I wrote a piece on Release Management on my LinkedIn Blog. I talk about the minimum properties of a change control authorisation system, the minimum evidence required before agreement can be issued, the need for emergency change control process, the need for post implementation reviews, treating failures as incidents and applying problem management tools to them, and ensuring that there is an appropriate segregation of duties. …
Elon Musk has taken over twitter; I wrote a short piece on LinkedIn on the deal, its funding, and the technology. Since then some, including the FT (£) have commented on its funding, not the least the bank loans and thus collateral required. The linkedin article has some interesting links commenting on the deal, or at least I think so.
I also like this theory, that it is/was all a big mistake which Musk’s ego cannot permit him to admit,
The first thing Musk did was fire senior managers but the second is to fire half the work force. Advertisers are having second thoughts, based on wild comments made by Musk, not helped by the fact that many of the job cuts are aimed at content moderation teams and that programmers being let go are those who released the least lines of code, as many have commented, this is unlikely to end well. Another threat to a platform like twitter is that of regulatory intervention; in the UK, the Online Harms Bill is going through Parliament and the EU will also legislate on fake information and cyberbullying. Since politicians are so often the targets of such bad behaviour, there’s little support for Musk’s free speech line. Furthermore, the way in which the ‘reduction in force’ is being conducted would seem to be in breach of both Californian and UK Law, and both Prospect and GMB have commented on the UK downsizings, and in Europe, I wonder if twitter has established a European Workers Council.
Many of twitters users are talking of leaving but as Maria Farrel comments, on Crooked Timber,
There are now tens of thousands of journalists, policymakers, academics and various other thought-leader types who viscerally get what it is to be trapped inside a monopolistic tech platform, and for it to be costly and painful to leave.
Maria Farrel
Richard Murphy and the ORG (and others) are asking questions about the private ownership of the digital world’s town square. The ORG and most others point at mastodon as an alternative, which is designed as impossible to capture.
What users need is pretty clear. They need greater control over what content they receive, how it is prioritised and how it is presented. The way this is done, in a digital world, is to create more “open” systems that allow third parties to repurpose, filter and represent content in ways that users want. This can and should include better ways to moderate content.
The Open Rights Group
The social networking system lock-in, is the audience and social graph. It’s not been possible, without coding skills to extract the social graph or even the message feed from twitter for a while and linkedin now require one to know the email address of your proposed new linkedin correspondent. i.e. I am looking at transferring my tweet followers to linkedin so that I have a means of contacting them if they decide to quit twitter. In terms of personal twitter hygiene I have been using tweet delete to remove old and unwanted tweets and likes. I have a mastodon account on mastodon.social, but don’t read it every day and neither the big news sites nor my preferred commentators are there. (I may change my habits, the quality of my mastodon home feed is immeasurably better today, than it was last week.) I should add that my mastodon postings have been more dilatory and personal than those on twitter, and of course, many of my twitter posts are retweets, probably more than posts which may make twitter easier to leave. For those worrying about the complexity of federation, or the fediverse, don’t worry, these are for developers and service engineers.
One user response already in progress is to adopt alternative short messaging products, mastodon is the obvious choice; another response for content authors would be to return to blogging, and encourage people to use a feed reader such as feedly! At least then their readers can get the content as they choose. , and some excessively long threads don’t get read.
For my European readers, although if reading my blogs, they don’t need the help,
Ich frage mich, ob Twitter einen Europäischen Betriebsrat hat
Mi chiedo se Tweitter abbia un Consiglio europeo dei lavoratori
Je me demande si Twitter a un comité d'entreprise européen
…
As part of the ‘drains up’ undertaken after the 2019 General Election, a coalition calling itself Labour Together undertook a review of what went wrong and as part of that review commissioned an organisation called the "common knowledge co-op" to look at Labour’s IT and its management. They produced a report called “System update required”. (original | mirror ) What did it say? I think this is important, but like so many learning opportunities that challenge power and the bad behaviour of the powerful it seems to me to be dramatically under-valued.
