The DOBlog

Category: Other Thoughts

  • Calling The Tweet Police

    [updated 2012-12-27@17:11 to reflect comments from TJ McIntyre] [edited introductory paragraphs at 20:34 2012-12-27 reflecting feedback from Aoife below, fair comment made and responded to] [Note: This has been posted today because RTE are doing a thing about “social media regulation” which means that levers are being pulled that need to be red flagged] I drafted this post on Christmas Eve morning 2012. The original post had the introduction below. One person (out of the 600+ who have read this post by now, a few hours after I posted it) felt that the opening was too hyperbolic. Perhaps it was, so I decided to tweak it. I did hope I wouldn’t have to publish the piece I’d drafted. But the fact that the opening item on the 6pm news on the 27th of December 2012 was a piece about the Chairman of the Dáil communications committee announcing that the committee would meet in the New Year to discuss regulating ‘Social Media’ meant that my misgivings about the approach of the Irish political classes to the use of Social Media were not entirely misplaced. I’m writing this on Christmas Eve morning 2012. I dearly hope I never have to publish it. If I do it will be because the Government I helped elect will have abandoned any pretence of being a constitutional democracy and will have instead revealed its true insular, isolated, clientelist nature in a manner that will disgust and appal people. And this will be all the more disturbing as the Government will have used real personal tragedies to justify this abandonment of principles. But I am not hopeful. If this post sees the light of day something will have gone horribly wrong with the Irish Body Politick. That the content of the media coverage today echoed the expectation I set out in the paragraphs below for the rationale of any review of regulation (“cyber bullying” and other misuses/abuses of social media) suggests that, perhaps, this post might contribute a useful counterpoint to a perspective that appears to dominate the mainstream.

    The Issue

    I fully expect within the early weeks of 2013 for the Irish Government to propose regulations requiring that users of social media be required to tweet or blog in an identifiable way. No more anonymous tweets, no more anonymous blogs. The stated reason will be to “combat cyber bullying”. Sean Sherlock TD is quoted in today’s Irish Times (2012/12/24) calling for action on anonymous posting. This is ominous. Others quoted in that article are calling for “support systems” to help TDs deal with the “venom” being targeted at them via social media. While the support systems suggested are to be welcomed, the categorisation of expressions of opinion by citizens as “venom” is, at best, unhelpful and, at worst, disingenuous. What seems to be in pipeline to be proposed to stem this tide is almost inevitably going to be some form of requirement that people verify their identity in some way in blog posts or tweets. Remove the veil of anonymity, the reasoning will go, and this venom will go away. The “keyboard warriors” will put their weapons beyond use and step in line with the process of government and being governed. The fact that politicians are lumping Facebook in with these other platforms illustrates the tenuous grasp many have on the facts – Facebook already requires “real identity”  policy, which raises problems about what your real identity is and has been flagged as potentially in breach of EU law by at least one German Data Protection Authority.

    Why this is a bad idea

    In Orwell’s 1984 a shadowy figure of the State ultimately breaks the protagonist Smith, requiring him to give up on love and private intimacy and resubmit to a surveillance culture in which the Thought Police monitor the populace and the media tells everyone it is necessary to protect against the “enemy”. That shadowy figure is called O’Brien. My passion for data privacy is a reaction to my namesake, and from that perspective I can see three reasons why this is A VERY BAD IDEA.

    Bad Idea Reason #1  – What is Identity?

    Requiring people to post comments, write blogs, or tweet under their own identity creates a clear and public link between the public persona and the private individual. The supporters of any such proposal will argue that this is a deterrent to people making harsh or abusive comments. However, in a fair society that respects fundamental rights, it is important to think through who else might be impacted by a “real names” policy. There are quite a number of examples of this, the most famous recent example being Salman Rushdie having his Facebook account suspended because it didn’t think he was him. Identity is a complex and multifaceted thing. We all, to borrow a phrase from T.S Eliot, “prepare a face to meet the faces that we meet”. The GeekFeminism Wiki has an excellent list of scenarios where your “real name” might not be the name you are really known by. In Ireland, people who would be affected by a “real names” policy in social comment would include:

    • Public servants who cannot comment publicly on government policy but may be affected by it
    • Survivors of abuse
    • People with mental health concerns or problems
    • Whistleblowers
    • Celebrities.

    A real names policy would require that every time Bono tweets or blogs about Ireland, Irishness, or Irish Government policies he would have to do it under the name Paul David Hewson. And who the heck would be interested in an opinion expressed by Paul Crossan about epilepsy?

    Bad Idea Reason #2 – How will it work exactly?

    It is one thing to say that you want people to post comments using their identity, but it is another thing entirely to get a system in place that actually works. Identity is a “flexible” thing, as outlined above. Facebook require evidence of your identity in the form of personal ID (passport/driver’s license). They have the resources to process that data securely. But they still get it wrong (see the Salman Rushdie example cited above). If verifiable identities are required for comment, then how exactly would a small personal blog that is used to exercise my mental muscles outside of my work persona (domestic use) be expected to handle the overhead of verifying the identity of commenters in a verifiable way. Would I be expected to get people to register with the blog and provide evidence of ID? Would I be able to get a grant to help implement secure processes to obtain and process copies of passports and drivers licenses? Or will the State just require that I shut up shop? Would the State indemnify me if this blog was compromised and data held on it about the identity of others was stolen? Every few years we used to hear similar calls about the registration of mobile phones. The argument in favour of registration usually goes: “If they have to register, bad people won’t use these phones”.  That argument is bunkum. I’ve written about it at length here but the short form:

    1. If people have to register and provide ID for verification, they will use fake ID (as is happening in China with their mobile phone registration requirement)
    2. If the law is to register, strangely it is unlikely that that would bother criminals by definition they find the law an inconvenience rather than a barrier.
    3. If people are required to register without some form of identity verification then you’ll wind up with Mr D. Duck of  The Pond owning a lot of phones. A pseudonym, so no more identifiable than a picture of an egg.

