DEMTECH – Kick Off af nyt e-valg forskningsprojekt

Den 28.9 afholdt forskningsteamet bag DEMTECH kick off på Christiansborg. Projektet tager tråden op efter Teknologirådets (forsigtige) rapport om e-valg i Danmark, og har til formål over en 5-årig periode at afsøge de teknologiske/sikkerhedsmæssige som de etnografiske, sociale og samfundsmæssige muligheder og konsekvenser, herunder hvilke muligheder det vil give for udvikling af HW og SW til mulig eksportbrug. Projektet har et budget på 34 mio hvoraf 17 mio kommer fra det Strategiske Forskningsråd. Projektlederen er Carsten Schürman fra IT Universitetet, og i projektet sidder 6 PhD-studerende og 4 post doctor forskere, repræsentanter for Københavns, Frederiksberg og Århus Kommuner, Siemens, AION, KL, ETH Zürich og University of Luxembourg samt IT-universitetet. Efter en kort indledning fra formanden for programkomiteen i det strategiske forskningsråd, Henrik Reif Andersen, gennemgik Carsten Schürman ideen og omfanget af projektet. Han understreger, at Danmark spiller en vigtig rolle, fordi man netop ikke som i Tyskland, Holland eller Irland har været igennem forhastede og fejlslagne digitaliseringsprojekter, der enten har fundet eValg som forfatningsstridigt (Tyskland) eller så fejlbehæftede, at alt er stopper (Irland, Holland).Så hypotesen er, at det er muligt at modernisere valgprocessen samtidigt med at man balancerer mellem borgernes tillid og gennemsigtigheden af valgprocessen. Ideen er at betragte den demokratiske process som et 'mission critical' system, der ligesom livsnødvendige systemer skal kunne sikres for enhver pris. Derfor omfatter projektet forskning både i den etnografiske kontext, brugernes forventninger, tekniske kontrolmekanismer, herunder ikke mindst muligheden af at arbejde med 'trust by design' (jævnfør PRISE-projektets krav) og rent tekniske discipliner som kryptografering og programmeringsparadigmer.

Randi Markussen, gruppeleder for 'Technologies in Practice' på ITU, forsker i de sociale kontekster og samspil mellem teknologi og samfund, og fortalte om erfaringerne ved at deltage i den nys overståede valgkampagne 'bag kulisserne' hos de tilknyttede kommuner. Opgaven er at finde nye veje men baseret på vores repræsentative demokrati og vores valgtraditioner, herunder at sikre en bred folkelig kontrol af valg. Ambitionen er at projektet skal sikre et solidt demokratisk beslutningsgrundlag for en mulig indførelse af e-Valg i Danmark uafhængigt af kommercielle interesser og som dækker 'hele spektret'.

Joseph Kiniry, der også er lektor på ITU, fortalte at hans personlige udgangspunkt for at deltage i projektet er, at han er lige dele matematiker, software engineer og hacker, og han fortalte levende om de andre typer af 'mission critical' systemer, der altid skal virke – lige fra de medicinske, militære til togdrift, fly, atomkraftværker, finansielle infrastruktursystemer og transport generelt. Baseret på gyservalget i USA og især skandalen i Florida, hvor valget blev afgjort med en optælling af 0,009% af Floridas stemmer i Bush' favør, og hvor fejl og tolkningsproblemer med gamle, mekaniske stemmemaskiner og mere eller mindre manipulation bragte ham til at fokusere på emnet.

Efter dette valg har USA prøvet flere forskellige typer af stemmemaskiner, og især udformning, programmering og manglende kontrol parret med ensidige leverandørinteresser har gjort eValg i USA til nærmest No No. Han berettede leveende om hvordan han ved hjælp af en 'super hacker' (white hat!) Ron Gonggrijp, hackede de indtil da alment accepterede 'trustworthy' stemmecomputere i Holland, som endda fik lært at spille skak (!) - hvorefter Holland stoppede enhver form for e-Valg. Samme – eller være eksempel fra Irland, hvor toppolitikere anskaffede NEDAP stemmemaskiner uden at afvente ekspertindstillinger og brændte millioner af Euro af på et fejlbehæftet system, der var let at hacke. So erfaringerne herfra opsummerede han til følgende gode råd:

• Lad ikke leverandører løbe af med regeringen

• Lyt til eksperterne og tag konsekvensen af deres råd

• Lad ikke samme leverandør designe, konstruere, styre og afvikle eValg

• Al HW og SW som har med valg at gøre skal være transparent og Open Source

• Det vigtigste er bevare offentlighedens kontrol med valghandlingen og bevare borgernes tillid

Joseph Kiniry sluttede med at advare Danmark mod blot at fortsætte med gradvis digitalisering af valgetuden en samlet gennemgang og strategi. Han ser en fare i digitale valglister, rapportering af valgresultater over det åbne internet, tro på at man kan bruge NemID som ID ved fjernvalg.

Og så håber han, at projektet vil kunne medvirke til at Danmark finder en 'fornuftig' vej at gå – 'Think Different'.

Herefter fulgte en paneldebat, hvor følgende synspunkter kom frem:

Roger Buch, der er forskningschef på Journalisthøjskolen, lagde ud med at kritisere betegnelsen 'eValg', da det efter hans mening rettere burde hedder 'digitalisering af valgstederne'. Hans grundsynspunkt er, at on line valg er forhindret af Grundloven, og at digitalisering næppe vil lede til større valgdeltagelse, det vil tværtimod koste stemmer, og det er svært at se hvilke fordele det skulle bringe.

Jørgen Elklit, der er professor i Samfundsfag, Århus og havde erfaringer fra et valg i Syd Afrika, hvor en ansat hacker formåede at overbevise ham om, at elektroniske afstemninger kan være tvivlsomme, var mest bange for at elektroniske valghandlinger ville nedvurdere den alvor og 'festivitas' der står om demokratiske valghandlinger i Danmark. Christian Bull, der er norsk projektleder på de forsøg på eValg, der har kørt i 10 norske kommuner med 165.000 vælgere, pegede på, at der også var positive erfaringer fra eValg, bl.a. i Estland, og at den elektroniske valgdeltagelse i de norske kommuner var så høj som 73%. Han pegede på, at et krav om at studerende og rejsende absolut skal hjem og stemme fysisk i deres hjemkommune var en af begrundelserne for at se på eValg som en mulighed til at undgå at miste stemmer. Hertil kommer, at man ikke får kasserede stemmer ved et eValg.

Yldiz Ardogan, pt IT ordfører for (S), langede ud efter Roger Buch og Jørgen Elklit, som hun mente tilhørte den gamle generation, der var angst for IT. Hun mente, i samklang med Teknologirådet, at indførelse af digitale valgbusser især i yderområder/'ghettoer' kunne være nyttigt, at handicappede og ældre sam,t travle familier kunne have stor glæde af det, samt at nytænkning på området kunne bidrag til innovation og eksportmuligheder. Hun beklagede, at den tidligere velfærdsminister Karen Jespersen, i 2008 havde afvist et forslag om prøve eValg, selvom anbefalingerne var direkte en del af Teknologirådets anbefalinger.

