any sense of control and certainly with any meaningful pretence at value for money. (Sir Alan Langlands) I can tell you about the national projects, the 152 million mentioned in the NAO report, but it was not the way from 1992-97-- we have had this discussion many times here—of the then Government to want to monitor the detailed actions of every health trust in the country. In fact, monitoring was confined to very few financial parameters which did not include capital expenditure on IT and did not include a set of accounts that broke down the expenditure on infoimation and IT services. What we are left with are the broad sample NAO and Audit Commission estimates of the percentage figures that appear at the front end of this report.

78. Is there any logic in the fact that if you are not having monitoring there is a greater justification for going to earmarking so that at least you have some control over where the money goes?
(Sir Alan Langlands) That is the logic that has been taken up in the post internal market world. The logic since May 1997 has been to earmark monies, labelled generally in the Health Service "The Modernisation Fund", but in particular to earmark a slice of money to allow this new 1998 Strategy to be pursued. Alongside that, we have in place a mechanism asking people in local health economies, if you like groupings of the health authority, the relevant trusts, the primary care people and a working relationship with social services people, to produce their costing plan for how they will implement the 1998 Strategy. So top down Modernisation Fund earmarked funding to hit precise objectives; bottom up a disciplined process of planning locally that shows how these things can be moved forward. That is the approach that is now being adopted but that approach was not involved between 1992 and 1997.

79. Why was it not a natural corollary? As I say, if you are not monitoring there is a greater temptation to impose a discipline through the earmarking process.
(Sir Alan Langlands) These were not the decisions that were made. The emphasis was on limited monitoring of NHS trusts and the vast majority of the money that was allocated to the Health Service being allocated to health authorities in the headline growth figures. So, if you like, it was not siphoned off or set aside at the centre as a central budget apart from the 152 million that was mentioned in this report. There was a little bit of that sort of earmarking going on to support these points of national infrastructure but it was not a wide scale approach.

80. With the absence really of the two, and the NHS Executive allocated additional funds but the funds were not earmarked we are told by the NAO and you have agreed that it was not the policy to monitor, I still do not quite see how these two situations are in any way compatible with you being able to sit there as the Accounting Officer and give us assurances about value for money when you do not even know what the money was spent on.
(Sir Alan Langlands) I can give you assurances about value for money in relation to the 152 million that was the central budget. Assurances about value for money at a local level would have to come, and did come, in the form of audited accounts and annual reports from the chief executives of boards and trusts. That was the way the Health Service was run. I was behaving perfectly reasonably within the policy set by the Government of the day.

81. A final question, and my apologies if the Chairman asked this earlier on while I was outside. The NHS bodies criticised the lack of practical support given by the Information Management Group, why did that happen?
(Sir Alan Langlands) I certainly do not think it happened deliberately. I think the Information Management Group did produce a whole number of very useful publications that if every single one of them had been read and acted upon by people working in the Health Service, this could have moved things on. Bluntly I think people do not learn that way any more. People who are learning about the use of these systems like to learn on line, they like to work together, they like to learn from places where good practice is in place. Again, I think that is something that through evolution has developed in the way that we are now thinking about education and training. It was not the case in 1992 that we had agreed with all the bodies concerned with clinical education that we should have a managed approach to learning about information technology but it is now the case, so things have moved on as indeed I think things have moved on in this world generally.

Mr Williams: My time is up, thank you.

Chairman

82. Thank you, Sir Alan. I think you have got one note to do for us from my request earlier. Can you include in that note the progress expected to be made in the implementation milestones of the IT system and, as I said before, delivering benefits of those two systems.
(Sir Alan Langlands) Sorry, Chairman?

83. I asked you before if you could let me have a note on the assessment of benefits, the measuring of benefits and so on, to be achieved with this one billion pound plus programme. Can you incorporate in that note some timetable with respect to the implementation of the IT systems listed within the billion, as much as you know'.
(Sir Alan Langlands) Something about the way in which we are taking the 1998 Strategy forward?

Chairman: Milestones of the IT systems and what you expect the benefits to be. Something that we can measure against later on. That is helpful, thank you. Thank you very much. Mr Burns, you have had a very enjoyable cheap spectator role today. Cheap for you, not for everybody else. Thank you both for coming.

Reducing systemic cybersecurity risk

2011-01-17T08:45:00.008Z

The OECD has today published a study by myself and Prof. Peter Sommer on Reducing Systemic Cybersecurity Risk:

The authors have concluded that very few single cyber-related events have the capacity to cause a global shock. Governments nevertheless need to make detailed preparations to withstand and recover from a wide range of unwanted cyber events, both accidental and deliberate. There are significant and growing risks of localised misery and loss as a result of compromise of computer and telecommunications services. In addition, reliable Internet and other computer facilities are essential in recovering from most other large-scale disasters.

Coverage in the Guardian, Metro, World Service, BBC News, Daily Telegraph, Computer Weekly, FT, Register, New Scientist, Wall Street Journal, Radio 4 Today and (my favourite so far), the New York Times:

Prophets of Internet-borne Götterdämmerung have gotten even more breathless since the publication of “Cyber War” last year. They describe China’s alleged hacking campaign against Google and the campaign by “hacktivists” against foes of the anti-secrecy Web site WikiLeaks, as the opening acts…

Nonsense, say two academics in a study commissioned by the Organization for Economic Cooperation and Development. The report, to be released Monday, argues that doomsayers have greatly exaggerated the power of belligerents to wreak havoc in cyberspace. It is extremely unlikely that their attacks could create problems like those caused by a global pandemic or the recent financial crisis, let alone an actual shooting war, the study concludes.

Updating the UK's communications law framework

2010-12-20T15:09:00.005Z

The UK government has been consulting over amendments to communications law as a result of recent EU activity. I've contributed to two consultation responses regarding lawful interception and the EU Electronic Communications Framework. Thanks to colleagues Judith Rauhofer and Chris Marsden, who did most of the drafting!

1. On amendments to the Regulation of Investigatory Powers Act 2000, we emphasised that "it is unlikely that one regime that requires the Interception of Communications Commissioner to maintain complete secrecy will be able productively to coexist with another regime that by definition must strive for the utmost transparency."

2. On the e-Comms framework, we wrote that the government needs to pay more attention to the issue of network neutrality. We were mildly horrified at the idea that these regulations should be used to create a new requirement for electronic communications services “to have a procedure in place to be able to respond to request for information from the police or security services”:

Provisions regulating access by public authorities to information held by communication service providers (usually communications/traffic data and intercepted electronic communications) are already included in the Acquisition and Disclosure of Communications Data Code of Practice and the Interception of Communications Code of Practice brought into force under section 71 of the Regulation of Investigatory Powers Act 2001 (“RIPA”). They cover in some detail the steps which service providers must take in order to assist public authorities in relation to information disclosure requests. It therefore questionable whether additional provisions governing the modalities of data transfers from communications services providers to public authorities are necessary in practice.

There is more information on this last point in my recent article Communications Data Retention in an Evolving Internet.

Learning for Change: the view from 1982

2010-12-20T13:36:00.009Z

My colleague Philip Virgo recently dug up his 1982 article on the implications of new-fangled computing technology for education. Through the magic of online OCR, the text is below. Do leave comments on where, with 30 years of hindsight, you think Philip was right or wrong! Philip himself writes: "Today I would be much kinder to the school maintenance staff and add an attack on the billions wasted on new buildings which are less fit for purpose than the inner city Victorian and Edwardian 'fortresses of learning' that have now been converted into gated apartment blocks."

A Bow Paper

Learning for Change: Training, Retraining and Lifelong Education For Multi-Career Lives
Philip Virgo, Spring 1982

Introduction and Conclusions

Education should be a lifelong experience for all, as and when the opportunity arises; not a joy for the few and a trial of youth for the many. Retraining at reasonable cost, social cost as well as economic cost, needs to be available at any stage of life, independent of the desires, means or needs of the current employer. A major shift in resources away from the 14-21 examination treadmill and from non-vocational to vocational education is required. Overall employment in education will increase but by the private sector production of packaged material rather than publicly funded delivery.

Most of the basic skills needed over the next hundred years can be predicted with reasonable certainty but many of the precise trades and professions cannot. "Age-Related Careers" is an employment strategy which can handle such uncertainty. Fundamental changes to the education system are necessary. Information Technology makes these possible at economic cost. Encouragement and favourable publicity are more effective weapons of persuasion than coercion but many actions at all levels are needed if the inability of our education system to cope with change is not to deny us the benefits which the new technology is bringing to other societies.

Government Actions include:-

— Outlaw the obligation to join the Company Pension Scheme, provided the option of equal contributions to a private scheme is available.
— Either split the University Grants Commission into separately funded bodies covering academic and vocational courses and facilities or increase employer and industry representation at the expense of University membership.
— Reform the Copyright laws to end educational piracy.
— Make payment under training tax free and allow privately paid training fees to be offset against past, present or future personal tax.
— Amend National Insurance and Pension legislation to encourage early retirement and part-time working.

Actions which need not involve government are:-

— Raising money and amending administrative arrangements to give every school at least a dozen micro's and video systems in a fully equipped vocational training centre available for adult and business use in the evenings and at weekends. This requires co-operative action by Parents, Unionists and Local Businessmen, as well as Councillors and Local Education Authorities if the financial and organisational constraints are to be overcome.
— Break down the barriers between school and industry by cross-secondments, visits and co-operation at every level.

1. The Role of the Educational System

200 years ago was the take-off period for Britain's first industrial revolution: the take-off that transformed England, Scotland, Wales and Northern Ireland from an economic condition akin to that of modern India, famines and all, to one akin to that of Hong Kong today. There may be extremes of poverty in Hong Kong but few actually die of starvation. The last English famine in which whole villages died was in the middle of the eighteenth century. The last Scottish famine was in the 1820s. There are many myths about the consequences of that revolution but few about its causes and course:-

An ambitious and underprivileged (but also undertaxed) class of entrepreneurs in an unregulated, unplanned environment, sought to buy social respectability by making money out of providing the materials and munitions to enable Britain to fight each of its continental neighbours in turn. In doing so they managed to create a forty year long investment led boom, ending only with the post Napoleonic war slump in the 1820s. Then another long boom followed as Railway mania gripped the country, fostered by the same group.

We have read so much about the evils of nineteenth century education, Whackford Squeers, Dotheboys Hall, Nicholas Nickelby and so on, that it is worth thinking about the education system in the eighteenth century, the education of the men who made the first industrial revolution. Since the Royal Navy was the only service fit for a gentleman of courage (the Army was discredited as a continental-style threat to civil liberties), and since the specialist Naval academies of the nineteenth century had yet to be founded, elementary engineering and scientific mathematics ranked higher than latin and greek in the education of a gentleman. Meanwhile, the Quakers and Non-Conformists of the Midlands and North West, excluded from grammar schools and universities ran more Trade, Commerce and Artisan schools than the rest of Europe added together. The poor condition of the English grammar schools and universities was no hindrance since only clergymen looked to them for inspiration.

In the nineteenth century, with the founding of Naval Academies, religious tolerance and the new found respectability of Army and Empire, the picture changed dramatically. The children and grandchildren of the men who made the first Industrial Revolution could enjoy the clergyman's education of latin, greek, and theology in reformed grammar schools and universities. Trade, commerce and engineering were relegated to the ragged aspirants of the Workers Educational Association despite the complaints of boring foreigners, like Prince Albert.

Meanwhile, the rest of Europe, with no world-wide Empire to administer and having to innovate rather than live off past innovation, learned from the Quakers and the Non-Conformists and made no such mistakes. Thus the seeds of our century-long decline were sown in the classrooms of Dr.Arnold's Rugby rather than on the playing fields of Eton.

Now that we have spent our inheritance and must once more earn a living we can do a lot worse than to look again at the institutions of the eighteenth century. We must recognise that education should not be a joy for the few and a trial of youth for the many but a lifelong experience for all, as and when the opportunity arises. The young should acquire a desire and an ambition to "improve" themselves and should associate learning with reward, not with examination trauma.

The men of the late eighteenth century shared many of our problems. They knew the world was about to change but didn't know in which direction, unemployed anarchic bloodshed alternating with tyranny as in France or hard working republican virtue as in America. Some thought the steam engine would usher in an age of leisure (or mass unemployment), others were confident that work might change (from brawn to brain, maybe), but that it would still be necessary and that the basic skills needed were likely to be much the same. The latter were right. Two centuries later we are still looking forward to an age of leisure. I venture to predict that in two hundred years our descendents will still be looking.

Meanwhile, it is our duty to do at least as well, and preferably better, than our ancestors in preparing for change.

2. Future Skill Requirements

We will still have to work for a living but the nature of that work is likely to change and we cannot predict many of the changes with much certainty.

We can no longer afford to spend one or two decades of detailed preparation for a single life-long career progression. Instead we should aim, like our ancestors, to impart those basic skills almost certain to be in continuous demand and to build a system capable of responding rapidly to change, and disseminating new skills to any age group when necessary.

This is all the more important since our education systems appear incapable of supplying the skills currently in demand, let alone new ones. Where we can predict major industries, such as computer assisted video entertainment and learning, mass produced electronics based medical aids, biotechnology and telematics, we are incapable of delivering the appropriate career preparation or retraining, unlike the Japanese. We even appear to have lost the ability to impart the basic commercial skills necessary to create fast growing new businesses. If we do not change our educational systems to produce generations capable of competing with the Japanese, the Germans and the Americans, we will lose out on the millions of wealth creating jobs potentially available. In consequence, we won't have the resources to support the idle decline, like that of nineteenth century Spain, that will be our lot.

