Sunday, 10 April 2016

Information wants to be free...?

I both like and dislike the quote "information wants to be free", mainly because it opens up a very nice philosophical discussion on what 'free' means but also because - and this is part I hate - it is some damned meaningless without any grounding in any form of semantics; and we've seen this before!

For the first part, this statement treats information in an anthropomorphic manner. Is it really information itself that has the need to be free? Let's assume that it does, though in a very fairy tale like way, it seems to me.

So let's then look at the word 'free', which I assume does not mean 'free' as in 'without cost' in the sense that someone has to pay for it. Though this is a curious idea in that information is somehow prostituting itself and despite all attempts someone (the information's pimp perhaps?) insists on controlling things. I guess this is the idea that information is going through some pre-1960's sexual revolution...
Rather I think the word 'free' refers to 'freedom' albeit in a Western sense of the word. Think of the use of the concept freedom as used in the US Declaration of Independence.

"We hold these truths to be self-evident, that all information is created equal, that it is endowed by its Creator with certain unalienable Rights, that among these are Life, Liberty and the pursuit of Happiness"
...or should that be Existence, Communication and Semantics perhaps....?

Let's stick with the word 'freedom' and its naive or common-sense meaning. What does it mean to be free? We can turn further to the the UN Declaration of Human Rights and the EU Charter of Fundamental Rights for further clarification, though here I'm sure we go into more of a legal-political debate more than anything. Evidently freedom means either the right to do or be something or the right to be protected from something.

So the question is, if information want to be free:

  • What does information want the freedom to do/be?
  • What does information want the freedom from?

Under the first question, the freedom to be 'free' as in 'without cost' certainly falls. What about the freedom to be private, or the freedom not to be abused - as in excessive privacy violations? Do we further need a notion of agency - does information have an owner or provenance?

Without answering those - I don't think I can give a definitive answer anyway - here's another thought. Given that matter = energy, isn't the use of the term information quite literally another way of saying 'humans' (or 'men' as in the Declaration of Independence). In which case the question 'information wants to be free' is just an expression of man's desire to define what freedom is - ostensibly in terms of freedom to do/be and freedom from.

And here comes the practical part, which freedoms to do/be or from do we allow or deny in order to be "free"?

Thursday, 7 April 2016

Privacy Lectures @ University of Iowa

I'm giving two lectures at the University of Iowa on the 21st and 22nd of April as part of the Iowa Informatics Showcase Symposium.

The two lectures are:


The Iowa Informatics Showcase Symposium will focus on new directions in informatics research and involve talks from external and internal scholars. It will also include an informatics fair with a poster session, and booths highlighting research centers, core facilities, centers and institutes. Saturday Workshops will be conducted as part of the symposium with topics including software basics, GIS, mapping and visualization, statistical packages, and others.

Thursday, 24 March 2016

Brussels - something to think about

The Independent is running a story today:

Brussels attacks: Security officials accused of missing a string of opportunities to stop suicide bombers
Accomplices still on the run after day of conflicting reports and confusion

The following paragraphs are deeply troubling given the emphasis on "banning" encryption and the need for total surveillance:
The French Prime Minister, Manuel Valls, who laid a wreath at the underground station close to the European Commission headquarters where more than 20 people died, said that EU nations had to invest “massively” in their security systems. 
The most direct criticism came from Turkey, which has previously criticised France for what it said was a failure to heed a prior warning about one of the suicide attackers involved in last year’s attack in Paris in which 130 people were killed. 
Turkish officials have previously said that French authorities were warned twice by Turkey about one of the assailants in the attacks on Paris in November. A senior government source told The Independent: “We had warned France before the Paris attacks, now this. It’s ridiculous.” 
The two brothers had been known to police in Belgium for years, and operated in some of the marginalised communities in the capital that had avoided close attention from the intelligence agencies despite problems of jihadist recruitment and terrorist links. 
The Belgian federal prosecutor, Frederic van Leeuw, told reporters that the two brothers, Brussels-born Belgian citizens, had “extensive” criminal records but they were not related to terrorism.
So, ultimately the failure was both of communication between intelligence and police agencies *and* a failure to listen. Worse is that the terrorists involved were already known (last paragraph above). If the signals of possible trouble were not seen in the above then the problem certainly does not lie with extensive data collection. In fact the perpetrators actually gained privacy by effectively hiding in plain sight.

