Scentrics, "Key Man" and mobile security, oh my

From a story in the Daily Mail today I found this October article in the Evening Standard about security firm Scentrics which has been working with UCL

In technical parlance, Scentrics has patented the IP for “a standards-based, fully automatic, cryptographic key management and distribution protocol for UMTS and TCP/IP”. What that translates as in layman’s language is “one-click privacy”, the pressing of a button to guarantee absolute security.
Where issues of national security are concerned, the ciphers used are all government-approved, which means messages can be accessed if they need to be by the security services. What it also signals in reality is a fortune for Scentrics and its wealthy individual shareholders, who each put in £500,000 to £10 million.

Hmm. That's a fairly vague description - the "government-approved" language makes it look like key escrow, but it's not clear. I was curious about the details, but there didn't seem to be any linked from the stories. Chandrasekaran was also touting this in the Independent in October, and it's not clear why the Mail ran with the story now.

I tried googling around for any previous news from Scentrics. Nada. So I tried "Paran Chandrasekaran" and found him back in 2000 talking about maybe netting £450M from the prospective sale of his company Indicii Salus. I couldn't find any announcements about the sale happening, but it looks like email security firm Comodo acquired the IP from Indicii Salus in March 2006. According to Comodo's press release

The core technology acquired under this acquisition includes Indicii Salus Limited's flagship security solution which, unlike other PKI offerings, is based on server-centric architecture with all information held securely in a central location thus providing a central platform necessary to host and administer central key management solutions.

That's a single-point-of-failure design of course - when your central server is down, you are screwed, and all clients need to be able to authenticate your central server so they all need its current public key or similar signature validation. It's not really world-setting-on-fire, but hey it's 8 years ago.

Then LexisWeb turns up an interesting court case: Indicii Salus Ltd v Chandrasekaran and others with summary "Claimant [Indicii Salus] alleging defendants [Chandrasekaran and others] intending to improperly use its software - Search order being executed against defendants - Defendants applying to discharge order - Action being disposed of by undertakings not to improperly use software"

Where the claimant had brought proceedings against the defendants, alleging that they intended to improperly use its software in a new business, the defendants' application to discharge a search order, permitting a search of the matrimonial home of the first and second defendants, would be dismissed.

The case appears to be fairly widely quoted in discussions of search+seizure litigation. I wonder whether Paran Chandrasekaran was one of the defendants here, or whether they were other family members? There's no indications of what happened subsequently.

How odd. Anyway, here's a sample of the Scentrics patent (USPTO Patent Application 20140082348):

The invention extends to a mobile device configured to:
send to a messaging server, or receive from a messaging server, an electronic message which is encrypted with a messaging key;
encrypt a copy of the message with a monitoring key different from the messaging key; and
send the encrypted copy to a monitoring server remote from the messaging server.
[...]
Thus it will be seen by those skilled in the art that, in accordance with the invention, an encrypted copy of a message sent securely from the mobile device, or received securely by it, is generated by the device itself, and is sent to a monitoring server, where it can be decrypted by an authorized third party who has access to a decryption key associated with the monitoring key. In this way, an authorized third party can, when needed, monitor a message without the operator of the messaging server being required to participate in the monitoring process.
Because both the message and its copy are encrypted when in transit to or from the mobile device, unauthorized eavesdropping by malicious parties is still prevented.

This reads to me like "given a message and a target, you encrypt it with a public key whose private key is held by your target and send it to the target as normal, but you also encrypt it with a separate key known to a potential authorized snooper and send it to their server so that they can access if they want to."

WTF? That's really not a world-beating million-dollar idea. Really, really it's not. Am I reading the wrong patent here? Speaking personally, I wouldn't invest in this idea with five quid I found on the street.

The 2038 problem

I was inspired - perhaps that's not quite the right word - by this article on the Year 2038 bug in the Daily Mail:

Will computers be wiped out on 19 January 2038? Outdated PC systems will not be able to cope with time and date, experts warn Psy's Gangnam Style was recently viewed so many times on YouTube that the site had to upgrade the way figures are shown on the site.

1. The site 'broke' because it runs on a 32-bit system, which uses four-bytes
2. These systems can only handle a finite number of binary digits
3. A four-byte format assumes time began on 1 January, 1970, at 12:00:00
4. At 03:14:07 UTC on Tuesday, 19 January 2038, the maximum number of seconds that a 32-bit system can handle will have passed since this date
5. This will cause computers to run negative numbers, and dates [sic]
6. Anomaly could cause software to crash and computers to be wiped out

I've numbered the points for ease of reference. Let's explain to author Victoria Woollaston (Deputy Science and Technology editor) where she went wrong. The starting axiom is that you can represent 4,294,967,296 distinct numbers with 32 binary digits of information.

1. YouTube didn't (as far as I can see) "break".

Here's the original YouTube post on the event on Dec 1st:

We never thought a video would be watched in numbers greater than a 32-bit integer (=2,147,483,647 views), but that was before we met PSY. "Gangnam Style" has been viewed so many times we had to upgrade to a 64-bit integer (9,223,372,036,854,775,808)!

When they say "integer" they mean it in the correct mathematical sense: a whole number which may be negative, 0 or positive. Although 32 bits can represent 4bn+ numbers as noted above, if you need to represent negative numbers as well as positive then you need to reserve one of those bits to represent that information (all readers about to comment about two's complement representation can save themselves the effort, the difference isn't material.) That leaves you just over 2bn positive and 2bn negative numbers. It's a little bit surprising that they chose to use integers rather than unsigned (natural) numbers as negative view counts don't make sense but hey, whatever.
Presumably they saw Gangnam Style reach 2 billion views and decided to pre-emptively upgrade their views field from signed 32 bit to signed 64 bit. This is likely not a trivial change - if you're using a regular database, you'd do it via a schema change that requires reprocessing the entire database, and I'd guess that YouTube's database is quite big but it seemed to be in place by the time we hit the signed 32 bit integer limit.

2. All systems can only handle a finite number of binary digits.

For fuck's sake. We don't have infinite storage anywhere in the world. The problem is that the finite number of binary digits (32) in 4-byte representation is too small. 8 byte representation has twice the number of binary digits (64, which is still finite) and so can represent many more numbers.

3. The number of bytes has no relationship to the information it represents.

Unix computers (Linux, BSD, OS X etc.) represent time as seconds since the epoch. The epoch is defined as 00:00:00 Coordinated Universal Time (UTC - for most purposes, the same as GMT), Thursday, 1 January 1970. The Unix standard was to count those seconds in a 32 bit signed integer. Now it's clear that 03:14:08 UTC on 19 January 2038 will see that number of seconds exceed what can be stored in a 32 bit signed integer, and the counter will wrap around to a negative number. What happens then is anyone's guess and very application dependent, but it's probably not good.
There is a move towards 64-bit computing in the Unix world, which will include migration of these time representations to 64 bit. Because this move is happening now, we have 23 years to complete it before we reach our Armageddon date. I don't expect there to be many 32 bit systems left operating by then - their memory will be rotted, their disk drives stuck. Only emulated systems will be still working, and everyone knows about the 2038 problem.

4. Basically correct, if grammatically poor

5. Who taught you English, headline writer?

As noted above, what will actually happen on the date in question is heavily dependent on how each program using the information behaves. The most likely result is a crash of some form, but you might see corruption of data before that happens. It won't be good. Luckily it's easy to test programs by just advancing the clock forwards and seeing what happens when the time ticks over. Don't try this on a live system, however.

6. Software crash, sure. Computer being "wiped out"? Unlikely

I can see certain circumstances where a negative date could cause a hard drive to be wiped, but I'd expect it to be more common for hard drives to be filled up - if a janitor process is cleaning up old files, it'll look for files with modification time below a certain value (say, all files older than 5 minutes ago). Files created before the positive-to-negative date point won't be cleaned up by janitors running after that point. So we leave those stale files lying around, but files created after that will still be eligible for clean-up - they have a negative time which is less than the janitor's negative measurement point.

I'm sure there will be date-related breakage as we approach 2038 - if a bank system managers 10 year bonds, then we will see breakage as their expiry time goes past january 2038, so the bank will see breakage in 2028. But hey, companies are already selling 50 year bonds so bank systems have had to deal with this problem already.

Thank goodness that I can rely on the Daily Mail journalists' expertise in all the articles that I don't actually know anything about.

Oh, Daily Mail subs...

From the article about the William and Kate visit to NYC:

It seems that relying on spellcheck is not quite adequate.

Whoda thunk? An actual piece of journalism on the University of Virginia "frat house gang rape" story

It seems as if the wheels are coming off Sabrina Rubin Erdely's story in Rolling Stone of gang rape on the University of Virginia's campus.

In the face of new information, there now appear to be discrepancies in Jackie's account, and we have come to the conclusion that our trust in her [my italics] was misplaced. [...] We are taking this seriously and apologize to anyone who was affected by the story.