For some of the new industries we can specify the technician training requirements in fair detail-for video they are akin to film production on a very tight budget and time schedule, for biotechnology they are a cross between process engineering and brewing real ale.

But our training facilities are far too thin on the ground. We need packaged course material for mass delivery but no commercial organisation will invest money in developing such material when it will be pirated as soon as it is supplied. Copyright reform is essential.

We can also list the basic skills that everyone will need for the office, factory and home of the future.

In the office of the future with its video workstations, electronic filing systems and telecommunications links, technical literacy and dexterity will, of course, be necessary. However, the ability to think clearly and express oneself accurately and concisely, to get sensible answers from the all-embracing information databases, will be even more important. The GIGO principle, (garbage in leads to garbage out), has its counterpart in information science where a woolly question will produce a meaningless flood of irrelevant data. The problem with modern management is already too much rather than too little information and computers don't often help. If the West Yorkshire police had had computerised information systems, they might still be looking for the Yorkshire Ripper. The uniformed policemen who finally caught him would have been too busy helping administer the database to leave the police station.

Without old fashioned linguistic skills, as tested in a "comprehension" exercise, and without the ability to frame an intelligent question and to recognise a sensible answer, the new Information Technology can all too often make things worse rather than better. Similarly, the ability of the technology to perform instant statistical analyses will make the knowledge of what those statistical analyses mean, if anything, essential.

However, to Reading, Writing and 'Rithmetic we need to add three new skills. The first is the concept of simulation, beginning with the concept of a computer model analogous to the real world in the way that a meccano crane or a model railway is to real things, but leading to the understanding of how computer models can be run backwards, from the desired ends to identify and test the logic, assumptions and premisses which lead to that end. This may well have a dramatic effect on the way we think since in many modelling exercises, the significant variables turn out to be unmeasurable, or based on hunches, value judgments or even moral principles where mere logic is of limited value: for example, the so-called "social" costs which befuddle public enquiries and motorway or airport planning exercises.

The second new skill is problem structuring and solving, and in particular group problem solving of the kind used by the class "cheat", who knows which classmate's homework to copy in which subject. By definition, this skill is selected against in our educational system and thus its most skilled practitioners frequently end up working against society as rebels, criminals or parasites rather than in the key management posts which they should occupy.

Thorough and imaginative approaches to group problem identification, structuring and solving are going to be essential in the factory of the future where quality control is going to be one of the main occupations. Ensuring that complex computer controlled products are functioning correctly, and that the specification of the control program is adequate under all circumstances and not dangerously inadequate under even the most unlikely circumstances, may well become the most labour intensive part of the production process.

Outside the factory the maintenance men who are to service the multiplicity of devices from automatic doors and light sensitive blinds, to mass-produced powered limbs and living aids for the elderly and rheumatic, will need similar skills since remote or automatic fault diagnosis will often be inadequate. Even in modern Britain with the lowest proportion of self-employed and small business proprietors of any country outside the communist block, the basic commercial skills of running a business are needed by more than one in eight of the population. If one accepts the thesis that most of the new jobs are going to be created in small businesses, private sector personal services and the informal economy, and that in the future more than one in four of the population will, at some time in their lives run their own business, a revival of "commercial" and "business" studies as subjects to be taught to all, in school, is necessary. Their current absence from the curriculum condemns the school leaver to servitude, unemployment or, at best, several wasted years learning for himself what he should have been taught at school. If education is truly a preparation for life, their absence cannot be defended outside a communist society.

The impact of technology on the personal service jobs, from street cleaning to street walking, will be negligible. Gardeners, window cleaners, plumbers, cooks and so on will be needed just as now.

At the other end of society, however, the changes may well be traumatic as expert systems render obsolete the book-learning and machine-like logical skills of most lawyers, accountants and consultants.

The robot that can sweep a factory floor or weed a garden is at least a century off. But most of the work of the Inland Revenue, most administrative accountancy, the routine conveyancing that keeps most solicitors in business, the complex diagnoses that elevate the Harley Street consultant above the local general practitioner, can already be done faster and more accurately by computer. In twenty years the local tax office will give an instant response to your query and the general practitioner will no longer refer you to the hospital for analyses and diagnoses but will do them himself with the aid of his surgery expert systems backed by links to national epidemiological and other databases.

There will be a great many skilled professionals checking the systems and equipment used but status will pass to the man doing the job that no mere machine can do. Giving an enema to an incontinent cripple will be a more valued task than diagnosing some rare cancer or tropical fever - "the simple application of memory and logic which any properly programmed computer can do".

The possession of book-learning or logical reasoning ability will lose status just as literacy did when everyone could read and write. The human touches of sympathy and creativity will be the hallmark of the high status job.

The trauma of this reversal in our hierarchy of status cannot be under-estimated. At one fell swoop it removes the rationale behind most of our edu-cational values, with their emphasis on memorising large quantities of verbal information, from irregular verbs to the naming of parts, the ability to follow complicated logical processes, quote obscure documents or recognise unusual sets of symptoms. It removes the main justification for the examination treadmill to which we chain our adolescent youth in a set of puberty rites crueller than those of primitive Africa. At least in Africa they don't label any of the participants as failures!

Rather than develop the learning skills of the few, we must train those of the many so that they can use the artificial intelligence and memory aids that will be available for all. Thus machines will take over the menial logic and memory tasks, leaving us humans with the interesting problems of judgment and the many interpersonal and service tasks which they may aid but cannot take over.

These changes are going to take time, certainly decades, possibly even centuries. But they are going to be fundamental and many new trades, skills and professions are going to be required on the way. However, unless we recognise and accept the transience of many of these new trades, we are going to condemn future generations to the fate of the handloom weavers. The handloom weavers were called into existance by the availability of cheap yarn, but were reluctant or unable to change trade when machine weaving became practicable. Their fate gives a stark lesson that a single career may not be enough in an age of fundamental structural evolution.

The handloom weavers' modern counterparts could well be the commercial programmers and analysts of today. Called into existence by the availability of expensive computers which had to be used more efficiently, they may well be reluctant or unable to change trade when packaged software on cheap computers has made their particular branch of computing skills redundant.

3. Age Related Careers?

Given the uncertainty as to the duration of requirement for specific trades, should we not prepare our school leavers for those jobs known to be in current - but possibly temporary - demand, while reserving certain careers, where demand is likely to be constant, for older generations who, because of family commitments, are no longer so mobile, who may take longer to retrain and who must therefore plan further ahead?

— Flexibility for the young 15-30 Mobility with Transient Skills
— Security for the family 30-50 Executive/Managerial
— Academe for the mature 50-80 Education/Social Service

Thus the school leavers would be prepared for the currently fashionable jobs and for those jobs requiring rapid learning or geographic mobility. As the individuals mature and seek to settle down they would retrain for a more stable executive or managerial career. Social careers, such as education or caring for others would be reserved for those with experience of all the vicissitudes of life.

Make no mistake, the very concept of a multi-career life, let alone the suggestions of age related careers, is at variance with our trades union, social security and pension structures, let alone our educational systems.

It is incompatible with the Graeco-Roman ideal of Plato's Republic of one education for one career for life.

It is, however, similar to the way many non-European societies, including Japan, are organised, with their veneration of the growing wisdom of age, and the tasks suitable for different age groups.

Rather than expound analogies and principles I will attempt to describe the careers of an average school leaver of 1990.

John Dent, cousin of Arthur Dent, has no academic interests. On a school project in Wales he once had to be manhandled out of a museum at closing time, but that one symptom of deviant enthusiasm was quickly cured. He is reasonably dextrous, likes making things in the engineering workshop and crashing other people's computer systems. In his last year at school he does a course on Numerical Control Programming which includes part-time work in a local engineering company which he joins as a trainee robogate supervisor.

In his spare time he is active in the local CAMRA (Campaign for Real Ale) branch, gets interested in the mechanics of brewing and when the demand for robogate supervisors tails off and salaries start to lag, takes a Biotechnology Production course at the local tech., in his mid twenties. He fails to get a job in a real ale brewery and settles for a metal recycling plant near Scunthorpe rather than work for a synthetic beer factory.

In his late twenties he gets married, stops drinking and starts studying Production Control and Finance on an Open Tech course. It's heavy going, and he doesn't qualify till his mid-thirties, when he manages to get a job as deputy production controller of a cattle feed plant in Cheshire.

He has worked his way up to production manager when he realises just before his 45th birthday that the plant will have to close because it cannot be adapted to meet the latest pollution control standards.

Unwilling to move, he takes a teacher training course and secures a part-time post at the local school teaching basic numeracy and industrial skills. He is elected to the local council, and with his attendance money and his wife's earnings as a paramedic running the body scanners in the local Group Practice combined Health Centre, operating theatre and cottage hospital, he decides not to take another full-time job.

In the school holidays he takes to studying Welsh History and at 55 graduates in Celtic Studies from the Open University of North Wales.

At 60, when their last child leaves home, he and his wife buy a derelict hill farm in mid-Wales and he opens a holiday centre specialising in the development of the Welsh Longbow, in use and in literature.

Note that John retrains four times, none of them at his employer's expense because each time he is going into a very different career; each time, partly because he is getting older and has more family commitments, it takes him longer, until his final academic, cum leisure cum retirement post. Note also that after his youthful job mobility, at 45 he settles for a collection of part-time sources of income, including teaching and social cum political activity, rather than disrupt his family life and move again.

This kind of multi-career life also requires major changes to our trades union structures, pension schemes and social security schemes to permit multiple job changes without loss of pension rights and to permit part-time work as a norm.

4. Institutional Changes Needed

Unacademic John Dent spends more time in the educational system, both for business and for pleasure, after he has left school than even today's academic high flyers. Therefore, unlike current and past generations of school leavers, he must enjoy it. One cannot drag London's adult East Enders over the threshold of anything that looks like a school but house the establishment in a Portakabin or a Shack, give it a different name and ethos, and disassociate it from memories of pain and boredom, and they are often as eager as any child to learn new skills.

It is essential that the initial educational experience should be such that the student learns how to learn in a way that makes him associate education with reward and relevance, while at the same time he acquires the basic skills essential to all career structures.

Given that the bulk of the new jobs are being created in small businesses with neither the time nor the money to train school leavers in changing skills, and given that the schools have ten years of the individual's best learning years, the school leaver should already have acquired most of the vocational skills and training necessary for his first career; a first career which is likely to begin at 16 or 17 and to involve a job in close proximity to the school. Therefore, much closer links between schools and local businesses, are necessary.

Whether these are fostered by cross secondments, use of part-time industrial staff for vocational training in schools, the recruitment only of teachers with outside work experience or sandwich courses for children, the current isolation has to be broken down.

Retraining at reasonable cost, social cost as well as economic cost, needs to be available at any stage of life, independent of the desires, means or needs of the current employers.

The kind of availability needed is possibly illustrated by the fate of an American steel company which gave notice of closure in a town where there was little alternative work for steel-workers. The sellers of retraining courses descended on the town like locusts and, although the company rescinded the closure notice, two years later it had to close because of shortage of labour. The workers had taken the message, retrained at their own expense and left for better, more secure, jobs.

We should not concentrate resources on those who are easiest to train, like the teenagers, at the cost of throwing later generations on the scrap heap, nor should we squander resources on the untrainable or those who wish to acquire skills not in demand, at someone else's expense.

When the taxpayers' money is to be spent, priority should be given to retraining taxpayers or training their children for jobs in known demand. Exotic or esoteric subjects should be studied at private expense, not public.

A major shift in resources away from the 14 to 21 examination treadmill will be required as well as a massive shift from non-vocational to vocational education and from "offering" courses to meeting demands. Non-vocational education will largely become a leisure activity paid for by mature students out of past earnings rather than a middle class puberty rite at taxpayers' expense.

For many subjects the student age range will rise from under 21 to over 60. Perhaps we should be looking to convert redundant Universities to Recreation and Leisure Schools or Industrial Training Centres depending on their location and facilities. It may well be that in twenty years' time we will again have in Britain a dozen or so proper research-based endowment funded Universities and, hopefully, at least a dozen first class colleges or institutes of advanced technology funded largely by industry. The dross of second-rate institutions where University status and academic freedom have too often been an excuse for woolly thinking, inefficiency and futility will no longer be supported with public money. Good researchers and funding will be concentrated in centres of excellence. Competent teachers will be paid more to train for specific professional skills in Polytechnics and Colleges of Further Education, possibly linked in an Open Tech-like framework. The concept of the University as a home of learning and research for young and old alike, rather than an imitation polytechnic for adolescents, without the polytechnic discipline of defined educational objectives, will reign again.

Maybe that is a pipedream; however, a revolution in teaching techniques will certainly be required since current methods rely too heavily on the in-grained awe and academic docility of examination broken youth for them to work with the cynical maturity of the adult trainee. This together with the emphasis on learning how to learn, rather than mastery of any particular subject matter, may well lead to teaching and lecturing in most subjects being reserved as a second or third career so that mature students are taught by their peers. Given the use of packaged material, mastery of the subject will be less important than understanding of the learning experience, the ability to manage the learning environment and to motivate the student by sympathy, guidance and understanding - those attributes which the expert in his own subject has all too often lost. Teacher centred methods must be replaced by learner centred methods.

5. How can the New Technologies help to meet this Fundamental Challenge?

At the simplest level, audio visual techniques enable the best lecturer or demonstrator to address an audience of thousands rather than a few dozen. A good video is very much more effec-tive than an average teacher in one-way communication such as a lecture.

