Intercepts for Facebook etc?

Computerworld seems to have woken up to this issue which has been around the privacy community for sometime.

The Obama Administration is reportedly considering a statute that would make it easier for federal authorities to intercept communications over services such as Facebook, Skype and BlackBerry -- an idea that's stoking anxiety within the privacy community.

The debate includes worthy noises about the need to eavesdrop on terrorists but does not address the trust that gets placed in the government agency.

For those of us outside the US whose communications are incidentally caught up in US service providers like Google, or Skype there are another set of considerations.

• Does every tin-pot government agency in the world get its own feed from the communications honeypot?
• Are we going towards a 2-level communications regime (inside and outside US regulation)?
  

• While end-end encryption inherent in RIM's BlackBerry defeats the eavesdropper, it is easily identifable that encryption is taking place and could lead to the assumption that the parties involved are 'evil' rather than simply private.

Those interested in privacy rights would do well to advocate end-end encryption of every communication to make wholesale eavesdropping ineffective until encryption scheme breaking moves forward a few more generations.

UPDATE: An expert view here from Bruce Schneier.

Security Barriers are not Enough

Lauren Weinstein commented reasonably on the Alleged Snooping at Teens' Data by Google Engineer . Yet again we are shown that technology is no match for the evilly disposed or simply stupid. You do not have to be a conspiracy theorist to understand that there is a lot of sensitive information flying around the internet or that by collating seemingly harmless data, sensitive information can be reconstructed. Points of concentration in the network (your ISP, Google, Bing and the like) increase the threat simply through the quantity of data available for analysis. Network security, database security and the strangely titled "Site Reliability Engineer" have fairly free range to see controlled information in order to do their job but are they to be trusted? and who watches the watchers?

The trusted person does not have to be in the shadows. There are plenty of jobs where an authorised person could misuse authority. Law enforcement immediately springs to mind. Generally we trust those people in law enforcement, they are checked, double checked and swear allegiance. But what do we do when people in these positions abuse the trust. In New Zealand, they get promoted!

A senior policeman caught accessing the police computer to pass on information to a private investigator working for convicted pack rapist Brad Shipton has been promoted to head the Police College's investigation and intelligence school. In 2005, then Senior Sergeant Dave Archibald was reprimanded for accessing the computer system known as National Intelligence Application during the trial of former police officers Shipton, Bob Schollum and two Mt Maunganui residents. from Dominion Post 25/08/2010

Remember that it is the information that has to be controlled and protected, and that its presence in a computer network is not the whole of its life. On the systems side we need to ensure that:

• information is appropriately classified
• if the information needs to be restricted to authorised parties, there are systems
  

• to ensure that the information access is appropriately controlled
• to track the handling of that information so that misuse is detected
  

and, out in the real world, we need to behave as though privacy and personal security matter.

Signalling in BPMN

At the risk of raising the ire of those that want to avoid precise meaning in their process flow diagrams, I recommend a study of Anatoly Belychook's handy primer on the use of the signal event.

I would emphasise that the signal event allows the ultimate "late binding". You do not have to design the world process ... only the bit you are in control of at the moment. When you come to an event that you know will be useful to another bit of the enterprise ... Signal ... then when a use is found in another bit of process design you do not have to redo the process design work again. Of course, you will need a way to hunt down these useful signals and some standardisation of how they will look in your enterprise.

For those of us that look forward to the executable process, Signals also provide a simple communication method between parallel flows within the same pool and avoid the process designer having to think too much about implementation level stuff like writing data to a store somewhere.

see also

BPMN only part of the solution

Scott Francis takes up the pen in the the ongoing and tedious debate about BPMN ( enough, too much, too hard, too rigid, too imprecise ....) and makes the excellent point that "too many people think that BPM starts and stops with BPMN!".

With a very small set of symbols, BPMN allows a range of expression of process definition from a whiteboard-quality overview to the precision of a computer algorithm for calculating Pi. Even with a palette of 1007667 English words, it is very difficult to get the necessary precision for specifying a business process. Working on the basis of the average reader using only a small subset of those possible words (about 2000) it is clear that we need something more formal than text to get to commitment on what a process is or should be.

