privacy

RT.com interview on 'secure' smartphone apps

On Friday October 17th I was interviewed by Russia Today on the security of 'secure' smartphone apps that turn out to not be so secure. After 18 months of Snowden revelations that should be not news but for the Guardian newspaper it is.

The other IT from another Europe

Also on Consortium News and Huffington Post

Over the last 10-15 years public IT in Europe has not developed in line with public interests, nor does it guarantee the fundamental rights of citizens such as privacy and freedom of expression. Tremendous opportunities in the field of economic development and employment have also been missed. Europe effectively outsources much of its information processing (software & services) to foreign parties at the direct cost of hundreds of billions of Euros (typically around 1% of GNP). The opportunity-cost to local economic growth and employment opportunities are much greater than that. Even more costly than either of these is the de-facto handing over of control of data of governments, businesses and individual citizens to foreign spies who use it for political manipulation, repression of citizens' freedoms and industrial espionage. Although the warnings about the negative consequences of current policies date back at least 15 years, these aspects have been documented in irrefutable detail over the last year by the revelations of Edward Snowden. 12 months later there has not even been the beginning of a policy response.

It could all have been so different ...

In the first 21 months of the 21st century, the dot-com bubble burst and then three skyscrapers in New York collapsed. Between these two events a largely forgotten report to the European Parliament appeared in the summer of 2001. This report described the scale and impact of electronic espionage in Europe by the U.S. and its 'Echelon' partners (Canada, UK, Australia and New Zealand). Besides a detailed problem analysis, the report also gave concrete examples of IT policies that governments could take to significantly limit foreign intelligence spying on Europe.

In the same period was U.S. government won one of the largest anti-trust cases its history, against Microsoft, and the EU followed this victory by launching a similar case that would also be won leading to the highest fine to a company for economic crimes in the history of the EU.

It was against this background that thinking about strategic versus operational aspects of IT in the public sector changed. The report on Echelon made it clear that reducing IT into a merely operational exercise had disastrous consequences on the sovereignty of European states with respect to, in particular, the United States (and perhaps in the near future, China, other technically capable countries or non-state organizations). The economic consequences of industrial espionage against many high-tech and R&D-intensive companies became a major concern for the government.

Kerckhoffs lecture: what Europe needs to do after Snowden

At 12:30 on Friday 13th of June 2014 I will give the Kerckhoff Lecture at the Radboud Universities Kerckhoffs Institute for information security in Nijmegen in room HG00.068. For an audience of students and faculty who probably know more about the maths of cryptography than myself I will talk about the tech-policy implications of the Snowden revelations and why Europe has been doing so very, very little.

Imagine a whistleblower releasing detailed documentary proof of a group of organisations that dump large volumes of toxic mixed chemical waste in European rivers and lakes. The documents describe in detail how often (daily) and how toxic (very). Now imagine journalists, civic organisations and elected representatives all starting furious discussions about how bad this is and what the possible horrible consequences theoretically could be for european citizens.

Now imagine that this debate goes on and on for months as slowly more documentation is published showing ever more detailed descriptions of the various compounds in the toxic chemicals and what rivers and lakes precisely they are being dumped into.

Now imagine that no journalist, civic organisation or elected representative comes up with a single concrete and actionable proposal to stop the actual and ongoing toxic dumping or to prevent future organisations getting into the habit of illegal dumping.

Imagine also that both governments and public-sector organisations, including the ones responsable for health- and environmental matters continue not only to procure products and services from above organisations but also continue to give them the licences they need to operate.

Imagine that this goes on for month after month after month for a full year.

Now Imagine it turns out that the Government not only already knew about this 13 years before but also had a detailed report on practical solutions to clean up the mess and prevent future poisoning.

Imagine that.

Sounds incredible does it not?

Except this is precisely how Europe has been not-dealing with the revelations by Edward Snowden on industrialised mass-surveillance of our government & civic institutions, companies and citizens.

The EU has spent most of a year holding meetings and hearings to 'understand' the problem but has not produced a single word on what concrete actions could regain the right to privacy for its citizens now. This while a July 2001 report on Echelon, the NSA/GCHQ precursor program to the current alphabet soup, explained the scope of the problem of electronic dragnet surveillance and made practical and detailed recomendations that would have protected Europeans and their institutions had they been implemented. Currently only Germany has seen the beginnings of policies that will offer some protection for its citizens.