Bertel Haarder, fung. Indenrigsminister, påpegede, at han som Kirkeminister havde gennemført de første eValg til menighedsrådsvalgene – men med meget ringe succes. Men han kunne se, at elektroniske brevstemmer via en stemmemaskine kunne være en fordel, især hvis man slækkede på kravet om at brevstemmer skal afleveres 3 dage inden valget. Også hospitalsindlagte ville kunne have glæde af sådan en løsning.

Kurt Strand, der var dagens konferencier, sluttede med at få panelet til at blive enige om, at hvis man kan sikre et transparent og sikkert system, så burde der ikke være hindringer for et eValg.

Nødtvungent fik han en accept hjem fra også Elklit og Buch.

(Se min tidligere Blog om eValg)

Hvorfor er digitaliseringsstrategien forsvundet i valgkampen?

(Foto fra Digitaliseringsstrategien)

Den 19. august udkom regeringens samlede IT strategiudspil, der er udviklet i samarbejde med KL og regionerne. Men der har været meget stille om den i valgkampen indtil nu – og det er under alle omstændigheder synd, for der er mange gode tiltag – og også en hel del mere luftige ønsker – gemt i de 43 sider, som strategien er beskrevet på.

De 3 hovedspor: 'Slut med papirblanketter og brevpost', 'Ny digital velfærd', 'tættere offentligt digitalt samarbejde' ser ganske vist ud som noget. Vi har hørt før, men på en del væsentlige punkter er der nyt at hente. Overskriften og hovedformålet lyder som et valgløfte: ”Det gælder fremtidens Velfærd” og er en videreførelse af ideen om at digitalisering i 2020 skal frigøre 3 mia årligt fra den offentlige sektor og et øget samarbejde mellem den offentlige og private sektor bidrage til øget vækst. Men hovedmålene synes at være bedre kvalitet, større borgertryghed og højere effektivitet i den offentlige sektor, noget vi har hørt siden 2001.

Strategien er delt op i 12 initiativer eller fokusområder:

1. Effektiv digital kommunikation med borgerne satser på total digital kommunikation med borgerne fra 2014, elektronisk selvbetjening for alle og adgang til mobil selvbetjening. Men fortsat via borger.dk, på trods af at især mobilområdet nu eksploderer over hele Verden med APPs'er til alt og alle. Det vil i løbet af få år betyde farvel til de portaler, der i dag betragtes som ligeså sakrale som Keops-pyramiden. Men positivt, at der tages hensyn til de IT-svage i strategien, og der ser ud til at være en fornuftig tidsfølje for aktiviteterne.

2. Lettere vej til vækst for virksomhederne lover 'mindre bøvl', on line kommunikation, digital oprettelse af nye virksomheder, lettere at ansætte nye medarbejdere og automatisk posteringer til det offentlige – og en kryptisk med ikke særlig specificeret indsats om adgang til 'tilgængelige offentlige data'. Der er milevidt fra Regeringens IT strategi til den aggressive åbning af adgang til offentlige data, der finder sted i UK og i USA. Danmark rangerer på en 16. plads på en liste over OECD-landes adgang til offentlige data, og her mangler både retningslinier, fælles principper for datalagring og sikkerhed, og dermed går man glip af et stort potentiale for udnyttelse af data mining, der kunne kickstarte f.eks. gen-baseret forskning i sygdomsforebyggelse, fødevarer, styring af trafikmønstre for blot at nævne nogle eksempler.

3. Folkeskolen skal udfordre den digitale generation. Lyder godt, men indholdet er lidt hult, når man tænker på hvor mange penge der er spildt på at anskaffe interaktive tavler og PC'er, uden at man af den grund har formået at tage fat om lærernes kompetence og støtte til nye anvendelse af helt nye undervisningsformer. Det gælder især ønsket om at eleverne skal kunne vurdere kvaliteten af informationer på nettet og kunsten at samarbejde digitalt. Forskning er nævnt, men formidling og lærerinddragelse mangler. Ipad-æraen og de mobile enheder og APPs-verdenen kræver nytænkning over hele linien, og finansiering af udskiftning af PC'er, der måske er forældede allerede om et par år, det virker maskinfikseret.

4. Effektivt digitalt samarbejde med patienterne lover fuldt digitaliserede, kliniske arbejdspladser, samlet overblik over patienternes sundhedsoplysninger, sikker og konsistent kommunikation, og en handlingsplan for udbredelse af telemedicin og støtte til kronikere i eget hjem. I lyset af valgkampens tema om nedlæggelse af regionerne ville det måske være mere værd at have haft en helt overordnet diskussion om organisering af hele sundhedsområdet – fra forebyggelse til helbredelse og rehabilitering – før man igen begynder på del-løsninger. Men det er positivt, at man taler om et samlet overblik over patientens sundhedsoplysninger i stedet for at satse på 'én EPJ' – tiden er løbet fra mastodont-løsninger og det vigtigste må være at skabe sammenhæng og adgang til forståelige data på tværs af systemer og sektorer. Fælles medicinkort er bestemt en fornuftig og vigtig delaktivitet.

5. Fart på brugen af teknologi i den sociale indsats er en glimrende målsætning, men at det nu skulle være nødvendigt at begynde med 'en udredning om udbredelse af velfærdsteknologi' er virkeligt at kaste håndklædet i ringen: Vi har MASSER af pilotprojekter bag os, det vi mangler er at kommunerne lever op til deres ansvar og satser langsigtet. Det er oven i købet muligt at få en fornuftig dialog med FOA og andre lønmodtagerorganisationer. Hvis Velfærdsteknologi skal være en dansk styrkeposition er det beskæmmende, at der ikke er flere konkrete forslag, herunder også et tilsagn fra KL om nu at begynde at satse. 'Styrket digital rehabiliteringsindsats' er ligeledes en luftig hensigtserklæring.

6. Digital, effektiv og forenklet beskæftigelsesindsats – Er det Amanda i en ny form? Digital selvbetjening hos udbetaling DK, digitale selvbetjeningsmuligheder generelt kombineret med efektiv screening mod snyd – men hvad med uddannelsesløft, opkvalificering af ledige, IKT-kompetencer for ledige ??

7. Digitale universiteter er jo dybest set beskæmmende, at vi ikke har fået det endnu. Kommunikation, optag, eksaminer er OK, men at universiteterne 'bør anvende fællesoffentlige IT-løsninger' leder tankerne hen på det berygtede VUE-projekt, for de der kan huske det. Indholdet af forskningen, brugen af højt avancerede IT-systemer, super-computing, deltagelse i globale samarbejder, kunne nok rykke betydeligt mere. Hvad med en effektiv markedsføring af danske universiteter gennem moderne tilbud om fjernundervisning til fjernere lande?

8. Effektiv miljøforvaltning på et fælles grundlag – herunder lettere adgang til offentlige miljødata, digitalt overblik over planer, bedre kvalitet i miljødata og lettere kommunikation for virksomhederne. Men hvor er miljøforandringerne og truslerne mod oversvømmelser, skybrud etc. henne? Området bærer måske præg af, at miljøministeriet har været droslet kraftigt ned under den nuværende regering, og at de gamle amters miljøindsats var så spredt, som den var.

