Arjen's blog

Xeroxing the war

In 1969, when the Vietnam War was in full swing,  a senior analyst at the U.S. Department of Defense was quietly copying a secret report about the war. This report, which ran to 7000 pages, covered the progress of the Vietnam war in exhaustive detail. The analyst intended to share this highly classified information with influential politicians and scientists, in the hope that it would quickly bring the war to an end.

That analyst was Daniel Ellsberg, a former officer of the Marine Corps who worked for RAND, the Pentagon think tank. As a result of his experiences in Vietnam and his meetings with conscientious objectors in the US, he became convinced that the war was wrong. With his insider's knowledge, he already knew that it was militarily lost, but that the American government was misleading the people. Every day the Vietnam war took about eight hundred Vietnamese lives, more than two thirds of them civilians, and twenty American soldiers. Many more were seriously injured or maimed for life..

On June 13, 1971 The New York Times tried to publish a number of excerpts from these documents, but was blocked by the Nixon government through legal and political means. Senator Mike Gravel made a breakthrough by reading a large part of the document in the Senate. The reading of 4100 pages took a while, but the rules of the Senate do not allow a senator who is talking to be interrupted (the "filibuster"). Everything the Senator said automatically became part of the proceedings of the Senate and thus on the public record. The publication of this information was the beginning of the end of the Vietnam war and the start the process of withdrawal of U.S. troops.

Fast forward to 2010. The US is once again embroiled in unwinnable wars, launched on dubious grounds, that continue indefinitely without any clear strategy or goal. Every extra day that these wars continue, more civilians and soldiers die.

And now there are new people who leak secret information about the wars, in the hope that the resulting political pressure will bring them to a close. The Xerox technology in 1969 has been replaced by a global computer network that uses encryption to protect the identity of the whistleblowers. Even Wikileaks does not know their identities – this is safer for both the whistleblowers and Wikileaks.

But the media's response is simply surreal. The bulk of the attention and the debate is about the Xerox machine – or at least the 21st century equivalent of it, the Wikileaks website. Questions such as "is WikiLeaks journalism?" and "should you be allowed to leak classified information?" are discussed in exhaustive detail by apparently intelligent media pundits – who with alarming regularity seem to have little understanding of the very technology they are discussing.

The first 'big' coup from Wikileaks, the “Collatoral Murder" video, led to a huge debate about the culpability of the helicopter pilots and whether or not it was reasonable for them to be able to distinguish between a camera and a grenade launcher. The key topic that was not discussed was the simple fact that the Pentagon had knowingly, for three years, lied to both Reuters and the families of the civilian casualties in Baghdad about the circumstances surrounding the shooting by an Apache helicopter, which was one kilometre away and which riddled two children with bullets from its cannon. The Pentagon made a statement in 2007 saying that it knew nothing of any injuries to children, even though it had been in possession of this video from day one and it leaves nothing to the imagination.

The deliberate lying from the start of the Iraq war continues to this day. The Dutch late night talk show, P&W, led the news on TV with "Dutchman involved in leaking attack video": that, after all, is news - apparently far more important than the fact that children were shot and there was a cover-up.

Wikileaks has already been the top story in the news for more than one week, and that's a problem. The Xerox machine is not important. Illegal wars of aggression launched on the basis of lies are important. The torture of innocent citizens in secret prisons is important. Spying on UN diplomats is important. Messing about in the internal political decisions of other countries is important.

So why is the entire media is so busy with the Xerox machine and the person with his finger on the copy button? Dear journalists, you have been presented with a cornucopia of scoops, many of which make Watergate pale into insignifcance. If African dictators were doing the things Western countries are being accused of, they would be dragged in handcuffs to the International Court in The Hague. Get to work!

Parliament's questions to the Court of Audit

Preamble
The Lower House of the Dutch Parliament has asked the Court of Audit to investigate the problems and opportunities related to the adoption of open standards and open source software for the government's information systems. The Court has opened a LinkedIn group to collect opinions from experts. This blog post is my contribution.

The questions are being asked to the highest supervisory body of the country, rather than the departments responsible for implementing this policy - the Ministries of Home Affairs, and also Economic Affairs, Agriculture & Innovation - eight years after the government's first unanimous vote on this issue and the expenditure of about 5 billion euros on licensing fees. The impression given to the outside world is that Parliament is not impressed with the progress of the last eight years and believes that the relevant government departments could benefit from the external scrutiny of a neutral and objective body.

Each of the following five questions implies a series of unspoken assumptions. In order to answer the questions, it is necessary to identify and, where neccesary, challenge these underlying assumptions in order to reach a sensible answer.