That's certainly a novel way of writing "our unquestioning acceptance of her decidedly dodgy tale" and "had their reputations dragged through the dirt in the national media".

My favourite wonk, Megan McArdle, has a must-read piece on how this happened and how the crazy rush to publish a decidedly dodgy and unverified story has been one of the worst things to happen to real campus rape victims in a long time:

So now the next time a rape victim tells her story to a journalist, they will both be trying to reach an audience that remembers the problems with this article, and the Duke lacrosse case, and wonders if any of these stories are ever true. That inference will be grotesquely false, but it is the predictable result of accepting sensational stories without carefully checking. The greatest damage this article has done is not to journalism, or even to Rolling Stone. It is to the righteous fight for rape victims everywhere.

Go read the whole thing, and despair at the media environment that splashed Erdely's story over the national news but will fail to discuss the points in McArdle's article in anything but the most oblique terms.

Unexpected consequences of Obamacare and immigration amnesties

I'm not sure why this hasn't generated more outrage yet: the Washington Times has spotted that President Obama's plan to legalize employment for illegal immigrants might screw over American workers even more than initially suspected:

President Obama's temporary amnesty, which lasts three years, declares up to 5 million illegal immigrants to be lawfully in the country and eligible for work permits, but it still deems them ineligible for public benefits such as buying insurance on Obamacare's health exchanges.

Seems sensible enough, although the amnesty beneficiaries might well be eligible for the Earned Income Tax Credit if they have kids. But there's a consequence for the lack of health exchange rights:

Under the Affordable Care Act, that means businesses who hire them won't have to pay a penalty for not providing them health coverage [my emphasis] — making them $3,000 more attractive than a similar native-born worker, whom the business by law would have to cover.

Oopsie. Since the immigrants will tend to participate in the lower-paid end of the employment spectrum, that means the $3000 delta will be a huge fraction of the wage. That's quite the competitive advantage. Sure, it means in practice that they won't have ACA-compliant health care - and in fact I'd expect many employers to pay their amnestied workers a higher headline wage to compensate for this lack of employer-supported healthcare. Nevertheless, once it's legal to employ these workers openly, the wage differential makes them look very attractive.

This won't affect unionized jobs where wages can't easily be varied, but in the private sector the medium-sized businesses who have more than 50 employees will start sucking up all the amnestied labor they can and will stop hiring the locals. Small businesses which have pushed workers into part-time slots to avoid the ACA can now replace two part-time workers with a full-time amnestied worker.

This is what happens when you create a baroque, complicated legal framework for employment and health insurance. When you subsequently make changes, you will find that they have unexpected effects.

Anatomy of a timeshare sale

Dear readers, the things I do on your behalf. Herewith my notes from participating in a recent timeshare sales session which was the condition of a fairly well discounted holiday which my partner and I recently enjoyed.

The vacation property itself was very pretty - manicured lawns, artfully trimmed flowering bushes and a background of blue skies and the sound of crashing waves. The sales office itself was tucked away in a corner of the imposing main clubhouse, presumably because once you’re an owner you don’t like to be reminded of how and where they got you. It was a reasonably high traffic operation, several other couples there waiting or coming through - note that there were no singles, only couples. I'd guess they’re maximising their chances of finding a weak spot and then leveraging it to pressure the other party. Divide and conquer FTW!

The waiting room had the usual free beverages to enjoy for the few minutes we were waiting. Coffee was from a press-top urn and was awful. Normally I'm OK with urn coffee in a pinch, but my goodness this stuff was dreadful; I had to fall back to Lipton tea. This was scheduled to be a 2 hour session so my tolerance for coffee absence would be tested to its limit.

I'll call our sales rep "Nick", who was audibly a New Yorker. He led us down to his office and the presentation started after a few minutes of soft soap "how was your vacation so far? what have you enjoyed?" which was fairly obviously an intelligence-gathering exercise.

Nick started the sell emphasising that this was not a high pressure sales session. He then described the "price integrity" of his company, that they never discounted or negotiated on price (yeah, sure, you betcha snookums) and referenced back to how much we'd enjoyed the holiday so far to stimulate the guilt gland. He then noted the extra financial incentives if we bought right now, today, with a yes/no decision at the end of the session. What was that about "no high pressure sales", Nick? He outlined our aim today which was to decide whether our future vacations would be better with or without TIMESHARECO ownership, which was studiously neutral so far. At the end of the session we would be meeting with the company inventory manager for details on prices, incentives etc.

About 10-15 minutes in and Nick took a break to "get some water". Presumably this was to check with his boss on his boss's read on the situation so far. I didn't think to check for a video or audio monitor in the office; nothing was obvious, and I'm guessing that there wasn't any eavesdropping going on. Certainly nothing subsequently made me suspect that.

Nick started the next session reviewing our past holidays and latched on to our holiday last year as similar to the kind of thing he was selling. He asked us to name our "dream" 3-5 money-no-object vacations which we did. He picked out quality as a factor in our holidays and started talking numbers on room prices, picking a $200/night base price.

We learned after casual conversation from me that he had retired from a job as a retirement plan sales manager, but had come back into the timeshare sales game after a couple of years. In light of the later discussions, this made a lot of sense. He likened the scheme he was selling as a "401(k)" (money purchase pension scheme) for holidays - invest money and get a steady yield of vacations.

During the meeting he took very short but effective notes on a single sheet of paper, only a few words per concept; around now he read back to us a summary of what he'd noted, and pretty much nailed everything. I was very impressed at his technical skill. I also approved of the strategic placing of his office with a genuinely lovely garden and waterfall view - he sat with his back to it, so it clearly wasn't intended for his benefit. I bet the room views aren't like that (except for the show rooms.)

Now we come on to the numbers. He was trying to sell on the basis of 7 days stay, $200/night, over 20 years - that if we did this with his company then it would be cheaper than renting a hotel room each year. He presented a table showing cost of hotel rooms in brackets - but quoting in non-constant dollars. The chart spanned 40 years - so starting from the mid-1970 when 11% annual inflation was the average - but actually only 7% over past 10 years (I did the math). Later, checking the US inflation calculator it's clear that 1974-1984 is by far the steepest inflation decade of the past 40 year - 110% compared to 42% (1984-1994), 27% (1994-2004) or 25% (2004-2014).

I innocently asked him "but aren't wages inflating too, so shouldn't this be expressed in constant dollars or at least expressed in terms of purchasing power? And aren't hotel prices determined by supply/demand - what you can persuade people to pay, not what your costs are, so heavily influenced by wages?" at which point he pretended confusion. I also asked why he was looking at a 40 year basis when we were talking about a future span of 20 years, which met with a similar response.

Now it makes sense why he used to sell retirement plans... he's essentially selling a financial plan. He's saying that if we give TIMESHARECO about 20 grand then they can invest it in property and meet the cost of our stays over the next 20 years while presumably turning a small profit including his commission. And yet, they can't persuade the major financial establishments to make the same investments and profit directly. I wonder why?

Now the "here's all the places you can stay!" list. About 70 locations in 10 countries - not a massive amount, but they have "affiliates" in 100 countries with over 5000 resorts you can stay at. Minimum of 3 nights per stay, no max, which seems reasonable. With your purchase of the plan you get X points per year to spend on properties, and can transfer points between years. It costs $100 to carry forward non-spent points, but $0 to borrow them from future years - cheaper to take a loan than save up. What's wrong with this picture? It means that they want the additional money they get from you actually staying, of which more later.

We toured through photo sets of properties in countries we might visit, though only TIMESHARECO properties not affiliates - which was a nice sleight of hand. Apparently TIMESHARECO "reviews" the quality of the affiliates to ensure they're up to scratch. I'm sure you're as reassured as I was. It's a first-come first-served model for all properties. Nick claimed that there was a low probability of all affiliate properties being full in an area even in busy time e.g. spring break but didn't address TIMESHARECO numbers directly. So they almost certainly have a problem with availability during this times. Affiliates charges $200 per booking which is a nice little earner and pushes you towards fewer, longer holidays in affiliates.

He gave us a brochure for the affiliate program: RCI. According to their SSL cert information they are Wyndham Worldwide Corporation based in Parsippany, New Jersey. Their stock is up about 15% y/y so clearly the timeshare business is doing well out of the boom.

Nick took another break, this time more extended than the previous one, presumably to allow replanning of his sales approach. I couldn't help but notice that he didn't offer us a refill of our beverages.

He mentioned in passing that there was also a maintenance fee which covers insurance for the property, in response to an earlier question I had about "what if the property we buy rights to burns down?" We fenced for a few minutes, then 70 mins after the start of the discussion he gave up, said that we didn't have to tour the property if we didn't want to - we didn't - and handed over the bonus gifts that we were due to receive at the end of the property. He did try a last gasp attempt with vacation offer similar to what we had already enjoyed, with another timeshare presentation linked in. I'm sure that if we'd taken this up then we'd have been lined up with their Top Gun negotiator. But we said no thanks, and left.

