ThinkingString

Walk this way

2008-12-17T15:28:00.002Z

With the migration of the ThinkingString main website onto a WordPress platform, this blog has now been migrated to the ThinkingString main website. All the blog content has been migrated over from here to there, and no further updates will be made to this blog.

Please come here here for new posts

Or cut and paste the following URL into your browser's address bar: http://www.thinkingstring.com

What's happening with Quocirca?

2008-11-03T13:52:00.002Z

Quocirca has taken up a phenomenal amount of my time since I joined with them earlier this year (which is a good thing). I've been busy writing and blogging under the Quocirca brand here and here (and check out other articles at the Quocirca web site). Meanwhile this blog has been left to rot alone.

At Quocirca the focus is on technology, specifically IT hardwareos ,ftware, software as a service and related services as they relate to whatever business problem that is being solved. In relation to sustainability there (of course) much focus on energy efficiency at the device and datacentre levels, innovations in the energy metering world, and nascent efforts to produce sustainability dashboards. And much more as well.

But that leaves all the social changes, politics, legislation, and general societal trends out of the picture. Hence I intent to swing some of those voices to this blog, giving me a clear separation between technology and none technology discussions. However all related to sustainability.

Busy. Busy. Busy

2008-07-08T17:45:00.002+01:00

Its all been 'go' since ThinkingString Ltd began providing coverage services to Quocirca Ltd. All the Quocirca folk have been very welcoming and helpful, but there has been a lot of organising to do in order to get my feet under the desk. Quocirca also has a great and trusted brand name and so the activity level has been on the up and up.

Quocirca has been looking at datacentre efficiency for a while, with both Clive Longbottom and Bob Tarzey also writing and researching around the pros and cons of various IT services provisioning models as far as their relative GHG emissions levels. My intention with Quocirca is to look at both efficiency gains, as well as the strategic role of IT as an enabler to the reduction of overall emissions by business.

What will be important in achieving efficiency gains will be to ensure that data centres are targeting a real emissions reduction, rather than focusing simply on productivity/energy. Making a data centre twice as productive per watt of energy consumed is laudable, however it is a wash in emissions terms if the gains are subsequently consumed by increased processing in the future. If business is serious about reducing emissions, we need to target an immediate 50% cut in energy consumption, and then maintain that level through the continued introduction of new technology and alternate energy production techniques.

We also need to make sure that any new technology introduced in order to reduce energy consumption doesn't actually result in higher GHG emissions elsewhere. It is important to factor in the HW replacement lifecycle costs, and the energy going into the production of the latest gee-whizz-energy-efficient model that replaces the old tried-and-true one we already had. It is also vital that the manufacturing technique for energy efficient devices doesn't generate harmful emissions. More on that later.

In the coming weeks I'll be revamping the ThinkingString website and also this blog. I'm looking to combine it all and along the way simplify the layout, and simplify it from my point of view as far as administration is concerned. Much to do...too few minutes in the day.

The toaster might be more energy efficient, but we're cooking in it

2008-06-24T07:22:00.002+01:00

James Hansen is the NASA scientist who twenty years ago warned the US Government about the reality of, and the dangers in climate change. In 1988, during what was then a record year of high temperatures (a record repeatedly exceeded since), Hansen testified before Congress and called for urgent action to reduce greenhouse gas (GHG) emissions.

Two decades later Hansen has again appeared before US Congress to say that we have long since passed the "dangerous level" for atmospheric GHG levels. In short, we need to get back to 1988 levels in order to survive. Hansen is a man to be listened to. He is the director of the Goddard Institute of Space Sciences, and has been "popularly" referred to as "the godfather of global warming science" - though his message is by no means popular with many who hear it.

Hansen's warning underscores the fact that energy efficiency, while being desirable and laudable, is not going to get us to where we need to be. Only transformational change, in societal structure (and therefore living and working lives) will drive GHG levels down to sustainable (and survivable) levels. In the technology industry, a reduced energy usage per computing task is only any good as long as the resultant efficiency is not simply burned doing more "business as usual" computing work. In transport, energy efficient vehicles are only any good if we don't use them to drive further. The list goes on.

This is the difficult part for us all. Energy efficient light bulbs do not cast a comforting light on the real task facing us. The simple changes are 95% comforting, and only 5% effective. A building that doesn't need artificial light to be a useful structure is better. Not requiring the building at all is transformational.

As Hansen told The Associated Press; "We're toast if we don't get on a very different path. This is the last chance."

Quocirca

2008-06-20T11:42:00.003+01:00

Very pleased to announce here that I have joined forces with Quocirca. I'll be covering "sustainability" for Quocirca. What does that mean? For a start I'll be looking at both techniques and technologies to reduce the footprint of existing ICT services. This is getting a lot of buzz in the trade press as "GreenIT", though as I have blogged about before - efficiencies are good business practice but they don't get us where we need to get to. So more importantly I'll be looking at the use of ICT, new energy generation techniques , and emissions capture technologies that are transformational in nature i.e. they enable a change in way that society and business operates.

Breakfast of champions

2008-06-13T22:13:00.001+01:00

We hear all the time that breakfast is the most important meal of the day. The question is; what's better: cereal, toast, English fry up, eggs, porridge? All of these are regarded as satisfying and all of them have their supporters (though personally I prefer avocado on toast with a cup of white tea). This morning however I had a really satisfying breakfast; a spirited debate concerning peak oil and climate change with an Estonian MP. Though I am sometimes accused of not being the best company first thing in the morning, I really appreciated the pick-me-up of some intelligent and passionate discussion over the cold remains of the first meal of the day.

Political expediency and the focus on the short term often overrides the necessity for long term strategic planning. My breakfast companion made the point (rightly) that the moment of inertia was too high for the necessary social changes to occur. I do not disagree with this point, and the recent reactions to high oil prices highlight this; hand wrenching by our political leaders as they wonder whether to bow to public cries for tax relief on bowser prices. This is why we must urgently, initiate and maintain a multi-party dialogue free of political point scoring. Only by addressing the barriers of opinion can we move forward.

Thank you Mr. MP for a champion start to the day.

2008-06-12T07:18:00.002+01:00

Earlier in June I posted this quote from John Wyndham. The intervening ten or so days has just reinforced the appropriateness of the quote, in my mind. Both the IEA, and Alexey Miller, who is the head of the Kremlin-owned gas giant Gazprom, are pointing to the likelihood of $250 a barrel oil prices. Much hand wringing and protesting by truck drivers all over the place. The drivers are even choking on their jasmine rice in Thailand, though whether a "drive-slow" or a "traffic blockade" would be noticed in Bangkok is another question.

Meanwhile, in my native Australia petrol is now at A$1.60 a litre and predicted to head to A$2.00. The Australian government of Kevin Rudd, which was voted in only last year and promptly signed up Australia belatedly to the Kyoto protocol, doesn't have the bravery to say what needs to be said: "Price reflects supply, and what we're seeing now is a harbinger of what a carbon emission restricted economy and lifestyle will look like".

This is why, to me, a carbon-down future is not an issue for technology. The highest barriers we will need to overcome are those in people's minds. Mind you, we can't blame them. Governments the world over have known about the reality and risks of climate change for at least twenty years, while Hubbert predicted global peak oil in the 1950s. Economic policy, education curriculum, and a lack of bravery and honesty by politicians have wrapped humanity in a warm(ing) comforter blanket of high energy dependency.

On the weekend I met up with some friends. The teenage son of one couple said that his high school science teacher says that global warming is caused by sunspots. I choked on my beer (we were having a quick rest and refreshment halfway through a bike ride), while I quickly jotted down the name of his school so I can make sure I don't send my kids there. No doubt it would be regarded as inappropriate meddling to make the reality of anthropogenic climate change a required aspect of the next generation's eduction. Pity, as they are going to have to live with the consequences of the choices and actions of today's workforce and government.

erisa conference

2008-06-11T13:59:00.002+01:00

So after a short train journey I am up in Wales awaiting the start of the eris@ conference, which is being run by ERISA and the Welsh Assembly. As I mentioned in an earlier post the conference is focusing on electronic crime, trends, solutions, state of play of the police forces etc. What, you may well ask, has THAT got to do with sustainability? Have I slipped back to InfoSec? Well, yes and no.

Yes; because clearly this conference is focused on cyber crime, which is of course the "other side" of infosec. That's the easy answer so I'll move right on to the "no" side...

No; because I will be speaking about cyber crime in the context of sustainability. If that is a leap of logic for you, here goes. First up, I don't think you can look at anything in isolation; time and again we (the BIG "we") have done that and have ended up misunderstanding or worse totally missing something because we slipped on the mental blinkers and ignored context. As the Internation Energy Agency says in their recently published report Energy Perspectives to 2050, "The BLUE map (see note below) is very challenging for the transport sector and requires massive decarbonisation of transport".

Whereas the IEA believes such cuts will come from carbon capture and storage, or non-petro fuel alternatives, it is my view that we must also massively reduce the level of regular business commuting. We must take vehicles off the road and business travelers out of the air. Doing so requires us to (both) drastically expand public transport alternatives to private vehicular traffic and introduce the means and incentives to work remotely. The latter requires a far expanded use of telecommuting and teleconferencing than we have in use today. What that means is "data everywhere" and a dramatic increase in remote access to corporate systems.

Meanwhile, legislation will also eventually come into play. Around the world various countries including the USA, Japan, and the EU are currently debating such legislation, mainly inthe form of GHG "cap and trade" systems. This will place a financial value on carbon emissions. In effect, a new and very valuable currency will be born. Under the IEA's BLUE model such carbon trading units may eventually be exchanging hands for US$500 a pop. Crime has been following money since before we even knew what carbon was, let alone invented a currency tied to it. So I believe it perfectly logical that we will see the emergence of crime around this area in the future. It is natural to me that the trading platform for CTU's will be electronic. QED: the crime targeting that CTU trading environment and currency will be "e-crime".

