Monday, March 8, 2010

Privacy, Identity and Safety

When people talk about privacy concerns related to Internet usage, their main concern Is often a risk of financial loss – that someone will steal their credit card, bank account number or their entire identity and they will lose all their savings, or at least their good credit. These are valid concerns. An instance of identity theft can take months or years to sort out.

But there is also a certain amount of concern over personal safety. There is a fear of being stalked or attacked or that one’s home will be broken into. There have been news reports of these sorts of things happening and it can be frightening. Is it a big risk?

While there have been a few anecdotes involving stalking and persons being lured into situations where they are victimized or robbed, there seem to be no statistics available on these types of crimes that are related to Internet activity.

But to emphasize the potential, a group that calls itself “Forthehack” created the web site pleaserobme.com, where you can find twitter posts from people who identify that they are not at home. The idea is that these people’s homes are available for burglary. The web site creators are not trying to get people robbed – they are trying to make the point that your Internet postings could be used by unscrupulous persons and that you should be careful. The results shown on pleserobme.com can be obtained from a simple search on Twitter, which the site shows you how to accomplish.

The FBI and other US governmental agencies focus their attention on three broad areas of Internet-related crimes: those related to terrorism, those that involve a possible or actual financial loss and those involving the exploitation of children. It is that latter category where the greatest physical crime threat exists.

It might be argued that in recent years we have become overprotective of children and too worried about threats to their safety. But it is also true that many of the threats are real and must be addressed by parents, law enforcement and the public. In the past, it was relatively easy to teach children not to talk to strangers, not to take candy from them and not to accept rides from them. Strangers on the street or in cars are easy for anyone, even a child, to identify as a stranger.

In the on-line world, of course, we have the ability to be anonymous. This is an aspect that we seem to value about the internet and we have seen a lot of advice to the effect that it is better to be anonymous to protect our own identities and our safety. This ability to be anonymous then gets turned on its head by those who wish to exploit – especially those who want to exploit children. It is not as easy for the child to spot a stranger as being dangerous when they seem to be just another 11 year-old in a chat room.

Most parents understand these risks (and if they don’t they should get informed fast). But how should those who manage online resources respond? Do the owners of social media sites and the like have a responsibility in this? Some of them try to put in place methods to identify their members as being who they claim to be and even monitor online chats. But there are usually easy ways to get around these identity checks.

Professionals who deal in any way with consumer identity information have a responsibility to at the very least make their best efforts to ensure the privacy and safety of those who buy their products or use their services. This is done by setting and following policies on privacy and security and designing systems that provide for compliance with regulations and ethical standards. It takes a little extra work to get it right, but it must be done to protect customers and users and most particularly children.

I’ll be speaking on the subject of privacy and identity at Enterprise Data World in San Francisco next week. My presentation will be at 8:00 a.m. on March 17. For more information on the conference, go to http://edw2010.wilshireconferences.com/.

Thursday, March 4, 2010

Privacy and Data Mining

When the 2003 version of the Outlook e-mail program came out, it would by default not display graphics in HTML e-mails where they were to be downloaded from the Internet once you opened the mail. The message that displayed in place of the graphic was “To help protect your privacy, Outlook prevented automatic download of this picture from the Internet”. What did this strange message mean? How would downloading a picture damage my privacy?

There are two issues here. The first is that there are some pictures you may not want to see and which could potentially offend. This is, however, a not very common worry.

The second, and more important, issue is that once you download the pictures, the sender of the e-mail knows you have opened the mail. Thus your anonymity is compromised. They may not know who you are, but they do know you are someone who has at least bothered to open the e-mail before deleting it. By downloading the picture you provide information to the sender that the e-mail address is live and someone is looking at the mail, even if only for a moment.

And of course if you click on any of the links in the mail and go to the sender’s landing pages, you provide the sender with more information about yourself and your viewing habits. The marketer can then start to build a profile about you. They can use cookies to track what you do on their sites over time. If you purchase anything, the amount of information they have about you starts to increase rapidly.

This brings us to the subject of data mining. I’m using data mining in the popular sense as being any activity that collects and analyzes data for marketing purposes. Professionals know that data mining is more properly defined as automated methods of discovering hitherto unknown patterns in any set of data. But the popular media have pretty well equated it with an invasion of privacy.

