Showing posts with label privacy. Show all posts
Showing posts with label privacy. Show all posts

Thursday, March 26, 2009

The Catch 22 of government online participation

Government often has a narrow path to walk when engaging online, some of the measures in place to protect the privacy and security of citizens and government officials can conflict with efforts to improve the transparency and openness of government processes.

Hence this article from the New York Times, Government 2.0 Meets Catch 22.

The article highlights some of the issues that US government officials must navigate and contend with when participating with online communities or even using the internet to research potential employees.

While the article doesn't present any real solutions for government, it does highlight that there can be the need for some government policies and legislation to be reconsidered to provide the appropriate balance between government's ability to engage online and to protect those it employs and serves.

Read full post...

Monday, March 23, 2009

Judging the personal risk to privacy when participating in social networking

A group of students from Penn State University have developed a methodology for assessing the personal risk to privacy when participating in online social media.

It's an interesting attempt to quantify objectively the risks for individuals and could be a useful starting point for government departments to help their staff understand the impacts of their choices.

You'll find the system, termed SNAPR (Social Networking Action & Privacy Risk Methodology) online here.

Read full post...

Monday, November 24, 2008

How much would your department pay for a 10% improvement in customer satisfaction?

I've been reading an article in the New York Times regarding the public competition Netflix has been holding.

The competition, named the Netflix Prize, has a prize of US$1 million for the individual or group who can improve their movie/TV recommendations engine by 10%.

The article, If you liked this, sure to like that, discusses how Netflix's programmers had gone as far as they could with their available resources and skills, so the company decided to make a large slice of their information available publicly (anonymised to protect privacy) and see where others could take it.

There are now over 33,000 teams around the world competing to come up with insights and algorithms to improve Netflix's recommendations, with a public leaderboard tracking the top forty (the best is currently at 9.44%) and a forum where the teams collaborate on improving results, sharing tips and code.

I can't help but think about this in the context of government.

Every agency struggles to provide the best possible outcomes and customer service with the resources they are given. However few departments or agencies look outside for help - even to other government bodies.

I'm sure there are many complex problems in government that could be looked at in a similar context to the issue Netflix is facing - ranging from simple IT programming issues, to customer service maximisation (such as the most effective placement of face-to-face locations to cover audience needs) and those huge thorny issues, such as devising fair policies or reforming tax regimes.

I wonder if government would be more effective if it allowed talented people to devise potential solutions (for kudos or prize money), which could then be tested, reviewed and the best solutions potentially adopted.

This isn't just a pipe dream. The UK government is running a competition at the moment, asking the public to come up with innovative ways to use government data to add value. The US and Japanese Patent Boards are piloting having the public examine patents and provide views before they are granted and New Zealand had the public write the Police Wiki Act 2007 (on how the police are to act towards the public).

I cannot think of any Australian examples - if anyone know of some let me know.

Clearly there's all kinds of guidelines and governance required for Australian governments to feel 'safe' in inviting outsiders to assist us in improving governance in Australia - but what do we really have to lose?

Read full post...

Friday, November 21, 2008

Government etiquette on Twitter

Neil Williams of Mission Creep has published an interesting question around how government should use twitter in a post, Government Twitter etiquette: talk but don’t follow.

It talks about the agency twitter account his employer runs - which is working well - and whether they should 'follow' others (which allows you to see what others are saying on twitter) or whether this is too Big Brother.

The post doesn't answer the question, but does present some views on the topic.

Here's mine....

Twitter is a very loose two-way mechanism. Its design does not foster the level of debate that is supported via a forum or allow for the level of indepth personal commentary (with comments), as does a blog.

The two things it does really well are placing short stream of consciousness messages, announcements and comments into the public eye and allowing for brief Q&A style exchanges of views, without enormous depth or follow-on.

This has made Twitter an increasingly popular medium for government (and for corporations), particularly in the US, to announce VIP schedules, status information (such as traffic status) and notices pointing to indepth website or media information.

It it less used as a method to respond to customers and constituents - but in its two-way mode can be used to gauge public satisfaction and collect top-of-mind responses as part of a consultation process.

It is important to have a goal when using any tool and, depending on the goal and level of resourcing, following has its place.

If it is being used solely as a one-way mechanism (as the BBC, CNN and NewsCorp do for article notices), there is little value in following others.

