Software and systems need to start being designed with privacy in mind.  I attended an interesting meeting the other week which had a talk from Claudia Diaz who is an Assistant Professor from COSIC looking at Privacy Enhancing Technologies (slide here).  She talked about ‘Soft Privacy’ where we have to ‘trust’ the holder of our data to protect our privacy, and ‘Hard Privacy’ where we should be providing as little data as possible and use Privacy Enhancing Technologies to protect that data.

This concept is not new, we have been using ‘Privacy Enhancing Technologies’ for hundreds of years.  For example in the UK when you come to vote, if there is anything written on the ballot paper (ie a signature) it is invalid, and the vote is made behind a screen.  Why?  Because if I am trying to rig an election and I am paying £100 per vote, or threatening people with violence, I would like to check which people voted for me.  The ‘laws and regulations’ give citizens protection by outlawing vote rigging (soft privacy). But by not allowing any identifying marks on the ballot paper or sight of me completing the ballot paper itself I am protecting peoples privacy (Hard Privacy) even if the legal protection is compromised.

As it was put across in the talk – ‘I can trust you because I do not have to’.  If I had to sign the ballot paper I would have to have trust that someone did not abuse the system and inform people of how I voted – which could have recriminations for me.  By not signing the paper and not having to show anyone how I voted, I can trust the system because I do not have to – they cannot inform people of how I voted.

When we design IT systems we need to ensure the same protections are in place.  Don't assume that it is only in scenarios such as voting where we need to protect privacy - Insurers use social networking sites to identify risky clients.  And don't assume that you cannot get the technology either – www.microsoft.com/U-Prove

In my post Insurers use social networking sites to identify risky clients last week I mentioned that NHS Choices was using a Facebook ‘Like’ button on its pages and this potentially allows Facebook to track what its users were doing on the site.  I have been reading a couple of posts on ‘Mischa’s ramblings on the interweb’ who unearthed this issue here and here and digging into this a bit further to see for myself, and to be honest I really did not realise how invasive these social widgets can be.

Many services that government and public sector organisations offer are sensitive and personal. When browsing through public sector web portals I do not expect that other organisations are going to be able to track my visit – especially organisations such as Facebook which I use to interact with friends, family and colleagues.

This issue has now been raised by Tom Watson MP, and the response from the Department of Health on this issue of Facebook is:

“Facebook capturing data from sites like NHS Choices is a result of Facebook’s own system. When users sign up to Facebook they agree Facebook can gather information on their web use. NHS Choices privacy policy, which is on the homepage of the site, makes this clear.”

"We advise that people log out of Facebook properly, not just close the window, to ensure no inadvertent data transfer.”

I think this response is wrong on a number of different levels.  Firstly at a personal level, when I browse the UK National Health Service web portal to read about health conditions I do not expect them to allow other companies to track that visit; I don't really care what anybody's privacy policy states, I don't expect the NHS to allow Facebook to track my browsing habits on the NHS web site.

Secondly, I would suggest that the statement “Facebook capturing data from sites like NHS Choices is a result of Facebook’s own system” is wrong.  Facebook being able to capture data from sites like NHS Choices is a result of NHS Choices adding Facebook's functionality to their site.

Finally, I don't believe that the "We advise that people log out of Facebook properly, not just close the window, to ensure no inadvertent data transfer.” is technically correct.

(Sorry to non-technical users but it is about to a bit techy…)

I created a clean Virtual Machine and installed HTTPWatch so I could see the traffic in my browser when I load an NHS Choices page.  This machine has never been to Facebook, and definitely never logged into it.  When I visit the NHS Choices page on bowel cancer the following call is made to Facebook:

https://www.facebook.com/plugins/like.php?href=http%3A%2F%2Fwww.nhs.uk%2fconditions%2fcancer-of-the-colon-rectum-or-bowel%2fpages%2fintroduction.aspx&layout=button_count&show_faces=true&width=450&action=like&colorscheme=light&height=21

So Facebook knows someone has gone to the above page, but does not know who.