9. Robust digital infrastruktur – konkret, vigtig og håndfast fokusområde – og ambitiøst at sigte mod et fælles overblik over IT-arkitekturen, men nødvendig. Også for at skabe forståelse for, at en Enterprise Architecture altså er mere end en IT-arkitektur, og at det er altafgørende for at sikre et samspil mellem ledelse og IT-funktioner uanset hvor i hierarkiet, man befinder sig. Men infrastruktur, der styres af IT, er altså også intelligent trafik, intelligente el-net, intelligent vand.- og kloak – og for den sags skyld intelligente bygninger. Også her er der vækstmuligheder at hente, hvis man satser lidt mere! Så godt fokusområde, men det kunne være endnu bedre!

10. Fælles grunddata for alle myndigheder – udmærket initiativ, men sigtet er for snævert: Det burde netop være adgang for alle (indenfor persondatalovens rammer/hensigt), så Open Government kunne realiseres og for at støtte mindre, men kreative virksomheders brug af offentlige data. 'En fælles datafordeler' – lyder interessant. Lad os høre mere. Forbedringer af personregistrering og bedre data om borgernes indkomst er nok marginalforbedringer i forhold til det bredere sigte.

11. Digitaliseringsklar lovgivning er nok en af de vigtigste fornyelser inden IT strategien; ike så meget den nødvendige lovgivning om digital selvbetjening, og om retsvirkning af digitale breve, men især om principperne for 'digitaliseringsklar lovgivning' – og så regler for cloud computing. De bedre rammer for IT-udbud og indkøb haster meget og må være lavthængende frugter – især i lyset af ønsket om at bidrage til vækst.

12. Det sidste fokusområde handler om styringen af den projektportefølje, som digitaliserings-strategien vil afstedkomme; koordination, implementering, klar ansvarsfordeling er vigtige, og forudsætter en veldefineret Enterprise Architectur. Dokumentation for at strategiens mål realiseres er også et krav til hensigtsmæssige business cases som grundlag for igangsætning af porteføljens delprojekter. Men hvordan tænker man at fortsætte styring på tværs af sektorerne? Domænebestyrelser uden reel magt er vel ikke nok til at sikre succes'en?

Alt i alt kommer digitaliseringsstrategien godt nok paletten rundt – men den mangler på nogle fundamentale områder, som ville have været vigtige at have med i en valgkamp, der handler både om vækst og velfærd:

Meget mere fokus på hele mobile Government-området

Virkelig slagkraft strategi for at åbne alle offentlige data – Open Government

Mere fokus på uddannelse og støtte til folkeskolens lærere for at udnytte nye muligheder

Gennemtænkt struktur for hele sundhedsområdet med en sammenhængende Enterprise Arkitektur i stedet for delløsninger

Vi behøver ikke flere udredninger om velfærdsteknologi – kom i gang og giv kommunerne incitament til at sætte det i værk

Hvordan opkvalificerer vi ledige? Med halvdelen af den arbejdsduelige befolkning på overførsel, er det ikke administrationen af pengene, der er vigtige, men derimod at udnytte potentialet

International markedsføring af danske universiteter og en indsats for at tiltrække udenlandske studerende – on line eller in person

Miljøforvaltning og robust infrastruktur – men hvad med hele området om klima, intelligente el-net, vej-net, kloak-net, huse...

Moderniserede regler for offentlige indkøb, der også støtte nye, innovative virksomheder og Public-Private-Partnership til glæde for innovation og vækst er vigtigt og haster

Digitaliseringslovgivning er et godt initiativ – det burde have en stor rolle i debatten, det handler jo om at sikre persondata men smidiggøre anonymiseret brug heraf – også i cloud computing

Endelig mangler strategien en klar diskussion om organiseringen af styringen af det videre forløb – uden en fast 'Governance model', er der meget, der kan køre af sporet.

Se også Version 2 blog om digitaliseringsstrategien

Cloud Computing – Are the Security Risks real - or is Legislation lagging behind technical Opportunities?

fig 1. Cloud Computing concepts and threats

In Denmark the discussion between Security freaks and the avant garde computer nerds has raged this summer om the question whether or not the Public Sector in Denmark should pursue the use of Cloud computing aggressively. (My blog – in Danish – covers this discussion). The con's are led by the IT Council for Security, while the pro's – amazingly – is lead by the Minister of Science, Charlotte Sahl-Madsen, who sees the opportunity to involve a number of innovative, small companies in utilizing the vast amount of public data until now stored away in departmental systems, bunkers or behind firewalls.

Gartner Group has recently publicized it's 'Hype Cycle' for Cloud Computing that points to the observation that the concept is probably currently at the very top of the Hype and bound to go through the 'Trough of Disillusionment' before we start to see real large scale, public use of the technology.

The opponents are pointing to 3 reasons why the public sector should be extremely careful to deploy CC at a large scale:

1. Cloud Computing should comply with all existing legislation concerning data security.

2. Cloud Computing solutions should obey to 'best practices' and common accepted standards that the providers should be certified to guarantee

3. Critical data should obey to national and EU standards in emergencies – currently demanding that critical data (Citizen Records, Health Records, State Financial Records, Military and police records) should be guarded and kept within full physical control of the responsible departments/public organizations.

The Minister of Science requests a new look at Data Security, and even EU is expected to produce a suggestion to ease the European Directives on data protection to stimulate use of Cloud Computing.

But what are the facts and what are the real security challenges in Cloud Computing? Are there any new technological developments that will ensure that legislations' intents are obeyed even if the rigorous requirements for 'physical control and inspection' can not be performed in it's original sense?

First we need to agree on what Cloud Computing is and what is isn't. In February 2009 the UC Berkeley Adaptive Distributed Systems Laboratory gave out a technical report describing the phenomenon.

They point out that Cloud Computing refers to both the applications delivered as services over the internet and the hardware and systems software that provide these services. The applications themselves are labelled Software as a Service. The underlying HW and SW is described as the cloud. When a cloud is made available on a pay-as-you-go manner, we call it a Public Cloud. The service being sold is called Utility Computing. In contrast to this, a Private Cloud refers to internal data centers or data centers not made a available to other that one customer (or a coherent set of customers). The Private Cloud is dismissed from the Berkeley sense of Cloud Computing, even if pricing and to a certain degree scalability might be at least similar to 'Real Cloud Computing'.

Now the business model of Cloud Computing in it's original form thus consist of this 'value chain': we have the SaaS user, the end user that buys the services, web applications. He might buy these services from a SaaS-Provider, who can be seen as a Cloud User, that buys the underlining HW and basic SW capabilities from a Cloud Provider. Of course the Cloud Provider and SaaS provider might be one and the same organization.

The various classes of Utility Computing that are offered through individual business models, vary of course (Amazon, Microsoft Azure, Google, IBM etc.) and the various types are reflected in various models for computation models (Virtual Machines running on 'Hypervisors' or a 'farm' of VM's), by various storage models including variations of DB SW provisioning and finally various Network models from pre-defined IP address spaces, dynamic allocation, fixed topologies, 'elastic zones' etc.