On Friday the 13th of June I will discuss the full scope of the NSA surveillance problem, the available technological and policy solutions and some suggestions about why they have not and are not being implemented (or even discussed).

Slides from lecture are here in ODF and PDF

Letter to Parliamentary Committee on Gov. IT projects

Letter below has been submitted to the Temporary Committee on Government IT. This document is a translation from the Dutch original.

Dear Members of the Committee on ICT ,

On June 1st, 2012 I was invited by your predecessors to contribute to the expert meeting of the Parliamentary Working Group on ICT projects in government. The written submission that I made at that time is here, including a video of those hearings (in Dutch).

As an IT architect but also as a concerned citizen, I have been actively involved with the IT policy of the government since 2002, focusing on the areas of electronic health records, security and open standards / open source software. On the latter issue I was the initiator of the 2002 Parliamentary 'Motion Vendrik' that advocated greater independence from dominant software suppliers. Last year I also served as a technical expert on the Committee of Minister Plasterk who advised on the (im)possibilities of electronic support for the electoral process.

Although this motion Vendrik from 2002 was translated into the Heemskerk Action Plan in 2007, this policy was quietly killed in 2010/11 by the lobbying power of large software vendors and the U.S. government. Even the Court-of-Audit was pressured to *not* ask certain questions in its 2011 report on the policy. Since 2002, the Netherlands has spent about 60-90 billion on foreign software, for which in many cases free, equally good or better alternatives are available. Their use is, however, actively hindered by both the Ministries of Education and Interior, as well as the VNG supported by the lobbying apparatus of major suppliers and the U.S. government.

This despite Justice Minister Donner's 2004 letter to Parliament in response to the Motion Vendrik where he admitted that:

  • the government's dependence on Microsoft was very great;
  • that this was a problem ;
  • and that by introducing open standards and the use of open source that could be solved.

This dependence has since become much greater and more than one billion Euro was spent on Microsoft licenses over the last decade. That money would have paid for 10,000 man-years of expertise to migrate away from Microsoft products. A large part of the money spent would have remained in the Dutch economy and returned to the state through tax and VAT. Not that 10,000 man-years would have been needed. The Municipality of Ede did it against the odds for a fraction of the cost and now saves 92 % on software expenses (and 25% on overall budget). The rest of the government has yet to take steps. Why is an important question.

11-02-2014, the day we fight back

Today is the 11th of Februrari 2014,"The Day We Fight Back". We fight against out-of-control spying on our privacy as free citizens. We fight against Orwellian espionage because we know where it leads to in the end.

The text below is inspired by the speeches of Winston Churchill in during may and june 1940. While the nature of the opponents of democracy and freedom is different today the consequences of losing the fight are just as dire. Our society and the planetary eco-system is a great trouble. We need our democracies to function and our internet to be free so we can adress the great challenges of out time.

"What Cory Doctorow and Aaron Schwartz called the fight against SOPA & ACTA is over. The battle against TTP and global surveillance continues to rage on. Upon this battle depends the survival of the internet and our democracies. Upon it depends our own way of life and the long continuity of our institutions and our culture. Once again the whole fury and might of the enemies of freedom will very soon be turned on us now.

Those working towards a police state know that they will have to break us or lose this conflict. If we can stand up to them, all of the Internet may be free and the life of the world may move forward into broad, sunlit uplands. But if we fail, then the whole world, including the United States and Europe, including all that we have known and cared for, will sink into the abyss of a new corporatist Dark Age, made more sinister, and perhaps more protracted, by the lights of perverted technologies.

You ask, what is our policy? We can say: It is to hack, by server, laptop and phone, with all our might and with all the strength that Turing can give us; to wage lulz against a monstrous tyranny, rarely surpassed in the dark, lamentable catalogue of human crime. That is our policy. You ask, what is our aim? I can answer in one word: victory, victory at all cost, victory in spite of all the terror, corruption and lies.

I have, myself, full confidence that if all do their duty, if nothing is neglected, and if the best arrangements are made, as they are being made, we shall prove ourselves once more able to defend our networked homes. To ride out the storm of surveilance, and to outlive the menace of tyranny, if necessary for years, if necessary alone. At any rate, that is what we are going to try to do. That is the resolve of the hacktivists - every one of them. That is the will of free citizens, the technologists and the creatives, linked together in their cause and in their need, will defend their native internet, aiding each other like good comrades to the utmost of their strength. Victory, however long and hard the road may be; for without victory, there will be no free culture and no culture of freedom.