The five questions
Here are the answers to the questions raised by Parliament. There is so much interdependence that subsequent responses will sometimes refer back to earlier parts.

“You cannot solve a problem with the same thinking that created it”

1.What possibilities and scenarios exist for the reduction of closed standards and the introduction of open source software by the central government (ministries and related agencies) and local authorities?

The Netherlands is a modern western country and has the same access to knowledge, skills, technology and comparable budgets for IT as Germany, France, Spain and Finland. It is a fact that all these countries have already implemented large-scale adoptions of open source and open standards in government. The implementation requirements of the Dutch government are also very similar to these countries. The reason that The Netherlands has not moved further in this area, eight years after the original, unanimous Parliamentary vote, can therefore be attributed to nothing more than the administrative culture and our Atlanticist political orientation.

There is no fundamental reason why the achievements of these other countries cannot be replicated in The Netherlands, especially as the  groundwork has already been done. Barriers to migration have often been treated as immutable laws of nature rather than just a problem to be solved.

• Parliament should no longer accept that a high dependence on one supplier is an adequate excuse not to move away from that very dependency (as the Cabinet did in response to parliamentary questions in 2004 and 2006 and 2008). The dependency itself is the problem that must be addressed, not an enshrined principle that IT departments must endure.
• Parliament should no longer accept that the acknowledged lack of technical or organisational knowledge amongst the 60,000 government IT professionals (and their suppliers) is an excuse for the lack of progress. It is implausible that the Dutch government is incapable of replicating the successful work of its European counterparts. Any governmental IT or management staff who do not have the requisite skills to carry out the very reasonable requests of Parliament should be replaced or retrained. Incompetence is grounds for dismissal, certainly not an excuse for refusal to do the necessary work.
• Intrinsic motivation works better than coercion. Administrators and IT staff who understand the wishes of Parliament can embrace it with real conviction and are likely to want to produce better results than those who only work under duress.  Such an approach will select and promote suitable people to the right jobs. The staff whose policies and  behaviour have caused our current problems are probably not going to the ones who find the necessary solutions.
• The link between HR and remuneration policies for IT professionals and achieving technical certification related to proprietary software from a handful of suppliers must be completely severed.

“When you find yourself in a hole, stop digging”

2. What part of closed standards and software can be replaced by open standards and open source solutions and what cannot?

This question has yet another unspoken assumption: that central government has a realistic oversight of all systems, applications and related standards. As a result, questions about the number of systems that can be replaced are very hard to answer and have little relevance to achieving lower costs and greater independence in the foreseeable future – primarily because of the very large differences in costs that are associated with different standards. The government would do well to focus on the most common, generic issues, for which proven alternatives already exist. The original 2002 Vendrik Parliamentary motion already asked for this.

Key points to identify: what are the most expensive closed source areas where functional open source alternatives already exist and are already being used successfully elsewhere? What are the closest functioning areas that can result in successful migrations?

Migration plans should be drawn up in these areas as a matter of high priority – and this means halting or delaying other projects that may block these migrations and accelerating projects that play a supporting role.

For instance, in 2005 the former Ministry of Economic Affairs produced a document management system which has made it virtually impossible for years for the Ministry to use other web browsers, word processors or desktop operating systems. This is particularly surprising as, in 2004, the government itself announced that such closed systems in the work environement were harmful and undesirable, and were therefore going to be actively addressed as per the wishes of Parliament.

A current, concrete example within national government is the introduction of SharePoint. There is a significant risk that this investment, once made, will be (ab)used yet again as an excuse not to migrate to open and available alternatives. That would take us up to 2016 (14 years after the initial Parliamentary decision!) before any real work could begin on migration.

“Not everything that can be counted counts, and not everything that counts can be counted.”

3.What are the current costs? What are the predicted up-front and structural costs costs of moving from closed standards and the introduction of open source software? What are the projected savings?

The Dutch government currently spends about one billion Euros on proprietary software licences annually.  These licences are mainly foreign, and the income tax and VAT on this expenditure flows into the Irish exchequer, because most European branches of American software companies are based there. The total Dutch expenditure is eight times more. Both governmental and general expenses grow by about 10% per annum and are therefore unsustainable.

A significant portion of these annual costs can be saved or ploughed back into the local economy through Dutch SMEs, and so this cost will be an investment in the Dutch knowledge economy. With the government as the leading customer in this new market structure, it is feasible that The Netherlands could save billions per year.

In addition to these direct costs, various indirect savings could increase this amount many times over: the costs of management and security for vulnerable mono-cultures; the cost of merging old legacy systems and new applications; and social costs caused by security failures and easily avoidable software security problems. Every month there are Dutch hospitals whose primary processes are severely disrupted by computer viruses - a direct result of monoculture.

