Yet another chapter in the ongoing debate over data breaches, government woes and the balance of responsibilities between organisations and individuals, came last week with the official follow up document to the House of Lords Science and Technology Committee's report on personal internet security. To cut a long story short, it renews the Lords' original calls for a data breach notification law, for fraud reporting laws to be changed so that the police and not the banks are the first port of call for a victim, and for liability for internet security to be placed firmly on the banks.
All of these recommendations are sensible, as they were last August when the original report was launched. The problem is that the government's stance, while softening, is still pretty non-committal. Lord Broers, a member of the committee, seemed cautiously optimistic when I spoke to him about it; after all, the original government response was nothing short of disgraceful - dismissive, arrogant and ill-considered.
The prospect of a data breach notification law is one of the more widely talked-about issues raised by the Lords. Already implemented in many states of the US, the arguments for are well rehearsed - compel an organisation to disclose when a breach has occurred and it is more likely to get its shop in order and protect sensitive customer data. A neat knock-on effect would also be to give us all a better idea of how widespread data breach incidents are, accidental or not.
The arguments against are less convincing in my book; for example that the public will lose interest in data breach stories after a while and therefore having to disclose such incidents will lose its effect. Well, to be honest, as long as a reasonable lower limit is set and due attention is paid not only to volume but how much an individual incident could affect the victims, a law should still work. We sorely need a legal imperitive here because otherwise, quite frankly, certain organisations would rather not come clean if they've lost sensitive data, and who can blame them? The cost of a sensitive data breach is increasing by 20 per cent a year, according to analyst Gartner - the cost to brand is pretty much incalculable but the risk is real enough to force organisations to re-examine their data security policies.
Europe is already leading the way by planning the introduction of such laws for ISPs and telcos, although they will be a long time coming to the UK. However, full, industry-wide legislation will happen eventually so it's better to be prepared and start thinking about best practices in data security - the Information Commissioner produces handy advice here. Thus, by the time it is the law, your people, policies and processes should all be geared-up to minimise the risk of data loss
Monday, 14 July 2008
Friday, 11 July 2008
At the heart of the knowledge economy
The 21st century is the era of the information professional. No, not another claim from the editor of IWR after a good lunch (I should be so lucky), but a summary of the prediction of the IBM Data Governance Council.
The council is a US-based industry group whose 50 members include big names from the corporate world including American Express, Deutsche Bank, Citi and Mastercard. Formed three years ago to help the business world take a more disciplined approach to how big companies handle data, it has produced an interesting assessment of life following the credit crunch.
The council concluded that failures in data governance were at the heart of the sub-prime crisis and that a regulatory backlash will see data governance becoming a regulatory requirement in some countries, initially in the banking and financial services industries. There is nothing like imposing a regulatory requirement for hoiking an issue up the corporate agenda. But the council goes even further. It is discussing the idea that the value of data should be recognised in the financial statements and should be treated as an asset on the balance sheet. The accountancy profession has always been a bit wary of intangible assets, with fierce arguments over if and how intellectual property assets such as goodwill, brands, and human capital should be recognised. The credit crunch and the argument over the value of financial instruments has underlined how difficult it is to inform investors about the changing asset values.
In the scenario painted by the council, the quality of data will become a technical reporting metric and key IT performance indicator. New accounting and reporting practices will emerge for measuring and assessing the value of data to help organisations demonstrate how data quality fuels business performance. Crucially the council sees the role of the chief information officer changing - with reporting on data quality and data risk to the board becoming a key task. The CIO will have the mandate to govern the use of information and report on the quality of the information provided to shareholders.
For information professionals it is an exciting idea, putting them at the heart of the knowledge economy and at the centre of corporate life. It is a vision which the profession should try to turn into reality.
The council is a US-based industry group whose 50 members include big names from the corporate world including American Express, Deutsche Bank, Citi and Mastercard. Formed three years ago to help the business world take a more disciplined approach to how big companies handle data, it has produced an interesting assessment of life following the credit crunch.