It would be really scary if those responsible for the operation of multimillion dollar enterprises can't take on the meaning of a set of symbols that can be put on a small wallchart.

The sad thing is that there is not a similar set of symbols that could be used to encapsulate other aspects of the business canvas so that discussions on whiteboards, or around coffee-bar napkins could be more enduring and useful communication of requirements.

Online privacy, Tracking, and IE8’s InPrivate Filtering

A bit of puffery here for IE8's InPrivate containing a lot of good pointers for the paranoid and those mere mortals who don't like the idea of vast collections of electronic fingerprints being collected by law-enforcement and other sinister bodies. The concern raised by the Panopticlick study does not appear to be addressed though. Taking the good point that "it is how the web works", a cloaking mechanism that, makes you look as though you are using the most common browser out-of-the-box without all those helpful pieces of information that together make you unique, might be useful. After all how many sites need to know that I have Macromedia Flash:Version 10 (version 10.1 r53)

Cellos for sale!

On a completely different tack , I am fundraising for a new cello! An excellent Almy full-size cello and a high quality 3/4 ce3llo are for sale and described here

BPMN 2.0 Best Practice

The LinkedIn Group for BPMN has a discussion on the need for a best practice for BPMN 2.0.
People come at BPMN from a wide spectrum of use from initial discussion of a business process to the IT developer perspective and a matching wide variety of views of best practice will evolve.
BPMN supports a design to execution path.
Tom DeBevois makes a similar point ...

“Certainly, BPMN enables a powerful requirements gathering tool and it can be a part of the over-the-wall requirement. Still, the central focus of BPMN is to support an agile executing environment and promote visible active, responsive change.”

This focus in the notation is in my view highly desirable. A side benefit at BPMN 2.0 has been the tightening up of syntax and meaning. This should help in the process development by making it relatively easy to critique specifications, as Tom was able to do ...

“For instance, consider the car sales process example (Figure 5-5 in the Method and Style Book). At one point in the process, sales enters an order from the factory and a message is shown from the subprocess to the Factory process. This seems correct; however, when I review an actual BPMN process diagram, it suggests to me that the definition of the process might be insufficient. In reality, what happens in most corporations is a salesman takes the paper order form and punches in the car order into another system.”

This is not a defect in the example, or in the style of BPMN 2.0. It merely represents the stage reached in the process design (it is to be hoped, before critical review).
BPMN does not in itself do the design. Transforming thoughts and words into the formality of BPMN 2.0 reduces the ambiguity of common spoken language. Coming from the technical disciplines of IT , I am attracted by the concept of an execution specification of the process that relates directly to an expression of the apparent problem being addressed. I anticipate a few round trips between business process specification and execution design. That is, it is still best for there to be an ongoing conversation between the person originating the problem and the provider of the solution rather than throwing arbitrary specifications over a wall.
Jakob Freund provided a clear example of the happy path through the design process in BPMS. I particularly liked the transition between viewing the process as flowing between departments of an organisation (level 1) to those departments carrying out independent and complex activities communicating through messages (level 2).


This is an example of what could be described as a “best practice” as ..

• the process is decomposed by responsibility
• information required by the various responsibilities is clarified (it is the message content)
• organisational change (eg outsource development) does not necessarily force process change

It would be useful for organisations adopting BPMN to be able to point to practice notes. Those “best practices” must be appropriate to the organisation and to the task in hand.
I suggest that a reasonable approach at this stage in the life of BPMN the best approach is to take one or more of the publications like Bruce Silver’s and go through it crossing out and highlighting depending whether you feel the ‘rule’ is appropriate. This then becomes the initial quality manual for BPMN.

I do feel that any BPMN symbols used in the early stages should be used correctly.
Things important to the expression of the business requirement should be included (however complicated the diagramatic representation) but avoid the temptation to express unnecessary “how to” in the model. I do not feel that the symbol palette for level 1 or 2 of BPMN 2.0 should be a constraint on the modeller. It is more appropriate as a compliance statement for tool providers.