Moving beyond the financial, it becomes more difficult to quantify the social impact of the high dependency level of Dutch society on certain foreign, privately-owned companies.  However, if more than 80% of the PCs in The Netherlands can be remotely controlled or even switched off, what does that say about Dutch national sovereignty? Is it politically acceptable for foreign software suppliers or government bodies to have an On/Off switch for ministries, municipalities, police, hospitals, water works, supermarkets, schools etc...?

“The best moment to plant a tree is 25 years ago, the next best moment is now.”

4.How would the reduction of closed standards and the introduction of open source software be realised?

With not only the right mandate (which Parliament actually voted for eight years ago!), but also the right expertise significant results are attainable within 24-36 months. This requires making this area a priority issue and a break from the old attitudes, excuses and methodologies of recent years (see answer to question 1). Successes abroad can serve as templates for our projects.

One area where we could make a rapid start would be primary education. Currently we are actively strengthening existing monopolies via this sector with public money. If by 2011/12 the first two years of primary school use open systems and then a higher class is switched each year, The Netherlands will have the first generation of citizens who are trained in vendor-neutral systems entering the workforce in 12 years, easily capable of working with multiple systems and applications. De 'Rosa Boekdrukker' primary school in Amsterdam clearly shows how this can be done.

Dutch hospitals in The Netherlands could follow the example of the Antonius Hospital in Nieuwegein.  Many other hospitals can share in this success.   And because it's already been shown to work, the risks and costs for the next 100 hospitals are much lower.

It will take at least a decade before the full potential of open source and open standards can be utilised.

“Go out on the limb, that's where the fruit is”

5. Beyond the cost, what other advantages, disadvantages, risks and opportunities should the Court of Audit factor in? What conditions must be met to make possible the implementation of open standards and open source software?

Benefits & Opportunities

• Savings of billions per year in direct costs for all citizens and IT-using organisations in The Netherlands.
• Redirecting a stream of funds from Ireland / USA into Dutch society as a huge and permanent investment in our knowledge economy.
• Government investment in software will result in free, reusable software and knowledge available to our whole society, rather than controlled by privately-owned and usually foreign companies.
• Security is strengthened through greater diversity of IT, competition, and the possibility of custom code audits.
• National sovereignty is reinforced when the government has complete control over its systems.
• General IT competence will dramatically improve, ensuring fewer spectacular and expensive failures such as the 2006 'Walvis' Tax project, national medical records, public transit chip cards and, most recently, the new police system to name but a few.

Disadvantages and risks

• The current, fragmented IT policy of the Dutch government means that a thousand little fiefdoms may need to be broken up.
• The apparent lack of skills amongst IT management may have consequences for personnel. No doubt there will be resistance.
• Significant investment is probably needed in re-training government IT professionals.
• Angry phone calls from Washington DC when the flow of licensing money is shut off.

Preconditions

• See answers to question 1.
• Be realistic about the positioning and motivation of software companies. Companies seek to maximise profits, control markets and will therefore exploit any leeway that the government offers them. We do not invite the turkey to discuss the Christmas dinner. Therefore why do we accept “advice” from software companies and their interest groups about the best software strategy?
• We need to break away from the idea that  extensive outsourcing is necessary, effective or desirable. The raison d'etre of government is to justly serve the legitimate needs of its citizens; it should therefore have detailed and inherent control over information systems. Stop the corporate-speak and 'playing business' by civil servants. Government is not a business, nor should it pretend to be. Outsourcing the control of information processing systems is contrary to the very principles of a democratic state for exactly the same reasons that outsourcing the military forces or the judiciary would be.
• Make a clear distinction between political and administrative goals and the means of achieving them. Cutting costs can be realised in many ways, regaining national sovereignty in only one.
• As long as desktop projects implemented under the guise of “efficiency through economy-of-scale” result in each desktop costing 6600,- Euros per annum, this kind of bullshit-bingo is completely risible. Keep IT managers and other decision makers who don't know the difference between desktop-standards and a "standard-desktop" away from such projects.

Cloud computing, from the frying pan into the fire

In a recent column (Dutch), Frank Benneker of Amsterdam University explored the consequences of the rapidly growing use of cloud computing. The shift of computer applications from PCs and servers to a single "service" provided through a worldwide network is probably as fundamental a shift as the earlier one from mainframe computing to PCs.

Given the objectives of the Dutch Open standards and interoperability policy plan, cloud computing seems the quick and easy-to-implement solution: I hear Web 2.0 enthusiasts say “put everything on Google Docs and we are all interoperable”. But just as in the case of the "liberation" of PCs from mainframe managers/suppliers, there are problems with cloud computing – potential snakes in the grass.