Overall a fascinating view into the world of timeshare sales. I didn't feel in any danger of buying at any point, but I give Nick his due that he tried very hard and used most of the tricks in the book without resorting to what I'd regard as "high pressure" sales. Perhaps the fact that I was taking notes alarmed him a little; he emphasised at the start that he'd give us all the items discussed in writing, but of course with us leaving before closing this didn't happen (if it would have happened). Credit to him that he recognised when he was beaten and didn't waste our time or his beyond that point. It also turned out to be remarkably easy to elicit information about him and divert him off course for a few minutes. Presumably this was because he thought that he was making a social connection and common ground.

The offer itself of course was completely overpriced - I checked out the secondary market in TIMESHARECO properties and they were a) heavily discounted, around 60% of face value and b) not selling, though of course these are related and just give you a ballpark idea of the market clearing price. The annual maintenance cost was around $1300 - i.e. the same as 6 nights of hotel stays at $200/night. If you buy in the primary market, you are a total mug or you have lots of money, the holiday model fits you and you don't mind paying a healthy excess for the convenience.

Lipstick on a postal pig

I can't help but share this lunacy with you. The (American) Center For Economic and Policy Research thinks that the problem with the US Postal Service isn't the lackadaisical, contemptuous, inefficient distribution of mail which it perpetrates. It's just not properly utilized. Instead, we should allow it to run banking services at the same efficiency with which it delivers mail:

[...] the Postal Service could improve its finances by expanding rather than contracting. Specifically, it can return to providing basic banking services, as it did in the past and many other postal systems still do. This course has been suggested by the Postal Service's Inspector General.
This route takes advantage of the fact that the Postal Service has buildings in nearly every neighborhood in the country. These offices can be used to provide basic services to a large unbanked population that often can't afford fees associated with low balance accounts. As a result they often end up paying exorbitant fees to check cashing services, pay day lenders and other non-bank providers of financial services.

Of course, the reason that banks have run a mile from providing banking services to clients with low income or dubious immigration status, running away from a steady (albeit low) income stream, is due to... government regulatory pressure. Who'd have thought that the government would have caused these problems?

Now the CEPR is proposing that a government agency can step in and fix the very real problems in banking access that other government agencies have created. I don't know whether to laugh or cry.

Incidentally, my personal experience with sending mail through the USPS - a monthly mail to a residential address within the same state, dropped in a regular post box - is that the failure rate is about 1 in 13. This is corroborated by the experience of The Advice Goddess (Los Angeles resident Amy Alkon, if you're not reading her blog or buying her books then you really should):

How sucko is @USPS? Called to complain re lazy postal wkrs not picking up from blue boxes; USPSer says "I'd never put mail in one of those"

— Amy Alkon (@amyalkon) November 5, 2014

There is no way that the USPS could comply with the existing banking regulations in the USA without having the same order of overhead as the major US banks. I suspect their savings in property costs are insignificant; even if they could train existing post office counter staff to be bank tellers as well without any major salary inflation, all the backend systems and personnel required would kill their cost advantage. Check out the USPS compensation and benefits: "regular salary increases" means you're paid by length of service, not productivity, they get federal health benefits which are a step or three above Obamacare coverage, and they get a defined benefit retirement plan. Believe me, if you're staff at a major bank, you would sell your mother on the streets to get these benefits.

All the CEPR is doing in this article is lobbying for an increase in (unionized) federal government employees. The government, and therefore the taxpayer, is going to pick up the tab, but that's Just Fine with them. The only way I can see this working is if the USPS is exempted from most of the existing banking regulations - and if that's the problem, why not just repeal them for everyone else as well?

A caricature of Civil Service placement and rhetoric

The new director of GCHQ was announced earlier this year as Robert Hannigan, CMG (Cross of St Michael and St George, aka "Call Me God") replacing the incumbent Sir Iain Lobban, KCMG (Knight's Cross of St Michael and St George, aka "Kindly Call Me God"). Whereas Sir Iain was a 30 year veteran of GCHQ, working his way up from a language specialist post, Hannigan was an Oxford classicist - ironically at Wadham, one of the few socialist bastions of the university - and worked his way around various government communications and political director posts before landing a security/intelligence billet at the Cabinet office. Hannigan is almost a cliché of the professional civil servant.

Hannigan decided to write in the FT about why Facebook, Twitter and Google increasing user security was a Bad Thing:

The extremists of Isis use messaging and social media services such as Twitter, Facebook and WhatsApp, and a language their peers understand. The videos they post of themselves attacking towns, firing weapons or detonating explosives have a self-conscious online gaming quality. [...] There is no need for today’s would-be jihadis to seek out restricted websites with secret passwords: they can follow other young people posting their adventures in Syria as they would anywhere else.

Right - but the UK or US governments can already submit requests to gain access to specific information stored by Facebook, Google, Twitter et al. What Hannigan leaves out is: why is this not sufficient? The answer, of course, is that it's hard to know where to look. Far easier to cast a dragnet through Internet traffic, identify likely sources of extremism, and use intelligence based on their details to ask for specific data from Facebook, Google, Twitter et al. But for the UK in the first half of 2014, the UK issued over 2000 individual requests for data, covering an average of 1.3 people per request. How many terrorism-related arrests (never mind convictions) correspond to this - single digits? That's a pretty broad net for a very small number of actual offenders.

Hannigan subsequently received a bitchslap in Comment is Free from Libdem Julian Huppert:

Take the invention of the radio or the telephone. These transformed the nature of communication, allowing people to speak with one another across long distances far more quickly than could have ever been imagined. However, they also meant that those wishing to do us harm, whether petty criminals or terrorists, could communicate with each other much more quickly too. But you wouldn’t blame radio or phone manufacturers for allowing criminals to speak to each other any more than you would old Royal Mail responsible for a letter being posted from one criminal to another.

Good Lord, I'm agreeing with a Libdem MP writing in CiF. I need to have a lie down.

Hannigan is so dangerous in his new role because he's never really had to be accountable to voters (since he's not a politician), nor influenced by the experience and caution of the senior technical staff in GCHQ (since he never worked there). He can view GCHQ as a factory for producing intelligence to be consumed by the civil service, not as a dangerous-but-necessary-in-limited-circumstances intrusion into the private lives of UK citizens. After all, he knows that no-one is going to tap his phone or read his email.

Personally, I'd like to see a set of 10 MPs, selected by public lottery (much like the National Lottery draw, to enforce fairness) read in on GCHQ and similar agency information requests. They'd get to see a monthly summary of the requests made and information produced, and would be obliged to give an annual public report (restricted to generalities, and maybe conducted 6 months in arrears of the requests to give time for data to firm up) on their perception of the width of the requests vs information retrieved. That's about 40 Facebook personal data trawls per MP, which is a reasonably broad view of data without excessive work. Incidentally, I'd also be interested in a breakdown of the immigration status of the people under surveillance.

Mazzucato and her State-behind-the-iPhone claims

This caught my eye in the Twitter feed of Mariana "everything comes from the State" Mazzucato:

.State behind Apple figure (pic) in my #EUDigitalMinds piece is from p.109 of http://t.co/apmUdCZwdS @NeelieKroesEU pic.twitter.com/Mb8iGOPswn

— Mariana Mazzucato (@MazzucatoM) November 4, 2014

The box claiming that "microprocessor" came from DARPA didn't sound right to me, so I did some digging.

Sure enough, DARPA appears to have had squat all to do with the development of the first microprocessors:

Three projects delivered a microprocessor at about the same time: Garrett AiResearch's Central Air Data Computer (CADC), Texas Instruments (TI) TMS 1000 (1971 September), and Intel's 4004 (1971 November).

I don't know about the CADC, but Tim Jackson's excellent book "Inside Intel" is very clear that the 4004 was a joint Intel-Busicom innovation, DARPA wasn't anywhere to be seen, TI's TMS 1000 was similarly an internal evolutionary development targeted at a range of industry products.

Looking at a preview of Mazzucato's book via Amazon, it seems that her claims about state money being behind the microprocessor are because the US government funded the SEMATECH semiconductor technology consortium with $100 million per year. Note that SEMATECH was founded in 1986 by which point we already had the early 68000 microprocessors, and the first ARM designs (from the UK!) appeared in 1985. Both of these were recognisable predecessors of the various CPUs that have appeared in the iPhone - indeed up to the late iPhone 4 models they used an ARM design.

