2 days with Chris Potts – Good Bye to IT as we know it!

(Breaking down the wall around IT !)

This week I spent 2 exciting days at one of Chris Potts' seminars on Corporate (IT) Strategy.

It certainly was an eye-opener for me, having lived through all stages of IT since the 360 mainframe.

A few years ago when Enterprise Architecture became the hot topic, we all agreed, that one of the fundamental problems of this world was to align business and business strategy with IT and IT strategy – but all this is nonsense, according to Chris Potts. 'You shouldn't have an IT Budget' was one of initial remarks. But after 2 days I am convinced he's right and that this new approach leads to complete different and much more meaningful business decisions, investments and methods of managing complex portfolio of projects – including projects heavily relying on IT and technology.

However, Chris' point of view is completely different from Nicholas Carr's 'IT Doesn't Matter' kind of approach trying to persuade business managers to spend less on IT, to follow in stead of leading at the 'bleeding edge'. Chris' point is straight forward: As you cannot do anything business wise without deploying 'some' IT and some technology in it's broadest sense, than there is simply no reason in treating IT 'projects' and IT spending as if it is an animal of it's own. What is even worse is, that this tradition has been thriving on the 'IT specialists' that have kept the WE and THEM paradigm in what Chris Pott calls the second generation II era. Fueled by crisis and downturn, the 2. G people are 'cutting down on IT spending' instead of asking the obvious question: What Value do we get for it? Which are the key business investment areas we should be concentrating on and first at this point maybe wonder of technology could be deployed in these areas in a smarter way than to day.

So it is not about cost, it's about value. (Even accountants are beginning to admit this!) IT in itself creates no value – as if we didn't know it, the sinister implication is that the public sector's (IT) projects being launched these days are all being selected according to the strict EU tendering rules focusing on minimizing cost and securing 'delivery' – meaning fulfillment of a development/deployment contract at a specific point in time at a spefic cost – but where is the value of the project?

Chris' observation not only leads to the clear conclusion that the perceived outcome in terms of value of a project not only should be the guiding principle, but that the whole accounting process around project selection and project management is completely wrong:

Any project – and public sector projects in particular – should be selected according to their contribution to value – maybe cost reduction is one of them, but in that case total operational costs. Also transparency could be a very interesting value of a public project as could citizen participation and take-up of eGovernment projects. So the estimated impact on all essential types of value is absolutely meaningful, but ONLY if the project management is measured on how the value of the project is created AFTER it's fulfillment. We are deploying 2. generation project managers maybe skilled in PRINCE 2 to deliver 4. generation solutions deploying web 2.0 technologies and aiming at involving citizens – but we are not measuring it.

One of the latest scandals in Denmark is the project dealing with electronic bonds and real estate registration. According to CSC's project manager 'The IT project is a success – we have a service level of 99.5% availability and we have had that for months!' - but reality is that now it takes anything from 4 to 8 months to register a sale of a real estate. Again – the tendering rules selected the winner of the development project, but didn't in any way measure, secure or include the total costs of the process, let alone found it necessary to manage that real value was actually achieved.

(See this blog: (In Danish) http://it-bizzen.blogspot.com/2007/11/csc-forsinker-hurtig-tinglysning-it.html )

So Chris Potts lesson is that you need to go to the thirds generation thinking: focus on the value people are getting from projects involving IT and employ BUSINESS experts to ensure this – not nerds, npår technical people – not even 'Enterprise Architects' still stuck in the THEM/US thinking.

But Nirvana only comes if you forget IT completely – drop the idea of a specific IT budget, think in terms of business organization and embed the investment and management issues of IT in the proper context.

In summary: From Chris we learned how to make an overall Corporate strategy in one page – with a clear strategic objective, with max 10 basic principles and/our beliefs and max 10 core tactics.

I can clearly recommend this seminar and the thinking behind it to any 2. generation frustrated IT manager or to any forward thinking CEO. If you happen to be employed by the Public Sector, I have to warn you, though: Your politicians are all 2. G, the rules are from last century and the narrow budget thinking is killing many bright ideas. But if you don't try, we might face 'civil unrest' – when the new generations used to web 2.0 technologies demand a decent way of thinking what value the Government is really bringing to the table!