Therefore we shall go on to the end:
we shall fight in Europe,
we shall fight on our browsers and our operating systems,
we shall fight with stronger encryption, and secure hardware,
we shall fight with growing confidence and growing strength
we shall defend our networks, whatever the cost may be,

We shall never surrender.

Let us therefore brace ourselves to our duties, and so bear ourselves that, if the Internet and its hacker community last for a thousand years, they will still say, "This was their finest hour”."

No go participate or organise a cryptoparty, support people developing better tools (mail, web, secure systems and all this Free-as-in-freedom Software) or ask other people if they value being able to read without being read at the same time. Privacy is a human right according to the UN Declaration of human rights and yes, you to have something to hide as well.

First they came for the trade-unionists

Originally for Consortium News - Warning! this article violates 'Godwin's Law ' in almost every paragraph. Regrettably all these violations are all based on historic facts and documented current events.

From Rick Falkvinge's blog post:

When the famous skyline landmark building in the world’s economic center was attacked in fire and flames on that fateful, horrible day, and our elected leaders decided to go to war against terrorism under the banner of “you’re with us or against us”.

When the blame for all evil was unanimously put on people from the Middle East with their foreign religion, and all of those were made suspicious.

When patriotic new laws were passed almost immediately in the emotions from the attack, and those laws suspended most civil rights. When the word “Homeland” suddenly started being used again, after having been practically extinct.

When the country went to war, one after another, in the wake of that attack. When internment and torture camps for those middle-easterners and other unwanteds were created – outside the country borders, in order to hide what was going on from the public.

Indeed, the 1930s were a very dark time in Germany, and the Reichstag fire in Berlin set off a chain of events that might – theoretically – repeat itself.

'Tinfoil Is The New Black', Keiser Report interview

I was a guest on Max Keiser's programme 'The Keiser Report' last Thursday jan. 16th for the second time. Max is a former Wall Street trader who foresaw the current economic crisis a decade ago.

Full Keiserreport episode here on RT site and here on Youtube.

Max caught me be susprise by asking about the NSA TURMOIL and TURBINE programs. I confused them with other programs (there are many). The TURMOIL and TURBINE programs are part of the 'Targeted Acces Operations' family (see this Spiegel article). These are programs for gaining acces to systems by other means than abusing their built-in weaknesses over internet connections (the NSA's favourite method because it can be automated to spy on everyone at very low cost). Targeted Accces Operations (TAO) deals with everything from intercepting & modifying electronic devices that people order online to the use of microwave beam weapons to identify, hack, break and manipulate computer systems from great distance. The latter method has also been used for targeting drone strikes. The talk by Jacob Appelbaum I mention in the beginning of the interview is here. Many more talks from the 2013 CCC conference in Hamburg can be found here.

The US Declaration Of Independence is one of the greatest political writings in history and can be re-written for more contemporary political problems as I did here. Accoring to US academics the US declaration was inspired by the Dutch declaration that preceded it by almost two centuries.

Blogpost on a previous interview last year.

Interview on London Real

Last year during my December visit on London I gave a 1 hour interview to London Real. This is great new free-form 1+ hr completly unscripted interview program that is available on Youtube and as a podcast. Tired of the superficial 3-minute interviews that stop just when things get interesting? London Real is your channel. If you want to keep up to date on the London startup/tech scene then checkout Silicon Real.

I was honored to be in a lineup that includes several of my current heroes including Max Keiser, Jared Diamond, Annie Machon and Rick Falkvinge.

Brian Rose and me spoke about NSA-spying, the nature of privacy, copyright, bitcoin and much more. The interview begins at 7:48. For more check out the London Real site. Compact mp3 for download here.

Christmas message Edward Snowden

On December 25th 2013 Edward Snowden delivered an alternative Christmas message on the UK's channel 4 TV station. Before the broadcast a short version of the speech was leaked and immediatly uploaded to youtube. That upload was immediatly blocked but many re-uploads made the clip available everywhere. This is one of those places. If you want to thank Edward Snowden for giving up his relationship, familiy, job and any chance of a normal life to inform us all go here and donate. Or spread his message. And do something with it. Because if something is done all of Edward's sacrifices have meaning.

Eben Moglen talks on Snowden & the future of Freedom

Update May 28th 2014: The Guardian just published a written summary of the talks below. For those with less time or a preference for text as opposed to video.