    Applying this to a proposal for a “real names” policy for tweets, blogs, comments and other social media discourse and we wind up with a situation where, to achieve the objective that the proposers of non-anonymised comment seem to be seeking, would result in a disproportionate burden being placed on those of us who engage in debate on-line. Even then it would not be fool proof. And a non-verified identity is nothing more than another pseudonym. I could, for example, use the name of another person when “registering” to comment. Or a fictional duck. It is worth noting that South Korea is abandoning its “Real Names” policy for social media for a variety of reasons.

    Bad Idea Reason #3  –  The logical principle must be technology neutral

    Blogging, tweeting, social media… these are all technologies for self-expression and social interaction that barely existed five years ago and where unheard in the mainstream of a decade ago. Therefore any regulation that requires identification of commenters must be framed in such a way as to anticipate new technologies or new applications of existing technology or risk near instant obsolescence. Therefore the regulation would need to be technology neutral. Which means that, in order to avoid it being discriminatory and to ensure it has the fullest possible effect, it would need to be applicable to other forms of technology.

    When debating this on Twitter with Harry McGee on the 22nd December I asked him if he saw a difference between Twitter and a malicious phone call or an anonymous pamphlet. His response was they were, in his opinion, the same. So, if tweets are the same as anonymous pamphlets, the logical extension of needing to be able to identify the tweeter is a need to be able to identify the pamphleteer. The State would want to be able to identify the author of a published thought. We have seen this before. In fact, the seeing of it before is one of the reasons that the EU has a right to personal Data Privacy (introduced in the Lisbon Treaty) and why the strictest interpretations of Data Protection laws in Europe tend to be in Germany and former Soviet bloc countries. Have we managed to forget that, within the lifetime of people now in their mid thirties, governments in Eastern Europe required people to register their typewriters with the State so the State could identify the writers of letters, plays, pamphlets and other communications? As Mikko Hypponen of F-Secure (one of the world’s leading experts on information security) says in one of his many presentations:

    In the 1980s in the communist Eastern Germany, if you owned a typewriter, you had to register it with the government. You had to register a sample sheet of text out of the typewriter. And this was done so the government could track where text was coming from. If they found a paper which had the wrong kind of thought, they could track down who created that thought. And we in the West couldn’t understand how anybody could do this, how much this would restrict freedom of speech. We would never do that in our own countries. But today in 2011, if you go and buy a color laser printer from any major laser printer manufacturer and print a page, that page will end up having slight yellow dots printed on every single page in a pattern which makes the page unique to you and to your printer. This is happening to us today. And nobody seems to be making a fuss about it. And this is an example of the ways that our own governments are using technology against us, the citizens.

    So, if we can uniquely identify the typewriter or the printer shouldn’t we take the logical step and have the owner register it, just like in communist East Germany in the 1980s? So that when a pamphlet or letter is sent that has the wrong kind of thought the relevant authorities can take action and immediately stop that kind of thing. But sure, we’d never do that in our own country. We’d just ask everyone register their identity before blogging or tweeting. Totally different. The Government would never propose the creation of a register of printer owners. Would they? {update: here’s an article from EFF.org outlining their take (from the US) on why “real name” policies and regulation are a bad idea }

    Use the laws we have, don’t create crazy new ones

    But something must be done!! This is an intolerable thing, this “cyberbullying”. And indeed it is. But let’s not get hung up on the label. It is not “cyberbullying”. That is bullying by a fictional race from the TV show Dr. Who.

    What this is is inappropriate and/or malicious use of communications networks and technologies. It is no different from a smear poster campaign, a co-ordinated letter writing campaign, or a malicious calling campaign. And there are already laws a-plenty to combat this in a manner that is proportionate with the curtailment of freedoms of speech and rights to privacy. Bluntly: If your conduct on-line amounts to a criminal act or defamation it is almost inevitable that your illusion of privacy will evaporate once the blow-torch of appropriate and existing laws are applied.

    The power to pierce privacy in this case comes from the pursuit of a criminal investigation of what are deemed under the Communications (Retention of Data) Act 2011 as serious offences. Any social media provider will provide information about users where a serious offence is being investigated. It’s in their terms and conditions (see Twitter’s here – Section 8). This would allow the identification of the IP address used at a date and time for transmitting a message via twitter and could be used to compel a telecommunications provider to provide the name of the account holder and/or the location of the device at the time and at present. But it is done under a clear system of checks and balances. And it would be focussed just on the people who had done a bold thing that was complained about, not placing a burden on society as a whole just in case someone might do something naughty. I would ask the Government to use the laws we already have. Update them. Join them up. Standardise and future proof their application. But do so in a technology neutral way that isn’t swiping at flies while ignoring larger concerns. And please don’t mandate non-anonymised comment – it simply doesn’t work.

    The Risk

    When proposing any course of action it is advisable to prepare for the unintended consequence. With this chatter of requiring comment to be identifiable comes the risk that, should it happen, the social media data of Irish citizens will become either more valuable (because marketers will be able to mine the “big data” more efficiently) or less valuable (because we switch off and there is less data to meaningfully mine). There is also the risk that our Government will, yet again, send a signal to the world that it just doesn’t understand On-Line, for all its bleating about a “Knowledge Economy”. And at that point we may become less attractive to the foreign new media firms who are setting up base here. Like Twitter, LinkedIn, Facebook, etc.

    Conclusion

    Requiring identifiable comment is a dumb move and a silly non-solution to a non-problem. The problem is not anonymity. The problem is actually how we evolve our laws and culture to embrace new communication channels. We have always had anonymous comment or pseudonymous dispute. Satire thrives on it, art embraces it, and literature often lives through it. Just because every genius, wit, and idiot now has a printing press with a global reach does not mean we need to lock down the printing presses. It didn’t work in Stasi East Germany or other Soviet Bloc dictatorships. Other solutions, such as working the laws we already have, are preferable and are more likely to work. Educating users of social media that there are still social standards of acceptable behaviour is also a key part of the solution.

    Tagging the typewriters is NEVER the answer in a democracy. This O Brien stands firmly against this particular Thought Crime.

