Cardiff Airport

First post of the new year ... and this year I'll try to post more, but for a start, this from Wales On Line (sometimes Wales' answer to the Daily Mail - at least in terms of sensationalism)...

15 safest holiday destinations for 2017 and flight prices from Cardiff

All well and good, apart from the obvious sensationalism placing Belgium, Spain in almost the same category as Iraq and Syria...and on a personal note missing the World's safest country - Finland - from the mix.

What actually struck me about this article was the HUGE price disparity between flying from Cardiff than some other regional airports. This can be attributed to a number of things, mainly classic bad management over the years (this seems to have changed a little since the Welsh Government took over), but Cardiff has suffered from a management that has been quite content not to develop the airport.

This can be seen in the prices charged and the number of airlines coming to Cardiff, for example, flights to Iceland from the above article: Flights from Cardiff start from around £223, but can be picked up for less than £70 from London or Manchester. The price differential here covers travel from South Wales to London by practically anything other than a private limousine.

How about Poland? Great country and just a mere £142 from Cardiff, but only £20 from Newcastle or Birmingham. Malta? With a change of flight at £183 from Cardiff, or, less than £30 from those international heavyweights of airprots: Bournemouth, Glasgow and Nottingham...

Shopping around of course you might get better deals and Wales On Line probably isn't the best place to get your flight information in this respect. However the situation remains that Cardiff is expensive, especially with scheduled flights more or less limited to FlyBe and KLM and no cheap operators available: Norwegian HINT!!!

For Cardiff Airport to succeed a few things need to happen. Firstly the management of the airport need to get airlines and thus people to the airport - lower fees and even make a loss in certain areas but a profit overall. Control over airport taxes by the Welsh Government is critical and then finally a little more self promotion around the World, or at least Europe - maybe even China - I'm sure that even Wales could market itself from both a tourist and business perspective to the Chinese...

The situation gets even more surreal when you consider that the Cardiff region is supposed to be one of the fastest growing in the UK, yet Wales relies upon Heathrow and Bristol instead of a perfectly functional airport right next to its own capital city. Northern Ireland manages to support two airports - one of which  actually handles a reasonable amount of intercontinental flights, Scotland has five airports (Aberdeen, Inverness, Edinburgh, Glasgow and Prestwick) with Newcastle not too far from the border. Even some of the regional English airports such as Bournemouth and Exeter look better than Cardiff.

What Cardiff Airport needs is a management who have a vision and the confidence to attempt to make things better, get more business, get more tourists etc. In some ways Cardiff Airport still suffers from the problem that the Welsh Tourist Authority (or whatever they were called) had in that for them to do anything they had to ask the English Tourist Authority permission ... it still feels the same way.

In post-Brexit UK, the devolved countries of the UK, especially Wales, can not afford to sit back and hope for business. Cardiff Airport has a lot going for it with a major maintenance base for BA and another in St.Athan next door, GE Engines in Caerffili, a rail link (just about) and a runway that can handle 747s and A380s*, it just lacks any form of confidence.

*Not that you're going to see either regularly in passenger duty - unfortunately.

Brussels - something to think about

The Independent is running a story today:

Brussels attacks: Security officials accused of missing a string of opportunities to stop suicide bombers
Accomplices still on the run after day of conflicting reports and confusion

Paul Peachey, Kim Sengupta, Leo Cendrowicz, Laura Pitel

The following paragraphs are deeply troubling given the emphasis on "banning" encryption and the need for total surveillance:

The French Prime Minister, Manuel Valls, who laid a wreath at the underground station close to the European Commission headquarters where more than 20 people died, said that EU nations had to invest “massively” in their security systems. 

The most direct criticism came from Turkey, which has previously criticised France for what it said was a failure to heed a prior warning about one of the suicide attackers involved in last year’s attack in Paris in which 130 people were killed. 

Turkish officials have previously said that French authorities were warned twice by Turkey about one of the assailants in the attacks on Paris in November. A senior government source told The Independent: “We had warned France before the Paris attacks, now this. It’s ridiculous.” 

The two brothers had been known to police in Belgium for years, and operated in some of the marginalised communities in the capital that had avoided close attention from the intelligence agencies despite problems of jihadist recruitment and terrorist links. 

The Belgian federal prosecutor, Frederic van Leeuw, told reporters that the two brothers, Brussels-born Belgian citizens, had “extensive” criminal records but they were not related to terrorism.

So, ultimately the failure was both of communication between intelligence and police agencies *and* a failure to listen. Worse is that the terrorists involved were already known (last paragraph above). If the signals of possible trouble were not seen in the above then the problem certainly does not lie with extensive data collection. In fact the perpetrators actually gained privacy by effectively hiding in plain sight.

The trouble is that now politicians are in the "do something" mode of operation, where doing anything, regardless of effectiveness, is far better than actually thinking and doing the right thing.

I had the pleasure of speaking with some security experts in counter-terrorism a while back. They effectively said that politicians want more security just to be seen to be doing something - this is why we've ended up with airport security that concentrates on bottles of water but not on mitigating the real risks - queues, delays, bottlenecks. The question of profiling, as seen in Israeli aviation security is too much for the politicians to risk their careers on so everyone will suffer under increasingly intrusive and increasingly ineffective security.

Finally this quote by Simon Jenkins of The Guardian:

Those who live under freedom know it demands a price, which is a degree of risk. We pay the state to protect us – but calmly, without constant boasting or fearmongering. We know that, in reality, life in Britain has never been safer. That it suits some people to pretend otherwise does not alter the fact. 

In his admiral manual, Terrorism: How to Respond, the Belfast academic Richard English defines the threat to democracy as not the “limited danger” of death and destruction. It is the danger “of provoking ill-judged, extravagant and counterproductive state responses”.

DevOps and the ABC(DE[FG]) of Privacy

Or maybe this should be called the ATLS of privacy perhaps?  ATLS, or Advanced Trauma Life Support is a training programme for dealing with medical trauma incidents and is typically used by first responders such as paramedics to an incident.

Now as we move to a DevOps oriented model - think of a highly integrated Agile with a "right now" delivery timescale - then the way we will have to react to compliance, privacy impact assessments, privacy engineering etc is going to be on the same kind of time-scale. Certainly if we are late or delayed with the PIA then the product is going to be shipped - with some interesting security and privacy consequences certainly!

So, I conjecture it makes sense that we bring our PIA/compliance activities not just to the engineering level but also to the speed of development and operations.

This means that the PIA is going to have to be extremely focused and very strictly run. Effectively we need the DevOps privacy version of the medical ABC.

The question then becomes what is the equivalent to the medical ABC?

As I've stated before, privacy can [must] learn a lot of things from medicine (and aviation) - such as checklists - in that they both work in very agile, unstructured and reactive environments. Privacy in a DevOps situation can not rely upon traditional compliance or work at the usual, relative glacial speed associated with such work.

References

Ian Oliver (2015). Privacy as a Safety Critical Concept. 1st International Workshop on Privacy Engineering. California. (Keynote Talk)

Ian Oliver (2014). Privacy Engineering: A Data Flow and Ontological Approach. CreateSpace. 978-1497569713 (see: http://www.amazon.co.uk/dp/1497569710  )