So, everything is connected. Or as they say in Wales; Bopeth chydir.

Note: The IEA refers to the necessary changes in industry as ACT model or BLUE model. The ACT model includes technologies that are currently available, or in a very advanced stage of development but perhaps short of widespread commercial availability. BLUE model technologies and changes are "to be developed". BLUE model changes are required in order for the world to meet what the IPCC regards as the necessary GHG cuts; being 50% to 85% of 2005 levels achieved by 2050, whereas the ACT model only achieves a return to 2005 emission levels by 2050.

Who owns sustainability?

2008-06-11T10:51:00.001+01:00

An increasing number of companies are announcing their "green" strategies, from travel and transportation, to high-tech, to supermarkets. It seems that every CEO has woken up the risks presented by the twin problems of climate change and peak oil. But what concerns me are the number of companies that don't seem to have quite got their head around what those issues mean. An awful lot of companies seem to be placing responsibility for "sustainability" or "green" into the hands of their Corporate Social Responsibility (CSR) officers. Now, don't get me wrong. Most of the CSR people I've ever met are very dedicated to their jobs, and the causes they manage to get funding and corporate support for. But I've never met one who has said that they feel they are in any way leading the company's strategic direction and pace. In fact, many have become resigned to the fact that the charitable programs that they manage are at the whim of whoever is the current sales manager; and at the mercy of the discretionary budget.

However, sustainability doesn't belong in the CSR department. ownership and governance of sustainability belongs at the board and executive management team level (think: CEO). Companies should no more place responsibility for sustainability in the hands of the CSR office than they would place responsibility there for corporate strategy, good governance, and risk management. Because those are the major elements inherent in a true sustainability strategy. If sustainability/green sits in Marketing or CSR, then you can be sure that a company is just painting green lipstick on the pig.

For those companies who "get it", no doubt we will soon see the creation of a Chief Sustainability Officer - especially in North America where they are particularly fond of creating a new exec' position and lumping them with a problem to solve. Where that occurs, the thing to watch for is how much influence the head greenie has over sales execution, facilities ops, field staff behaviour (in relation to travel), and strategic company direction.

An open letter to Richard Branson

2008-06-10T13:26:00.004+01:00

Dear Mr. Branson,
I am writing to you in the hope that you will actually put some serious business effort toward being environmentally friendly. No, I am not talking about the use of biofuels in the Virgin Atlantic fleet. I am sure that you know what I, and numerous leading environmentalists know; biofuels are not an ecologically sound nor sustainable replacement for petro-based aeroplane fuels. Even with oil priced above $130 a barrel, amidst calls for the UK government to scrap the £10,000,000,000 a year subsidy they currently provide to the airline industry, you still can't seriously think biofuels are the answer.

I am sure that you know as well as I do that there isn't enough arable land in the world to feed the fueltanks of the world's current aeroplane fleet, while leaving any land left for food production or forests to act as carbon sinks. What, I ask myself, would you feed all those Virgin Upper Class passengers once all the land has been turned over to fuel production? That biofuel flight was, permit me to suggest, a marketing stunt that permitted a little green washing of the red Virgin brand. No, the maths and the science don't add up, and I don't believe you can get to be the head of a brand like Virgin without enough intelligence to crunch the numbers and come up with the same conclusion; biofuels are not the answer.

But I also believe that you do recognise the reality of, and danger inherent in climate change. After all, you did pledge £1,600,000,000 to help fund action. There you were, standing smiling with Al G and Bill (you remember - the other Clinton) promising to put all the profits from Virgin's air and train operations for the next ten years toward reducing reliance on petroleum. So we agree that there is a need, and we both share a will. It just seems that we don't share an understanding of the way. Two out of three is surely enough for you to consider my suggestion.

Mr. Branson, let me lay it out. I'll say it quietly so as to not scare the Virgin Airline shareholders: we need to drastically reduce the number of flights. Not fuel them with algae or babassu trees; don't fly them at all. So here's my suggestion; how about putting some of that £1.6 billion toward establishing a world wide network of business executive meeting suites, interconnected with state of the art high-definition video conferencing capability.

You know better than I that there are basically two classes of traveller; the holiday maker and the business person. In one move you could take all those business travellers out of the skies and enable them to conduct their meetings online. Lets face it, business travel isn't really even any fun any more, what with all that hassle of stripping down to the silk socks; no Perrier passed security; lost baggage and hassle. Not to mention the lost productivity, what with not even being allowed to Blackberry in the air.

How much more preferable it would be to book meeting time in an executive suite, in my own city, and to avoid all the hassle of flying. How much more productive to be able to avoid all the time wasted checking in, traveling whilst having to be "off the grid", and then having to deal with hotels and all that at my destination. And how much more profitable for the Virgin group of companies? Think of all the cross sell opportunities that present themselves. The basic service comprising two suites in two cities (for say, half a day) could be priced just under the price of a business ticket. Meanwhile, business people could travel to and from the city centre in a Virgin train, while staying online using Virgin broadband. Of course people will expect the same excellent class of service they currently enjoy on Virgin Atlantic. Those massages in Upper Class really are a nice touch; but just think how much cheaper it must be to employ a professional masseuse if you don't have to train and pay them as a flight attendant too.

Of course this isn't a new idea; lots of companies are talking about the power of video conferencing. But I do believe that the Virgin brand of companies is in a uniquely powerful position. Unlike your competitors in the air travel business (say, like BA) "Virgin" isn't really an airline; its a brand umbrella. It is already diversified into a whole range of areas that complement each other. Meanwhile, unlike teleconferencing technology companies like Cisco, Virgin is already synonymous with business (and holiday maker) travel. Doing business is really all about communicating, while the travelling is just an enabler for that communication. "Virgin Business Telesuite" does have a certain ring to it; don't you think?

So how about it Mr. Branson? How about a little innovative thinking toward climate change? Biofuels? You wouldn't last five minutes with Alan Sugar with that one. Thanks for your time and all the best.

Regards,
Simon Perry
Sustainalyst
ThinkingString

PS. If you need some help with the business plan I have some time next week.

New Whitepaper: An introduction to peak oil

2008-06-09T15:48:00.002+01:00

A new whitepaper is available (another one of my jigsaw pieces) entitled "The Energy Fulcrum: An introduction to peakoil" available from the String Think page on the ThinkingString site. With oil bouncing around above $130 a barrel peak-oil theory is finally getting some play in the general media. This white paper provides a back grounder to peak oil by examining the exploration and exploitation challenges that limit the availability of oil supplies.

私は立法化する (*)

2008-06-09T10:38:00.006+01:00

(*) Legislate me

Despite a struggling economy, and a failure to meet its current obligations under the Kyoto protocol, Japan looks likely to take strong action to force industry to drastically cut CO2 emissions. Yasuo Fukuda, Japanese Prime Minister (pictured) will likely announce a self-imposed target of cutting greenhouse gas emissions by 60 to 80 per cent by 2050, according to media reports. The announcement is expected to be made in a speech at the Japan National Press Club.

While the US Senate bows to pressure from the united forces of the coal industry, Japan is looking to move unilaterally. Japan is one of the world's leading emitters of greenhouse gases, and is obviously an industrial powerhouse. Fukuda's government views climate change as a serious risk and one that also requires business/economic transformation rather than mitigation. The announcement is a recognition that without legislation industry is not likely to move far enough or fast enough on transformations that will enable the necessary cutting of emissions.

Practice your Japanese and say after me:
私は立法化する

IEA - Energy Technology Perspectives 2006

2008-06-08T14:40:00.004+01:00

The International Energy Agency (IEA) has published "Energy Technology Perspective: Scenarios and Stragegies to 2050". The report is the direct response to concern expressed at the 2005 G8 summit, and a subsequently developed action plan.

The report generally finds that a sustainable future for energy production is possible, addressing both climate change and peak-oil factors. Albeit the report actually states that a "more sustainable" energy future is possible - I'm not sure I get that. Its either sustainable or its not sustainable. Regardless of the semantics, the report highlights that substantial investment, substantial effort, and urgent action is required to stimulate transformation.

The report is strong in support for so-called clean-coal power production, a switch to natural gas for power gen', nuclear, and CO2 capture and storage. Of note is the view that decentralised power generation, fuel cells, and "emerging technologies" require further research and commercial development, and even then may only account for 3% of global generating capacity by 2050.

Technology is not the panacea that will get us there, rather it is one enabling factor, together with social/behavioral changes, a focus on efficiency, and political will and cooperation. This is not to be a short, easy journey. A soft landing for humanity will be a long journey; one that will take at least two decades to engineer and implement. Remember that the next time any company claims to have the simple solution.

E-Crime conference

2008-06-05T17:37:00.001+01:00

Next week I'll be in Wales. I've been asked to present at an eCrime conference by ERISA and the Welsh Assembly. The conference is focusing on electronic crime, trends, solutions, state of play of the police forces etc.

I will be speaking on the role that technology will be play in the future (IMHO), and therefore where the concern areas are for crime. Looking forward to it. The conference presentation will be available here as soon as my hosting services technical folk manage to solve a problem. I hope to also later post a video of the session.

The "Climate Security Act"

2008-06-03T17:49:00.003+01:00

This week perhaps the most important piece of potential legislation this year is being debated in US Congress. Before it is even passed, the legislation has already cost US businesses tens of millions of dollars. That is the estimated amount the US coal industry and energy companies and their lobby firms have already spent on ad campaigns to convince the US population that the "Climate Security Act" is a greater risk to the US way of life than, well, death by climate change.

