Posts by despairing citizen

MoD to become even more top-heavy as a result of personnel cuts

Re: Lions led by (lots of) donkeys (again)!

and as the author has previously written about, procurement by dinosaurs

Indian gov bans bulk texts as workers flee Bangalore

Get another example of Political Risks offshore

This is another example of the kinds of political risks you get by offshoring, that the consultants always seem to forget to mention.

i.e. the country has a history of relgious and political violiance that can distrupt operations.

Banking IT cowboys 'need whipping into shape by watchdog'

Re: Not an issue for regulators.

The regulators job is to ensure that the banks are fit and proper institutions to hold a banking license.

Part of that assesment in the 21st century should be are they actually capable of delivering the banking services.

It is frankly unaceptable for a quarter of the UK banking system to be offline because one bank can't adequately staff, train, equip and have appropriate BC/DR plans in place, and this really should be included as a factor, like keeping appropriate records, when considering should the bank keep it's license.

Whilst the regulator should not say what equipment should be used, they should be setting the standards expected, and auditing to ensure they are met.

Re: Where have you been for the past decade?

"It was overturned because the big banks could not compete with the financial trading firms which were not banks but were offering banking services like checking accounts tied to their customer's brokerage accounts."

and the guy that spearheaded this change is US gov legislation......

well he decamped into GoldmanSachs shortly thereafter.

obviously no conflict of interest or potential corruption there then!

How one bad algorithm cost traders $440m

Amatuer testing times

Where systems have to be tested with live feeds, you isolate the system in such a way that the usual output is blocked, (not exactly rocket science)

Was doing this back in 1998 to test what happened to large financial systems (mutli-Bn) when they thought they where working in 2015, 2025, 2035, which meant we where adjusting the inputs as well.

Would suggest that the various stock exchanges set down minimum standards for testing, and revoke the connections of any outfit that does not meet them, much the same way as PCI DSS does security standards.

RBS: June's tech enormo-cock-up cost us £125m

£125m, Ah, and the rest .............

£125m is an exceedingly low figure, and even a "bag of a fag packet" analisys by a BA would show that their indemnity costs are like to be double that.

Now add on the costs of customers walking (given recent survey RBS/FailWest/StillNotWorkUlster), and deduct that from the revenue stream.

The cost of managers being hauled up in front of the Irish government to answer questions (the ClownServatives, LibDumbs and LieBour parties don't see an issue with 25% of the UK ability to bank being offlined)

Brand damage is going to cost vast quantities of advertising budget and account managers time convinsing customer to rely on our banking systems.

personally I would be amazed if the damage is less than £300m, and would be unsurprised if it was north of £600m

So that half the IT team in scotland saving (approx £10m over 3 years), looks real good (sic)

If I was a majority share holder in the bank, I would start by firing the entire executive board, and the NEDs on the Audit committee, and appoint a brand new board with job one being to stablise the administrative systems of the bank, and job 2 to review the sign off of Risk on the downsize, outsource and offshore programmes, with a view to sacking on grounds of competance, or reassigning to less demanding roles.

RBS must realise it's just an IT biz with a banking licence

Still missing the DR/BC plan?

Lots of talk about change management preventing the problems, which is always a good approach, but RBS is suppose to have a BC/DR plan.

In this day and age it should be unacceptable for a major bank to lose mission critical capabilities for more than 24 hours.

So where was the BC/DR plan that says this part of the system has been "nuked", (in this case by operator error rather than the data centre burning down), this is how we restore it?

Re: Strongly disagree

Whilst I agree around the principal of there is no such thing as an IT project, only business projects with larger or smaller amounts of IT, in the case of our national banks, the Prof is right.

RBS is an IT company with a banking liscense, because if you switch off the IT, the bank ceases to trade, and is therefore not a functioning Bank.

A lot of managers, in both IT and Business areas, have not realised the mission criticality creep of technology, and many still think that IT is an optional extra. RBS demonstrated the fallicy of that perception.