I'm now curious about the other boxes in that diagram. The NAVSTAR/GPS and HTML/HTTP claims seem right to me, but I wonder about DARPA's association with "DRAM cache" - I'd expect that to come from Intel and friends - and "Signal compression" (Army Research Office) is so mind-meltingly vague a topic that you could claim nearly anyone is associated with it - the Motion Picture Experts Group who oversee the MPEG standards have hundreds of commercial and academic members. If Mazzucato's premise is that "without state support these developments would never have happened" then it's laughably refutable.

At this point I'm very tempted to order Mazzucato's book The Entrepreneurial State for the sole purpose of finding out just how misleading it is on this subject that happen to know about, and thus a measure of how reliable it is for the other parts I know less about.

Update: it seems that associating the DoE (US Department of Energy) with the lithium-ion battery is also something of a stretch. The first commercial lithium-ion battery was released by Sony and Asahi Kasei in Japan. The academic work leading up to it started with an Exxon-funded researcher in the early 70s . The only DofE link I can find is on their Vehicle Technologies Office: Batteries page and states:

This research builds upon decades of work that the Department of Energy has conducted in batteries and energy storage. Research supported by the Vehicle Technologies Office led to today's modern nickel metal hydride batteries, which nearly all first generation hybrid electric vehicles used. Similarly, the Office's research also helped develop the lithium-ion battery technology used in the Chevrolet Volt, the first commercially available plug-in hybrid electric vehicle.

That's a pretty loose connection. I suspect, since they specifically quote the Volt, that the DofE provided money to Chevrolet for research into the development of batteries for their cars, but the connection between the Volt and the iPhone battery is... tenuous.

For fuck's sake, Mariana. You could have had a reasonably good point by illustrating the parts of the iPhone that were fairly definitively state-funded in origin, but you had to go the whole hog and make wild, spurious and refutable claims just to bolster the argument, relying on most reviewers not challenging you because of your political viewpoint and on most readers not knowing better. That's pretty despicable.

State-endorsed web browsers turn out to be bad news

Making the headlines in the tech world this week has been evidence of someone trying to man-in-the-middle Chinese iCloud users:

Unlike the recent attack on Google, this attack is nationwide and coincides with the launch today in China of the newest iPhone. While the attacks on Google and Yahoo enabled the authorities to snoop on what information Chinese were accessing on those two platforms, the Apple attack is different. If users ignored the security warning and clicked through to the Apple site and entered their username and password, this information has now been compromised by the Chinese authorities. Many Apple customers use iCloud to store their personal information, including iMessages, photos and contacts. This may also somehow be related again to images and videos of the Hong Kong protests being shared on the mainland.

MITM attacks are not a new phenomenon in China but this one is widespread, and clearly needs substantial resources and access to be effective. As such, it would require at least government complicity to organise and implement.

Of course, modern browsers are designed to avoid exactly this problem. This is why the Western world devotes so much effort to implementing and preserving the integrity of the "certificate chain" in SSL - you know you're connecting to your bank because the certificate is signed by your bank, and the bank's signature is signed by a certificate authority, and your browser already knows what the certificate authority's signature looks like. But it seems that in China a lot of people use Qihoo 360 web browser. It claims to provide anti-virus and malware protection, but for the past 18 months questions have been asked about its SSL implementation:

If your browser is either 360 Safe Browser or Internet Explorer 6, which together make up for about half of all browsers used in China, all you need to do is to click continue once. You will see no subsequent warnings. 360's so-called "Safe Browser" even shows a green check suggesting that the website is safe, once you’ve approved the initial warning message.

I should note, for the sake of clarity, that both the 2013 and the current MITM reports come from greatfire.org, whose owners leave little doubt that they have concerns about the current regime in China. A proper assessment of Qihoo's 360 browser would require it to be downloaded on a sacrificial PC and used to check out websites with known problems in their SSL certificates (e.g. self-signed, out of date, being MITM'd). For extra points you'd download it from a Chinese IP. I don't have the time or spare machine to test this thoroughly, but if anyone does then I'd be interested in the results.

Anyway, if the browser compromise checks out then I'm really not surprised at this development. In fact I'm surprised it hasn't happened earlier, and wonder if there have been parallel efforts at compromising IE/Firefox/Opera/Chrome downloads in China: it would take substantial resources to modify a browser installer to download and apply a binary patch to the downloaded binary which allowed an additional fake certificate authority (e.g. the Chinese government could pretend to be Apple), and more resources to keep up to date with browser releases so that you could auto-build the patch shortly after each new browser version release, but it's at least conceivable. But if you have lots of users of a browser developed by a firm within China, compromising that browser and its users is almost as good and much, much easier.

Corporate welfare from Steelie Neelie and the EU

I used to be the starry-eyed person who thought that governments pouring into a new concept for "research" was a good thing. That didn't last long. Now I read The Reg on the EU's plan to chuck 2.5 billion euros at "Big Data" "research" and wonder why, in an age of austerity, the EU thinks that pissing away the entire annual defence budget of Austria is a good idea.

First, a primer for anyone unfamiliar with "Big Data". It's a horrendously vague term, as you'd expect. The EU defines the term thus:

Big data is often defined as any data set that cannot be handled using today’s widely available mainstream solutions, techniques, and technologies.

Ah, "mainstream". What does this actually mean? It's a reasonable lower bound to start with what's feasible on a local area network. If you have a data set with low hundreds of terabytes of storage, you can store and process this on some tens of regular PCs; if you go up to about 1PB (petabyte == 1024 terabytes, 1 terabyte is the storage of a regular PC hard drive) then you're starting to go beyond what you can store and process locally, and need to think about someone else hosting your storage and compute facility.

Here's an example. Suppose you have a collection of overhead imagery of the United Kingdom, in the infra-red spectrum, sampled at 1m resolution. Given that the UK land area is just under 250 thousand square kilometers, if you represent this in an image with 256 levels of intensity (1 byte per pixel) you'll need 250,0000 x (1000 x 1000) = 250 000 000 000 pixels or 250 gigabytes of storage. This will comfortably fit on a single hard drive. If you reduce this to 10cm resolution - so that at maximum resolution your laptop screen of 1200 pixel width will show 120m of land - then you're looking at 25 TB of data, so you'll need a network of tens of PCs to store and process it. If, instead of a single infra-red channel, you have 40 channels of different electromagnetic frequencies, from low infra-red up to ultra violet, you're at 1PB and need Big Data to solve the problem of processing the data.

Another example, more privacy-concerning: if you have 1KB of data about each of the 7bn people in the world (say, their daily physical location over 1 year inferred from their mobile phone logs), you'll have 7 terabytes of information. If you have 120 KB of data (say, their physical location every 10 minutes) then this is around 1PB and approaches the Big Data limits.

Here's the press release:

Mastering big data could mean:

• up to 30% of the global data market for European suppliers;
• 100,000 new data-related jobs in Europe by 2020;
• 10% lower energy consumption, better health-care outcomes and more productive industrial machinery.

My arse, but let's look at each claim in turn.

• How is this project going to make it more likely for European suppliers to take over more of the market? Won't all the results of the research be public? How, then, will a European company be better placed to take advantage of them than a US company? Unless one or more US-based international company has promised to attribute a good chunk of its future Big Data work to its European operations as an informal quid-pro-quo for funding from this pot.
• As Tim Worstall is fond of saying, jobs are a cost not a benefit. These need to be new jobs that are a prerequisite for larger Big Data economic gains to be realized, not busywork to meet artificial Big Data goals
• [citation required] to quote Wikipedia. I'll believe it when I see it measured by someone without financial interest in the Big Data project.

The EU even has a website devoted to the topic: Big Data Value. Some idea of the boondoggle level of this project can be gleaned from the stated commitment:

... to build a data-driven economy across Europe, mastering the generation of value from Big Data and creating a significant competitive advantage for European industry, boosting economic growth and jobs. The BDV PPP will commence in 2015[,] start with first projects in 2016 and will run until 2020. Covering the multidimensional character of Big Data, the PPP activities will address technology and applications development, business model discovery, ecosystem validation, skills profiling, regulatory and IPR environment and social aspects.

So how will we know if these 2.5bn Euros have been well spent? Um. Well. Ah. There are no deliverables specified, no ways that we can check back in 2020 to see if the project was successful. We can't even check in 2017 whether we're making the required progress, other than verifying that the budget is being spent at the appropriate velocity - and believe me, it will be.

The fundamental problem with widespread adoption of Big Data is that you need to accumulate the data before you can start to process it. It's surprisingly hard to do this - there really isn't that much new data generated in most fields and you can do an awful lot if you have reasonably-specced PCs on a high-speed LAN. Give each PC a few TB in storage, stripe your data over PCs for redundancy (not vulnerable to failure of a single drive or PC) and speed, and you're good to go. Even if you have a huge pile of storage, if you don't have the corresponding processing power then you're screwed and you'll have to figure out a way of copying all the data into Amazon/Google/Azure to allow them to process it.