The council concluded that failures in data governance were at the heart of the sub-prime crisis and that a regulatory backlash will see data governance becoming a regulatory requirement in some countries, initially in the banking and financial services industries. There is nothing like imposing a regulatory requirement for hoiking an issue up the corporate agenda. But the council goes even further. It is discussing the idea that the value of data should be recognised in the financial statements and should be treated as an asset on the balance sheet. The accountancy profession has always been a bit wary of intangible assets, with fierce arguments over if and how intellectual property assets such as goodwill, brands, and human capital should be recognised. The credit crunch and the argument over the value of financial instruments has underlined how difficult it is to inform investors about the changing asset values.
In the scenario painted by the council, the quality of data will become a technical reporting metric and key IT performance indicator. New accounting and reporting practices will emerge for measuring and assessing the value of data to help organisations demonstrate how data quality fuels business performance. Crucially the council sees the role of the chief information officer changing - with reporting on data quality and data risk to the board becoming a key task. The CIO will have the mandate to govern the use of information and report on the quality of the information provided to shareholders.
For information professionals it is an exciting idea, putting them at the heart of the knowledge economy and at the centre of corporate life. It is a vision which the profession should try to turn into reality.
Thursday, 10 July 2008
BLOGOSPHERE Information professionals guiding you to the best bits of the blogosphere
Less than a year ago, Gráinne Conole was sceptical of the whole idea of blogging. But after deciding to suck it and see, the OU's professor of e-learning has found it eminently to her taste
Q Where is your blog?
A e4innovation.com I have been writing it since September 2007.
Q Describe your blog and what's on it.
A It's about e-learning innovation: research, evaluation, practice and policy.
Q What started you blogging?
A I never understood how people had the time to blog, nor was I quite convinced about the value, but back in September I decide that rather than have a negative view I would try it and see, and I was really amazed at how valuable it was, that it was a complementary outlet for some of my activities. One criticism I have of the blogosphere is that there is not enough mainstream educational researchers in there yet. I want to encourage more people to get into it.
Q Do you comment on other blogs and what is the value of it?
A It's hugely valuable to comment. As somebody who blogs, I find it motivating when people comment. You start building a community; it's a very good way to get to know new people. It's also a new form of academic discourse. It's not the same as writing a fully fledged paper where you have formulated your thoughts and are writing a story. People have - jokingly, I hope - described my blog as a stream of consciousness as opposed to the more perfectly formed type, but I think it just depends on your style.
Q How does your organisation benefit from your presence in the blogosphere?
A It has proved useful in a range of ways, both for communicating and disseminating the work of colleagues and also for summarising ideas I have seen at conferences. I've found the blogosphere community just so interesting. I've been amazed at who reads it and the international spread with people commenting on my blogs. It's also a useful
repository for my thoughts. More and more, I'm telling people they can find the information they want from me on my blog. It acts like a digital research diary.
Q What do you get out of it for your career?
A I think it has raised my profile in new areas. It still freaks me out slightly when I meet new people and they say they enjoy reading my blog! I have had contact with readers in Saudi Arabia and Iran. You see people come through from all over the place; it's very motivating. When you are at conferences, you start to think, what do I want to write
about? Is there an angle there related to the work that I am doing? I always hated having a static researcher website that listed my name and publications. I always found it
a real bind trying to keep it up to date, whereas this blog is on my own site and under my control. Somehow it's much more motivating to keep it up to date. You can tell a lot about someone's personality from the way they blog. It allows for a much more personal touch.
Q What good things have happened to you that could only have happened because of blogging?
A I have had quite a few invitations to events that came as a result of the blog, such as being a keynote speaker at an event in Saudi Arabia (which unfortunately I couldn't attend).
Q Which blogs do you read for fun?
