Arjen's blog

The Ducth Considerati think tank reported earlier this week that there is still widespread  downloading in the Netherlands. But for an allegedly 'broad' piece of research, some key parties were missing - Bits of Freedom, for example. Nor did the study consider fundamental questions about the social or economic value of copyright that lasts for more than a century (when once it only lasted for 15 years), probably because those ordering the report did not want that question asked, let alone answered. There was also no mention of the copyright industry aggressively lobbying behind closed doors where laws are hammered out that our European representatives are not even allowed to see, let alone influence.

The entire debate is reduced to a financial accounting exercise for a particular industry. So all is perfectly OK then, as I have nothing to do with it – I don't work in that industry – nor indeed do the vast majority of people. The comments  on Webwereld.nl quickly show that almost nobody takes such research seriously.

A lawyer from the American RIAA recently added some colour by saying that the public domain blocked free market capitalism. So much honesty can be scary sometimes. But the recent high point of the "e"G8 meeting in Paris was when Sarokozy and a few captains-of-industry gathered to decide what we should be allowed to do with our internet in the future. In response, a few uninvited representatives of civil liberties organisations held their own press conference (video - Lessig sums it up nicely from 7:00 minutes onwards).

These examples make it absolutely clear that the idea of any reasonable discussion with these vested interests is pure fiction. Wise people like Prof. Lawrence Lessig have been trying to start such a discussion for a decade, without success.  Writer and activist Cory Doctorow also tries to find a reasonable 'middle ground' between the interests of authors, the copyright industry and the rest of society, and himself provides a good example with his DRM-free books. The copyright industry (or “entertainment industry "in the Considerati report) ensures that any such a discussion is absolutely impossible by claiming industry interests and rights are absolute, without providing much of a broader social context. Large parts of the Considerati report read along the lines that providers of bottled mineral water are losing a lot of money because the local municipality washes its buses with tap water.

This week, a UN report declared that uninhibited  access to the internet was a human right. This makes the French HAPODI law (whereby, after three alleged transgressions, the citizen is disconnected) a human rights violation. As long as people have internet access, they will download material. If there is anything to be learned from the internet's last 15 years, it is that repressive measures against making digital copies always fail. Next year there will be yet more storage, wider bandwidths and cheaper processing power. This will only stop if we give up those basic rights as defined by the UN. A digital police state of Stalinist proportions would be needed to prevent copying. It is not insignificant that it is the copyright industry itself that is blocking any real move towards a wide-ranging public discussion on the reform of copyright.

There is a well-known rule for complex projects: Good, Fast, Cheap - choose two. You can get good and fast but it will cost. Good and cheap is possible, but it may require a little patience.  All three at once is usually not possible. We can apply a similar formula to the 'download debate':

Internet, Privacy, Copyright; Choose Two.

We can have the internet with the current functionality and openness while maintaining the right to privacy and free speech - but maintaining a 20th-century copyright model at the same time is impossible. Or we could give up our privacy and other civil rights to allow one specific industry to earn money in the same old way for a little longer. A last option would be to switch off the internet. But that is not realistic: a country like the Netherlands could not survive a day without the internet, any more than it could survive without electricity.

As a society we're going through the painful realisation that we can only have two out of the three options. Different vested-interest groups would no doubt make different choices but, like the vast majority of the people, I opt for the internet and privacy (this symbolises a whole range of civil rights). And thus the outcome of the process is already established, assuming we have a somewhat-functioning democracy (ACTA people do sometimes have doubts about this). Lawrence Lessig once joked during a presentation in Berlin that he, like Gorbachev, wanted to reform the system enough so it could be kept in place. Reform does not appear an option, rather a non-violent revolution is likely to happen.

Like any social change (the abolition of slavery, universal suffrage), this is also accompanied by heated debates, occasional legal sabre rattling and periodic propaganda reports from hired guns. But historically that will be just so much background noise. Maybe there will come a time, in the not too distant future, when basic civil rights make a comeback, upheld by the legislature and supported by the law enforcement agencies.

Until then, we citizens must defend our online rights with technical skills. Privacy can be upheld with crypto. To ensure mobile network neutrality,  run all your traffic through a VPN . On a day-to-day basis, it is not crazy to suggest that we should all explore the use of privacy tools more thoroughly.

Previous columns on copyright

Debate between HAR2009 en BREIN at Hacking at Random

Doctor, doctor ...

A MP stumbles, coughing, into the doctor's surgery. There is blood pouring from the ears and nose and left eye. “Doctor, doctor, I've just had a bad fall and I think I've broken my wrist” gasps the MP. The doctor has a look and briefly feels the pulse. “Does that hurt?” “A little bit” mumbles the MP. “I don't think it's that bad” says the doctor. Unfortunately I can't check it today as the digital X-ray machine is broken”. The MP is swaying back and forth. “It's probably just a bruise, the nurse will give you a sling. Take it easy for a couple of days and come back if it's still painful.”  The MP staggers out of the surgery, still bleeding from the ears, nose and eye. The doctor is already focused on the file of the next patient, because doctors are very busy.