In December 2004 the Dutch government decided that the dependency on dominant software providers was a problem and had to be addressed. The Dutch action plan from 2007 was the first, tentative step in dealing with this.

The Dutch government wants to use open standards for interoperability, and open source to foster independence, lower costs and strengthen local development (services instead of licences). Open standards are fundamentally essential for interoperability. The Dutch 'standard' government desktop plan demonstrates to governments that interoperability can also be achieved with an imposed, top-down mono-culture. Give everyone the same software, and information can be conveniently exchanged.

However, the price of a mono-culture is high, both directly in money and in less quantifiable aspects such as security problems and an extreme dependence on a few foreign private companies. The latter is especially difficult to reconcile with the idea of a sovereign nation and a government that is democratically accountable. Surely our governments would wish to avoid relying on foreign companies to control the connectivity of our information databases in some nebulous “computer cloud”?

The crucial point is that even in this cloud, the hardware does not belong to the government nor is it possibly even on Dutch soil. The hardware can be located anywhere in the world, and therefore subject to multiple legal regimes beyond the Dutch government's control (or indeed, accountability).

Much of the Web 2.0 knowledge for the Dutch government and discussions about this are held on ning.com servers, and the consensus is that it would be pretty difficult to migrate away from there. Even NOiV, the Dutch open standards and opensource implementation bureau also holds regular discussions on LinkedIn instead of its own XWiki environment. It is only natural that people use what they know. However, bearing in mind not only the objectives of the Policy Document, but also the various Parliamentary Motions on the subject and the earlier decisions of the government itself, cloud computing is a major IT problem. To expect cloud computing to rid us of the issue of  “lock-in” that has been a problem for the last 20 years creates a classic example of 'out of the frying pan; into the fire '.

Our current problems arise from not foreseeing the long-term consequences of our IT choices. We need a separate government IT programme to ensure the freedom of choice that we see as entirely natural in other markets. Unless the cloud computing servers are on Dutch soil and we have access to the code under an open source licence, we shall only go from bad to worse.

The Free Software Foundation has the solution for these problems, a distributed cloud that we can all access. Servers that provide free software designed to guarantee our digital freedom. After all, this is the original intention of the Internet: all equal players in their own cloud.

Cybercrime or the end of scarcity? The future of hacking.

On October 14th The Club of Amsterdam is meeting to discuss 'the future of hacking'.

The term hacking (and hacker) means very different things to different people. Most will associate the term with computer-enabled crime; from Russian mobsters stealing western credit cards to spammers sending billions of unwanted email advertisements for Viagra to Chinese intelligence employees attempting to break into NATO computers. For those calling themselves hacker (or being called hackers by their peers) hacking just refers to the creative use of technology, any technology, to do new and unexpected things.

These two very different meaning of the term continue to cause a lot of confusion in any discussion about it. This piece will expand on both the cybercrime and creative technology uses and see where they meet.

The term cybercrime itself suggests that computer and the networks that connect them are a new phenomenon in the eyes of law-enforcement and the justice ministry. If a crime is enabled by a telephone or car this is not worthy or separate classification. But if a computer or the Internet is involved a crime quickly becomes a 'cybercrime'. A recent BBC item mentions a big case were 45 million credit cards were  stolen. The financial impact of this theft was either not known or not made public. The trouble with evaluating 'cyber'-crime is both the scope of the subject and the lack of hard data. From copyright infringement via credit card fraud to child pornography (more accurately imagery of child-abuse) cybercrime is a field that encompasses a wide range of activities of varying seriousness and with very different levels of impact on the victims. Even more troubling is estimating the effectiveness of law-enforcement do prevent or these crimes or at least bring to justice the perpetrators after the fact. Can this effectiveness be measured and if we can, is it worth logging everyone's e-mail and cellphone communications to capture an unspecified number of thieves? Precisely because we lack clear information on both the scale of the problem and the effectiveness of the measures trying to cope with it  there is no way of telling either way. Frans Kolkman (Head High Tech Crime Unit East-NL) will hopefully enlighten us a bit more.

The much happier side of hacking is all the wonderful things people are doing with technology all over the world, taking it apart and making it do stuff the original designers and producers never imagined. Thanks to intrepid hackers computers have become utterly commoditized and all of us can get connected to the global Internet for 10 euros per month. This democratization of technology has spawned not only entire new industries but also new ways for people to communicate, organize and participate in global affairs whoever en wherever you are. Martijn Aslander (Life hacker) will talk with us about using all these tools to get more out of life.

Before computers became small and cheap people calling themselves hackers were tinkering with all kinds of other hardware. Now computers, sensors and other components have become so cheap hardware hacking is becoming just as democratized as merely using a computer. Alper Çugun will give us an overview of the possibilities and perils of the digital world meeting the real world again.