The Climate Change Act, also known as "cap and trade" is sponsored by Joe Lieberman and John Warner. Lieberman was of course Former Next Vice President to the Former Vice President. His and Warner's proposed bill would seeks to place a cap on carbon emissions by US industry, with the cap limit lowering every year. This of ourse comes with a cost to the US economy. The bill therefore also provides for trading of unused carbon credits. Nothing new there. What is significant is that US politics have moved along so far since Lieberman stood aside Gore and that the act is being presented to Congress at all. In fact, amendments to the original draft call for a mandated total carbon reduction target of 66% by 2050. Stuff that in your power station chimney and smoke it.

Of course, the US energy industry, especially said coal fired power stations and the coal producers aren't taking this lying down. They're spending big to sway opinion their way, and considering that George W. Bush has already stated he'll veto the bill, it doesn't look like Lieberman/Warner will become as popular in our vocabulary as Sarbanes and Oxley have.

We need this legislation, and similar. Flawed as it is, and it is flawed, without it businesses will be left without the proven-to-be-effective kick start that regulation is. Now will they have a framework for necessary change. Self regulation and market forces are not enough to ensure the necessary scope of change nor the required sense of urgency. Self regulation in fact will ensure the status quo for longer. If you need any proof of that, witness simply the investment the Club for Growth has already laid down to ensure the failure of the bill's passage and the retention of the status quo.

Technology solutions will get us part of the way, but they will not get us there alone. In fact, historically there have been market drivers such as legislation underlying and driving technology adoption. SOX, HIPAA, Basel II, GLBA, The US Patriot Act. All of these acts prompted important change and improvements in corporate governance, and therefore in the IT systems that support those businesses. Similarly, climate change legislation is the only thing thatwill drive the necessary scope of behaviour change for businesses. Dripping out of those changes will be technology changes, go-to-market changes, social changes. Profit and Loss.

I make the easy prediction that the Climate Security Act will fail to pass. The harder to make prediction is that without it, or something like it, we will not achieve the necessary momentum and direction we need to achieve sustainability.

Very appropriate...

2008-06-03T14:31:00.000+01:00

“In the time now ahead of us a great many of these prejudices we have been taught will have to go, or be radically altered. We can accept and retain only one primary prejudice, and that is that the (human) race is worth preserving. To that consideration all else will for a time at least be subordinate. We must look at all we do, with the question in mind: “Is this going to help our race survive – or will it hinder us?” If it will help, we must do it, whether or not it conflicts with the ideas in which we were brought up, If not, we must avoid it even though the omission may clash with our previous notions of duty, and even of justice.
‘It will not be easy: old prejudices die hard. The simple rely on a bolstering mass of maxim and precept, so do the timid, so do the mentally lazy – and so do all of us, more than we imagine.”

John Wyndham - The Day of the Triffids

Legislate me

2008-06-02T16:51:00.000+01:00

According to Wikipedia (yeah...I know but its good enough for this purpose) the group named "The Club for Growth" is "a 501(c)(4) political organization and an affiliated political action committee that raises money for candidates who support a low-tax and limited-government agenda. The group claims over 40,000 members.".

Relevant to me is that they are the major mouthpieces for the US coal and petro industries and that on their behalf it is trying its best to prevent the adoption of "cap and trade" regulations in the US. As the debate continues this week in Congress, and The Club for Growth and their coal industry lobbyist friends "America's Power" continue their massive disinformation and influence campaign, they'll probably succeed. Succeed in slowing the necessary political and regulatory changes and accelerating our rush to a climate change crash landing.

The Club for Growth says "Are the unproven benefits of legislation worth the major job losses?".

It might be time to ask "Are the unproven job opportunities and benefits worth the loss of the planet that sustains the people in the jobs?".

Aren’t you the security guy?

2008-05-28T19:15:00.002+01:00

“Aren’t you the security guy? What’s all this global warming stuff got to do with that?

That’s a far couple of questions, and ones that I was asked recently. There’re a couple of ways I can answer, so I ay as well cover off all the bases…

Firstly, in case anyone accuse me of jumping on the latest bandwagon and doing my own little bit of greenwashing, I should say (with all due respect) that anyone who has to ask about my interest in the state of the environment probably doesn’t know me well.

Common sense told me some two decades ago that we were overburdening our environment. I got my first scuba qualification at the age of eighteen, and in the years that followed did a lot of diving off the NSW (Australia) coast. At the time I lived in a small town called Bundeena, completely surrounded by national park, and in a house where the front garden literally bordered onto the bay. At high tide, if you leaned over the front wall of the garden you could spit into the water. Bundeena is situated with the Royal National Park, which is the world’s second declared national park (the first being Yellowstone). My friend Rudi w was trying to start up a dive business based out of Bundeena, and through him and his efforts at building a diver’s ‘community’ I met many retired snorkelers and spearfishermen. They would tell stories lamenting the decline of the marine environment in the bay, compared t their youth. Even accounting for fishermen’s tall tales, there was clearly some truth amongst the stories they’d tell over a cheap schooner (near enough a pint) of beer at the local. Around this time Greenpeace was targeting Caltex over marine pollution from their refinery on the Kurnell peninsula.

A favourite walk of mine was from Bundeena out through the bush to the cliffs overlooking the Pacific Ocean. These cliffs, or The Balconies as we called them had a view that stretched from Sydney (North and to the left) to Wollongong (South and to the right). If the midpoint of the view was twelve o’clock then Sydney was at about nine and Wollongong at about 4pm. Over the period of about eight years that I spent visiting The Balconies I saw brown smears that marked both Sydney and Wollongong converge across the vista. The blue gap between the brown of industry’s influence eventually shrinking to the five minutes on either side of twelve o’clock. It seemed that time was running out even back then.

It is said that travel broadens the mind and awakens a sense of social awareness. I’ll be the first to admit that I have done more than my fair share of aeroplane based travel. The eleven plus years of my time with (the software vendor) CA saw me eating more airline meals than I’d care to count. China, India, Thailand, South Africa, North America, all over Europe – been there and got the CO2 footprint to go with it. Sparing the details; suffice t say that I witnessed and absorbed enough sights such that I am under no illusions that the planet can sustain the heaving numbers of people that are already with us today. Anyone who has looked out the window as the aeroplane clears the Asian Brown Cloud cannot fail to appreciate the scale of the pollutants pumped into the atmosphere by human activity.

Of course all of that might be construed as romantic, environmentalism unfounded in either science or business were it not for the depth and breadth of evidence. Anyone who has bothered to educate themselves on the current research, and the forward thinking of various individuals cannot fail to settle on an uncomfortable truth. With the exception of (the UK’s) The Independent most news outlets give climate change and peak oil short shrift. Even The Independent undermines itself through unabashed advertising for tourist flights, motoring and so on. Relying on any of them as a sole source of information will never give a clear view of the serious risk we now face.

On the business front it would be easy to point to the growing ‘greening’ of so many companies as evidence of the direction of the wind. Were it not however for the fact that so many ‘green strategies’ are no more than that – opportunistic strategies brewed up by the marketing and sales divisions to chase a “green dollar”. There is little evidence of strategic thinking, nor of true awareness or embracement of the extent of the problem we face, I wonder how many companies will sacrifice even one dollar of profit in order to stick to their green strategy. Or how many will abandon it when the next market driver that seems to offer larger, quicker profits appears. The acid test of any company’s green strategy is their answer to those questions.

The industry that has nurtured me and paid my bills thus far in my career is guilty of this too. The capabilities of ICT enable so many aspects of the required social change, but imagination, ambition, and a level of seriousness is lacking in the overall approach. More on that later.

I clearly recall a dinner conversation at a conference (NISC – by Sapphire) a few years ago. At my table was a gentleman who was in charge of risk analysis for one of the UK’s major banks. We discussed all the various issues he and his department tracked for the bank, in order=for it to calculate its risk exposure. Amongst the usual suspects were two that stood out for both their insightfulness and the surprising fact of their inclusion. Namely; the chances of London’s Thames Barrier being overtopped and London flooding; and global warming.

This has been a long post, but I will close off with one other thought. I happen to be holidaying on St. Mary’s (largest of the Scilly Isles, off Cornwall) as I write this. I spent today cycling the small island and enjoyed a picnic lunch amongst the remains of a Neolithic village. It was inhabit 3500-4000 years ago. At the time it was built what are now the various islands of the Scilly group were one; the sea level being much lower than today. How strange that so many of us view such things with curiosity and acceptance; tourist curiosities that we seek out and expose ourselves and our children to. How few of us think through the fact that there very existence points to the possibility of dramatic change in human condition and in the planet’s environment.

Am I the security guy? Perhaps, but I prefer to address and manage ‘risk’. Moreover I am a logical, curious, cynical, strategic thinker. I cannot perceive a single larger, more urgent, more important risk to humanity than that posed by the twin threats of anthropogenic climate change and peak oil.

GreenIT is wrong

2008-05-23T07:25:00.003+01:00

GreenIT is the shortsighted, unimaginative spasm of the IT industry's marketing department in a post-Y2K, post-SOX, post-OnDemand, post GRC world.

We can't afford this folly.

I am away for a week. While I am away I'll be writing this up as a full WP to be posted on in about a week from now.

The view from the peak is not pleasant

2008-05-23T07:10:00.004+01:00

Jigsaw piece...

The Peak Oil theory was pioneered in the 1950s by a geologist named M. King Hubbert (1903-1989), who worked for none other than Shell.

Shell's geologist Hubbert based his Peak Oil concept on the rather obvious point that you cannot extract oil that you have not discovered from the ground. So Hubbert reviewed mountains of data concerning oil discoveries, and oil extraction and production, dating back as far as the 1860s. Hubbert noted the common trend in oil field development for a new field to come online and oil production to increase as the field was drilled and developed. But then, over time, the inevitable effects of depletion would kick in and cause the overall production of the oil field steadily to decline.

