T H E M A G A Z I N E F O R T H E I T P R O F E S S I O N A L

WINTER 2018
BLOCKCHAIN
THE HYPE, THE HOPE
AND THE REALITY

bcs.org/itnow
 BLOCKCHAIN
04 FROM HYPE TO HELP 18 BLOCKCHAIN IN NIGERIA
08 BLOCKCHAIN, BITCOIN AND 20 THE BLOCKCHAIN ISLAND
THE RISE OF NEW MONEY 22 BEWARE OF THE
14 PROTECTING MEDICAL CRYPTO-HYPE
RECORDS 24 BLOCKCHAIN TRANSACTION
16 BLOCKCHAIN AND INSURANCE AND REGULATION

BCS PROJECTS AND NEWS SECURITY

48 GDPR:FOUR MONTHS ON 26 BIOLOGICAL IMPROVEMENT
60 TURING BOMBE MOVES HOME 28 THE BIGGEST HACKS AND WHAT
61 BCS WOMEN & BCS AI AWARD THEY CAN TEACH US
62 TURING LECTURE: INTERVIEW 32 SHOULDER SURFING
34 IS YOUR SMARTPHONE LEAKING?
OTHER FEATURES 36 REMEMBER THE PEOPLE
52 WHY 3D LEARNING FELL FLAT 38 INTERVIEW WITH GIOVANNI VIGNA
54 WHY PROJECTS FAIL 42 SECURE SOFTWARE DEV
56 SOCIAL START-UPS 44 CYBERCRIME: POLICE RESPONSE
46 APP SIDELOADING AND RISK
REGULAR FEATURES
64 BOOK REVIEWS HEALTH
65 BCS JOURNALS 50 A SMARTER APPROACH TO
66 CHRISTOPHER CURRY CITY LIVING

EDITORIAL/PRODUCTION of IT professionals, from June, September, December) www.oxfordjournals.org/ F +44 (0)1865 353 485 the address below and may
Justin Richards systems developers to by BCS, The Chartered our_journals/combul/ require a fee.
Commissioning Editor directors, consultants to Institute for IT, North Star access_purchases /price_ The opinions expressed
Grant Powell training and education House, Swindon, UK. list.htm herein are not necessarily Printed by Rotolito S.p.A
Assistant Editor specialists. A subscription Airfreight and mailing in the The current year and two those of BCS or the Italy.
Martin Cooper to ITNOW comprises four USA by agent named Air previous years’ issues organisations employing the ISSN 1746-5702. Volume
Content Manager issues. Business Ltd, c/o Worldnet are available from Oxford authors. 60, Part 4.
Brian Runciman Shipping Inc., 156-15, 146th University Press. Previous © 2018 The British BCS The Chartered Institute
Head of Content All prices include postage. Avenue, 2nd Floor, Jamaica, volumes can be obtained Computer Society. for IT
Florence Leroy For subscribers outside the NY 11434, USA. from the Periodicals Service Registered Charity No First Floor, Block D, North
Production Manager UK, delivery is by Standard Periodicals postage paid at Company, 11 Main Street, 292786. Star House,
Air. Jamaica NY 11431. Germantown, NY 12526, North Star Avenue, Swindon,
Advertising US Postmaster: Send USA. Copying: Permission to copy SN2 1FA, UK.
Brian Runciman Annual subscription rates address changes to ITNOW, E psc@periodicals.com for educational purposes only T +44 (0)1793 417 424
Head of Content Institutional: print edition Air Business Ltd, c/o T +1 518 537 4700, F +1 518 without fee all or part of this F +44 (0)1793 417 444
editor@bcs.org and site-wide online access: Worldnet Shipping Inc., 156- 537 5899 material is granted provided www.bcs.org/contact
+44 (0) 1793 417 474 £243/US$455/€358; 15, 146th Avenue, 2nd Floor, that the copies are not made Incorporated by Royal
print edition only: £224/ Jamaica, NY 11434, USA. For further information, or distributed for direct Charter 1984.
Keep in touch US$417/€329; Subscription records are please contact: Journals commercial advantage; BCS
Contributions are welcome. site-wide online access only: maintained at BCS, The Customer Service copyright notice and the title Chris Rees BCS President
Please email: £190/US$357/€289. Chartered Institute for IT, Department, of the publication and its date Paul Fletcher CEO
editor@bcs.org Personal: print edition and North Star House, Swindon, Oxford University Press, appear; and notice is given
individual online access: SN2 1FA UK. Great Clarendon Street, that copying is by permission Feedback
ITNOW is the membership £224/US$417/€329. Oxford OX2 6DP, UK. of BCS. To copy otherwise, editor@bcs.org
magazine of BCS, The For payment details and E jnls.cust.serv@oup.com or to republish, requires
Chartered Institute for IT. ITNOW, ISSN 1746-5702, is terms and conditions, please T (and answerphone) +44 specific permission from
It is sent to a wide variety published quarterly (March, see: (0)1865 353 907 the publications manager at

03 ITNOW December 2018

BLOCKCHAIN
FROM HYPE TO
HELP
It is almost impossible to avoid the hype around blockchain
technology. In the space of less than two years, what was once the
preserve of developers and deep tech entrepreneurs has
exploded into the public consciousness. Perception varies wildly.
Kate Baucherel, COO of emerging technology software house City
Web Consultants, and presenter of BCS’s recent blockchain webinar
looks, discusses and differentiates between hype and utility.

Many people simply follow the headlines
about volatile cryptocurrency prices
without any appreciation of the hive of
activity beneath. Since summer 2017,
the bull and bear markets have attracted
attention for their get-rich-quick potential
and the schadenfreude of paper losses.
The rise and fall of cryptocurrency makes
a better story than the work that has been
going on under the radar to refine and
expand upon Bitcoin’s original mechanism
for decentralised, trustless, transparent
transactions. Development has been rapid,
global and largely collaborative, its wheels
oiled by gold-rush fundraising with new
cryptocurrencies (altcoins) and tokens.
Despite this, opinion over the
technology’s real potential is polarised.
For some, blockchain is a new talisman,
a silver bullet. It’s the tool to fix all supply
chain problems (it isn’t). Cryptocurrencies
Do you really need a blockchain?
Thanks to elevated excitement and ready
sources of funding, many ‘blockchain’ ideas
come to the table at our software
development consultancy. It is
extraordinary how few of the proposed
applications show a genuine need for this
emerging technology. Occasionally we
meet people who have their eyes on
making magic internet money at little risk
to themselves. Some well-meaning
proposals have no business model to
speak of, driven by a desire simply to use
the technology, looking for a problem to fit
the solution. When a real business model is
presented with an apparently
insurmountable pain point, we sit up and
take notice. Blockchain is still unlikely to be
the solution: in most cases the real
challenge is to define the client’s processes
more clearly and invest in development of

For some, blockchain is a new talisman, a silver

bullet. It’s the tool to fix all supply chain problems
(it isn’t). Cryptocurrencies will make banks obsolete
(they won’t).
will make banks obsolete (they won’t). At traditional enterprise systems to solve their
October’s Conservative Party conference, problem.
Chancellor of the Exchequer Philip However, there are an increasing
Hammond held blockchain up as the key number of proposals where transparency
doi:10.1093/itnow/bwy087 ©2018 The British Computer Society

to a frictionless Irish border (maybe one
day, but not yet). To others, blockchain
is an over-hyped, jumped-up database,
its unproven benefits outweighed by its
evident shortcomings. Of course, the
truth lies between these extremes, but
misconceptions over the operation and
application of blockchain, or more correctly,
distributed ledger technology (DLT),
are legion.
and immutability bring benefits and could
not have been achieved in any other way,
where parties who do not know each
other need a mechanism to trust the
recorded data, or where unique features
such as smart contracts or tokens will
be significant in the successful operation
of the system. In those few cases where
distributed ledger technology is genuinely
relevant, it’s very exciting.