(See also http://www.aeaassociation.org/ )

IT History - Fractions from a Journey

On December 30. I had my last working day with IBM. After 39½ years I received a very nice offer, and yet it was a strange feeling trying to summarize all the changes I have lived through since I joined the IBM Denmark company in 1970. It wasn't really my intention to make a career out of it – I graduated as a Master Economist, but I got interested in Data Processing, and decided that the best place to learn more probably was in the department for Operating Systems in IBM. At that time the Disk Operating System (DOS) was being outdated by OS that came in two brands: OS/MFT (Multiprogramming with a fixed number of tasks) and OS/MVT for the REALLY big machines allowing a variable number of transactions concurrently.

The picture here is me in 1970 and the photo was illustrating 'Modern Data Processing' in the Danish encyclopedia. It was a 360/40 – huge machine, 256K memory.

Over the years a lot of rather dramatic changes occurred – both in the way the Company was organized, in technology and in the competitive landscape. I soon got captured by the Government Branch and spent most of my career working with Government in some way, interrupted by assignments in Stockholm organizing and running Sales School and internal Training in mid 70's and handling staff job in the early 1980's and again in the mid 90's.

My first job was with what became one the 4 DP Centers for the Kommunedata organisation, and the first center to work with typewriter terminals to run financial management systems. 5 years before the color screens and the Systems network Architecture was announced. I later become responsible for the entire local Government and Health Care market, which had a fantastic growth in the late 70'es

IBM changed dramatically in the early 80'es – we had been split up in 3 divisions, DP (the Large Customer segment), GB (mid size machine and small and medium customers) and the DCS - the Data center Operations. The split was made to prepare for a split up if a court ruling found IBM guilty in monopolistic behavior, but thanks to the growing competition from Amdahl for the high machines, Memorex and similar for peripheral and Digital for mini computers, IBM avoided to be cut up and instead pooled the resources. Then in 1981 the IBM PC suddenly emerged as a new star – based on standard components bought on the open market it seemed to be the brand name that sold the product. I was asked to organize a group of system engineers and salesmen to conquer the Danish Education and Scientific market for the PC's, and I had the pleasure of interviewing some 300 teachers before hiring 6 of them – with sweaters and hairy faces and everything. Plus a nice lady, a French teacher from a high school. In fact we succeeded in just 4 years, the mantra was that it was not the question of the Hardware but how the software could help the teachers. It worked – and I still recall the first IBM PC we sold with 2 diskette stations, 256K for 7.000 US Dollars (35.000 Danish Kroner). At the end of the 80'es and early 90'es I was responsible for Market Development for the Public Sector (including Post, Defense, Central Government, Tele). At that time it was dawning on IBM's management that the business model had to change and that we had to charge for our skilled Systems Engineers and Networking CE's. The Business Consulting area began to be the hot topic, but my position - together with some of the former Government Branch Managers - was that it was important to marry the consulting skills with deep industrial knowledge. We lost the argument, and the General Business Consultant emerged, later to be split into practices and boosted by the subsequent purchase of Price Waterhouse. (See: Seven Keys to Success )

In the 90'es a new thing emerged – the Internet. Although I already got acquainted with it during my job with the University Sector, it wasn't until around 1994 that it became clear that a new market was emerging; I started a fantastic group of quite young people, creative designer-types and long haired programming freaks plus a couple of deeply engaged old time Systems Engineers. Within just a few years we managed to create first-of-a-kind of websites for Copenhagen City, a number of Danish Companies, plus launched the first secure payment systems on the Internet. And then suddenly – it all became 'pervasive' – which in practice meant that the profit margin for doing websites and similar solutions were coming down, and that the new business model would call for a value chain of Business Partners and IBM withdrawing to delivering the SW platforms and intermediate layers.

So the turn-around of the Company mid to late 90's architected by Lou Gerstner, once again laid to a dramatic change in organization, and started the period of active acquisitions, that Sam Palmisano carried on. As of today, the organization is split in divisions reporting to global or regional managers, and the coordination that is necessary in every major customer engagement handled by a an all-encompassing CRP and accounting system and strict procedures for bidding.

Since the end of the 90'es I have worked internationally as an eGovernment Advisor in a job working with the public sector and the Software group – plus of course a number of dedicated business partners and our GBS people that on and off have supported Public Sector.