The trouble is that now politicians are in the "do something" mode of operation, where doing anything, regardless of effectiveness, is far better than actually thinking and doing the right thing.

I had the pleasure of speaking with some security experts in counter-terrorism a while back. They effectively said that politicians want more security just to be seen to be doing something - this is why we've ended up with airport security that concentrates on bottles of water but not on mitigating the real risks - queues, delays, bottlenecks. The question of profiling, as seen in Israeli aviation security is too much for the politicians to risk their careers on so everyone will suffer under increasingly intrusive and increasingly ineffective security.

Finally this quote by Simon Jenkins of The Guardian:

Those who live under freedom know it demands a price, which is a degree of risk. We pay the state to protect us – but calmly, without constant boasting or fearmongering. We know that, in reality, life in Britain has never been safer. That it suits some people to pretend otherwise does not alter the fact. 
In his admiral manual, Terrorism: How to Respond, the Belfast academic Richard English defines the threat to democracy as not the “limited danger” of death and destruction. It is the danger “of provoking ill-judged, extravagant and counterproductive state responses”.


Wednesday, 23 March 2016

NSA, BigData and Privacy

We all know that BigData is good and that more data is better. In fact if you could collect everything then you could potentially stop all crimes, stop terrorism, save the World, freedom, puppies...literally do anything and everything!

Except, as most organisations should have realised (ordinary businesses take note!!) that having huge amounts of data doesn't really help you if you have no idea of what you have, what it means and how to actually extract the data you want.

Its worse when you have so much that even running the queries that might extract the right piece of data becomes so complex that you may as well just give up.

Pity the NSA then:

http://www.zdnet.com/article/nsa-whistleblower-overwhelmed-with-data-ineffective/

NSA is so overwhelmed with data, it's no longer effective, says whistleblower
One of the agency's first whistleblowers says the NSA is taking in too much data for it to handle, which can have disastrous -- if not deadly -- consequences.
So, we have a paradox in the sense that the more data we get the better we can hide...

Its funny but about 2 years ago there was an idea called the "Slow Data Movement" whose aim was to save the World from BigData madness but concentrating on what you actually need...

In fact we've even heard the argument that mass surveillance is no where as effective as "good old fashioned police work".

In fact, it even seems that the recent attacks in Belgium relied upon unencrypted communications ... which should have been easily spotable, unless of course you've got politicians obsessed with the evils of encryption and too much data to even see the weak signals of ordinary, unencrypted data.

Scary...

Human evolution and the mobile phone

From the great User Friendly:




Friday, 18 March 2016

Short abstract on privacy processes

Any reasonable implementation of privacy requirements can not be made through legal compliance alone. The belief that a software system can be developed without privacy being an integral engineering  concept and that a privacy policy is sufficient as requirements or compliance check is at best dangerous for the users, customers and business involved.

While requirements frameworks exist, the specialisation of these into the privacy domain have not been made in such a manner that they unify both the legal and engineering domains. In order to achieve this one must develop terminological or ontological structures to aid communication between these domains, provide a commonly acceptable semantics and a framework by which requirements expressed at different levels of abstractness can be linked together to provide refinement of these in some form. One interesting effect of this is to almost completely remove the terms ‘personal data’ and ‘PII’ from common usage and to force a deeper understanding of the data and information being processed.

