Arjen's blog

Cloud computing, from the frying pan into the fire

In a recent column (Dutch), Frank Benneker of Amsterdam University explored the consequences of the rapidly growing use of cloud computing. The shift of computer applications from PCs and servers to a single "service" provided through a worldwide network is probably as fundamental a shift as the earlier one from mainframe computing to PCs.

Given the objectives of the Dutch Open standards and interoperability policy plan, cloud computing seems the quick and easy-to-implement solution: I hear Web 2.0 enthusiasts say “put everything on Google Docs and we are all interoperable”. But just as in the case of the "liberation" of PCs from mainframe managers/suppliers, there are problems with cloud computing – potential snakes in the grass.

In December 2004 the Dutch government decided that the dependency on dominant software providers was a problem and had to be addressed. The Dutch action plan from 2007 was the first, tentative step in dealing with this.

The Dutch government wants to use open standards for interoperability, and open source to foster independence, lower costs and strengthen local development (services instead of licences). Open standards are fundamentally essential for interoperability. The Dutch 'standard' government desktop plan demonstrates to governments that interoperability can also be achieved with an imposed, top-down mono-culture. Give everyone the same software, and information can be conveniently exchanged.

However, the price of a mono-culture is high, both directly in money and in less quantifiable aspects such as security problems and an extreme dependence on a few foreign private companies. The latter is especially difficult to reconcile with the idea of a sovereign nation and a government that is democratically accountable. Surely our governments would wish to avoid relying on foreign companies to control the connectivity of our information databases in some nebulous “computer cloud”?

The crucial point is that even in this cloud, the hardware does not belong to the government nor is it possibly even on Dutch soil. The hardware can be located anywhere in the world, and therefore subject to multiple legal regimes beyond the Dutch government's control (or indeed, accountability).

Much of the Web 2.0 knowledge for the Dutch government and discussions about this are held on ning.com servers, and the consensus is that it would be pretty difficult to migrate away from there. Even NOiV, the Dutch open standards and opensource implementation bureau also holds regular discussions on LinkedIn instead of its own XWiki environment. It is only natural that people use what they know. However, bearing in mind not only the objectives of the Policy Document, but also the various Parliamentary Motions on the subject and the earlier decisions of the government itself, cloud computing is a major IT problem. To expect cloud computing to rid us of the issue of  “lock-in” that has been a problem for the last 20 years creates a classic example of 'out of the frying pan; into the fire '.

Our current problems arise from not foreseeing the long-term consequences of our IT choices. We need a separate government IT programme to ensure the freedom of choice that we see as entirely natural in other markets. Unless the cloud computing servers are on Dutch soil and we have access to the code under an open source licence, we shall only go from bad to worse.

The Free Software Foundation has the solution for these problems, a distributed cloud that we can all access. Servers that provide free software designed to guarantee our digital freedom. After all, this is the original intention of the Internet: all equal players in their own cloud.

Cybercrime or the end of scarcity? The future of hacking.

On October 14th The Club of Amsterdam is meeting to discuss 'the future of hacking'.

The term hacking (and hacker) means very different things to different people. Most will associate the term with computer-enabled crime; from Russian mobsters stealing western credit cards to spammers sending billions of unwanted email advertisements for Viagra to Chinese intelligence employees attempting to break into NATO computers. For those calling themselves hacker (or being called hackers by their peers) hacking just refers to the creative use of technology, any technology, to do new and unexpected things.

These two very different meaning of the term continue to cause a lot of confusion in any discussion about it. This piece will expand on both the cybercrime and creative technology uses and see where they meet.

The term cybercrime itself suggests that computer and the networks that connect them are a new phenomenon in the eyes of law-enforcement and the justice ministry. If a crime is enabled by a telephone or car this is not worthy or separate classification. But if a computer or the Internet is involved a crime quickly becomes a 'cybercrime'. A recent BBC item mentions a big case were 45 million credit cards were  stolen. The financial impact of this theft was either not known or not made public. The trouble with evaluating 'cyber'-crime is both the scope of the subject and the lack of hard data. From copyright infringement via credit card fraud to child pornography (more accurately imagery of child-abuse) cybercrime is a field that encompasses a wide range of activities of varying seriousness and with very different levels of impact on the victims. Even more troubling is estimating the effectiveness of law-enforcement do prevent or these crimes or at least bring to justice the perpetrators after the fact. Can this effectiveness be measured and if we can, is it worth logging everyone's e-mail and cellphone communications to capture an unspecified number of thieves? Precisely because we lack clear information on both the scale of the problem and the effectiveness of the measures trying to cope with it  there is no way of telling either way. Frans Kolkman (Head High Tech Crime Unit East-NL) will hopefully enlighten us a bit more.