04 ITNOW December 2018


The promise of programmable money
The high proportion of snake-oil salesmen
in the cryptocurrency field has given tokens
a bad name, but they are a particularly
interesting aspect of blockchain. A token is
not merely monopoly money: it is
programmable money. A token might
represent an item, a digital asset, or a
degree of influence in a community. There
is excitement over the use and trading of
discrete items represented by non-fungible
Blockchain is not going away: regardless of the hype
and some ridiculous ICO propositions, it is being
taken seriously in the highest circles.
tokens (NFTs), driven by the gaming
industry and gaining traction in enterprise.
Tokens have, of course, been used to
raise billions of start-up and development
funding in the blockchain space. These
initial coin offerings (ICOs) are the
sale of tokens that should have utility
in a proposed system. The distinction
between a token that has utility and a
token that may be a thinly-veiled risk-
bearing security is being hotly debated
in multiple jurisdictions, but for now let’s
think of a pre-sold token as a gift card:
buy it now, use it when the system is
built. New ideas are proposed daily by
entrepreneurs who raise funding through
the mechanism of ICOs. The best of these
are transformational, the worst unfeasible
or fraudulent, but the work undertaken,
thanks in part to ICO token funding,
has accelerated the development and
understanding of blockchain.
Balancing the risks and benefits of new
technology
The potential of DLT to transform
processes, change behaviour and improve
lives is increasingly accepted. Substantial
organisations from the United Nations to
governments and multinational enterprises
are investing considerable resources in
pushing the boundaries of the technology.
There are also efforts to address growing
concerns over the energy consumption
required to maintain a public blockchain,
and regulators around the world are
hovering over volatile cryptocurrencies and Using existing systems this process
a proliferation of tokens, conscious of a lack took almost a week to run, while the
of investor protection in the ICO gold rush.
Blockchain is not going away: regardless of
the hype and some ridiculous ICO
propositions, it is being taken seriously in
the highest circles.
Business on the blockchain
The supply chain is frequently cited as a
perfect use case for DLT, so let’s dig deeper
into the ambition of achieving frictionless
cross-border trade. Where are the pain
points in the process? In the simplest case,
the origin of goods determines whether
they can cross the border and what duty
is chargeable. The sender needs to be
confident that the buyer will pay. The
buyer may need assurances regarding
provenance, ethical sourcing and suitable
transportation, for example, maintaining
the cool chain for perishable goods. There
are multiple parties involved: buyer, seller,
producer, transport companies, customs,
banks.
Many of the processes involved could
be streamlined using existing technology,
and, as software developers, we very
rarely recommend using blockchain, even
when the client makes an initial approach
to explore its application. However, there
are some transformations, thanks to
blockchain, which are genuinely exciting.
It is already possible to check the
provenance of certain commodities.
Everledger pioneered the tracking of legally
mined diamonds using forensics and digital
asset twinning on a hybrid public/private
distributed ledger framework. Blockchain
in this case is a vehicle for trust, through
the transparency of the public record and
the validation of inputs from unconnected
parties along the supply chain.
Distributed ledger supply chains are
being developed and tested around the
globe and, in October 2018, the IBM Food
Trust blockchain went live as a commercial
product. During the proof of concept phase,
IBM worked with Walmart, who challenged
them to trace mangos from farm to store.
blockchain-based system completed the
FOCUS: BLOCKCHAIN
task in 2.2 seconds. It’s early days in such
a complex area, and there are many issues
to overcome, not least that a blockchain
is only as good at the data that is fed into
it. Developers would be well advised to
remember GIGO: garbage in, garbage out. If
this hurdle can be overcome for foodstuffs,
using reliable forensic data in the same
way that Everledger has implemented with
diamonds, the potential is huge. If reliable
inputs are overlaid with transparency
and trust, this has implications for proof
of ethical sourcing, distribution of wealth
through the mechanism of smart contracts,
and a reduction of opportunities for fraud
and corruption.
In the shipping industry, Maersk and
partners have implemented a blockchain
system to manage insurance for their
hulls as they cross the world. The
economic driver for the business was
the mitigation of risk and the reduction
of manual administrative processes, but
the implications are far-reaching. If you
Where do people
believe blockchain will
have the most
significant impact?
The holy grail of blockchain is identity.
The ID2020 foundation, in partnership
with Accenture, is providing digital
identities for some of the 1.1 billion
unregistered people in the world using
biometrics and blockchain. The Estonian
government has protected the details
of all their citizens through distributed
records held at their embassies in other
countries. In Jordan, the World Food
Programme implemented a private
blockchain beneath an existing food
aid distribution system, protecting the
details of 100,000 refugees and enabling
biometrics as their means of identity. As
a bonus, the proof of concept implemen-
tation saved $40,000 a month in bank
transaction fees, administration costs
and the prevention of fraud. Identity is
not just a concern at national levels:
in financial services the need to Know
Your Customer is leading banks towards
authentication from immutable, trusted
records.
December 2018 ITNOW 05
know where the hulls are, could you track
the containers within them, and thus
goods thoughout their transit? Kuehne &
Nagel have made a start on this, adding a
blockchain element to their existing Verified
What other assets could be represented, recorded,
exchanged or licensed in a decentralised structure?
For example, could a digital asset represent a
component in major engineering works such as oil
rigs, giving the rig a digital twin record that
accompanies it for life to decommissioning?
Gross Mass (VGM) portal which tracks the
weight of shipments.
Escrow and deposit services have
existed for decades, giving suppliers
reassurance, but the implementation of
smart contracts to trigger payment on
acceptance of goods is a new departure.
This is not simply automation of a process,
but its extension and decentralisation.
There is no reliance on a central authority
to complete the payment once all the
criteria are met, and funds can be sent
simultaneously to multiple recipients down
the supply chain. Possibly the first example
of a working blockchain escrow transaction
was on the Propy real estate platform,
which executed its first blockchain property
sale in October 2018.
Payment is the final hurdle, and one
which at first sight has been working
perfectly well without a blockchain.
Behind the scenes, it is a story of complex
reconciliation of multiple accounts,
administratively burdensome and entirely
ledger-based. This structure makes cross-
border payment a prime candidate for
reworking in a distributed ledger powered
by smart contracts, delivering more
transparency, confidence in the integrity
of the records, and long-term cost savings
into the bargain.
This course is being pursued across
banking and financial services. Santander’s
One Pay FX system was the first
blockchain-powered foreign exchange
system to go live, released in the UK and
several other countries in April 2018.
Although we are years rather than months
away from seamless cross-border trade,
the foundations are already in place.
Practical blockchain applications are
06 ITNOW December 2018
emerging in many diverse sectors. A
short step from consumer banking lies
the securities market, where ownership
transfers are already being made using
distributed ledgers. The first such transfer
took place in March 2018 between
Credit Suisse and ING. Shifting sideways
to financial regulation, in March 2018
Northern Trust deployed a system whereby
their auditors have direct access to fund
transactions, permitting real-time audit for
private equity lifecycle events. Widening
the scope to assets, HM Land Registry
announced, in October 2018, that they are
trialling blockchain in their Digital Street
project.
The tokenisation of property assets in
investment portfolios is starting to gain
momentum, using the new technology to
make previously illiquid assets tradeable.
In engineering, blockchain is being used
to reduce the administrative burden at the
sharp end of the oil and gas industry. In
June 2018, Diamond Offshore launched
a blockchain drilling platform for supply
chain, well planning and other aspects of
the drilling process.
Gaming takes blockchain outside the box
The concept of asset ownership has taken
on a life of its own in the gaming industry.
This should not come as a surprise. The
adoption of innovative technology often
begins in gaming, and there has been
considerable development and concept
stress testing going on here since the
earliest days of blockchain.
Ownership is deceptive. Anything you
have previously created or purchased in a
game may feel as if it is yours, but in reality
the item remains on the servers of the
gaming company, or static in your licensed
copy of the game, as Deckbound’s Gareth
Jenkins explained at the 2018 Blockchain
Game Summit. Gamers are ready for
blockchain: it fits their mindset.
When the first high-profile blockchain
game, Cryptokitties, launched in November
2017 there was so much traffic that the
Ethereum network struggled under the
load. The excitement was not due entirely
to the fact that, at last, here was something
you could spend your cryptocurrency
on. Sharp-eyed developers reading the
open source code realised that once you
had purchased your cartoon kitty, you
owned it. If you breed kitties, you own the
offspring. Gamers may wish to take the
asset and use it in another game: to be
fair, a cute cat cartoon may not be useful
on a Call of Duty battlefield, but a fully-
tooled Overwatch character may be. This
ownership of a digital asset which is not a
coin is something quite new, and while it
is currently exercising games designers it
has wider implications across sectors.
What other assets could be represented,
recorded, exchanged or licensed in a
decentralised structure? For example,
could a digital asset represent a
component in major engineering works
such as oil rigs, giving the rig a digital
twin record that accompanies it for life to
decommissioning? This is a new way of
thinking and may represent a behavioural
shift to come.
Mitigating the environmental cost
The strain put on the Ethereum network
by Cryptokitties brings us neatly to the
elephant in the room: Is blockchain
killing the planet? The energy consumption
required to maintain public blockchains
is phenomenal. According to the Bitcoin
Energy Index, estimated annual
consumption in 2018 for the Bitcoin
blockchain alone has doubled year on year,
standing at over 73 terawatt hours. This
is around the same energy requirement
as the whole of Austria and takes no
account of the load from the Ethereum
network or any other public blockchain that
relies upon proof of work (PoW) number-
crunching for its validation.
To bring this into context, a proof is
the validation mechanism that makes
transactions on any blockchain a matter
of absolute trust. A single block contains
a reference to the previous block (joining
the chain), the Merkle tree root of all
the transactions contained in that block
(there could be thousands), a timestamp,
and a validation nonce. In the Bitcoin