Freed from the pressure to prepare material to deliver to a timetable, the teacher can act as a tutor rather than a lecturer, advising which sources of information the individual student would find most helpful or relevant: videos, books, computer based simulators, and so on.

The simulations which are at the heart of many Computer Aided learning packages appear to improve greatly the motivation of students of all types. Good packages speed the assimilation of knowledge and understanding, facilitate the practice of techniques and of recall. They can also make formal examinations and the associated trauma unnecessary by testing the student's understanding at each stage before he can move onto the next. Thus at the end of a CAL packaged course, each student has reached the same level of understanding, some more quickly than others.

Packages enable the teacher to concentrate on his students as individuals, especially on their interpersonal abilities: for example, in group situations where the computer has set a task which requires a number of students to work in concert. The computer can be left to manage the task while the teacher concentrates on developing those skills and qualities which the computer cannot, such as the consi-deration of the feelings, motives and abilities of other people.

Learning can also take place at the student's convenience; his choice of time, place and pace. Thus the part-time student can study the theory of genetic engineering in the Village School by night, using video and simulation packages with teleconference facilities for tutorials, while the pregnant teenager does remedial mathematics and babycare at home with a visiting teacher to keep up her morale.

Our current education system is "schooled" into subject areas, while life is not. The ability of the expert system to manage complexity makes it ideal for controlling multidisciplinary study projects crossing subject boundaries in a way which few teachers have the ability or knowledge to match. An example might be the complex inter-actions between economic growth, nutrition standards, mortality, mores and birth rates in the first industrial revolution.

The medical ignorance of most historians, the cavalier way in which theoretical economists regard most historical evidence, the woolly thinking of most sociologists, and the lack of interest of most medical men, make this an area abounding in myth and nonsense. Such packages could be invaluable in broadening the outlook of our narrow specialists in both teaching and research.

Packages are labour intensive to specify and prepare and require much planning and discipline to assemble and test. 150 man hours to produce a single course hour is one current rule of thumb for packages with limited visual content. If video material is to be integrated into the package the labour content could easily treble or quadruple.

However, two years and a million or so pounds to assemble quality packages which can then be mass produced on discs or transmitted over the air or down phone lines, is a lot faster and cheaper than retraining several thousand teachers over a decade or two. The result is greater understanding and more enjoyable learning on the part of the student and less need for large expensive school buildings with complicated timetables, rather than fewer teachers. The role of the teacher will change, the preparation of material will largely become divorced from its delivery, many teachers will earn more from royalties on packages they've helped assemble than from their direct salaries, but overall, many more jobs will be created.

6. Problems You Can Help Overcome?

The Japanese, like the Americans under Kennedy or ourVictorian ances-tors, succeed because they think they can. We are failing because we think we will. We don't suffer from lack of resources, we suffer from the frag-mentation of those resources we have, the refusal to consider solutions we did not invent for ourselves, bureaucratic procedures and institutions which do not believe they can cope with change, an idiosyncratic examination system which reinforces the status quo and recruiters who have, for all too human reasons, given up trying to influence the systems they have to work with.

In all these areas the fear of public ridicule can be a potent weapon. Fear of the public exposure of wasted resources can often persuade a Local Authority to bring together Further Education, Polytechnic and School Resources to solve common problems in situations where rational arguments gets bogged down in red tape.

The "Not Invented Here" syndrome can equally be countered in a time of financial stringency by forcing the public cost-justification of each attempt to re-invent the wheel.

Institutional resistance is harder to overcome; of course, an Authority with a large Architects Department and a militant bunch of maintenance men and caretakers will seek to impart to others the subjects they know. Of course, examiners will seek to preserve the status quo.

Consumer revolt, whether on the part of parents, taxpayer, student or recruiter, is one weapon capable of over-coming institutional resistance in the long run. But it can be a very wasteful mechanism. Waiting for Encylopaedia Britannica or Time-Life to fill the gap with packages sold direct to parents or mature students is not the best way, unless we really believe that American methods are so superior that we cannot catch up. Subversion is likely to be far more efficient. Demonstrating to the teachers that copying material produced elsewhere, perhaps even paying copyright fees, that prostituting academic freedom in return for gifts of equipment, books and visits, that adopting commercial rather than academic norms can greatly ease their problems, will encourage them to change the system from within. Demonstrating that interesting relevant packages can make a class of unaca-demic delinquents an acceptable challenge rather than a futile trial of strength will encourage the teachers to fight the waste of resources on bricks and mortar, and get the money spent on teaching aids, and material instead.

In Japan the Universities are showered with gifts of money and equipment by employers, not because they value University research - they don't - but because they want recruits trained to their standards. Our employers must adopt similar tactics, not just in dealing with Universities but with schools and colleges at all levels. Because of the difficulties on both sides, and the cultural gulf that exists, they need all the encouragement they can get through publicity and praise for successful case studies of co-operation (as in the Japanese press); case studies which emphasise the direct selfish benefits to both parties as much as the long term benefits for the students. The Marconi-sponsored MSc course at Southampton is one example.

Finally, recruiters who buck the system and retest applicants or select for deviance, rejecting the validity of examination results or who offer inflation adjusted pension transfer rights or payments to independent pension schemes, should receive praise and publicity for their initiative in helping to change the system. The docility of the recruiters merely serves to reinforce the complacency of the examiners that they are imposing the correct quality control procedures on the rest of the system.

A revolt among the recruiters could well be the fastest way of securing rapid and far-reaching change. Rapid and far-reaching changes in our educational systems at every level are essential. Throwing money at the system will probably serve to delay those changes, while financial crisis and constructive publicity for the alternatives may well help to promote them.

So what can you do about it?

Are you a parent? Join your parent-teacher association. Help raise money for equipment, materials and teaching aids, then blackmail your Local Education Authority into matching your contribution and paying for the in-service teacher training necessary. Forget the sports field, swimming pool and minibus. Mens Sana in Corpore Sano. If you don't feed the mind and teach it how to earn a living all you've got is a physically fit, unemployable delinquent. Demand vocational courses for your children and volunteer to pay for them. Volunteer to help deliver them if necessary.

Are you a trades unionist? trapped in a dead-end job in a dying industry? Get your union branch to get the local Trades Council to fight for practical, vocational adult evening classes, using the school's equipment and facilities. Make it clear you are happy to pay the going rate for such a course. After all, if it's free or dirt cheap it's usually because it's worthless.

Are you a manager or businessman? Offer equipment and funding to your local school, in return for being able to use it and the premises in the evening and the weekend to retrain your staff. Pay the teachers moonlighting money to to do that retraining. Offer visits for the staff and children to your company. Offer the schools any under-employed senior staff with specialist backgrounds as part-time careers advisors and technical teachers. Specify the skills and qualities you need your recruits to have and make sure they are what you really need. You don't need 0-levels to be a road-mender, A-level maths to be a computer programmer or a degree to be a systems analyst. Too high a qualification is really a disqualification for a contented, competent employee.

So reforms do need political action. They can be easily listed:-

— Amend the National Insurance and Pension legislation to encourage early retirement and part-time working. Exhortation is not enough. There are real barriers to be removed.
— Make pay while under any form of vocational training taxfree. Remove the disincentive for a mature man to go on residential and unsocial hours training schemes.
— Allow fees for any form of vocational training paid for by the individual, for himself, his wife or his children, to be deducted from personal tax.
— Reform the Copyright laws to encourage the preparation of packaged learning materials, and outlaw educational piracy.
— Abolish the University Grants Commission, or at least drastically amend its membership and terms of reference. If it is to be the main channel of government funds into the further and higher education industry, its current policy of fostering centres of academic excellence, at the expense of the old college of advanced technology, is disastrous. We already train more scientists than Japan but only a tenth as many graduate engineers and technicians.
— If the UGC is to continue with its current responsibilities, at least one third of its membership should be drawn from the customer - British Industry, and no more than one third from the Universities. Alternatively the education and training of future employees and applied research should be financed separately from academic research and the apprenticeship of future academics and the UGC's terms of reference and funding revised accordingly.
— Outlaw the obligation to join the Company pension scheme, provided the option of equal contributions by the Company to a private pension scheme of the employee's choice, is available. The employee would be under obligation to pay into the private scheme at least as much as he would have into the Company scheme.

The Author

Philip Virgo is Chairman of the Conservative Computer Forum and author of Cashing in on the Chips (CPC May 1979) and co-author of The Big Steal (Bow Paper Oct. 1980). He has worked in the computer industry for nine years including responsibility for several long-range planning studies.

© Bow Publications Ltd. 240 High Holborn, London WC1V 7DT Price £2.00 Printed by Orchard & Ind Ltd., Gloucester

The views expressed in Bow Papers are those of the authors. They do not represent a collective view of the Bow Group, nor do they represent a statement of the view either of the Conservative Party or of the Government. Bow Papers are published as containing arguments which merit consideration by the Conservative Party and by a wider audience.

RECENT PUBLICATIONS From the Bow Group
Building Societies The Need for Reform by Simon Mabey and Paul Ti/let (£2)
Company Accounting and disclosure by Richard J. Simmons (£2)
North Sea Giveaway The Case for Auctioning North Sea Oil Licenses by Peter Lilley (£2)
Quis Custodiet Evidence in the future of ILEA by Michael Stern (£1.50)
British Gas: A Prospectus by Tim Eggar, M.P., Jocelyn Cadbury, MP and David Shaw (£2)
Elected Member's Guide to Reducing Public Expenditure by Cyril Taylor, GLC (£1.50)
The Big Steal The Computerisation of PAYE Assessment by John Butcher, MP and Philip Virgo
An Open Tech A Proposal for Tackling Britain's Skill Shortages by Michael Colvin, MP
Reserves of Strength by Nicholas Perry and Trevor Standen, with a foreword by Lord Chalfont
Prelude to Freedom: An Alternative Foreign Policy by Joanna Bogle and others
Making Monetarism Work Institutional Distortions in the Economy - Possible Remedies by Rodney Atkinson
The Assurance of Justice by Michael Stephen and Christopher Jackson

Except where otherwise stated, Bow Papers are priced at £2.50 including postage (Members 75p). All publications can be obtained from the Bow Group, 240 High Holborn, London WC1V 7DT. Telephone 01-405 0878.

Communications Data Retention in an Evolving Internet

2010-11-21T11:15:00.004Z

The International Journal of Law and Information Technology has just published my new article, Communications Data Retention in an Evolving Internet. I hope this will prove useful for the debate coming any day now as the UK government relaunches its Intercept Modernisation Programme, as well as for the reviews being carried out by the European Commission and Court of Justice:

The 2006 Data Retention Directive requires EU-based Internet Service Providers to store information on customers and their online communications. The Directive is being reviewed by the European Commission, and has been criticised in a number of recent national constitutional court judgments due to its impact on privacy. Its compatibility with the Charter of Fundamental Rights is now being considered by the European Court of Justice. This article describes the likely impact on data retention of further developments in Internet usage, technology and law. It outlines the increasing use of private networks and member community sites that are not subject to the Directive, and the changes in surveillance technology and practice that some member states have proposed in response. It concludes by analysing the key factors to be taken into account in the EC and ECJ reviews, and suggests more proportionate and effective mechanisms for preserving appropriate law enforcement access to communications data.

Openness and innovation in the information society

2010-11-20T12:15:00.003Z

This week I've been in Luxembourg to speak at the European Media Days hosted by the Centre National de l'Audiovisuel. Here is my presentation:

Openness and innovation in the information society

View more presentations from Ian Brown.

The toothless watchdog v Google's creepy line

2010-11-04T16:16:00.002Z

The Guardian has just published my article on the Information Commissioner's Google Street View decision:

Google is facing legal investigations around the world into its Wi-Fi-snooping Street View cars. But after cursory consideration, the UK's information commissioner has forgiven the company this illegal interception in return for a promise to do better in future. Why should any company or government agency care about complying with data protection law if this is the worst they can expect?

Banning BlackBerry

2010-08-03T14:27:00.003+01:00

Yesterday evening I was one of the guests on Al Jazeera's Inside Story programme, discussing the BlackBerry ban in the United Arab Emirates:

Ofcom net neutrality consultation

2010-07-28T13:07:00.005+01:00

Ofcom asked me to speak this morning at their stakeholder consultation event on net neutrality; my slides are below. The other two speakers said what you would expect. BT (plus mobile network 3 in the audience) asked for evidence of harms that neutrality regulation would "fix", and complained of the difficulties of defining a minimum acceptable level of Quality of Service. Skype described how restrictive some mobile data packages are, blocking access to Voice over IP and most other peer-to-peer, audio and video applications.

Everyone agreed that the "open and neutral" Internet the European Commission and Parliament wish to see involves much wider issues of public policy than communications competition regulation. This heated discussion is likely to continue for several years, much of it in Brussels rather than London.

Net neutrality, citizenship and discrimination

View more presentations from Ian Brown.

Another database bites the dust

2010-07-22T16:27:00.002+01:00

Our Database State report strikes again:

ContactPoint will be switched off on 6 August, ministers announced today.

In a ministerial statement, children's minister Tim Loughton said from noon that day users would no longer have access to the database that was set up to allow authorised children's services professionals across England to see who else was working with a child or young person. The data itself will be destroyed within two months of the closure.

ContactPoint was one of eleven systems we judged "almost certainly illegal under human rights or data protection law and should be scrapped or substantially redesigned. The collection and sharing of sensitive personal data may be disproportionate, or done without our consent, or without a proper legal basis; or there may be other major privacy or operational problems."