The process described above resembles the way the Court of Audit went about answering MPs questions about our national IT strategy. The MPs asking those questions were not experts and the Court provided simplistic answers without providing any context or stopping to consider whether the symptoms might be part of a broader problem. The newly-published report failed to respond  even to the superficial questions and, moreover, based its answers on minimal data.  Which is a disgrace, as it is precisely the role of the Court to delve into the deeper issues.

Instead of focusing on the 88 million euros spent on licence fees (less than 1% of the total annual licence expenditure), the Court could and should have explored why a different approach can work in other European countries, but fails in the Netherlands. Is this country really so different from Finland, Germany, France or Spain? As their colleagues in the Central Planning Bureau had done in 2009, the Court could have produced its own qualitative analysis of the macro-economic effects of large-scale, open source implementations. This as a viable alternative to  annual imports totalling of more than 8 billion, primarily from the USA. The macro-economic demand alone is relevant since the VAT and profit tax of this trade ends up predominantly in the Irish treasury, because of inter-EU trade regulations.  (I 'm not necessarily against bailing out Ireland but this can surely be done more efficiently). Also the figures of the 2004 SEO study are still current enough to be indicative for order of magnitude estimates.

As one of the 'experts' consulted by the Court, I am very disappointed by the minimalist approach it took. But perhaps I shouldn't have been surprised – after all, in a previous report, the Court had also dithered, even after they had determined the government really had no insight whatsoever into its own IT spending. It is beyond me why a subject such as IT, where so many aspects can go so terribly wrong, is not more thoroughly and strategically overseen. In my written input to the Court last year I proposed several clear ways to frame the fundamental questions. For those who, like doctors, are very busy here is a summary:

Dear MPs, the Netherlands is a modern western country with access to the same knowledge, technology and IT budgets as Germany, France, Spain and Finland. Today all these countries  have already achieved widespread adoption of open source and open standards in government. The work of the Dutch government is also very similar to these countries - certainly generic aspects such as office automation. So, eight years after the original and unanimous vote by parliament, surely the only reason that the Netherlands cannot implement this policy is our administrative culture and our Atlanticist political orientation. There is certainly no fundamental reason why the results of the other countries I mentioned cannot be replicated in the Netherlands, particularly because those same countries have already done all the preliminary research for us. But in recent years potential obstacles for migration have been elevated to norms, rather than being correctly identified merely as part of a problem to be solved.

Parliament should no longer accept high dependence on a supplier being invoked as an excuse for not making progress towards becoming less dependent on that supplier (as the government did in response to parliamentary questions in in 2004, 2006 and 2008). The high dependency is the problem that must be solved, not an immutable law of nature where IT departments are the powerless victims.

Parliament should no longer accept the acknowledged lack of technical and organisational expertise of the 60,000 government IT professionals (and its suppliers) as a valid excuse for the lack of progress. It is implausible that the Dutch state cannot find the requisite skills to replicate the results of its European neighbours. Any IT staff and management found lacking in the necessary skills to carry out the very reasonable requests from parliament should be retrained  or replaced. Incompetence is grounds for dismissal, not a valid excuse to refuse to do the work.

Of course there will be problems in unravelling this gigantic Gordian knot, created by decades of accumulated proprietary software. But the most frequently cited excuses for not making a start with OSS and OS are similar to those used by asbestos manufacturers: "yes, but it is handy", "we have been using it for so long", "we are comfortable with it", "we know nothing else". All factually correct statements, of course, but certainly not valid excuses to prevent us from finding an alternative solution.

If the government had started making these changes way back in 2002, as parliament voted to do, the cutbacks we're now suffering in education and health care would have been more than covered.

On this issue, the Netherlands seems  to have been reduced to providing the frightening role for the rest of Europe on “how not to do it....”. Too bad.

Asbestos is also useful

For decades throughout the Western world houses were built with asbestos. The material is affordable, durable, insulating and also has excellent fire resistant properties. All this - and the low price – made it the ideal stuff to use for everything. Which is what we did.

As long as the asbestos remains safely in place, nothing much happens. It does its job and you don't need to think about it. The problems begin when changes are made, such as a conversion. The demolition of a such a wall releases microscopic asbestos fibres, resulting in enormous danger to the health of anyone who has the misfortune to be nearby. Consequently the processing of asbestos is very strictly regulated. Despite these regulations, asbestos has for decades caused twice as many deaths as road accidents.

Because the long-term consequences of the use of asbestos is so damaging, its use is now prohibited. All this, despite the fact that the original reasons for using still exist: asbestos is still cheap, strong, durable, insulating and fire resistant. Yet we now don't use it because the social price is just too high. Strategic and social reasons are more important than practical and technical advantages.

Yet when we talk about the software that governments use for their daily work, it seems virtually impossible to distinguish between strategic and operational arguments. Concerns about the fundamental inadequacy of closed (and uncontrollable) systems are easily dismissed by phrases such as "it's useful", and "everyone's used to it”, or even “political concerns are not up for discussion”. All these quotes were also used by asbestos suppliers in the 1980s.