and Ethereum blockchains this nonce is
generated using PoW: a race to the line
to solve an algorithmic puzzle whose
difficulty increases with each block, as
does the processing power required to
solve it.
This process ensures that the validator
is chosen at random, reducing the potential
to collude and defraud. (Purists will
point out that collusion is possible if an
entity has control of a majority of nodes.
These ‘51 per cent attacks’ do happen,
particularly on smaller blockchains with
fewer nodes, and work to manage the
risk is ongoing.) The winning validator
receives a fee for each transaction in the
block and, on the Bitcoin blockchain, a
reward which currently stands at 12.5
Bitcoin. That reward will halve every
200,000 blocks until all that remains is a
long tail of tiny sums, but the transactions’
fees by that time are expected to provide
the full economic reward that keeps the
validators, the miners, working to maintain
the blockchain. It is an elegant solution and
has worked largely unhindered for the best
part of a decade. The power consumption
involved in validation mining is gradually
levelling out, but it is already cripplingly
high, and we are in the early days of
adoption. How can the toll on our planet’s
resources be mitigated?
There is plenty of talk around the use of
renewable energy, but existing renewable
generators are fighting back against
miners flocking to cheap energy hotspots
such as the cities around Niagara Falls,
The vision of a transparent supply chain which
rewards the producer, frustrates the corrupt, and
reassures the consumer is a powerful one.
banning them from operating. In countries
close to the Arctic circle, miners are trying
to mitigate consumption by using the
naturally cool local climate to keep their
servers at operational temperatures.
The PoW calculation is not the only
energy guzzler on the horizon. It is the
nature of a distributed ledger to be, well,
distributed. Every party to the ledger has a
copy stored locally. In a centralised system,
the database is held in perhaps two or
three places for redundancy and security
and users read the data by API or direct
access. In a decentralised system, there
could be hundreds, thousands, millions of
copies of the same data: more computing
power.
Initiatives to harness renewable energy
are essential, as is the use of judgement
on what processes are suited to a
blockchain. If traditional technology does
the job, why change horses mid-stream?
There is a lot of work underway to find an
economically sound substitute for PoW.
Ethereum’s community has invested a lot
of work in developing proof of stake (PoS)
but this is still beset with problems and
its adoption has been delayed. Proof of
stake requires nodes to vote to commit a
block to the chain, the weight of the vote
reliant on their investment, their stake, in
the chain’s cryptocurrency. There is more
risk of attacks here than with PoW, as it
would be easier to gather 51 per cent of
the vote by purchasing coins, and this
risk is the principal stumbling block for
implementation.
There has been more inventiveness in
private (permissioned) blockchains such
as the Hyperledger frameworks and IBM
Blockchain. Where the membership of
the distributed network is restricted, for
example, within an enterprise supply chain,
there are no transaction fees to pay and no
cryptocurrency in the system. Hyperledger
Sawtooth’s Proof of Elapsed Time (PoET)
allows the node with the fastest processing
time at that given moment to validate the
block. It relies on Intel chips in all nodes to
run, which is a possible security weakness.
Other proofs seek to achieve a level of
Byzantine Fault Tolerance. There is no
consensus on the most effective path, but
ultimately any proof must randomise the
validating party for any block in the chain,
whether by work, by lottery, or by voting.
Changing lives
The imperative to reduce energy
consumption by any means possible is at
the forefront of the minds of developers
and advocates. Blockchain has the potential
to change lives, and must not also destroy
them. The World Economic Forum has
estimated that the technology could
FOCUS: BLOCKCHAIN
stimulate a trillion dollars of trade from
underdeveloped countries and small
businesses. The vision of a transparent
supply chain which rewards the producer,
frustrates the corrupt, and reassures the
consumer is a powerful one.
Through our first world lens, blockchain
gives incremental benefits. For the rest of
humanity, it could be revolutionary.
Further reading
An alliance committed to improving lives
through digital identity https://id2020.org/
The Diamond Time-Lapse Protocol
https://diamonds.everledger.io/
Why blockchain won’t fix food safety—yet
https://newfoodeconomy.org/blockchain-
food-traceability-walmart-ibm/
HM Land Registry to trial blockchain for
Digital Street project https://bit.ly/2Fjcf8F
Diamond Offshore in blockchain push
https://bit.ly/2Fho0wE
Fixing player ownership, Game Summit
https://bit.ly/2PU6Etv
Cryptokitties isn’t about the cats
https://bit.ly/2z8gXRo
Digiconomist Bitcoin Energy Consumption
graph https://digiconomist.net/bitcoin-
energy-consumption
Cryptocurrency: not so eco-friendly
https://bit.ly/2RLT0Ge
Blockchain’s 51% Attack
https://bit.ly/2xW4OAE
Blockchain Could Enable $1 Trillion in
Trade
https://bit.ly/2DjB8OY
December 2018 ITNOW 07
 BLOCKCHAIN,
BITCOIN AND THE
RISE OF NEW MONEY
Starting with Satoshi’s famous essay, Anthony G. Parker MBCS explores what blockchain
and cryptocurrencies may mean for the future of money and wealth. Along the way he
reveals how the two could change more than just the pound in your pocket too.
In January of this year, the rich and power-
ful banks, politicians and economists met
at the annual Davos Economic Forum to
discuss technology, globalisation and the
world’s economic activity. My sources tell
me that Blockchain was one of the topics
widely discussed. The focus of interest
was not the understanding of the technol-
ogy itself, but how disruptive this technol-
Image: iStock.com/Georgeclerk/Gmutlu
ogy could be.
Blockchain, the underlying technology
infrastructure behind Bitcoin, was
released to the world on 3 January 2009
by Satoshi Nakamoto after writing his
seminal white paper, ‘Bitcoin – a peer-
to-peer (P2P) cash transaction system’.
Having been annoyed at how banks
could privatise profit, but socialise losses
after the financial meltdown in 2008,
Satoshi wanted to create a new form of
money- one that couldn’t be susceptible to
doi:10.1093/itnow/bwy088 ©2018 The British Computer Society
corruption, power, politics and economic
cycles. A form of money that had distinct
advantages over the old, slow form
of money we take for granted. These
advantages I like to call the 4 D’s:
• Digital – it is the first scarce digital
resource, recorded on an open,
public ledger
• Decentralised – it’s not governed by
any bank or institution and cannot
be shut down
08 ITNOW December 2018
• Deflationary – With only 21 million
bitcoins ever made, the price
increases as more and more people
use it
• Divisible – One bitcoin can be split
into 100 million Satoshi
Bitcoin has been called many things –
internet money, digital gold, fast money;
and, more negatively, rat poison, a
fraud and a Ponzi scheme. Whatever
your understanding of Bitcoin, and the
distributed ledger technology it’s built on,
for the first time in IT history we now have
access to a standard, open, decentralised
immutable ledger that anyone can transact
with globally without needing permission.
We don’t need to trust anyone using it –
we trust the defined and provable maths
highlighted in Satoshi’s white paper.
With nearly 10 years in the wild, gone
are the arguments about the energy
consumption of Bitcoin when compared
with the energy used printing, storing,
transferring and securing paper money
and the vast financial products around it.
Gone are the hacking arguments – whilst
digital wallets, private keys and exchanges
have definitely been hacked, the Bitcoin
blockchain itself is tamperproof. If you
make changes to your copy of the ledger,
it will be rejected by other computers in
the network. Gone are the arguments
about how GDPR will render it unusable
– businesses that adhere to GDPR ensure
personal data is kept privately off-chain or
anonymously stored on-chain. Gone are
the mistaken views that it’s only used by
criminals. As an open and public ledger,
federal and police authorities all over the
world can track transactions – it’s easier to
buy your narcotics anonymously with local
currency than with Bitcoin.
How about the argument that it’s too
volatile? Venezuelans don’t think so. If
they bought Bitcoin at it’s height of $20k
in January 2018, they would still have
more value left in their pocket than if they
had kept hold of their Bolivars due to the
hyper-inflation in the country. We’ve seen
Bitcoin at heights of $32 only to crash to
$2, then climb to $256 and crash to $70,
climb back to $1,000 and again crash to
$200, and recently crash from around
$20,000 to $5,800. We have seen these
market cycles before and have become
exceedingly efficient at not worrying about
the volatility, as with all new asset classes.
It’s also only temporary as this technology
grows and more people adopt it and adapt
to it. Is it a bubble? Well, yes, but no more
so than the stock market, housing market,
car loan market, the current deficit and
the very worrying corporate bond market.
Putting aside the assumed problems that
media like to portray about Bitcoin, let’s