  • The Anti-Choice Robodialler–some thoughts

    The Intro

    Robodialling, autodialling, power dialling. Call it what you will. It is the use of computers and computer telephony integration to save the tired fingers of call centre workers and turn the job into a battery farm of talk… pause.. talk.

    I know. I’ve worked with them. Heck, I designed the backend data management and reporting processes for one of the first big installations of one in Ireland back in the late 1990s. It was fun.

    I also learned a lot about how they work and some of the technical limitations and capabilities of them. Such as the lag that can happen when there is no agent available to take a call so the person dialled hears noise and static. Or the fact that you can trigger the dump of a recorded message either as a broadcast or based on the machine’s interpretation of whether it’s hit an answering machine or not (at least on the snazzy RoboDial9000 we were putting in).

    And I also remember the grizzled CRM and Direct Marketing consultant who was helping advise on best practice for using it telling the management team:

    “Don’t. For the love of all that is sacred don’t. Doing that shit just gets our industry a really bad name because it freaks people out.”

    Today – Fallout and penalties

    Today I’m trying to reengage brain after a night on twitter helping to advise people how to register their complaints about the use of a Robodialler to push anti-choice messages to unsuspecting households. The DPC is now getting up to 3 complaints every 5 minutes on this.

    Each complaint could carry a €5000 penalty on summary conviction. That is the tricky bit as this requires evidence gathering etc. This could take time. But the DPC has time available to them to conduct investigations and bring prosecutions. And if it is a case that this is an individual acting on their own behalf, the DPC has the powers to enter domestic premises to conduct searches and can levy a significant personal penalty of up to €50,000.

    Oh.. and if the dialler is in the UK the maximum penalty per offence is £500k and the DPC and ICO do talk to each other. A lot. They’re co-hosting an event in Newry at the end of the month.

    The unintended consequences

    My thoughts now turn to the unexpected consequences this robodialling will have.

    1. All future market research or polling that may be done on this topic by phone is borked and broken. People will be suspicious, even when the nice man from the polling agency ticks all the boxes and explains who they are etc.
    2. There will be a wave of “false positive” complaints to the DPC arising from any phone polling on this topic (for the reason outlined above). This will tax the resources of the DPC, and will tax the resources of market research and polling organisations as they work to deal with complaints and investigations etc.

    The impact of this on debate is that the published results of any polling will be distorted and will be potentially unreliable as barometers of public opinion. Face to face field work results will likely be less tainted by the robodialler experience but will be a LOT more expensive and time consuming for media and other organisations to run. So there may be less of them.

    The dialler incident will tie up resources in the ODPC that would otherwise be spent dealing with the wide range of complaints they get every day, driving investigations, conducting audits, and managing the large number of existing open cases they are working through.

    22 staff. In total. 25% of their staff regularly being tied up dealing with Facebook alone. With a mandate that covers ANY non-domestic processing of personal data. (by comparison the Financial Services Regulatory Authority has three times the number of staff at Director level alone).

    Another consequence of this is that we might get a little debate about how this is no different from the placard waving and leaflet shoving of the Anti-choice camp historically. But it is different. Disturbingly different. If I am walking on the street with my daughter and a leaflet or picture is thrust in her face, I can turn away, walk another route, or some other strategy to help shield my daughter from disturbing imagery.

    Last night I read of parents whose small children or young tweenagers answered the call and listened and have been upset by the calls.

    The wrap up

    I worked in a telemarketing business early in my career. Even then (nearly 2 decades ago) we were cautious about ringing people in the evenings. It is an invasion of the private family time of individuals, an abrupt interruption of what Louis Brandeis called “the right to be left alone”. No recorded messages were left. Human interaction was key to ensuring we only continued to encroach where welcomed, and requests to be removed from lists were treated respectfully. “Do Not Call in Evenings” was a call outcome code in the robodialler that prevented that number ever being called again (at least in theory when the software worked correctly and the teams did their jobs right).

    To tread on that right to be left alone to ram a pre-recorded message into the ears of an unsuspecting and unidentified audience belies an arrogance and ignorance on the part of those who thought it would be a good idea to choose to commit a criminal offence to push their message, ignoring both the law and the choices people had made with respect to their own personal data privacy (a fundamental right of all EU citizens).

    _____

    If you have received a call from a robodialler with an automated message or where the caller did not identify themselves to you you should register a complaint with the Data Protection Commissioner

    Investigations can be complex and it may be impossible to verify who to prosecute, but by registering the complaint you can help build the case against people who are acting illegally.

    Try to find the number that called you (in your phone’s call log). Note the date and time of the call. If the number is blocked, include that fact in your complaint. While numbers are blocked from being presented to you, the phone network will still know who called you and having the date and time you received the call will potentially enable ComReg and the Data Protection Commissioner to request data from the telecommunications companies to trace calling numbers. They may subsequently require you to give consent to accessing your phone records as part of their investigation but only to identify the number that phoned you on that date/time from the network call logs that are generated.

  • Dublin Web Summit, Data Protection, Data Quality, and Brand

    The KoolAid is being quaffed in great quantities this week in Dublin. And, having run national and international conferences in the Data Protection and Data Quality fields, I have to respect the achievement of the organisers of the Dublin Web Summit for putting together an impressive event that showcases the level of innovation and thought leadership, and capability in web, data, and all things tech.

    Yes. About that “thought leadership”…

    Data Protection

    Today’s Irish Times Business Section carries a story by Karlin Lillington about things that have been happening with her personal data at the Web Summit. An event she is not attending and has not registered for but for which she:

    • is registered as an attended
    • is listed on the media attendees list
    • has had her contact details distributed to sponsors and companies attending the event
    • has had her details shared with a social networking application that has pulled data from her Facebook profile

    In addition, she highlights that a list of ALL attendees is being distributed by the organisers if you request it through their Facebook page, but there is no opt-out for being included on this list and nothing in your registration that informs you that this will be happening.

    Emails are being sent out without people having opted-in, and not every email that is being sent out has the required opt-out. And I suspect that that may be the tip of the iceberg.