The first desktop factories, also known as 3D printers, for home use with use-at-home pricing are a reality today and over the next decade they will develop in the same way our commodore 64 developed into smart-phones and laptops. Cheaper and twice as powerful every 18 months. If we can all print our consumer goods at home, will anyone even want to steal anything? Of course someone will figure out a way to print an AK-47 (just for fun mind you!) and then things will get really interesting.

Everyone having aces to technology has both benefits and problems; from youtube and wikileaks as new global media to road-side bombs detonated by cheap mobile phones and surveillance possibilities the Stasi could only dream of. In a world re-defined by technology everybody needs to become a little bit techno-literate. Ignorance of new possibilities will mean losing out on great opportunities for a better life and becoming a victim of those who would use the new tools for criminal or other bad purposes. Hackers might save the world, especially if every citizen adopts the hacker ethic of collaboration, free sharing of knowledge and an anti-authoritarian attitude to keep would-be stasis at bay.

Close the Loop

Now The Pirate Bay is outlawed in the Netherlands - although this ban has yet to be tested in Dutch courts - the copyright industry and its tame lobbyists face a difficult choice: should they take their customers to court or not?

This question is crucial to the survival of the lobby groups. Since the cost of fighting downloading is much higher than income, large entertainment companies constantly need convincing that all these indirect lobby costs will at least produce results in the longer term. Nobody wants to think that the funding of lobby groups is ineffective, even if those organisations claim hundreds of site removals annually.

The entrenching of the battle lines is probably good for providers of innovative services such as proxies that can run your Internet traffic through other countries. There are also more complex and smarter things that experienced Internet users can do to avoid detection. Like the process of  downloading itself, these will become cheaper and more user-friendly in future, so that eventually everybody can use them.

Furthermore, any attempt to tighten online control will make offline sharing more attractive. With terabyte hard disks and 32-gigabyte microSD cards, the bandwidth in your pocket is probably higher than a cable or DSL connection. Technically not much can be done to stop people sharing bits, and the odious behaviour of the industry itself causes any moral objections to evaporate faster than the Greenland ice sheet.

Individuals are now threatened with prosecutions along the lines of the German model (with a 2000 euro fine). But how many of these cases can the already-overworked Prosecution Service realistically process in a year (thanks to other nonsensical bans on certain recreational pharmaceuticals)? Even making a grossly-inflated estimate of 1000 prosecutions a month, that still only results in 24 million euros' worth of fines per annum – and obviously that's only if they win every case, which is highly unlikely.

If the companies in the copyright industry actually take this step and go to legal war with their customers, it will not take long for someone to set up an online cultural solidarity fund. By becoming a contributor to that fund for a couple of euros per month, individuals can rely on specialist legal advice if they become one of the the unfortunate 0.2-0.4% to be sued in any given year. With 1 million members contributing even 2 euros each month, you would quickly have a well-endowed war chest behind you, should you end up in court. Let's make the copyright lawyers work harder for their putative 24 million.

As the case against Ziggo and XS4ALL demonstrated, copyright lawyers don't have nearly as much fun if their opponents fight back with a competent legal team. To gamble untold millions on legal costs to gain a paltry 24 million per annum is a risky strategy. Each lost case costs them money, and when you win you gain more members (and thus a larger fund) to take to the next fight. Eventually it would be quite possible that any money remaining in such a fund could be used to create and promote culture. These works would naturally be released under a Creative Commons licence. Of course, the "Bits-Of-Freedom-XS4ALL-Ziggo” Solidarity Fund for Culture and Creativity (just thinking out loud here!) would not allow the creation of more cultural works to be milked through classical copyright.

If such a fund existed to support cultural initiatives transparently and fairly, I would personally like to pay a bit more than 2 euros per month (say 10 euros). Especially when the de facto result is that I can make unlimited downloads - without having to worry that some copyright lawyers in the Netherlands apparently don't know the difference between copyright infringement and theft (and yet are still employed as lawyers!).

Unlimited, risk-free digital culture for a tenner a month would be enough even for Maecenas - true wealth!

Votingcomputers, the bugs are not the problem

While the use of voting computers in the Netherlands has been banned for over half a year, even for water board elections, there remains a fundamental misunderstanding of the essence of the problem with voting machines.

While the many clumsy security problems (video) or the absence of the source code of the software (in the case of Nedap and SDU voting computers), are an excellent opportunity to develop the topic through the media and in the political agenda, these issues are not core of the problem. And although the voting computer dossier at the Ministry of Home Affairs is now labelled with a bright fluorescent sticker: 'radioactive, do not touch!", there is still a risk that local authorities or suppliers continue to feel that voting by computer is best "if we can just iron out a few little bugs”.