Now go Facebook and log-in without ticking the ‘Keep logged in’ checkbox and the following cookie is deposited on my machine with the following 2 fields in it: (added xxxxxxxx to mask the my unique id)

• datr: s07-TP6GxxxxxxxxkOOWvveg
• lu: RgfhxpMiJ4xxxxxxxxWqW9lQ

If I now close my browser and go back to Facebook, it does not log me in - but it knows who I am as my email address is pre-filled.

Now head over back to https://www.nhs.uk/conditions/cancer-of-the-colon-rectum-or-bowel/pages/introduction.aspx and when the Facebook page is contacted the cookie is sent to them with the data:

• datr: s07-TP6GxxxxxxxxkOOWvveg
• lu: RgfhxpMiJ4xxxxxxxxWqW9lQ

So even if I am not logged into Facebook, and even if I do not click on the ‘Like’ button, the NHS Choices site is allowing Facebook to track me.

Sorry, I don't think that is acceptable.

The Wall Street Journal ran an article a few weeks back that made my eyebrows rise…

Insurers have long used blood and urine tests to assess people's health—a costly process. Today, however, data-gathering companies have such extensive files on most U.S. consumers—online shopping details, catalog purchases, magazine subscriptions, leisure activities and information from social-networking sites—that some insurers are exploring whether data can reveal nearly as much about a person as a lab analysis of their bodily fluids

Well that could be another incentive to curb what you post on Facebook!  There is even has a nice graphic to illustrate how Deloitte is telling insurers that they can profile people based on their ‘Marketing Data’ – very pretty and rather disturbing…

You then start adding in other snippets of privacy news like ‘NHS Choices allowing Facebook tracking’ and you can see all of this is going to end in tears:

Tom Watson MP, Labour MP West Bromwich East, has written to secretary of State Andrew Lansley, asking him to take steps to remove the tracking code from the NHS Choices Website.

“I write to you to express my concern that the NHS is allowing Google, Facebook, and others to track your https://www.nhs.uk/ browsing habits, regardless of the fact that people use the page to seek medical advice.”

Watson urges the minister to take action and imagine how embarrassed he would be, if as a user of NHS Choices, he searched on an embarrassing condition like genital warts, and the data were made available to third parties.

In the great rush of sites to bring in social web features, they have to be aware that adding a ‘Like’ button to the page will send Facebook (in this case) information about you - even if you do not click it and are not logged into Facebook. (See https://mmt.me.uk/blog/2010/11/21/nhs-and-tracking/ for a more technical analysis).

We need to do better in explaining the potential issues; they are complex and not all the implications of our avid data sharing are yet apparent.

While sensitive data such as emails are generally encrypted before being transmitted, the Chinese government holds a copy of an encryption master key which could be used to break into redirected traffic.

Goodness gracious me ‘encryption master key’; all very secret spy, 007, and all that. However, like James Bond this would be a complete work of fiction…

The challenge for governments is that as they put more systems online, the more vulnerable they are.  Where governments have spent time creating single points of access, authentication and messaging systems for citizens and businesses; they are also creating single points for attack.  Taking down a public accessible system that disrupts tax collection, or stops citizens and businesses from authenticating would cause significant issues for a government.

At an architecture level, we need to look at distributed or disconnected systems.  We need to avoid placing key public facing government assets in monolithic data centres. One of the advantages that governments can gain from moving to the cloud, is this distributed architecture.  It makes it harder to attack.

But then again, what is the point?  China holds the master encryption key for the internet…

German vandals target Street View opt-out homes

German home-owners who have chosen to opt out of Google's Street View service appear to have become the unsuspecting victims of anti-privacy vandals.

Local media report that homes in Essen, west Germany have been pelted with eggs and had 'Google's cool' notices pinned to their doors.

Privacy is a complex issue at the best of times, but I was not expecting this one!