Once such a structure is in place and even just partially or sparsely populated this provides a formal framework by which not only requirements can be obtained, their application (or not) be justified and a proper risk analysis made. This has further advantages in that privacy requirements and their potential implementations can be explored through the software development process supporting ideas such as agile methods and ‘DevOps’ rather than being an ‘add-on’ exercise - a privacy impact assessment - inappropriately executed at inappropriate times.

Wednesday, 10 February 2016

Horses Understand Human Emotions

A paper from the University of Sussex that shows that horses 'understand' human emotions [1] has been published - a layman's version can be found on the BBC. To some degree this is probably quite well known by horse people, even taking into account that humans tend to project their emotions and anthropomorphise their pets.

While you could take the cynical, sensationalist approach by a certain UK newspaper (if you read the comments to the article then this is a crisis in the equine world brought on my left-wing, migrant, EU bureaucrats seeks to steal UK jobs and entitlements), this actually is quite fascinating research.

For a start, looking at this piece of work then it confirms a number of facts about horses, namely that being a domesticated animal they have either evolved an ability, or, used an innate ability (due to their existence as herd animals) to understand humans; in much the same way as dogs.

In a more general sense it also confirms some aspects that we've suspected about how the brain works regarding how emotions are processed. Though more interestingly while it answers some questions it opens up a whole new set of questions about how the brain works.

When reading work such as this, the experiment might be very small and limited in nature, it does open huge questions about, in this case, emotion processing in the brain, the evolution of cross-species communication, whether emotions (or certain emotions) are fundamental in nature, aspects of the human-horse relationship since early domestication etc.

References

[1] Amy Victoria Smith, Leanne Proops, Kate Grounds, Jennifer Wathan, Karen McComb (2016)
Functionally relevant responses to human facial expressions of emotion in the domestic horse (Equus caballus). Biology Letters Published 10 February 2016.DOI: 10.1098/rsbl.2015.0907

Tuesday, 9 February 2016

A long time ago...

When computers were real, and I mean the ZX Spectrum, the BBC Model B, the VIC-20 and all manner of 8-bit machines that booting straight into a BASIC interpreter (with a nod of the hat to the Jupiter ACE of course!), there was a little publishing company called Usborne who produced the most amazing books on computing. Now many of those books from the 1980s have been released free via their website.

One book in particular will always stand out for me:



On pages 24 and 25 is a listing for a game called Space Mines - a very simple simulation game based on selling ore for food and mines. That particular game got typed in, played with, modified, reimplemented and I guess in no small way started my love of simulation games which more than likely led to me writing a language for implementing simulations ( BSc degree final year project ) and later trying to simulate the behaviour of systems from their formally specified models ( PhD thesis ).

So to Usborne, the writers, editors and everyone involved in those books, especially the person or persons who wrote "Space Mines" my deepest, heartfelt thanks!


Thursday, 4 February 2016

Millionaires in Finalnd

I love low-quality targeted advertising...its sort of like watching a bad Sci-Fi B-movie from the 1950s without the mental effort...take this for example


Well I'd certainly like to be rich, but to be honest there aren't too many millionaires here and certainly not many being made by watching some video - and no, I didn't click on the advert....maybe this is why I'm not a millionaire...or maybe I am, but I'm not telling you how*

Now it does get better:

Apart from the slightly suspicious encoding error, it should be an 'ö' and I guess the currency conversion is going to be a bit of pain, yes I too wonder how that housewife makes that sort of money...I wonder where she lives to be honest because at that rate I'm guessing she might be moving from Söderkulla to somewhere nice, such as the Cayman Islands.

A bit of a rough calculation for 1 year:

365 x $1420 - 5% currency exchange fees and 60% top rate of Finnish tax and your potential $550k becomes just under $200k, and most likely an entry in the yearly, public list of top tax payers. If she's not there then I think the above advert just gave a great tip-off to the Finnish Tax Authorities :-)

But it gets better!