Fortunately, the traditionally cuddly but now dangerously naive Dutch approach to international relations was brutally interrupted last month: the Dutch government has been lying to itself and us about military deployment; people's cloud-computing data is indeed vulnerable; Israel and the USA use their technical knowledge of proprietary systems to attack their digital adversaries; and 10% of Dutch PCs have been taken over by criminals. The latter is a direct consequence of the desktop-monopoly actively created by the government, and to this day strengthened through its IT-education policy.

Today it's an Iranian nuclear installation, the personal data of Rop Gongrijp, and the domain of Wikileaks. Tomorrow perhaps it will be a Dutch (air)port, power station, hospital or a few ministries?

If the Netherlands wishes to retain control of its own sovereignty, we have to stop this quasi-naivety in conversations about technology strategy. Despite all international agreements, the law of the jungle still prevails, but we behave like we're taking a stroll in the park. NOiV (or its successor programme) must find the courage to start a conversation about the strategic implications of running our public administration on systems that are not under our control. It is time to strictly regulate our public sector asbestos-information.  Although it can be useful, we must seek out alternatives that ware safe for everybody.

Trainspotting

Trying to get back home to Düsseldorf on last Monday evening we made sure to be in Utrecht well before the scheduled departure time of our international high-speed train. We had reserved seats and ticket upgrades to first class so all was set for a comfy journey home to our cat. Now all we needed was the train. And that's where everything went pear shaped...

At our arrival at Utrecht station I noticed on the big board the ICE train from Frankfurt to Amsterdam had come in over 1 hour late. Since this is the train that goes back the same way through Utrecht I feared a delay. But none was reported. Our train was still scheduled for 18:59 as planned. So we grabbed a warming drink and went down to the platform at ten to seven accompanied by a cheery annoucer telling us our train was arriving immently as scheduled.

At 18:57 the information board on the platform suddenly turned and now told us there was a 30 min delay. Suddenly the cold felt a lot colder knowing we would be in it for at least another 30 minutes.

The information board kept saying the next train was the ICE to Frankfurt even though now other trains to local Dutch destinations were arriving on the platform. This caused enormous confusions both with passengers for the scheduled train and the trains that were actually there. So passengers were at the right platform at the right time and the train they wanted (to Nijmegen) was there but the information board said it was going to Frankfurt so not everyone got on. A group of friends got separated because some of them were trying to get accurate information from a conductor on the platform while others already boarded. Suddenly the doors closed and refused to open again. A minute after that the train left.

Here was a train that actually left on time (no small feat apparently!) but without many of its passengers because of misinformation. The other remarkable thing here is the fact that a conductor with a walkie-talkie standing next to the train was not able to communicate the simple message 'stop!' to his colleague driving the train for over 60 seconds. A security situation more akin to third-world countries than Western Europe.

It was a unbelievable mess.

Finally a railway person had the stoic courage to show up and try to help out the almost frozen passengers. But he had only the info his colleagues were giving him and that wasn't much. The train turned out to have a delay of 85 minutes now so we were in for more feet-stamping. At this point my other half was inquiring about hypothermia symptoms involving blackened toes and chisels.

The infuriating thing about this situation is that this delay must have been known by the railway company well before the original departure time of the train. But this information was simply not made available to the passengers or the local staff. This meant those 100 passengers could have been in one of the bars or restaurant in the station over an hour, sipping a hot coco or having a meal instead of freezing their extremities off on a windy platform being serially-disappointed by railway disinformation-boards. This also would have brought extra business to those bars and restaurants. A short text-message would have sufficed.

Just how infuriatingly incompetent can an organisation be before its clients break out the pitchforks and torches in a violent bid to replace its management? If I were in a management position at the Dutch rail I would be worried.

With a 90 minute delay a train showed up. But is was not a German high-speed ICE that we planned and paid for. It was a 'classic' Dutch train from the Eisenhower-era that should be in a museum instead of replacing the pride of Deutsche Bahn.

On the platform we met an Asian woman who was trying to get to Berlin but had missed the overnight train because of the ongoing railway disinformation campaign that night. She had gone to the International desk to ask for assistance and the Dutch railway people had printed out some info their Dutch railway planner spat out. Info that was by now wholly unusable because of the 90 minute delay of the alternative train they had advised her. The Dutch railway planner (www.ns.nl) includes some German trains but only those with connections to the Netherlands. Had they used a browser and gone to the Deutsche Bahn site (bahn.de) or put their excellent free app on a phone they could have told her take the right train from Oberhausen to Dortmund where she could catch up with the night train and still make Berlin in time. With a fellow passenger I could figure out a workable route for her and she made the connection.

How is sad it that a passenger on the platform has better real-time information through a free Deutsche Bahn app and twitter (track #ns) than the International desk at the biggest Dutch railway station?

Dutch railway clients are fighting not just price increases, delays and canceled trains but also the vast incompetence of the railway management in making available free tools to their staff to provide what stranded passengers need most: real-time accurate information that will help them find alternative ways of getting to their destinations.

It was only after crossing the border at Emmerich that we could switch to a proper ICE train, stretch out on reclining seats and plug-in our hungry computers.

As a Dutch person I am sorry to say our national railway company has fallen so far behind, that passengers are best off ignoring most of the information provided in the stations and use smart phones or other mobile devices to collect and cross-reference real-time information on train-availability and timing.