This variation reflects the lack of common standards but is of course a result of the intense competition in the marketplace. But is has led to new definitions a part from SaaS that are used commonly: Platform-as-a service – typically major application areas, SAP for instance – and Infrastructure-as-a service. Especially the latter variation leads to the conclusion that the organization that buys IaaS simply buys the basic building blocks and otherwise are left with the responsibility to populate the Cloud by his own applications and development tools. This type of Cloud business model is especially appealing to SW developers, while the PaaS model is aiming at solving enterprise (or Government institutions') problems.

To confuse the matter more, the terms 'Community Cloud' and 'Hybrid Cloud' have risen recently – the former simply refers to a private cloud with many tenants (municipalities, agencies for instance) while Hybrid indicates that some of the applications in the portfolio in running in the Public Cloud while other services within the portfolio remains in the Private Cloud.

The application opportunities that have occurred the last couple of years as a result of this combination of highly scalable, robust 'back end' systems and an aggressive 'pay-as-you-go' pricing model covers interesting areas like mobile interactive applications, large scale batch processing jobs, heavy data analytical computation jobs, to more straight-forward desktop services solutions avoiding tedious updating and installation of new SW at each and every employees desktop.

The economics of Cloud Computing explains why the Berkeley-team did not want to include 'Private Clouds' in the definition: The huge requirements of back-end capacity and the real need for economy of scale makes it almost mandatory that the players are very large companies that can afford the risk of large scale investments – and on the other hand are able to manage and balance load in an extremely efficient way. Sharp changes in capacity demand, seasonal fluctuations, including back-up requirements, fall-over facilities etc. plus of course traffic bottlenecks in communication equipment clearly makes the unit costs of Cloud Providers competitive compared to traditional Data Centers. This is the major argument for US CIO Vivek Kundra's Federal Cloud Strategy 'Cloud First', announced February 2011, where it is stated that at least 20 Billion US $ out of the total 80 billion $ spent by federal agencies in 2011 could be saved by moving to the cloud.

Other economic benefits of moving to the Cloud as stated by Vivek Kundra are the improved productivity in application development, fast response time to rising needs, better linkage to emerging technologies and alignment with private sector innovation.

It is tempting to argue that the huge difference between the European 'Cloud Scepticists' and Vivek Kundra is that US is desperately in need of savings and in any case not very concerned about privacy, the Europeans have a more than 10 year legislation on privacy, now adopted in almost all EU countries and at least in some countries (led by Germany) this plays a very large role in public opinion. This is the reason why the EU Commission has requested an in depth study of legal and technical implications of Cloud Computing in light of the EU 94/46 Directive. These changes are not due to occur before spring 2012.

OK, but where are the REAL risks?

Looking at Figure 1 we can identify 4 classes of risks of malicious, unauthorized access:

• End user access – non-authorized attempts to gain access to read, steal, modify data, DOS etc.

• Inter-Cloud Access using external services to hide malware, worms, trojan horses etc.

• Tenant related 'insider' attempts to gain un-authorized access

• Cloud Provider administrator 'insider' attacks

Add to these risks the risk of errors in a shared physical environment if instances of VM and in particular data are not kept isolated from other tenant's.

Let us try to address the question of how a secure cloud solution could be established following the 3 items mentioned by the Danish Council for IT Security.

1. Comply with Data Protection laws.
   Their first concern is that a cloud and Saas-provider should comply with the current legislation. This has as it's root the requirement that it should be guaranteed that only authorized persons get access to data that contains PID (Personally Identifiable Data).

   You could argue that this is first and foremost the responsibility of the department that collects and stores the data to ensure access rights and to ensure that the Cloud provider follows the requirements in this respect: logs access as well as access attempts, prevents unauthorized access to customer data also by his own staff. Ultimately this requires for the government agency that wants to move to the cloud that it maintains a security organization that issues or controls issuance of access certificates and up-to-date Access Control Lists.
   It is likewise a requirement for any procurement and contracts with cloud providers.
   

2. Cloud provider should adapt 'best practices' and standards and be certified.
   Best Standards are at this stage only emerging, and it may be a tough requirement, before internal standardization agencies and governments agree on this. But there are practices that could help guide the Cloud Vendor. (See also Google's White Paper on Cloud Security)

   First of all the psychological fears of privacy breaches could be avoided if the cloud provider could guarantee against intruders passing the firewall and accessing user data, we already discussed the first level of this. The second layer attack could be hidden in the cross-application communication that will eventually occur when external clouds exchange services and data with the tenants of one cloud operator. It might be simple things like services for currency exchange calculations, or it might be much more SOA-like, cross domain data analytics – for instance health care research across several EHR-systems.
   The more basic services to protect against things like VLAN-spoofing and firewall configuration errors should in any case be part of a contract with a trusted provider, but the Achilles-heal is the second type: access to primary data across a number of domains.
   We will discuss this in more detail later to see if there are some technological development ahead.
   

3. The 3^rd requirement from the Security Council concerns national security regulations. These requirements are probably more difficult to deal with if legislation is taken literally: that inspectors should be able to physically identify data bases and storage devices. That is, of course unless you are able to prove that a) The data are protected from any 3^rd party reading and interpretation, and b) that even if the case of destruction you are able to re-construct data in a secure way. One would think that Vivek Kundra had this in mind but came to the conclusion that all major cloud providers are deeply rooted in US.
   
   There are, however, some inconsistencies in the current legislation; while it is understood that no foreign power should gain access to a complete Person Registration system, it is questionable why a financial system and related data should be considered 'strategic' if the data are duplicated and can be reproduced. This is the position of the Danish Minister of Science. But the intention as specified in national legislation to keep strategic data within the country seems to be more like a legal problem – especially if the true meaning of the word 'Control' can be solved in other ways. If you have full back up/recovery of data, full duplication and secured your data by top class (maybe even dynamic) encryption of data you could argue that you, the data owner has full control.
   

So it seems that there are technical ways around at least most of the issues – but how real is the idea to have all public institutions manage the access rights, secure encryption of the data and still be able to exchange and exploit data across institutional borders in a 'community-like' public cloud environment? Let us assume that all policy aspects are solved, agreements of responsibilities between tenant of cloud provider (and SaaS-provider) are put in place, SLA's established, certification of best practices – then is the idea of a grand scheme of encrypted data at all feasible?

Already in 2009 the IBM researche Craig Gentry suggested a method of what he called Homomorphic computing which would enable users with appropriate access rights to access and calculate on encrypted data across domains in a way where the final result could be decrypted and produce the same result as if the operation had been performed on the 'raw' data. If this is a feasible and economic practical solution, then most of the obstacles of putting sensitive data in the Cloud have disappeared. But as usual, there is no such thing as a free meal. At the current state of development, the computational requirements for this 2-step encryption method are enormous, at least at present enough to turn the economic advantages of Cloud Computing off. So we will still have to wait for the costs of computing to come down – and as it seems we are already getting beyond Moore's law and accelerating developments, it is now believed that homomorphic encryption will become economical feasible within the next 5 years. And when it will be solved, the interim requirements of close control with the Cloud provider might be reduced.