There are two broad categories of actions that marketers can take with data collected about individuals. First, they can target the person directly with offers that might interest the individual and prompt them to purchase goods or services. Second, the individual can be grouped together with others who seem to have similar characteristics in order to determine how that group behaves, leading to marketing that can better target that group or similar groups.

The first scenario, personal targeting, is the thing that consumers often find intrusive and sometimes just plain “spooky”. They don’t want their mail boxes or e-mail in-boxes filled with offers for things that they would normally not consider purchasing. They have a low tolerance to ads that say, “you might also be interested in...” or “other people who bought this product also bought ...”. Those kinds of suggestions must be used sparingly or the consumer is turned off.

Some consumers consider the use of their spending habits for market analysis as an invasion of privacy as well. But usually they are not even aware this is going on. Most people use grocery store discount cards with hardly a thought as to what is being analyzed about their shopping habits – they just like getting the discounts that are available. The use of the data gathered from such loyalty card programs has been limited, primarily due to the fact that marketers aren’t sure how far they can go towards targeting consumers with specific ads without offending them and driving their business away.

The controversy over data mining is just one more symptom of our conflict between identity and privacy in this digital age. We want to stay anonymous to feel safe, but we also have a need to be identified properly when we want to transact our business, on-line or off-line.

I’ll be talking further about the subject of identity and privacy at my presentation at Enterprise Data World later this month in San Francisco. My presentation will be at 8:00 a.m. on March 17. For more information on the conference, see:
http://edw2010.wilshireconferences.com/

Wednesday, February 24, 2010

Privacy and Identity

The idea of privacy has changed dramatically in the digital age. Humans have long valued their privacy – since about the time we moved out of communal caves we have looked to have our own little corner of the world that we can call our own and in which we can be protected from the intrusions of others.

A century ago, your privacy in your home was taken for granted. Outside the home it was more a matter of physical security from outlaws or others who did not mean us well. Your identity was a matter of pride and need not be hidden in any way.

Your name, unfortunately, is not unique. Governments like to keep track of their citizens, so most of them give their tax payers (i.e. everyone) a number that is unique. In the US and many other countries this is known as the Social Security number.

Even 10 years ago, your social security number was simply the number used to identify you to the Social Security Administration and the tax man. Many private agencies like health plans used your SSA as identification as a matter of convenience.

Then a strange thing happened – suddenly the Social Security number became a valuable secret that should never be divulged to anyone. How did this come about? The problem was identity theft – Someone pretending to be you and opening credit card accounts or even emptying your bank account.

The thing that propelled identity theft and much of the concern about privacy was the rapid proliferation of electronic means of commerce over the public Internet. We can buy and sell seemingly anything, access our bank accounts instantly, send money quickly to anywhere in the world at the click of a mouse and carry out all manner of other transactions. We love the convenience – so long as nothing goes wrong.

I would venture to guess that anyone reading this has at some time in the last few years had a credit card stolen and had some stranger – pretending to be you – charge things on that card that you had nothing to do with. It has happened to me three times. Each time I have been able to report the crime to the credit card company and I have not had to pay the charges myself. But it was a hassle, sometimes requiring that I provide a notarized statement.

Notice I did not report the crime to the police and I doubt that the credit card company did either. Both parties just considered this the cost of doing business. The credit card company may or may not have been able to stop or reverse the payments on the fraudulent charges. Most likely they just wrote it off.

Over this last decade our number one concern regarding privacy has moved away from simply shielding ourselves from prying eyes to being a defense of our hard-earned money.

But even though the worry about losing our wealth is perhaps at the top of the list of privacy concerns, it is not the only privacy issue that we are contending with. Consider the recent story of a school district accused of remotely monitoring students through the webcams of their school-provided laptops.

I’ll explore more of these privacy issues in future blog posts, along with a discussion of how privacy relates to identity and the impact of both these hot topics on how Information Technologists deal with them. And I will be presenting an overview of all of this at Enterprise Data World in San Francisco on March 17. I hope to see some of you there.

Wednesday, September 2, 2009

The Promise and Danger of Agile Project Methods

The Agile Manifesto (http://agilemanifesto.org) is a “great leap forward” in thinking about how software can best be created. It’s four basic values are simple and sensible statements of where priorities should lie in any software project and can even bee applied to projects outside of software development.

Of the for values, only the last (“Responding to change over following a plan”) would have any serious argument from most Project Management Professionals. At the base of everything a PMP does is the creation of a plan and then following that plan. The plan is constantly reviewed, of course, but it is always there and it is followed. If circumstances demand that the existing plan is no longer valid, then the plan is changed and the new plan followed. But the plan is always followed.