Twittering when trains actually leave key stations or when they are running delays could be a great gift to fellow travelers you may never meet. For some reason the fact that we have had these things called 'winters' in North-Western Europe for the last 40 million years has not reached the tiny dinosaur brains of the railway senior management. So as long as those dinosaurs remain in charge we're better off helping each other out in a peer-to-peer, distributed way. Perhaps this will shame the incompetents into action eventually. And if not, then there's always pitchforks and torches.

Xeroxing the war

In 1969, when the Vietnam War was in full swing,  a senior analyst at the U.S. Department of Defense was quietly copying a secret report about the war. This report, which ran to 7000 pages, covered the progress of the Vietnam war in exhaustive detail. The analyst intended to share this highly classified information with influential politicians and scientists, in the hope that it would quickly bring the war to an end.

That analyst was Daniel Ellsberg, a former officer of the Marine Corps who worked for RAND, the Pentagon think tank. As a result of his experiences in Vietnam and his meetings with conscientious objectors in the US, he became convinced that the war was wrong. With his insider's knowledge, he already knew that it was militarily lost, but that the American government was misleading the people. Every day the Vietnam war took about eight hundred Vietnamese lives, more than two thirds of them civilians, and twenty American soldiers. Many more were seriously injured or maimed for life..

On June 13, 1971 The New York Times tried to publish a number of excerpts from these documents, but was blocked by the Nixon government through legal and political means. Senator Mike Gravel made a breakthrough by reading a large part of the document in the Senate. The reading of 4100 pages took a while, but the rules of the Senate do not allow a senator who is talking to be interrupted (the "filibuster"). Everything the Senator said automatically became part of the proceedings of the Senate and thus on the public record. The publication of this information was the beginning of the end of the Vietnam war and the start the process of withdrawal of U.S. troops.

Fast forward to 2010. The US is once again embroiled in unwinnable wars, launched on dubious grounds, that continue indefinitely without any clear strategy or goal. Every extra day that these wars continue, more civilians and soldiers die.

And now there are new people who leak secret information about the wars, in the hope that the resulting political pressure will bring them to a close. The Xerox technology in 1969 has been replaced by a global computer network that uses encryption to protect the identity of the whistleblowers. Even Wikileaks does not know their identities – this is safer for both the whistleblowers and Wikileaks.

But the media's response is simply surreal. The bulk of the attention and the debate is about the Xerox machine – or at least the 21st century equivalent of it, the Wikileaks website. Questions such as "is WikiLeaks journalism?" and "should you be allowed to leak classified information?" are discussed in exhaustive detail by apparently intelligent media pundits – who with alarming regularity seem to have little understanding of the very technology they are discussing.

The first 'big' coup from Wikileaks, the “Collatoral Murder" video, led to a huge debate about the culpability of the helicopter pilots and whether or not it was reasonable for them to be able to distinguish between a camera and a grenade launcher. The key topic that was not discussed was the simple fact that the Pentagon had knowingly, for three years, lied to both Reuters and the families of the civilian casualties in Baghdad about the circumstances surrounding the shooting by an Apache helicopter, which was one kilometre away and which riddled two children with bullets from its cannon. The Pentagon made a statement in 2007 saying that it knew nothing of any injuries to children, even though it had been in possession of this video from day one and it leaves nothing to the imagination.

The deliberate lying from the start of the Iraq war continues to this day. The Dutch late night talk show, P&W, led the news on TV with "Dutchman involved in leaking attack video": that, after all, is news - apparently far more important than the fact that children were shot and there was a cover-up.

Wikileaks has already been the top story in the news for more than one week, and that's a problem. The Xerox machine is not important. Illegal wars of aggression launched on the basis of lies are important. The torture of innocent citizens in secret prisons is important. Spying on UN diplomats is important. Messing about in the internal political decisions of other countries is important.

So why is the entire media is so busy with the Xerox machine and the person with his finger on the copy button? Dear journalists, you have been presented with a cornucopia of scoops, many of which make Watergate pale into insignifcance. If African dictators were doing the things Western countries are being accused of, they would be dragged in handcuffs to the International Court in The Hague. Get to work!

Parliament's questions to the Court of Audit

Preamble
The Lower House of the Dutch Parliament has asked the Court of Audit to investigate the problems and opportunities related to the adoption of open standards and open source software for the government's information systems. The Court has opened a LinkedIn group to collect opinions from experts. This blog post is my contribution.

The questions are being asked to the highest supervisory body of the country, rather than the departments responsible for implementing this policy - the Ministries of Home Affairs, and also Economic Affairs, Agriculture & Innovation - eight years after the government's first unanimous vote on this issue and the expenditure of about 5 billion euros on licensing fees. The impression given to the outside world is that Parliament is not impressed with the progress of the last eight years and believes that the relevant government departments could benefit from the external scrutiny of a neutral and objective body.

Each of the following five questions implies a series of unspoken assumptions. In order to answer the questions, it is necessary to identify and, where neccesary, challenge these underlying assumptions in order to reach a sensible answer.

The five questions
Here are the answers to the questions raised by Parliament. There is so much interdependence that subsequent responses will sometimes refer back to earlier parts.