This has been an enormousinspiration, has brought me to the Middle East working with the forward thinking Governments in Dubai and Quatar, I have witnessed and supported the Baltic Countries in their quest to outgrow the older parts of Europe, with Iceland, with the Nordic Countries and during the last few years with Greenland and the new Greenland parliament, which I hope to continue as a ppensioner.The dramatic changes in the IT world since 2001 and the rise of the Open Source Community is a trend, that I expect we have only seen the tip off. When Cloud Computing really takes off, the business model for selling Software Licenses will change once again and the new competitive landscape will be different from anything we have seen so far. Google probably aiming to become the next top competitor and Microsoft standing to loose.

And this may be some of the reasons IBM has survived all the turmoil – at least during my 39½ years: We have always been careful to select the battlefield. The competitors we had in the late 70'es were all gone 10 years after; the competitors we had in the 80'es have almost all disappeared, with HP as an exception. And with IBM now launching the Smart Planet approach and going for Software as a service and supporting Open Source, the competitors in 10 years again will be a different crowd. An old IBM'er told me 25 years ago that IBM meant: I'll Be Moved – because the mantra of the company is change.

So I will. And I have promised to start to document IBM Denmark's History. It started January 1. 1950 as a local Danish Operation. It shouldn't be too difficult – after all I have lived through 2/3 of the history myself!

Eurocities Annual General Meeting

Stockholm Nov 25-28

The Eurocities organization that covers a number of the largest and most advanced cities in Europe, last week had their annual general meeting in Stockholm during the Swedish EU Presidency.

The main theme of this year's annual conference was of course focused on the upcoming COP 15 meeting in Copenhagen and the working theme name was 'Urban Challenges – Sustainable Solutions'. (The entire conference is available on line using this link - http://media.fronto.com/streaming/eurocities/091126/Default.aspx – you have to sign in first, but then you are in there, really a nice solution)

The mayor of Stockhom, Steen Nordin (M) welcomed the participants and explained that a large part of the program was dedicated to a number of green projects that participated to Stockholm's nomination as the Green Capital of Europe. Eurocities president, Jozias van Aartsen from Hague likewise expressed the hope that the conference could be a clear sign to the World that as the majority of the global population is now living in cities, the cities themselves are not longer 'just' the problem, but very much important players to solve the global challenges and the global warming in particular, but also the key areas where Eurocities has been active and where 3 awards were due under the headings of 'Innovation',' Participation' and ' Cooperation'.

One of the most interesting and engaging experts on international Health, professor Hans Rosling from Karolinska, then presented a breathtaking tour-de-force of numbers to describe how the World has changed and how all our prejudices dividing the World in 'They' and 'We' were no longer valid.

Look at this shortened version of his speech: http://paulchaffey.blogspot.com/2009/11/hans-rosling-om-utviklingsland-og.html

Under the headline: 'Sustainable Solutions for Business, Science, People and Culture' the conference split up in 9 groups and went on bus tours to study practical experiences and cooperations between Stockholm city and private and public organizations.

For my part I joined the tour to 'World Leading ICT cluster' at Kista, which in fact I have followed from its' early beginning with Ericsson and IBM as the first partners. Now more than 30.000 jobs have been created in more than 200 ICT companies in Kista. Really impressive and a positive experience and clear signs that the crisis is almost over in Sweden.

The other tours were labeledFuture Suburbia' – renewing Järva, a suburb from the 60's built to meet housing shortage and now in need for renovation - 'Teleco

m for green Cities' – a Visit to Ericsson Headquarter also describing the Intelligent Transportation System in Stockholm, where IBM performed the coordinating role – the 'Intelligent Electricity Project' – smart grids, smart electric cars - 'Creative cluster'- sustainable design in an industrial regenerated area - Mobility flows' – showing how the public bus system was converted to Biogas, also descr

ibing the Intelligent Traffic system - 'The Hammarby Model' – Integrated management of Waste, Water and Energy to 'Heating the city' – showing how 80% of the heating comes from

renewable sources and finally 'Low carbon Urban Transport'.

It was a tremendous well organized 2.5 hours extension for everybody and it was really impressive!