Cyberwar and other global risks

2010-07-22T10:05:00.003+01:00

The Defence Secretary has told Parliament he will need to switch resources from conventional military tasks to tackling cyber threats:

Pressure on the defence budget required the government "to sacrifice things we can see for things we cannot see", he told the cross party committee of MPs, referring to the hidden danger of cyberwars.

Here is the presentation I gave last month to an OECD workshop on this subject:

Systemic cybersecurity risk

View more presentations from Ian Brown.

Making the citizen heard in security research

2010-07-02T08:45:00.003+01:00

During the 7th Framework Programme, the EU is spending €1.4bn on security research. Since the coming into effect of the Lisbon Treaty, the European institutions have a duty to ensure this research supports fundamental rights. The Commission is also keen to avoid the negative media coverage that has resulted from previous research that was less careful of citizens' privacy.

Yesterday I spoke and chaired a panel at a Commission conference on these societal security issues. I was interested to hear from one of the assistant chief police officers present that the Commission is still funding research that does not provide meaningful security tools to end-users, but has the potential to be extremely invasive.

One of my own suggestions was that in future the annual work programme be subject to ethical review before a call goes out for such proposals. I also suggested mechanisms for better institutional oversight of the security programme:

Making the citizen heard in security research

View more presentations from Ian Brown.

Privacy and smart power meters

2010-06-04T17:47:00.003+01:00

Spoke this morning at an interesting workshop on smart meters organised by Consumer Focus. Governments and industry in Europe and North America are moving quickly to roll out "smart meters" for gas and electricity networks in tens of millions of homes. It seems that in this dash, not enough attention is being paid to getting privacy right before tens of billions of pounds are spent on this "smart" infrastructure.

Designing privacy into smart meters

View more presentations from Ian Brown.

Pakistan blocks Facebook and YouTube

2010-05-25T15:17:00.004+01:00

Pakistan rights activist Sabeen Mahmud has produced some wonderful graphics in response to the Lahore High Court's recent blocking of Facebook and YouTube:

Deleting the database state

2010-05-13T10:49:00.004+01:00

The agreement for coalition government between the Conservative and Liberal Democrat parties includes the following:

The scrapping of ID card scheme, the National Identity register, the next generation of biometric passports and the Contact Point Database.

Outlawing the finger-printing of children at school without parental permission.

Adopting the protections of the Scottish model for the DNA database.

Further regulation of CCTV.

Ending of storage of internet and email records without good reason.

Glad to see so many suggestions have been taken up from our Database State report. There is nothing detailed in the agreement on the NHS, but I expect the two parties will also scrap the National Programme for IT for the cost savings alone.

"Ending" the storage of Internet and e-mail records will not be possible given the Data Retention Directive that the previous government pushed through in Brussels. However, the Directive is currently being reviewed, so I do hope the UK will be demanding that it be scrapped. Until then, the government could use secondary legislation to reduce the length of time data is stored to six months; stop the "voluntary" storage by ISPs of lists of websites visited by their customers; and seriously reduce the number of government agencies with access to this data. My chapter on regulation of converged communications surveillance contains a number of further suggestions.

I spoke at a College of Law event on Monday on surveillance, alongside an extremely senior police officer with responsibility for CCTV. In his opinion, the £500m+ of public money spent on cameras in the UK since the early 1990s has given a very poor return. Politically, however, it would be difficult to remove existing systems. My suggestion is that all cameras should be subject to a regular value-for-money test. Those not having a significant impact on crime should be automatically removed.

E-voting is not the solution to poll chaos

2010-05-07T15:08:00.005+01:00

It has only taken a few hours for e-voting to be proposed as the "answer" to last night's chaos as polling stations closed. It is dismaying to read such badly informed commentary as this:

Andy Williamson, director of digital democracy at the non-partisan think tank, the Hansard Society, argues that "a lack of desire to change" is a better explanation of any resistance to electronic voting than security concerns.

He acknowledges the risks with electronic voting, but says "you have to put this in the context of the current process, which we mostly accept, despite the obvious flaws and risks."

Those risks, he says, include "the lack of positive voter verification, the obvious risk of moving big piles of paper around, and the fallibility of manual counting."

As has been explained over and over and over again: personal computers and the Internet are nowhere nearly trustworthy enough to conduct national elections. Even voting computers at polling stations are far too easy to hack, as Hari Prasad, Alex Halderman and Rop Gonggrijp demonstrated again just last week in India:

Would it be so difficult to employ a few more polling station staff, and pay them overtime to ensure everyone is able to cast their vote?

Secure software development survey

2010-05-07T08:50:00.004+01:00

Our visiting researcher Prof. Mingqiu Song is investigating how software firms use secure development processes. If you work in a company using these processes, please fill in her survey — and to say thanks, you can win a £100 Amazon voucher.

EU cybersecurity policy

2010-05-04T16:29:00.005+01:00

This morning I gave the following invited speech to a session of the European Parliament's industry committee, which was considering a draft report on the Commission's recent Communication on Internet Governance. Also speaking was Ambassador Janis Karklis, chairman of ICANN's Government Advisory Committee; Frederic Donck from the Internet Society; and Prof. Adrian Cheok, director of the National University of Singapore's Mixed Reality Lab. Due to technical difficulties (!) the Internet Governance Forum secretariat's executive coordinator, Markus Kummer, was unable to participate remotely as planned.

Internet governance and cybersecurity

Clearly, European society is increasingly dependent on the Internet and related communications systems. But the security of those systems is not yet at a level appropriate for that dependence. Mr Sosa Wagner's draft report is right to stress the importance of improving the "availability, robustness and resilience" of critical information infrastructures.

The Commission and the Parliament have taken some important steps in improving this situation, especially through the recent telecoms reform package and its obligation for operators to identify risks and ensure continuity of service. I want to outline five key additional steps that the EU should take towards this goal (many of which are being discussed by the institutions):

Bring member states up to a common high level on cybersecurity, with national Computer Emergency Response Teams or networks of sectoral teams. The European Network and Information Security Agency (ENISA) should continue to develop forums for information-sharing, and provide support to less capable member states.

Further increase the effectiveness of ENISA, which needs significantly greater resources. With the entry into force of the Lisbon treaty, ENISA should be able to take action on former third pillar matters such as criminal use of Internet.

Ensure the resilience of key industry sectors through appropriate regulation. There should be further discussion of the designation of critical information infrastructures under Council Directive 2008/114/EC (while addressing concerns over information sharing), and requiring isolation of critical utility systems from public networks.

Widen requirements for security breach notification from communication network operators to other information society services.

Reinforce system and network diversity through competition law, state use of open standards, and procurement policy.

The Commission's Communication on Internet governance states that "the EU should take a leadership role in working towards the goal of increased security and stability of the Internet by initiating dialogue with international partners." The Commission should develop concrete plans with the Parliament and member states on what this leadership role should entail. In addition to promoting at the international level the measures I previously described, this could include:

Support for ICANN in its work to ensure the security and stability of the Domain Name System;

Work in international venues such as the OECD, United Nations and Council of Europe to improve applicable laws and national coordination on cybersecurity;

Discussions on limited liability for software security faults, particularly in the operating system and browser software that is critical to system security.

Finally, it is critical that the Parliament continues its role in promoting fundamental European values such as freedom of expression and privacy. The draft report's suggestion to extend the Rome II regulation to include violations of data protection and privacy is positive, as is the suggestion on the negotiation of international agreements for effective redress. But the EU institutions should be extremely cautious in introducing measures such as powers to revoke IP address blocks and domain names, which was suggested last week by the Council, or requiring Internet blocking (as Commissioner Malmstrom has proposed). These measures would set an extremely damaging precedent for Internet governance by repressive states that do not share European values.

Court of Appeal rejects theocracy

2010-04-29T16:24:00.001+01:00

"We do not live in a society where all the people share uniform religious beliefs. The precepts of any one religion – any belief system – cannot, by force of their religious origins, sound any louder in the general law than the precepts of any other. If they did, those out in the cold would be less than citizens and our constitution would be on the way to a theocracy, which is of necessity autocratic.

"The law of a theocracy is dictated without option to the people, not made by their judges and governments. The individual conscience is free to accept such dictated law, but the state, if its people are to be free, has the burdensome duty of thinking for itself." —Lord Justice Laws

Monitoring and controlling the Internet

2010-04-25T07:22:00.003+01:00

The leak of the European Commission's review of the Data Retention Directive was timely for my presentation yesterday on Internet surveillance:

Monitoring and controlling the Internet

Let's just say that some of the audience at Cumberland Lodge's Annual Police conference were more sympathetic than others to my conclusions.

Government requests for Internet and phone records

2010-04-23T10:41:00.012+01:00

Google has (rightly) won praise for its new tool showing the number of requests it has received from governments to remove web pages and get user information. Here is some more specific data on European government demands for user data from telecommunications companies during 2008, gleaned from a recently-leaked European Commission review of the Data Retention Directive:

Government requests for communications data per million population (2008)

Country	Requests	Population (m)	Requests/m population
Cyprus	34	0.761	45
Czech Republic	131560	10.323	12,744
Germany	13348	82.12	163
Denmark	3605	5.447	662
Estonia	4490	1.343	3,343
Greece	584	11.172	52
Finland	4010	5.27	761
France	538437	62.277	8,646
Ireland	14095	4.422	3,187
Latvia	16862	2.271	7,425
Malta	867	0.413	2,099
Slovenia	282	2.013	140
UK	470222	61.073	7,699

Notes: 2008 population figures from IMF World Economic Outlook. Spain and Lithuania gave non-comparable figures to European Commission.

We are not at cyberwar

2010-04-21T09:14:00.009+01:00

Alarmist warnings about devastating "cyberwars" seem to have reached a new peak. Former National Security Agency director Mike McConnell recently wrote:

The United States is fighting a cyber-war today, and we are losing… The cyber-war mirrors the nuclear challenge in terms of the potential economic and psychological effects. So, should our strategy be deterrence or preemption? The answer: both.

Equating distributed denial of service attacks with nuclear missiles would be laughable were it not so dangerous, particularly since McConnell proposes in response that the Internet be re-engineered to remove any last vestiges of privacy. (Glenn Greenwald has pointed out McConnell's extreme conflict of interest).

Fortunately, for now, wiser voices are prevailing within the US government. President Obama's cybersecurity coordinator Howard Schmidt told Wired News: “There is no cyberwar. I think that is a terrible metaphor and I think that is a terrible concept."

I tried to make my own contribution to sanity at a conference yesterday in London on this subject:

The cyber terrain

I was pleased to hear widespread agreement with Schmidt's position from the audience.

UPDATE: Tim Stevens shares his thoughts on the conference.

Internet Security, Internet Freedom

2010-04-14T12:44:00.006+01:00

I'm looking forward to speaking later this month at a Princeton workshop on Internet security and freedom, and to hear Alec Ross, Hillary Clinton's senior advisor for innovation:

The internet is at once a means for great openness and great control — expression and exclusion. These forces have long been at work online, but have recently come to the fore in debates over the United States’ cyber security policy and its increased focus on “internet freedom.” The country now has a Cybersecurity “czar” that has presented a 12-part national initiative, and also has a Secretary of State that has forcefully stated the case for internet freedom. But what do these principles mean in practice?

Clay Shirky and Evgeny Morozov have a new instalment of their conversation on this subject, with Morozov concluding:

If the Iranians, the Chinese and the Russians get the impression that Silicon Valley are in bed with the State Department, that impression is likely to persist for quite some time, maybe forever (once again: try convincing foreigners that oil companies don't control Washington). Just like most foreign publics developed an impression — thanks to eight years of Bush — that promoting democracy necessarily entails regime change, they may soon develop similar impressions about "Internet freedom". So I think the diplomats just have to be very careful, and focus on ironing out these micro problems, instead of saying that, yes, we've developed this partnership with Twitter and everyone should know about it! It's the kind of "public diplomacy" that begs for being less "public".

I'll also be speaking at a conference on free speech and the Internet being organised at Oxford by Prof. Timothy Garton Ash in June: more on that as details are finalised.

Hostile reconnaissance

2010-04-10T13:26:00.003+01:00

Reconsidering the fundamentals of ©

2010-04-10T12:20:00.006+01:00

Today is the 300th anniversary of the world's first copyright law, the UK Statute of Anne. To mark this occasion the British Council is running a global debate on the future of copyright. You can read my contribution at their site. My conclusion:

An exclusive ‘right to copy’ is an unenforceable anachronism in a world filled with consumer technology that can copy, remix and redistribute works at almost zero marginal cost. Governments should be developing new legal frameworks to support necessary investment in creative works while enabling the benefits to society that flow from widespread sharing and reuse. Sadly, they instead seem focused on negotiating a secret ‘anti-counterfeiting’ treaty that will turn copyright into an even greater barrier to a productive and equitable information society.

There are also contributions from Lawrence Lessig, Jimmy Wales, Cory Doctorow and Yochai Benkler.

#DEAct - WTF?

2010-04-10T09:04:00.003+01:00

After wash-up and ping-pong, the Digital Economy Act 2010 has received royal assent and become UK law. For the Liberal Democrats, Lord Clement-Jones told the House of Lords:

There is no doubt that many parts of the Bill were greatly improved in the two and a half months that the Bill spent in this House, particularly in expressly stating that subscribers are presumed innocent until proof is provided otherwise.