discuss how disruptive the technology
behind it could be.
From CIOs to IT Consultants, those
that study Blockchain start to realise
its potential. Blockchain is the perfect
combination of a peer-to-peer (P2P)
decentralised network, cryptography
and token economic game theory or
cryptoeconomics as Vitalik, the founder
of the second largest cryptocurrency
Ethereum, likes to call it. This makes the
world’s first immutable, secure, open and
public digital ledger suitable for double
entry book keeping. This sounds like a vast
improvement over our current financial
legacy systems because it is decentralised
and it can’t be shut down or governed
by any state, business or individual user.
Satoshi Nakamoto (whoever he/she/they
may be) has given us the ability to create
a pure uncounterfeitable digital currency;
one that has been the desire of the banking
industry for many years. The banking
sector is rightly worried – they will have
to adapt or die in the new digital currency
space, but is it only banks that should be
worried?
Being programmable, Bitcoin and
other cryptocurrencies using blockchains
start playing in a very different financial
landscape. They can be programmed to
allow all kinds of economic activity, often
without a middleman, escrow agent or
any human arbritration of any kind. This
programmability, without having to trust
anyone, is impossible with current Fiat
currencies. In a digital age programmability
may become one of cryptocurrencies
important advantages.
Bitcoin has a very simple scripting
programming language, but other
cryptocurrencies are trying to deliver more
complex operations in secure blockchain
environments, validated by computers all
around the world. As developers attempt
to improve Bitcoin, a wave of innovation
has come, allowing anyone to deploy new
technology from their living room.
There is an avalanche of new
‘Bitcoin has been called many things – internet
money, digital gold, fast money; and, more
negatively, rat poison, a fraud and a Ponzi scheme.’
technologies with no gatekeepers to stop
it – just take Ethereum, the second largest
cryptocurrency by market capitalisation.
The underlying cryptographic signatures,
networking stack and scripting language
have all been upgraded to create virtual
machines and smart contracts – a
mechanism to incorporate these more
complex interactions with the same
underlying security guarantees from a
network of industrial scale miners.
FOCUS: BLOCKCHAIN
Trust
Trust is being eroded in the financial
industry. We have had a financial crisis, PPI
payments, Libor rigging, publically bailed-
out banks conducting financial terrorism
on SME UK businesses, low politician
ratings, numerous business hacks, banks
supporting cartels in money laundering,
banking legacy systems falling over or
system upgrade issues - the list goes on
and on. The Financial Crisis in 2008 has
done little to change things and many of
the same problems still exist. There are
still systemic risks in the property, credit
cards, student loans, stocks and pensions
markets. Banks have been asked to store
more reserves but with fractional reserve
lending they continue to print money and
balloon the money supply to debase our
current monetary system. Will we bail out
the banks a second time?
Bitcoin came out of the 2008 banking
crisis when people started to lose their
faith in banks managing their money.
Anarchists, libertarians and especially
Millenials have jumped on Bitcoin to disrupt
the traditional banking industry they
December 2018 ITNOW 09
don’t trust and used it as their revolution.
Millenials may never buy gold, bonds,
stocks and shares but digital money is
something that fits right into their lifestyle.
There is now competition in money
with Bitcoin being the best one around.
Digital currencies secured by blockchain
technology will gradually creep into our
lives more and more and people now
realise that Bitcoin is not a scam, a Ponzi
‘It’s not all rosy, however. With new technology
comes new hurdles and issues.’
scheme, or going to crash to zero. It’s real,
it works, it’s secure and it’s revolutionising
the next digital economy.
Centralisation vs. decentralisation
Today Web 2.0 includes Airbnb, Uber,
eBay, Amazon and Spotify, which we are
all familiar with and were unthinkable
before the internet was born. These
services make money by the value of
users’ personal data and actions. This
is subsequently data mined and sold on
to advertisers and marketeers as well
as feeding their internal AI systems.
Remember the adage: ‘If the service is
free – you are the product’. These majorly
centralised web platforms have a lot of
substantial problems - whether it be a
central place of failure or an authority
that can shut elements of the network
down if they wish. We are mostly happy in
the first world that access and freedom
of speech will be supported on such
platforms, but we are quickly learning that
10 ITNOW December 2018
the rest of world isn’t like that. Just take
the censorship of the internet in China as
an example. By decentralising the web we
can have
much more protection over our digital
rights globally.
Consider a decentralised Twitter. The
first problem we come across is where do
we store the tweets in a distributed, global
network where there isn’t one central
platform. For the decentralised economy
to grow we need decentralised server
storage for our decentralised services, a
decentralised identity, and to decentralise
access so that anyone can have access.
What we are talking about is a stack of
dependencies and applications that can
rest on top of a secure decentralised
blockchain layer. This is what the
Blockchain environment is like now, in
2018 – building out the decentralised
infrastructure that will run our future Web
3.0 applications that can never be shut
down and controlled.
P2P e-commerce, where consumers
and producers interact directly, is perhaps
the first use case of Bitcoin and crypto
in general. Crypto can be used as a
trustless method of exchange anywhere
in the world. Reputation networks and
community guidelines have made this
possible since the early days of Bitcoin and
are now starting to become much safer
via smart contracts that provide trustless
escrow. With Ethereum and their virtual
machine you are able to pragmatically
build far more complex systems, e.g. the
ability to collatorise a certain amount of
cryptographic assets in such a way that
it is provable in a smart contract. These
assets can then be traded for new assets
from a counterparty, based on the value of
the underlying cryptographic asset. This
can happen on a global scale and you don’t
even have to know who the counterparty
is because this collateral is verifiable and
if you default on the loan, the collateral can
programmatically be sent to the original
owner – a trustless peer-to-peer loan.
Issues and solutions
However, this is only the tip of the
iceberg. With programmable blockchains,
combining the power of a distributed
infrastructure with decentralised
governance and autonomous consensus
rules that enable trust between peers, we
achieve a completely new and ground-
breaking way to create and distribute
value. It’s not simply a currency or a way
to pay someone on the internet. There is
a lot more going on than just payments.
Value can indeed be created centrally e.g.
Facebook, but with a decentralised system
you can have a share of truly scarce
resources e.g. Art, property and knowledge.
Every protocol previously created didn’t
have the concept of digital scarcity. It’s
difficult to transfer an asset from one
person to another and prove that it has
completed successfully in digital form. Now
that you can, you can expect a swathe of
innovation in new behaviours based on this
provability of asset transfer, and increased
value. Once you can prove the provenance
of an asset on the decentralised network,
and where it originated, it becomes
much more valuable. Coded governance
structures can also be innovated where
participants vote to update the blockchain,
monetise identity and make illiquid assets,
like time, become liquid.
The traditional industries are finding it
very hard to compete with a decentralised
peer-to-peer network. There is no cost
structure on the other side – it’s just
a peer-to-peer network. Just like the
Bittorrent network, which has laid waste
to many industries including the video
industry, there were winners like Spotify
or the iTunes store. The previous Web 2.0
revolution was a challenge of interface –
moving from desktop computers to mobile
phones. Blockchains are part of the Web 3.0
revolution – the revolution of digital internet
money and assets. Businesses using
crypto as payments do not need a fraud
department, a disaster recovery process,
payments to third parties like Mastercard
and Visa or a large team of accountants.
Blockchain gives us a way of transacting
value globally in a far more public and
transparent way.
Issues
It’s not all rosy, however. With new
technology comes new hurdles and issues.
In the Blockchain space, due to the fact it
has originated outside of the usual financial
system, it can be incredibly difficult to
quantify, measure and control through
legacy financial models. Blockchain can
also be extremely complex to set up and
run within organisations whilst it is on the
path to maturity. One such complexity is the
scalability of Blockchain solutions. When
you run a computational activity from a
smart contract on a decentralised network,
you don’t want that activity happening on
the whole network and slowing it down.
The activity needs to be held centrally and
technologies such as sidechains, sharding
and the Lightning Network are being
developed to help achieve the scalability
we need for mass adoption.
We also have trade-offs in the
Blockchain space. Throughput vs. security
vs. decentralisation is a key discussion
amongst innovators – you can have two,
but not all three. Bitcoin is an example of
a blockchain that has increased security
and decentralisation at the expense
of throughput - when the network is
congested, higher transaction fees apply,
which is not a great customer experience.
EOS, the 5th largest cryptocurrency,
prioritises throughput over decentralisation
and security. Their 10,000s of transactions
per second could rival the established
players like Visa and Mastercard, but like
many other Blockchains, we will have
to wait a while for user adoption and
applications to be built on it. Currently,
user experience and adoption is lacking
throughout the cryptosphere. Using wallets
and apps are difficult, cumbersome and
have not yet improved on the status quo
we are used to. Usability is one area
that is calling out for resource and that’s
not the only one. Finding experienced
and proficient developers is becoming
increasingly difficult as more and more
innovation happens in this industry, mainly
from large consultancy companies who
can afford the resource. Anyone spending
time learning Solidity for smart contract
construction on Ethereum can expect a
wealth of opportunity in the future as more
and more Blockchain solutions use that
functionality.
Risk and reward
Buying, selling and investing in
cryptocurrencies also has its pitfalls.
Beyond speculation and rampant tribalism
for those holding specific currencies,
Blockchains can be slow and complicated.
ISO standards for Blockchain (ISO/TC 307)
have yet to be ratified and education in the
Blockchain space is only just starting to
gain momentum. Companies are starting
to wake up to the realisation they have to
understand this technology or find their
traditional business models dying. As more
and more businesses turn to Blockchain
for efficiency gains; education and
understanding in the Blockchain space is of
paramount importance.
But the market is slowly maturing,
with more and more use-cases and
infrastructure being built ready for mass
adoption. The disruption has started with
many new and traditional companies
already showing the way and proving some
of the promises of Blockchain:
• Overstock, the American online
retailer is currently processing up
to $120,000 of goods per week with
cryptocurrency. Their crypto team
does not have a fraud department,
consideration for disaster recovery
or a need to pay expensive third-
party licensing fees to Visa or
Mastercard. On top of that, the
number of accountants needed to
check transactions can be vastly
reduced or automated.
• Propy.com is already selling
property for Bitcoin with many other
projects looking at easing property
transfer, ownership charges and
registration.
• Hashed Health, in the US, is
encoding doctor’s credentials and
education on the blockchain, so
when they locum at a different
hospital, their details are checked
in minutes and not days. Putting
doctors in front of patients quicker
is just one example of how
blockchain can save lives.
• Also, in the medical space, is
Lancor Scientific, who use a
Blockchain solution to provide
trusted, verifyable and auditable
data around cancer diagnosis and
screening, vastly reducing costs and
democratising cancer screening.
• Zapaygo is a free smartphone and ensure transparency for all
application that links suppliers parties.
with customers so that they can
pre-order goods and services in ICOs and traditional investors
the sports, leisure and hospitality In 2017, the overall ICO market where
sectors, already signing the NEC in investment is used to finance projects
Birmingham to it’s stable. in the Blockchain space reached $5.4bn.
• SVKCrypto is a community-based, In 2018, it’s currently running at over
£50m fund supporting applications $15bn. ICOs and infrastructure projects
on the EOS platform. Each month in Blockchain are sucking in traditional
they see 200+ people attend their investments. Many people believe that
free event in London, usually once money enters the Blockchain space
discussing the future of Blockchains it rarely leaves – it’s where the smart
and finding great advocates to investment money is being placed.
present their experiences and view Hedge funds are clamouring to assign
of the future. a portion of their portfolio dedicated to
• FunFair is an online gambling and cryptocurrencies because they are a
casino game, built to be 100 per non-correlated asset – decoupled from
cent fair and transparent and using geographical economic impacts, political
Ethereum’s payment channels to persuasion or governmental regimes.
ensure scalability off-chain. Turkey, Venezuela, Columbia and Argentina
• Waltonchain, a Chinese Blockchain are all taking notice. Central banks are
project, is revolutionising the supply investigating their own digital currencies on
chain management industry with Blockchain to track every single transaction
IoT devices. Instead of customs or a to prevent terrorism, money laundering
dockyard employee only being able or continuing to control their populations.
to accept your consignment during One such example is the Venezuelan Petro,
working hours, IoT sensors will Maduro’s venture into the Blockchain
automatically update the Blockchain space, even if it’s untrusted by the rest of
with the location of your goods the industry and Venezuelans themselves.
December 2018 ITNOW 11
Pensions and sovereign wealth funds are
waiting for a robust custody solution before
assigning a portion of their portfolios to
cryptocurrencies – a multi-trillion dollar
industry. The traditional finance industry is
getting ready for the onslaught of trusted,
distributed and transparent Blockchain
technologies.
We’re in a fascinating time – this social
experiment called Bitcoin is creating
competition for the USD, Wall Street,
Silicon Valley and some of the other larger
entrenched interests in the world. What
we do know is that the Bitcoin blockchain
is a vast improvement over the current
settlement and remittance systems
that we have today, but this is only an
incremental efficiency update on current
systems. To fully appreciate Blockchain, we
have to look out of the windscreen rather
than the rearview mirror. The crypto-
native mindset is thinking about types of
applications that have never been imagined
before, which can now be delivered over
a secure decentralised network. There
are hundreds of business use cases for
this technology, mainly driven by market
efficiencies, e.g. companies that are taking
rent-seeking fees, or artificially liquid
markets. The business model of untrusted
intermediaries will be highly disrupted –
why will we need Ticketmaster or Stubhub
when artists can sell their merchandise
direct to customers without a trusted or
untrusted intermediary?
Facebook was natively enabled by the
internet - it never existed before it. What
future blockchain apps will natively use
blockchain in a way we’ve never seen
before? What business models will survive
and be able to cope with decentralised
apps which are global and unstoppable?
Incumbents will have to adapt their core
business model - they can’t just easily
create their own decentralised blockchain;
that would be like companies creating their
own internet. They will eventually have
to work WITH the decentralised economy
rather than against it and those that take
a pragmatic approach to this will be the
future winners. There are a thousand
reasons not to invest in a speculative
technology bubble and, with any new
technology, we don’t know all the answers.
But there is a lot of development and
infrastructure building happening to enable
this future – do not be fooled by your
scepticism of how useful the technology
could be.
Conclusion
Our Digital Society is here. Our youth are
growing up in this environment, immersed
in the world through their mobiles. In
China no one carries cash any more. If I
send digital flowers to my wife, I doubt
she would be impressed – but my friend’s
daughter would be bowled over receiving
a digital bouquet of flowers from her
boyfriend. As we move more into a digital
world, it makes sense to the younger
generation to own digital assets and to
have a digital savings account. The next
generation aren’t interested in buying
gold, stocks or shares – but they will buy
cryptocurrencies and support Blockchain
platforms. A teenager in a bedroom can
create a fair and open application on the
Blockchain and over time this will become
easier and more widespread. Anyone can
‘bootstrap’ their own digital assets on top
of the Ethereum network without needing
to have a pool of global miners securing
your blockchain. As this is open source
you can do this now for free. 100,000+
assets have currently been created on
top of the Ethereum blockchain. Some
have been fungible assets like currency,
but others are non-fungible assets
like a powerful digital sword, used in a
particular game to improve your battle
prowess. However, as this was created as
an asset on a decentralised blockchain
it is now transferrable between games
and applications. The global market for
purchasing in-game digital items in 2017
was around £100bn, and set to grow.
The League of Legends superbowl in
the Birdcage in Beijing brought in 88m
TV viewers, many more than any other
local sports event. Blockchains are really
harnessing the human capital in the world.
Society has been unorganised for
thousands of years before industry and
companies introduced people to economies
of scale in the pursuit of profit. Previous
to the industrial revolution, you could
mould your life around your interests
and aspirations. For the past 150 years
the industrial revolution has brought
a productivity model that drove large
corporations and the concept of a nation
state to protect that. Software is allowing
humans to be elevated back to that flexible
state where you can abstract yourself
from the old economic model and discuss
your interests in a new connected, yet
decentralised, economy with others who
share that interest. Previously it was a
job for life at one organisation - now it’s
working on a number of different initiatives
all at the same time
whilst being more in tune with
personal interests.
Blockchains could herald a new
decentralised, fair and anonymous global
economy – helping digital ecommerce,
not hindering it. With Bitcoin, financial
institutions can start to build a monetary
system based on savings, not debt, and it
could become the world’s reserve currency
and our solution to sound money. As a
new asset class, it will fluctuate wildly
until we get mass adoption, just as gold
did after the gold rush. What can’t be
underestimated is the amount of ongoing
development and infrastructure building
that is taking place – it’s only a matter
of time until consumers benefit from
globally distributed apps on top of secure
Blockchains. Blockchains are here to stay
and truly out of Pandora’s storage jar. They
will be highly disruptive to current markets
and are probably going to be worth far
more than the £230bn they are valued at
today - keeping in mind that both Apple
and Amazon are currently valued at $1tn.
Blockchain are the real deal for our future
decentralised digital economy and, even
though we are still in the innovative early
adoption phase, it’s far better than what
we have today.
Author biography
Anthony G. Parker (MBCS) is a certified IT
professional member of the BCS, Founder
and Blockchain Strategist at Cuberoot64
Ltd. Cuberoot64 takes complicated and
difficult concepts, breaking them down to
simplified terms to improve strategic focus
through relationships and technology. They
make technology understanding as simple
as 2 + 2.
Anthony is also Chair of the BCS
Berkshire Branch, holds an MBA from
Henley Business School and is a Freeman
of the Worshipful Company of Information
Technologists.
BITCOIN vs. GOLD & USD
AS A STORE OF WEALTH
From stone tablets to gold, mankind has
used money of many kinds throughout
our history. The adoption of one monetary
standard over another is not arbitrary
however – money needs to have some
unique properties for it to be classed as a
valuable. The properties of scarcity,
divisibility, fungability, durability and
recognisability can all be attributed to our
current store of value, Gold. But why is this
shiny metal so valuable?
Before humans, gold had zero intrinsic
value. Value becomes real when that
person has a reason or purpose to use
that item. Water has an intrinsic value but
only to a human that is thirsty. Intrinsic
value is the value we associate with an
item. Nothing has real intrinsic value
unless the majority agree it has - and this
is really a subjective viewpoint in the eyes
of the valuer. Gold was seen as valuable
because it couldn’t be debased or modified
by governments or politicians and could
be made into jewellery. Today we find gold
difficult to transport in large quantities,
expensive to produce and, potentially, at an
infinite supply.
With America owning most of the gold
after the great depression in 1939, most
other countries pegged their currencies
to the US Dollar and it has become the
global reserve currency we see today. In
1971, Nixon dropped the US Dollar from
the gold standard and most currencies are
now just promise notes from governments,
backed by guns and bombs. This is when
the US Dollar became what is known in
the financial industry as Fiat money –
distributed locally, government backed, but
not backed by a physical commodity like
gold. So, is the US Dollar a good store
of value?
Fiat currencies are created out of thin
air by banks and central banks with no
limit on supply and rarely with the whole
supply even being known. Call it currency
debasement, inflation or quantitive easing
- printing money enriches the printer
at the expense of the public who holds
the previous printed money. It is the
debt that runs our current economies
and we have accepted it that way for
years. Now, we are seeing troubles in
Zimbabwe and Venezuela when it comes
to hyper-inflation. Fiat also suffers from
durability – it only lasts as long as your
bank permits and even then, slowly
looses its value. Banks can destroy fiat
at the click of a button – ask a Cypriot, an
Argentinian or an Indian. Try to send an
international wire money transfer and you
have to do it during banking hours. Even if
successful, it will take five days with many
intermediaries adding your details to their
centralised systems. If you send a large
amount you will be censored. If you send
your hard earned money to your family in
Afghanistan, you will be stopped. In our
digital world, how is money transfer ever
going to compete with Bitcoin in a global
open marketplace?
With fiat currencies, you are dependent
on a third party for your wealth, which
is not an attribute of money many find
attractive. Requiring trust in politicians
seems a poor foundation on which to build
a prosperous society. The average lifespan
of fiat currencies is 50 years. The US
Dollar has lost 96 per cent of it’s value in
the 104 years since creation by the Federal
Reserve in a process called inflation or
currency debasement – how foolish do you
have to be to hold it over the next
100 years?
Bitcoin is in another class entirely.
It’s totally uncounterfeitable with it’s
blockchain security and is provably scarce
- I can tell you exactly how the supply of
Bitcoin will be in one week, one month
and one year from now. It is also highly
portable across borders with speed and
has no weight, smell or physical body.
It can be moved at distance, without
trusting a third party. It is the only money
that doesn’t require permission from an
overseer. Bitcoin cannot be debased, no
matter how many guns a government
wields, propaganda it spews or people
it imprisons. Lastly, and, perhaps, most
importantly, it has an attribute that will
become an essential part of sound money
– it’s programmable.
Either the innovation of owning your
own money, deciding how to spend/save
it and having a monetary policy based on
savings rather than debt has long-term
value or it doesn’t. If the global economy
wants a shot at ‘sound money’, the reality is
that Bitcoin can provide that. It was created
by someone we don’t know and achieved
the traction and security it needed when
nobody cared. It’s uncorrelated to the
traditional finance system, local economic
activity and it’s global. It’s also a-political
and based on maths rather than people.
Many believe that it’s a pretty good
invention and way better than the systems
we currently have - and it will become
more and more useful to people over time.
Erik Voorhees, a long-term proponent of
Bitcoin, and CEO of Shapeshift, believes
that Bitcoin is not just ‘sound money’ but
‘supremely sound money’. The Cypriots
didn’t realise they needed it until the bail-in
where people realised they didn’t own their
own money. Greece shut down ATMs with
many Grecians not being able to access
their cash. India made savings illegal and
removed higher denomination notes. Brexit
has already seen a 20 per cent reduction in
the purchasing power of the British Pound
and with a run on Northern Rock bank
back in 2007, even the British are seeing
the benefits of new globalised fast money
like Bitcoin.
Bitcoin’s intrinsic value is as an
unstoppable permanent record of
transactions on a secure payments
network – a very effective store of value
to rival the $7tn market of Gold. It has the
ability to send large payments all around
the world for minimal fees and is also
deflationary and programmable. That IS
the intrinsic value of Bitcoin and why many
think it could be the world’s new digital
store of value, even if the market has a
hard time of evaluating that value today.
 PROTECTING
MEDICAL RECORDS
Professor Mike Smith explains how and why he created his own species of blockchain to
ensure children’s mental health records are kept safe and trustworthy.
‘Technology was something I began
playing with as a boy,’ says Professor Mike
Smith, ‘I started tinkering and fixing TVs
after school and playing with amateur
radio. At 14, I worked all summer to
buy the parts to build a computer.’ The
machine in question was a 4-bit counter
with a rotary telephone dial for input and
#47 lightbulbs for output.
Image: Getty/nirat
These days, Smith is involved in
developing online psychiatric screening
systems, such as the SDQ (strengths
and difficulties questionnaire) and
DAWBA (development and well-being
assessments). Along with programming
the assessments, Smith is also deeply
doi:10.1093/itnow/bwy089 ©2018 The British Computer Society
involved in keeping the resultant data
secure. With the screening systems
focussing on children and their mental
health, Smith says, the data’s sensitivity
is profound. To keep the data safe and to
ensure it can’t be tampered with, Smith
designed a layered security system that, in
part, relies on blockchain.
Around the career houses
‘I’m not sure what my career is, or has
been,’ Smith says. ‘It’s been quite varied.’
As a professional, he never encountered
14 ITNOW December 2018
a computer until his late twenties.
Instead, when he started out in medicine
he was drafted into the military, passed
through geology, completed a PhD in
oceanography and then worked in the
oil industry. And it was during this phase
that Smith discovered computers and
computing. From there he eventually
landed a lectureship in computer science
at Reading.
‘In 1990, rather out of the blue, the
amazing Sir Brian Fender offered
me a joint professorship in computer
science and medicine combined with
an information directorship of North
Staffordshire NHS Health Authority,’ he
explains. ‘It was a fantastic time, a dream
come true.’
Greed is good
And where, or how, did blockchain come
into Smith’s life? ‘It was all to do with
reasons of greed,’ he admits. ‘I read
the first part of the Satoshi paper, the
kick-off paper. I read as much as I could
understand and attempted to invest in
bitcoin. I thought about mining them but
worked out that wasn’t going to work
financially.’
Mining, in Smith’s opinion, is fairly
obscene. ‘Purely and simply, it wastes
energy,’ he laments. ‘The principle is
to make it exceedingly hard to prevent
and control inflation. The problem is, the
process is entirely negative. The miners are
competing with each other. Basically, the
person willing to waste the most electricity
the fastest is likely to be the winner.’
So, he decided to invest. But, sadly, Smith
sent his first investment stake to Mt. Gox,
the week it collapsed and tumbled into
bankruptcy. Mt. Gox, for those unfamiliar
with the tale, was a website that exchanged
bitcoins for traditional currency. The site
rose to fame and fortune and then crashed
when it was the victim of an alleged theft.
Finding inspiration in a loss
Though Smith received his money back he,
Bitcoin and blockchain went their separate
ways and he returned his energies to his
mental health assessment project. ‘It’s
a psychiatric and diagnostic system,’ he
says, referring to SDQ and DAWBA. ‘I’ve
been working on the systems for getting
on for 20 years now. And the thing is, we
designed it to be secure from the start.
When we put it on the web, we didn’t put