The plenum meeting was then led by mr. Ballasteros from the EU commission on the topic of 'the Covenant of the Mayors':

The evening program called for a galla dinner at Stadshuset, in the Blue Hall, where the famous Nobel Price ceremonies take place. The evening called for a reward to the cities that had earlier been presented as nominees for the categories Innovation, Participation and Cooperation.

Winner for the innovation group was the city of Malaga, that had developed an interactive map in 3D to optimize localization of solar energy batteries. Birmingham won the category 'participation' with an interesting project on building an 'eco-village', and finally city of Dortmund won the prize for Cooperation by an impressive, yet low budget project on ' Consultation Circle for Energy Effectiveness and Climate Protection'

Friday morning program was dedicated to 'the Stockholm Appeal':

The mayors of the largest cities in Europe and the United States have co-authored a mutual appeal, "The Stockholm Appeal on Climate Change". The appeal manifests the signatories’ desire for the COP15 meeting in Copenhagen to result in an international climate change agreement.

The US chairman for the US Mayors Goncress, Mrs. Elisabeth Krautz already the day before stressed the dedication from the US cities to back the Stockholm initiative.

The Stockholm Appeal was signed earlier this year by U.S. Conference of Mayors President Seattle (WA) Mayor Greg Nickels, U.S. Conference of Mayors CEO and Executive Director Tom Cochran, Stockholm Mayor Steennnn Nordin, and Mayor of The Hague EUROCITIES President Jozias von Aartsen.

The Appeal was presented to the representatives of the Swedish Presidency of the European Union, as well as the Obama Administration by Mayor Kautz and Mayor Nordin. From this ceremony we have the following citation from the Canadian mayor:

"U.S. mayors proudly stand with our European counterparts in asking international recognition of the role of local leaders in climate protection. At the forefront of creative strategies, U.S. mayors have forced our national government to act to combat climate change. To date, over 1,000 mayors have signed the USCM climate protection agreement pledging to meet or beat Kyoto goals. Mayoral leadership is a major impetus in climate protection," said Mayor Nickels.

The Swedish Deputy Prime Minister, Maud Olofsson and the US Chargé D'Affair in Stockholm, Robert Silverman, underlined the strong intention behind the Stockholm Appeal, and Robert Silvermann declared that his president and the congress this time would do it's utmost to reach a politically binding treaty in Copenhagen on climate warming.

And finally, before the forum reports, Senator John Kerry appeared on video conference to persuade the European audience about the good will of the Congress in Washington, where he was at least partly successful. We are all now very much focused on what will happen in Copenhagen but take it as a good sign that President Obama has declared that he will participate.

Stockholm's Mayor Steen Nordin will hand over the Stockholm Appeal to the UN Conference COP15 in December in Copenhagen.

For the full Wording of the Stockholm Appeal, see this link: http://www.eurocities2009.eu/pages.aspx?page=42

Hospitals of the Futurè

An important part of the Danish Prime Ministers future plans deal with the construction of a number of bright, new so-called Super Hospitals. When he addressed the Danish Parliament on his opening speech first Tuesday in October, the amount of 40-50 Billion Dkr (9 – 10 B US $) was mentioned.

In Denmark the Regions are responsible for hospitals, but they have no tax income of their own, so they are completely depending on the Government allocation of funds. So the 5 regions are looking to negotiations with the Government, and as it looks they are treated rather differently; the regions that have been most eager to close down small and inefficient hospitals stand to gain the most.

In any case the question any Dane should put to his regional politicians, now up for re-election in November, is how they see the future of the hospitals. If this is not discussed, I fear the entire discussion will be around the brick-and-mortar investment, and not about the rethinking of the entire health structure as I feel is highly needed – not least in light of the demographic changes we can foresee, including the lack of doctors, nurses, more elderly, more chronic diseases etc.