Forget that $1420 per day, just use a crazy loophole and another "habit" (I wonder what?) and you could be making a fantastic $6679 PER DAY!!! That's nearly $2.5 million per year or a still respectable $1.4 million after tax, and maybe a visit from the tax authorities again.

Now the cynic in me might think that these are targeted adverts based on my IP address and are possibly not true, and that clicking on suck an advert is a great way to receive some nasty virus...which may or may not be similar to the nasty viruses one could get earning such money through some "habits" ....

Isn't the Internet wonderful...and to think we could have had a base on the Moon by now....

But, this isn't all, anyone interested in semantics will question that $ means...nowhere is it stated US Dollar...so in the best case $2.5 million dollars could mean 2.5 million Zimbabwean dollars, with a total worth of approx $6900 where $ = USD in this case....so our housewife from earlier might be earning as much as 3 Euros per day ... phew!

Friday, 22 January 2016

Thinking about Grothendieck

On n-Category Cafe is a post by John Baez linking to a short article on the late, great mathematician (and human being by all accounts) Alexander Grothendieck written by Barry Mazur.

I want to quote from that paper because I think the statement here is fundamental to everything we do, particularly in engineering and mathematics, be it category theory, trying to model the information flows in a system to better understand privacy or even linking privacy engineering with the legal aspects (emphasis mine):

The mathematical talks I had with him—as I remember them now—were largely, perhaps only, about viewpoint, never about specifics (with the exception of a conversation about differential structures on conjugate complexifications of an algebraic variety over a number field). Grothendieck’s message was clear throughout: that everything important will follow easily, will flow, from the right vantage. It was principally ‘the right vantage,’ a way of seeing mathematics, that he sought, and perhaps only on a lesser level, its by-products. 


Wednesday, 20 January 2016

DSummit, Stockholm, May 2016

One for the CEOs, CIOs and CxOs of the world. This year DSummit is in Stockholm on 26th-27th May and has an impressive array of speakers and a strong focus on #privacy engineering!

"Disruptology is the art and science behind disruption. We study disruption and its impact on business and society. With a network of change makers, technology moguls and innovation evangelists we assist companies of all sizes with guidance, advisory and resources to become true disruptors. As an non profit academic institution and research foundation, Disruptology is a pioneer of new and disruptive business models, such as the F2W free-to-win model. With a vast network of industry professionals on call, we are able to inject new ways of thinking, working and playing into the DNA of companies throughout the world."


And further details of the event here: http://www.dsummit.net/

Saturday, 9 January 2016

BToolkit

First post of the year and a little look back in time.  I used the formal methods tools BToolkit from BCore extensively during my PhD studies back in the late 90s. BToolkit at the time had very nice animation capabilities that I was utilising in order to formalise parts of the UML and OCL languages.

Later on I got to work with AtelierB and Rodin (B#) for hardware-software co-design and mapping UML into B and then Bluespec - and then into SystemVerilog for hardware synthesis.

While formal methods and hardware were extremely fun, I got called away to work on something called the "Semantic Device" and moved heavily into some weird stuff called "The Semantic Web" - that's another story of course...

Anyway, BToolkit's source code is available on github and it compiles without problem under Ubuntu 15.04.

Here's a screenshot of a little piece of formal methods history:

BToolkit running under Ubuntu 15 on VirtualBox



Saturday, 26 December 2015

Kinkkumyrkytys

At this time of year I'd like to make a serious public health announcement and make people aware of a strange, incurable, debilitating disease affecting the majority of people here in Finland at this time.


* * *

Kinkkumyrkytys (eng: hampoisoning)

A debilitating disease suffered around late December and sometimes early January by persons residing in Finland. Thought initially to be a genetic disease of the native Finnish population, it now appears to be some kind of virus that is transmitted to non-natives in that region.

The sufferer experiences symptoms of feeling too full, bloated and some nausea. It also causes the sufferer to lie or sit for extended periods of time; attempts to move or walk cause the above symptoms to become worse.