it on the web and then make it secure. We
made is secure and then put it on the web.
That’s important.’
Though the project enjoyed success, it
received a challenge from a Scandinavian
data authority. A complaint had been
submitted, suggesting that the team had
been altering data after collection. ‘From
my perspective that’s a very serious
allegation,’ he recalls, clearly choosing his
words carefully. ‘I have a principle that
the original data should never be altered.
You can process it and you can make
derivatives, but you don’t alter the original
data. So, I was quite indignant.’
This indignation made Smith determined
to increase the project’s levels of security
and to put its data integrity beyond similar
accusation. ‘My mind turned back to
blockchain. I went back to the Satoshi
paper and swallowed the Kool-Aid! It’s a
fascinating paper. Quite brilliant. It’s both a
clear technical paper, but it’s at least fifty
per cent political. If you’ve not read it, you
should... Or at least as much as you can
before your brain expires!’.
Guided by the Satoshi paper he
initially implemented a blockchain
that concatenated a whole day’s worth
of database content. ‘At midnight we
‘There’s a lot of hype around blockchain.
The problem is people confuse blockchain
with Bitcoin.’
generated a hash,’ he explains, ‘and we
distributed it out to three computers from
where the Scandinavian data protection
authorities could monitor it.’ The theory
was, of course, that it would be very
difficult to alter the database’s contents
when three copies of the hash existed. ‘So,
they sat and watched this for a while and
they said: “yes, that looks okay. It looks like
you’re not altering the data and sorry for
the bother”.’
The whole experience convinced Smith
there was a need for a system, designed
specifically for healthcare, that went
beyond just storing data in a database. ‘If
data is stored on my database I can get at
it and indelibly alter it,’ he observes. ‘From
my perspective, that’s highly desirable
and easy to do. From your perspective, it’s
not desirable at all. You have to trust me.
Utterly. What I became interested in was
the idea of an independent proof-method
of data being stored and not altered. That
method was blockchain.’
Moving toward a solution
With the decision to investigate blockchain
established, he set about learning more
through developing his own implementa-
tion further. The experience taught him a
lot, he says, and he learned some valuable
lessons. ‘A lot of things in the paper weren’t
that feasible,’ he explains. ‘Peer-to-peer
communications, for example, is impos-
sible-ish without involving a third party to
swap IP addresses. In an environment of
minimum trust, which is what the paper
tries to address, peer-to-peer isn’t really
practical. Even those file-sharing services,
they’re not really peer-to-peer. They work
via a middle man.’ This might sound like
technical hair-splitting but, when the data
being shared is highly sensitive, relying on
an unknown intermediary to carry informa-
tion across a network isn’t an option.
‘It is practical to do peer-to-peer
communication across your own servers …
Servers where you know the IP address,’ he
explains. ‘Updating servers bidirectionally
is relatively easy too. The problem is, as
you increase the number of servers, the
complexity involved in updating them
increase more than exponentially.’
Smith began to feel disenchanted with
the Satoshi paper. For one thing, he recalls,
he wasn’t interested in developing and
implementing a currency. Rather he was
trying to implement a system designed
to keep healthcare data safe and to put
the data’s integrity beyond question or
contention.
‘There’s a lot of hype around blockchain,’
he states. ‘The problem is people confuse
blockchain with Bitcoin. People are trying to
store data on cryptocurrency blockchains.
This means you have to buy Bitcoins to
store your data and the amount of data
you can store is very small. You’re talking
BLOCKCHAIN
kilobytes. Worse still, the transaction time
on systems like Bitcoin is minutes. This
means it impractical for storing large
volumes of data at present.’
Personal data and a blockchain
This all led Smith to create his own
blockchain implementation focussed
purely on the business of storing data and
not, as with Bitcoin, storing wealth. But,
Smith’s system doesn’t actually store the
patient record in the blockchain. ‘I handle
enormous amounts of very sensitive
data… Data about children’s mental
health,’ he reveals. ‘You’d have to search
far and wide to find data that’s more
sensitive than that. But, we do not store
personally identifiable data.’ This means,
from a user’s perspective, which could
be a doctor, all they receive from Smith’s
project is a cryptographic hash or key. ‘It’s
the clinician’s job to make sure that the
key is correctly assigned. The problem is,
of course, humans don’t work well with
long numbers. Just think about telephone
numbers.’
This does mean, from a procedural
point of view, if the client wants to delete
a patient’s record all they need to do is
delete or throw away the hash. If that’s
destroyed, the patient data remains
inaccessible. It also means, of course,
Smith’s clients need to be careful with
how they store and protect their
cryptographic keys.
Summing up his whole system, Smith
says, he sees his blockchain as an aircraft
style black-box recorder. It’s the faithful
scribe that records information about
the integrity of the sensitive records. The
patient records aren’t themselves stored
in the blockchain, they are generally stored
elsewhere. ‘The blockchain proves that
the patient record is intact,’ he says, by
way of a summary. ‘And it proves that is
hasn’t been altered. The typical application
simply acts as a pointer to a record and
it says: “if that file is hashed to this value
then nobody has touched it since it was
stamped on the blockchain”’. But, he says,
it’s not enough to simply hash the file in
question once. These hashes need to be
distributed.
December 2018 ITNOW 15
 HOW BLOCKCHAIN IS
CHANGING INSURANCE
Martin Cooper MBCS RITTech talks with XL Catlin’s Hélène Stanway about how blockchain
will allow some types of risks to be priced in near real time.
Hélène Stanway is a digital leader at XL
Catlin, where her role involves identifying,
experimenting with and learning about
new technologies – technologies that may,
one day, enhance XL Catlin’s ability to
help its customers manage and mitigate
risk in new ways. Currently, she tells us,
she and her team are experimenting
Image: Getty/skynesher
with artificial intelligence, the internet of
things, augmented reality and, of course,
blockchain.
So, tell us about XL Catlin’s interest in
blockchain? Why are you eyeing the
technology and what problems will it
help you to solve?
The journey started, probably, 18 to
24 months ago when we did our first
doi:10.1093/itnow/bwy090 ©2018 The British Computer Society
experiments. We just made a blockchain
internally. We played all of the roles in an
insurance transaction. So, in a commercial
insurance transaction you have a client,
you have a broker and then you have us -
as an insurance company.
In today’s way of running an insurance
transaction, all three of these need to be
present. This means that you have a bunch
of information that the client provides. It’s
to do with their exposures - the assets
16 ITNOW December 2018
that they want to insure and the types of
coverage that they want to buy. That goes
to the broker. The broker will then go to
numerous carriers and negotiate the best
deal for that client. So, you’re already
getting a view of the information passing
from client to broker to carrier.
Now, the insurance industry spends
a lot of time reconciling the information
throughout the lifecycle of a transaction.
There are lots more data points too. That
all causes a lot of friction and it causes a
‘We wanted to try a blockchain and see if it
could solve the problem of friction and see if it
could reduce the time it takes for the
insurance transaction to happen.’
lot of delays. We wanted to try a blockchain
and see if it could solve the problem of
friction and see if it could reduce the time
it takes for the insurance transaction to
happen.
What’s interesting is, we didn’t do
this alone. We collaborated with clients
and with brokers to develop the idea
together. I think it’s also very important
to remember that we didn’t just say:
‘Right, this is the insurance transaction
today, let’s just stick a blockchain on it
and see what happens.’ Rather, we spent
time reimagining the processes. We said:
‘Okay, we know what blockchain does. We
definitely know how we operate today. How
can we reimagine our process based on
those very early learnings?’ It was really
interesting because we were able to use
that technology to actually take out some
of the slow process steps.
Specifically, we started off with a
register of assets for Maersk, the big
shipping company. We used their hulls as
the type of business that we wanted to
underwrite. Today we typically get fewer
than ten datapoints per vessel. From those
we work out the risks and then the prices.
What would those datapoints be then for