Images and video are probably the most ripe field for Big Data, but still you can't avoid the storage/processing problem. If you already have the data in a cloud storage provider like Amazon/Google/Azure, they likely already have the processing models for your data needs; if you don't, where are all the CPUs you need for your processing? It's likely that the major limitations processing Big Data in most companies is appropriate reduction of the data to a relatively small secondary data set (e.g. processing raw images into vectors via edge detection) before sending it somewhere for processing.

The EU is about to hand a couple billion euros to favoured European companies and university research departments, and it's going to get nine tenths of squat all out of it. Mark my words, and check back in 2020 to see what this project has produced to benefit anyone other than its participants.

Signs that the terrorism threat might be overblown

Or maybe just a sign that the US education system is a pool of sharks...

Modern terrorism getting you down? Don't worry, it's an opportunity for you! Sign up for a certificate in Terrorism Studies!

In the program, you will develop an understanding of terrorism and counter-terrorism. The online program is suitable for students interested in pursuing a career in homeland security at local, state, or federal levels; joining national and international counter-terrorism agencies; conducting research on terrorism in academia; or seeking opportunities in relevant industries.

Presumably it's also suitable for students interested in pursuing a career in terrorism? Or maybe this is an elaborate honey trap by the FBI, but I suspect that a) they don't have the motivation and b) they can't afford to fund the course.

Don't ask for your emails to be deleted

Darrell Issa, Republican congressman from California (yes, amazingly they exist) releases the oversight report on the initial rollout of Healthcare.gov and it wasn't pretty. The bulk of the report was based off emails that they managed to retrieve from Health + Human Services and their CMS subsidiary, and the report authors did a nice job of excerpting the damning snippets from the emails that confirmed everyone's suspicions about the rollout: the grunts implementing and testing the site knew darned well that it wasn't ready, but they were overridden.

I don't find any particular reason in the report to believe that the President knew the site wasn't ready; it looks very much like he and his advisors were assured that everything was in hand, and he had no particular reason to disbelieve it. The problems occurred lower down in the hierarchy:

Mr. Sivak showed Mr. Baitman emails that were made public by Congress in the wake of Healthcare.gov's disastrous launch. In these emails, dated September 27, 2013 [launch date was Oct 1st], a CMS official working on the FFM development, wrote "the facts are that we have not successfully handled more than 500 concurrent users filling out applications in an environment that is similarly in size to Day 1 production." In response, Mr. Baitman wrote "Frankly, it’s worse than I imagined!" Mr. Sivak replied, "Anyone who has any software experience at all would read that and immediately ask what the fuck you were thinking by launching."

Indeed, we were asking almost exactly that question. And there was no naivety about motivations:

How did one week Henry Chao tell us there was no way Account Transfer would be ready, then a meeting at the White House and a week later, oh, yeah, everything is back on track, we’ll meet the dates? That’s what I mean by WTF. You could definitely see the CYA moves coming a mile away

Doublethink is clearly very important for project managers. Henry Chao was one of the prime Healthcare.gov project managers and it appears he knew that the site was heading to disaster, but for some reason he couldn't or wouldn't articulate this to the administration.

Issa, of course, has plenty of partisan reasons to bash the administration and the Healthcare.gov backers, but it's hard to conclude anything other than that this launch was destined to crash and burn spectacularly, that this was known well in advance, and that it was egregiously mis-managed. That Mikey Dickerson and his crew managed to retrieve some semblance of success from this state was amazing, but not something that should be relied on by any future project manager.

Once again, the maxim "Do not write anything in an email that you do not want to see on the front page of a major newspaper" is confirmed. The usual wisdom around this is a combination of a) mail is transferred in the clear between servers on the public internet, although this is changing, and b) the risk of including the wrong person on your To: or Cc: lines. This report highlights a third option: the risk that your email will be retrieved during a legal discovery process. If you send your email from a company email system it'll be archived there and prone to later legal discovery even if you and the recipient delete it. This also applies if any of your recipients use a company or government email address.

The Verge provides a nice summary of the highlights in the report if you don't have the stomach to read the whole thing.

Take the upside and you own the downside

I was annoyed by this inane Reuters article on the fate of the UK's gold stash:

An independent Scotland could lay claim to a part of the United Kingdom's 310-tonne gold reserves if votes go in favour of the "Yes" campaign this month, with ownership of Britain's bullion hoard up for negotiation along with other assets.

If I were Scotland, I'd run as far as possible from the £7.8bn pile of gold bricks. The reason I'd do this is because if I take on a fraction of the assets of the UK, I have no argument against also taking on its liabilities:

As of Q1 2013 UK government debt amounted to £1,377 billion, or 88.1% of total GDP, at which time the annual cost of servicing the public debt amounted to around £43bn, or roughly 3% of GDP.

Why would you take (say) 10% of £7.8bn when you'd also have to assume 10% of a £1400bn liability? You'd have to be stark staring bonkers. Alex Salmond isn't a rocket scientist, but even he would realise how dumb this would be.

New clamping down on information in China

Spotted this on a net security research blog yesterday: someone is trying to snoop on the web traffic of Chinese students and researchers:

All evidence indicates that a MITM [man-in-the-middle] attack is being conducted against traffic between China’s nationwide education and research network CERNET and www.google.com. It looks as if the MITM is carried out on a network belonging to AS23911, which is the outer part of CERNET that peers with all external networks. This network is located in China, so we can conclude that the MITM was being done within the country.

To decipher this, readers should note that CERNET is the Chinese network for education and research - universities and the like. The regular Great Firewall of China blocking is fairly crude and makes it practically difficult for researchers to get access to the information they need, so CERNET users have mostly free access to the Internet at large - I'm sure their universities block access to dodgy sites, but to be fair so do Western universities. What's happening is that someone is intercepting - not just snooping on - their requests to go to www.google.com and is trying to pretend to be Google.

The reason the intercept is failing is because Google - like Facebook, Yahoo, Twitter and other sites - redirects plain HTTP requests to its homepage to a HTTPS address, so most people bookmark those sites with an HTTPS address. Therefore the users were requesting https://www.google.com/ and the attackers had to fake Google's SSL certificate. Because of of the way SSL is designed, this is quite hard; they couldn't get a reputable Certificate Authority to sign their certificate saying "sure, this is Google" so they signed it themselves, much like a schoolchild signing a note purportedly from their parent but with their own name. Modern browsers (Chrome, Firefox, modern versions of IE) warn you when this is happening, which is how the users noticed. The Netresec team's analysis showed that the timings of the steps of the connection indicated strongly that the interceptor was somewhere within China.

The attack doesn't seem to be very sophisticated, but it does require reasonable resources and access to networking systems - you've got to reprogram routers in the path of the traffic to redirect the traffic going to Google to come to your own server instead, so you either need to own the routers to start with or compromise the routers of an organisation like a university. Generally, the further you get from the user you're intercepting, the greater your resources need to be. It would be interesting to know what fraction of traffic is being intercepted - the more users you're intercepting, the more computing resource you need to perform the attack because you've got to intercept the connection, log it, and then connect to Google/Twitter/Yahoo yourself to get the results the user is asking for.

The attempted intercepts were originally reported on the Greatfire.org blog which observes that there were several reports from around CERNET of this happening. Was this a trial run? If so it has rather blown up in the faces of the attackers; now the word will circulate about the eavesdropping and CERNET users will be more cautious when faced with odd connection errors.

If the attackers want to press on, I'd expect the next step to be more sophisticated. One approach would be SSL stripping where the interceptor tries to downgrade the connection - the user requests https://www.twitter.com/ but the attacker rewrites that request to be http://www.twitter.com/. The user's browser sees a response for http instead of https and continues with an unencrypted connection. Luckily, with Twitter this will not work well. If you run "curl -I https://www.twitter.com/" from a command line, you'll see this:

HTTP/1.1 301 Moved Permanently
content-length: 0
date: Sat, 06 Sep 2014 17:23:21 UTC
location: https://twitter.com/
server: tsa_a
set-cookie: guest_id=XXXXXXXXXXXXXXXXX; Domain=.twitter.com; Path=/; Expires=Mon, 05-Sep-2016 17:23:21 UTC
strict-transport-security: max-age=631138519
x-connection-hash: aaaaaaaaaaaaaaaa

That "strict-transport-security" line tells the browser that future connections to this site for the next N seconds must use HTTPS, and the browser should not continue the connection if the site tries to use HTTP. This is HTTP Strict Transport Security (HSTS) and Twitter is one of the first big sites I've seen using it - Google and Facebook haven't adopted it yet, at least for their main sites.

Alternatively the interceptor may try to compromise a reputable certificate authority so it can forge SSL certificates that browsers will actually accept. This would be a really big investment, almost certainly requiring nation-state-level resources, and would probably not be done just to snoop on researchers - if you can do this, it's very valuable for all sorts of access. It also won't work for the major sites as browsers like Chrome and Firefox use certificate pinning - they know what the current version of those sites' SSL certs look like, and will complain loudly if they see something different.