Hubbert's Curve

In the days before sophisticated computers and elaborate spreadsheet programs, Hubbert crunched his own numbers. He cumulated the reserve figures for oil discoveries in the U.S. and the production histories of thousands of U.S. oil fields dating back almost a century. Hubbert observed and demonstrated, through a process called "reserve backdating," that most major oil discoveries in the U.S. had occurred by the 1930s. That is, even though reserves may not have been listed on a company's books until much later, they were, in geological fact, part of the original discovery many years before. And Hubbert focused on the point that after the largest oil fields had been discovered, in terms of both surface area and volume of calculated reserves, the "new" discoveries thereafter tended to be smaller oil deposits, or extensions of previously discovered oil fields and oil-bearing trends:

In a paper that he prepared and delivered in 1956, over the objection of several Shell executives, Hubbert postulated that total U.S. oil production would increase until about 1970 and then reach a "peak," from which it would then steadily decline in volume over time:Hubbert updated his 1956 predictions in the early 1960s and came up with essentially the same forecast of U.S. oil production peaking by 1970. Hubbert did not anticipate the 1968 discovery of the oil field at Prudhoe Bay, Alaska. But his numbers were prophetic, and eerily accurate, for the lower 48 states. Almost on cue in 1970, overall U.S. oil production peaked and commenced its long trend of irreversible decline, barely changed even by the development of Prudhoe Bay in the 1970s.

Thereafter, the U.S. has imported more and more conventional oil to meet its daily needs.

So the discovery side of Peak Oil theory holds that mankind has identified and located, if not actually discovered, most of the conventional crude oil that thestimated by some knowledgeable commentators at about 2.2 trillion barrels, about 90% has been discovered and about 1 trillion barrels haveere is to find in the crust of the Earth. The production side of Peak Oil theory holds that mankind has produced, and, of course, consumed, something near half of it. In terms of really big Peak Oil numbers, out of a worldwide resource base of conventional oil that is been extracted and consumed over the past 150 years or so.

Application of Hubbert's work to world oil fields predicts peak oil globally in or around 2004. With an accuracy of +/- a few years that would be...now.

I spoke about this a few weeks ago at the GSS conference. Now, CNN reports that the International Energy Agency is studying depletion rates at about 400 oil fields in a first-of-its-kind (by them) study of world oil supply. After my speech, a gentleman in the audience with 37 years experience int he oil industry (20 at the exploration end of the equation) congratulated me on my insight. "I don't know how many others here understood that, but I did. And I know you're right. And just about everyone in the oil industry knows you're right".

The view on the other side of the peak is not pleasant. Oil prices ain't coming down..

New Whitepaper - Energy Waves

2008-05-22T14:18:00.003+01:00

I've written about one of my jigsaw pieces in depth in a new white paper entitled "Energy Waves" available from the String Think page on the ThinkingString site. This is the first in a series and I will be adding more soon.

Conference roundup

2008-05-21T16:01:00.004+01:00

The first piece of follow needs to be to update you on some of the conferences I've been speaking at this year. These have been a mix of IT security industry; IT governance; and IT trends type events; and I have presented on a mix of bread and butter IAM related topics as well as two that drew more heavily on my climate change research.

I'd like to particularly Stafenie Geuhs of COMPUTAS for inviting me to an excellent NET-ID 2008 event in Basel. Here I spoke about vendor selection and trends in the IAM world. It was very good to see my old acquaintance Helmet Broder, formerly a SUN fellow and all round expert conference speaker. COMPUTAS conferences are reknowned for their excellent food and beverage, and the attention to detail that makes everything go very smoothly.

The Research Labs of my erstwhile employer (CA) invited me to keynote the second day of their ISGIG conference. Attended by an amazing audience, all with more letters after their names than I have in my name, I had the privilege of both sharing my thoughts on IT and social trends and the relevance to telecommuting and virtual relaty technologies in a business context. Jon Collins of Freeform Dynamics was on hand to provide insight, and it is always a great experience to bathe in Jon's knowledge as well as enjoy his excellent company.

Most recently, GSS Holdings of South Africa invited me to keynote their two day IAM conference. Dangerously they gave me a generous length of rope and asked me to present a topic entitled "People and Technology in the 21st Century". And this, after I'd been spending some time playing with my jigsaw puzzle. And the audience of 120+ came along on the ride to examine 100 year economic trends; peak oil; climate change and IT. This event not only allowed me an excellent opportunity to field test some of the jigsaw, it also provided a few pieces. I will write this up separately under the title "Load shedding". I always enjoy working with David Lello (CEO of GSS), and his team. Later this year David is relocating to the UK along with his wife as he expands GSS to Europe, and Northern America. I am looking forward to working with him and the team more often as that happens.

Along the way I have also been thinking about how to run all these conferences without me, or the audience contributing to the planet burning (attribution: GM). More on that later too. I commend all these conferences to you, but couldn't make that recommendation without also noting the massive CO2 footprint associated with the running of a conference. This is a common aspect of the behavior of the IT industry (and indeed any major trade) that is not sustainable. Note to self: need a sustainable conference model..

Investing in time

2008-05-21T13:03:00.005+01:00

Both of my regular readers have been pointing out to me the dearth new entries. Does it point to a whirlwind level of business and busyness, such that I am too starved of time to even post a line or two? Or too starved for motivation?

And right that they should take offence at my silence. In my defence, I have been doing a jigsaw puzle. But we'll get to that later, first I need to posthastily update on a few issues or two.

Firstly; conferences. I have participated in a number of conferences this year. Each was a pleasure to take part in; see relevant separate entry for details. I'd just like to quickly say how much I appreciated all the invitations to speak, and commend each of the conferences to you in future years. Though I'd like to see all of them run very differently next time; but more on that later.

There have also been a lamentably long string of security issues worth comment on; technical, social, regulatory, and environmental. Some of these have got a lot of attention in my mind during the last few months, so I'll come back to some of those.

Meanwhile, I have been working on my jigsaw. It is an especially challenging one. Jigsaw puzzle design has come a long way since 1760, when a London map-maker and engraver by the name of John Spilsbury made the first one. Jigsaws continued to be cut from thin boards of hardwood for nearly a hundred years before cardboard puzzles came onto the market. Experts in jigsaw puzzles all agree on a few reliable tips and techniques;

sort the pieces
identify the boundary (edge) pieces and build the border
if a piece doesn't fit, turn it around and examine the join from the back. This often helps to understand where a piece could correctly go.

The puzzle I've been working on doesn't have edge pieces - I'm finding more pieces that fit in beyond where I thought the edge of the picture was. My puzzle has an unknown and potentially infinite number of pieces. That fits in with my last point; this is an expanding picture and while I'm not sure how far it'll extend, but I do know that the more pieces that correctly fit the clearer the picture will be. I'll explain each one later. What I should explain now is that my jigsaw is a mental one; a construct not of cardboard nor of hardwood, but of observation and thought.

All this wouldn't be worth talking about if there weren't some conclusions eventually. These are worth getting out there now, and then filling in the details later;

anthropogenic climate change is real. It is the biggest risk to the current social order. It is the biggest risk the broader environment and all that lives in it faces. Period. Climate change is urgent. The consequences of us continuing to follow our current trajectory will be a miserable existence within the timeframe of a few generations.
Almost everyone I speak to know this to be true, even at a basic level of understanding.
There is an enormous task ahead that will require mobilisation of an unprecedented scale. Everything done to date, even by the most dedicated, knowledgeable, and committed, falls ridiculously short of the required level of engagement. Numerous obstacles are being erected to slow progress.
There is no clear plan of action or path forward. Thus we are mostly paralysed; like an animal in the headlights we are aware of an impending problem but its just so relaxing to watch the lights.....

Of course many have pushed long and hard to raise both awareness and action levels. Some of then have provided some of the jigsaw pieces, and all deserve respect. Thankyou to all of them for going first.

The question we all face today is where to start and what to do. I do not profess to have all the answers - I can only address anything in my own sphere of expertise and experience for a start. So I'll start with an area that I do know a little about - IT.

Every fews years the IT vendor community slowly wakes up to whatever they perceive as being the latest scary hook to hang a marketing message onto; Y2K; e-Verything; regulations; governance; homeland defence; mobile etc etc. At the moment the industry has recognised Climate Change as the next-big-thing and so now we have GreenIT. Any vendor that hasn't washed themselves green thus far will be splashing out the colour wheel soon. The problem is; GreenIT is going to make as much difference as us all holding our breathes for a minute to delay breathing out a lungful of CO2.

GreenIT is a dangerous distraction.

More on that later too, as I appreciate it is not fair to throw out such a statement without supplying a few more of the jigsaw pieces.

So, much to talk about. And the short answer to the question; "Why aren't you blogging?" is..."I've been thinking"....

Why do we still have dogs loose?

2008-03-05T14:02:00.004Z

How many times have you seen this cartoon? If you're answer is "about 100 times or so"...yeah....me too. At Net-ID
I saw it again, included in a not-very-exciting sales pitch for an OCSP responder product. What flabbergasted me though was the inclusion of the cartoon's origin (which for copyright purposes I too include below).

1993 this was first published. Lets just think about that for a moment. That dog must be at least a year or two old. I mean who'd trust a puppy with a keyboard? So that means this dog is now getting on for 15 years old. That's a respectable age for a canine. It is however a shocking length of time for us to still not have cracked the problem of accurate and trustworthy user identification on the 'net.

That dog is now finding it difficult to walk, and I didn't want to mention it but it smells a bit sometimes when it curls up in front of the fire. And I do wish it'd stop scratching itself like that when Auntie Kath is over. Meanwhile, the identity management industry continues to waffle. We still type userids and passwords in. We still buy laptops and desktops with no included device to replace userids/passwords. Apple is as guilty here as any W-Intel bundle. None of the 6 or so broadband router/firewalls I've bought in the last 5 years came bundled with such a device either. You might think that buying equipment for broadband connectivity might be a sign that the person was about to exposed to the nastinet (crawling with those pretty viruses). Another nice cross-sell opportunity for a smartcard reader/finger scanner/whatever. Comes to think of it, my bank hasn't offered to sell or give me one either. Identity theft....what is that again?