But then we need in any case to agree on and clean the standards, define and refine policies, practice and implement large scale ID-management and authorization. In any case the answer to the question whether the technical risks of cloud computing are real is yes, and it will be solved. Eventually.

Cloud Computing i den offentlige sektor – En død sild eller ...??

Henover sommeren har der været en hel del artikler om det offentliges brug eller ikke brug af Cloud Computing. Rådet for IT-sikkerhed nedkom med en pressemeddelelse den 18. juni med budskabet: 'Vent med Cloud Computing i den offentlige sektor', som blev kraftigt kritiseret af Børsen i juli, hvor Jesper Frederiksen beskyldte Rådet for at være bagstræbende og for at forhindre den offentlige sektor i at opnå massive besparelser. Selv IT- og Telestyrelsen gik ind i debatten og erklærede sig uening med Rådet for Større IT sikkerhed. (Se ComOn's udlægning: 'Rend og Hop'!)

Parallelt hermed har Videnskabsministeren hele foråret er klæret sig som varm fortaler for mere brug af Cloud Computing i det offentlige: Videnskabsministeren siger ja til cloud-løsninger i det offentlige og har udtalt, at 'Persondataloven forvirrer for meget' og hun har derfor nedsat en arbejdsgruppe, der skal se på, om der kan laves lovændringer, så det bliver nemmere at bruge Cloud Computing i det offentlige.

Så hvad er op og ned i den diskussion?

Rådet for større IT sikkerhed anbefaler, at det er uomgængeligt at 4 krav skal opfyldes, før nye offentlige cloud løsninger etableres:

• Sikkerhedsforholdene hos leverandøren skal kunne verificeres ved fysisk inspektion og certificering af leverandøren, der sikrer overholdelse af EU og dansk lovgivning

• Der skal være løsninger for nødberedskab

• Der skal være klare aftaler, der sikrer at data forbliver i myndighedernes varetægt og lagres inden for EU's grænser

• Kritiske IT løsninger som forsvar, politi og CPR bør under alle omstændigheder være fuldstændigt under statens kontrol

I det hele taget mener Rådet, at manglen på standarder og gennemsigtighed hos leverandørerne gør det højst umuligt at anvende andet en 'privat cloud', d.v.s. en lukket anvendelse af principperne i Cloud Computing, men helt under det offentliges kontrol – muligvis via en tredjepart, men under alle omstændigheder inden for landets grænser.

IT-og Telestyrelsen er ikke enig i IT sikkerhedsrådets konklusion og de fremhæver, at de har gode erfaringer med cloud computing til tre systemer, især eFaktura og Nemhandel. Når Datatilsynet indtil nu ikke har godkendt Odense Kommunes skolevæsens brug af Google Apps, mener man i ITST at det løser sig, når kommunen finder nye formuleringer. I øvrigt henviser man til det arbejde, der er udført i IT Sikkerhedskomiteen om De juridiske rammer for Cloud Computing 17.5 2011

På hjemmesiden Digitaliser.dk, har der løbende kørt diskussioner om brug af cloud computing. I bloggen skrevet af Marie Munk: Partly Cloudy er hun især positiv overfor brugen af standard SW (SAAS – Software as a Service), men i det hele taget indstillet på at det offentlige kan gå foran og afprøve nye serviceformer. Men ser vi Private versus Public Cloud – Niels Pagh Rasmussens kommentar – er denne mere på linie med Rådet for IT Sikkerhed. Og der har da været en del eksempler på brølere – f.eks. omtalen af at Cloud-fejl i køreprøvesystem påtales af Datatilsynet .

EU er i fuld gang med en revision af diverse regler og direktiver, der kommer i spil når man overvejere Cloud Computing. Det fremgår af denne artikel: Charlotte Sahl-Madsen positiv overfor lovændringer der forhindrer regnskabsdata, at arbejdet skal være tilendebragt den 31. august 2011, så kommissionen i starten af 2012 kan komme med nye forslag, herunder også om de regler, der i dag begrænser at nationale regnskabsdata kan flyde frit over grænserne. Man må formode, at man også vil tage stilling til, hvordan den gamle 'Safe Harbour' regel kan opdateres. Safe Harbor – Certificering af data centre i udlandet var den regel, der gjorde det muligt at overlade Europæiske, Schweiziske og Amerikanske Data til certificerede datacentre i hinandens lande. Problemet med Safe Harbour er imidlertid, at i de mere end 10 år den har været i kraft har der aldrig været nogen klage eller sagsanlæg, på trods af at man antager at ca. 1/3 af datacentrene ikke lever op til certificeringen. Dertil kommer, at hele ånden bag Safe Harbour er blevet ødelagt efter 9/11 af Patriot Act – indkskrænket beskyttelse af persondata blev resultatet, så man kan forvente, at US efteretningstjenester har fin adgang til de persondata fra udlændinge, der befinder sig i US.

Ikke desto mindre har især den amerikanske CIO Vivek Kundra udarbejdet en national strategy:

'Cloud First' – Vivek Kundra's national cloud strategy – der peger på særdeles omfattende besparelsesmuligheder ved at flytte federale og statslige datacentre til Cloud Computing.

I lyset af den amerikanske finanskrise, er det nok overvejende sandsynligt, at det vætigste argument her nok snarere er besparelsespotentialet. Samt en formodning om, at da cloud-lverandørerne typisk er amerikansk ejede virksomheder, har man de nødvendige håndtag – samt et noget mere afslappet forhold til persondata. Hør Vivek Kundra tale om Cloud: Vivek Kundra – US CIO – understreger vigtigheden af at flytte offentlige løsninger til cloud computing

Ud over USA er også Australian langt fremme med anbefalinger til anvendelse af Cloud Computing, og man beskriver i strategien fra april 2011, hvordan pilot applikationer som eTax og Business Reporting bliver evalueret. Denne rapport er en glimrende oversigt over muligheder, og den indeholder i øvrigt Gartner Groups 'Hype Cycle' for Cloud computing.

Medens den Australske model er meget åben over for applikationer, der liogger i 'Public Cloud'. Er UK's CIO-committee mere forsigtige og peger på anvendelser indenfor 'the G-Cloud' – d.v.s. En privat cloud der deles på tværs af ministerier og forvaltninger i UK.

Diskussionerne er langt fra overstået, og det bliver spændende at se, hvordan diskussionen mellem Rådet for større IT Sikkerhed og IT- og Telestyrelsen/Videnskabsministeriet udvikler sig.

For fuldstændighedens skyld kan man med fordel læse rapporten om

Cloud Computing i den offentlige sektor fra 2009 og måske også Google Apps Security White Paper for at se, hvad Cloud Leverandørerne har i tankerne.

The IBM Centennial - IBM Denmark Milestones 1970-2011 (part 2)

(This picture was published in Gyldendal's Encyclopedia in 1971 under the heading: 'Modern Electronic Data Processing'. It was taken a few months after I started in IBM and was deeply engaged with the 360/40 simulating The Maersk Company's container traffic using GPSS. It was a proof-of-concept, that led the Maersk Company to invest heavily in management systems for containers, and was as such the first milestone that I remember.)