When I first read it, I was outraged. I hoped to summarise it in a sensationalist fashion to see if I could interest someone who might pick it and make things better. What I have written is not that exciting and I suspect little will change because the Party doesn’t have the knowledge and experience and today is led by people who care more about their control and position within the Party than they do in winning an election and becoming a government. I mean they’d be happy to be in Government but it’s more important to them that they control the Party.
In summary, the report says, portfolio management was unacceptably poor and not accountable to the highest levels of management although they too didn’t have clue. There weren’t enough IT staff and the more numerous IT management layer wasn’t good enough. The report makes no mention of ‘requirements management’, nor of any benefits analysis tools to allow an understanding the effectiveness of the software applications provided. Labour’s voter ID/GOTV software is no longer the best. Local adoption of the IT tools is low, partly because of poor commitment to training, partly due to a high turnover of local activists and partly because the Labour machine didn’t care.
In the rest of the article, overleaf, these failings are explored in more detail. ...
I found some old notes on classifying and evaluating risk and have put them on my LinkedIn blog. How does one work out the importance and value of a risk and how much to spend on mitigation. Some of this article repeats what was said in the previous article. …
I wrote a note on information systems programme evaluation and management on my linkedin blog. It considers business value vs reliance and observes that this technique permits the management of software products to have different governance policies, that measuring competitive advantage is hard, that IT strategy must be aware of business strategy which will drive the build vs. buy decision together with other project management decisions. Importantly it decries the practice of buying and adapting a software package. These ideas were first taught to me by Dan Remenyi. …
The Labour Party can’t issue the ballots for their internal elections; they claim it’s a consequence of the cyber-breach last October.
The Party seems to have attempted to create a replacement membership database by updating its mail manager system and presumably adjusting the feeds although much of the functionality previously offered is no longer available and the feed from the financial system is now days or weeks out of date. We should note that the membership self administration tool is also now not available. The mail manager is obviously from observation slowly dying. It is known to be inaccurate; there are errors in terms of who it considers to be a member, their addresses, and their payment status.
The Party plans to replace this recovered system with an off the shelf package[1] from Microsoft. At the moment we are advised that it is unlikely that local party role holders will get access to this until next year.
Until then we have to use a known to be inaccurate database. From observing, presumably NEC authorised actions, it seems to be considered accurate enough to select councillor candidates and run trigger ballots. Procedure Secretaries have been told that they may not override the membership system even when variances are well known and provable. I question that this is legal in it breaches the duty to be accurate and not to automatically profile people.
What seems to be forgotten that is data protection rests on seven principles, Lawfulness, fairness and transparency · Purpose limitation · Data minimisation · Accuracy · Storage limitation · Integrity and confidentiality. Often too much or too little attention is paid to integrity and confidentiality and issues such as lawfulness, fairness, transparency and accuracy are forgotten.
They are running selections and triggers on data known to be inaccurate. This isn’t right.
This has taken 9 months to get here. While culpability for the breach may be questionable, not having a recovery plan and or not funding it is the fault of the Labour Party and thus its NEC. CEO’s have been fired for less.
Why was there no recovery plan? Did they do vendor due diligence on the member centre hosting provider, did they keep it up to date? Is there a risk register? Has the NEC or the risk committee approved the mitigations? In fact, what is the NEC doing about IT Risk? Is there a DPIA on reusing the mail system? Is there a DPIA on reusing the SAR Tool? Is there a DPIA on using the social media scanners they use? When will we get a data protection capability that protects members data from bad actors rather than from themselves?
Nine months failing to recover is shameful and unprofessional. NEC members should be asking why it has come to this and determine if they, through their inaction, are in fact culpable.