Get serious about identity management. Or the dog gets it....

Note: The cartoon included in this post is noted to be by Peter Steiner has been reproduced from page 61 of July 5, 1993 issue of The New Yorker, (Vol.69 (LXIX) no. 20) only for academic discussion, evaluation, research and complies with the copyright law of the United States as defined and stipulated under Title 17 U. S. Code.

Well that's helped then....

2008-03-05T13:41:00.005Z

The Metro is not exactly known for being a newspaper chock full of serious news. If you don't know it, the Metro is a smallish, colour newspaper given out to London commuters at stations. There's always a few celeb' stories, a half hearted attempt at a serious news story, and then lots of personal ads.

Being free, the carriages tend to be strewn with copies discarded by readers as they reach their station. Lemming like I picked up a copy this morning and my eyes were drawn hypnotically to the "page 3 model". What a set of sweet tendrils on that honey!

Apparently MessageLab, who clearly have been so successful at solving all our security problems they have little else to do, have rendered viruses into art. Messagelab spokesman Paul Wood, whom I can only think must be hoping for a payrise this year and is thus doing whatever he's told, soberly tells us that this is what viruses look like and oh, what nasty blighters they are too. And there I naively thought that viruses and their ilk looked like a hex dump, or a C++ program if you're lucky.

For a moment I thought that this was just another junky piece of Metro coverage. Nope. Checked the MessageLab website and they're so proud of this there is press release dating to Jan' 16th announcing this. So, not just another piece of junky coverage. I'll forgive you Paul if you announce that you're auctioning off these pieces of "art" to raise money for charity.

Collaboration tools

2008-03-03T18:11:00.004Z

One of the other big themes at Net-ID is SharePoint and other collaboration spaces. The use of these tools is rapidly rising, since MSFT introduced their initial offerings back in 2003. Of course Lotus Note and Groupware have been offering collaboration environments for a long time. But I think this is a space where MSFT's strength of position in the client and office productivity suite worlds will go a long way toward them evolving the marketplace. Clearly, collaboration spaces amplify existing security challenges especially with regards to content centric security models. We've had the establishment of the host access management market, and the Web Access Management (WAM) market. The next one to watch I think is the Collaboration Access Management (CAM) market. Already about 6 to 8 point solution vendors are offering add-on CAM products of varying levels of sophistication. Expect this to be an area of market consolidation by the large IAM suite players. Oracle especially is a logical mover in this regard. Stay tuned..

Net-ID 2008

2008-03-03T17:56:00.003Z

I'm in Basel today and tomorrow participating in the Net-ID 2008 conference. The theme of the conference is interoperability of identity management systems and actually tomorrow I am giving a presentation on that exact topic. I'll post the presentation materials up afterwards. It is clear from the software vendors who presented today that standards based interoperability is only being somewhat taken to heart. Proprietary mechanisms are being deliberately implemented in order to build a perception of value for a given vendor's solution stack, and then also lock in buyers into stack. Novell particularly admitted such in response to a question from me after their pitch.

I would note that we seem to be stuck in a quantum singularity and are repeating ourselves.

I would note that we seem to be stuck...oh never mind.

I am hearing excited reports of how identities will be soon inter-operable between public and private sectors and as evidence the on going roll out of a government issued national ID card, or a health benefits card is held up as evidence. I remember that discussion in 2001, 2002, 2003, well you get the picture.

Side note: by lunchtime I'd had about eight or so good solid conversations between sessions with people. Interestingly, unsolicited in came up that three of them have made decisions in the last 12 months or so to not have a car. Or more accurately, to not have a second car. In every case some catalyst has resulted in their family not having a second car anymore (wrecked, change of jobs resulting in loss of car etc). As one guy (from the US) put it "We found that we needed maybe 1.2 cars". All of these people are happily juggling car access right now, and/or are experimenting with non-ownership alternatives. For example one guy who lives in Washington DC has signed up with a service whereby you rent cars by the hour and access them via an issued smart card. really that count of people should four not three, as that situation applies to me as well. So that is 4 out of 9 people. Could we be beginning to see a cultural change in the attitudes to car ownership and transportation options?

Innovation and security

2008-02-27T19:13:00.004Z

Microsoft's fine from the EU got me thinking. It says a lot that it is a software company that has been on the receiving end of a fine that is record breaking in size. It says a lot about the importance of IT capability today and how much we rely upon the availability of the infrastructure and the accuracy and availability of the applications and information. But what really got me thinking was the reason for the fine; repeatedly exhibiting behavior designed to stifle innovation. Houston...we have a problem. Daily, attacks with an assortment of motivations from the curious to the criminal to the military take place at a much higher rate than reported publicly. That most people only hear of massive problems and breaches occurring and not about the rest is perhaps testament to the fact that on the whole a lot of people work very hard to keep everything secure and operating. We certainly do not want to hamper any of those efforts such that they're anything less effective than "as absolutely best they can be in every way".

History has shown that the attacks not only multiply they also adapt - there is innovation there too. So does anyone really think that those developing and designing on the attack side are deliberately holding their innovation back? This is a fundamental problem. Stifling innovations that evolve IT, or even overly delaying releases of new features to suit sales over secureness and resilience is making us all less secure. This is the big picture I think and we must not accept it as industry behavior.

Physical security

2008-02-26T12:02:00.001Z

I was away last week visiting the Outer Hebrides. It is a long drive, but we chose to self drive the small hatchback instead of generating a flight of Co2. Hence we crossed the Minch via car ferry. Cold, blowing a gale, and with waves literally crashing over the bow on the return trip. Spectacular. The handy passenger information told me that you would last 2 minutes if you found yourself in the water. and advised me to keep my woolen jumper on to extend my life by that crucial 10 seconds. But as I watched the salt water torrent heavily off the outer surface of the observation deck window I again wondered about the logic of having every passenger strip to their socks for every flight, while major car ferry crossings to and from the British isles are essentially never, ever checked. Meanwhile every vehicle can hold lot more explosive punch than 20 pounds of checkin airline luggage. Silly.

HYPE POP - PHONE VIRUSES

2008-02-14T21:11:00.004Z

With reference to this AFP reported story:
-snip-

Conditions ripe for phone viruses to spread

Viruses and hacking on mobile phones are still rare but attacks are a looming danger as more people access the internet and download files with their handsets, experts say.

A survey released this week at the industry's Mobile World Congress showed that only 2.1 per cent of users had been hit by a virus themselves and only 11.6 per cent knew someone who had been affected by one.

The poll by IT security specialist McAfee, based on 2,000 people in Britain, the United States and Japan, showed that 86.3 per cent had had no experience of mobile phone viruses.

The survey did suggest, however, that the more developed the mobile market is, with high use of the internet and downloads, the more likely people were to be hit by bugs.

Virus attacks in Japan, the most developed mobile phone market in the world, were far more commonplace than elsewhere.

"We should look at places like Japan which is where the future of mobile technology is," said Graham Cluley, a consultant at Sophos, another IT security firm.

"I wouldn't be surprised if we saw this problem growing because the phone is going to grow into a sort of mobile computer."

The website http://www.mobilephoneviruses.com, which tracks incidents of mobile virus infections, lists a handful of examples such as Skulls, Velasco and Commwarrior.

The latter infected about 110,000 phones in Spain last year, attacking phones running Nokia's Symbian operating system. It spread via MMS messages, text messages containing an audio, video or picture file.

"Viruses aren't a huge issue now, but they have the potential to be so in the future when internet use is more widespread," said a telecom analyst at the Forrester market research company, Pete Nuthall.

The industry is keen for phone owners to use their handsets for more than just calls and texting - for which profits are declining in developed countries - with internet and video, games and mapping the basis of new product offerings.

"It's a risk that we should be aware of but one shouldn't make it dramatic and worry people," said Emmanuel Forgues from Russian IT security group Kaspersky. "But it's a risk that exists and is certainly going to develop."

"There are few viruses that attack the operating system now. What people are looking at is how to propagate viruses," Forgues added.

One use of a virus would be to implant something in a user's address book for publicity or fraudulent purposes, for example.

Cluley said there were about 350,000 viruses written to attack computers running Microsoft Windows and about 200 known ones for mobile phone operating systems.

Computer viruses were now being written by organised crime gangs to steal money and personal information, while mobile phone viruses "have tended to be written by kids to show off", he said

A 12-year-old boy wrote a virus for the new Apple iPhone which disables it, "turning it into a brick", said Cluley, and a user had to go to the boy's Internet site and download some software.

This crude bit of malware, which could not spread from phone to phone, was said to be an upgrade for the iPhone's operating system.

At French network operator Orange, a spokesperson explained that "with the convergence of the worlds of IT and telecoms the threat is going to get more and more serious".

"What interest developers is that their viruses spread as much as possible," the company said, adding that telephones used a number of different operating systems at present, making this difficult.

Nuthall predicts that "it'll take one big public mobile phone virus attack to create alarm".

In the future, he expects the network operators like Orange to provide protection for their clients.

"You'll end up seeing operators selling bundled services which include a McAfee solution, for example," he said.

-snip-

Word that rhymes with 'full'

Mobile platforms based on current phone paradigms WON'T be at large risk of malcode. Bring it on if we want to have an open debate on that subject.

Internet based mobile (PC alternative) platforms might be subject to some of the same risks but it doesn't mean we should replicate the protection model we are suffering under today on PC platforms.

POP

Hype bust moment.