someone like Maersk?
For a hull it be would variables like the type
of vessel, the age, the tonnage, who owns
it, and that sort of thing. We put those in the
blockchain and we also put in some other
data feeds too. For example, sensor data
- IoT data from the hull. For the register
of assets in the blockchain, we went from
fewer than 10 datapoints to north of 30
datapoints. We want to increase this to 50
datapoints plus per vessel.
In the blockchain, Maersk’s data moved
immediately through the system - through
the nodes that we created with the broker
and ourselves and another carrier. We
could see that data in near real time. So,
‘The challenges to come are going to be how
different blockchains operate together, that’s
going to be really interesting.’
that old problem of the data moving slowly
from client to broker to us was gone. With
a blockchain we had that single source of
the truth.
How long would a traditional paper-based
transaction take?
It can take months of back and forth to get
to the right picture and to negotiate the
right price. There’s obviously no automation
in the process today.
Are there any applications or processes
that blockchain is naturally suited to?
Absolutely. Anything where there are
multiple people involved, and I don’t just
mean internally, I mean externally as well.
It’s useful where there are multiple people
involved and where you need to talk about
the same set of data. Data can be physical,
actual data points, but it can also be
documents. You can put documents in the
blockchain as well. So, anything where you
need to talk to multiple people.
I think blockchain really lends itself
well to complexity. Maersk is one of the
biggest companies in the world, it’s hugely
complex. Blockchain has made it a lot
simpler because they’ve now got a single
version of the truth.
What about smart contracts? What are
they? How do they work and why are they
so attractive?
Today, things are done in a very manual
way. But smart contracts enable you to
automate some of those processes. For
example, clients pay more premium if they
go into more risky areas around the world.
These are typically called war zones. These
areas are geo-fenced, or geo-located. Now,
because we’ve also got IoT sensor data
from the vessels, we know exactly where
they are. This means that when a vessel
approaches a warzone, and because you’ve
got this real time view of data, the captain
of that ship can make a decision: ‘Okay,
I know this area is more risky. But, am I
going to go into that area and pay more of
a premium?’
The ship would get stamped when it
went into the area and stamped when
it went out, so the premium could then
automatically get calculated. The captain of
the vessel could make a different decision:
‘Okay, I’m going to go around the war zone.
This may cost me more in fuel but may
ultimately be a slightly safer bet.’ And all
of that automation of the calculation of a
premium is all achieved through the smart
contract.
How important is interrogating,
reimagining and agreeing business
process before you begin a blockchain
project?
You absolutely need to have a good view of
your process but then I wouldn’t just say
you have to have it nailed down. You really
have to be open minded.
Blockchain is a young technology, do
BLOCKCHAIN
you think it’s too early within this
technology’s lifespan to predict whether
it’s going to be a disruptive force or not?
It seems like it’s a very long-term play?
I really see blockchain as a long-term play.
But I would say that it is going to have
huge applicability once people realise
exactly what it can do. And it’s going to be
really interesting once it disrupts the roles
that people play today and the tasks that
people have.
We’re talked about blockchain’s
good side. What about the bad. What
risks does it pose, or can it pose, for
businesses?
The challenges to come are going to
be how different blockchains operate
together, that’s going to be really
interesting. The bigger risk is the people
risk though. Do we have enough talent -
either in the computing industry or in the
insurance industry - to support the scale
and the speed at which people are going to
want to adopt this technology? I think the
bigger risk is that we don’t have enough
talent to be able to service the demand.
What kind of advice would you give to
businesses, or boards, looking to adopt
blockchain?
It’s really interesting because people think:
‘Oh my god, blockchain is really massive,
we can’t possibly tackle it.’ And actually,
that’s not true. You can just start small. It’s
just a question of finding that one
use-case.
About XL Catlin
XL Catlin is a global insurance
provider. Rather than focusing on
life’s more mundane concerns like
cars and cats, XL Catlin levels its
skills on protecting the owners of
planes, satellites and super tankers
from uncertainty. The firm also
specialises in insuring works of art.
December 2018 ITNOW 17
 BLOCKCHAIN
IN NIGERIA
Dr Isa Ali Ibrahim FBCS, Director General/Chief Executive Officer of the National
Information Technology Development Agency (NITDA), discusses the exploitation of
regulatory instruments to unlock blockchain’s potential in Nigeria.
Technological advancement has changed
the way we think, the way we live and
the way we socialise. Back in 1995, the
bursting of the dot-com bubble was a
figment of Bill Gates’ imagination when
he was present at a conference in which
Image: Getty/orighomisan
tech leaders highlighted the potential of
an emerging technology: the World Wide
Web. At the time, people could not do
much online; there was virtually no online
shopping, games or social media. However,
upon returning to Microsoft headquarters,
he dramatically shifted the company’s
strategy to focus more on the future
possibilities.
Dot-com hype, boom and bust have
come and gone. Early bird businesses
doi:10.1093/itnow/bwy091 ©2018 The British Computer Society
like Microsoft, IBM, HP, etc. who created
and captured values have reaped hugely.
Digital business is slowly replacing legacy
e-business while new technology trends
like blockchain, artificial intelligence (AI)
and internet of things (IoT), etc, have
emerged to drive digital transformation.
At the core of digital transformation is the
digital economy.
Distributed ledger technology (DLT)
can be described as a collection of
18 ITNOW December 2018
components which includes distributed
data storage, peer-to-peer networks, and
cryptography, focusing on the sharing of
data among the participating network
nodes (operational participants). DLT
consists of a series of networks of
databases that allow its members to
create, distribute and store information in
a secured and efficient manner.
This technology innovation has
the potential of transforming and
‘Blockchain, as one of the leading new
technology trends, has captured the interest of
leaders across industry as a promising
technology to leapfrog digital transformation.’
revolutionising the conventional payment,
clearing, and settlement transactions
in the financial sector and, at the same
time, change the way in which the record
keeping, storage and transfer of a digital
asset is carried out. The potential benefits
of DLT are expected to improve cost
reduction, end-to-end settlement speed,
ability to audit data and resilience in the
overall system.
Blockchain is usually managed and
distributed across peer-to-peer networks.
As it is in the form of a distributed ledger, it
can exist without any centralised authority,
or perhaps server managing it, and the
quality of its data can be adequately
maintained through computational trust
and database replication. A blockchain
is basically a list of records that grows
continuously. Moreover, the append-only
structure of blockchain only allows data to
be added to the database, thereby making
it impossible to alter or delete previously
entered data on any of the earlier blocks.
As such, blockchain technology is well-
suited for managing records, processing
transactions, tracing assets, recording
events and voting.
Blockchain technology is the foundation