“You cannot solve a problem with the same thinking that created it”

1.What possibilities and scenarios exist for the reduction of closed standards and the introduction of open source software by the central government (ministries and related agencies) and local authorities?

The Netherlands is a modern western country and has the same access to knowledge, skills, technology and comparable budgets for IT as Germany, France, Spain and Finland. It is a fact that all these countries have already implemented large-scale adoptions of open source and open standards in government. The implementation requirements of the Dutch government are also very similar to these countries. The reason that The Netherlands has not moved further in this area, eight years after the original, unanimous Parliamentary vote, can therefore be attributed to nothing more than the administrative culture and our Atlanticist political orientation.

There is no fundamental reason why the achievements of these other countries cannot be replicated in The Netherlands, especially as the  groundwork has already been done. Barriers to migration have often been treated as immutable laws of nature rather than just a problem to be solved.

• Parliament should no longer accept that a high dependence on one supplier is an adequate excuse not to move away from that very dependency (as the Cabinet did in response to parliamentary questions in 2004 and 2006 and 2008). The dependency itself is the problem that must be addressed, not an enshrined principle that IT departments must endure.
• Parliament should no longer accept that the acknowledged lack of technical or organisational knowledge amongst the 60,000 government IT professionals (and their suppliers) is an excuse for the lack of progress. It is implausible that the Dutch government is incapable of replicating the successful work of its European counterparts. Any governmental IT or management staff who do not have the requisite skills to carry out the very reasonable requests of Parliament should be replaced or retrained. Incompetence is grounds for dismissal, certainly not an excuse for refusal to do the necessary work.
• Intrinsic motivation works better than coercion. Administrators and IT staff who understand the wishes of Parliament can embrace it with real conviction and are likely to want to produce better results than those who only work under duress.  Such an approach will select and promote suitable people to the right jobs. The staff whose policies and  behaviour have caused our current problems are probably not going to the ones who find the necessary solutions.
• The link between HR and remuneration policies for IT professionals and achieving technical certification related to proprietary software from a handful of suppliers must be completely severed.

“When you find yourself in a hole, stop digging”

2. What part of closed standards and software can be replaced by open standards and open source solutions and what cannot?

This question has yet another unspoken assumption: that central government has a realistic oversight of all systems, applications and related standards. As a result, questions about the number of systems that can be replaced are very hard to answer and have little relevance to achieving lower costs and greater independence in the foreseeable future – primarily because of the very large differences in costs that are associated with different standards. The government would do well to focus on the most common, generic issues, for which proven alternatives already exist. The original 2002 Vendrik Parliamentary motion already asked for this.

Key points to identify: what are the most expensive closed source areas where functional open source alternatives already exist and are already being used successfully elsewhere? What are the closest functioning areas that can result in successful migrations?

Migration plans should be drawn up in these areas as a matter of high priority – and this means halting or delaying other projects that may block these migrations and accelerating projects that play a supporting role.

For instance, in 2005 the former Ministry of Economic Affairs produced a document management system which has made it virtually impossible for years for the Ministry to use other web browsers, word processors or desktop operating systems. This is particularly surprising as, in 2004, the government itself announced that such closed systems in the work environement were harmful and undesirable, and were therefore going to be actively addressed as per the wishes of Parliament.

A current, concrete example within national government is the introduction of SharePoint. There is a significant risk that this investment, once made, will be (ab)used yet again as an excuse not to migrate to open and available alternatives. That would take us up to 2016 (14 years after the initial Parliamentary decision!) before any real work could begin on migration.

“Not everything that can be counted counts, and not everything that counts can be counted.”

3.What are the current costs? What are the predicted up-front and structural costs costs of moving from closed standards and the introduction of open source software? What are the projected savings?

The Dutch government currently spends about one billion Euros on proprietary software licences annually.  These licences are mainly foreign, and the income tax and VAT on this expenditure flows into the Irish exchequer, because most European branches of American software companies are based there. The total Dutch expenditure is eight times more. Both governmental and general expenses grow by about 10% per annum and are therefore unsustainable.

A significant portion of these annual costs can be saved or ploughed back into the local economy through Dutch SMEs, and so this cost will be an investment in the Dutch knowledge economy. With the government as the leading customer in this new market structure, it is feasible that The Netherlands could save billions per year.

In addition to these direct costs, various indirect savings could increase this amount many times over: the costs of management and security for vulnerable mono-cultures; the cost of merging old legacy systems and new applications; and social costs caused by security failures and easily avoidable software security problems. Every month there are Dutch hospitals whose primary processes are severely disrupted by computer viruses - a direct result of monoculture.

Moving beyond the financial, it becomes more difficult to quantify the social impact of the high dependency level of Dutch society on certain foreign, privately-owned companies.  However, if more than 80% of the PCs in The Netherlands can be remotely controlled or even switched off, what does that say about Dutch national sovereignty? Is it politically acceptable for foreign software suppliers or government bodies to have an On/Off switch for ministries, municipalities, police, hospitals, water works, supermarkets, schools etc...?

“The best moment to plant a tree is 25 years ago, the next best moment is now.”

4.How would the reduction of closed standards and the introduction of open source software be realised?