[1] This I consider to be wise, although they will need additional software modules to support Labour’s unique processes, such as donation monitoring. Although it seems they plan to customise the UI 🙁 …
Data Protection Officers roles were revised by GDPR and the member state implementations. Here is a reminder for those that need it.
Article 37 states that a processor or controller requires a DPO if it is a public authority, if it requires regular sys systematic monitoring of data subjects on a large scale or if it processes special data.
A DPO may work for multiple companies, but Article 38 requires the DPO to be adequately resourced and supported.
The DPO must be appointed on the basis of professional qualities and, in particular, expert knowledge of data protection law and practices and the ability to fulfil the tasks specified in the GDPR Article 39.
Article 38 states that the DPO must be involved in in all issues which relate to the protection of personal data, be properly resourced to perform their duties and to maintain their professional expertise, not receive instructions on the conduct of their duties, not be dismissed for doing their job, and report to the highest levels of management.
The tasks of the role are defined in Article 39, the job is to advise the highest levels of management on their obligations, to monitor compliance including the assignment of responsibilities, training and operations’ audits, to assist and monitor the data privacy impact assessments, to cooperate and act as a contact point for the supervisory body, in the UK, the ICO.
I have used the EU text as the source of my summary and is reproduced overleaf/below ...
This post was originally posted at linkedin.
When evaluating Data Protection laws and enforcement appetite, one sometimes needs to refer to the 7 principles. These were agreed by the OECD in 1980 and I summarise them below.
Europe’s privacy laws are constructed by building legislative infrastructure based on treaties and then the creation of law. This diagram below shows the time line of European infrastructure (above the line) and law (below the line), it was made in a year or so ago and thus does not have the UK’s departure from the EU, nor the assignment of “Adequacy” by the Commission.
While much focus today is on the EU’s GDPR, the principles that underpin it, are more broadly accepted than that law, and in some areas, the GDPR maybe found wanting.
This blog post originally appeared on my LinkedIn blog. …
I posted a note on cyber security on my linkedin blog. I post some pointers on the standards and controls needed to defend against a cyberattack and implement “adequate technical and organisational” protection. It looks and links at the NIST cyber-security framework and lists some of the necesary controls to implement a reasonable defence and prove “adequate technical and organisational” controls. If you do what I suggest badly, you might get away with it, if you do it well, you might stop and or recover from attacks. …
This is interesting. From the Register, an article called, “Software piracy pushes companies to be more competitive, study claims • The Register“, sub-titled, irreverently as ever, “So, do copy that floppy?”
The article is written by, Wendy Bradley, assistant professor of strategy, entrepreneurship, and business economics at Southern Methodist University’s Cox School of Business, and Julian Kolev, an economist at the United States Patent and Trademark Office. The article describes their methodology, and links to their paper. They define the launching of Bittorent as a shock and examine the intellectual property development of vulnerable companies to that shock.
“When comparing the IP strategies of software firms at risk of piracy (the treatment group) against those of not-at-risk firms (the control group), we find that our treatment group significantly increases its innovative activity after the piracy shock in terms of R&D expenditures and granted copyright, trademark, and patent applications,”
Bradley & Kolev – Software Piracy and IP Management Practices: Strategic Responses to Product-Market Imitation (August 2021)
Interestingly it seems, that Entertainment software companies behave differently. although the academic work done, as quoted in the article does not suggest that piracy reduces the supply of content.
Basically the big software firms use their superior cost structures, achieved by size and source code ownership to increase the rate of innovation to keep their customers coming to them. The entertainment companies don’t. I don’t think they look at the size and cost of investment into regulatory barriers to entry, both buying the laws they want, and pursuing newly created malefactors.
Bradley, Wendy and Kolev, Julian, Software Piracy and IP Management Practices: Strategic Responses to Product-Market Imitation (August 2021). USPTO Economic Working Paper No. 2021-3, Available at SSRN: https://ssrn.com/abstract=3912074 or http://dx.doi.org/10.2139/ssrn.3912074 …