From 1970 to 2011: Until the first oil crisis business was booming – the big Data centers really took off, both in the financial sector and in the public sector, where the major part of the cities now joined forces in Kommunedata matching the equally powerful Datacentralen, owned by the State Government.

The first major project IBM had with the Aalborg Kommunedata Center was the so-called 'Project Database' where we spent a year to map all transactions, work flows, and archives in the city of Aalborg and jointly developed a complete catalog of municipal applications as an idea. This was in fact used for Kommunedata's first on-line success, the SIP-system with info on Tax, Income and Personal Data. It was a predecessor for what later became known as Enterprise Architecture and used as teaching material at university level.

After the success of the 'pay-as-you go'-tax and the Central Personal Registration System, the next major application area became the Social Security System (Sygesikring/Dagpenge), probably the most ambitious system of it's kind. Kommunedata worked hard to solve all the inconsistencies in the legislation and by something close to a miracle - and a very firm controlling hand - the system was launched in 1973. Behind the scene it was a mess

– integration consisting of tapes being carried from one sub-system to another, but it worked.

In IBM DK we formed a 'think tank' giving advice to new uses of Government DP and among other initiatives we launched the 'Government Game' – you could say an early version of 'SimCity' which really opened the eyes of many politicians and top managers during the many seminars we arranged. An other new thing was the creation (in APL!) of what we called 'SiSyFos-model' (In Danish this was short for Taxes, Income and Social Benefits seen from a Family perspective). This was the first time all these diverse legislative initiatives, all depending on actual income, family size etc. were brought together. With astonishing results showing the problem areas where marginal taxation exceeded 100%!. This was later taken over by Datacentralen and the Ministry of Finance as a general law-model and has been refined ever since.

At the same time my IBM colleagues in the Health Sector developed the first on line Medical Record System, 'The Red System' – because the proposal was wrapped in red paper. It was based on DB/2 (Well, IMS) and ran on 3270 screens (4 colours!). It was developed by 3 counties and in 76 it became part of Kommunedata's new County/Medical Center in Skejby, Aarhus.

Other milestones of IBM Denmark impact in the 70'ies were undoubtedly the massive investments made by the Danish Banking sector. It was the dawn of the banking terminal era based on the IBM 3600-terminals and major main frame solutions. And in the beginning of the 80'ies an extraordinary thing happened in Denmark as the banks agreed to implement a common debit card system, the DanCard, and created a joint center, the PBS, to handle this and soon all major credit cards business as well. This greatly influenced the way the Danish population became accustomed to 'EDP'.

As the 3rd generation computers - the IBM 360 announced in 1964 - were replaced by the 303X-series, the competitive marketplace changed once again for IBM, and in parallel with the 'high end' 303x customer segment new initiatives for the SMB-market were on their way, so the early 80'ies saw the beginning of the era of SMB and Business Partner way of marketing. Also the personal computer entered the market place and IBM's PC was born. In a garage in Boca Raton, Florida based on standard components and external SW - but the brand name immediately made it a success.

In Denmark we saw the opportunity to go for the educational market – Schools and Universities – and mainly because we focused much more on SW, applications, 'Teachware', plus solutions for handicapped children - and how this new technology could be used by teachers, IBM soon became the absolute leading brand in the Danish Schools – from general schools, to High Schools to Teacher's Seminars.

(The poster illustrated our new style of communication with the young generation - we couldn't use Chaplin, we dis-liked the Pink Panter so this was one our favourites)

In the late 80'ies as the industry turned to distributed data processing, competition turned to Unix and mini computers, and the early 90'ies witnessed the problems of IBM doing the traditional stuff. Lou Gerstner 'Taught the Elephant to dance', but in the process a number of IBM'ers were laid off, something never seen before. Because IBM Denmark always had a reputation for running a tight ship, the impact here was in fact minimal, although felt hard enough by those exposed to it. And the major reorganisation for the first time really put an emphasis on services – from consulting to hosting services to programming. And IBM Denmark struggled for this.

In the early 90'ies we looked for new business and one of the milestones during this period was the first projects for TeleMedicine. The first project was implemented with the Viborg County where pictures of tumors scanned by an electronic microscope and via 2 ISDN-lines were transmitted to a specialist hospital where the experts could judge on the nature of the sample shown in the picture. The next pioneering project was sending Magnetic Scanning pictures from Queen Ingrid's Hospital in Nuuk, Greenland, to the National University Hospital, where the pictures of unborn babies could be studied to decide whether the pregnant ladies should be transported to Denmark or give birth locally under advice from the specialists. Also video conferencing systems were pioneered, partly with Danske Bank.

So even at this harsh time there was a focus on new business opportunities. - And then we entered the Internet age – first called 'Multimedia'. Some of the early projects included a plan with Datacentralen to install 1000 information booths in Denmark with access to all public information, but it soon became clear that this idea was overtaken by the rapid development of 'the Net', and 'eBusiness' emerged.

So IBM Denmark played a leading role in this – We helped the City of Copenhagen launch their first major web-site with on line access to a huge database with practical information, we launched a joint county-company website in North Zealand with the first websites of prominent companies like DSV and Coloplast, and we participated in 1999 with the first secure payment systems using internet payment for eBusiness solutions in cooperation with PBS and the Egmont on line book shop.

The new IBM led to acquisition of a number of companies: From the Lotus SW company to Price Waterhouse's consulting group, to CMA hosting services to Maersk Data and through Maersk the Acure Health Services company originally part of LEC, the Danish Agricultural Data Center.

Among the major milestones for the first 10 years of the new millennium was undoubtedly the health portal, Sundhed.Dk, for the first time integrating a remarkable number of back-end systems from medical records to medicine prescriptions, communication systems across the health sector and between patients and doctors, doctors and specialist. This major websphere portal received several international prices and is still one of the top international solutions in the World.

Maybe less visible but equally important was the consulting effort towards the central Governments IT Task Force developing the Danish ICT Public strategy. IBM has contributed to this rather consistently since the very first reports in the 90'ies and until today using IBM methodology to map the relevant domains and activities across the public sector (FORM, STORM).

In the local Government area the most exciting development was happening in the municipalities, partly as a result of the major reorganisation that took place in 2007 but prepared during the period from 2003-2006. During these years IBM consulting developed and tested Enterprise Architecture solutions that helped different authorities to merge their operations. If one city should be mentioned, it must be the City of Odense, where joint efforts between the City IT staff, the business partner and IBM resulted in a quite spectacular solution covering both intranet, citizen services and linkage to a number of back end solutions.

The largest public sector solution in Denmark was undoubtedly the deMARS-project for the Defense. A huge multi-year SAP project designed and implemented by IBM. The system was delivered in 2005, and IBM is now also responsible for operations.