The real objections are more fundamental and have little to do with security bugs or open source code. They are the fundamental principles of the reasons why we have democracy, which the use of voting computers threatens. In the many discussions on mailing lists and web forums it seems that people lose sight of the fundamental principles.

In the first year of operations of the wedonttrustvotingcomputers work group, by government and suppliers that had not been suspicious. The Netherlands is a great country and the suggestion that someone is committing fraud with something so fundamental as ridiculous as the election was done by hand. It was simply unthinkable and further discussion or justification about it was not necessary. This attitude demonstrates a fundamental misunderstanding of the essence of democracy. That is not a question of trust but distrust of organized power.

Through trial and error we have learned over the past few thousand years that power corrupts, and absolute power can corrupt absolutely. An enlightened dictator can be an efficient form of government but how do you ensure they remain enlightened once they have the power?? To solve this problem we have evolved a complex system of temporary mandate (four years), with checks and balances as th need arises. You can only gain power if many people have said that they really want you there, and even then you will be closely monitored by 150 other people who are also only be allowed to do so because of the vote of thousands of fellow citizens. The system is far from perfect and is plagued by inertia and a focus on what is hot in the media, but we have yet to invent something better. This system makes it difficult to take important decisions publicly without authorisation. And a king or president cannot simply on a whim ruin the country or violate the fundamental rights of citizens - unless those citizens and their representatives agree to it by inaction, but then they only have themselves to blame.

The abuse of power cannot be solved by having online the the source code of a voting computer because citizens cannot determine whether the published source code actually runs on the specific voting computers in their neighborhood. Even more important is the fact that 99.99% of the population cannot audit the code. It still comes down again to having confidence in a very small group of technical experts. And having to trust a very small group (any small group whatsoever!) is precisely what we no longer want. If we have small groups of technicians whom we trust, we might as well make up the parliament based on a sample of a research firm. That saves a lot of time and paper and there is probably a good TV night to build around.

It has often been said that paper ballots can also be fraudulent, with the recent election in Zimbabwe cited. The important aspect here is not the possibility of fraud but its detectability. Large-scale, and therefore effective, fraud in a paper voting system is impossible to keep secret and that makes it possible to intervene when small groups try to exploit the system. In most cases, fraud with voting computers is impossible to prove afterwards. The records are then erased and there are no ballot papers available for another recount. This proved once more painful when a local election where the candidate gemeenteraadsid also operator of the voice computer was. In the polling station where he was present he was unlikely many more votes than all other locations in the municipality. Yet no matter OM could get around this potential fraudster to lack of evidence. The man can this lack of evidence but never convincingly prove his innocence. The result is therefore a situation where the integrity of the process itself is called into question, and thus the legitimacy of the ballot. The distinction is thus the detectability of fraud, not the (im)possibility of it.

Voting computers do not solve any major problems, are more expensive to use than paper and undermine the legitimacy of democratic governments. And as Churchill said: "Democracy is the worst form of government, except for all those other forms that have been tried from time to time.'

The Last HOPE

Just finished my talk at the Hope conference about the national Dutch open standards / opensource policyplan. Hope stands for Hackers On Planet Earth and has been a bi-annual event since 1994. HOPE features presentations on a range of (IT) security related topics but also hosts all kinds of techno-creative workshops and lectures on the social relevance of technology. For a full listing see the conference site. Video's of the talks will become available in the future.

Because the mid-town Manhattan hotel just across from Penn station in New York may be demolished next year it is unclear if there will be (a) hope after this one. Because of this, and a certain facination with morbid themes, the conference organisers are calling this 'The Last Hope', refering both to their conference and the state of (digital) civil liberties in the US.

Cnet has the first coverage on the event.

My slides are here in ODF and PDF. For more background links and video see the 24C3 page (Dec 2007 talk in Berlin) and my blogpost about LinuxTag (May 2008 Berlin).

Conservatives want opensource

Conservative party leader David Cameron held a speech at the National Endowment for Science, Technology and the Arts on April 3rd. Aside from the usual criticism (not all undeserved) at the current government he talked about the network society and bottom-up collaboration enable by ubiquitous access to IT. He (or his staffer) had obviously read "Mavericks at Work: Why the Most Original Minds in Business Win" by William C. Taylor and Polly G. Labarre. And a good thing too since it is filled with good examples of how to innovate by sticking your neck out and doing things differently.

About three quarters through the speech Cameron very explicitly stated that his government, if elected, would actively seek a greater use of opensource software and mandate the use of open standards for public IT systems. According to him this will enable faster innovation in the public sector while avoiding repeats of the very expensive NHS disaster.