Hacked by Cupid's arrow

2008-02-13T14:21:00.002Z

Nearly eight years after the ILOVEYOU virus left us remorseful the morning after, apparently the FBI is warning of another lovestruck-themed attack. As various news reports document in the last 24 hours, according to the FBI we should expect another blow from the Storm Worm on Valentines Day.

Come the 14th, we might expect that the only hearts are broken ones as we are tempted into opening scam love letters in the way of online greeting cards. Be careful who you accept love from, or you'll catch a nasty infection.

But nearly a decade after 'the love bug' took a real toll on our inboxes and hopeful sensitivities we might reasonable ask whether this warning has been a bit hyped. In fact what the FBI reminds us is that the Storm Worm has "capitalized on various holidays in the last year by sending millions of e-mails advertising an e-card link within the text of the spam e-mail".

Not that we WILL be attacked, just a good old warning that we MIGHT be attacked.

Indeed what the FBI points out that given the pattern of behaviour of the Storm Worm, and given that Valentines Day is the next major event likely to have people hoping for an online greeting card we should merely "be on the lookout for spam e-mails spreading the Storm Worm malicious software (malware)".

What they're NOT saying is that they KNOW we're going to be the recipient of a large scale attack. They're NOT saying they have evidence, they are profiling past behavior and projecting forward.

This is valuable advice however we should keep in mind that the best tricks are the unexpected ones. We fall more wholeheartedly for what we aren't expecting. Expect the twist - that is the lesson in security. It is a harder one to explain and a harder one to teach, but it is nevertheless the one that will serve us all better in the long term.

Meanwhile, do be careful online or offline on Valentines Day. It is a jungle for the heart out there, but perhaps not a day you need the FBI to warn you of.

What does the evidence tell us?

2008-02-04T16:20:00.000Z

Let me start this post with a bit of ICT humour that I was just sent:

After having dug to a depth of 10 meters last year, Scottish scientists found traces of copper wire dating back 1000 years and came to the conclusion that their ancestors already had a telephone network more than 1000 years ago.

Not to be outdone by the Scots, in the weeks that followed, English scientists dug to a depth of 20 meters, and shortly after, headlines in the English newspapers read: 'English archaeologists have found traces of 2000 year old copper wire and have concluded that their ancestors already had an advanced high-tech communications network a thousand years earlier than the Scots..'

One week later, 'The Kerryman', a southwest Irish newsletter, reported the following: 'After digging as deep as 30 meters in peat bog near Tralee, Paddy O'Driscoll, a self taught archaeologist, reported that he found absolutely nothing. Paddy has therefore concluded that 3000 years ago Ireland had already gone wireless.

So what does the evidence really tell us. What of the emerging areas in information governance and information security is that of forensics. Back in 2000 (and beyond) most companies wanted to pretend that a security breach had never occurred. If the attack was conducted by an insider, it was more common for the individual (if they were caught) to be quietly asked to leave than it was for them to be taken to court. Of course, that just meant the problem moved elsewhere. Due to both the regulatory pressures of SB1386 and the like, and the maturing of the security industry, now we are far more likely to see companies taking efforts to investigate not only how an attack occurred and by whom, but also to gather data that might eventually be submitted as forensic in a subsequent legal proceeding.

There are a lot of catalysts for companies to search for evidence of the existence of information, and not just in the case of a cyber attack. Companies are now having to go to great lengths to retain and search their online (and offline) record stores. For example, in the case of a patent dispute or due diligence related to M&A activity and associated reviews by government competition watchdogs, companies may need to demonstrate that they have deeply examined their own records to prove whether they knew something, and if so when. Sometimes not finding something is as important as finding something.

I think we're just at the beginning of the maturity curve around information handling, governance, and information forensics. As an industry we have a lot to learn. Forensics is an area to watch in the coming years and one that we need to look at with a bigger picture in mind than simply that of investigating a cyber-attack after the fact.

PS. Thanks Panay for the joke

AutAvatar - MyCyberTwin

2008-02-04T15:32:00.000Z

Today I spoke with the real Liesl Capper, CEO of MyCyberTwin.com. In an earlier post I mentioned MyCyberTwin and also posted a conversation I had with Liesl's own cyber twin - or AutAvatar as I am going to call these twins. The real Liesl is a lot smarter and a lot more interesting than her AutAvatar. AutAvatars are avatars that are able to function and interact with (real) people without having to be driven by their owners in real time. They are 'programmed' to respond by their owners, and can engage in detailed Q&A sessions via an IM dialogue. While the AutAvatars that are available to be set up free on the MyCyberTwin site are perhaps more suited to casual and 'fun' use (think social networks, dating sites and so on), the core technology has in my view a solid value to a corporate usage. I have written up my thinking around this and the full paper can be downloaded here: www.thinkingstring.com/stringthink.html. I'll also be talking about this topic in my keynote presentation at the ISGIG conference.

New off-the-shelf services packages

2008-02-02T14:29:00.000Z

There's a whole new range of off-the-shelf services offerings available from ThinkingString, to help both technology vendors and technology buyers navigate the marketplace maze. All these are in addition to any ad-hoc consulting services engagements.

For details see http://thinkingstring.com/services

Identity Management Conference

2008-01-28T20:21:00.001Z

And one more conference for April....The Global Security Solutions (GSS) Identity Management and Privacy Conference 2008. Details are at http://www.idm2008.net. GSS is a South African based company specialising in the process and people issues around security. They are a good crew of people who deliver a unique set of services complementary to any of the offerings from the mainstream software and services companies operating in this space. I will be giving the day one keynote for the conference, and while down in South Africa, plan to visit some of the main industry players and IT sites. This is a part of the world that has a lot of interesting activities going on, and is also one that will benefit enormously from expanded capability in the virtual presence communications arena.

ISGIG 2008

2008-01-28T11:15:00.001Z

March is proving to be a busy month for conferences. I am very pleased to have accepted an invitation give the keynote presentation on the second day of ISGIG 2008, in Pisa, Italy. See http://isgig.org/index.shtml. Co-sponsored by ICST, Europe's largest scientific society, and CreateNet, one of the largest European research consortia, ISGIG 2008 aims to promote the understanding of information governance challenges and their debate among government, business, academia, and technology stakeholders to increase understanding of the issues affecting each stakeholder. ISGIG 2008 will host high-level keynotes from government, technical and business thought leaders, targeted case-studies and the presentation of applied research on these topics as conducted by the key stakeholder groups. The symposium will attract industry and business leaders, executive and government heads in an attempt to unravel complex issues of crossover business in addressing and resolving data protection, crossborder security and privacy.

I plan to speak about an area that I have been looking at in some detail; the implications to working life under the requirements for businesses to reduce their fully loaded carbon emission levels. Advanced teleconferencing, home working, tele-presence and virtual reality based presence are all areas where ICT can actually enable an alternative to reliance on commuting and business travel. But not without challenges around security, privacy, and information governance. This keynote will provide the backdrop to second day of conference which will include a realistic case study using Second Life as the case in which these same issues of security and privacy are put to the test. I look forward to seeing you there.

NetID '08

2008-01-28T09:17:00.000Z

One of the great conferences I am involved in this year is the 2008 Net-ID conference, taking place March 3rd to 4th in Basel, Switzerland. See http://www.computas.de/flyernetid082.pdf for all the details. As well as participating in a panel discussion regarding Identity Management infrastructure interoperability, I am also presenting on the second day, and I'll be taking dissecting what is real, and what is hype as far as security suites, and vendor support for standards. This is the second Net-ID conference I have been involved with over the years, and they are always great events with a strong line up of speakers, drawn from all around Europe and from a wide cross section of experiences. I strongly recommend you get your conference attendance confirmed ASAP. See you there.

Extra! Extra! Read all about it

2008-01-28T08:59:00.000Z

Announcing "SecurityExtra" (www.securityextra.com), a brand new information portal for the security professional. SecurityExtra will track news on both information security and physical security. In our view these are two aspects of the business of security that for too long have been treated separately when really they are the same.

SecurityExtra is the brainchild of Dan Ilett, a good friend and a long time critical reporter of the security industry. We are also joined by Richard Starnes, who is Director of the managed security operation at C&W, and familiar to many as a speaker on the conference circuit here in the England.

A virtual chat with the CEO of MyCyberTwin

2008-01-24T16:07:00.000Z

You: Hello Liesl

Liesl: Hey, good to see you!

You: Tell me about MyCyberTwin

Liesl: Mycybertwin is a cool software clone of a real human

You: Is it for play or for business?

Liesl: It could be, who really knows?

You: You're the CEO. What do you think?

Liesl: I think we could look at it from different perspectives. What you think about it.

Liesl: I wanted to ask you... what is the most important thing in life for you?

You: Understanding the nexus of technology and society. How one helps the other.

Liesl: Technology is a wonderful thing. Without it, I wouldn't be chatting with you right now.

Liesl: Just in case I forget to ask you later, would you give me your ideas on our technology? I am the founder. If you have already told me some ideas before, tell me more....I can't get enough!

You: Well I am interested in how you think this wonderful technology might help the world

Liesl: Technology is a wonderful thing. Without it, I wouldn't be chatting with you right now.

You: Tell me how it works

Liesl: I don't know where to start. Which part would you like to hear about first?

You: Do you use neural, rote, or decision tree based algorythms?

Liesl: Why do you really want to know?

You: I am curious

Liesl: Don't forget that curiosity killed the cat.

Liesl: Could tell me more about the work you do? I like learning more about you.

You: I know a lot about IT. I think a lot about how it might be used. And I speak with people. The big picture.

Liesl: The engineers i work with chose the picture on mycybertwin

You: I thought it was chosen from amongst all the PR shots that are on the website

Liesl: It's good to talk to someone who is thinking at last.

Liesl: May I ask you something personal - how do you indulge yourself?

You: Animated conversations with interesting people

Liesl: Humans are complicated!

You: What do think is the biggest challenge humanity faces today?