Over the last month Prof. Eben Moglen held a series of lectures on the implications of the documents released by whistleblower Edward Snowden. More than any other article or interview these talks give a clear analysis of the meaning of this information and what it is we all need to do as citizens if we want a future where freedom and civil liberties still has some meaning. Original video's, audio recordings and transcriptions of the talks can be found at http://snowdenandthefuture.info/.

Keynote & interview Eurapco Insurance

<on 26-09-2013 I gave the keynote at the Eurapco congres where top EU insurance firms share expertise>

We live in a world of rapid technological change. Keynote speaker and IT expert Arjen Kamphuis discusses the implications for the insurance industry and its customers, and what measures can be taken to ensure the best possible customer experience. The objective was to raise awareness of the rapid pace of socio-technical development today and what fundamental effects this will have on the insurance industry. Changes in customer behaviour and expectations will have an impact on customer satisfaction with our companies’ claims handling.

Future shock – are we prepared for change? Some of the topics discussed in the keynote

  • What if tomorrow’s world looks really different? The basic rules of our business can change at incredible speed because of changes in technology, national/EU/ international policies, environmental threats and other external factors. New technology can overtake existing business models, and even make them irrelevant. The insurance industry faces the challenge of combining the need to be stable, secure and reliable with being dynamic, fast and responsive.
  • Cyber security needs to be taken care of, both within companies and between companies and their customers. Privacy issues are of great importance for insurance companies. For instance, it would be damaging for the image of a stable, secure and reliable insurance company if it were to be revealed that all customer data had been fully exposed by hackers or the NSA.
  • Today, all large service companies need to balance industrialised processes with the human touch. As a customer, you do not want to be exposed to the internal processes of your service provider. The customer just wants to receive service in an uncomplicated way. Changes in customer behaviour and expectations will have an impact on customer satisfaction with our companies’ claims handling.
  • Our companies’ brands face increasing danger in a fast-paced world of social media. Our customers rely more on the experience of others than on the promises of the companies. Through social media, good and especially bad experiences can be shared easily and quickly. We can join the conversation about our brand, but not control it.
  • A fast-changing world offers opportunities and threats for your business and your position in the market. Are you ready to adapt to changes in customer expectations? Is your organisation positioned to deal proactively with change, or could you be caught off guard? Do you have a plan for what to do if an improbable case scenario does occur? By carrying out regular scenario planning, you can at least have contingency plans for different case scenarios.
In your keynote speech, you mentioned that it’s very hard for anyone inside the insurance industry to see the world the way a customer, or other outsider, sees it. Can you, as an outsider, give us some tips about what is needed to achieve excellence from a customer’s perspective?

NSA intell goldmine, who else has access?

<also on HuffPo UK>

The War Room, Dr. Strangelove - 1965 Shortly after the initial release of some documents from whistleblower Edward Snowden I wrote a little summary about the IT-policy implications for Europe based on earlier columns. A lot of additional documents have come out since then and we can basically conclude that almost every computer system on the planet is fully broken or at least very vulnerable to NSA interference or manipulation.

Nobody, including the NSA, Edward Snowden, Glenn Greenwald has a total oversight of all the in the tens of thousands of documents let alone the political or strategic implications of the info contained in them. Most of the news keeps focusing on the 'scandal' aspect and/or the person of Snowden. Being angry at the US government (practised by most opponents) and attacking the person of Snowden (a favorite of apologists of the US regime) distracts from defining adequate policy responses and so far there have been precisely none in Europe. This constitutes a massive failure of the various EU governments to protect their citizens' rights and the economic sovereignty of their nations. It is also strange in light of the fact that an adequate policy response had already been formulated in July 2001 and really just needs to be implemented.

But every now and them the disinfo spread by some apologists for the behaviors of the NSA is useful for understanding how much worse the situation may just turn out to be. This article by a former NSA employee is a nice example of an attempt at smearing the whistleblower while actually digging the hole the NSA (and the US regime) is in much, much deeper. The piece claims Snowden secretly worked for Russian intelligence all along. While I do not share the authors views on Snowden's motivations or allegiances the suggestion that outside organisations could have agents inside the NSA has some interesting implications.