The much happier side of hacking is all the wonderful things people are doing with technology all over the world, taking it apart and making it do stuff the original designers and producers never imagined. Thanks to intrepid hackers computers have become utterly commoditized and all of us can get connected to the global Internet for 10 euros per month. This democratization of technology has spawned not only entire new industries but also new ways for people to communicate, organize and participate in global affairs whoever en wherever you are. Martijn Aslander (Life hacker) will talk with us about using all these tools to get more out of life.

Before computers became small and cheap people calling themselves hackers were tinkering with all kinds of other hardware. Now computers, sensors and other components have become so cheap hardware hacking is becoming just as democratized as merely using a computer. Alper Çugun will give us an overview of the possibilities and perils of the digital world meeting the real world again.

The first desktop factories, also known as 3D printers, for home use with use-at-home pricing are a reality today and over the next decade they will develop in the same way our commodore 64 developed into smart-phones and laptops. Cheaper and twice as powerful every 18 months. If we can all print our consumer goods at home, will anyone even want to steal anything? Of course someone will figure out a way to print an AK-47 (just for fun mind you!) and then things will get really interesting.

Everyone having aces to technology has both benefits and problems; from youtube and wikileaks as new global media to road-side bombs detonated by cheap mobile phones and surveillance possibilities the Stasi could only dream of. In a world re-defined by technology everybody needs to become a little bit techno-literate. Ignorance of new possibilities will mean losing out on great opportunities for a better life and becoming a victim of those who would use the new tools for criminal or other bad purposes. Hackers might save the world, especially if every citizen adopts the hacker ethic of collaboration, free sharing of knowledge and an anti-authoritarian attitude to keep would-be stasis at bay.

Close the Loop

Now The Pirate Bay is outlawed in the Netherlands - although this ban has yet to be tested in Dutch courts - the copyright industry and its tame lobbyists face a difficult choice: should they take their customers to court or not?

This question is crucial to the survival of the lobby groups. Since the cost of fighting downloading is much higher than income, large entertainment companies constantly need convincing that all these indirect lobby costs will at least produce results in the longer term. Nobody wants to think that the funding of lobby groups is ineffective, even if those organisations claim hundreds of site removals annually.

The entrenching of the battle lines is probably good for providers of innovative services such as proxies that can run your Internet traffic through other countries. There are also more complex and smarter things that experienced Internet users can do to avoid detection. Like the process of  downloading itself, these will become cheaper and more user-friendly in future, so that eventually everybody can use them.

Furthermore, any attempt to tighten online control will make offline sharing more attractive. With terabyte hard disks and 32-gigabyte microSD cards, the bandwidth in your pocket is probably higher than a cable or DSL connection. Technically not much can be done to stop people sharing bits, and the odious behaviour of the industry itself causes any moral objections to evaporate faster than the Greenland ice sheet.

Individuals are now threatened with prosecutions along the lines of the German model (with a 2000 euro fine). But how many of these cases can the already-overworked Prosecution Service realistically process in a year (thanks to other nonsensical bans on certain recreational pharmaceuticals)? Even making a grossly-inflated estimate of 1000 prosecutions a month, that still only results in 24 million euros' worth of fines per annum – and obviously that's only if they win every case, which is highly unlikely.

If the companies in the copyright industry actually take this step and go to legal war with their customers, it will not take long for someone to set up an online cultural solidarity fund. By becoming a contributor to that fund for a couple of euros per month, individuals can rely on specialist legal advice if they become one of the the unfortunate 0.2-0.4% to be sued in any given year. With 1 million members contributing even 2 euros each month, you would quickly have a well-endowed war chest behind you, should you end up in court. Let's make the copyright lawyers work harder for their putative 24 million.

