Arjen's blog

The Last HOPE

Just finished my talk at the Hope conference about the national Dutch open standards / opensource policyplan. Hope stands for Hackers On Planet Earth and has been a bi-annual event since 1994. HOPE features presentations on a range of (IT) security related topics but also hosts all kinds of techno-creative workshops and lectures on the social relevance of technology. For a full listing see the conference site. Video's of the talks will become available in the future.

Because the mid-town Manhattan hotel just across from Penn station in New York may be demolished next year it is unclear if there will be (a) hope after this one. Because of this, and a certain facination with morbid themes, the conference organisers are calling this 'The Last Hope', refering both to their conference and the state of (digital) civil liberties in the US.

Cnet has the first coverage on the event.

My slides are here in ODF and PDF. For more background links and video see the 24C3 page (Dec 2007 talk in Berlin) and my blogpost about LinuxTag (May 2008 Berlin).

Conservatives want opensource

Conservative party leader David Cameron held a speech at the National Endowment for Science, Technology and the Arts on April 3rd. Aside from the usual criticism (not all undeserved) at the current government he talked about the network society and bottom-up collaboration enable by ubiquitous access to IT. He (or his staffer) had obviously read "Mavericks at Work: Why the Most Original Minds in Business Win" by William C. Taylor and Polly G. Labarre. And a good thing too since it is filled with good examples of how to innovate by sticking your neck out and doing things differently.

About three quarters through the speech Cameron very explicitly stated that his government, if elected, would actively seek a greater use of opensource software and mandate the use of open standards for public IT systems. According to him this will enable faster innovation in the public sector while avoiding repeats of the very expensive NHS disaster.

When things like this are being stated by a conservative the idea has arrived. The other political parties will have to follow suit or be left in the dust by the conservatives. I think these are really good ideas and I know they are practical because I advised the Dutch government on a policy plan (full English translation here) last year that was adopted by parliament last year and is being implemented now. Since the publication of the plan that has been a remarkable change in the relationships between many government institutions and their usual software suppliers. They customer is re-taking power by forming interest groups and re-defining what IT-vendors should actually deliver (instead of just waiting what vendors want to sell them). Norway has a comparable policy and France, Germany Italy and Spain are taking concrete steps too. Below an example of the effects such a policy has had on the quality of healthcare and education in the south of Spain:

More about my work on open standards and opensource here.

A tale of two elections

There were two elections on my news radar the last two weeks. One in an African country now rapidly sinking into an economic crash and possible civil war, the other in the heart of the civilized west; the OOXML election by ISO standards body in Geneva. Aside from the locations and prices of hotels for journalists the differences were few. Bribery, fraud and intimidation were applied to achieve a specific outcome, never mind what the majority wanted. In the OOXML election even the standards organizations of proper democratic countries like Norway and Germany were unable to withstand the well-oiled lobby machine of the worlds most convicted software monopolist. In the Netherlands Microsoft was actually a member of the committee and prevented a committee consensus. So instead of voting against the standards, as 21 out of 22 members wanted, the Netherlands voted 'abstain'. The list of irregularities is endless but try some of the links above to get an idea.

To quote an ISO insider: "“OOXML’s BRM process is irretrievably broken; complete, utter, unadulterated bullshit”" (Tim Bray). The ISO process is dead and that is bad. Even though ISO was far from perfect it's open process did help many nations to agree on thousands of standards on anything from steel manufacturing to surgical gloves. These kinds of standards are crucial for a globalized high tech society.

It would seem that those in favor of the OOXML standard (Microsoft and a few of it's partners) did not have so much confidence that their 6000-page specification would make it to ISO standard status that they trusted a transparent en democratic process to take it's course. There way of treating the process was much like an African dictator with a chest full of medals. Utterly lacking in legitimacy but high on power as a consequence of an unlimited bribery budget and a willingness to bully anyone in the way of their goal. If they were not so much trouble you'd almost feel sorry for them.

Microsoft is of the opinion that everything went fine. Neelie Kroes and the EU have a different view of the matter. I feel another mega-fine around the corner. Not that any of this matters a lot to the fastest growing parts of the world. Brazil, China, India, Iran voted no. They represent a big chunk of the global population (as opposed to yes-voters such as Malta). If I were an applications vendor I'd make sure I stay ODF compatible. Several countries such as the Netherlands and Norway (that is now appealing their stolen vote) have already formally chosen ODF as the document standards for government. Others are looking to follow this lead. It's not entirely clear what Microsoft has achieved by gaining the ISO label. The governments that already choose ODF are not going back and Microsofts well documented behavior is not going to make then many new friends.

The EU appear to have been investigating the OOXML ISO certification process for some time now. Documentation from countries with where very clear breaches of protocol occured will strengthen the case for further antitrust investigations and possible additional fines or other measures. The victory of OOXML may turn out to be very costly indeed. And any credibility of OOXML as an 'open' standard has already been severely damaged by the deluge of reports about bribes, fraud and other forms of misconduct by Microsoft over the last year. A Pyhrric victory if here ever was one.

Desktop mono-culture for the Dutch

The Dutch national government is proceeding with its new implementation of 'GOUD' (Gold), its new plan for a 'standardized desktop' for ministries and other governmental institutions. After the much publicized new Dutch National IT-policy of last autumn this might sound wonderful. It's not.

The problem with the 'standardized desktop' is that it uses very few real standards. Instead it uses products and pretends they are standards. The difference between 'standards' and the idea of 'standards products' is widely misunderstood, often confused and this is where projects such as 'GOUD' go off in troublesome directions.