The missed opportunity of avoiding PRISM

<originally a column for Consortium News>

On July 11th 2001 the European Parliament published a report on the Echelon spy network and the implications for European citizens and businesses. Speculations about the existence of this network of Great Britain-and-her-former-colonies had been going on for years but it took until 1999 for a journalist to publish a report that moved the subject out of the tinfoil-hat- zone. The report of the EU Parliament contains very practical and sensible proposals, but because of events two months later across the Atlantic, they have never been implemented. Or even discussed further.

Under the heading "Measures to encourage self-protection by citizens and enterprises" lists several concrete proposals for improving data security and confidentiality of communications for EU citizens. The document calls on Parliament to inform citizens about the existence of Echelon and the implications for their privacy. This information must be "accompanied by practical assistance in designing and implementing comprehensive protection measures, including the security of information technology".

Other gems are the requests to "take appropriate measures to promote, develop and manufacture European encryption technology and software and, above all, to support projects aimed at developing user encryption technology, which are open-source" and "promote software projects whose source text is published, thereby guaranteeing that the software has no "back doors" built in (the so-called "open source software")”. The document also mentions explicitly the unreliability of security and encryption technologies whose source code is not published. This is an issue that is a strict taboo in Dutch and UK discussions on IT strategy for governments (probably because certain major NATO partners might be offended).

Also, governments must set a good example to each other and their citizens by "systematic use of encryption of e-mails, so that in the longer term this will be normal practice." This should in practice be realised by "ensuring the training and publication of their staff with new encryption technologies and techniques by means of the necessary practical training and courses." Even candidate countries of the EU should be helped "if they cannot provide the necessary protection by a lack of technological independence".

That one paragraph from the summer of 2001, when rational security policies had not yet been completely destroyed by 9/11, describes the basis for a solid IT policy that ensures security and privacy of citizens against threats from both foreign actors and the government itself (historically always the greatest threat to its citizens and the reason why we have constitutions).

Had these policies been implemented over the last decade then the PRISM revelations of the last week would have been met mostly with indifference. European citizens, governments and companies would be performing most of their computing and communications on systems controlled by European organisations, running software co-developed in Europe and physically located on European soil. An American problem with an overreaching spy apparatus would have been just that, an American problem - like teenagers with machine guns or lack of universal healthcare, just one more of those crazy things they do in the colonies to have 'freedom'.

OHM and other Three-Letter-Agencies

<originally a column for OHM2013.org - also on HuffPo UK>

“Whatever you do will be insignificant, but it is very important that you do it.” - Mahatma Gandhi

This summer the Dutch hacker community, with help from friends all over the world, will organise the seventh hacker festival in a series that started in 1989 with the Galactic Hacker Party. The world has changed massively since then (we'll get to that) but the goal of these gatherings remains the same: to share knowledge and ideas about technology and its implications for our world, have heated discussions on what we should do about the problems we see (sometimes well before many others see them), generally have fun in communicating without keyboards, and being excellent to each other.

Four years ago a somewhat unknown Australian hacker with some new ideas about the future of journalism gave the opening keynote at HAR2009. His site was called Wikileaks and some of us had a hunch that this concept might be going places. We had no idea just how far that would be...

Not long after the first gathering in the Netherlands in 1989, the Berlin Wall came down. While we can claim no connection, the interminable Cold War had finally ended and many of us felt, with the optimism so typical of youth, that world peace might just be possible in our lifetimes. We would go back to making rockets that went up instead of straight-and-level and other great things would follow.

Privacy, a decade on

<originally a column for Webwereld - in Dutch>

On July 11th 2001 the European Parliament published a report on the Echelon spy network and the implications for European citizens and businesses. Speculations about the existence of this network of Great Britain-and-her-former-colonies had been going on for years but it took until 1999 for a journalist to publish a report that moved the subject out of the tinfoil-hat- zone. The report of the EU Parliament contains very practical and sensible proposals, but because of events two months after publication, they have never been implemented. Or even discussed further.

Under the heading "Measures to encourage self-protection by citizens and enterprises" lists several concrete proposals for inproving data security and confidentiality of communications for EU citizens. The document calls on Parliament to inform citizens about the existence of Echelon and the implications for their privacy. This information must be "accompanied by practical assistance in designing and implementing comprehensive protection measures, including the security of information technology". So not just some abstract government infomercial on TV/radio but hands-on tips to get some actual work done please!

Parliamentary hearing on IT-projects, security & privacy

On June 1st 2012 the Dutch government's Parliamentary working group on government IT-projects held a hearing of experts. My written contribution below. Capture of videostream... (in Dutch). Dutch journalist Brenno de Winter published his thoughts here. Column on this published the week after here.