As the case against Ziggo and XS4ALL demonstrated, copyright lawyers don't have nearly as much fun if their opponents fight back with a competent legal team. To gamble untold millions on legal costs to gain a paltry 24 million per annum is a risky strategy. Each lost case costs them money, and when you win you gain more members (and thus a larger fund) to take to the next fight. Eventually it would be quite possible that any money remaining in such a fund could be used to create and promote culture. These works would naturally be released under a Creative Commons licence. Of course, the "Bits-Of-Freedom-XS4ALL-Ziggo” Solidarity Fund for Culture and Creativity (just thinking out loud here!) would not allow the creation of more cultural works to be milked through classical copyright.

If such a fund existed to support cultural initiatives transparently and fairly, I would personally like to pay a bit more than 2 euros per month (say 10 euros). Especially when the de facto result is that I can make unlimited downloads - without having to worry that some copyright lawyers in the Netherlands apparently don't know the difference between copyright infringement and theft (and yet are still employed as lawyers!).

Unlimited, risk-free digital culture for a tenner a month would be enough even for Maecenas - true wealth!

Votingcomputers, the bugs are not the problem

While the use of voting computers in the Netherlands has been banned for over half a year, even for water board elections, there remains a fundamental misunderstanding of the essence of the problem with voting machines.

While the many clumsy security problems (video) or the absence of the source code of the software (in the case of Nedap and SDU voting computers), are an excellent opportunity to develop the topic through the media and in the political agenda, these issues are not core of the problem. And although the voting computer dossier at the Ministry of Home Affairs is now labelled with a bright fluorescent sticker: 'radioactive, do not touch!", there is still a risk that local authorities or suppliers continue to feel that voting by computer is best "if we can just iron out a few little bugs”.

The real objections are more fundamental and have little to do with security bugs or open source code. They are the fundamental principles of the reasons why we have democracy, which the use of voting computers threatens. In the many discussions on mailing lists and web forums it seems that people lose sight of the fundamental principles.

In the first year of operations of the wedonttrustvotingcomputers work group, by government and suppliers that had not been suspicious. The Netherlands is a great country and the suggestion that someone is committing fraud with something so fundamental as ridiculous as the election was done by hand. It was simply unthinkable and further discussion or justification about it was not necessary. This attitude demonstrates a fundamental misunderstanding of the essence of democracy. That is not a question of trust but distrust of organized power.

Through trial and error we have learned over the past few thousand years that power corrupts, and absolute power can corrupt absolutely. An enlightened dictator can be an efficient form of government but how do you ensure they remain enlightened once they have the power?? To solve this problem we have evolved a complex system of temporary mandate (four years), with checks and balances as th need arises. You can only gain power if many people have said that they really want you there, and even then you will be closely monitored by 150 other people who are also only be allowed to do so because of the vote of thousands of fellow citizens. The system is far from perfect and is plagued by inertia and a focus on what is hot in the media, but we have yet to invent something better. This system makes it difficult to take important decisions publicly without authorisation. And a king or president cannot simply on a whim ruin the country or violate the fundamental rights of citizens - unless those citizens and their representatives agree to it by inaction, but then they only have themselves to blame.

The abuse of power cannot be solved by having online the the source code of a voting computer because citizens cannot determine whether the published source code actually runs on the specific voting computers in their neighborhood. Even more important is the fact that 99.99% of the population cannot audit the code. It still comes down again to having confidence in a very small group of technical experts. And having to trust a very small group (any small group whatsoever!) is precisely what we no longer want. If we have small groups of technicians whom we trust, we might as well make up the parliament based on a sample of a research firm. That saves a lot of time and paper and there is probably a good TV night to build around.