Let me just preface this by saying of all the failure points in your business - you really don't want the door to be locked while you stand behind the counter waiting for business. No, let me rephrase that: you don't want the door jammed shut, completely unopenable while your customers wait outside - irate that you won't let them in.

Nicely put!  The main risk is that if you outsource identity, you better be sure it works otherwise you customers cannot access your site.  Looking at how U-Prove could be used to provide authentication to sites, there are some interesting advantages over the classic federation model

The problem with ‘just in time’

In the classic federation pattern a user is redirected to an identity provider to authenticate to be returned with a SAML token.  This is where the problem highlighted above can occur.  What happens if the Identity Provider is having problems, what happens if it changes something? This problem then hits you.

With U-Prove we can provision the client with tokens that can be re-used independently of the Identity Provider.  We of course have to consider revocation and lifetime if we want to move to long lived tokens rather a just in time pattern, but it provides a nice way to remote the business risk of just in time.

However, what really helped clarify some thoughts on the way home was reading the UK Government CIO, John Suffolk’s blog post from earlier today. To quote him:

‘You can open many papers on any day and you will see references to public sector cuts, downsizing, reform... And they are right. Whether we wanted a burning platform or not, we have one, and I guess we change or burn.’

He is right.  The UK and other governments all around the world are facing a burning platform, they know it, we know it – it is no great surprise.  The ‘real make it or break it’ is going to be how we can get them out of this hole.

Events like the ukgovcamp are absolutely vital, but we need to continue the conversation.  We need to explore and debate how we can change the way that government works.

Much has been written about how to develop software.  I am not talking about the lines of code, but rather how to structure a team, how to test, how to design for operations, produce something that works and that is supportable and does what the customer wants.

Especially when looking at government IT projects, the failure rate is horrifying and I think as an industry we need to take a very serious look at how we are delivering projects.  There are many reasons for this failure rate, but the one that has currently got my attention is the rate of innovation in IT (which is good) and the insistence of development teams to use that latest innovation (which is not always a good).

This is where as an industry there is much to learn from more mature industries.  I was talking to a friend who comes from an engineering background, and he was talking about the mix of old and new technology that they used.

The example he had was about props used to hold up tunnels on building sites.  They have been using steel props for a long while – they are light and strong.  However if you go down a tunnel on a building site, you will often see wooden posts being mixed in with the steel ones.  Why?

The answer is simple.  Under great pressure, wood starts to crack and splinter.  You can see and hear that the post is under too much pressure.  Steel however shows no sign of strain -  until it suddenly breaks, causing the tunnel to collapse.  When working underground, wood will give you a warning of an impending collapse, potentially saving lives.

Sometimes in IT, we need to temper our desire to use the latest and newest technology.  Don't always throw out the old, it sometimes has its uses.

Bill was the UK e-Communications Director under Tony Blair's government and was responsible for the original UK Online portal and the now far more successful DirectGov portal.  He was part of the team that designed the business model for DirectGov which has lead to it being the most successful eGovernment portal in Europe by quite some way.  I enjoyed not only his sense of humour, but also his wealth of experience in delivering successful eGovernment projects from a business/political rather than technical viewpoint.  There was one comment he made which really rang true for me.

Governments for years have called citizens ‘consumers’, and tried to treat them in the same way that commercial companies have.  However in reality citizens are not consumers; I pay my tax not because I want too, but because I have too. Citizens have little choice in the government services they consume, unlike with a more traditional business where there is a wide choice of competing products and ways of purchasing them.

However that all changes with eGovernment.  As a citizen I now have a choice in the way that I consume government services.  I can consume services electronically, or I can continue to consume services offline in the way I have done for decades.  Citizens will not move online just because online services are there.  Citizens will only move online when the overall experience of dealing with the government online is better than dealing with it through more traditional channels.  In the same way people will buy goods online only if they offer a better overall experience (cost, convenience, etc) than going to traditional bricks and mortar stores.

Governments need to start using the same techniques as commercial companies do to ensure that their online services offer a more compelling experience than their offline channels.