With not only the right mandate (which Parliament actually voted for eight years ago!), but also the right expertise significant results are attainable within 24-36 months. This requires making this area a priority issue and a break from the old attitudes, excuses and methodologies of recent years (see answer to question 1). Successes abroad can serve as templates for our projects.

One area where we could make a rapid start would be primary education. Currently we are actively strengthening existing monopolies via this sector with public money. If by 2011/12 the first two years of primary school use open systems and then a higher class is switched each year, The Netherlands will have the first generation of citizens who are trained in vendor-neutral systems entering the workforce in 12 years, easily capable of working with multiple systems and applications. De 'Rosa Boekdrukker' primary school in Amsterdam clearly shows how this can be done.

Dutch hospitals in The Netherlands could follow the example of the Antonius Hospital in Nieuwegein.  Many other hospitals can share in this success.   And because it's already been shown to work, the risks and costs for the next 100 hospitals are much lower.

It will take at least a decade before the full potential of open source and open standards can be utilised.

“Go out on the limb, that's where the fruit is”

5. Beyond the cost, what other advantages, disadvantages, risks and opportunities should the Court of Audit factor in? What conditions must be met to make possible the implementation of open standards and open source software?

Benefits & Opportunities

• Savings of billions per year in direct costs for all citizens and IT-using organisations in The Netherlands.
• Redirecting a stream of funds from Ireland / USA into Dutch society as a huge and permanent investment in our knowledge economy.
• Government investment in software will result in free, reusable software and knowledge available to our whole society, rather than controlled by privately-owned and usually foreign companies.
• Security is strengthened through greater diversity of IT, competition, and the possibility of custom code audits.
• National sovereignty is reinforced when the government has complete control over its systems.
• General IT competence will dramatically improve, ensuring fewer spectacular and expensive failures such as the 2006 'Walvis' Tax project, national medical records, public transit chip cards and, most recently, the new police system to name but a few.

Disadvantages and risks

• The current, fragmented IT policy of the Dutch government means that a thousand little fiefdoms may need to be broken up.
• The apparent lack of skills amongst IT management may have consequences for personnel. No doubt there will be resistance.
• Significant investment is probably needed in re-training government IT professionals.
• Angry phone calls from Washington DC when the flow of licensing money is shut off.

Preconditions

• See answers to question 1.
• Be realistic about the positioning and motivation of software companies. Companies seek to maximise profits, control markets and will therefore exploit any leeway that the government offers them. We do not invite the turkey to discuss the Christmas dinner. Therefore why do we accept “advice” from software companies and their interest groups about the best software strategy?
• We need to break away from the idea that  extensive outsourcing is necessary, effective or desirable. The raison d'etre of government is to justly serve the legitimate needs of its citizens; it should therefore have detailed and inherent control over information systems. Stop the corporate-speak and 'playing business' by civil servants. Government is not a business, nor should it pretend to be. Outsourcing the control of information processing systems is contrary to the very principles of a democratic state for exactly the same reasons that outsourcing the military forces or the judiciary would be.
• Make a clear distinction between political and administrative goals and the means of achieving them. Cutting costs can be realised in many ways, regaining national sovereignty in only one.
• As long as desktop projects implemented under the guise of “efficiency through economy-of-scale” result in each desktop costing 6600,- Euros per annum, this kind of bullshit-bingo is completely risible. Keep IT managers and other decision makers who don't know the difference between desktop-standards and a "standard-desktop" away from such projects.

Cloud computing, from the frying pan into the fire

In a recent column (Dutch), Frank Benneker of Amsterdam University explored the consequences of the rapidly growing use of cloud computing. The shift of computer applications from PCs and servers to a single "service" provided through a worldwide network is probably as fundamental a shift as the earlier one from mainframe computing to PCs.

Given the objectives of the Dutch Open standards and interoperability policy plan, cloud computing seems the quick and easy-to-implement solution: I hear Web 2.0 enthusiasts say “put everything on Google Docs and we are all interoperable”. But just as in the case of the "liberation" of PCs from mainframe managers/suppliers, there are problems with cloud computing – potential snakes in the grass.

In December 2004 the Dutch government decided that the dependency on dominant software providers was a problem and had to be addressed. The Dutch action plan from 2007 was the first, tentative step in dealing with this.

The Dutch government wants to use open standards for interoperability, and open source to foster independence, lower costs and strengthen local development (services instead of licences). Open standards are fundamentally essential for interoperability. The Dutch 'standard' government desktop plan demonstrates to governments that interoperability can also be achieved with an imposed, top-down mono-culture. Give everyone the same software, and information can be conveniently exchanged.

However, the price of a mono-culture is high, both directly in money and in less quantifiable aspects such as security problems and an extreme dependence on a few foreign private companies. The latter is especially difficult to reconcile with the idea of a sovereign nation and a government that is democratically accountable. Surely our governments would wish to avoid relying on foreign companies to control the connectivity of our information databases in some nebulous “computer cloud”?

The crucial point is that even in this cloud, the hardware does not belong to the government nor is it possibly even on Dutch soil. The hardware can be located anywhere in the world, and therefore subject to multiple legal regimes beyond the Dutch government's control (or indeed, accountability).