However if you wish to engage and extend the reach of the channel for your agency, following and responding to direct questions/comments, humanises your organisation and integrates you into the Twitter community. It does require ongoing resourcing and monitoring, which is beyond the capacity of many organisations - but perhaps not Mosman council.

I think the big brother concern is more linked to unwanted follows - following someone before they follow you, however if someone chooses to follow your government department's Twitter feed, if appropriate for the goals of your agency, you should follow them back (perhaps with a notice somewhere to state that you do so).

I can only think of rare occasions where a government department on Twitter should follow individuals who have not followed them - though following some of the one-way twitter feeds.

What do you think?

Read full post...

Friday, October 03, 2008

How secure is a password?

Following my security theme today, I've never seen much value in passwords as strong security measures - they need to be easy to remember for the user, and therefore rely on common letter and number patterns of relevance to the user, which inevitably become easier to break.

People need to remember passwords for many different services. I count at least 50 passwords I personally use on a monthly basis including phone, ATM and online.

This makes it tempting for people to,

  • reuse a few passwords across sites/channels,
  • use a common pattern for passwords (family birth dates for example), 
  • rely on password memory memory systems (in web browsers or centrally through services such as Microsoft Live), and/or 
  • write and store passwords in easy-to-access places.


A five second Google search threw up a large number of articles decrying the weakness of passwords as a security method.

One I found interesting was How I'd hack your weak passwords, which provides details on the mistakes people make when creating passwords, and points out that when people use the same password across multiple sites the password is only as good as the weakest site's security.

So what's the alternative?
Given that passwords are not a strong security measure as they rely on the user to select secure passwords, the only real alternatives are to,
  • Use more physiologically unique approaches to security (retina scans, fingerprints or brain waves),
  • Employ physical tokens (random number widgets, cards or similar devices),
  • Use innovative alternatives to passwords (such as join the dots)
  • Make it clearer to people what is at risk and educate and support them in creating stronger passwords.


Given that most people are unwilling to spend extra money on a PC attachment to allow biometrics scans (though, like seat belts in cars or fire alarms in houses, they could be mandated by government and rolled out with new PCs over time) and issuing physical tokens is a costly exercise (and prone to physical theft), the most viable short-term option is to improve how we communicate with our customers.

I think that we could do a better job of educating people on how to create and manage large numbers of secure passwords, and addressing this area would by itself save significant costs in terms of fraud prevention and personal loss - not to mention password reset calls to call centres.

In the longer-run, I see a strong case for mandating biometric scanners on PCs.

What do you think?

Read full post...

Biographical secret questions weakening as security measures

Due to the rise of online social networks and informational sites, secret questions based on biographical information are losing strength as a supplementary to password-based security.

As discussed in a Time article, Those Crazy Internet Security Questions, as more information on individuals becomes easily available - either provided by them directly or via government, corporate and collaborative online databases - the secureness of personal questions diminish.

The article provides a ten second case study on how easy it is to get the biographical information of a prominent person from their wikipedia entry and online postal database.

Speech transcripts, videos, blog posts, social network profiles, news sites and genealogical websites can also provide significantly more information quickly and cheaply.

It's slightly more difficult to get information on an 'unknown' person - but many are doing hackers the favour of providing their own biographical information online - as well as adding to the available information on their family and friends.

This raises a need to steer secret questions away from purely biographical information, or seek stronger alternatives.

So what was your mother's maiden name again?

Read full post...

Wednesday, September 24, 2008

Locating and learning about future public employees using social networks

I am a reasonably active LinkedIn user (view my profile here).

It's one of my professional networking tools for keeping track of 'people of interest' to me - from business contacts to potential employees and employers.

It, and similar social and professional networks, are also useful recruiting tools for managers and HR professionals seeking to find or screen job applicants.

This isn't news to US HR teams. A recent survey by Careerbuilders.com, as reported in Reuters, found that 22 percent of hiring managers screened applicants via social networks.

From the article, One in five bosses screen applicants' Web lives: poll, of the managers screening applicants, 24 percent found information that solidified their decision to hire, while 34 percent found information that made them drop the candidate from the short list.

I also tend to Google people before making short-listing or hiring decisions (or when hearing about or meeting them professionally). It helps me build context and understanding and it draws on publicly available information (provided by the person in question), so there are no privacy considerations.