Subsequent to the Bill's passage here, however, the process has been totally unsatisfactory. Second Reading could easily have been held three weeks earlier. The Bill left this House on 15 March and Second Reading could have taken place well before 6 April, when it actually took place in the Commons. Some Committee days on crucial areas such as file-sharing, website blocking and orphan works could have been allocated. Instead of that, we have had the unedifying prospect of a wash-up stitch-up between the Conservative and Labour Benches on many elements of the Bill. Allied to the lack of time was the Government's unwillingness in some cases to consider amendments or to give assurances that would have delivered a sensible, consensus solution. It is no wonder that so many internet users, Back-Bench MPs and now the Front Bench of my party are firmly of the view that the Bill has not received adequate debate and should not proceed further.

Index on Censorship has a round-up of the debate, with this comment from me:

The House of Commons may have rushed through the Digital Economy Act with minimal scrutiny, but I think public protest over its far-ranging provisions is just warming up. Most of the UK’s 50m Internet users are only just hearing about this threat to their ability to work, learn and express themselves online.

The Internet’s democratic potential will be damaged by powers in the Act for users to be disconnected and websites to be blocked. But in the meantime, the tens of thousands of citizens who complained about the lack of debate to their MPs will be thinking about next month’s general election. Voters have an ideal opportunity to favour candidates that support freedom of expression and promise to block the secondary legislation that is still needed in the next Parliament to bring many of the Act’s provisions into force.

Toe-prints added to ID cards

2010-04-01T00:01:00.004+01:00

Some exciting news hot from the Home Office:

Regulations have been tabled today, to be enacted before the dissolution of Parliament, to allow toe-prints to be added to the list of biometrics collected from individuals when they enrol for an ID Card.

The move will allow for shorter queuing time at airport security as anyone who is requested to take their shoes off when passing through airport security scanner (or a whole body scanner) will be able to have their toes checked and their identity confirmed when they stand in the scanning system. Biometric toe-print readers have already been successfully trialled with security scanners at Doncaster’s Robin Hood International Airport near Barnsley.

I am looking forward to getting more details on the draft “Identity Cards Act 2006 (Toes Biometrics) Regulations 2010” later this morning.

SEE ALSO: TouchNote integrates with Heathrow's X-ray scanners

Bank of Scotland and its rapacious charges

2010-03-26T13:23:00.006Z

I am gnashing my teeth after being charged a scandalous £30 penalty on my current account by Bank of Scotland. I just sent them the following complaint, and will update this post with their responses:

Me: Since you showed a cheque for £x appearing in my account on 18 March, it seemed safe to schedule a payment three working days later on 23 March. I am EXTREMELY unhappy that you decided that the funds were not available on 23 March and are charging me £30 for a decision that must have cost you pennies in computer time.

This kind of behaviour makes me seriously think about closing my current account with you. I will be blogging this complaint, and your response.

Bank of Scotland: It will take up to 4 banking days (after we receive it) for a cheque to clear in a current account. The cheque will show in the 'balance' of your account on the day we receive it, but not in your 'available funds' until the cheque has fully cleared and the funds are available for withdrawal.

Me: That is less than clear in your user interface. It would also be trivial for you to automate the process of notifying customers that insufficient funds are available and asking whether they wish to postpone or cancel an online payment.

A £30 penalty is entirely disproportionate to your costs. If you apply this penalty in this case I am planning to make a complaint to the Office of Fair Trading, and close my account.

Bank of Scotland: I can advise this charge is for a failed payment.

At the time the payment were called for, the balance in your jar was not sufficient to cover these payment

Intelligent Finance does not offer the facility to monitor accounts on an individual basis.

It is our customer's responsibility to ensure there are sufficient available funds within the account to cover any payment instructions which are set up.
As a gesture of goodwill, I will arrange to credit your account today to cover the charge. Any future charges will stand.

A happy ending, and reminder that it is always worth complaining over unfair treatment. If that doesn't work, as Ross Anderson says: a lawsuit never hurts.

Oxford hosts final PrivacyOS conference

2010-03-25T16:36:00.003Z

Next month (12-13 April) we will be hosting the final Privacy Open Space conference at Worcester College in Oxford. Come along to hear from our Europe-wide community of researchers, industry, civil society and regulators concerned with privacy in the information age.

Is technology the saviour of free speech?

2010-03-23T18:09:00.002Z

The new edition of Index on Censorship is out this week. It contains a whole range of interesting articles on privatised censorship, including one from yours truly on self-regulation. Pick up your copy today!

e-elections will be won in the real world

2010-03-21T12:22:00.000Z

"This is the big paradox of the so-called e-election. It will not be won by the party with the most hollow-eyed obsessives hunched over keyboards blogging and tweeting at all hours of day and night. Success will belong to those who can use the internet to so organise and enthuse supporters that they log off from their virtual worlds, pound the pavements, knock on doors and get out among voters in the real one." —Andrew Rawnsley

MPs: don't rush through extreme Web laws!

2010-03-18T10:52:00.003Z

Six thousand people have now written to their MPs to politely request that they do their job, and properly scrutinise the Analogue Economy Bill. If you think democracy is, actually, quite important, then you should do so too today!

The Financial Times certainly isn't impressed:

In the commercial world, major legislation concerning copyright, such as Britain’s Digital Economy Bill, is unlikely to withstand the second great variable – the coming of age of the net generation. Laws banning file-sharing are likely to prove as unpopular as the poll tax that helped bring down the Thatcher government. They also look utterly unenforceable.

As a harbinger of change, we are seeing political parties springing up throughout Europe with names such as the Internet party or the Pirate party, which understand the web as simply part of human DNA. “In the collision between the old and the new on the web,” argues Rex Hughes, a Chatham House fellow who is leading a cybersecurity project, “the old always wins the first few rounds but eventually they die off.”

The wanton theft of our liberties

2010-03-17T12:14:00.001Z

"Individualism and autonomy used to be prized rights of our people. Now they are held in contempt by our governors. If we seek reasons not to give Labour another term in office, this wanton theft of our liberties should be high among them." —Simon Heffer

Spooks v. recording industry

2010-03-13T11:16:00.004Z

If only both could lose… In this extraordinary leaked memo, the British Phonographic Industry's public affairs director sets out his concerns that the Security Service, MI5, is secretly funding opposition to the government's Digital Economy Bill:

The debate has been given an extra twist with a Talk Talk sponsored survey today, which says that 71% of 18–34 year olds would continue to infringe copyright, in spite of the Bill provisions, and would use "undetectable methods" to do so. Whether MI5 helped pay for the survey is not clear, but the results helpfully play into their court.

He also tells his colleagues that MPs have given up on having any chance to properly scrutinise the Bill:

MPs with whom we spoke back in Autumn are already resigned to the fact that they will have minimum input into the provisions from this point on, given the lack of time for detailed scrutiny… John Whittingdale [MP, chair of select committee on culture, media and sport] has said this week that he still thinks it could be lost if enough MPs protest at not having the opportunity to scrutinise it.

Watching legislation being made is truly never a pretty sight.

The evidence on DNA retention

2010-03-09T17:34:00.005Z

Who to believe? The Home Secretary, who claimed today that Conservative plans to stop the retention of DNA profiles taken from arrested but unconvicted individuals would lead to "23 murderers or rapists going free in the last year alone"? Or the House of Commons Home Affairs Committee, whose detailed report this week stated:

It is currently impossible to say with certainty how many crimes are detected, let alone how many result in convictions, due at least in part to the matching of crime scene DNA to a personal profile already on the database, but it appears that it may be as little as 0.3%—and we note that the reason for retaining personal profiles on a database is so that the person can be linked to crimes he/she commits later… It is not known how many crimes are solved with the help of the stored personal profiles of those not previously convicted of a crime… We are not convinced that retaining for six years the DNA profiles of people not convicted of any crime would result in more cases being cleared up—let alone more convictions obtained—than retaining them for three years. We therefore recommend a three year limit.

How can we have a sensible debate on criminal justice policy if the Home Secretary ignores careful reports from select committees (where his own party holds a majority), and so carelessly throws around such serious accusations?

UPDATE: Chris Pounder points to the even more damning conclusion of Parliament's Joint Committee on Human Rights:

“When asked for further information on statistics relating to individual cases, the Government has been unable to provide it. For example, we asked the Government for more information about the ACPO research which it states illustrates that 36 rape, murder or manslaughter cases during 2008-09 involved matches to innocent persons’ DNA retained on the NDNAD which were of 'direct and specific' value to the investigation. Unfortunately, the Government was unable to conduct this analysis within the time that we asked for a response… We recommend that the Government publish the details of these cases, if necessary in a suitably redacted format, or it should stop referring to them as support for its proposals."

NHS continues attempt to destroy patient trust

2010-03-08T16:02:00.005Z

The NHS is continuing with its very badly thought-through plans to upload patients' basic medical records to the central "Spine" database without their explicit consent:

GPs say they fear patients' rights are being overlooked, that "scaremongering" is being used to get people's agreement for the database, and that hackers could illegally access the central computer.

The damage this will do to doctor-patient relationships once the inevitable breaches occur hardly bears thinking about.

The Analogue Economy (Preservation) Bill

2010-02-26T11:07:00.004Z

There is one piece of good news about the Digital Economy Bill being considered by the House of Lords. The Conservative and Liberal Democrat parties are to block clause 17, the constitutional outrage that would have allowed the government to rewrite copyright law through poorly-scrutinised statutory instruments whenever they chose.

Clauses 10–16 of the Bill remain a disaster. As Jerry Fishenden says:

"The Bill claims to be about protecting copyright and intellectual property in the digital age. But in reality it seems to be more about preserving the dying business model of middle-men publishers, be they the music, film or publishing industries. There is little recognition of the need to protect the interests of those who actually create and make a living from original content, of moving to new ways of encouraging and nurturing innovation. We need to expedite the natural disintermediation of these stale old business models, not to bankroll them through ill-designed legislation.

"One thing is for sure. The Digital Economy Bill is going to become a textbook case of flawed legislation and the extent to which policymaking is damagingly behind the reality of the world in which we live. My concern, however, in the meantime, is that it will do enormous damage to the economic and social fabric of the UK at the very time when we need to be taking advantage of the Internet, not trying to shut it down."

Amnesia, obfuscation and hush money

2010-02-24T07:08:00.003Z

The Commons' Culture, Media and Sport Committee has come to some devastating conclusions about News International's phone-hacking activities:

493… This inquiry has subsequently revealed more facts, including the pay-offs made to Clive Goodman and Glenn Mulcaire and that they tapped the phones of the princes themselves. They also highlighted the fact that a culture undoubtedly did exist in the newsroom of News of the World and other newspapers at the time which at best turned a blind eye to illegal activities such as phone-hacking and blagging and at worst actively condoned it. We condemn this without reservation and believe that it has done substantial damage to the newspaper industry as a whole…

495. In seeking to discover precisely who knew what among the staff of the News of the World we have questioned a number of present and former executives of News International. Throughout we have repeatedly encountered an unwillingness to provide the detailed information that we sought, claims of ignorance or lack of recall, and deliberate obfuscation. We strongly condemn this behaviour which reinforces the widely held impression that the press generally regard themselves as unaccountable and that News International in particular has sought to conceal the truth about what really occurred.

There are also some juicy-looking morsels on privacy and libel law, which I will digest later.

Mark Thomas on Digital Economy Bill

2010-02-13T10:28:00.001Z

Includes interviews with Billy Bragg, Feargal Sharkey, Cory Doctorow and Jim Killock:

The laboured assault on civil liberties

2010-01-31T10:00:00.000Z

"[The rule of law] has been invoked down the ages in the face of oppressive government legislation, but it seems to have been forgotten altogether under this shameless government. Not much evidence that David Blunkett, the author of the Criminal Justice Act 2003, had ever heard of such a concept, much less tried to square his proposals with it. But then, if you prepare your criminal legislation on the basis of the law and order agenda of the editors of the Daily Mail and the Sun, you are bound to find you have drifted far from the port of the rule of law." —Mark George QC

Je ne regrette Iraq

2010-01-30T11:52:00.000Z

"There is a planet, some way removed from the real one, on which Tony Blair lives. He invited the Chilcot inquiry to join him on it yesterday. On this alternative earth, certainties dissolve and falsehoods become truths. Facts are transformed into opinions and judgments turn into evidence. Success and failure are both the same. On this strange planet, the invasion of Iraq was not a disaster, but a necessary and even heroic act. Other witnesses to Chilcot have admitted error. Mr Blair simply said he would invade Iraq all over again." —The Guardian

Photographers not terrorists

2010-01-23T13:26:00.002Z

Always up for a demo on a Saturday morning.

Hillary Clinton on Internet freedom

2010-01-21T18:07:00.005Z

The US Secretary of State has issued a ringing declaration of the "freedom to connect" in her speech today. I'll try and dig up links later to the interviews I've done on this for the World Service and BBC News, but here's what I told Index on Censorship:

Hillary Clinton’s support for online freedom is welcome. I hope it leads to a push for Internet companies to make that freedom meaningful. Microsoft, Yahoo!, Cisco and others can all do much more to protect the privacy and free speech of Internet users around the world. Search engines should join Google in refusing to provide censored results. Webmail providers should store messages and account information out of reach of repressive regimes. Infrastructure companies should refuse to sell “surveillance-ready” Internet routers to countries such as China and Iran.

At the same time, democracies should be careful of their own online freedoms. The US and UK both require Internet Service Providers to enable real-time interception on their networks. The UK government has strong-armed ISPs into blocking access to web pages on a secret list of alleged child pornography, including last year a Wikipedia entry. European ISPs are required to log information about their customers’ online activity — which in the UK is accessible without a warrant to hundreds of central and local government agencies. We should hardly be surprised when repressive governments follow our own example.

You can also read a preprint of a much longer article I've written on Internet self-regulation and fundamental rights.