So where can we find the inspiration needed before these new super tankers are cast in iron?
Normally you would look to US: http://health.usnews.com/articles/health/best-hospitals/2009/07/15/the-high-tech-hospital-of-the-future.html
But US has its own problems and has a highly different tradition than Northern European health systems, where this is an integral part of our welfare system, hence mainly paid for by the tax budgets. (Try to see the notices from the US Commission on the Future of Health Care from 2008:
http://www.fiercehealthcare.com/story/adaptibility-important-future-hospitals/2008-11-21?utm_medium=rss&utm_source=rss&cmp-id=OTC-RSS-FH0 )

There are sources and best-of-breed examples out there that can easily by reached; the web page for DesignIT has a very interesting article of hospitals of the future.
One of the cases that DesignIT describes is the Il Camino Hospital (Silicon Valley, Ca):

”Il Camino Hospital is a completely wireless hospital that is well on its way to becoming paper and film free. The hospital estimates that the new system has saved them 120,000 dollars a year in medical costs and 300,000 dollars a year in avoidable errors.
The hospital’s wireless technology includes:
· Voice-activated communicators: Nurses and doctors use a small voice-controlled, hands-free device that they wear around the neck to communicate with each other. The device is made by Silicon Valley start-up Vocera Communications Inc.
· Biometric supply cabinets: A device that enables authorised personnel to open doors or cupboards for medicine and other medical items by reading a thumbprint.
· Automated laboratory system: Laboratory tests go through various ‘stations’ that together make up an automated production line. Staff calls it ‘race track’. Automisation is made by · Beckman Coulter Inc.
· Tablet PCs and handhelds: Doctors test small, tablet computers and handhelds devices. In time, these will replace the clipboard. These devices are manufactured by Hewlett-Packard Corp.
But this system would appear to be particularly exposed to terror attack or technical failure – unfortunately key considerations in the future. How will medical staff cope if the system goes down? Will they be able to treat patients? While innovative, this hospital must also be fool proof. Otherwise technology will control people rather than vice versa.”

But we don't need to go to US to find fine examples of forward oriented hospitals: In Glasgow, for instance the Homeopathic Hospital has an interesting, holistic approach that could very well be part of the design principles for Hospitals for next several decades.

In Taiwan, the Chiang Gung memorial hospital with 8.800 beds has a very advanced deployment of RFID for controlling logistics, likewise an important part of the future High Tech Hospital, where the focus is on accountability, quality, saving human resources for the health and care oriented tasks.
Asia seems to be really pushing the uptake of new technology when they plan for future hospitals;
See for instance these award winners Asian hospitals: http://www.hospitalmanagementasia.com/awards/winners.htm . Not so surprisingly, there is a number of Singapore, Taiwan, Philippine references, but China and India is beginning to appear on this list as well.
Construction of hospitals is indeed a hot topic in these mega-countries.

In Sweden, Karolinska Sjukhuset, already a leading Nordic hospital in many specialties, is constructing a new site where the use of microelectronics and Gene technology is being deployed at a World record level. See for instance this description on their use of ICT.
Hospital trends in Europe can be found here: http://www.reportlinker.com/p07613/Hospital-Trends-Europe-2004-2009.html .
Since 2006 IBM has been running a Health Competency/Innovation center for the Latin speaking countries out of Barcelona. The center benefits from cooperation with the Hospital of Barcelona, one of Spain's most modern hospitals.

Each of the hospitals awarded in US, in Asia, being recognized as World leaders, contribute to the picture of the Hospitals of the Future, yet no hospital alone seems to have it all.
Given the pressure from the Climate debate and the mentioned adverse demographics plus not least the current financial crisis, new aspects has to come into the design principles.
And of course IT is going to play a major role. (See this New Scientist Article)

But in line with IBM's recent announcement of the Smart Planet initiative, I recommend that we look at the entire value chain of 'Health' – and not only look at the Hospital and the IT infrastructure: It has to be regarded as it is: A system of systems.
A Hospital is but one (important) station en route from disease to cure, but it doesn’t solve the long range development in human habits: from eating and drinking to travelling and social interaction.

The brick-and-mortar thinking should be replaced by thinking intelligent buildings:
imbedded control of material, light, control of electricity, water, sewage..

Around the hospitals we have a huge logistic task: transporting patients in and out, particularly in light of many more ambulant treatments, but also emergency systems, evacuation plans, logistics for delivery of goods, linen, visitors etc.

And we have the internal communication and collaboration between all the different stakeholders, doctors and nurses,, including admin, records management, knowledge management – and, not to forget: Electronic Patient Records that can be exchanged, distributed and disseminated with full compliance for data protection.

Another subsystem is the flow in and out of highly advanced diagnostic systems, surgery, remote collaboration, robotics. The advanced RFID plus asset management can take care of hospital beds, instruments, (patients), all sorts of critical material.