A I don't read any blogs just for fun, although I do use Twitter for fun as well as business. I think Twitter's brilliant. It's a bit like mini-blogging with an interesting mix of people. It seems to have gone mad recently. It is very addictive!
Q Which bloggers do you watch and link to?
A I must follow around a hundred but some of my favourites are;
Martin Weller on the Ed Techie blog
George Siemens in Canada at the Elearnspace blog
Terry Anderson at Eduspaces
AJ Cann writing at Science of the Invisible
and Stephen Downes, who everybody reads on Stephen's Web
Q Where is your blog?
A e4innovation.com I have been writing it since September 2007.
Q Describe your blog and what's on it.
A It's about e-learning innovation: research, evaluation, practice and policy.
Q What started you blogging?
A I never understood how people had the time to blog, nor was I quite convinced about the value, but back in September I decide that rather than have a negative view I would try it and see, and I was really amazed at how valuable it was, that it was a complementary outlet for some of my activities. One criticism I have of the blogosphere is that there is not enough mainstream educational researchers in there yet. I want to encourage more people to get into it.
Q Do you comment on other blogs and what is the value of it?
A It's hugely valuable to comment. As somebody who blogs, I find it motivating when people comment. You start building a community; it's a very good way to get to know new people. It's also a new form of academic discourse. It's not the same as writing a fully fledged paper where you have formulated your thoughts and are writing a story. People have - jokingly, I hope - described my blog as a stream of consciousness as opposed to the more perfectly formed type, but I think it just depends on your style.
Q How does your organisation benefit from your presence in the blogosphere?
A It has proved useful in a range of ways, both for communicating and disseminating the work of colleagues and also for summarising ideas I have seen at conferences. I've found the blogosphere community just so interesting. I've been amazed at who reads it and the international spread with people commenting on my blogs. It's also a useful
repository for my thoughts. More and more, I'm telling people they can find the information they want from me on my blog. It acts like a digital research diary.
Q What do you get out of it for your career?
A I think it has raised my profile in new areas. It still freaks me out slightly when I meet new people and they say they enjoy reading my blog! I have had contact with readers in Saudi Arabia and Iran. You see people come through from all over the place; it's very motivating. When you are at conferences, you start to think, what do I want to write
about? Is there an angle there related to the work that I am doing? I always hated having a static researcher website that listed my name and publications. I always found it
a real bind trying to keep it up to date, whereas this blog is on my own site and under my control. Somehow it's much more motivating to keep it up to date. You can tell a lot about someone's personality from the way they blog. It allows for a much more personal touch.
Q What good things have happened to you that could only have happened because of blogging?
A I have had quite a few invitations to events that came as a result of the blog, such as being a keynote speaker at an event in Saudi Arabia (which unfortunately I couldn't attend).
Q Which blogs do you read for fun?
A I don't read any blogs just for fun, although I do use Twitter for fun as well as business. I think Twitter's brilliant. It's a bit like mini-blogging with an interesting mix of people. It seems to have gone mad recently. It is very addictive!
Q Which bloggers do you watch and link to?
A I must follow around a hundred but some of my favourites are;
Martin Weller on the Ed Techie blog
George Siemens in Canada at the Elearnspace blog
Terry Anderson at Eduspaces
AJ Cann writing at Science of the Invisible
and Stephen Downes, who everybody reads on Stephen's Web
Wednesday, 9 July 2008
It's the tone at the top
By Peter Williams
Whenever organisations need to change they start to talk about culture. Changing culture has been described as a polite way of telling people to do things which they don't really want to do. A less cynical view is that culture comes from the highest echelons of an organisation. It is fashionable to talk about "the tone at the top". The idea is simple. Bosses tell you explicitly and implicitly that it is important to do something and underline that desired behaviour by rewarding those who comply. If you achieve those sought after outcomes then along come the bonuses and the promotions.