for many cryptocurrencies such as bitcoins.
Cryptocurrencies are typically created
by private entities without the backing of
governments and transacted using digital
mediums (usually relying on a peer-to-peer
network of nodes, rather than a centralised
server).
Having been created as the technology
architecture for bitcoin in 2008, blockchain,
as one of the leading new technology
trends, has captured the interest of leaders
across industry as a promising technology
to leapfrog digital transformation. The
technology was invented with a desire
to disintermediate central authority,
create temper-proof record and build
trust relationships underpinned with
cryptography in a digital economy. It
produces a tamper-evident cryptographic
record that can include time and identity
information. Thus, it is a potentially useful
tool for transactions between businesses in
‘Nigeria cannot ignore this global development,
if the nation must fulfil her dream of becoming
one of the top 20 economies in the world.’
a digital economy.
Blockchain technology was pioneered
by cryptocurrencies such as bitcoin.
Bitcoin’s emergence on the scene, in
late 2017, and the ensuing frenzy across
the media has brought cryptocurrencies
into public mainstream and imagination.
Businesses, governments, economists, and
also enthusiasts, are now all looking for
ways to apply the blockchain technology to
other use cases. This frenzy has brought
regulatory authorities on their toes. The
blockchain, especially cryptocurrencies in
recent development, has raised concerns
over its legitimacy as a legal tender. This
has led to major bans on cryptocurrency
exchanges and trading in countries like
China, Russia and Thailand.
Blockchain technology certainly has
come to stay. It has the potential to shape
and disrupt a number of industries,
including banking, real estate, government
and digital business overall.
It may interest the reader to know that
blockchain technology remains immature
and, thus, risky. A lot of people’s money
is trapped in cryptocurrencies and initial
coin offering (ICO). More than 1690
cryptocurrencies currently exist in the
market, with a total value of over $290.7
Billion USD market capitalization, over
12,138 market platforms, according to
CoinMarketCap.
In addition, Gartner forecasts that the
business value generated by blockchain
will grow rapidly, reaching $176 billion
by 2025 and $3.1 trillion by 2030. IT
giants such as IBM, Cisco, Microsoft,
and established institutions such as MIT,
Government of Estonia and Republic of
Georgia have all started investing and
embracing the technology.
As the Chief Information Technology
Officer of Nigeria, I have identified IT
regulation as one of my strategic goals. Our
focus is on emerging technologies; we use
regulation as a major instrument to level
the playing field, incentivise innovation
and encourage home grown IT solutions.
We have started the groundbreaking
work to create new value chains around
emerging technologies. From forecasts and
projections by major technology pundits, it
appears likely that blockchain technology
will become significant in financial
transactions worldwide, including Nigeria.
Apart from being one of the major
underlying technologies enabling virtual
currencies, the blockchain technology has
the potential of enabling the consummation
of financial transactions using smart
contracts at a lower cost, improve overall
business efficiency and enhance record
keeping. Hence, Nigeria cannot ignore this
global development, if the nation must fulfil
her dream of becoming one of the top 20
economies in the world.
Efforts are being made by the Nigerian
government to provide frameworks,
guidelines, standards and regulations for
the adoption of blockchain technologies
in the country. This led to constitution
of an advisory forum in June 2017, with
members drawn from different relevant
BLOCKCHAIN
stakeholder agencies including financial
regulators and security agencies.
My agency, the National Information
Technology Development Agency (NITDA),
is chairing the research committee of the
forum.
Relevant agencies have issued
cautionary notes to the public and banks
to protect consumers while working
on regulatory policies and guidelines.
However, several opinions from private
businesses and professionals have
reinforced the fact that blockchain
technology, virtual currencies and digital
assets have come to stay in Nigeria
and globally. This has triggered active
participation of the Nigerian startups in the
new ecosystem and value chain created by
this technology.
With all these efforts, there are still
many myths and inflated expectations
surrounding blockchain technology in
the country. In view of this, NITDA has
commenced work on the development of
standards and guidelines for adopting the
technology generally in Nigeria. This is to
complement ongoing work by financial
regulators on how Nigeria can maximally
benefit from the use of cryptocurrencies
and digital assets.
References
1. Mills, David, Kathy Wang, Brendan
Malone, Anjana Ravi, Jeff Marquardt,
Clinton Chen, Anton Badev, Timothy
Brezinski, Linda Fahy, Kimberley
Liao, Vanessa Kargenian, Max
Ellithorpe, Wendy Ng, and Maria
Baird (2016). ‘Distributed ledger
technology in payments, clear-
ing, and settlement’, Finance and
Economics Discussion Series
2016-095. Washington: Board of
Governors of the Federal Reserve
System, https://doi.org/10.17016/
FEDS.2016.095
2. Gartner Trend Insight Report
3. Maverick Research
4. CoinMarketCap
December 2018 ITNOW 19
 THE BLOCKCHAIN
Malta is the first country is the first to regulate blockchain, ICOs and cryptocurrencies.
Colin German FBCS, CEO of Chetcuti Cauchi Advocates, gives a brief glimpse into the
exciting opportunities created in the blockchain Island.
Malta, a little island in the middle of the
Mediterranean Sea, is clearly punching
above its weight when it comes to
blockchain and cryptocurrencies. It is the
first country to enact laws that are aimed
Image: Getty/Leonid Andronov
at regulating the sector. While the words
regulation and blockchain in the same
sentence seem paradoxical, the Maltese
Government has taken a very innovative
approach to the concept of regulation.
Rather than tightly define and pigeonhole
technology and practices, the laws seek
to create a framework within which these
technologies can operate in order to
doi:10.1093/itnow/bwy092 ©2018 The British Computer Society
protect the investor and the consumer.
The whole objective of the legal
framework is to enable the setup and
operation of blockchain applications as
well as to provide a launch pad for initial
coin offerings (ICOs) of various types,
and other blockchain and cryptocurrency
services. The physical reality is that
while today we can speak of ICOs and
exchanges being set up, as well as other
known models, in the future we will start
dealing with new models that operators
will come up with in this innovative
space. By the time technologies become
20 ITNOW December 2018
ISLAND
embedded seamlessly in our everyday
lives, innovators and technology experts
would already be rushing to unleash the
next big thing. In truth, the regulator will
never actually catch up with the industry,
therefore, it was important to ensure that
laws were drafted in a way that will not
become obsolete within a few years, but
which cast a very wide net that captures
future innovations. Malta has taken a pro-
active approach in this respect and has set
up a legal framework within which future
innovative models can be accommodated.
The Malta Digital Innovation Authority
One of the enacted laws has set up
the Malta Digital Innovation Authority
(MDIA), a new authority which shall work
closely with the Malta Financial Services
Authority (MFSA) to ensure that blockchain
companies are assisted, enabled and
guided into setting up and operating from
a technical perspective. The MDIA has set
out a framework under which technical
administrators and systems auditors are
required to register.
Additionally, it will also require new
innovative technology arrangements
to get certified, which means that new
technologies operating on the blockchain,
smart contracts and related applications,
and any other technology that may crop
up in the future will be vetted. This system
ensures that the blockchain applications
being rolled out are set up and operated
according to defined rules and that they
continue to operate according to these
rules throughout their lifetime.
Initial coin offerings (ICOs)
ICOs are seen to be an easier, or more
practical, way of raising finance or funds
using blockchain technology and tokens.
If you want to launch an ICO, the legal
framework gives you guidelines and
tools in order to ensure that this is raised
correctly and in full adherence to the
relevant laws and regulations. There are
different types of ICOs, or rather, depending
on the token type, there is a different
process that an ICO launch needs to follow
in order to ensure full customer and
investor protection.
The first aspect to consider when
launching an ICO is to fully understand the
business model of the ICO. This involves a