The final major sub-system is of course the entire process of a patient's engagement, not least how the out-patient services are provided, how collaboration can be obtained between hospitak satff and primary care, between patient and local government social services, including telemedicine and a holistic treatment of cronic patients in their own home, something we have been engaged in in far too many 'pilot projects' – now it is the time to deliver.

Or as Obama has put it: It's time to Change. This is understandable if you look at the status reports from 2008. So we Northern European spoiled citizens must cross our fingers that his medical plan for US comes true, because that would create yet a stronger, global drive to real forward thinking hospitals in the future.

Video Surveillance and Privacy

In Copenhagen this summer has seen a number of gang shootings in certain districts. Events like these are certain to raise a request for more video surveillance, more policing, and prolonged prison verdicts.
Video surveillance in Denmark has been relatively limited compared to UK and US, even banks have been restricted from using outdoor video surveillance. But like threats from terrorism, the threat from gang wars - however local and limited, might change the attitude against video surveillance using all sorts of arguments like “The law abiding citizens have nothing to hide” to “It will result in much faster arrests”, even “This will prevent crimes”. (See Camwatch: Preventing Crime 24/7 )

According to Gus Hosein , visiting senior fellow at London School of Economics and recent speaker at the European Privacy Seminar in Copenhagen “The Net will not Forget” , more than 44 studies on the effect of Video Surveillance have shown that the effect in preventing crime is almost non-existing, most likely reductions observed in thefts of bicycle and from cars, whereas violent crimes do not seem to be reduced at all. Also the suggestion that video surveillance should be a significant help to identify criminals after the fact, is doubtful – at least when we consider the traditional types of CCTV surveillance systems. (SeeWikipedia: http://en.wikipedia.org/wiki/Closed-circuit_television )

According to this article in the Telegraph, only one crime solved pr. year pr. 1.000 cameras seem to be the result: See http://www.telegraph.co.uk/news/uknews/crime/6081549/One-crime-solved-for-every-1000-CCTV-cameras-senior-officer-claims.html ,And similarly, according to UK police, CCTV is an utter fiasco:
http://www.telegraph.co.uk/news/uknews/1932769/Police-say-CCTV-is-utter-fiasco-as-most-footage-is-unusable.html
One of the reasons may be due to the old fashioned technology that is typically used: Up to 80 per cent of CCTV footage seized by police is of such poor quality that it is almost worthless for detecting crimes, it has been claimed.
And yet CCTV accounts for three quarters of the Home Office's total spending on crime prevention, making it the single most heavily-funded crime prevention measure outside the criminal justice system.
http://news.sky.com/skynews/Home/UK-News/Internal-Police-Report-Recommends-New-Focus-On-CCTV-Saying-Current-Use-Is-Ineffective/Article/200908415367491

A comparison of the number of cameras in each London borough with the proportion of crimes solved there found that police are no more likely to catch offenders in areas with hundreds of cameras than in those with hardly any. In fact, four out of five of the boroughs with the most cameras have a record of solving crime that is below average: http://www.thisislondon.co.uk/news/article-23412867-tens-of-thousands-of-cctv-cameras-yet-80-of-crime-unsolved.doands-of-cctv-cameras-yet-80-of-crime-unsolved.do

To get an overview of which laws regarding privacy and Video Surveillance are in force in Europe, see the following article on legal regulations of CCTV in Europe:
http://www.surveillance-and-society.org/articles2(2)/regulation.pdf

But even if permission is granted to establish a video surveillance system, this may be very questionable as this report points out:
http://tjmcintyre.com/2009/08/overseeing-surveillance-lessons-from-uk.html
The reports points out that authorisation should always include guidelines on the management and storage of the product of the surveillance, which should be under the supervision of the Data Protection Agency. Further, the following issues exist:“ -The continuing confusion with regard to the need for authorisation when surveillance equipment (such as CCTV) is focused on an individual in a public place. It is not where the CCTV is placed (which may be overt or covert) but the manner in which the camera is used that is determinative of whether the surveillance is covert; and- Authorising Officers not knowing the capability of the surveillance equipment which they are authorising. For instance, there are differences between video cameras that record continuously and those activated by motion; and between thermal image and infra-red capability. These differences may have an important bearing on how a surveillance operation is conducted and the breadth of the authorisation being granted. Therefore, a simple authorisation for ‘cameras’ is usually insufficient ”