In terms of the full hiring process, for HR professionals and managers the online channel doesn't replace resumes, selection criteria and interviews, but it can certainly supplement this process by adding depth.

And for anyone seeking a new job, it is worth reviewing what you've said about yourself online - to ensure that you are representing yourself professionally.

Read full post...

Tuesday, September 16, 2008

How public is public information?

Over in California a controversy over the level of public access to public information flared up where the The Bee newspaper in Sacremento published a searchable online database of public sector officials and their salaries.


The newspaper simply pulled publicly available information together into a single source - no information was assumed or obtained illegally.

This has led to storm of protest which the newspaper responded to in a From the Editor Special: Response to questions about state employee pay database.

Over time we're also likely to see more Australian public information also being matched in this way - the tools to do so are readily available today.

For instance, it would require minimal effort for a media outlet or individual to mash together and republish information from GOLD (Government On-Line Directory) with APS salary ranges drawn from agency careers pages - providing a fairly accurate picture of the salaries of senior public sector officials in Australia.

Pulling together names of public servants listed in Hansard reports, media releases, websites and from published event attendence lists or meeting minutes, could also be combined with White Pages details, salary figures and office locations to identify and locate many public workers. Add a Google search and you can discover sporting affiliations, past roles, comments made online and further information about individuals - particularly those with distinctive or unique names (such as myself).

Each of the pieces of information by itself doesn't breach privacy - so can matching them together create a breach?

If so, how do you prevent information matching - shut down the internet and close the public libraries?

I'll leave the last word to an article from Government Technology, Web 2.0 Challenges Notions of Public and Private Information;
...everything we know about records management is wrong. Sure, that's hyperbole, but Barton [Founder of Glassdoor, now publishing salary information on the web] isn't exaggerating when he claims, "People's appetite for this information ... is effectively infinite." Once again, the Internet will show us what happens when public records are actually public.

Read full post...

Thursday, September 04, 2008

The future of the internet - and how to stop it

Jonathan Zittrain's new book, The future of the internet - and how to stop it, presents a compelling picture of how the internet has evolved from the 'sterile' and unchangeable computer systems of the 1960s and 70s into a 'generative' environment, enabling individuals around the world to freely develop applications and services and distribute them widely.

The book then looks at what may come next - the impacts of security and privacy holes and the increasing attempts to limit innovation in order to solve these issues.

It provides a compelling view of where we might be headed if we do not take steps at politic and managerial levels to change the direction.

The book is available freely online, notated by readers in an innovative collaborative approach to exploring the written word.

Jonathon has also presented many of the key themes of the book in various lectures, such as the one below.


Read full post...

Monday, August 11, 2008

Online engagement - learning from the private sector

A few months ago a PR agency representing the National Australia Bank (NAB) made a series of comments on AFL blogs advertising NAB services.

This incident has been discussed in publications such as Marketing Magazine, NAB spamming: maybe it's time to take dance lessons and Crickey, NAB spams blogs to spruik its SMS banking, which confirmed that the approach was endorsed by the NAB. From the Crikey article,

NAB media relations spokesperson Felicity Glennie-Holmes confirmed that the message was indeed from the bank. The idea to spam the comments sections of private blogs was a recommendation of PR agency Cox+Inall, part of the BWM group, and had been undertaken by Cox+Inall with the bank’s full knowledge and approval.

Cox+Inall had searched for blogs that included AFL coverage and were “well-enough read to attract readers who might be interested in our offer,” said Ms Glennie-Holmes. No-one at NAB or at Cox+Inall had considered approaching blog owners first for permission before posting their promotional messages, she said.

“Blogs are a public forum”, said Ms Glennie-Holmes. NAB and Cox+Inall felt this meant commercial interests could feel free to contribute unsolicited and irrelevant commercial material as comments, placing the onus on blog moderators to reject or delete unwanted comments.

Crikey's article went on to point out that the NAB had a strong anti-spamming message on its website, which did not seem to apply to how the bank chose to engage with others.


The incident has created a great deal of concern across the blogging community and a number of people I have spoken have lowered their view of the NAB.

An example of the backlash is this Youtube video looking at how NAB would feel if people came onto NAB property to advertise their own services. It's cheap and grainy - but the point is clear, respect the rights of others in their own spaces.

Bloggers have also contacted NAB directly to complain about this incident and a recorded interview was published online, as reported by Better Communications Results, StewArtMedia and NAB’s comment spam.