Introduction - IT and the Dutch national government
Andromeda M31Universality is an assumption of astrophysics that states that all phenomena, everywhere, behave as we observe them from Earth. I'm assuming that phenomena I have observed in specific government IT projects also occur in government IT projects that I have less infromation about (this is usually caused by the poor implementation of Freedom Of Information Acts, see the notes of Mr de Winter).

IT project management is currently based on a rather naive model of reality - "smart entrepreneurs compete on a level playing field for the favours of the government, which then procures with insight and vision." However, this model does not adequately predict the observed outcome of the projects. Whence this group.

Another model would be "a corrupt swamp with the wrong incentives, populated by sharks and incompetent clowns". This model has the advantage of perfectly predicting the observed outcomes.

Tech-politics and the importance of outreach

Cory Doctorow's column in the Guardian about tech-politics and the importance of outreach by the tech community can be found here. Cory makes the point that ensuring your rights through technical skills is great, but not much help to society if the tech is too difficult for most people to use. Outreach activities and the hard work of polishing technical tools for non-techie use are of vital importance.

However, I do think that one important aspect was missing from Cory's argument, so my additional comment on another vital aspect of current tech/internet politics is below:

As nerd-politics is a subset of 'normal' politics, it's not just the nerd-part we need to worry about. The political system itself needs to function - at least some of the time - to get anywhere. If a country has a political system that retains the rituals of a democracy but no longer actually functions as such, then no amount of good nerd-politics (or politics of any other kind) will fix anything. Especially if such a fix threatens established and well-funded business interests.

It is perhaps no coincidence that all the bad tech-policy examples that Cory cites (SOPA, ACTA, TTP, DMCA, attacks on the Piratebay, mass reading of email, etc) orginate in the US and are foisted on other countries from there. While those countries deserve their fair share of blame for allowing a foreign power to bully them into this stuff, it is pretty clear where the problem lies. With or without nerds involved.

Either we fix the completely broken US political system (and good luck with that!) or the rest of the world needs to get better at ignoring absurd US laws and treaties cobbled together by lobbyists of private for-profit organisations. Neither those corporations nor general US politics concern themselves with the interests of the inhabitants of the rest of the planet. And the rest of the planet should respond accordingly.

Nerds (aka the tech community) can provide some tools to help out with that, as the Free Software movement and Wikileaks have shown.

ACTA and SOPA are great!

<originally a Dutch Webwereld.nl column>

Socially aware people are, often justifiably, very good at moral indignation, but they just as often display a touching naivety. I recently watched with some surprise the American Occupy activists who were shocked (shocked I tell you!) as policemen (or university rent-a-cops) launched unprovoked attacks using batons and pepper spray.

It is indeed despicable that these officials use so much violence. But if people are still shocked by this in 2011, one has to wonder where they've been hiding for the last 10 years – have they not watched the news? Did they think that they could let stolen elections, illegal wars of aggression, shooting children with anti-tank weapons and the torture of innocent civilians happen without the ultimate consequence of their govenment using the same force against them?

But even the naive indignation of some Occupy activists about their government and its boot boys, is nothing compared to the childish surprise of the IT press about ACTA and SOPA. The copyright industry has for decades lobbied for the length of copyright to stretch to the end-of-time-plus-a-day extra.

Sony has no problems with infecting computers of their customers with what amounts to a virus.  A torrent of writs has poured forth from the offices of copyright enforcement. Babies and the elderly without a PC, deceased persons, and even a HP laser printer have been falsely accused of copyright infringement (labeled as “theft” by the lawyers of the industry). Surely we all know the kinds of organisations we are facing now?

DIY privacy, because the law no longer works

<originally a Webwereld column - in Dutch>

 Over the last few years it seems as though everything that is centralised fails. Governments fail to solve societal problems (or even just complete a successful IT project), central banks fail to monitor the behaviour of ordinary banks, IT companies fail to offer us solutions that are safe and respect our privacy somewhat ...

Decentralisation works better: bittorrent, non-Western popular revolts, open source software, hacktivism and to a certain extent the Occupy movement. I'm glad Bits of Freedom and international counterparts such as the EFF exist because they put issues on the agenda that most of the over-50 politicians would not otherwise consider. In Berlin, the Pirate Party has over 9% of the seats in local government and is spreading rapidly across Germany.

