Posts by Doctor Syntax 42414 publicly visible posts • joined 16 Jun 2014
In my first venture from the world of science into IT the shop was mostly VAX/VMS. The machine room was occupied by two operators sitting side by side watching two terminals. The terminals were displaying apparently identical streams of VMS messages. Both operators were called Simon. Looking back, that seems scary.
"And who gets to decide which laws are unjust?"
AIUI it was a matter of him seeing just laws being broken.
If you saw a few guys drive some earth moving machinery up to a hole-in-the-wall ATM and use it to separate the ATM from the hole, dump the ATM in a truck which they then drove off at high speed would you a) report a possible theft of the ATM or b) decide you were some low-level guy who probably didn't have the big picture & do nothing?
What happens over a period of a few hours & days is weather. Over a few months its a season. We can discuss these sensibly. We can even look back over a year & decide that it was wet or dry, warm or cold. What we lack is a terminology to describe longer periods, up to, say a century or two; the kinds of interval that get averaged out to plot real climatic change.
"Another should be that the plaintiff should only be allowed to sue if the patent they possess is in active use by them or by a contracted designee (like a licensee)."
But if the inventor has a good patent and is trying but has not yet succeeded in finding a licensee then it's a free-for-all for anyone else to start exploiting the invention as neither of your conditions has been met.
Even if the second domain migrates away the uncleared data is still there. In fact there might now be uncleared data from two domains. What happens if a user of some other domain hosted there tries to email either of these domains? Good housekeeping should have removed the data when the domain expired or was moved.
I'd had enough & left them before they announced this migration. Frankly, I'm not surprised. But at least it's stopped them spamming me about renewing a domain they no longer manage.
One worrying aspect about their service turned up during my migration. I'd allowed as testing domain to lapse & set it up elsewhere. That was the first to be transferred to my new provider. Attempts to send email to it from the domain they still hosted were bounced by them and raising tickets had no effect. Emailing from anywhere else still worked. Clearly having once had the domain they seem disinclined to accept anybody else can host it. It seems to be of a piece with their spamming. The worrying aspect was that if this was SOP for them any current customer wouldn't be able to email any ex-customer. Possibly, just possibly, they'll have failed to migrate all this old baggage.
Whatever happened to DR services? Instead of having spare premises of your own you paid an annual contract to a company that had such premises to be used by their customers as required. The last few places I worked were warehousing & manufacturing so that sort of thing wasn't really feasible. But for offices it ought to be cheaper than having your own DR suite. Plus the service company should be experts in setting up the premises for a customer so that takes some of the load off the BC team.
For the warehouse business & for previous jobs we had DR contracts for IT which entitled us to annual tests. The first test, & maybe the second, can teach a lot about how your backups are organised (i.e. if the system backup tapes had been organised better we could have started the database recovery much sooner).
Following the link in the article I came on this statement: "Careful legal and security assessments were conducted to establish whether the services were suitable for use at the official security classification in government."
So who would pass them as suitable for security classifications. Read further and all is revealed: "We are operating a “yes-first” approach to open internet tools. This follows guidance from GDS on using these tools to help Civil Servants to be more productive. Web access is open to most services, and blocked where there is an established threat rather than by default. On devices (laptops, phones, tablets) we provide a basic checking service before making apps available for users to install. This makes sure that the applications are trusted, compliant and have an appropriate level of security for use at OFFICIAL.
Applications our users are actively using include Evernote, Trello, Workflowy, Twitter, Eventbrite and many more."
GDS. That explains it all.
They don't seem to know when the breach happened, just that it was before April so the monitoring may be a lot too late. Also, if this agency was responsible for recruiting then they may well have lost data on unsuccessful applicants, not just current & former employees; that doesn't seem to be being addressed at all.
I had 3 valuations done, mostly for insurance, when we inherited this house from my mother. One of them commented on an Artex ceiling, clearly not having seen the lines running across it every 2' or realised that they were the joins between the textured wall-paper. He also commented on the polystyrene tiles in the porch; clearly he hadn't come across the high quality mineral fibre tiles before. (No, mineral != asbestos. I know where the asbestos is, it's in the soffits sealed by plenty layers of paint & I'm not going to disturb it.)
One of them gave conspicuously lower valuations then the others. I'm sure they'd have been delighted to have put it on the market for me. I think it would have been sold very quickly & reappeared at a higher price but with half the garden separated off as a building plot. But back in those days estate agents occupied the place in public esteem now held by bankers.
"All of this is possible, what it takes is political vision and the will to follow it through. Having a proper understanding of delivering public IT systems and being able to properly run procurement and contracts would help as well. Sadly successive UK governments seem to be unable to do any of these things."
Did the Estonian govt do this in house or farm it out? Farming it out here would involve the usual suspects whilst doing it in house would bring on panic attacks due to having to recruit people who know what they're doing.