The reason why the credit crunch happened is that banks went chasing market share encouraging their employees to throw money in many different ways at as many different companies as possible. They rewarded each other with eye wateringly large bonuses. Now of course such lending appears foolish. But that is hindsight after the event. The information industry has had the equivalent of the bankers' credit crunch. The digital revolution has put more information in more hands than ever before. Like the bankers enjoying their leveraged-induced bonuses so many organisations have enjoyed the benefits of a wall of usable and useful information. We saw the Promised Land in terms of harnessing modern communication technology to our advantage but we were so dazzled by the prospect that most of us failed to properly take note of the potential downside.
The series of data losses and information security breaches we have witnessed over the last few months has been the information industry equivalent on all those City deals turning bad. We can't put the genie back in the bottle in terms of uninviting the internet or web 2.0 - and anyway who wants to? However, we do have to relearn some of the basics of data and information management and security. The culture has to change to put data security and management at the top of the agenda. Information professional have to use their skills, knowledge and experience to lead by example, teaching and good practice. But that will only happen if the tone at the top says such a move is important.
Whenever organisations need to change they start to talk about culture. Changing culture has been described as a polite way of telling people to do things which they don't really want to do. A less cynical view is that culture comes from the highest echelons of an organisation. It is fashionable to talk about "the tone at the top". The idea is simple. Bosses tell you explicitly and implicitly that it is important to do something and underline that desired behaviour by rewarding those who comply. If you achieve those sought after outcomes then along come the bonuses and the promotions.
The reason why the credit crunch happened is that banks went chasing market share encouraging their employees to throw money in many different ways at as many different companies as possible. They rewarded each other with eye wateringly large bonuses. Now of course such lending appears foolish. But that is hindsight after the event. The information industry has had the equivalent of the bankers' credit crunch. The digital revolution has put more information in more hands than ever before. Like the bankers enjoying their leveraged-induced bonuses so many organisations have enjoyed the benefits of a wall of usable and useful information. We saw the Promised Land in terms of harnessing modern communication technology to our advantage but we were so dazzled by the prospect that most of us failed to properly take note of the potential downside.
The series of data losses and information security breaches we have witnessed over the last few months has been the information industry equivalent on all those City deals turning bad. We can't put the genie back in the bottle in terms of uninviting the internet or web 2.0 - and anyway who wants to? However, we do have to relearn some of the basics of data and information management and security. The culture has to change to put data security and management at the top of the agenda. Information professional have to use their skills, knowledge and experience to lead by example, teaching and good practice. But that will only happen if the tone at the top says such a move is important.
Monday, 7 July 2008
Icann opens things up
Icann's recent decision to effectively relax the rules on registering domain names has again highlighted the importance of choosing the right suffix to represent your organisation on the web. Although it is often relegated behind web site design and content management issues, domain name management is now crucial to the success of a business or the effectiveness of a public sector organisation online.
Icann's historic Paris vote throws the cat among the pigeons somewhat because it paves the way for firms to register any word as a suffix, not just the usual .coms and .uks. So in the future we could see regional generic names like .sco for Scotland and .lon for London, we could see popular brand names like .Polo, .Mars and so on, and other more unusual or generic names.
Most firms' traditional policy when it comes to registering domain names, is to decide which names are closest to their own url, including ones with small variations likely to be typed in erroneously by users, and then snap them up before domain speculators get their hands on them and try to monetise their investment. Ultimately it's brand protection, defensive registration, and it needs to be done across all of the major TLDs.
Well, that strategy has effectively been turned on its head by this latest Icann decision. With infinite variations on your domain name possible, how can any organisation practically buy up all the potentially similar names? Well, they can't really, so in time it's going to be a case of picking the domain name you're comfortable with and want associated with your organisation - tesco.supermarket, for example - and sticking to it. If you then find someone is infringing on your brand rights, then you'll just have to go after them on a case-by-case basis. In fact, with the number of permutations set to multiply at an alarming rate, cybersquatters are likely to find that domain names are a lot more difficult to monetise - as choice increases demand will obviously decrease.