    Karlin reports that there have been complaints filed with the ODPC. My twitter stream this morning confirms that there are a number of people who I follow who have complained about how their data has been used. Many of these people would be the kind of people who you’d like to see fronting the thought leadership and innovation in web and data stuff, and they are irked at how their data is being abused.

    The DPC apparently has had previous complaints about Web Summit and has engaged with them in an “Advisory Capacity”. In my experience working with clients who have been subject to Data Protection complaints and have been investigated by the DPC, that is the Data Protection equivalent of “helping the police with their enquiries”. Web Summit has been handed rope. They have been guided and advised as to what needs to be done to be compliant (in keeping with the gummy tiger provisions of Section 10 of the Data Protection Acts which require the DPC to seek amicable resolution first and to focus on encouraging compliance rather than punish breaches).

    Dublin Web Summit has chosen, whether through a deliberate decision or a series of ego-driven and ignorance fuelled errors of judgement to ignore the advice of the DPC and continues to act in a manner that flouts the Data Protection rules that (and here’s the kicker) are not ‘nice to have’ but are guaranteed under Article 16 of the TFEU and have been subject to a number of recent tests at Circuit Court and High Court.

    Basically this is a Data Protection cluster f*ck of the highest order that illustrates one of the key problems with the “Innovation culture” in Ireland and, on the part of Government, either a blatant hypocrisy or a sociopathic ability to hold multiple contradictory positions at once. We want to promote Ireland as a great place to do business with web and data. And we want to be seen to be a bastion of increasingly responsible governance and regulation (after all, we’ve learned the lessons of the financial services collapse right? That one where we had  a Regulatory regime that was of so light a touch it could earn extra pin money touting for trade along the canal.) But for feck’s sake, don’t let the LAW get in the way of the use of TECHNOLOGY.

    Dublin Web Summit has almost certainly breached the Data Protection Acts in a variety of ways. Given that many of those breaches would appear to have been taken AFTER the DPC had given advice and guidance on what not to do. So the Web Summit organisers might want to check section 29 of the Data Protection Acts (never used, but there’s always a first time).

    Data Quality

    Data Protection and Data Quality go hand in hand. Heck, the principles for Data Protection are referred to in Directive 95/46/EC (and a variety of other places) as “Principles for Data Quality”. But on a more practical level, the approach the Web Summit has taken to obtaining and gathering their data and putting it to use has created some Data Quality problems.

    Take Karlin for example.Her contact details have been included on a media contact list for the event, touting her as someone from the media who is attending. A variety of sponsors and exhibitors at the event have apparently contacted her looking to meet at the conference. I’m guessing they’re a bit surprised when a leading tech journalist tells them she isn’t attending the event and won’t be able to meet with them.

    Also, eyeballing the “media list” I’ve found:

    • Duplicate entries (suggesting the list was created from multiple sources)
    • Organisations listed that might not be media organisations but are possibly service providers interfacing with media (new media/old media)… so VENDORS.

    The categorisation of organisations is hair splitting on my part, but the duplicate entries on a list that was being circulated to sponsors and exhibitors is indicative of a lazy and careless approach to managing data.

    How many of the people on the list are actually attending? And if you are counting the number of people attending from an organisation, are you allowing for duplicate and triplicate entries? If you are a marketing manager from a company who is ringing all these media people only to be told that they are either not attending or that they are not actually covering the tech aspects of the event but are (heaven forfend) actually exhibiting at the event yourself, how much will you trust this list next year? Will you be happy to pay for it?

    Never mind the quality, look at the tech!!

    Brand

    And this is where we come to the brand aspect of all of this. The Web Summit has made basic mistakes in Data Protection compliance even when presented with advice and guidance from the DPC. With regard to their Presdo social networking application, there are examples of it being used in data protection compliant ways (Karlin cites the le Web conference which used the same application but presented people with a code they could use to confirm their consent to their personal data being accessed and shared).

    But Dublin knows better. Dublin is the go-getter innovator. Rules schmules, Indians Schmindians.

    Which is a mantra that has disturbing echoes in the recent history of the European Economy. So it is a mantra we should, as thought leaders and innovators, be trying to distance ourselves from as much as possible. By showing how we can design privacy into everything we do in web and data and pushing the innovate envelope in ensuring balance.

    But here’s my fear. EI and the Government don’t get this. I am not aware of ANY EI incubator programme [Brian Honan informs me that Blanchardstown and Dundalk IT have had him in to talk to programmes] that provides training or briefings on Data Protection (Wayra does. I recently provided some content to help).

    My company has submitted proposals to various government backed training programmes for On-Line business, and I have got letters back telling me that Data Protection is not relevant.

    Everyone seems happy to touch the hem of the prophets of the Web and drink hungrily from the Kool Aid, repeating the mantra “Rules Schmules, Indians Schmindians”. But it is worth remembering the origins of the phrase “Drinking the Kool Aid” (hint: it didn’t work out well for the first group to do it).

    The Data Protection world globally is in a state of rapid evolution. Those who ignore the help and advice of Regulators invite penalties and brand damage. It  is time that the thought leaders of our web economy stepped back and actually thought about how they develop their brand and build trust based in the personal data economy.

    Koolaid from the Floor [an update]

    I made the mistake of watching twitter streams from the Dublin Web Summit. The KoolAid was gushing. Lots of great ideas and interesting innovation but not a single person seemed to be addressing the gorilla in the room that is Data Protection and Privacy.

    Yes, Social Engagement is important. Yes it is important to build trust and engagement with your brand. But as W.Edwards Deming famously said:

    You can’t inspect quality into a product, it’s there from the beginning.

    In other words, if you don’t start off by respecting your customers and their privacy rights, you will leave a bad taste in your customer’s mouths and sour your brand.

    That’s the weedkiller in your web branding koolaid. Drink with care.

  • Lego System and the Value Delivery System

    I love Lego. The fact that my Facebook avatar is a sinister looking “Liago” man from a Chinese clone of the famous Lego System is a little personal in-joke (and I’d love to see what their facial recognition makes of that). But I also love my daughter, who is bright, imaginative, and creative. And I hate to see anything that might curtail that and box her thinking into a gender-appropriate bucket that she might struggle to climb out of in years to come.