I think the previous A/C post has dealt with the numbers to a large extent.
As to your point about there being plenty of criminals about; until someone comes to police notice they can operate undetected for a long time. Perhaps that should be some reassurance to us that surveillance isn't all-seeing, or at least all-understanding. But that doesn't justify lack of due process.
@A/C
I gather from your explanation that you have experience at the sharp end and you may well be correct that this is not excessive.
However my view, and I'm sure many here share it, is that as things stand there is no due process in place that corresponds to a search warrant. In fact, it's worse; with a search warrant, unless the premises are unoccupied, the suspect parties will be aware of the action and could even challenge the warrant, is only in retrospect. Although some queries will be made in respect of a seized phone in many (?most) the subject will be unaware.
I think two things are needed to ensure that this is done right.
The first is that authorisation be taken out of the hands of a senior officer or minister - I cannot be persuaded that this is due process. It should be done by a disinterested party such as a magistrate or judge on the basis of reasonable suspicion.
Secondly there should be an oversight authority to review the results. Each investigation should, after a suitable interval, report the proportion of the requests which resulted in significant information. Investigations yielding an unexpectedly high proportion of negative results should be required to explanation by the investigation team. The authority should be responsible for publishing an annual report summarising this and providing more detailed feedback to the individuals who authorised the original requests - in part this would be to discourage regulatory capture.
A proper review process would require much more detailed information from the Police. For instance in the report referenced in the article only one force, Humberside IIRC, provided a breakdown of the types of crime suspected. One category was traffic offences. I'm guessing these would be suspected texting whilst driving or the like. If requests are made on the basis of reasonable suspicion, say a report that someone was seen doing this, one would expect a high proportion of the requests would produce evidence to support the suspicion - but not 100%. Sometimes the suspicion would be reasonable but mistaken and the result of the request would be to clear the suspect. Clearing an innocent person is as important a result as providing evidence of guilt in a criminal investigation. If, however, a force were to produce a lot of negatives in such a category the oversight authority would have to look at the possibility that the traffic officers were conducting fishing trips whilst the same level of negatives in a serious crime investigation might not be out of the way and investigation of seized, suspected stolen, mobiles would have yet a different expected level of negatives.
"Suddenly 700k requests in 3 years starts to sound not so many...this is not casting a net far and wide, but does 3,000 active investigations per year sound that unreasonable in a country of 60 million people?"
It's not clear whether the 700k are requests, including repeats, for single phones as you assume. Looking at the PDF the table for rejections has a footnote against Cheshire Constabulary that the units reported are batches which may contain up to 40 phones. If this is the basis of some of the other reports but not documented as such then the effective number of requests could be much higher.
Happy to help. Two words: "due process". It's the difference between living in a liberal democracy and living in a police state. We're just about to celebrate the 800th anniversary of its being part of English law. It seems that the way chosen to celebrate that is to remove it.
Re ignorant & clueless. I spent many years dealing with terrorism in N Ireland in the 70s & 80s. What are your qualifications in this?
I think we have two definitions of dark age here. AIUI modern historians apply it to a time for which we have few or no sources to tell us what happened. From an English PoV Britannia dropped out of the Western Empire in the early C5th and the external forces at that time were German. Without the Imperial administration only the Church would have been in a position to provide any links with the continent likely to have resulted in surviving documents and the British Church seems to have lost contact before the end of the century. So in these terms the dark age started in the C5th which means that although we know that the Anglo-Saxon settlement followed we have no good account of how it came about. In fact there was no prospect of any records from the Anglo-Saxon side until they were Christianised which mostly fell to the Irish rather than the British (Welsh) Church.
Contact with Rome started to be re-established about 600AD with Augustine's mission & I suppose we can consider it completely established with the Synod of Whitby in 664AD so we have a period of about 200 years with little or no recorded contact with the Mediterranean and for which there was very limited contemporary evidence.
With Bede & Alcuin a recovery was definitely under way. Under Alfred in the C9th there was a well organised administration which, like the Roman, used writing and had a silver coinage so access to gold was of less significance.
As to recovery starting in 1100 an elderly Englishman looking back at that time would have concluded that far from recovering, and Romanesque cathedrals notwithstanding, things had got much worse in his lifetime. And his grandchildren, during the two decades of the Anarchy, would think that they had got worse still.
@AC
You're quite right, of course, in that all these things are intrinsic to what they're ostensibly doing. But you'd require some restriction to say they're limited to just providing that specific service. And look, there is a restriction:
"The rights you grant in this license are for the limited purpose of operating, promoting, and improving our Services, and to develop new ones."
So does that seem OK? Look carefully. In my first paragraph I said "specific service". In the restriction service is now in the plural and not even restricted to what currently exists. And promoting is added to what's allowed and that isn't in your list of what's reasonable.