Even if the number of US studies on video surveillance is limited, some material can be found:
Video Surveillance - Is It An Effective Crime Prevention Tool ? (Obs: this is dated 1997 )

The issues around video surveillance are several: The cameras will invariably shoot a number of completely innocent people, and either he footage is stored for an unknown period of time, storage maybe guarded, maybe not – and sometimes the cameras are directly linked to a control centre, where officers or even private persons can observe and identify persons that can be linked to specific places at specific hours. Who sees this? How is it recorded? It is definitely not an excuse that the quality may be poor - as this may even lead to other types of misinterpreting, like who is actually shown on the tapes.

In spite of the UK experiences, a number of cities in US are installing another type of video surveillance systems based on more intelligent cameras, seem to become the next hit: See this ABC Chigaco Interview: Intelligent IRIS – Video Analytics
http://abclocal.go.com/wls/story?section=news/national_world&id=6138580

The new type of systems may have several benefits, for instance that the cameras can be programmed so that they only record out-of-line situations, whether it is traffic, lack of movement, crossing an (invisible) border line. This automatically reduces the privacy problem of storing tons of innocent person’s data. Also the ability (not discussed in the Chigaco clippings) to mask individuals to avoid recognition of phases is a clear improvement over traditional CCTV-systems.
(Intelligent cameras come in many makes, IP Cameras: http://www.videoanalytics.net/intelligent-ip-cameras.html - But the system as such requires a network, an architecture, analytical solutions and the privacy intelligence on top – like in Chigaco)

The so-called Smart Video Surveillance is discussed here:
http://www.sourcesecurity.com/news/articles/co-3223-ga.1852.html
The article clearly describes the benefits of pre-programmed observation criteria, and if this is combined with dynamic microphones, it may prove useful in assisting in arrests of real criminals and even increase privacy compared to traditional surveillance systems.
Yet another wave of ‘indirect’ video surveillance systems is rapidly on the rise: Congestion charging of cars in an out of city centres as well as video assisted toll systems represents another threat.

See this article on ‘Congestion pricing, the road to the Surveillance State:’
http://www.encyclopedia.com/doc/1P3-1448295571.html
And it really seems that quite a number of cities will have this kind of solutions in operations. Here is a short overview of traffic congestion schemes: http://en.wikipedia.org/wiki/Road_pricing

In Stockholm, one of the most successful anti-congestion road charging systems, the privacy question is solved by strict regulations on the storage and retention of the data, and by blurring the faces of the drivers and passengers on all footage. It may even be further improved, for instance by deploying some of the solutions described in this article on “Congestion pricing that respects driver’s privacy” by Andrew Blumberg (From Stanford) and Robin Chase (From Meadow Networks)

So to sum up:
Video Surveillance is erroneously being interpreted as trust-enhancing, supposed to calm the upset citizens, whereas the truth so far is that it simply doesn’t work: It can’t be shown to prevent crimes – violence due to drugs, alcohol, gangs etc. will prevail, probably either disregarding the risk or moving to other parts of cities, and the quality as we know it in CCTV is not very helpful in police work after the crime has been committed.
We may have new, more intelligent solutions coming to the market, but it must be required that privacy is embedded in these solutions. This goes for masking faces – maybe making it possible to lift masking after a verdict based on suspicion – it goes for regulations on storing and retention, and it goes for rules for deployment, particularly of covert cameras, which in any cases should be limited in the public space.
These rules should also be followed even if the purpose is not ‘surveillance’ but Road Charging,

Security& privacy in biometrics – how do we ensure proportionality ?

A basic principle in the current European Data Protection Act is to ensure proportionality between the level and amount of personal identifiable data, that you have to reveal to identify yourself has to be proportional to the risk and danger incurred if the identity is faked or stolen.

The recent years have seen a growth in tools for identification, mainly in the biometric area, that has led to the risk of 'overreacting' using easy biometrics where lesser level of authentication could have been used. One of the latest strange cases from Denmark is a night club, that has been allowed by the data protection agency to take customers fingerprints at the entrance as a means to secure against violent behavior. Horror examples of major collection of biometric data is of course U K's collection of DNA profiles for children, a practice that was started 5 or 6 years ago.