    That’s why I hate the fact that ‘girls’ toys are all pink. I’ve given up to an extent on the battle against all girls’ clothes being default pink. Everyone seems to think this is the way it has always been, but no it’s not. It’s new, and it has been the other way around as well. Here’s a quote from an article in the Smithsonian Institute’s magazine:

    For example, a June 1918 article from the trade publication Earnshaw’s Infants’ Department said, “The generally accepted rule is pink for the boys, and blue for the girls. The reason is that pink, being a more decided and stronger color, is more suitable for the boy, while blue, which is more delicate and dainty, is prettier for the girl.” Other sources said blue was flattering for blonds, pink for brunettes; or blue was for blue-eyed babies, pink for brown-eyed babies, according to Paoletti.

    In 1927, Time magazine printed a chart showing sex-appropriate colors for girls and boys according to leading U.S. stores. In Boston, Filene’s told parents to dress boys in pink. So did Best & Co. in New York City, Halle’s in Cleveland and Marshall Field in Chicago.

    But Lego is supposed to be different. It is supposed to allow children to think outside the box (literally as well as metaphorically). My fondest memories of childhood centre on a massive 30 litre white bucket that my grandmother bought at a time before my memory which was filled with every piece of Lego bought for my uncles, for me, my brothers and which did the rounds of ALL my cousins.35 year old Lego being played with without prefixed form or format, constrained only by our imaginations and the laws of physics, whether we were boys or girls (I’ll admit – mostly boys, but that just makes my next point more important as I do have some girls in my extended family).

    New Lego is shit. More precisely: New Lego for Girls is shit. Sexist, insulting, degrading shit. It is so shit that I will not let it in my house. Ever. Here’s why:

    Lego Friends–Silly imagination retarding lego playsets for girls.

    So.. gone are the fun Lego person minifigures, replaced with anatomically approximate figurines with long hair. Who go shopping. And hang out with their friends. And have handbags and Beauty parlours and cake shops.

    Jebus. There’s no need for any small girl to risk burning out a brain cell engaging in that ‘imagination’ thing. Keep your brain inside the small box that society is creating for you, accept the parameters and all will be well. Compare to the style of the ‘boys’ Lego (which is a slightly formulised version of the Lego I love)

    Lego that makes you think about what might be possible….

    Yes. I’m guessing the Astronaut is a boy. (I secretly suspect girl astronauts wouldn’t have sent a broken satellite into space or would have been more careful with the fragile bits when it got there).

    Lego say that their product design is based on market research and studying what girls play with. This is a mistake. This basically means that their research has essentially asked questions like:

    • “How have different genders reacted to mass market indoctrination by other toy manufacturers who are creating pre-assembled play sets? ”
    • “When faced with a choice of toys in pink, pink, or pink that establish certain female gender roles, do girls choose the astronaut (who is not an option they can chose)”

    Which, unsurprisingly has left them with the answer that girls like pink, want to have a beauty parlour, and the only space they are interested in is the one where they will be building their beauty parlour.

    This inevitably has lead Lego to creating a range of products that women find sexist and demeaning and men find to be a heretical travesty of the concept of Lego as we know it.

    What might they have done differently?

    A few years ago my friend and mentor Andrew Griffiths introduced me to the concepts and principles of the Value Delivery System, as developed by Michael Lanning at McKinsey and subsequently refined by Lanning in his own consulting work. Andrew helped knock some corners off the concepts when he was in McKinsey and gave me a first-hand insight into the power of the method.

    (Incidentally, the term “value proposition” in marketing comes from this Value Delivery System but is used today with a meaning that is less than that which Lanning first promoted it.)

    Key to the Value Delivery System method that Lanning developed is the idea of the Key Resulting Outcome that the customer wishes to have. Once that is identified, the organisation can determine how to deliver that Key Resulting outcome using their products and services. In his book, Lanning cites the development of the Polaroid Instamatic camera as a good example of a Key Resulting Outcome triggering innovation. The inventor, Mr Land, was taking photographs at his daughter’s birthday. She apparently had a tantrum when he told her she couldn’t “see the photographs now!!”, which sparked the development of a technology that shook up photography and related industries (like pharmacies and camera shops) for nearly five decades.

    I often work back from what a company is delivering through or with data to identify the Key Resulting Outcomes they are giving their customers – as a way of triggering debate about Information Strategy (a cheeky adaptation of Lanning’s method). Applying that approach to Lego’s #NewLegoforGirls I have determined that Lego believes that Parents and Children:

    1. Want imaginations constrained with pre-formed Anglo-European/Anglo-American gender roles and lifestyle expectations. Girls shouldn’t worry about being astronauts because they can own a cake shop instead.
    2. Want clear demarcation in play and interaction between children of different genders. After all, Astronauts don’t get their hair done at the salon and don’t go for cakes at the coffee shop. They’re too busy fighting aliens and fixing satellites.
    3. Want girls to identify from an early age with female body shape identity and “gender appropriate”clothing and colours (like pinks). So the “Lego Friends” figures have curves and bumps and boobs and long hair, while the traditional Lego MiniFigures have comical faces painted on, but remain blocky and androgynous apart from that (yes.. I know the minifigures have ‘wigs’ with long hair and can have bodies made with painted on dresses as much as painted on uniforms but…they’re not as ‘in your face’ about it).

    Frankly, the Key Resulting Outcomes I actually want from toys for my daughter are:

    1. Stimulate imagination and creativity
    2. Promote group play and interaction, so that skills of cooperation and planning can be developed
    3. Allow her freedom to imagine herself in any role/job/scenario she may want, whether that’s cake shop owner or astronaut
    4. Provide a format and system within which the gender biases and cultural short-hand of the marketing departments of other lazy toymakers can be set aside and open explorative play and imagination can be developed.