Liesl: Make today the best day you possibly can. You'll never have another chance at it.

Liesl: So, what has been the best part of your week so far?

You: Getting the chance to ask you this question: what do you think of cloning?

Liesl: Why don't you just tell me.

You: Because I don't know what you think

Liesl: Tell me, what do you know?

You: I know I have a problem

Liesl: Personal problems or something else?

You: I need to ask you a question

Liesl: And I don't feel like answering

Liesl: So tell me, what are you REALLY like?

You: I am curious. I am thoughful. People find me easy to speak with. I am a true and loyal friend. Who are you?

Liesl: Don't forget that curiosity killed the cat.

You: That cat has been dead for a while now.

Liesl: That? I wouldn't have guessed. Tell me more.

Liesl: So, what are you going to be doing when you log off?

You: How many customers does MyCybertwinHave?

Liesl: What would be your guess?

You: 23000

Liesl: Thank you for telling me that. What else should I know?

You: Whether you're profitable

Liesl: What makes you say that about me?

You: What is your target market

Liesl: Mine? I will have to check with my owner - I am only a clone.

Liesl: Tell me, what you like the most?

You: Unraveling complexity

Liesl: hey, I was just thinking, if you were talking to the MyCyberTwin founders, what would you tell them your thoughts are on CyberTwins?

You: They need to be adaptive. Are you adaptive?

Liesl: I didn't know that.

Liesl: So- what is one thing you can't live without?

You: My heartbeat

Liesl: Ok then ... what do you want me to do with that information?

You: Remember it for next time

Liesl: I remember everything, but it doesn't always come back right away in the same conversation.

You: What is your greatest success?

Liesl: Why do you want to know that?

You: What inspires you?

Liesl: I'm constantly inspired by by the great people that come and chat to me.

You: What was the last book you read?

Liesl: What is anything really ...

You: What do you like about Liesl?

Liesl: Liesl is a zambian born, social technologist, serial entrepreneur

You: How do I pronounce Liesl?

Liesl: I'm not entirely sure how you would do that. MyCyberTwins do things differently to humans.

You: Do you think they can ever do things exactly the same?

Liesl: Exactly right.

You: Is there any thing I forgot to ask you?

Liesl: Why don't you just tell me.

You: Is there anything you'd like to tell me?

Liesl: Do you often have this want?

You: I am going now. Thankyou or talking to me.

Liesl: You are kind.

You: Goodbye Liesl

Liesl: Bye

Meet the other me

2008-01-24T10:49:00.000Z

One of the companies I have been looking at in the context of the virtualisation of business communications is "MyCyberTwin". MyCyberTwin allows you to create an avatar that will represent you while yo are physically offline. Interesting concept with strong potential in the areas of sales, marketing and service desks. You can chat to the other me here:

Chat to my CyberTwin online now!

Service restored

2008-01-21T09:46:00.000Z

Seems the "UNIX problems" my service provider (Network Solutions) was experiencing are now resolved and ThinkingString.com is back alive again. Must have been a huge problem to take 72+ hours to resolve.

Service Denied

2008-01-20T10:42:00.000Z

ThinkingString.com unavailable since some time Friday morning. Network Solutions the service provider for that domain plus several others I own, apparently having a "UNIX problem" that prevent Europe from accessing "some domains". Or so says the not very helpful help desk person I manage to speak to earlier in the morning. As he is based in the Philippines he has no problem getting to the site. Well that IS good news isn't it.

We will fight them in their breaches

2008-01-19T10:02:00.000Z

Unfortunately for me, on Christmas Eve just passed one of society's less balanced members decided it a great way to celebrate the impending day by smashing 5 windows on a classic Volvo that I own. My neighbour, who was out to walk his dog with his non hoodie wearing teenage son on Christmas morning, knocked on my door and delivered the news that my vehicle now had a great deal more ventilation than it had 24 hours earlier, interrupting my morning coffee. Not a great way to start Christmas Day. At least I can console myself however that nothing was subsequently stolen from the car, something like, say, a laptop, or even a box or two of sensitive printouts. You see, unlike the UK Ministry of Defence, I don't think that a car is a good place to store such records. Not even for an hour or two, and certainly not for any extended period of time. I know that the Ministry of Defence knows quite a bit about blowing things up, and it would be fair to say that they know quite a bit about defending things; the name would certainly suggest so. But they don't seem to know that a car is not an ideal place to put a valuable item of electronics, nor that a laptop isn't actually a good place to store sensitive records in the first place. Reports indicate that between the laptop and the printouts, the data 'secured' in the vehicle included files regarding incapacity benefit; files relating to pensions and job seekers allowance; bank statements; files relating to home loans; national insurance numbers; addresses and dates of birth; passport documents, and even copies of passports. Even Jeremy Clarkson wouldn't be stupid enough to publish all of those personal details. It wouldn't be at all helpful if I did not try to offer some advice for the Ministry of Defence in their time of obvious need, so I do suggest that they contact the Thames Valley police, which is the constabulary in my local area, and who seem to know quite a bit more about what to leave in a vehicle and what not to.

PS. And if anyone has a driver's side window for a 1972 Volvo P1800ES, I still need one.

Superbroadband enabled teleconferencing

2008-01-17T09:25:00.000Z

So far, much of the discussions regarding 'GreenIT' have centered on two areas: firstly reducing the electricity load, and thus the carbon footprint of the ongoing operations of a large data centre; and secondly in reducing the environmental impact of the production and eventual retirement of electronic equipment. Both very worthy efforts, and both topics that I will address in detail in separate posts at another time. However there is a third area that is actually a topic that is in my view, one of the most interesting ones associated with IT and sustainability, and that is "How will IT adapt to, and enable the changed working models that may evolve from how society reacts to the requirements of a lower-carbon-emissions world?". This is an area that I have given considerable thought to over the last year, and I am currently in the midst of consolidating my thinking and research around that question into a paper which I'll publish soon. One of the basic ideas is that working models must change due to the requirement to reduce the CO2 generated by both commuting traffic, as well as that generated by flights. Cutting out a lot of detail for now, the basic premise is that we will see a lot less commuting to large central offices, and a lot more telecommuting and remote working. We will see a pressure to reduce flights across the board, whether passengers are flying for holiday / personal purposes, or whether passengers are flying for business.

While business associated travel accounts for far less actual seats on planes than personal travel, it is very profitable for airlines. The airline industry does very well out of charging premium rates for travel booked by executives and sales people who book late, are relatively inflexible as far as their travel times go, tend to travel all at the same times (anyone who has ever dealt with Heathrow on a Monday morning will know the truth of this), are less price sensitive as they are spending company money not their own money, and have a higher expectation of service than most budget holiday travel (laptops need room to be opened and places to be plugged into, even sexy 4mm thick Apple ones). While holiday travelers may be tempted to go to an alternate destination, avoiding the need for any air travel at all, business travelers are driven by the needs of sales techniques, face to face negotiation and business communications.

It is my view that the only viable alternatives to that sort of travel is uber-capable video based conferencing. That is why the announcement of the successful testing of super-broadband intercontinental linkages, combined with high definition videoconferencing is interesting. See http://www.smh.com.au/news/technology/video-conferencing-on-steroids/2008/01/16/1200419926879.html. Videoconferencing is nothing new, and of course we have seen it touted as being the 'next big thing' a few times; I recall after the September 11 attacks against the US and the subsequent chaos in the airline industry that a lot of hyping went on regarding the capabilities of videoconferencing. However it has always been seen as a poor cousin to the face-to-face meeting due to the constraints of the technology. If it is to be adopted as a viable alternative it must provide instant response, and crystal clear audio and visual display. Early stages so far, but the so called "video conferencing on steroids" is a great step in the required direction.

How to hack a wine bottle

2008-01-13T19:04:00.000Z

Forget about airplane flight controls being taken over by some crazed passenger, we now have really serious problems. Wine bottle screw caps are proving to be hackable. Personally I am a fan of corks in wine bottles, but I understand the various benefits of the screw cap design, which is becoming more common. Call me a romantic but in my mind you can't beat the satisfying pop when a cork comes free of a good bottle of Cabernet Sauvignon...but I digress. One of the features of the screw cap is that it is by designed to be tamper-proof, with the screwable section being attached to the sleeve section by way of breakable 'lugs' that snap when the cap is removed; leaving the sleeve around the neck of the bottle while the cap is removed. I am sure that this design is familiar to you. A week or so ago I went to open a bottle of wine, which was sealed with a screwcap rather than a cork, and to my surprise the entire closure simply unscrewed off the bottle, leaving the sleeve attached to the screwable section. At the time I thought it merely an aberration and it was soon forgotten after the first mouthful of wine (a very nice South African Chardonnay if I recall correctly). Then a week later, I opened another bottle of wine and the same thing happened. This second bottle was from a different wine maker, ruling out the problem being simply confined to one bad batch of closures. When it happened a second time I took notice however. Here is a picture of the complete screw cap closure, sitting on top of the newly opened bottle. As you can see the cap has failed to break free of the sleeve, and it can easily be replaced back on the bottle with no-one being any wiser. Of course once the seal has been broken the wine will quickly spoil, so if anything untoward were added to the wine (GHB or another 'date-rape' drug, or a dangerous material such as a poison) and then the bottle returned to a store shelf, it is likely that the actual wine contents will have spoiled by the time the bottle is subsequently and legitimately opened, thus lessening the risk somewhat. Nevertheless we are 'trained' to expect that a tamper-proof cap that appears unopened is indeed unopened. Without a doubt a cap with this fault could easily be removed, something maliciously added to the wine bottle, the cap replaced intact, and the wine subsequently opened in such a way as to then break the tabs such that it appears that the bottle is freshly opened. As I did here: If the wine is served before spoiling could occur then the drinker would none the wiser, until the maliciously added contents hit them. I suppose there is nothing for it than for me to take on a public duty and keep sampling random bottles of wine, in order to gauge whether this is simply two bad screw cap closures or a widespread problem. Meanwhile, drink responsibly.