The most effective approach, for what it's worth, is to put logging software on all the computers connected to CERNET, but that's probably logistically infeasible - it only works for targeting a small number of users.

So someone with significant resources in China is trying to find out what their researchers are searching for. Is the government getting nervous about what information is flowing into China via this route?

Surrender monkeys don't eat balut

A fascinating shit-storm is brewing between the Philippine Army and the UN Disengagement Observer Force as a result of recent events in the Golan Heights:

The Philippine military said Monday that a U.N. peacekeeping commander in the Golan Heights should be investigated for allegedly asking Filipino troops to surrender to Syrian rebels who had attacked and surrounded their camp.
[...]
When the besieged Filipino troops sought his [Gen. Catapang's] advice after they were ordered to lay down their arms as part of an arrangement with the rebels to secure the Fijians' release, Catapang said he asked them to defy the order.

It seems that in order to facilitate negotiations for the release of 45 Fijian soldiers captured by the (al-Qaeda affiliated) Nusra Front rebels - such capture perhaps due to less-than-stellar planning by UNDOF - the UNDOF commander decided that yielding to the rebels' demands for the Filipino troops to give up their weapons would be just dandy. After all, what could possibly go wrong?

Gen. Catapang is Chief of Staff of the Philippine Armed Forces, so can't really rise any higher in the command structure, and isn't well-known enough to run for high government office, so he's got no real motive to puff up his role in this dispute. I'm inclined to believe the main thrust of his account. Since the army has been in near-continuous counter-insurgency campaigns, with the communist NPA in the central Philippines and the Islamic groups in the south and south west, they've accumulated quite a lot of experience with fanatic groups and have presumably absorbed the lesson that doing what your opponent tells you to seldom works out well.

It'll be interesting to see if the resolution of the dispute is made public:

Catapang said an investigation would allow the UNDOF commander to explain his side and the Philippine military to explain why it advised the Filipino peacekeepers to defy his order.

I doubt the second part will take very long. I'd start with "Because it was bloody stupid" and work up from there. Catapang, as a 4-star general, comfortably out-ranks UNDOF's 2-star leader and so there's no insubordination problem I can see. The first part would be educational though: just what did the UNDOF commander think would happen if the Filipino troops had laid down their arms as ordered? And what involvement did the UNDOF commander have in the Fijians being captured in the first place? The Philippine Army is withdrawing from the UNDOF mission in the Golan, presumably because they have no appetite for being put in the same position again when UNDOF decides that covering its backside is more important than the safety of the troops in its command.

It seems that si vis pacem, para bellum is still true: if you want to keep the peace, you have to be prepared to kick the ass.

Update: Richard Fernandez at the Belmont Club is well worth reading on this topic:

In the past the UN apparatchiks have relied on the faithfulness of their subordinate commanders to take a bullet for the team. "Theirs not to reason why, theirs but to do and die." But Tennyson had never been to the Philippines where the word for blindly following orders is tanga – or sap.

A voice of reason in CiF

It would have to be a mathmo, wouldn't it? Sam Howison, an applied maths professor, looks at why the first 50 Fields medal winners were uniformly male and, refreshingly, comes up with a range of explanations with the starting point that there just aren't many female mathmos:

Data is scarce in this rarefied region, and hypotheses are hard to test; so, too, is the influence of the culture of their chosen field. Nevertheless, such astronomical odds of a woman winning the medal are disturbing, and they are just an extreme point of a range of evidence that women are underrepresented in mathematics at many levels.

It's indisputably true that you don't find anything like a 50% proportion of women at the top level of maths, or theoretical computer science for that matter. On the other hand, in my experience the women that you do find there aren't obviously any less smart and capable than the men, so if you were making randomized choices based on intellect you'd expect women to be far more frequent in Fields medal holders than they are.

This year, Stanford professor Maryam Mirzakhani won a Fields medal. She's clearly a hard-core pure mathmo; I defy anyone with anything less than a Ph.D. in maths to read about her research interests and not have their brain leak out of their ears. This is not just "I don't understand what this is about", this is "I can't even picture the most basic explanation of this in my head". Compared to that, even Fermat's Last Theorem was a walk in the park - solving polynomial equations is standard A-level fare, and even if you can't understand what Andrew Wiles did to prove it you can at least understand the problem. With Mirzakhani's work, you have no frame of reference, you're like a child who wanders into the middle of a movie.

Howison's point about the astronomical odds of the Fields medal award gender distribution (50 tails in 51 unbiased coin tosses) is a nice point of probability, but of course the first place you'd start is to look at the eligible pool - top-flight mathematicians, generally at (UK) professor level, with a substantial track record of publishing. That will tell you your bias; if 1 in 10 people in the pool are female, you're tossing a biased coin which will show tails 9 times out of 10. Still, it's pretty clear that even with that pool the Fields medal gender split is way out of line with what you'd expect.

Howison makes an interesting point that I hadn't considered up to now:

[...] people with successful careers have usually had a high degree of support from a mentor. As well as providing academic guidance and inspiration (as Mirzakhani freely acknowledges she had when a student), the mentor will introduce their charge to influential colleagues on the conference circuit and elsewhere, and arrange invitations to speak at seminars and workshops. That is one way for a young mathematician to get their work noticed, and to improve their chances of getting a position in a world-leading department where they can thrive. Is this perhaps (if only subconsciously) difficult for women in a community where the majority are men?

The usual reason for explaining the lack of women in senior positions in Fortune 500 firms (banks, Big Pharma etc.) is that they're not as good at men at talking their own book, preferring to be more even-handed in giving credit for the achievements in which they'd participated. However, Howison tantalisingly hints at a squaring function in gender representation here - will junior female mathmos only get good support and PR from a senior female mentor, and do such senior female mathmos pick up juniors with a blind eye to gender? It would be fascinating to get some data here.

I do wonder whether that perennial topic in gender discrimination, motherhood, plays a role here. Because the Fields medal only goes to people younger than 40 - Andrew Wiles, who cracked Fermat's Last Theorem, was a notable omission from its holders due to his age - if you take time out from academe to have children then this disproportionately affects your time where you're eligible for a Fields medal. The Guardian interviewed this year's sole female awardee, Maryam Mirzakhani but she didn't make any comment about her family life so I have no idea if she has kids.

So mad props to Maryam Mirzakhani for being the first female winner of the Fields medal, and here's to hoping for many more. Apart from anything else, if we can start to get some data on what factors determine female Fields medal winners we might have a hazy glimpse of what we need to fix in the academic lifecycle to get more top-flight women choosing to follow it.

Formalising success in a bureaucracy

It's only natural, when you've managed to get out of a hole against all odds, that you want to re-use the people and/or planning that made the difference. You'd be wasteful if you didn't, to be honest. Following this line of thinking, and after a small team of digital fixers managed to save the flagship Healthcare.Gov federal healthcare exchange from near-certain doom, the White House is trying to do just that.

Today they announced the launch of the new U.S. Digital Service which aims to replicates the lessons of the (relative) success in saving Healthcare.Gov with other troubled US federal government IT projects. Heaven knows that there's no shortage of potential targets for USDS to help with. The question of the moment is: can this new government team actually succeed? If so, what does success look like?

US CIO Steve van Roekel outlined the USDS role:

"This isn't going to be a group that we parachute in to write code," as Van Roekel put it in a call earlier this summer, and with perhaps the Department of Health and Human's experience with HealthCare.gov on the brain, "This isn't decending a group of developers onto the scene." Rather, the focus is going to be on helping agencies figure out where their weak points are and how to fix them.

Note that therefore the role of USDS staff isn't actually the same as the Healthcare.Gov fixers, but that might be OK as the fixing itself wouldn't scale; if you want to solve the key IT problems of more than one government agency at at time then you can't have most your staff embedded in one project, and there's no reason to think that the government can recruit multiples of the motivated team that fixed Healthcare.gov. They're going to have to strike a balance, though. They won't be able to determine the principal IT problems of an agency without spending time working with and talking to the agency's tech team. The more time they spend there, the more trust they'll gain and the better the quality of information they'll gather - but then they won't be able to help as many agencies.

The danger with any new government agency is that after a time it accumulates bureaucrats whose primary purpose is propagating their own employment and importance. Van Roekel seems to be aware of this and planning to bring in people for 2-4 year rotations. With placements of 3-6 months this may be about right; long enough for the new people to spend a placement or two with the veterans and absorb the institutional knowledge, do a couple more placements as peers while encouraging their friends to join up, then lead new recruits in placements as the veterans leave.

What's going to be interesting is to see how the USDS embeds are treated in the troubled agencies. Are they going to have the influence and effective power to remove obstructions - such as long-term barnacle workers who hoard knowledge and obstruct progress? If not, they're unlikely to be able to change much. If so, the agency's workers are going to hunker down and be terrified of being fired or reassigned. It's going to be quite a challenge for tech sector workers to get their heads around the government worker mindset sufficiently to influence those workers into getting things fixed.