UPDATE: Bruce Schneier writes: "Whether the eavesdroppers are the good guys or the bad guys, these systems put us all at greater risk. Communications systems that have no inherent eavesdropping capabilities are more secure than systems with those capabilities built in. And it's bad civic hygiene to build technologies that could someday be used to facilitate a police state."

Visualising the Great Firewall

2010-01-16T15:28:00.003Z

See also Jonathan Zittrain, Ross Anderson and others in the New York Times: Can Google Beat China?

Oxford still not quite getting student diversity

2010-01-12T10:20:00.000Z

Oxford University is supposedly doing its best to encourage applications from state school sixth-formers. Invigilating at an exam full of students in "subfusc" this morning, however, put me in mind of an evening with the Bullingdon Club (spot the mayor of London and leader of the opposition in the photo above).

I wonder how these silly fancy dress regulations impact on teenagers who don't wish they had gone to Eton.

Sanity v the war on terror

2010-01-10T12:04:00.000Z

"After spending hundreds of billions of dollars and imprisoning millions of people, it's slowly beginning to become possible for some politicians to admit that fighting a necessarily endless drug war in pursuit of an impossible goal might be a bad idea. How long will it take to admit that an endless war on terror, dedicated to making America a terror-free nation, is equally nonsensical?" —Paul Campos

The totally-pants bomber

2010-01-09T10:32:00.002Z

"What’s most striking about the government’s response to this unsuccessful bombing attempt is the complete lack of any rational relationship between the actions that have been taken and are being proposed, any analysis of which of these and similar tactics did or did not contribute to the success or failure of the Christmas Day attack on Northwest Airlines flight 253, and any likelihood that they would make future attempts at terrorism less likely to succeed." —Ed Hasbrouck

"Any reasonably competent terrorist organisation, with access to funds, capable technical experts and a small number of operatives able to move about the world freely can blow up airliners in flight." —Lewis Page

Communications data mining doesn't catch terrorists

2010-01-07T16:50:00.002Z

I spoke this afternoon at the annual Media, Communication and Cultural Studies Association conference, in a plenary session on surveillance. Here are my slides:

Communications Surveillance: Justification and Efficacy

View more presentations from Ian Brown.

Labour’s fixation with control is strangling everyone

2010-01-03T12:53:00.000Z

"Our sense of self depends on our having some control over how we live. Labour made a disastrous mistake when it abandoned its own tradition of self-help and mutual assistance for a distrustful bureaucratic state. We are not willing to be the helpless observers of our lives." —Jenni Russell

The politics of fear

2010-01-02T15:13:00.001Z

"A risk that is completely dwarfed by numerous others — the risk of death from Islamic Terrorism — dominates our discourse, paralyzes us with fear, leads us to destroy our economic security and eradicate countless lives in more and more foreign wars, and causes us to beg and plead and demand that our political leaders invade more of our privacy, seize more of our freedom, and radically alter the system of government we were supposed to have. The one thing we don't do is ask whether we ourselves are doing anything to fuel this problem and whether we should stop doing it. As [John] Adams said: fear 'renders men in whose breasts it predominates so stupid and miserable.'" —Glenn Greenwald

DNA retention hampers policing

2009-12-31T11:44:00.000Z

"When ministers or police chiefs seize on the odd case, always with emotional pulling power, which they claim would not have been solved without a big DNA database, they should consider the long-term implications of an intrusive DNA policy. An alienated population seldom provides the tip-offs the police need to catch criminals, or the evidence in court needed to convict. This has been a problem at times within some minority communities who regard the police as hostile. How much more difficult life would be for the police if this attitude became widespread.

"A smaller, targeted DNA database would not only be a more effective tool in crime-fighting; it would act as a sign that the creeping expansion of the surveillance state was being reversed. In this instance civil liberties and the real interests of the police point in the same direction. The only people who still need convincing are current Home Office ministers, and the senior ranks of the police." —Damian Green MP

Happy Xmas!

2009-12-22T11:37:00.001Z

A wonderful new addition to Martin Rowson's cast of end-of-humanity characters:

Publics need persuading on climate change

2009-12-20T11:26:00.007Z

The lack of a binding agreement on carbon emissions in Copenhagen is regrettable in the extreme. That said, it is perhaps a warning signal to politicians that they have not yet done enough to persuade voters that radical action is needed. Too many political leaders are still terrified for their jobs and Senate majorities if they take the necessary steps to stop the planet frying. (Of course, the leaders of non-democracies have no such excuse).

Matthew D'Ancona, former editor of the Spectator (which likes to promote absurd contrarian denials of the climate impact of atmospheric CO₂), at least has this right:

If you want a "green revolution" — and the evidence suggests that you don't – it must truly be from the bottom up. This Government's strategy – to sneer at the doubters — is doomed, not only because doubt is the cornerstone of democracy but because, on this specific issue, the doubters are in the majority. Copenhagen marked the end of an era: it demonstrated the poverty and self-regard of elite politics, the introspection and self-congratulation of a political class still in love with itself because nobody else will love it. The lesson of 2009, from duck houses to green summits, was that that kind of politics is dead, and a new kind is needed. Any ideas?

Well, Matthew; since you ask…

Changing behaviour to reduce energy demand

View more presentations from Ian Brown.

Does the Internet support political revolution?

2009-12-20T10:33:00.004Z

Clay Shirky on the impact of the Internet on authoritarian regimes (via Andrew Sullivan):

Iran’s geopolitical importance is paramount on many fronts at once. Clearly, the protests following the 12th June elections were aided by social media. Although Twitter got top billing in western accounts, the most important tools during the Tehran protests were mobile phones, whether to send text messages, photos, or videos. Twitter, predominantly, was a gateway to western attention.

By the time the regime managed to shut down the various modes of communication available to the Tehran protesters, they were retiring to rooftops and shouting slogans into the night. Although this act of coordination did not use technology per se, it was made possible by the visible evidence provided by users documenting and broadcasting the earlier solidarity of the street protests. This is why figures showing how few people use social media for political change are red herrings. Insurrections, even pro-democracy insurrections, always begin as minority affairs, driven by a small, young, and well-educated population before they expand more widely. In the Iranian case, once the information about general discontent had successfully cascaded, the coordination among the populace remained intact, even when the tools which helped disseminate that information were shut down.

Paper beats electronic patient records

2009-12-15T07:45:00.005Z

If this wasn't so shocking, I would be pleased to see that we had some significant new evidence on the efficacy of electronic patient records:

A leading academic has dealt a major blow to the Government's embattled electronic patient record rollout, after publishing a major global study claiming systems of its kind hamper rather than improve clinical care.

Professor Trisha Greenhalgh, professor of primary healthcare at University College London, led a review of hundreds of previous studies from all over the world, which found that large systems such as that being developed by Connecting for Health, are less efficient than locally-based systems and often less useful than paper records.

If only the Department of Health had engaged Professor Greenhalgh before they spent £4 billion on the NHS National Programme for IT. Or even just listened to their own accident and emergency clinicians, one of whom wrote earlier this week in the Daily Telegraph that:

When someone is brought in unconscious or unable to speak or give any history, the priority for the medical staff is to ensure they are physiologically stable — that they are breathing, their heart is beating and their blood pressure is adequate.

While background details are important, these are rarely the pressing concern when someone is in extremis. Yet the Government has repeatedly justified the ludicrously expensive NHS IT programme on the grounds that it is needed in precisely this situation. The reality is, it's not. Not only this, despite vast sums being spent, the system is not fit for purpose. Aside from the issues around confidentiality and the Government's refusal to allow people to opt out from having their personal details entered into the system, the whole thing has proved to be an ill-thought out, wasteful and unnecessary white elephant.

ID cards down. What's next?

2009-12-12T08:00:00.003Z

The Chancellor tells The Daily Telegraph:

"Most of the expenditure is on biometric passports which you and I are going to require shortly to get into the US. Do we need to go further than that? Well, probably not."

This comes after the spending of at least £120m on the scheme.

Facebook starts to fix application privacy

2009-12-10T06:20:00.006Z

Facebook's new privacy controls have received global media coverage today. Their new privacy defaults have been called a "disaster in the making". However, they have at least started to fix the gaping privacy problems their platform has with third-party applications:

When you visit a Facebook-enhanced application or website, it may access any information you have made visible to Everyone as well as your publicly available information. This includes your Name, Profile Picture, Gender, Current City, Networks, Friend List, and Pages. The application will request your permission to access any additional information it needs.

Users can also separately control which information their friends' applications can access. Previously your installed applications could access just about all of your profile information (and much of your friends').

The largest remaining issue is that your friends list should not be publicly available, as it can reveal not just your patterns of association but also enable de-anonymisation attacks on your privacy based on your social network. This is otherwise a positive step — shame it only came after a ruling from the Canadian Privacy Commissioner and an opinion from the European data protection commissioners.

UPDATE: Much more on this by the Electronic Frontier Foundation.

Mobile phone and Internet access now a necessity

2009-12-07T09:15:00.003Z

The Young Foundation has today published a new study, Sinking & Swimming: Understanding Britain's Unmet Needs. Recommendation six states:

Our research has repeatedly confirmed how quickly some things have moved from being luxuries to become necessities. People living in rural areas are not alone in thinking of the car as a necessity. But the mobile phone is much the clearest example of this shift – invaluable and prioritised by everyone from refugees to unemployed teenagers. Given the importance of social contact to mental wellbeing and life opportunities, perhaps this should be reflected in how essential support is provided to people in hardship, and in regulation that already treats some other utilities as necessities. Access to the internet is also becoming a necessity (not least as public services go more fully online) and for many the mobile will be the main point of access.

Perhaps someone should tell Lord Mandelson, before households start being disconnected on the basis of unverified allegations of copyright infringement?

NHS IT system down. What's next?

2009-12-06T15:58:00.002Z

The Chancellor has announced this morning that the NHS's troubled National Programme for IT, estimated to cost £20bn to operate over the next decade, is to be significantly scaled back:

"You know, for example, the NHS had a quite expensive IT system that you know, frankly, isn't essential to the frontline. It's something that I think we don't need to go ahead with just now."

I'm sure the government will be looking carefully through our Database State report to find further ideas for reducing the Public Sector Borrowing Requirement.

Fightback coming on Digital Economy Bill?

2009-12-04T15:02:00.005Z

The recording industry clearly thought the Digital Economy Bill, with its constitutionally outrageous copyright proposals, was a done deal. Judging from the Lords 2nd Reading debate on Wednesday, they might be right — only Lords Lucas and Whitty and Baroness Miller had much sensible to say:

Lord Lucas: We have to be careful too about the industry cloaking itself in the finery of the small, creative individual. We are not talking about the small, creative individual here, but about powerful, monopolistic industries and giving them power over citizens… The recording industry is another major beneficiary of what is being done here. That industry is not exactly known for its kindness to creative people. Many people have created pieces of music and sold them to rapacious recording companies for a couple of hundred quid, only to see those companies go on to make vast sums out of them… We also need to bear in mind that the problems now facing the industry are, to quite a large extent, of their own creation. The industry has been extremely slow to listen to the demands of its customers, and has had something of an abusive relationship with them, seeking to punish them before thinking of how to serve them better. It has taken a decade for the industry to produce sensible alternatives to illegal file-sharing, and the fact that a generation of people have become used to an illegality comes down to the industry's sluggishness.

Baroness Miller of Chilthorne Domer: While understanding the wish of industry for protection from the tides of change, the Government have, in Clauses 4 to 17, laid the emphasis too much on stemming that tide and not enough in channelling it into the new business models. Can the Minister elucidate the most successful, established and emerging business models for monetising online content? Noble Lords have mentioned Spotify, micro-payments and other forms of payment for content. How will they be made easier and more convenient? What vision do the Government have for this? What studies have they done to see how free, ad-funded models might also succeed?

Lord Whitty: Surely the main way forward should be to develop legal ways in which the interests of rights holders can be met and to which consumers can relate, not engaging in sanctions that raise serious issues of consumer rights and human rights. That is happening but it is happening slowly and, as other noble Lords have said, it is happening far too late. The main focus of this debate and the main focus of this Bill should be to develop those alternative measures. Instead, the headline of this part of the Bill regrettably is on sanctions. It is on criminalising people who are unwittingly engaged in downloading and it is setting in statute and through the regulations that Ofcom will be required to produce sanctions that are not proportionate to the loss to the original rights holders. They are not necessarily the original rights holders because, as the noble Lord, Lord Lucas, said, most of the rights are actually owned by monopolistic companies, not individual creative persons.

However, today's resignation of Pure Mint Recordings CEO Anthony Hall could be the start of a fightback:

"I have enjoyed contributing to both [the BPI's] Rights [Committee] and the [IFPI's] ILC, but increasingly feel that my contributions are falling on deaf ears as an agenda has already been reached that I now consider is unmovable. As you know, I do not think the Digital Economy Bill is a sensible or well thought out piece of legislation. In my view it is being rushed through the last months of a parliament of an unpopular government and it is not legislation that I support".

Referencing clause 17 — the one that gives senior ministers the right to change copyright laws on whim — he continued: "I am particularly surprised that the record industry has chosen to endorse s.17 of the DEB, which I consider is wholly undemocratic and contrary to centuries of good practice regarding the forming of our copyright legislation. I also believe it may set a dangerous precedent going forwards (and could come back to haunt the industry)".

You can follow the progress of the legislation at Parliament's new Bill Tracker.