So maybe today the "IT Project" mantra in this tech heavy world should include a second line that says, "there's no such thing as a pure business project, only IT projects with a larger to smaller business component"

Re: "A (retail) bank's business is Risk Management."

I would love to have a look at the Risk Logs and Register for the Downsize, outsource and offshore projects that RBS ran!,

I would also like to see who signed off on the corporate risk exposure of halve your change team, and run the risk of creating £300m+ in liability dents in your balance sheet.

Although I doubt the Fundementally Supine Authority has demanded these as part of a review of RBS/Natwest's suitability to hold a banking liscense.

Ubisoft assassinates Uplay flaw, denies DRM rootkit

Interesting Statement

"The issue is not a rootkit. The Uplay application has never included a rootkit."

Noted the above part of the statement, and that it was not "We/Ubisoft don't use rootkits"

Given that rootkits, installed without the expressed informed consent of the computer owner, would be a criminal offence (CMA90)

Siri sued again as Taiwan uni cries foul over patents

Re: Does anyone know what the patents actually are?

A way for big companies to block any form of innovation! (who says I'm cynical)

Given the number of computers that have voice commands on SciFi films, doesn't this lot fail prior art or the obvious to practioner tests?

Hobbyist builds working assault rifle using 3D printer

Re: good luck finding somebody skilled enough in metalwork

With all the CAD/CAM kit going these days, it does not take much effort to build the relevant tools.

Bottom line, somebody with enough time, money and a reasonable amount of knowledge can build any firearm they feel like.

the improvements in IT and manufacturing tools is merely making the time and money part a much lower barrier to entry.

Tesco in unencrypted password email reminder rumble

Iceberg - and not a Lettuce

Wish I could say I was (a) surprised or (b) it's rare....but I can't

Other examples include several Licence consultation systems used by the police, local authorities, et al to vet and exchange information on whether a person or site/shop/pub (e.g. Tesco) is suitable to be licensed (e.g. sell alcohol, etc.), and the web sites run the login on HTTP in the clear across the internet.

Think you can have fun ordering 120 iceberg's for someone, just imagine the fun you can have accessing a regulatory system pretending you're a police inspector!

Olympic athletes compete in RAYGUN SHOOTING for the first time

Re: Outraged!

Also no recoil to compenstate for.

Might as well scrap the competition, as it is now longer even an aproximate facilimy of the military skills it was suppose to be a test of.

IT departments are BRATTY TEENAGERS

Six of one, Half Dozen of the other

The guy does make several good points, and over the last 30 years I have seen IT specialists doing some of the things he describes.

However Business Managers these days are just as bad. (Previously they knew they knew nothing about IT, until the internet came, now they only know enough to not realise how little they know)*

So;

(1) Their is no such thing as an IT Project, they are Business Projects with larger or smaller technical components. (i.e. the corporate network is not the network managers personal fiefdom, it's there to make the company money)

(2)Your ability to post on Twitter, and build an access database to manage your stamp collection, does not qualify you to advise the company's best DBA on how to design a system with 15m records and 14k concurrent users. (this is a very common in my client facing roles, and I do my best to screen the local IT from the worst of these brain waves from the business managers (esp. Marketing))

*For every rule there is an exception, I have had one marketing manager on a project who could have done quite well in IT, and came up with several good ideas.

Olympics security cockup down to software errors - report

Best Value 25%?

Lets see that 25% less to be 35% short on the staff they where to supply.

For some reason if I see a tender that is massively out from that of all their competitors, I spend a lot of time digging to find out if it is becasuse they are really brilliant (very rare), or have missed lots of basic stuff (v.common)

Personally I would go with sack the people who ran the ITT, and sue G4S for breach of contract.

O2's titsup network struggles to find its feet

Mission Critical Kit vs Bonus Culture

With core infrastructure of large companies (RBS payment processing, 02 Telephony), it should not be possible to nuke the system, a suffcient amount of money and resources can easily render this possible.