What can be learnt from this
I believe there are a couple of things communications professionals can learn from the NAB's experience.

Understand the channel and medium before engaging
The view of the NAB was that blogs were public forums, available for commercial comment.
In this case I feel that the NAB did not initially build a strong understanding of the online channel and consider how the medium of blogs actually function.

While blogs are available publicly, they are usually owned by a single individual and operated in a highly personal way. Just as people would take offense if an advertiser came into their home and started talking to their family and friends about a commercial offering, blog owners are proprietory about their blogs and need to be approached and engaged in an appropriate way.

This applies equally for an situation where an organisation engages with someone else's online property - be it a blog, forum or chatroom.

It is important for the organisation to take the time to understand the appropriate ground rules for the venue, consult appropriately and engage with the full agreement of the site operator.

Respect others
Respecting others is part of the social 'glue' that holds civilisation together. By stepping into someone's space and shouting a message an organisation, or individual, can be demonstrating a lack of respect.

While the internet is a public service, and blogs and forums publicly accessible, they still have rules of engagement - just like a public event.

An organisation seeking to engage within the online medium needs to spend the time observing to understand the social rules and codes of conduct before diving in.

This demonstrates respect for others and demonstrably changes the reception the organisation will receive.


Online engagement must add value
In this case the NAB posted commercial messages unlinked to the discussions taking place in the blog.

There did not appear to be any planning or thought around building credibility with the audience or adding value with the comments.

For organisations engaging online it is not sufficient to rely on the branding and established reputation in other mediums. Organisations need to think about what they bring to the forum or blog and what value they add to the conversation.

An organisation that provides adds value to the online conversation (speaking with), rather than advertising (speaking to) will build credibility and gain opportunities to communicate its message in more engaging ways - thereby being more successful.

Use an honest voice
In the NAB incident, a PR agency posted the comments - and they were posted anonymously, not as an official representation of the NAB.

When engaging online if you want to be taken seriously as an organisation you must represent yourself as who you are. Use an honest and real voice, advertising agencies can only take you so far, organisations will achieve far greater credibility and cut through if it is an actual representative of the organisation making the posts, using their true voice (not pre-processed PR statements).

This is very hard for organisations to understand, given the formal nature of engagement in other mediums - the best example is to think of the online channel as talkback radio and engage accordingly.


In conclusion
Thre's a lot of material available in print and online discussing the right and wrong approaches to online engagement. Most of it follows the same general theme as my points above, understand the medium, be respectful of others, add value to the conversation and use an honest voice.

Take advantage of this when developing your online engagement strategy and you'll avoid many of the mistakes organisations first face when making a decision to use the online channel actively.

Read full post...

Wednesday, August 06, 2008

Build egovernment trust, not privacy

Government Computer News reports that in Singapore government departments share the personal information of their customers in order to provide better egovernment services.

As reported in the article, Singaporese put a lot into passwords,

Singapore’s citizens are accustomed to the government knowing who they are when they access e-government services. With a mandatory password system named SingPass, in place since 2003, government forms download — after authentication — with personal data prepopulated into the fields.

Since the early 1990s, the government has used standardized, cross-agency data-naming conventions for elements such as names and addresses. It also has standardized data elements in the business and land registry domains. SingPass is also a reusable component for agencies building e-services.
In Australia data sharing across government departments is often perceived as a bad thing. Singapore's egovernment approach would be considered as reducing citizen privacy.

However within Singapore the approach is seen as a privacy enhancement.

What's the difference? Trust

As it states in the article (bolding is mine),
Citizens don’t welcome Big Brother surveillance, said Prashent Dhami, a senior consultant at the Singapore branch of consulting firm Frost and Sullivan. But most Singaporese tend to trust their government, Dhami said. Plus, technology infuses the lives of citizens from a young age. “You use technology so much, you start to understand it, you start to trust it. People have seen very few failed attempts at technology,” he added. SingTel, the largest local telecommunications provider, even sends text advertisements to mobile phone subscribers based on their current location.
Perhaps in Australia we need to invest more in raising the level of trust citizens place in government rather than investing more in technical systems to mitigate concerns over privacy.

In the long-run this could result in improved and more accessible egovernment services and a better relationship between citizens and government.

Read full post...

Bookmark and Share