Tories crowdsource a new government IT strategy

2009-12-01T13:32:00.003Z

Any ideas on how to improve government IT strategy? The Conservative party would like to hear them:

You certainly couldn't do any worse than the leaked Government draft strategy…

Local newspapers aren't worth saving

2009-11-10T08:46:00.002Z

"For many years the local press has been one of Britain's most potent threats to democracy, championing the overdog, misrepresenting democratic choices, defending business, the police and local elites from those who seek to challenge them. Media commentators lament the death of what might have been. It bears no relationship to what is…

"It's true that the vacuity and cowardice of the local papers has been exacerbated by consolidation, profit-seeking, the collapse of advertising revenues and a decline in readership. But even if they weren't subject to these pressures, they would still do more harm than good. Local papers defend the powerful because the powerful own and fund them." —George Monbiot

Politicians are intoxicated by cowardice

2009-11-03T22:00:00.002Z

"Drugs policy is desperately important. It has the power to wreck lives, families and communities. It underpins a third of crime and 80% of acquisitive crime. Four decades of illegality have done nothing to curb consumption, merely breeding the most lucrative, untaxed product market in Britain. No country has achieved the remotest success with prohibition, but Britain's archaic laws have been the least successful. Go to any deprived area, any difficult school, any failing social service, and the root cause of trouble is drugs." —Simon Jenkins

"Speakeasies, moonshine and gangsterism live on in folkloric infamy, even though the disastrous American experiment in prohibition only lasted for 13 short years. It has been three times as long since the 1971 Misuse of Drugs Act instigated its own unwinnable war. In the late 1960s there were 2,000 registered drug addicts, together with a perhaps similar number who lived their life below the radar. Four decades on there are 360,000 problem drug users. Addicts scramble to spike their veins with dangerously adulterated substances that sell at inflated prices, while modern-day Al Capones clear up. As well as accompanying an explosion in damaging narcotic use, strict prohibition has gone hand in hand with an equally remarkable increase in recreational dabbling, making criminals of a huge minority of young people along the way. Half the government, as well as the Conservative leader and three US presidents in a row, have used drugs in their own youth, and yet punitive laws continue to threaten others who do the same with prison. The three-year sentence that a teenager can receive for providing friends with a few ecstasy tablets snuffs out his future far more surely than any drug, and does so at great expense to the taxpayer." —The Guardian

My FT lead feature: Can creative industries survive digital onslaught?

2009-11-03T11:14:00.003Z

Always a pleasure to be commissioned by the Financial Times, especially to write a lead feature for today's Digital Business supplement:

Can creative industries survive digital onslaught?

Ian Brown examines the competing rights of content producers and file-sharers and argues that new business models are the future, not blocking users

If you are interested in following up any of the points made, here are some references:

Jack Valenti told Congress that cable TV was “a huge parasite in the marketplace”: Richard Corliss (2007) What Jack Valenti Did for Hollywood, Time, 27 Apr

…and that “the VCR is to the American film producer and the American public as the Boston strangler is to the woman home alone.” Hearings before the Subcommittee on Courts, Civil Liberties, and the Administration of Justice of the Committee on the Judiciary, House of Representatives, Ninety-Seventh Congress, Second Session, 12 April 1982

The recording industry claims… online copyright infringement will cost the UK music sector £200m this year: British Phonographic Industry (2009) Reducing online copyright infringement

The US Supreme Court decided in 1984 that video recorders should not be considered as directly contributing to copyright infringement: Sony Corporation of America v. Universal City Studios, Inc., 464 U.S. 417 (1984)

Google stumbled upon the sponsored search model that now earns billions of dollars each quarter: Google Inc. (2009) Google announces third quarter 2009 results, October 15

James Murdoch asks, can online journalism compete with the “dumping [of] free, state-sponsored news on the market”? James Murdoch (2009) The Absence of Trust, Edinburgh International Television Festival MacTaggart Lecture, 28 August

The Guardian’s Emily Bell worries that “the ecology of some parts of the UK media is now so uncertain and fragile that it can be depleted by a single blow from the end of the BBC's tail as it rolls over in its sleep": Emily Bell (2008) We need to start a new conversation about the BBC, The Guardian, 28 April

Established musical acts recently had their most successful year ever on tour, grossing over $4bn worldwide in 2008. Tours by Bon Jovi, Bruce Springsteen, Madonna and the Police all grossed over $150m: Ray Waddell (2008) Bon Jovi Scores 2008's Top-Grossing Tour, Billboard, 11 December

Two-thirds of the Guardian’s 30 million monthly online visitors come from outside the UK: Patrick Smith (2009) Guardian Hiring Bloggers For Local News Network, paidContent:UK, 12 October

Blogzilla is 4! And his big brother is 15!!

2009-10-31T15:04:00.006Z

Amidst this week's rejoicings at the 40th birthday of the Internet, Blogzilla is celebrating his own fourth year on the Web. Doddering along behind is the prehistoric Web presence of the author: so old even the Wayback Machine didn't catch up until 1997. Perhaps fortunately, this avoided the purple flares phase of 1994-1996.

To think, it was only fifteen years ago that a first-year undergraduate friend eagerly introduced HTML 1.0…

Cops go for Regional Internet Registry

2009-10-23T09:44:00.004+01:00

The FBI and UK Serious Organised Crime Agency are getting heavy with RIPE (thanks, Lilian!):

Andy Auld, head of intelligence at SOCA’s e-crime department… used the Russian Business Network (RBN) cybercrime network as an example of the type of criminal enterprise they were targeting. The now disbanded group used an IP network allocated by RIPE, a European body that allocates IP resources, to host scam sites, malware and child porn.

RIPE actions might lend themselves to interpretation, viewed in the harshest terms, as being complicit with cybercriminals and "involved in money laundering offences".

"We are not interpreting it that way. Instead we are working in partnership to make internet governance a less permissive environment," Auld said.

This explains some recent EU discussions about blocking "criminal IP address spaces". RIPE is unimpressed:

Press coverage this week portrayed the RIPE NCC as being involved with the criminal network provider Russian Business Network (RBN). Any connection with criminal activity, or with RBN itself, is completely unfounded.

The press coverage arose from a speech given by the Serious Organised Crime Agency (SOCA) in the UK. SOCA has since contacted the RIPE NCC with an apology. The RIPE NCC will continue to work with SOCA and other bodies to ensure criminal investigations can be carried out in an efficient manner within established laws and guidelines.

Policy-based evidence making

2009-10-20T10:43:00.002+01:00

Two revealing examples in one day of how this government approaches policymaking:

The UK's biggest ever investigation of sex trafficking failed to find a single person who had forced anybody into prostitution in spite of hundreds of raids on sex workers in a six-month campaign by government departments, specialist agencies and every police force in the country… Current and former ministers have claimed that thousands of women have been imported into the UK and forced to work as sex slaves, but most of these statements were either based on distortions of quoted sources or fabrications without any source at all.

Civil liberty campaigners claimed a victory today after the government announced it is dropping current proposals to retain the DNA profiles of innocent people on the national database… The authors of the research on which Home Office ministers based their plan had disowned the proposals. The Jill Dando Institute for Crime Science said its work should not have been used to decide the six- to 12-year time limits because the work was unfinished.

Sigh. Wouldn't it be nice if government departments thought through the impact of policy options before proposing, let alone enacting, legislation?

Consumer privacy and online marketing

2009-10-19T10:14:00.004+01:00

Next month I will be acting as a rapporteur for the European Consumers' Association (BEUC) at their Brussels conference on privacy and marketing. Alongside the EU Commissioners for the Information Society and Consumer Affairs, there will also be keynote speeches from the European Data Protection Supervisor and a number of other prominent experts. You can see the programme and register here.

The irresistible illusion of Afghanistan

2009-10-18T12:11:00.001+01:00

"Obama has so far committed to building ‘an Afghan army of 134,000 and a police force of 82,000’, and adds that ‘increases in Afghan forces may very well be needed.’ US generals have spoken openly about wanting a combined Afghan army-police-security apparatus of 450,000 soldiers (in a country with a population half the size of Britain’s). Such a force would cost $2 or $3 billion a year to maintain; the annual revenue of the Afghan government is just $600 million. We criticise developing countries for spending 30 per cent of their budget on defence; we are encouraging Afghanistan to spend 500 per cent of its budget.

"Some policymakers have been quick to point out that this cost is unsustainable and will leave Afghanistan dependent for ever on the largesse of the international community. Some have even raised the spectre (suggested by the example of Pakistan) that this will lead to a military coup. But the more basic question is about our political principles. We should not encourage the creation of an authoritarian military state. The security that resulted might suit our short-term security interests, but it will not serve the longer interests of Afghans. What kind of anti-terrorist tactics would we expect from the Afghan military? What kind of surveillance, interference and control from the police? We should not assume that the only way to achieve security in a developing country is through the restriction of civil liberties, or that authoritarianism is a necessary phase in state-formation, or a precondition for rapid economic development, or a lesser evil in the fight against modern terrorism." —Prof. Rory Stewart (via Andrew Sullivan)

The lives of the other

2009-10-17T10:50:00.000+01:00

"In recent years general concerns about privacy in Britain have been greatly inflamed by the disappearance of personal data and great rows over planned mega-databases. The public increasingly perceives information collected for official convenience as a malign intrusion. And fears of recreating The Lives of Others are all the greater when the others in question are also "the other" in cultural terms. Muslims read every day about western fighting in Muslim lands. This week they heard MI5's director trot out a less-than-reassuring reassurance on torture of mostly-Muslim terror suspects, and this morning they read that the foreign secretary has been covering up what the government knew in one such case. Already angered by the sense that the ordinary rules no longer protect them as they do everyone else, many more followers of Islam may be tempted to succumb to militant rage if they feel they have been singled out for special snooping. Surveillance aimed at gauging the extent of a problem could end up making it very much worse." —The Guardian

The UK's unspoken constitution

2009-10-12T14:33:00.002+01:00

"We the elite, do not believe in the kind of constitution most other advanced nations have — those that boast a belief in popular sovereignty; with resounding declarations such as ‘we, the people’, and that tend to contain rules about how governments should act.

"We describe ours as the ‘unwritten constitution’. It is a collection of laws, fictions, powers left over from the old monarchy and powers that we make up as we go along. It allows us to decide what governments can do; and best of all, only we have the power to change it.

"We disguise the fact that it is neither popular, representative nor accountable through a set of myths about the ‘Mother of Parliaments’, Magna Carta and the rule of law… We are also able to treat the people not as citizens but as subjects. We encourage people to believe that they are free, though actually they are in chains, unfelt but real chains nevertheless…"

Enough poison about the Human Rights Act

2009-10-05T09:23:00.001+01:00

"They have fought important battles for personal freedom: opposing 42-day detention of suspects without charge, opposing ID cards, and opposing unjust extradition, and the poorly designed European arrest warrant. And it has taken these positions in a thoughtful and well calibrated way, without naivety as to the gravity of the issues involved.

"It is time, now, for the Conservative party to take the final step: to make the Conservative case for the Human Rights Act. It is our own bill of rights, and it is Churchill's legacy." —Peter Oborne

"The Tories have suggested introducing a Bill of Rights, based on the provisions in the convention, but also drawing on this country's own traditions and sorting out the problems of judicial application. That would be a properly conservative approach, although given the amount of legislative time taken up by constitutional measures, my suspicion is that this will slide quickly down the list of Tory policy priorities." —Philip Johnston

Selling surveillance to authoritarian regimes

2009-09-24T16:35:00.003+01:00

Timothy Garton Ash has a strong comment piece in today's Guardian on the continuing political developments in Iran. He suggests:

A textbook example of what democracies should not do was provided last year by a joint venture between Siemens and Nokia, called Nokia Siemens Networks. It sold the Iranian regime a sophisticated system with which they can monitor the internet, including emails, internet phone calls and social-networking sites such as Facebook and Twitter, much used by Iranian protesters. In today's politics of people power, that is the equivalent of selling a dictator tanks or poison gas.

So, to be clear: a German company, Siemens, which used slave labour during the Third Reich, sold a Holocaust-denying president the instruments with which he can persecute young Iranians risking their lives for freedom. Think of that every time you buy something made by Siemens.

When this first hit the news in June, Nokia Siemens stated that they had sold technology that would allow Iran to monitor phone calls rather than Internet usage. The former is mandated in many countries' telephone networks under "lawful intercept" rules, including the US and UK. The latter is not, although the UK Home Office is doing its best with its proposed Intercept Modernisation Programme.

Democratic governments need to think much more carefully before requiring technology companies to develop products that could have an extremely repressive impact in undemocratic regimes lacking human rights protections. They should also update export controls to prevent the sale of these tools to states such as Iran. In the meantime, individuals can help by diverting their business away from companies that are aiding and abetting authoritarian regimes.

A Liberal-Conservative alliance?

2009-09-20T11:38:00.001+01:00

"It's clear: the real enemy of progressive politics is not the Conservatives and I would not claim it is the Liberal Democrats. In truth, it is the bureaucratic, backward-looking, big state government that Labour epitomises. That is why at our conference, instead of trying to create some artificial dividing lines between Liberal Democrat policy and Conservative policy, my message will be: if you want rid of Gordon Brown and the big brother state, and if you care about our schools, our quality of life and our liberties, then join us in one national movement that can bring real change." —David Cameron MP

Tories to reverse rise of database state

2009-09-16T08:33:00.004+01:00

It's always nice to see your research end up as Opposition policy. Even better, of course, once they are in power to implement it. Shadow Justice Secretary Dominic Grieve comments:

“This Government’s approach to our personal privacy is the worst of all worlds — intrusive, ineffective and enormously expensive.

“We cannot run government robotically. We cannot protect the public through automated systems. And we cannot eliminate the need for human judgment calls on risk, whether to children, or from criminal and terrorist threats.