Unfortunately the senior managers whoose bonus is based on cutting easily visible costs, and quite frankly have naff all ability at risk management, will cut these services to get their bonus, and if they are still around when the risk occurs, (a) they probably won't lose their job, and will (b) keep their bonus, despite how much money they have just lost their company(*)

This is why Barclay/Libor is a side show, it's being hanfled by the regulators, what needs serious consideration by parliment is the amount of the UK economy that is bet on technology services, that is not robust, and does not have an adequate BC/DR plan. RBS took out around a 25% of the abilitty of the UK to transact business, it is not unusual from other firms (e.g. 02) in it's approach to IT.

The modern economy needs legislation, that makes your IT and BC/DR as well audited as your accounts, shareholders and business partners should be able to read your company report, and see if they want to do business with you.

Web snooping bill an 'odious shopping list of new gov powers'

Cunning Clue

The cunning clue that the proposed powers are wanted for something other than the stated purpose, is that every week the "reason" changes, starts as "needed to combat terrorism", and then mutates is way through the 4 horsemen of the computer appocolypse.

It just like watching a child who wants something, "I need it to do my school" work, when actual what they want it for is to play games, and every time you ask, the stated reason mutates.

The only thing is that the children are usually more creative and inteligent in their creation of excuses than the ministerial dummies front this.

Re: United KINGDOM

The clue is not in the name;

Practically every single liberty UK subjects enjoy, was created by unelected monarchs and lords (e.g. Trial by Jury)

Practically every single liberty that has been taken away, or attempted to be stolen, has been via the House of Commons. (e.g. scrapping of double jeopardy by previous goverment)

I would also remind you that England'ss one and only military dictator was an MP (Cromwell), whoose rule was so appalling that the King was invited back, as a better alternative to the tyrany Cromwell inflicted.

Top spook: ISP black boxes NOT key to UK's web-snoop plan

Military (UN)Inteligence demo'd again

From the uninteligent service.....

"If people take greater efforts at anonymisation, it could become a problem... but I'm satisfied by the techniques being developed. Many workarounds can be defeated... we are not proposing this law on the grounds that it will provide 100 per cent coverage of the communications data in this country."

Means the following.....

"If people take greater efforts at anonymisation, it could become a problem."

where people = criminals with a higher IQ than the idiots proposing this

"provide 100 per cent coverage of the communications data in this country.",

except for people defined as above, therefore, 100% coverage of honest law abding citizens, which can then be used for mud slinging by AC at the Cabinet Office when the civil servant proves the government is lying, or sold to NewsCorp by bent coppers.

And all for a mere £2Bn, if it runs to budget, so make that £6Bn to £8Bn in real life.

Re: VPNs to be banned in the UK.

closely followed by as many companies that can, decamping their IT and core business admin out to countries where your price sensitive information can't be snooped on by every bent copper in the Met, without any form of monitoring.

Yet another "tackling unemployment" initative curtsey of the House of Clowns.

Cerner questions Epic win for Cambridge patient records

Best Value does not equal Cheapest

The procurement process for the public sector requires you to get "best value". A lot of people (including suppliers) have taken this to mean cheapest, it is not.

For a patient record system (or any other public sector system betting life and limb), quality of system, ease of use/training (less staff mistakes), and projected levels of support from the supplier (i.e. do they forget you after you sign the cheque, likely to be bankrupt, etc.), should all score higher than the initial contract costs.

You also need to watch for the little sods (sorry suppliers), putting in low ball initial signing costs, and then loading it up for renewals and support services. (for example on year 2 of the contract, they get to pick a large random number and call it a liscense fee increase)

Europe's prang-phone-in-every-car to cost €5m per life saved

Nice idea - shame about the details

This is one of those ideas that is good in threory, but fails in the real world.

1. Assumes the comms survives the crash

2. Assumes the cell net works in the area you're in (try getting a mobile reception in rurual river valley)

3. Assumes the system can get a GPS signal (big buildings in cities, tunnels, etc,)

4. People will assume the auto call went out, and hence not call it in themselves

5. Defects and Faults causing false-positives, or not calling when they should

Yes it could in theory save a life, I can think of two examples where it would have, but personally I think the above down sides would actually create a net negative, be having ambulances responding to wrong locations, and people relying on system that has ceased to function.

so 10 out 10 for a good idea, minus a few hundred for practicalities

BAE proposes GPS-less location

Non-Jamming/Spoofing NAV system = Inertial NAV

Inertial Nav has been around for years, yes you can screw the set up(*), but there is very little an opponent can do subsequently to screw with it.