It has often been said that paper ballots can also be fraudulent, with the recent election in Zimbabwe cited. The important aspect here is not the possibility of fraud but its detectability. Large-scale, and therefore effective, fraud in a paper voting system is impossible to keep secret and that makes it possible to intervene when small groups try to exploit the system. In most cases, fraud with voting computers is impossible to prove afterwards. The records are then erased and there are no ballot papers available for another recount. This proved once more painful when a local election where the candidate gemeenteraadsid also operator of the voice computer was. In the polling station where he was present he was unlikely many more votes than all other locations in the municipality. Yet no matter OM could get around this potential fraudster to lack of evidence. The man can this lack of evidence but never convincingly prove his innocence. The result is therefore a situation where the integrity of the process itself is called into question, and thus the legitimacy of the ballot. The distinction is thus the detectability of fraud, not the (im)possibility of it.

Voting computers do not solve any major problems, are more expensive to use than paper and undermine the legitimacy of democratic governments. And as Churchill said: "Democracy is the worst form of government, except for all those other forms that have been tried from time to time.'

The Last HOPE

Just finished my talk at the Hope conference about the national Dutch open standards / opensource policyplan. Hope stands for Hackers On Planet Earth and has been a bi-annual event since 1994. HOPE features presentations on a range of (IT) security related topics but also hosts all kinds of techno-creative workshops and lectures on the social relevance of technology. For a full listing see the conference site. Video's of the talks will become available in the future.

Because the mid-town Manhattan hotel just across from Penn station in New York may be demolished next year it is unclear if there will be (a) hope after this one. Because of this, and a certain facination with morbid themes, the conference organisers are calling this 'The Last Hope', refering both to their conference and the state of (digital) civil liberties in the US.

Cnet has the first coverage on the event.

My slides are here in ODF and PDF. For more background links and video see the 24C3 page (Dec 2007 talk in Berlin) and my blogpost about LinuxTag (May 2008 Berlin).

Workplace 2028

After a brainstorming session with about 50 employees of Brunel Engineering last week I was asked to write a piece on the workplace of the future.

Office 2028
How are workplaces will look like in 20 years depend on two basic factors. One factor is the development of technological instruments to aid us in our work. Think all those IT-related things such as the speed and capacities of computers, networks and data storage systems. Scientific insights are put to work to make these instruments easier and more effective to use. Improved understanding of human cognitive and neural processes allow for better information-processing tools. Then there is the physical location (slowly but surely becoming less important); new materials make for better chairs, desks and ultimately an entire building specifically designed to facilitate mental work.

The other factor is us. Our (in)ability to actually use all these tools effectively my become the major bottleneck in improving the effectiveness of office workers. Techno-scientific developments tend to out pace the ability to change of most organisations (and the people in them) by at least a decade or two. There will be major difference between and within organisations. Age, education, upbringing and attitude will all be factors determining a workers ability to absorb the skills required to use new tools to do things better or to do better things for the organisations they are a part of. The type of work is also relevant. Graphics designers, architect and other creatives usually want and need the best possible tools and know how to use them. Someone writing a policy document can probably make due with the same word processors we use today. Some people may perform relatively simple administrative tasks in an organisations with a low level of automation while another performs complex, creative and knowledge intensive work were the limits of technology are sought. Thé office of he future therefore does not exist.

In 2028 many officeworkers will still be behinds desks wile others will be plugged into the Internet from somewhere on the planet. Some of them will work alone but more will work in teams assisted by intelligent systems that take most of the analytical and non-cvreative work out of their hands. Education, training, good leadership and access to communities of knowledge will be the determining factors of their productivity and creativity.

Will Apple be the next Sony?

I normally don't review products or specifically recommend them but the difference between the success of the iPod and Apple TV teaches some important lessons to anyone with ambitions in the digitized media markets of the 21st century.

Apple TV's competitor is not the video rental store on the corner, it's not even online companies like Netflix. It's The Piratebay and sites like it. And it will be hard to re-learn new customers to buy media for watching though devices like Apple TV when they've been using somewhat comparable devices for  freely watching media for a few years.

I own both a Mac laptop and an iPod and use them both to listen to music, podcasts, recorded lectures, audiobooks and watch movies on planes & trains. Even though my 60GigaByte iPod is two-thirds full I've never bought anything through iTunes. Why would I? Firstly I'd have to pay for it while there's more than plenty music freely available (downloading is legal in the Netherlands and some other EU countries as long as you're not making a profit from it by reselling or renting). Then there's the fact that Apple ties the music it sells to me to their device. And while I like my iPod a lot I want to retain the option to switch to something else in the future (maybe my new Nokia phone that holds 8GigaByte of data). My downloaded MP3's do not restrict me in any way. Oh, and did I mention they were free? It's a pretty easy choice.