“As we have seen time and time again, over-reliance on the database state is a poor substitute for the human judgment and care essential to the delivery of frontline public services. Labour’s surveillance state has exposed the public to greater — not less — risk.”

Databases and child protection

2009-09-15T10:16:00.004+01:00

Retired senior detective Chris Stevenson, who ran the investigation into the Soham murders, has an extremely sobering article in today's Times on why he believes new checks on the 11 million adults who have regular contact with children would not have made any difference in that case:

As a result of poor intelligence, [Ian] Huntley was appointed a school caretaker in Soham. Did that give him access to children? Yes, hundreds. Did he abuse them? No. In fact he reported to the headteacher that several teenage girls had made inappropriate comments. What Huntley did to Holly and Jessica was as bad as it gets, but did he come into contact with them through being a caretaker? Not exactly — he was caretaker of Soham Village College, a school for the over-11s. The two girls attended St Andrew’s Junior School. Different building, different caretaker. Huntley had contact with them because [girlfriend Maxine] Carr was employed at St Andrew’s as a classroom assistant. She worked in a class with Holly and Jessica, who both liked her. Holly’s mother sent Carr a box of chocolates on the last day of term to say thank you for helping her daughter.

Before trying to find policy solutions, it always helps to be sure exactly what the problem is. Headmaster Anthony Seldon adds:

Subjecting everyone in sight to checks, placing surveillance cameras everywhere, subjecting every institution to intimidating inspections, hemming in all relationships with contract and law, and driving everyone mad with bureaucracy is categorically not the way forward.

The case for legalising all drugs is unanswerable

2009-09-13T12:23:00.001+01:00

"The war on drugs is a failed policy that has injured far more people than it has protected. Around 14,000 people have died in Mexico's drug wars since the end of 2006, more than 1,000 of them in the first three months of this year. Beyond the overflowing morgues in Mexican border towns, there are uncounted numbers who have been maimed, traumatised or displaced. From Liverpool to Moscow, Tokyo to Detroit, a punitive regime of prohibition has turned streets into battlefields, while drug use has remained embedded in the way we live. The anti-drug crusade will go down as among the greatest follies of modern times." —John Gray

Could Paine inspire Cameron?

2009-09-09T14:42:00.001+01:00

"We live under a government that has almost certainly been complicit in torture; given state officials unprecedented power to snoop; undermined local democracy in England; eroded trial by jury; continued the Thatcherite assault on the public domain; presided over growing inequality; and sustained London's ignoble role as a happy hunting-ground for the world's ultra-rich. The gap between the state's proclaimed civic values and its oligarchic practices is becoming too glaring to miss." —David Marquand

The war on drugs has failed

2009-09-06T10:35:00.001+01:00

"No country has devised a comprehensive solution to the drug abuse challenge. And a solution need not be a stark choice between prohibition and legalisation. Alternative approaches are being tested and must be carefully reviewed. But it is clear that the way forward will involve a strategy of reaching out, patiently and persistently, to the users, and not the continued waging of a misguided and counterproductive war that makes the users, rather than the drug lords, the primary victims." —former Brazilian president Fernando Henrique Cardoso

All in the public interest?

2009-08-31T14:17:00.002+01:00

"The 1998 Data Protection Act would allow access to some confidential databases if the journalist were acting in the public interest. However, the public interest is not obvious in the work summaries that [private investigator Steve] Whittamore listed on his weekly pay claims: 'Bonking headmaster, Lonely heart, Dirty vicar, Street stars split, Miss World bonks sailor, Dodgy landlord, Judge affair, Royal maid, Witchdoctor, Footballer, TV love child, Junkie flunkie, Orgy boss, BBC gardening blunder, Hurley and Grant, EastEnders star…'" —Nick Davies

The Murdochs and the media

2009-08-29T10:54:00.004+01:00

In this long, self-serving rant from Rupert Murdoch's son and anointed heir at News International, there is some sense struggling to get out:

Rather than concentrating on areas where the market is not delivering, the BBC seeks to compete head-on for audiences with commercial providers to dampen opposition to a compulsory licence fee. The corporation is incapable of distinguishing between what is good for it, and what is good for the country.

Yet bizarrely, James Murdoch spends the rest of the article attacking the one part of the BBC's output — its news and current affairs programming — where the strongest case can be made for limited state intervention. A carefully circumscribed and robustly impartial BBC news channel would certainly do more for the UK's democracy and soft power than a toxic Fox News UK.

Perhaps the government can do a deal with the Messrs Murdoch: a BBC without the soap operas, movies and sports that are amply provided by the market, and a less interventionist Ofcom, in exchange for much more robust enforcement of competition law and a limit of one national media outlet per beneficial owner. That would have the side benefit of saving us the nauseating spectacle of the leaders of both main parties flying around the world to pay obeisance to Murdoch Snr.

Facebook to fix application privacy problem

2009-08-27T15:27:00.002+01:00

It's always good to see problems you've highlighted in your research fixed, even if it does take several years:

Facebook has agreed to retrofit its application platform in a way that will prevent any application from accessing information until it obtains express consent for each category of personal information it wishes to access. Under this new permissions model, users adding an application will be advised that the application wants access to specific categories of information. The user will be able to control which categories of information an application is permitted to access. There will also be a link to a statement by the developer to explain how it will use the data.

This change will require significant technological changes. Developers using the platform will also need to adapt their applications and Facebook expects the entire process to take one year to implement.

Now the privacy commissioners are taking action, perhaps their competition law counterparts can take a look at our more recent work!

Summer bliss

2009-08-27T10:29:00.002+01:00

For only the second time in five years…

Take 3 strikes into the shower?

2009-08-26T13:46:00.001+01:00

"The creative industries are noisy and well organised, but they are minnows compared with our networking and computing industries. Government’s role is to strike a balance between the needs of rights holders on the one hand and society’s need for fast, efficient and lightly regulated networking on the other. That’s difficult to do and it will take time to work out, which is why Lord Carter set aside three years for the job. It’s not something that should be rushed on the basis of a dinner conversation in Corfu." —Prof John Naughton

Encryption ain't easy

2009-08-21T11:21:00.006+01:00

Encrypting data is an elementary mechanism to protect it from unauthorised access. It would have trivially prevented the UK's biggest data breach to date, and many others, and is now mandated across UK government systems. But why do some software companies continue to make it so *&^$&^% awkward? Apple, I'm looking at you…

FileVault, which encrypts your home directory under Mac OS, has caused me real difficulties on my MacBook, where it has corrupted my files on several occasions (once even requiring a complete reinstall). Now that I've got Apple's Time Capsule remote backup system, it will only backup FileVault partitions when you logout (usually just as I want to switch off the power). It also breaks Time Machine's selective restore function. Why is it so badly designed? It's hardly surprising that many users just give up and leave data vulnerable to thievery.

PS It also breaks Sophos Anti-Virus, but that is probably more Sophos's fault.

Fixing the DNA database

2009-08-12T15:03:00.006+01:00

The Home Office consultation on the future of the UK's National DNA Database has just closed. You may recall that the indefinite retention of DNA from all those arrested was found last December by the European Court of Human Rights to be a "disproportionate interference" with privacy that "cannot be regarded as necessary in a democratic society." I wrote a consultation response with some FIPR colleagues that suggested that:

On the key issue — retention of profiles from unconvicted individuals — the proposals are an entirely inadequate response to the judgement. By retaining profiles of unconvicted individuals for 6 or 12 years, they would leave England, Wales and Northern Ireland greatly out of step with the vast majority of other Council of Europe members. The Court noted approvingly that Scotland retains profiles only of those suspected of violent or sexual offences, for a period of 3-5 years, and that "the strong consensus existing among the Contracting States in this respect is of considerable importance and narrows the margin of appreciation left to the respondent State." The proposals would continue to treat innocent individuals as suspects by retaining their DNA profile for much longer than those, for example, who voluntarily provide samples to rule themselves out of enquiries.

We have suggested that the Home Office should therefore plan a further consultation around primary legislation that more carefully considers the impact of retaining profiles of innocent individuals on both crime and human rights. It seems there is little alternative given that a legal opinion for the Equality and Human Rights Commission found that the existing plans would still be in breach of the Convention.

Tories and Google Health

2009-08-09T11:38:00.003+01:00

More on the Conservative plans for medical records:

Individuals would share their notes with private hospitals and patient support groups, under the plans which would also involve the scrapping of the centralised database system currently being introduced in the health service, which has been dogged by problems and delays.

Under the Conservative scheme, patients would be able to annotate their official records, alerting family doctors and hospitals to side-effects they had suffered as a result of taking medication, or medical symptoms which had gone undetected.

The Tories will consult on more radical measures such as whether patients should be given the right to "edit" their own records, deleting information with which they disagreed. In such instances, NHS doctors might still be given access to the unedited version, it suggests.

The Tories need to be careful that they don't simply replace an inefficient, blundering, expensive public monopoly NHS database with a much more efficient private monopoly system that could be even more dangerous for patient privacy.

The development of the surveillance state

2009-08-01T11:51:00.005+01:00

Adam Serwer has some interesting background on the development of the US surveillance state:

The roots of excesses in law enforcement and incarceration … have almost the same impetus as those that created our modern surveillance state: fear of the other. Nixon's 1968 campaign was implicitly premised in large part on his ability to protect the silent majority from black criminality and radicalism, just like Bush's imperial presidency was meant to protect us from scary Muslim terrorists. It's only now, that fully 1 in 31 Americans is in prison, on probation or parole, that the public is beginning to recognize the problem, because the police state has gone beyond its mandate to protect "us" from "them." It's now locking "us" up too. The surveillance state will likewise only be met with sufficient skepticism once people realize it can be turned on "us" as well as "them."

The new Information Commissioner, Christopher Graham, makes a related point in his response to the Home Office's "Intercept Modernisation Programme" consultation: that Internet surveillance should be targeted at individuals already suspected of illegal activities, not blanketed across the entire population:

The consultation does not appear to have fully investigated other options that may exist between the two extremes of a single, centralised Government database of all communications data and doing nothing. The ICO response presents several other options that need to be properly considered and open to public debate and comment. Full consideration of all available solutions is essential to ensuring that the final decision as to which option is selected fully considers the proportionality and necessity of that solution against other possible solutions.

Of course, there should be ex ante judicial scrutiny of allegations of suspicion rather than the UK's feeble political warrantry regime.

Dr Google will see you now

2009-07-28T13:46:00.000+01:00

"The Conservatives, whose independent review on medical IT reports soon, say there is no prospect of NHS records being handed over to Google in bulk. The party argues that it is simply preparing for an open source world, where individuals will manage and share data more effectively, and cheaply, than government ever can. If people want to use Google Health, or Microsoft HealthVault, they should be allowed to, on their own terms.

"But for individuals to be empowered, they must first be protected. Data is only guarded by the promises of the organisations that hold it. Users can protest if the terms of their contracts are changed, but there are no central rules and no central control. For some, that is the attraction. But do not mistake this for a right to privacy." —The Guardian

Lord Lester, tethered goat

2009-07-27T23:37:00.000+01:00

"What about the Human Rights Act? The government damaged its creation by blaming the act for its own political mistakes. It never campaigned effectively to explain why human rights protection matters for everyone and not only for villains or cranks. It published proposals for a separate 'bill of rights and responsibilities' that would create no new legal rights and impose no new responsibilities, but would create uncertainty and confusion. The idea of building on the Human Rights Act by creating a Great Charter of Rights and Freedoms was entirely beyond ministers. The sad reality is that the government is illiberal and often deeply reactionary. It lacks imagination, ambition and respect for personal liberty. It continues to make too many vastly complex laws instead of making existing laws work in practice." —Anthony Lester

What should replace the NHS überdatabases?

2009-07-27T10:24:00.003+01:00

It's good to see that the discussion is now opening up on what should replace the £20bn NHS system of centralised medical databases if the Conservative party wins the next election. David Davis MP writes in today's Times:

"There are powerful arguments for people owning their own information and having rights to control it. There are massive weaknesses in the NHS’s bloated central database and there are benefits from using the private sector. But there are also enormous risks, so we are still a long step from being able to give personal data to any company, let alone Google."

No doubt Google's PR flacks will be running around today trying to contain the damage (update: here we go). But Mr Davis is right that extreme caution is required in the design of systems containing so much highly sensitive personal data; and that while many solutions are likely to be preferable to the NHS's ill-starred National Programme for IT, that doesn't mean we should rush into the arms of Google (or indeed Microsoft).

We DO want competition in the provision of health data services that meet strong privacy (and interoperability) requirements.

We don't want any more centralisation than is necessary, because of the security and availability risks, but also the temptation for future governments to grab hold of that data without patient consent — for national security, medical research, and whatever other purposes are politically convenient at the time. So a Google-type solution would probably look less like Google Search and more like Google Wave, with GP practices and hospitals running Wave apps on their own servers, federated to exchange data where necessary, with strict controls and an absolute requirement for patient consent.

The best solution is to fund GPs and hospitals to buy whichever electronic patient record software best meets their clinical needs, so long as it meets key interoperability and privacy standards — not to push patients into the arms of large database companies whose business models are based on exploiting medical records.

Secret life of the private eye

2009-07-25T11:52:00.000+01:00

"If one considers the profitable activities of companies like QinetiQ, Blackwater, Sandline International and myriad similar companies, their dominance in providing these sorts of less well advertised services in trouble hotspots all over the world and at home, one cannot but surmise that industrial and personal spying on largely innocent people has been turned into a very lucrative industry." —Helen Pender