Arjen's blog

Trainspotting

Trying to get back home to Düsseldorf on last Monday evening we made sure to be in Utrecht well before the scheduled departure time of our international high-speed train. We had reserved seats and ticket upgrades to first class so all was set for a comfy journey home to our cat. Now all we needed was the train. And that's where everything went pear shaped...

At our arrival at Utrecht station I noticed on the big board the ICE train from Frankfurt to Amsterdam had come in over 1 hour late. Since this is the train that goes back the same way through Utrecht I feared a delay. But none was reported. Our train was still scheduled for 18:59 as planned. So we grabbed a warming drink and went down to the platform at ten to seven accompanied by a cheery annoucer telling us our train was arriving immently as scheduled.

At 18:57 the information board on the platform suddenly turned and now told us there was a 30 min delay. Suddenly the cold felt a lot colder knowing we would be in it for at least another 30 minutes.

The information board kept saying the next train was the ICE to Frankfurt even though now other trains to local Dutch destinations were arriving on the platform. This caused enormous confusions both with passengers for the scheduled train and the trains that were actually there. So passengers were at the right platform at the right time and the train they wanted (to Nijmegen) was there but the information board said it was going to Frankfurt so not everyone got on. A group of friends got separated because some of them were trying to get accurate information from a conductor on the platform while others already boarded. Suddenly the doors closed and refused to open again. A minute after that the train left.

Here was a train that actually left on time (no small feat apparently!) but without many of its passengers because of misinformation. The other remarkable thing here is the fact that a conductor with a walkie-talkie standing next to the train was not able to communicate the simple message 'stop!' to his colleague driving the train for over 60 seconds. A security situation more akin to third-world countries than Western Europe.

It was a unbelievable mess.

Finally a railway person had the stoic courage to show up and try to help out the almost frozen passengers. But he had only the info his colleagues were giving him and that wasn't much. The train turned out to have a delay of 85 minutes now so we were in for more feet-stamping. At this point my other half was inquiring about hypothermia symptoms involving blackened toes and chisels.

The infuriating thing about this situation is that this delay must have been known by the railway company well before the original departure time of the train. But this information was simply not made available to the passengers or the local staff. This meant those 100 passengers could have been in one of the bars or restaurant in the station over an hour, sipping a hot coco or having a meal instead of freezing their extremities off on a windy platform being serially-disappointed by railway disinformation-boards. This also would have brought extra business to those bars and restaurants. A short text-message would have sufficed.

Just how infuriatingly incompetent can an organisation be before its clients break out the pitchforks and torches in a violent bid to replace its management? If I were in a management position at the Dutch rail I would be worried.

With a 90 minute delay a train showed up. But is was not a German high-speed ICE that we planned and paid for. It was a 'classic' Dutch train from the Eisenhower-era that should be in a museum instead of replacing the pride of Deutsche Bahn.

On the platform we met an Asian woman who was trying to get to Berlin but had missed the overnight train because of the ongoing railway disinformation campaign that night. She had gone to the International desk to ask for assistance and the Dutch railway people had printed out some info their Dutch railway planner spat out. Info that was by now wholly unusable because of the 90 minute delay of the alternative train they had advised her. The Dutch railway planner (www.ns.nl) includes some German trains but only those with connections to the Netherlands. Had they used a browser and gone to the Deutsche Bahn site (bahn.de) or put their excellent free app on a phone they could have told her take the right train from Oberhausen to Dortmund where she could catch up with the night train and still make Berlin in time. With a fellow passenger I could figure out a workable route for her and she made the connection.

How is sad it that a passenger on the platform has better real-time information through a free Deutsche Bahn app and twitter (track #ns) than the International desk at the biggest Dutch railway station?

Dutch railway clients are fighting not just price increases, delays and canceled trains but also the vast incompetence of the railway management in making available free tools to their staff to provide what stranded passengers need most: real-time accurate information that will help them find alternative ways of getting to their destinations.

It was only after crossing the border at Emmerich that we could switch to a proper ICE train, stretch out on reclining seats and plug-in our hungry computers.

As a Dutch person I am sorry to say our national railway company has fallen so far behind, that passengers are best off ignoring most of the information provided in the stations and use smart phones or other mobile devices to collect and cross-reference real-time information on train-availability and timing.

Twittering when trains actually leave key stations or when they are running delays could be a great gift to fellow travelers you may never meet. For some reason the fact that we have had these things called 'winters' in North-Western Europe for the last 40 million years has not reached the tiny dinosaur brains of the railway senior management. So as long as those dinosaurs remain in charge we're better off helping each other out in a peer-to-peer, distributed way. Perhaps this will shame the incompetents into action eventually. And if not, then there's always pitchforks and torches.

Carribean opensource

It's been quiet on this blog. A long vacation that was not really a vacation, more on that later.