(*) - see FAA Harrier Pilot of ZA176 for why he had to land on a container ship, much to the financial happiness of the container crew ($1m+ in salvage)

'Inexperienced' RBS tech operative's blunder led to banking meltdown

Re: no backup of the schedule?

"Why, precisely, does one mess-up by one employee in front of one computer put your ENTIRE BANKING SYSTEM out of action, nationwide?"

it's all about management controls.

Whilst sometimes it is not possible to build in management controls to prevent a single operator nuking a system (but many times they are, but the can't be arsed to build them in), in this situation you use a checklist, do not think, do not use initative, follow the check list to the letter.

There is a reason pilots use them.

They work just as well for operations and application support.

and if they can't follow a check list, you shouldn't have hired them for that job.

Brussels could 'clash' with London over UK snooper's charter

The problem is not dumb terrorists, it dumb MPs, and their "advisors"

The Home Sectary is a politician, hence there is an expectation of an inability to do anything other than run mouth without thinking (see Francis Maud, panic the nation and endanger life knee jerker earlier this year)

However the idiots are suppose to have Sir Humprey clones advising them to stop the grossly stupidity ideas. Unfortunately the ACPO, et al seem to lack brain cells and the ability for critical thinking as well.

This act will DECREASE public safety, by diverting £2bn of assests to fund a boondogle rather than fund real intel and surveilance activities.

It will have police officers running down suprious leads, rather than focusing on real crime.

The terrorists will keel over laughing every time they clone someones identity (where do the thugs get most of their money, ah, ID and online fraud!) and use it to get a mobile phone, then ring all the numbers they know are blown, and watch the headless chickens of state security run around shooting electricians on tube stations, and pulling a SWAT on 60 year old grannies.

Winston Churchil once said the best argument against democracy is a 5 minute conversation with the average voter.

Today he is wrong, it's a 5 minute sound bite from the average MP.

Re: Waffle

the system would prove useful for combating certain forms of crime;

1. Police officer e-mails and other contacts with news of the screws staff selling info

2. number and length of contacts between ministers and newcorp executives on the run up to and during comercial bids facing government regulation.

I support having the MP's contacts posted on a public web site?

NHS fights record £325k ICO fine after clap records appear on eBay

Where to start

So no clear ownership of the data management process

Hired "fred in a shed" to carry out work involving S2/DPA98 data

Didn't write a proper contract (therefore probably no transfer of liability and duties with the drives)

Did anybody check that the end party has the appropriate procedures and equipment to dispose of the drives?, do they have the appropriate professional indemnity cover?

There are a lot of people in the NHS with the word "manager" in their job title, yet to meet many people in the NHS that I would call a Manager.

Re: so let me get this straight

The NHS has lots of money, and it is the largest single employer in Europe.

What it lacks is qualitity employees in managerial posts (i.e. it needs less managers, and more management)

It is also worth noting that all NHS IT jobs come with the tag "must have previous NHS experience", despite the track record of failure in NHS IT.

You also end up with managers sending SHOs rather than consultants ("to save money") to see new cancer patients at a comunity hospital (i.e. no backup), and then wonder why they end up in court with the next of kin, and a bunch of barristers.

Consultants maybe expensive, but their hourly rate is less than a barrister! - No Brainer!

So the problem is not number of bodies or size of budget, it is simple competence

Re: £325k?

The maximum fine for those regulated by the ICO is £500k, the government probably guessing who was going to be picking up most of the fines chickened out, and did not set it to the FSA standard.