Incidentally, www.usds.gov was not resolving as of posting time; I actually consider that a potential sign of success as the new team is focusing on getting operational before getting any marketing/PR in place; still, they're going to need a portfolio of some form after a few months in order to attract their new short-term hires.

Bringing the diversity of car manufacturers to Silicon Valley

I should start this blog by warning the reader of my prejudice towards Jesse Jackson. I think he's a fairly despicable human being; a race hustler who is standing on the shoulders of the giants of the US Civil Rights Movement (Parks, MLK et al) to further his own petty shakedown rackets and attempts to gain political power.

That said, let's examine his latest crusade: bringing the focus of the US Equal Employment Opportunity Commission onto the diversity disaster area that is Silicon Valley.

"The government has a role to play" in ensuring that women and minorities are fairly represented in the tech workforce, Jackson told a USA TODAY editorial board meeting. He said the U.S. Equal Employment Opportunity Commission needs to examine Silicon Valley's employment contracts.

The trigger for this appears to be Twitter's release of workforce diversity statistics (select the Twitter tab, the default is Yahoo). They show a global 70% male workforce with 50% white, 29% Asian, 3% Hispanic, 2% black, 3% mixed and 4% other. Jackson claims that this is proof that the EEOC needs to step in. Because what could possibly go wrong with that?

The gaping hole in USA Today's argument:

Of Twitter's U.S. employees, only 3% are Hispanic and 5% black, but those groups along with Asian Americans account for 41% of its U.S. users.

Wow, talk about a misleading stat. I assume "mixed" is rolled in with "black" to make the 5%, using the Halle Berry "one drop of blood" theory, but note that if you add Asian Americans in it becomes:

Of Twitter's U.S. employees, only 3% are Hispanic and 5% black plus 29% Asian making 37% total, but those groups account for 41% of its U.S. users.

Hmm, that's a little bit different, no?

Since Silicon Valley is in focus, let's look at the demographics in the Bay Area from the 2010 census:

• 52.5% White including white Hispanic
• 6.7% non-Hispanic African American
• 23.3% Asian (7.9% Chinese, 5.1% Filipino, 3.3% Indian, 2.5% Vietnamese, 1.0% Korean, 0.9% Japanese plus rounding errors for others)
• 23.5% Hispanic or Latino of any race (17.9% Mexican, 1.3% Salvadoran)
• 5.4% from two or more races
• 10.8% from "other race"

The categories aren't an exact overlap, but you'll note that whites are almost exactly represented in Twitter as in the Bay Area population. Asians are over-represented in Twitter (29% vs 23%), African Americans under-represented (7% vs 5%) but the real under-representation is Hispanic (24% vs 3%). Why is that? Hispanics in California are disproportionately over-represented in the menial jobs currently. This is starting to change a little with the new generation of America-born Hispanic kids but their parents can't generally afford top-tier universities for engineering or CS courses so it'll be at least one more generation before they start to appear in the engineering/CS student pool for recruitment.

The really disgusting thing about Jackson is when you realize what he is actually implying - that Silicon Valley engineers systematically discriminate in hiring against black and Hispanic engineers just on the basis of their skin colour. Yet somehow they discriminate in favour of Chinese and Indian engineers on the same basis - so they're racist, but very narrowly so. What Jackson fails to point out - because it wrecks his entire thesis - is that the real demographic problem is in the pool of engineers eligible for these jobs. African-American and Hispanic students are massively under-represented here. This isn't Twitter's fault, or Google's fault, or Facebook, Apple, or IBM. The problem starts at the awful public (state) schools which poor American students attend and which completely fail to give them any reasonable preparation for university courses with objective (numeric) subjects - maths, computer science, physics - that are the grounding for computer science careers. But delving into those facts might take an enquiry into unionised teaching and teacher tenure rules, and I'd bet Jesse's union buddies wouldn't like that.

The engineers I know who conduct interviews for computing firms day in, day out, are overwhelmingly thoughtful and fair individuals who strive to give any new candidate a fair go at getting hired. Even the occasional monster among them is uniformly brutal - white, Chinese and Indian candidates have as brutually intellectual an interview as Hispanic and black candidates. If Jackson were to appear before those engineers and accuse them explicitly of bad-faith prejudice against black and Hispanic candidates, they'd probably punch him.

The real problem in Silicon Valley demographics is the male vs female disparity in engineering. There are plenty of good, smart, talented women - they're just not going into engineering. Until we figure out why, we're missing out on a heck of a lot of talent. But Jackson is not pushing this angle - perhaps he's figured out that he has nothing to say on the subject and so there's no money in it for him and his cronies.

I can do no better than conclude with Jackson's own words:

The former two-time Democratic presidential candidate said he'll continue pushing the issue and has no plans to retire. "The struggle for emancipation is my life," he said in an interview. "It's my calling."

Well it's your revenue stream, at least. God, that man gets on my wick.

The importance of words

CiF poster Scott "the most" Lemieux is aggrieved at today's ruling in D.C. that puts something of a crimp in the Affordable Care Act (aka Obamacare):

Up first: an outrageous two-to-one decision by a panel of the Court of Appeals for the DC Circuit ruling against sensible subsidies that real people need, based on what we can charitably called the "reasoning" of the two Republican nominees on the three-judge panel – the opinion was written by an appointee of George HW Bush, along with a judge nominated by his son.

I do like the "play the man, not the ball" approach here, by the way. Mr. Lemieux is appalled that in Halbig vs Burwell the D.C. Circuit judges have thrown a major spanner in the works of the Obama administration's flagship Act. Since Mr. Lemieux is a professor of political science at a college in New York, you may safely assume that he knows how the legal process works and has the proper perspective to come to such a judgement.

What is this horrendous decision which has so appalled Mr. Lemieux? Let us consult the blogging lawyers at the Volokh Conspiracy:

In a 2-1 opinion, the Court held that the Internal Revenue Service regulation authorizing tax credits in federal exchanges was invalid. Judge Griffith, writing for the court, concluded, "the ACA unambiguously restricts the section 36B subsidy to insurance purchased on Exchanges 'established by the State.'" In other words, the court reaffirmed the principle that the law is what Congress enacts — the text of the statute itself — and not the unexpressed intentions or hopes of legislators or a bill's proponents.

What made the Affordable Care Act affordable for many people was that for low-to-medium incomes you could get tax credits to subsidise the (fairly expensive) policies available on the exchanges. Now the original idea was for most states to run their own exchanges, but more and more of them have used the shared federal exchange since it turns out that developing and running an exchange is fairly hard. Unfortunately, the ACA itself only allowed tax credits for insurance purchased on exchanges established by the State, which was the point of contention in this case - should the IRS be allowed to issue tax credits to people buying insurance on federal-run exchanges, which is the case in more than half of the states. The D.C. Circuit said "no, you can't apply the law as you wish it was written, you have to apply the law as it is." Apparently this approach is too radical and subversive for Mr. Lemieux and he wishes to blame the D.C. Circuit rather than (say) the original drafters of the ACA.

From the actual court decision:

Appellants argue that if taxpayers can receive credits only for plans enrolled in “through an Exchange established by the State under section 1311 of the [ACA],” then the IRS clearly cannot give credits to taxpayers who purchased insurance on an Exchange established by the federal government. After all, the federal government is not a “State,” see 42 U.S.C. § 18024(d) (defining “State” to “mean[] each of the 50 States and the District of Columbia”), and its authority to establish Exchanges appears in section 1321 rather than section 1311, see id. § 18041(c)(1).

There was a lot of controversy at the time the ACA was passed due to the very short time between it being presented and being rammed through Congress and the Senate. Democratic senator Nancy Pelosi told us not to worry about the contents of the bill at the time:

But we have to pass the bill so that you can find out what is in it – away from the fog of the controversy.

Well, now we've all found out. Perhaps a little more scrutiny at the time of passing would have been in order so that problems like the tax credits language could have been spotted before being signed into law. This is why complex laws are bad - they cause problems for everyone including those that they were intended to help.

The joys of hard drive death

The IRS (US tax service) ex-head Lois Lerner has been under the spotlight in the past year about the IRS allegedly targeting organisations for audit based on their political allegiances. Apparently Tea Party related organisations were much more likely to be targeted than left-leaning organisation. Lerner retired from the agency in September last year, but the Republican party has unsurprisingly been chasing her. Lerner took the 5th at a hearing in March, refusing to testify to avoid the risk of incriminating herself, so the investigators have been looking for other sources of information.