Much of the Web 2.0 knowledge for the Dutch government and discussions about this are held on ning.com servers, and the consensus is that it would be pretty difficult to migrate away from there. Even NOiV, the Dutch open standards and opensource implementation bureau also holds regular discussions on LinkedIn instead of its own XWiki environment. It is only natural that people use what they know. However, bearing in mind not only the objectives of the Policy Document, but also the various Parliamentary Motions on the subject and the earlier decisions of the government itself, cloud computing is a major IT problem. To expect cloud computing to rid us of the issue of  “lock-in” that has been a problem for the last 20 years creates a classic example of 'out of the frying pan; into the fire '.

Our current problems arise from not foreseeing the long-term consequences of our IT choices. We need a separate government IT programme to ensure the freedom of choice that we see as entirely natural in other markets. Unless the cloud computing servers are on Dutch soil and we have access to the code under an open source licence, we shall only go from bad to worse.

The Free Software Foundation has the solution for these problems, a distributed cloud that we can all access. Servers that provide free software designed to guarantee our digital freedom. After all, this is the original intention of the Internet: all equal players in their own cloud.

Gran knows why

My grandmother was born in 1920 and left school at the age of 12 to work in her father's shop.  She has never used a computer (but has tried an iPod for audio books). She is now 90 and is still interested in what I do.

Usually I just quickly skip over the technical aspects, because it's difficult for her to understand. The “why” is much more relevant. Privacy, civil rights and the control of your own details/information. She understands this easily, without having to follow all the technical details of open source codes and cryptography.

Last Sunday, Bits of Freedom in Amsterdam  organized a lecture and discussion with Prof. Eben Moglen, a former programmer who is now a law professor and advocate for the use of free software. Part of his lecture was about the risks of cloud computing (see a previous lecture in New York on the same theme).

Besides his new plans for a technical project (the Freedom Box) , Moglen spoke mainly about the principles of digital freedom. Explaining this concept in The Netherlands remains difficult.

A video that Bits of Freedom tweeted about shows this problem. It's a short list of recent privacy breaches but does not explain why these are problematic. For many viewers there is still a pervasive feeling of "so what?”.

In The Netherlands, the problem explaining this issue is that we have no recent experience of a government that has seriously gone off the rails (unlike Spain and Eastern Europe). The use of a good recent example can be seen in an employee of the German T-Mobile explaining why the British government's Stasi-style tapping of all mobile phone traffic might not be a good idea. Churchill must be turning in his grave.

As we have only experienced two real disasters in The Netherlands in the last 100 years (the German occupation and the 1953 flood),  we as a people fall back on WW2 to explain the importance of  civil rights. And then the Godwin-accusations fly. For the post-baby boom generations the war is a (his)story that we read about, but which is not quite real. And the possibility that such a thing could happen again is inconceivable, and therefore unmentionable.

My grandmother has no such problem because she lived through it. A real war - where the previous government was suddenly replaced by a new administration that energetically started using data collected in previous decades, and which found the accurate ethnic records extremely useful: an administration which could put your neighbours on a train to Westerbork, and would shoot you for owning a radio.

Eben Moglen suggested that we all ask our grandparents why privacy and other civil rights are important. People who have lived through an oppressive state are largely immune to Godwin's rules. They can speak out from a personal, rather than an abstract, historical perspective. My grandmother is not well enough to speak out, but hopefully there are some grandparents out there who can explain to the younger, Facebooking and tweeting generation in The Netherlands the vital importance of privacy and other civil liberties.

When I'm done explaining things Gran always grabs my hand and whispers "just you be careful!". Because you never know what could happen when you are critisizing governments. She knows this, so take a bit of time to listen to your gran.

Dedicated to my grandmother, Tet de Boer - Olij,
Kollum 1920 - Leidschendam 2010

Cybercrime or the end of scarcity? The future of hacking.

On October 14th The Club of Amsterdam is meeting to discuss 'the future of hacking'.

The term hacking (and hacker) means very different things to different people. Most will associate the term with computer-enabled crime; from Russian mobsters stealing western credit cards to spammers sending billions of unwanted email advertisements for Viagra to Chinese intelligence employees attempting to break into NATO computers. For those calling themselves hacker (or being called hackers by their peers) hacking just refers to the creative use of technology, any technology, to do new and unexpected things.

These two very different meaning of the term continue to cause a lot of confusion in any discussion about it. This piece will expand on both the cybercrime and creative technology uses and see where they meet.

The term cybercrime itself suggests that computer and the networks that connect them are a new phenomenon in the eyes of law-enforcement and the justice ministry. If a crime is enabled by a telephone or car this is not worthy or separate classification. But if a computer or the Internet is involved a crime quickly becomes a 'cybercrime'. A recent BBC item mentions a big case were 45 million credit cards were  stolen. The financial impact of this theft was either not known or not made public. The trouble with evaluating 'cyber'-crime is both the scope of the subject and the lack of hard data. From copyright infringement via credit card fraud to child pornography (more accurately imagery of child-abuse) cybercrime is a field that encompasses a wide range of activities of varying seriousness and with very different levels of impact on the victims. Even more troubling is estimating the effectiveness of law-enforcement do prevent or these crimes or at least bring to justice the perpetrators after the fact. Can this effectiveness be measured and if we can, is it worth logging everyone's e-mail and cellphone communications to capture an unspecified number of thieves? Precisely because we lack clear information on both the scale of the problem and the effectiveness of the measures trying to cope with it  there is no way of telling either way. Frans Kolkman (Head High Tech Crime Unit East-NL) will hopefully enlighten us a bit more.