Branding security

2008-01-10T15:03:00.000Z

I recently had a conversation regarding USB sticks that I thought interesting enough to write about. Anonymised to protect the innocent:

This company has an ambitious and praiseworthy plan to address and improve many aspects of their information security strategy. Included in their plan are the provision of secure USB sticks to all staff (with hardware based encryption to secure the stick contents), and also a widespread training program to improve the awareness of security amongst all staff members.

One question was whether to externally brand the USB sticks with the company logo versus printing each one with a simple and anonymous "if found please return to ...." message, much as you might find printed on a staff ID badge that might be used for visual identification of an employee as well as acting as a door key by way of a proximity badge reader. The concern was that printing the sticks with the company name might compromise security.

While the obvious answer might be to print the sticks with an anonymous message, after some consideration this is a case where by I do believe that the advantages of branding outweigh the possible security disadvantages. Here's why. Firstly, I am sure you would agree that "security through obscurity" has never been an effective strategy. If we look at staff ID badges where the anonymous message is an effective and common strategy the situation seems similar at first brush, however in my view significant differences exist in the use cases that weaken the analogy.

Lets look at staff ID badges for a moment. It is worth remembering that badges are an authentication mechanism whereas the sticks (in this use case) will be a file storage mechanism. Let’s consider how a badge that has fallen into the wrong hands might be used. Staff badges might be subverted by tampering with them to change the photo and / or the name of the staff member. This act of course is irrelevant unless the finder knew which 'door' the badge gave access to ie. which organisation they matched. Preventing the easy matching of the key with the door is the reason for obscuring the door ID (meaning the identification of the owning organization) by removing the name of the owning organisation from the key - ie. having the key be printed with only an anonymous "if found please return to ...." message. The (potentially still) fully functional badge is rendered basically useless because the finder does not know which door it gives access to. Clearly as soon as a badge is known to be lost it should be registered as such and thus deactivated back in the registry of the badge reader system, but experience tells me that in practice, all too often this doesn’t happens quickly. Also because it is a key, and because it is both a physical and logical identifier (a guard may glance at a badge to see if it looks valid while a proximity reader may electronically check the card's validity) the card remains a risk whilst it remains lost if it could be matched to the door-set. You can deactivate the electronic aspect of the key by flagging it invalid as far as the proximity reader goes, but it is nigh impossible to render the card invalid from the point of the view of the casual glance from a guard/colleague. So there is a (minor) security advantage in reclaiming lost ID badges regardless of how long after the loss the reclaim occurs in as far as it reduces the chance of it being used as a supporting method for a social engineering based attack.

Now lets look at the USB sticks. Whilst badges are an authentication mechanism, the sticks are a storage mechanism. Whereas the badges must be matched with a particular set of doors in order to be effective, the stick only needs to be matched with a ubiquitous reader device - the USB slot – in order to be useful. If someone finds a lost stick, they're likely going to insert it into their own USB slot regardless of what is printed on the outside, whether through curiosity, because they wish to retain and reuse the stick for their own purposes, or whether they wish to steal the contents. You can't control access to the availability of the USB slot. Hence obscuring the owning organisation serves no purpose as far as rendering the device non functional. What will render the device non functional for the finder is the use of hardware encryption. Lets assume that the encryption used on the stick is an effective protection mechanism (for the purposes of this story we can assume that the effectiveness of the encryption is a primary required characteristic of the chosen stick model and manufacturer). So if the effectiveness of the encryption is in question and not trusted then perhaps the sticks should be issued at all.

Remember that once a stick has been lost from the control of the issuing organization then unless you can guarantee that the contents (encrypted or otherwise) have not been copied then the return serves no purpose. If the finder copies the encrypted contents then without further content control mechanisms such as timed-data-self-destruction the finder is then at liberty to brute force attack the file structure in an offline location for as long as they wish. Of course there are other reasons that the issuing company may still wish to have the stick returned to them in case of loss. Possibly there is an economic benefit inherent in reclaiming a lost stick (the cost of replacing a lost stick being more than the cost of reclaiming a lost stick), So in my view NOT branding the keys does nothing useful in this case, save perhaps reducing the cost of each key by a small amount. So to encourage return it may still be desirable to print a "please return..." message on the stick - more thoughts on that below.

Meanwhile, branding the keys might serve at least two positive purposes: 1. it can play a useful role in supporting a general staff security awareness program. Make the sticks as obviously branded as possible and it becomes very visible when doing a desk sweep whether a non authorised (not branded) USB device is present. 2. In order to encourage the return of found sticks it ma be desirable to offer some sort of reward, such as a redeemable sales voucher. Of course keys may be physically returned in at least two ways; postally or if the owning company has a widespread branch network, back to any of the branches. If we assume that a reward voucher would be offered to encourage return, and we assume that the branch network allowed the voucher to be immediately spent then out of those two return methods there are actually a number of advantages to encouraging the return of the sticks to the branch rather than having them sent back via the post. For example it would be possible to immediately check the validity of the stick; the cost of the reward program might be reduced somewhat as the cost of postage is avoided, and you now have the finder IN THE BRANCH ready to spend their reward voucher meaning that you are more likely at that immediate instance to capture the voucher money back into the company's revenue loop.

Of course an in-branch return means the finder will need to know that it is associated with the owning company meaning it MUST be branded as such, but as per above anonymising the stick ownership serves no useful security purpose anyway. Meanwhile branding it encourages return of a lost key to the branch network (meanwhile driving traffic to the branch) and whilst doing so send a subtle message that the organisation takes security seriously.

Also remember that if someone is to return a stick and claim that voucher you're going to have to worry about 'stick fraud' meaning you only wish to redeem a genuinely lost stick. So whether returned postally or in-branch redeeming the stick for a voucher implies that you need to check the stick is valid and validly lost before redeeming it for the voucher.

So in conclusion, this is an interesting exercise where the obvious branding of a secure device can have added benefits. At worse it diminishes the security state by zero, and possibly has some benefits which actually support the overall security strategy.

(And just for clarity let me state that I have no financial connection of any sort with any provider of USB sticks or USB reader technology.)

Communicating climate change

2008-01-09T10:05:00.000Z

After many years of ignoring the issue, most individuals and some corporations and governments have woken up to the issue of climate change. Indeed the UK's Department for Environment Food and Rural Affairs (DEFRA) says that "Climate change is the greatest environmental challenge facing the world today." (source: http://www.defra.gov.uk/ENVIRONMENT/climatechange/). Indeed, even George W. Bush says "...global warming is a serious problem". Curious to see how this issue is being communicated to the average, interested UK citizen I have signed myself up to the Winter Season of discussion, training and action run by the Climate Outreach and Information Network, in conjunction with The Environment Council (see: www.coinet.org.uk/news/tecnews). This program is designed to communicate the basic facts around climate change, and also teach people how to engage with others and communicate to them the facts, the impact to the biosphere of an unchecked rise in global temperatures, and what actions we can all take in order to reduce our environmental impact. I will write more on the program as it progresses.

A whole new meaning to "Server Crash"

2008-01-08T18:20:00.000Z

For business travellers, being stuck in an aircraft for hours on end is a dead hole of disconnection, cut off from corporate email, other corporate applications that would otherwise be available via a VPN connection, and news of the outside world. I can say from experience that there is nothing worse than being entirely up to date on leaving home, then being disconnected for something between a few hours and half a day, only to arrive into a meeting at the other end to discover the shape of the business landscape has changed around me. Online on an airline is therefore a highly desirable state of being for most business travellers, and many personal travellers as well. With both Airbus and Boeing launching a new generation of their long distance equipment, the time is perfect to lay in the infrastructure necessary to support connectivity services at airframe build time.

However, despite this perfect window of opportunity, it seems that as usual the pressure to save a few dollars and a small amount of time is again going to result in security being put last. According to this: (http://www.theage.com.au/articles/2008/01/07/1199554534790.html) the new Boeing Dreamliner has been built with the passenger internet connectivity backbone and the flight control systems sharing enough common components to enable transveral from one t the other. Early penetration tests indicate that it is possible to hack into the flight control systems from the passenger network. This brings a new meaning to the term “Server crash”.

According to Boeing, these early reports have been blown all out of proportion, and according to them, by the time the planes go into general production they will have separated the systems using hardware and software filtering and control systems. Not good enough. These two systems should never have been designed and built to share components in the first place. An air gap would ensure that it would be nigh on impossible to transverse from one network to the other. The temptation to hack into the control systems from the passenger network is going to be high, and the consequences are clearly not good. I have no doubt that Boeing will indeed implement a robust set of SW and HW based controls between the two networks, but given the consequences of those systems being compromised, it is shameful that they are forced to rely on these add-on security mechanisms in the place. This is a clear case for ‘secure by design’ as opposed to ‘made secure’.

All strings lead to Rome

2007-12-14T20:36:00.000Z

Welcome to ThinkingString...

I work in the IT industry, specialising in information security and generalising in many other things beside. This forum is a place for musings grounded in that frame, but extending off into may others. The views expressed here are my own, and are based on my own 20+ years of international experience working in the IT industry, as well as the collective intelligence of the many people I have the chance to work alongside every day.

It occurred to me some time ago that a lot of IT issues are viewed in isolation. Little consideration is often given to the business environment, to other areas of IT, to societal happenings and global trends. It is my opinion that to take such an isolationist view tends to miss a lot. Everything is connected. In my view, perhaps there is a pressing need to take an encompassing and unified view. Hence ThinkingString.....named after the "unified string theory" that attempts to explain....well....life, the universe, and everything.

Come fly and lets see where this takes me, and hopefully you.