One interesting offshoot of this whole affair could be that users have to rely more heavily than ever before on search engines to locate the organisations they want to connect to - at least until they become familiar with the domain names attached to particular brands. To be honest though, it's more likely that despite this increase in choice for firms and organisations, .com, .uk and the existing TLDs are going to be pretty safe. Why give up an identifiable web address it has taken years to build up, just because you can? Things will certainly get more complicated in the short term for legal, marketing and IT teams, but it's equally easy to see how the novelty could soon wear off.
Icann's historic Paris vote throws the cat among the pigeons somewhat because it paves the way for firms to register any word as a suffix, not just the usual .coms and .uks. So in the future we could see regional generic names like .sco for Scotland and .lon for London, we could see popular brand names like .Polo, .Mars and so on, and other more unusual or generic names.
Most firms' traditional policy when it comes to registering domain names, is to decide which names are closest to their own url, including ones with small variations likely to be typed in erroneously by users, and then snap them up before domain speculators get their hands on them and try to monetise their investment. Ultimately it's brand protection, defensive registration, and it needs to be done across all of the major TLDs.
Well, that strategy has effectively been turned on its head by this latest Icann decision. With infinite variations on your domain name possible, how can any organisation practically buy up all the potentially similar names? Well, they can't really, so in time it's going to be a case of picking the domain name you're comfortable with and want associated with your organisation - tesco.supermarket, for example - and sticking to it. If you then find someone is infringing on your brand rights, then you'll just have to go after them on a case-by-case basis. In fact, with the number of permutations set to multiply at an alarming rate, cybersquatters are likely to find that domain names are a lot more difficult to monetise - as choice increases demand will obviously decrease.
One interesting offshoot of this whole affair could be that users have to rely more heavily than ever before on search engines to locate the organisations they want to connect to - at least until they become familiar with the domain names attached to particular brands. To be honest though, it's more likely that despite this increase in choice for firms and organisations, .com, .uk and the existing TLDs are going to be pretty safe. Why give up an identifiable web address it has taken years to build up, just because you can? Things will certainly get more complicated in the short term for legal, marketing and IT teams, but it's equally easy to see how the novelty could soon wear off.
Friday, 4 July 2008
It gives with one hand...
The issues surrounding online privacy and Google are never far away from one another. Today Google (as owners of YouTube) have been ordered by the Department of Justice to provide user details from the online video site in their lawsuit with media group Viacom for copyright infringement. That is every record of every user and what they watched; 12 terabytes of IP addresses and usernames.
In today's FT, Google's lawyer Catherine Lacavera says the Search Company was "disappointed" and that Google are asking Viacom to "respect users' privacy and allow us to anonymise the logs".
While it is laudable of Google to fight for the protection of its users' privacy it could equally be accused of adopting contradictory practices with private information, the latest accusation coming from the Privacy International organisation.
They complained to Google that the Street View tool (which I enthusiastically blogged about a few weeks ago) could contravene the UK's Data Protection laws because its images inevitably feature identifiable members of the public. Because Google make commercial gain from the images, the argument goes that each individual should have to give their permission if they appear.
Google on the other hand say that they are using technology to blur the faces of anyone who is snapped by the Google car taking the pictures. Privacy International has asked the firm to release the technology specs to prove that the blurring will actually work on both car number plates as well as faces. If Google doesn't comply with this request, they will be getting in touch with the Information Commissioner in order to prevent Street View UK from being published.
Darren Waters BBC blog on this, includes a copy of the letter Privacy International sent to Google. The comments there are interesting too, with plenty of discussion as to the legality of snapping away in public.
While we are on the subject of Google, I came across what has been dubbed as the holographic version of Google Earth. Even though the technology used means that the image is very much 2D, the projection is interfaced something along the lines of a large iPod Touch. It is an impressive and effortless way to control the application. I continue to be inspired by the ways people conceive to fully interact with information.