When things like this are being stated by a conservative the idea has arrived. The other political parties will have to follow suit or be left in the dust by the conservatives. I think these are really good ideas and I know they are practical because I advised the Dutch government on a policy plan (full English translation here) last year that was adopted by parliament last year and is being implemented now. Since the publication of the plan that has been a remarkable change in the relationships between many government institutions and their usual software suppliers. They customer is re-taking power by forming interest groups and re-defining what IT-vendors should actually deliver (instead of just waiting what vendors want to sell them). Norway has a comparable policy and France, Germany Italy and Spain are taking concrete steps too. Below an example of the effects such a policy has had on the quality of healthcare and education in the south of Spain:

More about my work on open standards and opensource here.

A tale of two elections

There were two elections on my news radar the last two weeks. One in an African country now rapidly sinking into an economic crash and possible civil war, the other in the heart of the civilized west; the OOXML election by ISO standards body in Geneva. Aside from the locations and prices of hotels for journalists the differences were few. Bribery, fraud and intimidation were applied to achieve a specific outcome, never mind what the majority wanted. In the OOXML election even the standards organizations of proper democratic countries like Norway and Germany were unable to withstand the well-oiled lobby machine of the worlds most convicted software monopolist. In the Netherlands Microsoft was actually a member of the committee and prevented a committee consensus. So instead of voting against the standards, as 21 out of 22 members wanted, the Netherlands voted 'abstain'. The list of irregularities is endless but try some of the links above to get an idea.

To quote an ISO insider: "“OOXML’s BRM process is irretrievably broken; complete, utter, unadulterated bullshit”" (Tim Bray). The ISO process is dead and that is bad. Even though ISO was far from perfect it's open process did help many nations to agree on thousands of standards on anything from steel manufacturing to surgical gloves. These kinds of standards are crucial for a globalized high tech society.

It would seem that those in favor of the OOXML standard (Microsoft and a few of it's partners) did not have so much confidence that their 6000-page specification would make it to ISO standard status that they trusted a transparent en democratic process to take it's course. There way of treating the process was much like an African dictator with a chest full of medals. Utterly lacking in legitimacy but high on power as a consequence of an unlimited bribery budget and a willingness to bully anyone in the way of their goal. If they were not so much trouble you'd almost feel sorry for them.

Microsoft is of the opinion that everything went fine. Neelie Kroes and the EU have a different view of the matter. I feel another mega-fine around the corner. Not that any of this matters a lot to the fastest growing parts of the world. Brazil, China, India, Iran voted no. They represent a big chunk of the global population (as opposed to yes-voters such as Malta). If I were an applications vendor I'd make sure I stay ODF compatible. Several countries such as the Netherlands and Norway (that is now appealing their stolen vote) have already formally chosen ODF as the document standards for government. Others are looking to follow this lead. It's not entirely clear what Microsoft has achieved by gaining the ISO label. The governments that already choose ODF are not going back and Microsofts well documented behavior is not going to make then many new friends.

The EU appear to have been investigating the OOXML ISO certification process for some time now. Documentation from countries with where very clear breaches of protocol occured will strengthen the case for further antitrust investigations and possible additional fines or other measures. The victory of OOXML may turn out to be very costly indeed. And any credibility of OOXML as an 'open' standard has already been severely damaged by the deluge of reports about bribes, fraud and other forms of misconduct by Microsoft over the last year. A Pyhrric victory if here ever was one.

Desktop mono-culture for the Dutch

The Dutch national government is proceeding with its new implementation of 'GOUD' (Gold), its new plan for a 'standardized desktop' for ministries and other governmental institutions. After the much publicized new Dutch National IT-policy of last autumn this might sound wonderful. It's not.

The problem with the 'standardized desktop' is that it uses very few real standards. Instead it uses products and pretends they are standards. The difference between 'standards' and the idea of 'standards products' is widely misunderstood, often confused and this is where projects such as 'GOUD' go off in troublesome directions.

Standards are things like Open Document Format, HTML (the programming language of web pages), LDAP (a protocol for defining access-control on a network) or TCP/IP (the low-level network protocol of the Internet). What all these things share is that they are not owned by a single entity. They are a formalized form of knowledge about how to achieve certain technical objectives. This knowledge can be used by programmers to build tools that actually do these things for us. This means that there will be many different, competing, implementations of the standards that can inter-operate. This diversity fosters a working market and ups the quality while lowering the price (often down to zero).