The FSA gets to think of a suitably painful number and demand it as a fine. The most similar case to this was the Nationwide stolen laptop, which earnt them a £1.4 base fine (reduced because they reacted quickly to plug the hole)

Re: Ridiculous money-go-round

The purpose of the fine is to make it painful for the budget holder, so that;

(a) they take action to aviod being fined

(b) that heads role, and the next person in charge has his mind sharply focussed the next time somebody suggest tossing out some disk drives

Personally I would like to see directors and officers in the NHS held personally accountable for the fines, but short of that this is as good as it gets.

PS. Nationwide got a base £1.4m fine from the FSA, when the data was stolen from a locked house

Re: Excuses...

If the appeal ends up in front of a judge, the cost is going to be a damn sight higher than £325k.

They don't have a case, they have clearly failed to understand, let alone comply with the relevant legislation. I can see a judge awarding costs on this for NHS stupidity, and wasting time appealing.

Please get the twit CEO out of the office whilst the trust still has some money left.

Hard disk drive prices quick to rise, slow to fall

Corporate Suicide

HDDs are a dead tech, still some twiching in the corpse, but the writing on the wall is that they will be fully replaced by SSD's once the price-capacity-performance mark hits critical mass.

If you are a HDD manufacturer, the only life extending option is to make your old tech HDD as competative as possible versus SSDs, whilst you get your company into a new market. This is NOT acheived by having over inflated prices, which will only make business make the jump to SSD storage that much faster.

For further details on brilliance in management decision making, please consult with the board (former) of Kodak or Marconi

Virgin Media wipes out websites with routing blackhole

Re: Looking forward to reading the litigation

Read the Unfair Contract terms rules in the Consumer Contracts Directive'99.

Just because you put in the Ts & Cs that they must surrender their first born, does not make it stand up in court (just like most of the weasle words you find in IT software and services contracts)

The unfair terms applies to personal customers.

The BI case would resolve around the same logic that occurs, when somebody digs up and blocks a road to a shopping area, without authorisation, all those business get to present their lost earnings for the duration to the fool with the JCB and cones, except in this case it would be a fool with a keyboard.

Note they would not have to be VM customers themselves, they just have to prove how many sales they would have taken from VM customers on average during the period of the outage, and claim that loss.

Looking forward to reading the litigation

VM have a couple of problems here, and I look forward to reading the litigation that may result;

1. Failure to provide service to paying customers due to their actions and inactions;

2. Loss of Business for those business that virgin customers were prevented from using by the actions and inactions of VM.

On your marks, get set, litigate...........................

UK High Court split over Twitter airport bomb joke

Re: Advice for his legal team

Or ask them when Francis Maude (a government minister) is going to be arrested and charged for inciting the entire UK road using public to break the law, via multi-national media outlet based in England & Wales.

Or is there a double standard in English law!

UK cookie law compliance takes effect today

New Definition of Informed Consent at Reg and BBC

"If you continue to use the site, we'll assume you're happy to accept the cookies anyway."

Reg and BBC obviously have a new definition of informed consent!

The relevant item from the ICO guide;

"The Regulations require that users or subscribers consent. Directive 95/46/EC (the Data Protection Directive on which the UK Data Protection Act 1998 (the DPA) is based) defines ‘the data subject’s consent’ as:

‘any freely given specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed’.

Consent must involve some form of communication where the individual knowingly indicates "

their acceptance."

Not no action = consent

BUZZZ, TRY AGAIN!

ICO: Managed to comply with Cookies Law? Go help the other kids

Optimisim?

"The Information Commissioner's Office (ICO) wants public sector bodies that have made their websites comply with EU cookie regulations to share their knowledge with others."

Okay, now find me a public sector website that >fully< complies with the directive!

Office 365 hard enough to penetrate US government

For further details on the quality of US Gov security standards

please see wikileaks

ICO mulls stiffer probe into Google Street View Wi-Fi slurp

Re: They've actually broken another law.

This is one of those wonderful wooly "intent" clauses.

Until somebody takes a case, and some clarity is added via case law, it will be open to interpretation.

However in my personal opinion, google would have difficulty trying to put themselves into the fudged gray area on this, as quite clearly their street view car was not the intended receipant of the e-mail etc. They deliberately went out to collect it according to the FCC.