The iPod is successful because it does not restrict me from playing a relatively open (and widely available) format such as MP3, downloaded or ripped from CD's I owned. Apple TV on the other hand comes with all kind of restrictions built in. While I could buy (or rent) movies from Apple and watch them on my TV through the Apple TV device this is a big limitation compared to being able to choose the source of media myself, choose to payment level and method myself and then do with the file as I please (transfer it to a non-Apple device for instance). While the Apple TV has a nice Interface to control it from the couch so do various other devices at a lower cost. These also do not restrict me in my sources of media like Apple TV. So why would I buy a 300 euro Apple device that ties me down to the Apple media store when I can get a better device for under 200 that does not?

Apple seems to be making the same mistake as Sony did some years back. You remember Sony don't you? They used to make these things called Walkmans fthe late seventies - I bought several of them. Then when customers started demanding MP3 players Sony did not deliver because it's management feared that would hurt their CD business. Apple did not have a CD business and felt no such limitations. They blew Sony's 25-year legacy of building  the hottest mobile music devices out of the water in in few short years.

So now there's Apple trying to tie us to their storefront through a device while other device makers don't. Its pretty obvious what is going to happen. As long as Apple (or any other manufacturer) tries these kind of tie-ins I'll stay away. And so will the dozens of people who rely on me to make tech-purchasing decisions for them. Instead I'll move to a device that gives me the freedoms I demand from a media center and I'm taking a buss load of potential customers with me. So will most of my tech-savy friends. If Apple does not want to be the next Sony the need to shape up and let me choose freely the source and file-format of my digital media. Only then will I consider taking my mac-ownership to the next level.

(this brainwave was created over Portuguese chicken with Aldert - thanks man!)

Desktop mono-culture for the Dutch

The Dutch national government is proceeding with its new implementation of 'GOUD' (Gold), its new plan for a 'standardized desktop' for ministries and other governmental institutions. After the much publicized new Dutch National IT-policy of last autumn this might sound wonderful. It's not.

The problem with the 'standardized desktop' is that it uses very few real standards. Instead it uses products and pretends they are standards. The difference between 'standards' and the idea of 'standards products' is widely misunderstood, often confused and this is where projects such as 'GOUD' go off in troublesome directions.

Standards are things like Open Document Format, HTML (the programming language of web pages), LDAP (a protocol for defining access-control on a network) or TCP/IP (the low-level network protocol of the Internet). What all these things share is that they are not owned by a single entity. They are a formalized form of knowledge about how to achieve certain technical objectives. This knowledge can be used by programmers to build tools that actually do these things for us. This means that there will be many different, competing, implementations of the standards that can inter-operate. This diversity fosters a working market and ups the quality while lowering the price (often down to zero).

'Standard products' on the other hand are, by definition, products and generally owned by private corporations with a profit motive. Standardizing on a product is essentially creating a mono-culture of one type of product, making yourself totally dependent on the vendor of that product. In the case of desktop computers this is extra problematic because there exists a de facto monopoly in this market. Creating a mono-culture in a monopolized market actually re-enforces the monopoly, the exact opposite of the aims of the adopted policy plan.

The Dutch government (or any other for that matter) should not work towards a 'standard desktop' but towards open desktop standards. This is precisely what the Dutch parliament unanimously requested from the government in 2002. Open standards, such as the ones mentioned above, allow computers of many different types and the people using them to communicate.

The Internet is a network of billions of computing devices made by thousands of different vendors and these can all communicate through open standards. Because of this I can e-mail other people without having to know anything about the computer they use. As long as we all agree to adhere to the standards information sharing is possible with a variety of systems and products. Open standards make this possible and should be the cornerstone of any governmental IT-architecture.

I've had many conversations with civil servants on this issue over the years and I conclude from these that the vast majority of them have no conceptual understanding of the difference between (the use of) standards and product mono-culture. In 2005 I was speaking at the Ministry of the Interior to a civil servant who enthusiastically talked about the 'standard' desktop they were developing for the entire government (350.000 desktop in the Netherlands). When I asked him what standards they were using he responded with a list of products: 'this version of an operating system, that version of a word processor', and so on. I tried not to cry. I really did.