No doubt followers of the Agile methodology would say that they do not reject all planning, just that responding to change is more valuable. My observation, though, is that those seeking to apply Agile methods to projects tend to throw out planning altogether (they often throw out processes, documentation and contracts as well).

In some descriptions of Agile development you will find that the Project Manager has been relegated to an administrative role - making sure that there are enough white boards and scheduling meetings with senior management . They are actually project expeditors and not managers at all.

The fact is that the planning function in any project is so important that it is always being done in any successful project. It is done usually by someone by default who has the leadership potential and the experience to do it. He or she may do a lot of the planning behind the scenes and informally, but the planning does exist and is followed. A plan is pushed ahead through force of will and cajolery, or it is not followed and the project fails.

I have seen some embrace Agile mainly because they cannot plan, document, negotiate or use processes or tools effectively. They see it as their license to jump in and start coding. We have seen this same kind of behavior for many years in the software industry and few seem to have learned the lesson that this just does not work. It does not create workable, stable systems that can be maintained and that bring value to the business over the long term.

The Agile Manifesto itself is very short and sweet. Many other words have been written to expand on those ideas and to create a full-blown methodology. My hope is that we will one day see a methodology that balances both sides of the value equation. There is no doubt that software development processes must change and Agile will be an important part of that. We will probably see a gradual swing to the center where values are more balanced. I certainly hope that is the case.

Thursday, July 30, 2009

Creating Business Value

Back in May I wrote about failed projects and the myths surrounding the supposed high percentage of project failures in the IT industry. I tried to make the point that the only true measure of project success is the value the project brings to the business and that success is not just bringing in a project on time and within budget. I recommended that Project Managers measure their projects by business value generated.

I don’t think I took that idea far enough. I believe that PMs should actively seek to achieve business value in their projects from the very beginning of the project and to push that idea all the way through the project. One way to do this is to think of risk in a new light – the risk that the project is not generating business value.

We should be constantly looking at risks to our projects, determining the potential impact of those risks and taking appropriate action or at leas planning for what to do if a risk becomes reality. We usually look at those risks in terms of cost or time lost. What we need to do is look at the impact on business value.

For example, a risk could be late delivery of the production server hardware from a vendor. The impact is that production cut-over is delayed and the schedule is extended by one week.

But what is the impact to the business? If this production server is to support an e-commerce site intended to go live in late October to handle the Christmas sale rush, a delay of one week could be devastating to the sales for that season. On the other hand, if the server is for a data warehouse to support analysis of the Christmas season campaign after the fact, the impact on the business of a week’s delay might be minimal.

It could be relatively easy to include such measures when doing qualitative and even quantitative risk analysis. This can help you prioritize risk responses and manage your risks in a more realistic fashion.

Business value can also be factored into the monitoring of project progress. The metrics offered by earned-value analysis do not allow for such factors to be taken into account. Earned value is a narrow measure of the value the project has earned toward the goal of completing on time and within budget. It gives only a passing nod to business value.

How could a project manager measure business value while executing, monitoring and controlling a project? This would require a new set of metrics that go beyond earned value. It might be possible to work out something very complex. Even better would be to apply Occam’s razor (or if you like, the KISS principle) and find the simplest solution first. Here’s a suggestion:

1. Predict the value the project will bring to the business over the period following the completion of the project (could be 1-3 years).
2. The total value over that period, if the project completes on time, is the baseline value.
3. If the project is expected to be late, determine how much business value will be “eaten”.
4. If the project can come in early, calculate the added business value that can be earned.
5. Factor in additional or saved project costs.
6. This gives a new business value figure. Is it better or worse than the baseline? Make decisions based on that.

I’m sure someone out there can come up with some better ideas on how to do such a measurement and it might even vary by organization or project. The point is – make sure you use business value as your prime factor in determining project success or failure!

Sunday, June 14, 2009

Forecast: Clouds, Fog - Followed by Partial Clearing

Cloud computing has become one of the more interesting trends in the technical world in the last year or so. But it is not easy to see through the fog surrounding this latest buzzword. It’s worthwhile for a project manager to understand this trend and to think about where it might take us.

The term cloud computing came from the world of networking, where a diagram of a wide-area network would often show a large cloud in the middle that was meant to represent some mixture of the Internet and private links. The idea was that the communications from various servers and workstations went into the cloud and the cloud took care of routing the communications to the correct point. The cloud was generally conceived to be managed by the ISP or telecom company.