In today's FT, Google's lawyer Catherine Lacavera says the Search Company was "disappointed" and that Google are asking Viacom to "respect users' privacy and allow us to anonymise the logs".
While it is laudable of Google to fight for the protection of its users' privacy it could equally be accused of adopting contradictory practices with private information, the latest accusation coming from the Privacy International organisation.
They complained to Google that the Street View tool (which I enthusiastically blogged about a few weeks ago) could contravene the UK's Data Protection laws because its images inevitably feature identifiable members of the public. Because Google make commercial gain from the images, the argument goes that each individual should have to give their permission if they appear.
Google on the other hand say that they are using technology to blur the faces of anyone who is snapped by the Google car taking the pictures. Privacy International has asked the firm to release the technology specs to prove that the blurring will actually work on both car number plates as well as faces. If Google doesn't comply with this request, they will be getting in touch with the Information Commissioner in order to prevent Street View UK from being published.
Darren Waters BBC blog on this, includes a copy of the letter Privacy International sent to Google. The comments there are interesting too, with plenty of discussion as to the legality of snapping away in public.
While we are on the subject of Google, I came across what has been dubbed as the holographic version of Google Earth. Even though the technology used means that the image is very much 2D, the projection is interfaced something along the lines of a large iPod Touch. It is an impressive and effortless way to control the application. I continue to be inspired by the ways people conceive to fully interact with information.
Wednesday, 2 July 2008
Are research scholars taught the skills they need?
Apparently not if the latest report from the Research Information Network (RIN) is anything to go by. "...training on information seeking and information management is uncoordinated and generally not based on any systematic assessment of needs" the opening paragraph states.
The report, Mind the Skills Gap: Information-Handling Training for Researchers focused on the way researchers are trained in the information seeking and management in UK higher education.
The damning report also suggests of a perception among library and information specialists that even competent researchers show "alarming deficits in their information skills" with "little systematic assessment of researchers training needs". Overall the findings suggest the information skills of researchers have failed to keep up with the demands of the modern research information world.
More effort needs to be made among information institutions like libraries and research committees to co-ordinate and manage the right information skills training says the report.
The way I read it, it's not that the HE training researchers are getting is necessarily bad or irrelevant, but there are some issues that the report has highlighted that need to be considered.
1) Funding for relevant information training is not being made properly available. Better clarification for what is eligible for resources is needed.
2) Training should be tailored and developed alongside the researcher's subject field. There has possibly been an over-emphasis on generic training.
3) Improved measurement and monitoring of training made available by those responsible for it, whether that is an institution's central training department or library.
With an RIN workshop due to be hosted in early autumn about the results, please let us know if your experiences are similar to the report findings. Is there such a gap in your experience? Let us know your thoughts.
The report, Mind the Skills Gap: Information-Handling Training for Researchers focused on the way researchers are trained in the information seeking and management in UK higher education.
The damning report also suggests of a perception among library and information specialists that even competent researchers show "alarming deficits in their information skills" with "little systematic assessment of researchers training needs". Overall the findings suggest the information skills of researchers have failed to keep up with the demands of the modern research information world.
More effort needs to be made among information institutions like libraries and research committees to co-ordinate and manage the right information skills training says the report.
The way I read it, it's not that the HE training researchers are getting is necessarily bad or irrelevant, but there are some issues that the report has highlighted that need to be considered.
1) Funding for relevant information training is not being made properly available. Better clarification for what is eligible for resources is needed.
2) Training should be tailored and developed alongside the researcher's subject field. There has possibly been an over-emphasis on generic training.
3) Improved measurement and monitoring of training made available by those responsible for it, whether that is an institution's central training department or library.
With an RIN workshop due to be hosted in early autumn about the results, please let us know if your experiences are similar to the report findings. Is there such a gap in your experience? Let us know your thoughts.
Subscribe to:
Posts (Atom)