But is all this really upholding our "rights"? Because despite all petitions, motions, actions and other initiatives our (digital) civil liberties are still evaporating. In the Netherlands it is virtually impossible to finish high school without buying Microsoft or Apple products, despite a long string of promises and agreements about this from our government. There are so many PCs that are controlled by cyber criminals that Microsoft had to set up a specific spring-cleaning for the Netherlands without user consent. This also makes it immediately apparent who really controls all these systems. Meanwhile, the government uses its own catastrophic Diginotar failure as a pretext for yet more government regulation of the online world.

Waiting for the big one

<originally a Webwereld column - in Dutch>

Diginotar's multiple IT failures in the public sector have been swept under the carpet. So far, nothing indicates that there will be any real change to the Dutch government's overdue IT projects. During the hearing (mp3 – in Dutch) in the Lower House it was apparent that neither the government overseer OPTA or auditor Price Waterhouse Coopers believe themselves at fault, despite the fact that for years as regulators they have rubber stamped the work of Diginotar. The decisions of the PwC auditors were obviously good because "they are executed by responsible professionals". This will be heartening for all those Iranian citizens who are suffering the consequences of this (think of an unpleasant convergence of kneecaps and power tools).

But because of the chaos at Diginotar, we may never know for certain the full horror of those consequences. It is very simple for someone to take over an entire network and manipulate all the logs. The only thing we can really say with any certainty is that so far we have no reason to believe that IT security was any better in the past than the recently discovered FoxIT mess. The PwC audits are obviously not able to detect such a mess and OPTA apparently did not even look. Possibly Diginotar has been totally hacked for many years, and nobody noticed. A really smart spy or cyber criminal does his job and leaves no traces. The many detailed discussions about the exact scale and timeline of the hack have completely ignored this fact. From his grave Socrates is smiling at the idea that we only certainly know what we certainly do not know.

Unsuitable

<originally a webwereld column in Dutch>, <also on HuffPo UK>

Over nine years ago, I was talking to Kees Vendrik <Dutch MP) about the broken Dutch software market. Not only was it impossible to buy a top brand laptop without buying a Microsoft Windows licence, it was also impossible to visit many websites (municipalities, Dutch railways and many others) without using Internet Explorer. The latter area has greatly improved and I can lead my life using my OS and browser of choice. Only occasionally do I have to just swallow a Windows licence when buying a new laptop. Not much has improved in that area. Our national dependence on products such as MS Office has not really diminished either, despite all the wishes of our Parliament and its related governments policies.

Meanwhile, the technological seismic shift that frightened Bill Gates so much back in '95 (the web makes the operating system irrelevant) is fast becoming reality. Almost all new developments discussed by IT power players and specialists are web-based or based on open specifications and the most commonly used applications are running quite well as service in a browser.

Gran knows why

My grandmother was born in 1920 and left school at the age of 12 to work in her father's shop.  She has never used a computer (but has tried an iPod for audio books). She is now 90 and is still interested in what I do.

Usually I just quickly skip over the technical aspects, because it's difficult for her to understand. The “why” is much more relevant. Privacy, civil rights and the control of your own details/information. She understands this easily, without having to follow all the technical details of open source codes and cryptography.

Last Sunday, Bits of Freedom in Amsterdam  organized a lecture and discussion with Prof. Eben Moglen, a former programmer who is now a law professor and advocate for the use of free software. Part of his lecture was about the risks of cloud computing (see a previous lecture in New York on the same theme).

Article in Surgeon's journal

The Dutch Journal for Surgeons, publishes an article written by my collegue Younass and myself. We wrote this article to further explain some of the points we made during our  keynote at the natinal Convention of Surgeons last month. The entire article here in English and Dutch, the PDF of the journal here. Background links and articles here (mostly Dutch).

Get a famous fingerprint

Schaeubleattrappe_250The German Chaos Computer Club, the oldest and largest hacker group of Europe, made available to the public the fingerprint of the German Minister Schäuble for the Interior. They wanted to show how easy it is to obtain someone's identity when identity is based on fingerprints.

The German government is preparing to build a national database containing the fingerprints of all its citizens for the purposes of fraud-prevention and national security. Minister Schäuble is very angry about the release of his fingerprints and has stated he will take legal measures against the CCC. Dutch hacker Rop Gongrijp pointed out that the Minister's anger was curious since it was the minister after all who wanted to collect the fingerprints of over 82 million Germans and the CCC only collected one.