Recently, virtualization has allowed any server to be easily split into many small servers that could be resized and brought up and down, independent of the underlying hardware. A hosting provider could allow a customer to manage their server resources in a more flexible manner. A virtual server could be made available somewhere on the Internet and so could be thought of as a “cloud computer”.

Curiously, the organizations that have begun to make a serious impact on cloud computing have not been ISPs, telecoms or hosting providers. Instead, it has been a small group of large companies that already had very large infrastructures set up to manage their own businesses. We are talking here about Amazon, Google and Microsoft. Of the three, the Amazon offering is the most mature and I’ll focus on it as an example of how this all works.

Amazon’s offering is called simply Amazon Web Services – AWS. Its most basic components are Elastic Compute Cloud (EC2) and Simple Storage Service (S3). The EC2 service allows a user to set up virtual servers quickly and easily, paying only for the resources actually used. The S3 service allows users to store data – any kind of data – and access it from an EC2 server or anywhere within their own infrastructure.

This way of working can be very cost-effective for testing. A tech can bring up a virtual server, load software and data and be ready to test in a short period of time. When he is done testing, he can save the data to S3 (or on a server back in his own office) and drop the virtual server. He can do several days testing for just a few dollars. If he had to get a real server it could take weeks and cost hundreds of dollars or more.

Beyond testing, this kind of set-up can be a great help for a company who has a lot of peaks and valleys in their computing needs, such as retailers who get most of their sales in November-December. They can have a small virtual server most of the year and easily double or triple their capacity during the holiday sales season.

It probably makes less sense for a company with a steady, even usage pattern and little (or very predictable) growth to use this kind of service for production. This kind of company can plan, purchase, install and maintain servers and storage far enough in advance to meet demand and probably do it less expensively. But in today’s environment, there are fewer and fewer organizations who are in this predictable category.

From everything I have seen, Amazon is far in advance of anyone else in terms of their services, management, reliability and availability.

I started using Amazon S3 nearly a year ago almost by accident. I wanted an easy, cheap and secure way to store important files online for backup purposes.. There are several commercial offerings that charge upwards of $15 per month. With S3 and an inexpensive software component (Jungledisk - $10), I was up and running very quickly. The cost? About $1 per month!

As a project manager, if you have any flexibility in how your infrastructure is deployed, it would be worth your while to investigate cloud computing as an alternative. It could be a way for you to shave costs and time. It is not appropriate for every task (security policies may make it impossible). But if you have ever had to wait weeks for procurement to get you that test server, it can be a huge victory to get it done in a couple of hours for one-tenth the cost.

Keep an eye on this technology. The fog will clear and I predict sunny weather ahead.

Links:
http://aws.amazon.com
http://www.jungledisk.com

Wednesday, May 20, 2009

A New Venture

I have spent many years now working for various organizations as an employee. There is nothing wrong with that – a well-managed group can accomplish a great deal and working as part of a large team can be very rewarding. But I, like many in America and elsewhere, have always had the dream of starting something on my own, my own company.

I have recently decided that now is the time for me to take on such a new challenge. I want to be able to use the things I have learned about systems, organizations, projects and people and put these together in a package that I can offer to others to help them achieve success.

To that end, I have formed Pinnacle Project Group (www.PinnacleProjectGroup.com). Our mission and goal will be to help create a better world through the application of superior IT project management. We will achieve this by ensuring that our client’s projects deliver real business value to their organizations.

I know that “a better world” is a lofty goal for a consultancy that currently consists of one person. But I believe strongly that we all should be striving to create a better world in whatever big or small way we can. If we are not doing so, we must perforce be allowing the world to get worse, if only by neglect. We can all make an impact – even if it is only in one small corner of the world.

I would invite you to think about your projects and the impact they have on the world around you. Will the project lead to something that improves conditions in the world? More than it harms? If not, consider whether this is a project that you want to be associated with.

In tough economic times it can be difficult to think beyond the welfare of yourself and your immediate family. But if you look over recent history, you can probably see that considering only self-interest is what got us into this mess.

I think you will not find it hard to consider the greater good in your actions. For some excellent guidance, have a look at the booklet The Way to Happiness”, which can be found at this link:
www.thewaytohappiness.org/about/resources-and-downloads/e-books.