In the 'Gold'-documentation (yes, the project name is a gift to punsters) the same way of thinking is pervasive; in order to collaborate, all civil servants need to use the exact same software products. I call bullshit. One of the primary recommendations of a counter-expertise report was to replace product-specific standards by open standards. This would enable interoperability with a variety of systems in the future and thus free the government of its dependence on a single vendor. This remains one of the primary stated goals of the national policy set by the government and applauded by parliament.

I can imagine how 15 years of vendor-lock-in-by-standards would lead people to believe computer systems can only share data if they are all supplied by the same vendor. This is however not a law of nature but a symptom of a badly functioning market. It is a problem to be solved by making a policy plan and sticking to it. The national action plan obliges the government to actively seek solutions to the problems of interoperability by the mandatory use of open standards.

In a letter to parliament the responsible minister for the 'Gold' plan claims two things:

1. With the new 'standard' desktop civil servants will be able to collaborate better. It is not clear why they cannot collaborate now. Don't they all have e-mail and a phone? What 'collaboration' and 'better' means in this context is never defined so it's kind of hard to verify this claim.

2. By implementing a mono-culture of Gold PC's the cost of systems maintenance and administration will be reduced to a level that will compensate the cost of procuring and implementing them in the first place. Not that this claim requires a detailed understanding of the existing level of cost.

MPs I work with will be seeking freedom-of-information acces to all relevant documents pertaining to this project from 2006 onwards. I'm looking forward to being proven wrong but I'm not holding my breath.

7-year olds get school laptops... in Peru

Wouldn't it be great for education if all school kids had their own laptops? Well, in Peru this is happening. And in Uruguay, Mongolia, Libya and Ethiopia. The laptops are designed and developed by a non-profit foundation called One Laptop Per Child (OLPC) started by Nicolas Negroponte, formerly of the MIT Medialab.

The OLPC is a technical miracle. It was in fact considered impossible by all the major commercial manufacturers and software builders like Intel, Dell, IBM and Microsoft. That did not hold back the OLPC team though and they build something not only affordable ($150-$180) but also rugged, maintainable and very, very eco-friendly. My Mac laptop eats 30-80 watts, the OLPC does 1-2 watt. That matters when your primary source of electricity is a $10 solar panel. If the world switched to OLPC's from their current systems the savings on power cost (even excluding the environmental cost!) would be sufficient to buy 50 million OLPC's per year for the third world.

On the software side the OLPC foundation chose to use open source software wherever possible, both to keep the cost to their clients as close to zero as possible but also to allow local communities to adapt the software to their needs, wishes, languages and cultural conventions. All the specifications of the laptop (both hard- and software are available for public scrutiny and improvement from the OLPC wiki. This guarantees the independence of nations basing their education on OLPC devices, they will remain in control over the content and methods of education because they have full control over the technology.

But the technical brilliance is not the most important part of the story. The way digital teaching aids allow for new ways of disseminating knowledge is. When every student has a networked digital device that can store and display digital information, schoolbooks can be fully digitized. That gives opportunities to free the ownership of the information in them from the classic model of big publishers that exert control over what goes in the books. A schoolbook is then just a part of a wiki-type system where teachers, experts and other interested parties can collaborate on educational materials that is then shared freely with the world. Some of these contributers may be financially rewarded for such work in the same way we now financially reward publishers. The output however would belong to all of us and we would not have to buy the same knowledge over and over again.I've written more about this here.

The interesting question for western countries is whether they will lag behind places like Peru and Mongolia in modern education. Western European countries typically spend 150-300 euros per child per year on schoolbooks so there's no question that the budget is there. It just needs to be spent slightly differently.

Much has been made of the fact that teachers would not be able to handle the technology. But teachers don't teach kids these laptops, they mostly teach each other. But don't take my word for it. Listen to the 9-year old expert:

Some interesting ideas from Robert X Cringley on the future of education if all kids have full access to online information resources. As often with these type of articles there are as many good ideas in the comments as in the article itself