Of course a number of important sales and implementations took place in the industrial sector as well as in the major banks – Nordea, Danske Bank – rapidly becoming the largest IT installations in the Nordics. Maersk Company, Carlsberg, NovoNordisk and many more were equally in the forefront of ICT development, but if one real new activity should be mentioned, it must be the Edison project, were IBM teamed up with DONG energy, BetterPlace electrical Cars, the Technical University of Denmark to produce a pilot project in Bornholm, were windmills would create up to 80% of the anticipated power consumed, using the batteries of the electric cars as a storage and a buffer in periods with more wind than needed. This is part of the 'family' of projects that IBM launched under the heading 'A Smarter Planet'. Around the World these kind of projects will be fundamental for the success of the company during the next hundred years.

The nature of the ICT market has changed over the 100 years of IBM operations in Denmark – the competition has changed from decade to decade. And the company has changed. But what has remained intact is probably the fighting spirit and the teamwork among the members of the company – including the 'new comers', the 'light blue employees', those that did not choose IBM as their first choice but was bought into the family. The milestones I have highlighted of course reflect my personal experience but nevertheless I think covered the major successes and also some of the small, but innovative steps that moved IBM forward.

(See part 1 of the centennial blog)

Sundhed 3.0 - Behov for nytænkning haster mere end nogensinde

Bertel Haarder - Grundlovsmøde 2011

Ved afslutningen af Folketingsåret kunne Bertel Haarder løfte armene, da Sundhedsministeriet som det eneste ministerium tilsyneladende får tilført ekstra milliarder år for år frem mod 2020.

Ser man nærmere efter, er dette et resultat af tidligere indgåede aftaler, bortset fra de fingeraftryk, som Pia Christmas Møller fik sat, og som især gavner det psykiatriske område. Men hvordan ser det ud i fugleperspektiv?

Vi står ved starten på et omfattende sygehusbyggeri, som i løbet af de næste 10 år vil koste 41 Mia kr., hvoraf de 25 mia kommer fra Staten og resten fra Regionerne. Tilskuddene er blevet prioriteret efter alle kunstens regler, og regeringens ekspertudvalg har grundigt analyseret regionernes planer og tildelt midlerne og offentliggjort begrundelsen i rapporten fra november 2010.

Men allerede før rapportens fremkomst var der kritiske røster, der pegede på, at en al for stor del af de afsatte midler ser ud til at vedrøre mursten snarere end teknologi, på trods af intentionerne og på trods af regeringens oprindelige visioner om at det omfattende sygehusbyggeri kunne blive en showcase for de danske kompetencer på området. Den 25. maj kunne man i Ingeniøren læse en artikel under overskriften: Ingeniører om Supersygehuse: Byg et ad gangen.

Heri anbefaler 71 procent af de adspurgte ingeniører at sygehusene bygges serielt, så man kan lære af hinanden. Næstformanden for regionerne, Carl Holst er ikke enig, han siger at man dels baserer sig på internationale erfaringer fra Sverige, Norge, Finland og Island (der var deltagere fra Sverige og Norge med i Regeringens ekspertudvalg), og dels er man meget obs på at lære af hinanden.

Hverken de 71% af ingeniørerne eller Carl Holst forholder sig imidlertid til kritikken om, at kun en beskeden del af investeringerne sker i teknologi.

Værre bliver det, når Bertel Haarder understreger, at man ved den nye sundhedsaftale 'fokuserer på brug af Telemedicin, der vil kunne spare 4-6 milliarder kroner'. Bertel Haarder henviser her formodentlig til Formanden for Dansk Selskab for Telemdicin, Klaus Panareth, der udtalte at 4.700 hospitalssenge kunne spares væk, såfremt sygehusvæsenet virkeligt skruede op for brug af telemedicin. Han anslår, at næsten halvdelen af de 3 millioner sengedage, som medicinske patienter har hvert år, kan spares væk. Det giver 7 milliarder kroner.

Bertel Haarders forklaringsproblem er imidlertid, at kommunerne i dag overhovedet ikke har taget telemedicin til sig (Se vores udredning om dette) ,at der ikke er planlagt en revision af hele organiseringen af sundhedsvæsenet, som dette ville medføre (Og som ekspertpanelet faktisk direkte har anbefalet i kapitel 3, synspunkter på fremtidens sygehusstruktur) – og hvad værre er, at man har afsat 50 millioner til at fremme brugen af Telemedicin. Beløbets størrelse står slet ikke mål med den mulige besparelse, og man har ikke tænkt andre incitamenter ind i modellen, men ovenikøbet ændret afregningen mellem kommuner og sygehuse i en retning, der ikke umiddelbart fremmer tilskyndelsen til at investere i hjemmeovervågning, organisatoriske ændringer, sammenhæng med primær lægetjenesten.

(Det er åbenbart symptomatisk at man hellere vil give 300 mio til en øget toldkontrol ved grænsen, som har vakt vrede hos alle vores naboer – men det er jo en anden historie!)

Det kan næppe være ABT-fondens opgave at designe den organisatoriske ændring af den danske sundhedsmodel, der vil være nødvendig frem til år 2020 – og slet ikke for 50 mio kr! Lige så lidt som man kan tage ingeniørernes anbefaling om at bygge sygehusene sekventielt alvorligt – det er jo stadig 'kun' en delmængde af det samlede problem.

Allerede i efteråret kunne man i MandagMorgen den 24.9 læse en artikel under overskriften

'Århundredets sygehusinvestering risikerer at blive tabt på gulvet'

Hvor kan man gå hen for at se gode erfaringer, der flytter patienterne ud af sygehusene og medfører en højere sundhedstilstand? En af de cases, som mange peger på, er Kaiser-Permanente i Californien. Her har man dels etableret nogle af Verdens mest moderne hospitaler, men også organiseret hele patientforløbet på en meget mere effektiv måde. Man har etableret store lægecentre, hvor både almen praktiserende læger, speciallæger, sygeplejersker, laboranter og andet sundhedspersonale kan supplere hinanden, stå for en effektiv diagnose og visitering og ikke mindst bistå ved 'call centre' for udskrevne patienter, så genindlæggelser minimeres og patientens trivsel øges. Så vi skal ikke 'vælge' læge i Sygesikringen – men lægehus. Det vil fremme en hurtig diagnose, øge trygheden og mindske presset på sygehuse.

Hvis vi om 10 år står med en aldrende befolkning, hvor patienter med kroniske sygdomme beslaglægger 60-75% af det samlede sundhedsvæsens ressourcer, er det oplagt at flere vil lide af mere end én kronisk sygdom med hvad det fører med sig af behov for viden om forskellige mediciners virkning på hinanden, individuelt tilpasset overvågningsudstyr og behov for patientens on-line kontakt via lægecenter med relevant personale – enten i centret, på specialesygehuset eller hos andre.

Det er ikke nok at allokere 50 mio til en ABT-fond, der ikke har ansvar for re-organisering af sundhedsvæsenet, det er ikke nok at give 600 mio til en ny helikopter og akutbiler (omend lægehusdelen af dette initiativ er et lille skridt på vejen, selvom det er et hold-kæft bolsche til 'udkants-Danmark).