The much happier side of hacking is all the wonderful things people are doing with technology all over the world, taking it apart and making it do stuff the original designers and producers never imagined. Thanks to intrepid hackers computers have become utterly commoditized and all of us can get connected to the global Internet for 10 euros per month. This democratization of technology has spawned not only entire new industries but also new ways for people to communicate, organize and participate in global affairs whoever en wherever you are. Martijn Aslander (Life hacker) will talk with us about using all these tools to get more out of life.

Before computers became small and cheap people calling themselves hackers were tinkering with all kinds of other hardware. Now computers, sensors and other components have become so cheap hardware hacking is becoming just as democratized as merely using a computer. Alper Çugun will give us an overview of the possibilities and perils of the digital world meeting the real world again.

The first desktop factories, also known as 3D printers, for home use with use-at-home pricing are a reality today and over the next decade they will develop in the same way our commodore 64 developed into smart-phones and laptops. Cheaper and twice as powerful every 18 months. If we can all print our consumer goods at home, will anyone even want to steal anything? Of course someone will figure out a way to print an AK-47 (just for fun mind you!) and then things will get really interesting.

Everyone having aces to technology has both benefits and problems; from youtube and wikileaks as new global media to road-side bombs detonated by cheap mobile phones and surveillance possibilities the Stasi could only dream of. In a world re-defined by technology everybody needs to become a little bit techno-literate. Ignorance of new possibilities will mean losing out on great opportunities for a better life and becoming a victim of those who would use the new tools for criminal or other bad purposes. Hackers might save the world, especially if every citizen adopts the hacker ethic of collaboration, free sharing of knowledge and an anti-authoritarian attitude to keep would-be stasis at bay.

Close the Loop

Now The Pirate Bay is outlawed in the Netherlands - although this ban has yet to be tested in Dutch courts - the copyright industry and its tame lobbyists face a difficult choice: should they take their customers to court or not?

This question is crucial to the survival of the lobby groups. Since the cost of fighting downloading is much higher than income, large entertainment companies constantly need convincing that all these indirect lobby costs will at least produce results in the longer term. Nobody wants to think that the funding of lobby groups is ineffective, even if those organisations claim hundreds of site removals annually.

The entrenching of the battle lines is probably good for providers of innovative services such as proxies that can run your Internet traffic through other countries. There are also more complex and smarter things that experienced Internet users can do to avoid detection. Like the process of  downloading itself, these will become cheaper and more user-friendly in future, so that eventually everybody can use them.

Furthermore, any attempt to tighten online control will make offline sharing more attractive. With terabyte hard disks and 32-gigabyte microSD cards, the bandwidth in your pocket is probably higher than a cable or DSL connection. Technically not much can be done to stop people sharing bits, and the odious behaviour of the industry itself causes any moral objections to evaporate faster than the Greenland ice sheet.

Individuals are now threatened with prosecutions along the lines of the German model (with a 2000 euro fine). But how many of these cases can the already-overworked Prosecution Service realistically process in a year (thanks to other nonsensical bans on certain recreational pharmaceuticals)? Even making a grossly-inflated estimate of 1000 prosecutions a month, that still only results in 24 million euros' worth of fines per annum – and obviously that's only if they win every case, which is highly unlikely.

If the companies in the copyright industry actually take this step and go to legal war with their customers, it will not take long for someone to set up an online cultural solidarity fund. By becoming a contributor to that fund for a couple of euros per month, individuals can rely on specialist legal advice if they become one of the the unfortunate 0.2-0.4% to be sued in any given year. With 1 million members contributing even 2 euros each month, you would quickly have a well-endowed war chest behind you, should you end up in court. Let's make the copyright lawyers work harder for their putative 24 million.

As the case against Ziggo and XS4ALL demonstrated, copyright lawyers don't have nearly as much fun if their opponents fight back with a competent legal team. To gamble untold millions on legal costs to gain a paltry 24 million per annum is a risky strategy. Each lost case costs them money, and when you win you gain more members (and thus a larger fund) to take to the next fight. Eventually it would be quite possible that any money remaining in such a fund could be used to create and promote culture. These works would naturally be released under a Creative Commons licence. Of course, the "Bits-Of-Freedom-XS4ALL-Ziggo” Solidarity Fund for Culture and Creativity (just thinking out loud here!) would not allow the creation of more cultural works to be milked through classical copyright.

If such a fund existed to support cultural initiatives transparently and fairly, I would personally like to pay a bit more than 2 euros per month (say 10 euros). Especially when the de facto result is that I can make unlimited downloads - without having to worry that some copyright lawyers in the Netherlands apparently don't know the difference between copyright infringement and theft (and yet are still employed as lawyers!).

Unlimited, risk-free digital culture for a tenner a month would be enough even for Maecenas - true wealth!