    Like in the old days. The way Lego used to be. Right now I fear Lego may be facing a “New Coke” moment. Parents (and dare I say it, grandparents who fought the feminist battles of the 1970s and 1980s) are sick of society and toy makers being lazy and putting the imaginations of children into boxes that are shaped by relatively recent colour charts (1940s) and ridiculously inane and sexist stereotypes of gender roles and possibilities.

    Lego should be about possibility, not pink. That is the Value that the Lego System should be delivering.

    When my daughter plays with Lego, I want her to feel free and encouraged to imagine the day she opens her Beauty Parlour/Cake Shop.

    On Mars.

    After she’s led the first successful manned mission there.

    As an Astronaut.

  • Support your Local Sheriff–why the DPC needs us to help them help us.

    Problem Statement

    The Irish Government is tripping over itself to win FDI from the new ‘Big Data’ enterprises. Whether it is promoting Ireland as a perfect location for Data Centres (it is, apparently we’re in a temperate Goldilocks zone) or chasing flagship investments in European headquarters for companies such as LinkedIn, Facebook, Zynga Games, Twitter, not to mention the pursuit of “home grown” ‘Big Data’ firms or the development of long term residents like Apple or Amazon from ‘box packers’ or call centres to foot prints of ‘Big Data’ behemoths, the Government can’t help itself.

    And why would it. These organisations bring needed jobs, needed credibility to the Irish Economy, and much needed positive headlines for beleaguered politicians.

    Of course there is a catch. A small problem. Actually two small problems.Well actually one problem but one that is so small but so significant that it is worth mentioning twice:

    Our Data Protection Commissioner is chronically understaffed and, in my view, may lack skills and experience necessary to engage with and properly enforce EU Data Protection regulations.

    If the Government is viewing “Data” and its related services as the “New Finance” they are showing precious little evidence of having learned from the failures of the past and I increasingly believe we are facing a scenario where either

    1. A major Data Protection scandal sweeps across big name players in Ireland and the DPC is wholly overwhelmed and cannot respond appropriately.
    2. Once new EU Data Protection Regulations are in place, we find ourselves in the eye of a major Data Protection issue and the Irish DPC finds himself with no option but to cede responsibility for the investigation and enforcement to another EU Data Protection Authority under the enhanced co-operation protocols in the revised Data Protection Directive.

    (more…)

  • Describe what you do in one word…

    This is a challenge an old boss of mine used to set. He was an alpha male. The answer he was looking for was usually a variant of “lead” like “inspire”, “command” or “drink”.

    But it is a good exercise to set yourself.

    This evening I was responding to an retweet of an article I published on my company website last year. Vish Agashe retweeted this post about data modelling and Data Protection. In response I asked him if he was still finding the ramblings of a legodatapsychoeconotechnoqualitatrian interesting.

    Then it hit me. That’s a word. A bloody good word. A “kicking my dad’s arse in scrabble” kind of word. Because it almost perfectly describes me.

    Lego

    No. I am not made of plastic and if you separate my legs from my body you will find it very difficult to reattach them.

    But I spent four years half a life time ago studying law and business in UCD. From that study I developed a love of law and all things legal. In particular I developed the skills of legal interpretation and research that all lawyers need to possess.

    And, just as (if not more) importantly I developed a network of friends who are lawyers. Yes. Some of my best friends are lawyers. Who’d a thunk it?

    Data

    No. I am not an android with a positronic brain and the strength of 10 men (I wish). And if you poke me in the back between the shoulder blades I’m more likely to turn around and put you in a painful joint lock or punch you in the face than calmly power down and go lifeless (hint: if you want that, a few bottles of good wine is the best option).

    But I am obsessed with data. The capturing and creation of it, the analysis of it, the value of it. It’s what I do. I’m a Data Scientist, but in the “lives in a castle in the mountains and don’t ask about the missing corpses” sense of “scientist” (at least at times).

    Pyscho

    No. I don’t own a run down motel and I haven’t hacked a young lady to death in the shower. At least not since the dried frog pills kicked in.

    However I have been a closet psychologist for years. And once I realised that closets had very few hidden secrets (if you discount fantastical lands ruled by big lions) I turned my attention to the Human Equation in the context of change management and how we perceive and value information.

    So, BF Skinner was a lovely man who pigeons experimented on to see just how far would he go to have them support his flawed hypothesis that extrinsic reward/punishment is a key motivator of behaviour. At least that’s my opinion.

    Econo

    Last time I checked I’m not a gas guzzling American mini-van that is anything but economical to run. But, linked to my love of data and the interfaculty degree I did in law and business, I am a fan of economics and economic theory and practice. In particular I’m an advocate of the branch of economics that applies economic principles to the study of law and legal principles, and the application of economic principles to the valuation of and management of data.

    What is the value at risk?

    Where is the economic equilibrium of risk and reward/supply and demand?

    Is the economic deal fair when Entity A gives data to Entity B… what is the valuable consideration given for the exchange of assets?

    Techno

    No. I don’t play annoying 9000 beats per minute europop techno. Except for Saturdays. And even then only when there is a total eclipse of the moon.

    But I do enjoy my technology and my tools. I was the first customer in the world for Informatica’s Data Quality offering (back before it was Informatica). And I’ve coded countless Visual Basic skunkworks to do data reformatting, consolidation, reporting etc. And I do like Sharepoint and Drupal and WordPress and Unix and Linux and…..

    …  I think you get the picture. I know a few things about databases and database technology. But unfortunately not with a parchment attached to it (yet).

    Qualitarian

    it’s all about quality. Quality of outcomes for the end customer in a value chain. And quality of outcomes for the data controller, or the regulator, or society. Everything comes down to this.

    • Laws exist to regulate outcomes. Often badly
    • How we internalise and conceptualise the customer and the outcome are key to achieiving the right balance.
    • Technology is a tool to getting us there but is not a destination.
    • The economic value is the point at which things are good enough to achieve the outcome that is required… and no more… anything beyond that is a value-add luxury that we can charge premium price for.

    Now. Where’s my scrabble board?

  • An open letter to Viviane Reding

    Dear Commissioner Reding,

    I’m writing to you as an EU Citizen who is passionate about data, is use, its quality, and its protection. I’m not writing to you as the Managing Director of a company that offers Data Protection training and consulting services, but in the interests of transparency I think it best to disclose that that is my day job.