The risks involved are related to the kind of threat you are trying to prevent: Do we need the security tool to reveal the identity and all related information? This may be the case if we have a strong suspicion that a person is directly related in crime or an act of terror. Or do we only need to know if a person is 18 years old so it is legal to sell alcohol to him/her? Similarly, within the health area a nurse and a doctor do not need to have full access to a patients medical record if he has lost his consciousness and need a blood transfusion, only the key information of blood type and current medication.

So the use of biometrics in itself is one dimension of the game - and the other dimension is what the biometric identification gives access to reveal of PII – Personally Identifiable Information - at the same time or as a consequence of using the biometrics.

The first question of proportionality is then solely related to the 'strength' of the biometric method used. A weak solution is a quick, convenient solution which is non-intrusive, non-incriminating and non-discriminating in regard to civil rights and color of skin, sex, race and religion. For this purpose simple biometrics like a signature (Analog or digitized) may be better than a fingerprint ( traditional, optical electronic scanning using a template to generate a simple bit stream) - because fingerprints may be seen as incriminating, offensive, police-like. while a face recognition reveals race, color of skin and maybe sex, and thus does not meet the other criteria.

Signatures may be faked, fingerprints (simple fingerprints) can be stolen – in bizarre cases it has been seen that criminals have cut off fingers of owners of Mercedes 300S cars to break the fingerprint starting mechanism. (This risk is probably less in Northern Europe, though.) Or it may be difficult to read the results properly.

When stronger proof is needed, it is acceptable to rely on methods with higher reliability – like the thermal scanning of fingerprints, that measures the distance from the underlying blood, revealing riffs and valleys, again to be transformed by fast fourier transformation to a template consisting of 0's and 1's. This prevents the use of faked fingerprints copied on a strip of tape – and even the rough case of cutting off Mercedes' owner's finger –( presumably the blood has stopped circulating – so no heat difference). Also Iris recognition has been suggested, whereas 3D face recognition at this point still has a higher rate of errors. It has been suggested to use at least 2 types of biometry, like the US border control where you combine fingerprints with face recognition.
In any case the reliability of the identification methodology applied in every case has to discussed and explained before any solution is deployed. (See article about reliability)

It may be OK under well-defined circumstances to use higher level of trusted biometrics, even if they are not 100% proof. The second dimension of the question than is what other PII is stored with the template or the face geometry is stored and how these data are protected. This is a question of data stewardship and again should be in proportion to the use of the data. Taking the example from the Danish night club that has been granted permission to store peoples' fingerprints, these should definitely not be store with any other information than the purpose: Is this guy know to have a tendency to quarrel – NOT his name, address etc. Even if this is kept using cryptography, it is not in proportion to the use of the biometric data.

Other types of biometrics are recognition of moving patterns, voice recognition, pattern of the veins, retina scan – and of course DNA. Whereas the failure rate (both positive and negative) of the first 2 of these types are still relatively high, the 3 other may reveal unwarranted additional details of the health situation of the individual, hence these items should only be used for forensic purposes and not just collected arbitrarily or even – as in the UK DNA case – systematically.

An important aspect of using Biometrics is also how it will be possible to revoke or change the biometrics as the person changes. Whereas fingerprints remain stable for a longer period in life, face geometry changes a lot from childhood to old age, so does walking patterns, voice. And people do have cosmetic operations in their faces, accidents may change the looks and behavior so any system based on biometrics should have a way to allow for changes of this kind and it should be possible to revoke biometrics.

But as the technology improves and computing power is increasing, one solution which could use biometrics and at the same time prevent the data from occurring in the open space or being communicated could be to have an ID card with a number of different domains, each holding the relevant information linked to the person: one domain simply stating the age, another for the bank including bank account numbers, one for driving license use, one for medical/health care use, one for insurance use, one for credit cards, one for public identification purposes.
If this identity card can be activated by a fingerprint reader plus a pin code, the citizen could then select exactly how much PII he wants to reveal in the situation. This is in line with the PrimeLife recommendations from IBM Zürich Lab, that has just got the German award for forward think identity management solution. This type of solution has the advantage that the user is in full control and that no central database is required for the biometric data.

In a few days I will discuss the use of video surveillance, what we know about it as a crime prevention tool and what may be a more intelligent way of using it.