Of course, most communication these days is done by email, and the IRS is no exception. The obvious place to start in finding the details of Lerner's involvement - if any - would be to trawl her email. Except that this appears to be difficult:

Today, Ways and Means Committee Chairman Dave Camp (R-MI) issued the following statement regarding the Internal Revenue Service informing the Committee that they have lost Lois Lerner emails from a period of January 2009 – April 2011. Due to a supposed computer crash, the agency only has Lerner emails to and from other IRS employees during this time frame.

Oopsie. Still, these things happen occasionally. It's just bad luck, right?

The IRS has 89,500 employees. It's not unreasonable to estimate that every one of them has an email account, and most of them have a computer. Say they have 70,000 personal computers on their network. Every computer has at least one hard drive. A hard drive's average life is 2-3 years; let's say 1000 days. On average, if you have 1000 hard drives, one will be failing each day. In the case of the IRS we'd expect to see 70 hard drives a day, nearly 500 per week, failing. Hard drives failing are a completely normal part of IRS IT operations.

Given that, you put together an IT system that lets your executives lose all their emails whenever their personal computer hard drive crashes? This seems... not the approach one would normally take.

What I find interesting is an IRS note from 1998 announcing that they were standardising on Exchange:

The new e-mail package will use Microsoft Exchange Server Version 5.5 along with the Microsoft Outlook 98 desktop product. The IRS will switch over to the new system during the next 12 months

I'm assuming that by now they've done several migrations to more modern versions of Exchange. By 2009 they should have been on Exchange 2003 at least, maybe 2007. A user's emails would be in folders on replicated central storage, not just on a personal machine; the Outlook client would copy mails from the central storage to the local computer for speed and ease of access, but they would remain in the central storage precisely because personal computers fail all the time. Suppose the power supply exploded, or the motherboard shorted, or coffee spilled into the CD-ROM drive slot, or the user has to get email access out of office hours (e.g. via Outlook Web Access) - there has to be a way to get to their data when the PC is not available. The replicated storage copies the data to several physically separate machines, using a scheme such as RAID which lets you trade off the number of copies of data, read performance and write performance.

What I would believe, and I should make it clear that this is pure speculation, is that someone was deleting old emails off the replicated storage for some purpose; perhaps for perfectly legitimate purposes. They ended up deleting much more than they expected. Once this was discovered, they tried to recover the data from the daily / weekly tape backups that were almost certainly being made from the central storage. When they did this, they discovered that for the past 1-2 years the backup data being written wasn't being written correctly - taken from the wrong source, missing indexes, taken from a source that was being updated as it was being read, whatever. This was so embarrassing given the amount of money that they were spending on their storage and backups that they cooked up a story about a hard drive failing and hoped no-one would ask any inconvenient questions. Bad luck, boys!

If the details of IRS's excuse haven't been mis-reported - a possibility we should not reject out of hand - then either they have a painfully badly assembled and operated IT system, or someone is telling pork pies.

RAGE

I really shouldn't follow cases like this; it's terribly bad for my blood pressure. Let's assume that you're a law graduate training to be a barrister. You're doing badly in your exams because you go out drinking and partying every night. What do you do? Apparently, "party less and study harder" is too passé - the hip modern approach is to accuse your boyfriend of a series of rapes and assaults:

The allegations made by Rhiannon Brooker meant Paul Fensome was arrested, charged and held in prison for 37 days.
Following an 11-week trial, the jury of 10 men and two women at Bristol crown court on Thursday found Brooker, who has an eight-month-old child, guilty of perverting the course of justice. She was given bail but could be [my emphasis] jailed when she is sentenced later this month.

Could be? I'm not sure that there are the words. At minimum, Brooker should be given the same sentence as Mr. Fensome would have received given the rape sentencing guidelines which looks to be a 15 year starting point (Repeated rape of same victim over a course of time or rape involving multiple victims) with one possible aggravating factor (ejaculation) and one possible mitigation (sex with victim before offence). The guidelines for perjury regarding rape notes that "If there is any question as to whether the original allegation might in fact have been true, then there is not a realistic prospect of conviction, and no charge of perverting the course of justice should be brought" so the CPS is clearly convinced that the accusation was indeed false rather than not provable. The sentencing guidelines indicate aggravating factors (premeditated, persistent, arrest of innocent person) and indicate a likely sentence of 1-2 years.

Giving this woman a non-custodial sentence would send an appalling message to other women who falsely accuse their innocent boyfriends of rape to get out of a sticky situation. The message would be "it's worth a try - in the absolute worst case where you get found out, prosecuted and convicted you still won't see the inside of a jail." I'm hopeful (though not certain) that her potential career as a barrister has come to a screeching halt, but despite her 8 month old baby this woman needs to spend serious time in jail. Her reckless accusations were a gnat's chuff from jailing an innocent man for a decade or so, and as a law graduate there is no question that she knew the consequences of her accusations.

WAR has not been helping their case:

A War [Women Against Rape] spokesperson said the prosecution of Brooker was "completely disproportionate", adding: "Time and again we see police resources diverted from rape and put into prosecuting women instead."

First, would anyone like to point to a "Women In Favour of Rape" group? No? Then let's focus on this "spokesperson"'s assertion. Yes, the police put resources in to prosecuting women like this. They happened to persuade a jury, beyond reasonable doubt, that Rhiannon Brooker made up these allegations and tried to send Mr. Fensome (poor bastard) away for a good number of years as a sexual offender, thereby giving him a sporting chance of being stabbed to death in the shower or having boiling hot cocoa poured over him. This seems like the sort of crime that we would expect the police to prosecute, n'est ce pas? Or should the police never prosecute women for crimes where men are the victims?

God. If Mr. Fensome happened to throw WAR's spokesperson into a manure pit and I was on the jury, I'd declare him innocent and ask for the prosecution witness to be put to death. If WAR want to help women who have been raped, they can start by ensuring that juries don't think that rape accusations can be motivated simply by spite: give women who make false accusations some skin in the game by giving them a realistic prospect of spending years in jail for this kind of perjury.

Marcela Trust update: 2013 accounts

The Marcela Trust has sent in their accounts for their fiscal year ending July 2013 so I thought I'd take a look to see how our favourite salt and sugar haters are doing. For comparison, have a look at my analysis of their 2012 accounts.

A quick summary:

• Their donations this year were £300K to the Camelia Botnar Foundation, £170K to Fauna and Flora International (like last year, for their Western Transylvania work and to fund their student at Cambridge), £20K to the Nuffield Orthopaedic Centre and £7.5K to support the annual exhibition of the Society of Portrait Sculptors; these were funded in the usual way by restricted donations (totaling just under half a million quid) from OMC Investments which holds all the money that the Marcela Trust distributes.
• Nothing was sent to CASH or Action on Sugar this year; perhaps the Marcela Trust trustees are not keen on the attention they received as a result of the CASH donations.
• The 300K donation to the Camelia Botnar Foundation is interesting; I wonder what it was for? I looked at the Camelia Botnar Foundation 2012 accounts back in December and they looked in reasonable shape; their net funds had jumped from £5.1M to £6.3M. So was the 300K for something specific that the Marcela Trust wanted to set up but not fund directly? If so, what? The Marcela Trust report says that it "was made contribute [sic] to the foundation's annual running costs." We'll have to wait until December to see how this materialises in the CBF accounts and why it was needed.
• This year the Trust got £2.5K in donations and £22K in interest on funds, comparable to last year. They raised £5.6M (property rentals, hotel operating income etc) but spent £6M doing this, which is rather surprising; last year they raised about the same at a cost of only £3.7M. Where did they lose the extra £2.3M or so? Looking at the subsidiary activities trading costs, it looks like that was mostly due to extra impairment of investments (things they have are no longer as valuable as they used to be).
• Their funds had an OK year, rising £1.5M in value to £67M, about a 2% gain.
• They sold £3M of investment assets (property, presumably) but lost another £1M on revaluation of assets they held; this wasn't quite as bad as last year's £1.5M loss but must have still smarted a bit.
• They moved about £24M from investment assets to cash, nearly a mirror of last year's move of £24M cash to tangible assets (after raising £12M in loans); that loan is still outstanding in the creditors line, now due within 1 year.
• Fortunately the poor investment performance didn't stop the Trust increasing its wages paid. Wages were up about 6% overall and pensions about 19%. Dawn Pamela Rose was paid about £250K again, with £58.5K going into her pension scheme (up from £40K last year).
• Dawn Pamela Rose's QHH Limited subsidiary of OMC Investments commenced trading as a hotel during the previous financial period; it lost £15K on turnover of £1.1M this year.

I think QHH Limited must be the Queen's Head Hotel (Google is fairly definite on this link) but I'm not sure which of the eponymous establishments in the UK corresponds to this.

So overall a year which is interesting mostly for the sudden arrest in the flow of funds to CASH, a property investment performance which looks less than stellar, and a £300K donation to Camelia Botnar Foundation which did not look to be needed. Let's see what the CBF accounts reveal when they appear in December...