Welsh NHS fined £70k for patient psych file leak blunder

Re: Another blow to the public.

"Bow unto me, for I have shared my medical history online!"

that is the choice that the law makes clear, you the data subject can share your information with anyone you choose......but.......NHS employees, et al that hold your information in trust are not allowed to be careless with it.

Re: Title

DPA98 has been around long enough that everybody by now should know it is media agnostic.

So yes, losing those clay tablets holding the patient records for a living person is covered by the ACT.

Re: Who gets the £70k?

The point is the budget holder (NHS) got whacked with a number big enough to make the managers take notice the next time somebody tells them they need to do something to secure their data.

i.e. X is cheaper than another £70k fine.

David Willetts: UK firms need to 'fess up to security boobs

Computer Misuse Act 1990

Has anybody ever tried explaining to a senior police officer what is covered by CMA90.

Given the police and cps are barely aware the law exists, let alone enforce it, why should any business in the UK take a blind bit of notice of some government lacky getting sound bytes.

If the government are serious, then (a) update DPA98 to require disclosure, could be done in 48 hrs if they want.

Personally I think we should go the californian way, mandate discolsure, and update the companies act to require PLC's to include a IT risk statement in it's annual report. Then see how seriously the board take security.

Theresa May: No emails sniffed in web super-snoop law

Real use of monitoring system

This is to enable the prime ministers press secetary to dig for dirt when a citizen or civil servant has the audacity to point out when the prime minister is telling lies (e.g. the WMD report, and the mud slinging from an AC close to the prime minister)

Now instead of having to hunt for mud and rumours, they will be able to access all at the touch of a button, and possibly sell it to their form boss and staff at places like NewsCorp.

Given the existing surveilance powers have worked adequately well since 7/7, as demonstrated by the fact that the only victim of a terrorist related incident in england was a law abiding citizen killed by the Met screwing up, I see no logical argument or evidance for more powers.

EU-US name-swap deal actually gives passengers MORE privacy

Re: More Seurity Theatre

The DHS is only interested in security that occurs in air conditioned air ports.

They don't chase crew details for vessels crossing the line, and the state of oregon (360+ miles of coast), had 1 part time state trooper patroling the coast road, you could literally land an infantry division, and they wouldn't know.

this all seems more like make work activity for job and budget justification, than secuirty thearter, where the assumption is the person proposing it is dumb enough to believe it improves security.

CSC axes another 640 UK IT workers

Re: Cost Savings

Outsourcing has it's uses;

1. gain economies of scale (small 100 man insurance company outsources infrastructure yes, NHS or major comercial firm no)

2. gain access to specialist skills or services (e.g. outsouce security services, yes for most non trans-national companies, no for government and major corporates)

3. retain strategic staff on critical functions (e.g. doctors treat patients, not clean floors), basically ditching the donkey work onto somebody on a lower pay grade, but you need to check (1) first

Apple sued for every touchscreen device by Flatworld prof

Prior Art Anybody

I remember having to use touch screens on laserdisk based training back in the early '90s.

The gesture stuff is blindingly obvious to anybody that see a touch screen.

I'm sure there is earlier research on this from the '80s (my memory not so good these days!).

So how did he get a patent for something that was obvious and prior art?

at least it makes a change to the US prat office handing out patents to apple for blindingly obvious and prior art material.

Blighty slaps £100m spending cap on govt IT projects

Re: £100m?

There is an assumption in your statement....

"Why does a database system for the NHS......"

it is never A (singular) system, it's usually 460 systems and working practices which they attempt to stuff into 1 (or 5) systems (e.g. magistrates court case management project)

At which point the complexity factor is now 460^460, not 1

Until national projects are "National", we will still have 460 systems, or 1 expensive defective bug riden system, that is either late and/or cancelled.

Re: So..

OR

you suddenly have 120 NHS IT projects of £100m each, instead of one £12bn project.

...

see this is the £100m project to deliver patient records in Redhill, that is the £100m project to deliver patient records in Reigate, completely different project scope, as defined spatial extent of each project's terms of reference.