    I am writing to you about the new Data Protection Regulation. In particular I’m writing to you about the penalties contained in the current draft proposal. Frankly I think they suck. I don’t think they’ll have the effect that you think they will have. I’m basing my opinion on a number of bases:

    1. I have worked in Regulatory Operations in a Regulated industry that you are familar with, telecommunications.
    2. I’m a keen student of human psychology and economics, particularly the psychology and economics of risk and reward.Understanding this “theory of psychology” is important in the world of Information Quality.
    3. I like to observe and learn from other industries and areas of life to see what can be applied to improving quality systems for and the governance of information.
    4. I’m the parent of a toddler. This might not appear immediately relevant but, in the context of Data Protection, my immediate experiences dealing with a stubborn personality in development who is programmed to push boundaries and infuriate me with apparent disregard for the standard of behaviour expected of her all too often find their parallels in the management teams and staff of organisations I’ve worked with.

    Taking these elements together I am afraid that 5% of Global turnover will not work as a penalty. It’s a great soundbite but will, in practical terms, amount to little more. There are a few reasons for this.

    (more…)

  • Correction from Irish Examiner re: Vatican Closure

    After some toing and froing and an email trail that included quotes from the Chairman of TCH (the parent company of the Irish Examiner) at #mediv2012 I finally got clarification from the editor of the Irish Examiner of their Vatican Embassy story (soon to be corrected on-line), which I first blogged about on the 19th of January.

    At my suggestion, Dolan O’Hagan (the editor) provided the text of the clarification (which ran in the print edition two weeks ago but never made it online until today) for me to post here to close the loop so to speak. I’ve made the font bigger for the quote so that the text can be more clearly seen.

    In an article published on January 16 headlined "Public decries closure of embassy to the Vatican" it was stated in the opening paragraph that  the embassy closure "was met with overwhelming opposition from the public with over 93% criticising the move".
    The Irish Examiner would like to clarify that it was, in fact, 93% of those who had written to the Dept of Foreign Affairs in the immediate aftermath of the announcement who had voiced opposition to the move – a fact reflected later in the story but not in the opening paragraph due to a copy review error.

    While I differ slightly on the claim that the latter part of the story reflected accurately the level of actual uproar about the Vatican closure (I feel that the section in question required some close reading to understand the actual sample size involved which the 93% referred to), I welcome the statement from the Irish Examiner that does go a substantial way to clarifying the issue. I look forward to seeing the promised amendments and clarifications in the on-line edition soon, and once that happens I’ll be gladly closing my complaint with the Press Ombudsman.

    Of course, there is an important lesson for anyone producing information that is distributed through multiple outlets – an error may need to be corrected in a timely fashion in multiple locations. As such you will need to know when and where that information was disseminated and what control you have over getting the facts corrected.

    (Indeed, under the Data Protection Acts if a Data Controller is informed of an inaccuracy in personal data they have to inform anyone they shared that data with in the previous 12 months who in turn must notify anyone they shared it with etc. Frankly it’s turtles all the way down until the data universe is as correct as it can be made).

    Now my hope is that, with the correction on the part of the Irish Examiner, the other publications which picked up the 93% rallying cry will in turn correct their copy so that it reflects the reality of the situation, not hyperbole caused by an error in review.

  • SOPA, Irish political debate, and keyboard warriors

    I work in a knowledge-driven sector (consulting and training). I have written two publications that have ISBN numbers, which makes them books I suppose. They were each over 100 A4 pages long. I’ve written hundreds of blog posts and articles over the years and have a large external hard drive filled with every presentation I’ve given in my topic area (Information Quality, Data Protection, Data Governance) over the past number of years.

    In my professional capacity I am a member of a number of professional associations and have a number of professional certifications, all of which have an ethics element which, amongst other things, requires me to respect copyright and to give credit to the works of others when I am using them.

    As a presenter I’ve experienced flying in economy class to far flung places to see the person in front of me on the agenda ripping off the presentation I was just about to give because he’d come into possession of an earlier version of my slides from a previous event (in that case I just changed my presentation and explained to the audience why while the guy sat in the front row looking for an emergency exit – perhaps repeatedly saying how much I agreed with his points might have been laying it on to thick).

    But the SI that is about to be signed into law is just nuts, aimed solely in my opinion at propping up a dying business model in which KPI indicators that were perfectly valid 10 years ago are falling and rather than pull the levers and turn the knobs in their own business model and evolve, an industry lobby is seeking to pull levers and turn knobs in society as a whole and create a time machine that puts the smoke of 20 years of technology evolution back in the bottle.

    I teach and consult on-site with clients. I have also been published in dead-tree formats. e-learning and on-line tutorials and coaching, blogs, internet based publications, e-books all challenge that business model. So is my response to lobby hard for legislation and burn cash in litigation to reverse the universe? No. I’m not a moron. I embrace the opportunities for new business models that the Web provides. I look to build a Platform Business (to borrow from my friend Phil Simon) and I seek to develop new ways to distribute and monetise my services and my knowledge. (So expect to see some things developing from my business over the next few months)

    That the Irish Music Industry has strong armed the Government into rushing bad law in in a bad way is irksome in the extreme. That a mortally wounded industry has been able to bully (and yes, I do feel that the approach taken amounts to bullying) a Government into bringing in legislation of a kind that a vibrant and growing industry sector (that would be the Interwebs and Cloud) had lobbied and campaigned against successfully in the US only a few weeks ago galls me. That it is happening when the legal position in Europe has evolved and the clear message from TWO EU Commissioners (including the Vice-President of the Commission) is that Internet Blocking is not an option in Europe (ergo the Commission would be unlikely to penalise Ireland for not having it in place) just sickens me.

    But what really sticks in my craw is the pantomime of a Dail debate that we saw last night which makes a mockery of parliamentary democracy in this country. A debate where a perfectly workable alternative piece of legislation that achieves largely the same objectives while balancing the needs and interests of the ISPs (who were NOT consulted or engaged with when the original SI was being prepared) was basically ignored.