'Standard products' on the other hand are, by definition, products and generally owned by private corporations with a profit motive. Standardizing on a product is essentially creating a mono-culture of one type of product, making yourself totally dependent on the vendor of that product. In the case of desktop computers this is extra problematic because there exists a de facto monopoly in this market. Creating a mono-culture in a monopolized market actually re-enforces the monopoly, the exact opposite of the aims of the adopted policy plan.

The Dutch government (or any other for that matter) should not work towards a 'standard desktop' but towards open desktop standards. This is precisely what the Dutch parliament unanimously requested from the government in 2002. Open standards, such as the ones mentioned above, allow computers of many different types and the people using them to communicate.

The Internet is a network of billions of computing devices made by thousands of different vendors and these can all communicate through open standards. Because of this I can e-mail other people without having to know anything about the computer they use. As long as we all agree to adhere to the standards information sharing is possible with a variety of systems and products. Open standards make this possible and should be the cornerstone of any governmental IT-architecture.

I've had many conversations with civil servants on this issue over the years and I conclude from these that the vast majority of them have no conceptual understanding of the difference between (the use of) standards and product mono-culture. In 2005 I was speaking at the Ministry of the Interior to a civil servant who enthusiastically talked about the 'standard' desktop they were developing for the entire government (350.000 desktop in the Netherlands). When I asked him what standards they were using he responded with a list of products: 'this version of an operating system, that version of a word processor', and so on. I tried not to cry. I really did.

In the 'Gold'-documentation (yes, the project name is a gift to punsters) the same way of thinking is pervasive; in order to collaborate, all civil servants need to use the exact same software products. I call bullshit. One of the primary recommendations of a counter-expertise report was to replace product-specific standards by open standards. This would enable interoperability with a variety of systems in the future and thus free the government of its dependence on a single vendor. This remains one of the primary stated goals of the national policy set by the government and applauded by parliament.

I can imagine how 15 years of vendor-lock-in-by-standards would lead people to believe computer systems can only share data if they are all supplied by the same vendor. This is however not a law of nature but a symptom of a badly functioning market. It is a problem to be solved by making a policy plan and sticking to it. The national action plan obliges the government to actively seek solutions to the problems of interoperability by the mandatory use of open standards.

In a letter to parliament the responsible minister for the 'Gold' plan claims two things:

1. With the new 'standard' desktop civil servants will be able to collaborate better. It is not clear why they cannot collaborate now. Don't they all have e-mail and a phone? What 'collaboration' and 'better' means in this context is never defined so it's kind of hard to verify this claim.

2. By implementing a mono-culture of Gold PC's the cost of systems maintenance and administration will be reduced to a level that will compensate the cost of procuring and implementing them in the first place. Not that this claim requires a detailed understanding of the existing level of cost.

MPs I work with will be seeking freedom-of-information acces to all relevant documents pertaining to this project from 2006 onwards. I'm looking forward to being proven wrong but I'm not holding my breath.

Public Transport card fully hacked

What experts foresaw last December and the Dutch research institute TNO denies was possible in their recent report has been done. The deepest level of data-encryption on the NXP Mifare RFID chip has been hacked. Cash from cards can now be copied to other cards through cloning and that makes this system utterly unsuitable for serious applications involving real people and real money.

But this is essentially old news. The more interesting news as far as I'm concerned is the fact that TNO was immediately re-hired by the company implementing the card system to do more research on the validity of the hack. You have to wonder what the thinking is here. This company dropped the ball on at least three separate occasions in this area so why do they get another chance to write a big rapport to claim 'there is no problem' ? And this is not the first time, on the sensitive subject of voting computers (now banned in The Netherlands) they also kept telling us 'all is well'.

If you merely want a paper to reassure yourself just ask the secretary to print out a pretty picture from the Interweb with a caption that says 'everything will be ok'. That's a lot cheaper then hiring a company like TNO, and apparently just as valid.

Does TNO just write down whatever the customer asks of them or do they really not know any better? Either alternative is troublesome. As an important expert-adviser to the governments we should hold TNO to a higher standard. When faced with an impossible request from a client they should respectfully decline the job explain that the client's request is either technically impossible or not in line with laws concerning citizen privacy and such.

Our government (and parliament!) allowing such organizations to indirectly guide technology policy is a real problem that will continue to cost us dearly (in real money, privacy violations, theft and missed technology opportunities).

Next up for big IT-projects is a road-toll system that should allow for more flexible costs of (pay-as-you-go) owning and using a car. Hopefully it won't be as insecure as this project, that could be expensive for government or the citizen (or both).

Tomorrow there will be a meeting in parliament on this matter. The independent experts (the ones that got it right from day 1) have decided to boycott this meeting since they are not allowed access to the 'secret' paragraph of the most recent TNO rapport. They wisely refuse to legitimize more 'security-by-obscurity' bullshit.