Last week I was visiting the Dutch Caribbean by invitation of the local government to do the opening keynote (ODF 1 2) on their conference on open standards and opensource. Curacao, one of the islands of the Dutch Antillies is about to become fully independent nation state and that means a lot of re-design of the local IT systems of the government and public sector. The government is determined to maximise the opportunities offered by open standards and opensource software to move the new governemnt, the local educational system and economy forward. For education an OLPC project is being considered because 3 PCs per school is not the way into the 21st century. Hopefully the new Internet Exchange (based on the Dutch one) will bring down the cost of bandwith so that all those OLPC's will be able to go online.

All of this will not be easy to achieve. Curacao is a very small entity to function as an independent nation and do everything themselves. There is a great need for expert knowledge and training to bring local IT-staff and administrators up to speed and the available budgets for this are very limited.Curacao spends about 20 million pounds per year on proprietary software licenses (mostly in government and other public sector), this amounts to about half a month's wages per citizen. If this can be reduced by 30-50% the budget required to make the desired changes is available (assuming the total IT-budgets can be kept at the same level for the time being).

Because this visit also included several meetings with local dignitaries and media appearances I was invited to stay for a whole week in a beautiful apartment west of Willemstad. Many thanks to Ace Suares who has been working for open-IT on his island for many years. He was the driving force behind the whole conference and a wonderful host.

London is your Oyster

The Oystercard is a electronic debit card that has all but replaced tickets on the London tube and bus transport systems. It allows users to put money on the card and discounts this credit as the card is used to enter and exit the underground and buses. The system is fast and unobtrusive and almost everyone who uses London public transport has one. Everyday millions of pounds are being put on these cards and taken of again as Londoners move about their city. The security mechanisms that are supposed to be keeping these millions (your money ultimately!) safe have now been shown to be, frankly, utter crap.

So the Oystercard has been definitely compromised. Its fundamentally broken and needs to be replaced by new technology concepts. Independent experts warned about this back in 2004 so there's no excuses for being all surprised now. Then they warned again in 2005 and last December at the Chaos Computer Club  international IT conference in Berlin. Now the attack on the lackluster security system of the London Oystercard has been practically demonstrated last April by a group of Dutch researchers who were investigating the same technology that was about to be implemented nationally in the Netherlands. "The Oystercard system uses the same chip and has the same basic vulnerabilities" according to Professor Bart Jacobs of the Computer Science faculty of Nijmegen University.

After the publication of some of the inner workings of the data-encryption mechanism of the chip used in the Oystercard last December in Berlin, a fully operational breach was predicted by many experts. With the basic knowledge of the inner workings of the chip available online for anyone to see, implementing a working attack against the system was just a matter of time. The Dutch research group has been able to clone the funds on an Oystercard to another Oystercard. This provides at-home top-up mechanism allowing essentially free travel in the greater London area after an initial investment of 10 pounds plus a few blank Oystercards at 3 pounds each. Since the required devices and software are otherwise pretty much free today or in the near future (at most a few months from now), the London Transport Authority needs to get moving on this or accept that they will be providing free travel for those capable of using a laptop and a high-end mobile phone (and all their friends).

The systems failure bears all the classical hallmarks of public-sector IT screw-ups. Basing your security mechanism on trying to keep the inner workings of such a system a secret while at the same time distributing 12 million copies of said system into the hands of the public is, frankly, insane. Does anyone think a handful of engineers locked in a room at Philips can come up with a system clever enough so that the combined expertise of 1 billion Internet users cannot defeat it? One has to wonder what they were smoking that day. Then there are bonus points for ignoring repeated warnings from independent experts for several years.

Among security professionals it is considered scripture that the only systems that can be trusted are those that have been tempered in the fire of public scrutiny. No one is as clever as everyone, and with a few million interested specialists online there is nowhere to hide for a system containing design flaws. Flaws are always found sooner or later and most often sooner. One would think that after six decades of spectacular failures the method of keeping a system secure by trying to hide its inner workings (know in the security trade as 'security by obscurity') would be utterly invalidated. The Germans used this method for their supposedly secure communications using the Enigma machine in World War 2. It cost them the battle for the Atlantic and ultimately the war (ok, ok, attacking Russia in August without winter coats for the troops was not a smart move either). More recently a $400 million DVD encryption method was broken by a 16 year old Norwegian hobbyist.

The Dutch system will probably not be implemented in its current form, but the London system is already operational with an estimated 12 million people using the card. For the sake of the financial stability of the tube system one can only hope that clever engineers have already been working on a solution that can be implemented quickly. But I'm not holding my breath.

(earlier post on the Dutch card here - posts in Dutch here)

The Times picked up the story, and has a writeup of the wider security implications (accescards to buildings and such).

Weekend in London

Easyjetted over to London on Friday after finishing my 'Train-the-Trainer' class. The students worked hard on writing responses to two articles in a Dutch E-zine on open source/open standards. While bored on the plane I added my own article (Dutch) to the discussion.

Now working on the Makewarshistory campaign website and talking to journalists on Monday about open source for governments, voting computers and the Mifare RFID hack. Trying to find some free time to spend doing as little as possible with my love Annie.