Standards are things like Open Document Format, HTML (the programming language of web pages), LDAP (a protocol for defining access-control on a network) or TCP/IP (the low-level network protocol of the Internet). What all these things share is that they are not owned by a single entity. They are a formalized form of knowledge about how to achieve certain technical objectives. This knowledge can be used by programmers to build tools that actually do these things for us. This means that there will be many different, competing, implementations of the standards that can inter-operate. This diversity fosters a working market and ups the quality while lowering the price (often down to zero).

'Standard products' on the other hand are, by definition, products and generally owned by private corporations with a profit motive. Standardizing on a product is essentially creating a mono-culture of one type of product, making yourself totally dependent on the vendor of that product. In the case of desktop computers this is extra problematic because there exists a de facto monopoly in this market. Creating a mono-culture in a monopolized market actually re-enforces the monopoly, the exact opposite of the aims of the adopted policy plan.

The Dutch government (or any other for that matter) should not work towards a 'standard desktop' but towards open desktop standards. This is precisely what the Dutch parliament unanimously requested from the government in 2002. Open standards, such as the ones mentioned above, allow computers of many different types and the people using them to communicate.

The Internet is a network of billions of computing devices made by thousands of different vendors and these can all communicate through open standards. Because of this I can e-mail other people without having to know anything about the computer they use. As long as we all agree to adhere to the standards information sharing is possible with a variety of systems and products. Open standards make this possible and should be the cornerstone of any governmental IT-architecture.

I've had many conversations with civil servants on this issue over the years and I conclude from these that the vast majority of them have no conceptual understanding of the difference between (the use of) standards and product mono-culture. In 2005 I was speaking at the Ministry of the Interior to a civil servant who enthusiastically talked about the 'standard' desktop they were developing for the entire government (350.000 desktop in the Netherlands). When I asked him what standards they were using he responded with a list of products: 'this version of an operating system, that version of a word processor', and so on. I tried not to cry. I really did.

In the 'Gold'-documentation (yes, the project name is a gift to punsters) the same way of thinking is pervasive; in order to collaborate, all civil servants need to use the exact same software products. I call bullshit. One of the primary recommendations of a counter-expertise report was to replace product-specific standards by open standards. This would enable interoperability with a variety of systems in the future and thus free the government of its dependence on a single vendor. This remains one of the primary stated goals of the national policy set by the government and applauded by parliament.

I can imagine how 15 years of vendor-lock-in-by-standards would lead people to believe computer systems can only share data if they are all supplied by the same vendor. This is however not a law of nature but a symptom of a badly functioning market. It is a problem to be solved by making a policy plan and sticking to it. The national action plan obliges the government to actively seek solutions to the problems of interoperability by the mandatory use of open standards.

In a letter to parliament the responsible minister for the 'Gold' plan claims two things:

1. With the new 'standard' desktop civil servants will be able to collaborate better. It is not clear why they cannot collaborate now. Don't they all have e-mail and a phone? What 'collaboration' and 'better' means in this context is never defined so it's kind of hard to verify this claim.

2. By implementing a mono-culture of Gold PC's the cost of systems maintenance and administration will be reduced to a level that will compensate the cost of procuring and implementing them in the first place. Not that this claim requires a detailed understanding of the existing level of cost.

MPs I work with will be seeking freedom-of-information acces to all relevant documents pertaining to this project from 2006 onwards. I'm looking forward to being proven wrong but I'm not holding my breath.

Public Transport card fully hacked

What experts foresaw last December and the Dutch research institute TNO denies was possible in their recent report has been done. The deepest level of data-encryption on the NXP Mifare RFID chip has been hacked. Cash from cards can now be copied to other cards through cloning and that makes this system utterly unsuitable for serious applications involving real people and real money.

But this is essentially old news. The more interesting news as far as I'm concerned is the fact that TNO was immediately re-hired by the company implementing the card system to do more research on the validity of the hack. You have to wonder what the thinking is here. This company dropped the ball on at least three separate occasions in this area so why do they get another chance to write a big rapport to claim 'there is no problem' ? And this is not the first time, on the sensitive subject of voting computers (now banned in The Netherlands) they also kept telling us 'all is well'.

If you merely want a paper to reassure yourself just ask the secretary to print out a pretty picture from the Interweb with a caption that says 'everything will be ok'. That's a lot cheaper then hiring a company like TNO, and apparently just as valid.

Does TNO just write down whatever the customer asks of them or do they really not know any better? Either alternative is troublesome. As an important expert-adviser to the governments we should hold TNO to a higher standard. When faced with an impossible request from a client they should respectfully decline the job explain that the client's request is either technically impossible or not in line with laws concerning citizen privacy and such.

Our government (and parliament!) allowing such organizations to indirectly guide technology policy is a real problem that will continue to cost us dearly (in real money, privacy violations, theft and missed technology opportunities).

Next up for big IT-projects is a road-toll system that should allow for more flexible costs of (pay-as-you-go) owning and using a car. Hopefully it won't be as insecure as this project, that could be expensive for government or the citizen (or both).

Tomorrow there will be a meeting in parliament on this matter. The independent experts (the ones that got it right from day 1) have decided to boycott this meeting since they are not allowed access to the 'secret' paragraph of the most recent TNO rapport. They wisely refuse to legitimize more 'security-by-obscurity' bullshit.