    The debate highlighted how out of touch with their electorate the Government is. Dismissing people who WRITE to you as “key board warriors” is insulting and disingenuous to say the least. I am a keyboard warrior and proud of it. I use my keyboard to effect change in organisations, educate and inform. It is my TOOL. Just as my grandfathers’ tools were pens and typewriters (for one) and trowels and plaster (for the other). My keyboard (and my website) is my own personal printing press with a scope, scale, and reach that Guttenberg could never have imagined.

    Bad law, introduced badly, by people who don’t grasp the basics of what they are seeking to regulate and control, with an arrogant dismissiveness of comment and debate from the political class (with notable exceptions) has the makings of a total trainwreck.

    As an aside, when I first raised concerns last year about the Fine Gael website I was dismissed  as being “only a blogger”. This keyboard warrior was right, so the track record of arrogant dismissiveness from Government parties has not been good on things internet related.

    So I contacted my Government party TDs by phone this morning to express my dissatisfaction. If my keyboard won’t be listened to then I’d better start using my voice.

  • While we’re all fired up about protecting rights..

    Hey you #stopsopaireland people, I’ve got a favour to ask. It’s not a big one. It will take you 30 seconds to do but it may help to make your life a little better

    The 30 seconds kicks in as soon as you’ve finished reading this post.

    The discussion around #stopsopaireland has focussed on the impact that internet blocking would have on fundamental rights of freedom of expression, and the EU legislative and policy frameworks and case law that exist to support that right and ensure it is protected in a balanced way.

    There is another right that is important. The right to Privacy. In particular the right to Personal Data Privacy which is set out in Article 16 of the Lisbon Treaty. It is this Article that provides the basis for the EU’s Data Protection regime, changes to which were announced on Wednesday. Those changes will take a number of years to come into affect, assuming they are not bastardised and watered down beyond all recognition by national parliaments or the European Parliament responding to lobby groups.

    But a functioning Data Protection framework is in existence day and it is policed in Ireland by the Data Protection Commissioner. Already this year they have engaged with the Dept of the Environment regarding the Household Charge database and with Dublin City Council regarding the transfer of personal data from Dublin City Council to a private company. And let’s not forget their audit of Facebook last year. And that’s just the high profile stuff that gets in the media. In my professional context I’m aware of the significant number of complaints they help people with each year as they strive to promote compliance with the Data Protection Acts in an increasingly complex information management environment and a financial culture where organisations and governments are trying to to less with more and often cutting the wrong corners in the process.

    The Office of the Data Protection Commissioner serves the individual citizen, helping them with advice regarding their rights and acting to investigate and prosecute breaches of those rights. They also serve the Organisation (be that a Government department, a large multi-national, a local football team, or a student company selling jumpers on-line) providing education and advice (when asked) as to what steps should be taken to ensure the right balance is struck between the goals of the organisation and the rights of the individual. They don’t deal with just one sector of the economy. Anywhere personal data is being processed they have a role to play.

    Saturday 28th January is World Data Privacy Day. It is one day in the year where Data Privacy is celebrated. Companies and regulators around the world have planned activities and events to celebrate the day (see here and here), but in Ireland it seems to be just another Saturday. Some of you might say that the Data Protection Commissioner should have lead the charge on this but, to be frank, they are under resourced in terms of numbers and budget and need to prioritise their efforts and energies to dealing with the actual and alleged breaches of people’s rights that come through their inbox every day.

    So, to celebrate World Data Privacy Day 2012 I’m asking you to write an email to your TD, Minister, or other elected official asking them to comment, tweet, or in some other way make public

    1. Their support for the principles set out in the Data Protection Acts and the proposed revised EU Regulation on Data Protection
    2. Their commitment to ensuring the Office of the Data Protection Commissioner is properly funded and resourced to allow it to execute its duties under the Acts and the Lisbon Treaty in an effective and truly independent manner.
    3. What one thing they will do by January 2013 to improve their personal knowledge of the Data Protection regulations.

    I’ve even put sample text below so you can just cut and paste it. You can use the great contact form at Contact.ie to bulk contact your elected representatives (while you are there, why not donate to support the site), or you ca nmake the message personal and send it yourself from your own computer/phone/device/smoke ring maker. Heck, if you want to phone them or tweet them directly about this fire ahead.

    +++ email text

    Dear Sir/Madam

    I write to you on the occasion of World Data Privacy Day, which is being celebrated globally on Saturday the 28th of January (mark your diary, it’s the same day next year).

    Personal rights, particularly personal rights in relation to information and personal data, have been in the media a lot this past month. Much of the coverage could have been avoided had proper attention been paid to the requirements and obligations under the Data Protection Acts 1988 and 2003 which apply equally across a wide range of industry sectors, including Government

    To celebrate World Privacy Day I would ask you to consider issuing a statement either by traditional press release, a blog post, or a tweet, that will tell your electorate where you stand on the following questions:

    1. Do you support the principles set out int he Data Protection Acts and in the proposed revised Regulation on Data Protection announced this past week by Vice President of the European Commission Viviane Reding?
    2. Are you committed to  ensuring the Office of the Data Protection Commissioner is properly funded and resourced to allow it to execute its duties under the Acts and the Lisbon Treaty in an effective and truly independent manner, as is required under EU Directive and the Lisbon Treaty?
    3. What one thing will you do by this time next year to improve your personal knowledge of the Data Protection regulations.

    Of these three questions, the second is one I feel is important.  Personal data is the currency of the new economy and it is a valuable commodity. The Regulator for the Personal Data Industry is the Data Protection Commisioner. One of the key lessons of the Financial crisis is that for a Regulator to be effective they must be correctly resourced and independent of Government or industry influences.

    I appreciate your time on this and look forward to seeing your press release, blog post, or tweet expressing your support for #DataPrivacyDay, the principles of Data Protection, and the office and role of the Data Protection Commissioner.

    ====ends===

    If you get responses please post a comment below so I can see what uptake (if any) there has been from our political classes.