In a mechanism that is still unexplained the disease affects the vocal centres of the brain rendering the sufferer to emit grunts and be incapable of saying much more than simple sentences. Sufferers have been known to complain bitterly and say phrases such as "Ei ruokaa...", "Ei enää kinkkua taas...".

Curiously regardless of the nationality and language of the sufferer, these phrases are always in Finnish leading to speculation that this is some new class of neurological disorder. Because of the above utterances, it is believed that this is how the disease obtained its name.

In extreme cases the sufferer becomes a vegetable and can only blankly stare at contentless, bright, flashing pictures known as Finnish Christmas TV without comprehension for hours on end. In some serious cases people have been known to binge watch "Vain Elämä" - the prognosis in these cases is however extremely grave bordering on absolutely no hope at all.

Interestingly while sufferers have a complete aversion to roast ham at this time, other foods also cause the sufferers additional agony. These include: mätti (fish eggs), lipeäkala, joululimppu (Christmas bread), various kinds of "laatikko-" food including lanttu (swede), porkkana (carrot) and peruna (potato).

It has been suggested by some researchers that there may be a connection with excessive amounts of Christmas good consumed in Finland. However this research has been extensively denounced as being "pasta" - a Finnish term meaning "obviously not true you ignorant fool...pass me more ham and an extra helping of that lovely lanttulaatikko too!"

A secondary debate on whether lipeäkala is food or a chemical/biological weapon is tending towards the latter.

The symptoms of this disease continue for a number of days and the sufferer returns to full health quickly afterwards. However no immunity is gained and it is likely that the symptoms will reappear at the same time next year,

Some alternative therapists have suggested a treatment called "Tipaton tammikuu" involving consuming homoeopathic amounts of alcohol for a month. This rather dangerous and unethical therapy has been denounced as being "pasta".

Tuesday, 22 December 2015

100,000 page views

100,000 page views isn't huge...but for a blog that was meant to be a way of collecting links and thoughts and not really aimed at anyone in particular - though you might see a strong leaning to things such a privacy, astronomy, mathematics, computer science - I consider this to be quite a milestone.

And here it is, reached at 22:27 on 22 December 2015:


Nadolig Llawen
Hyvää Joulua
God Jul
Merry Christmas

Engineers for Privacy Professionals

As many discussions on this blog have pointed out, there is a mismatch between engineering and legal when it comes to privacy; one can even argue there's a mismatch between these two groups and privacy advocates too, but that's another story...

It is critical for anyone involved in privacy to understand that without the complete trust and involvement of the engineers who build the systems that are supposed to be compliant with whatever privacy policy exists, that compliance will be at best, fragile.

At the IAPP's DPIntensive meeting earlier this year I gave a presentation on the subject, here's the link to the slides.


The main learning is that unless engineering is an equal part in your privacy discussions then you're really just playing at compliance.

Privacy isn't just about privacy policies or long winded legal documents but about education, learning and understanding that everyone depends upon everyone else in order for your business to successfully (and legally!) function.

I wrote about how privacy should be taught earlier with the quote:

It often surprises me that many of the people advocating privacy don't actually understand the things that they're trying to keep private, specifically information. Indeed the terms data and information are used interchangeably and there is often little understanding of the actual nature and semantics of said, data and information.

This is also seen in how we train our staff in privacy aspects - with the dreaded "privacy awareness training":

One thing that came up was the need for training and that privacy awareness training hasn't had the effect hoped for. Given that awareness training is exactly that, is it no surprise that once the, usually, one hour presentation on how we should all care about privacy is made nothing happens?
 
Actually, everyone is acutely aware of privacy in the first place and privacy awareness training rapidly becomes an exercise in CYA - as security expert Bruce Schneier might have put it - and have no effect whatsoever on the overall quality of development, customer privacy and company culture.

I guess we're still pretty naive about privacy and unless we have a cultural change this naivety will come back to haunt us for a very, very long time with some awful business repercussions.