Ekspertudvalget, der indstillede prioriteringen af investeringerne i de nye sygehuse, var i deres kommissorium begrænset til at vurdere indretningen, organiseringen og designet af de nye sygehuse, ikke af den samlede sundhedssektors organisering. Og det er det, der er behov for.Som udvalget skriver i afsnittet om 'synspunkter på fremtidens sygehusstruktur':

”Fremtidens sygehus må derfor ikke planlægges og bygges som en simpel lineær fortsættelse af fortiden. Fremtidens sygehuse er ikke lig med selv det nyeste af dagens sygehuse. Der skal tænkes mindst 10 år frem, før flere af sygehusene overhovedet tages i brug. Udfordringerne til fleksibilitet er store, idet man kan forvente, at en stor del af den teknologi, som skal til rådighed for sygehusene i 2020 slet ikke er kendt i dag.”

”Med det omfattende investeringsprogram skal der være plads til nytænkning omkring organisering, logistik og brug af teknologiske muligheder.” (s.19)

Der er kort sagt brug for en meta-model for sundhedssektorens opgaver, funktioner i relation til patientgrupperne – herunder af forholdet mellem forebyggende behandling, fjernbehandling, selvbehandling, diagnosticering, forløbsstyring, kvalitetssikring, udskrivningskontrol, genoptræning og samspil med pleje, kommunale services, ambulante kontroller etc.

Vi kan anvende begreber fra Enterprise Architecture til at mappe byggeklodserne, flowet, funktionerne – og det skal IKKE forveksles med f.eks. G-EPJ, der var fejlslagen, fordi den efter flere års forsøg på generalisering af selv de mindste detaljer i arbejdsgange ikke fik opbakning og ikke havde mulighed for løbende tilpasning og justering. Hvis Regeringen sammen med KL og Danske Regioner virkelig VIL en sundhedsreform, der også omfatter almen praksis, så er det nu. INDEN supersygehusene sluger alle ressourcer og opmærksomhed og løser problemer, der ikke vil være relevante, når de står færdige.

IBM Centennial – From 1911 to 1970

(Picture: Dansk Folkeforsikring installs the first "real" computer - the IBM 1410 in 1962)

On June 16. IBM will celebrate it's 100 years anniversary, the Centennial. On that date in 1916 the Computing, Tabulating & Recording Company was incorporated as a merger between 3 companies.The Computing was actually represented by computing scales, and recording was the Time Recording used as a basis for wages in industry. The Tabulating part was a result of Hermann Hollerith’s invention of the punched card machinery, first used in 1890 for the US Census.

As Hermann's business idea was to rent the machinery to customers and not sell it, he soon realized the need for a much larger marketing muscle and willing investors, which is why he gave up his company to enter the merger. This company was renamed to International Business Machines, but that happened as late as 1924. So in 13 years IBM can celebrate yet another centennial.

As I have been granted the privilege of access to my former company's archives in my attempt to write the history of IBM Denmark, I have dug into the archives to see what kind of impact the CTR-company, the Hollerith equipment and later the Danish IBM company has had on the Danish society. (See my slides from HINC3, History of IT in the Nordic Countries, Stockholm 2010)

As it turned out, this year is also the centennial for the first Hollerith equipment that was used in Denmark: The Danish Statistical Department received 2 sorting machines, 1 tabulator and 6 punch card machines in june 1916, ordered through the German affiliate of CTR, DeHoMag – Deutsche Hollerith Machinen Gesellschaft A/G. The were returned only after one year, and the impact was not impressive – with no service personnel and no instructions, the machines jammed frequently, which proved a challenge for the first entrepreneur selling 'IBM' equipment in Denmark, Max Bodenhoff, who was granted the role as an agent for Hollerith Equipment in 1920.

Max B. tried several times to persuade IBM to set up a service bureau, but only succeeded in 1933. During the recession of the thirties and especially during the German Occupation 1940-45 this proved to be one of the reasons why IBM solutions had a stronghold in Denmark in the Forties, and helped by a donation from the US Army of 2 lorries filled with punched card equipment from the US Army, the Data Center and the City of Copenhagen immediately after the war was updated with 'heavy' machinery. The team with Max B. had spent the war to develop an arsenal of different applications and solutions, so it was a solid base, upon which a new affiliate could be created in 1950. Viggo Troels-Smith became the first CEO, a position he held until 1952, when he was named Executive Assistant to the European IBM Vice President, and then again from 1960 until his death in 1980.

The punch card era in DK contributed to a number of solutions for the public sector: Danish Railroads, census and statistics, but most important salary systems, citizen registration and taxation systems. Also the insurance business was among the key industries at this time.

The cities of Copenhagen and Frederiksberg pioneered the use and applications in the municipal sector, and the 2 top salesmen in the IBM hierarchy, Renner Andresen and Willy Olsen, became the founding fathers for some of the most important Data Centers in the public sector. Already in 1953 the association of municipalities and the association of cities in the County of Copenhagen, created the first center serving several communities, but soon the idea was taken up by other parts of the public sector: Renner A. became the first CEO of Jydske Kommuners EDB-central in 1955. JKE eventually merged in 1971 with other municipal centers to create Kommunedata, now KMD. Willy Olsen formed Government Data Center, I/S Datacentralen of 1959, most likely based on a request the year before to IBM to enter into highly confidential planning discussions on a new taxation system – 'pay as you go' – instead of the traditional, declaration based system. Willy O. was in charge of IBM's team, and undoubtedly he spotted the business potential, yet it took almost 10 years before the work materialized in a very advanced citizen registration system and a new taxation system. Also one of the World's first Vehicle Registration System – based on the IBM 2321 Datacell with Teletype terminals – was installed in the late 1960's.

The 60'es marked the first decade with 'real' computers – from the IBM 701 to 1401 and then the 1410, that was claimed by old timers to be the first 'real' computer as it had multiplication and division as part of the instruction set, something the 1401 and other contemporary machines had to simulate. This gave rise to new, advanced solutions: Dansk Folkeforsikring installed the first 1410 in 1962, Handelsbanken entered the computing age at the same time. In 1963 Scandinavian Airlines Systems launched their first IBM based booking system, SASCO I, and in October 1965 a 'super computer' IBM 7090 was installed at the Danish Technical University after lengthy negotiations as a gift to the scientific World. It was part of Scandinavian/Dutch University network and named NEUCC – Northern European University Computing Centre. It was soon upgraded to an IBM 7094, which in fact was my first personal meeting with IBM Computing. (See Picture from NEUCC)

In 1966 Gentofte hospital installed an IBM 1800 process control computer and marked the first milestone of eHealth in Denmark. Landbrugets EDB-central, LEC, the data center for the Danish Agricultural Sector, was started in 1962 and got it's first 'real' computers also in the late 60'ies. At that time IBM launched a new series of systems, the IBM/360 with a new operating system – OS/360 – that would change the momentum of computing yet once more.

Looking back at the period from 1911 until 1970 the impact of the IBM organisation was due to a combination of strong marketing and sales skills, a clear fokus on internal training as well as education for customers, a dedication of systems engineers that helped customers define and develop new applications – and of course the steady development of equipment and partly SW. Not always leading edge, but with a firm reputation for quality.

I will discuss the major milestones of IBM Denmark in my next blog covering the period from 1970 and until today.