clear understanding of what the business
is, what it seeks to achieve, why it aims to
raise funds and what features and benefits
shall be attached to the token. These facts
will be the building blocks that allow us
to determine whether the token will be
a virtual token (utility token), a financial
instrument (security token) or a virtual
financial asset (a cryptocurrency).
To pinpoint the nature of the token,
the regulator has come up with a
financial instruments test (FIT). After a
determination has been attained from the
test, an issuer will be able to understand
which law shall regulate the token, if any.
The processes, in this respect, vary in
complexity and effort, depending on the
law regulating the token.
Virtual tokens (utility tokens)
A virtual token is a store of value that
has no value or use outside the platform
on which it is created, and it may only be
redeemed for some form of value on this
same platform. An example of a virtual
token is a game token in an online game
where you can use the token to play the
game or buy powers on the actual game
platform, however these tokens would have
no use outside this platform. These tokens
are not exchangeable on public exchanges
and they cannot be traded.
Virtual tokens do not represent any form
of security on the issued platform and
they do not give the holder any financial
or pay-out benefits, like a distribution of
profits. They are, however, simply a store
of value that is able to be used on a limited
platform. These tokens are exempt from
regulation; however, it is our understanding
that the regulator is set to issue guidelines
with respect to their treatment in
the future.
Security tokens
Investors are generally wary of ICOs
because a large majority of such offerings
have been exposed as fraudulent. Hence
issuers seeking to grant a more concrete
right to their investors will generally opt
for a security token offering, which is more
heavily regulated under securities law,
but which gives more peace of mind to
investors. Security tokens will generally
grant a right to passive income or are
linked to the performance of an underlying
security. For example, a token can be
translated into shares of a company, it can
pay out returns tied to the performance of
a company or project, or its value could be
tied to the future price of a commodity like
gold. In these cases, the token is essentially
a Financial instrument.
There is already a body of law governing
the handling of financial instruments and
in this case, such an ICO is required to be
set up according to these laws, mainly the
Markets in Financial Instruments Directive
(MiFID). Holding such a token gives the
holder rights in the form of ownership or
participation in the success of a venture
or business. This also makes the tokens
tradeable on third party exchanges which
gives rise to a transactional economy
based on this token.
Virtual financial assets (VFAs)
When an issuer seeks to issue a token
with the features of a cryptocurrency, such
a token will be considered as a virtual
financial asset (VFA) under the Maltese
legal framework. Essentially, a VFA or a
cryptocurrency will not be treated as a
traditional currency, but rather, it will be
treated as a tradable store of value that
can be exchanged between holders and
treated almost similarly to cash in order
to acquire goods or services. Nonetheless,
few would consider cryptocurrencies
as proper instruments of payments
due to the volatility in the price of most
cryptocurrencies whose value is not
pegged to an asset with an ascertainable
value such as the dollar or even a
commodity such as gold.
The issuer of a VFA shall need to draft a
whitepaper with the information required
at law. A whitepaper is a document
detailing the project that the ICO shall
launch, the credentials of the company
issuing the ICO and of the promoters of the
project, it sets out clear definitions of the
aim behind the issuing of the token, and all
relevant information on the business and
flow of funds. Essentially, the whitepaper
should give the prospective investor a
thorough overview of where they shall be
putting money and what, if any, protection
BLOCKCHAIN
is available.
The last few years has seen a rise in
the number of crypto currencies. While
the most spoken about cryptocurrency
is Bitcoin possibly followed by Ethereum,
thousands of crypto currencies have been
created with many failing in the short-
term. However, with a significant number
of them being still around today, and even
developing further at this very moment,
one can only imagine that the popularity
of cryptocurrencies will only grow as
decentralisation takes the business world
by storm.
VFA exchanges
ICOs merely represent the first launch
of tokens into the system. Issuers of
tokens which are tradable will often
seek a secondary market which is where
cryptocurrency exchanges come into play.
The Maltese legal framework has sought
to regulate these exchanges to ensure
that they have set the proper safeguards
to maintain full investor protection at all
times.
Exchanges are platforms through which
a user can purchase and exchange crypto
currencies. The model can be further
extended to include the exchange of fiat
currency (our conventional currencies like
GBP, EUR…) to crypto currencies and vice
versa. The model can also be adapted
to include the trading of security tokens,
however, a separate license shall be
required due to the fact that such tokens
are regulated under EU law.
Looking ahead…
The new legal framework in Malta, as well
as the favourable operating conditions of
the jurisdiction, have created a great buzz
on the island in this space. ICOs are being
launched, exchanges set up and there
are constant blockchain conferences and
workshops feeding ideas and pushing
innovation. All of this is done in the spirit
of encouraging growth and innovation
within the guidelines of the law without
over-regulating. These are truly exciting
times for the crypto and blockchain world
and truly exciting times for the blockchain
island.
December 2018 ITNOW 21
 BLOCKCHAIN:
BEWARE OF THE
CRYPTO-HYPE
Dr Stephen Castell explains why IT professionals need to watch out for crypto-hype and
be alert to the problems ahead.
There is currently a crypto-algorithmic
blockchain technology mania. Huge
amounts of money, commentary, thought,
ink and new paper column inches are
being lavished on blockchain based
technologies such as cryptocurrencies,
smart contracts and distributed ledgers. It
Image: Getty/South_agency
seems almost every millennial is involved
with an initial coin offering (ICO) or initial
token offering (ITO). A few of these may
prove to be commercially successful. They
may establish a new crypto-economic
paradigm. I wish these crypto-enthusiast
millennials well. Indeed, I have dubbed
crypto the millennials’ rock’n’roll.
doi:10.1093/itnow/bwy093 ©2018 The British Computer Society
I, myself, suggested just such a new,
disintermediated wholly digital cash
currency, in a letter published in Computing
magazine, July 1995: ‘… As cyber trading
grows, the new, powerful common
electronic trading currency will be ‘owned’
by no single physical nation state, central
bank institution, economic or political
grouping. We could … call it the ECU…, …
the Electronic Cash Unit.’
Returning to now, most agree that, in
order to protect consumers and investors,
this new blockchain-based digital
economy is in need of some regulation.
22 ITNOW December 2018
The Delta Summit was held in Malta
in early October 2018. In front of 4,000
attendees, Dr Joseph Muscat, Malta’s
Prime Minister, announced three new acts
positioning his EU island as a leader in
regulating blockchain applications, ICOs,
cryptocurrency trading and, more widely,
digital innovation. These acts were
• Malta Digital Innovation Authority Act
(MDIA Act)
• Innovative Technology Arrangements
and Services Act (ITAS Act)
• Virtual Financial Assets Act (VFA Act).
Blockchain: Sceptical IT professionalism
and legal due diligence
Experienced IT experts should, however,
be cautious about crypto-economics hype.
There are no finalised standards yet for
blockchain (eight are in development
under ISO/TC 307). It should also be
remembered that there is far more to
specifying, designing, developing, testing,
deploying and maintaining an appropriate
complete QA-assured system than just the
blockchain element.
It’s also essential to evaluate whether
blockchain is the right component for a
given business or system requirement. A
diligent IT systems engineer may conclude
that many things can be achieved just as
effectively by other means.
Notwithstanding Malta’s regulatory
initiative, the legal status of cryptocurrency,
smart contract and distributed ledger
technology is also generally neither
clear nor settled. In the USA, there is
already ICO litigation on foot. Having
been involved in advising on ICOs, I have
encountered significant tensions between
the crypto-enthusiastic, blockchain
technical specialist, and the sober
business development objectives of, and
the professional due diligence to be done
for, the ICO-issuing company owner or
executive.
The right to be forgotten
Furthermore, the ‘right to be forgotten’
could become a significant barrier to the
ubiquitous introduction of blockchain
software and technology. The General Data
Protection Regulation (GDPR), in force
from May 25, 2018, includes Article 17:
‘Right to erasure (‘right to be forgotten’)’
... (e) the personal data have to be erased
for compliance with a legal obligation in
Union or Member State law to which the

controller is subject. (http://www.privacy-
regulation.eu/en/article-17-right-to-
erasure-’right-to-be-forgotten’-GDPR.
htm)
With the ‘permanence and immutability’
of its written data records, blockchain is
potentially unable to be compliant with
the GDPR right to erasure. The meaning of
‘erasure’ in English is strong: eradication,
obliteration, or destruction. Simply ‘putting
data beyond use’ is unlikely to satisfy
the GDPR for data privacy. Setting record
delete flags, ‘losing’ cryptographic keys,
or overwriting hash tables may not be
sufficient to qualify as erasure.
If Article 17 sought to provide only
for ‘putting data beyond use’ its drafters
would surely have said so. There are
established legal precedents and court
orders on data records, recording media
and destruction (and certification thereof).
There are also corporate, industry and
professional standards as regards record
retention and destruction, and statutes
providing requirements and guidelines for
public bodies as regards citizens’ records
disposal.
Until recently, widespread use of
requests by applicant data subjects to be
forgotten may have seemed fanciful. But,
since the Cambridge Analytica allegations,
anyone using social media is now well
aware of the right not to have personal
data used for purposes for which they
were not originally, and freely, provided.
For those unaware of the Cambridge
Analytica story, it was claimed that
this data analytics firm used personal
information harvested from more than
fifty million Facebook profiles - without
the data subjects’ permission - to build a
system that could target US voters with
personalised political advertisements
based on their psychological profile.
Even before GDPR, though, the English
courts had already upheld such a critical
request. Specifically, Google lost a
landmark ‘right to be forgotten’ case when
a businessman took legal action to force
removal of search results about his past
convictions.
Future issues
The future issues that IT systems
professionals may be asked to investigate
and analyse, and upon which to provide
analyses are likely to be varied. Below is a
list of possible topics.
Cryptocurrency ICOs/ITOs, trading and
exchanges
• Allegations of false or negligent
representations in white papers.
• Failure to carry out due diligence as
to project viability, systems integrity,
quality standards, financial probity
and implementation rigour. For
example, under the Malta ITAS Act,
registered systems auditors provide
assessment and opinion in regard
to the ‘certification of innovative
technological arrangements’. Their
workings are likely to be open to
independent expert investigation in the
event of disputes
• Consequential losses: money lost,
businesses going bust, causality.
Blockchain
• Operational systems failures: the
blockchain may be robust and reliable,
but interconnected systems need
to be specified, designed, coded,
constructed, tested and commissioned
to IT industry and professional
standards.
• Consequences: assessment of
outages, unreliability of service, data
failures or faults, data going missing;
unable to conduct reliable business,
smart contracts corrupted, distributed
ledgers not capable of being trusted.
• Apportionment of causality and
liability for damages, losses and
compensation.
Blockchain and GDPR Article 17:
• Requests ‘to be forgotten’ by data
subjects: where personally identifiable
data are held on ‘permanent and
immutable’ blockchain records, advice
and management of implementation
of court orders granted for ‘erasure’.
• Efficacy of proposed/implemented
erasure techniques, transactions and
processes.
• Verification of the erasure carried
out: proof of correctness and
completeness.
• Assistance with regards to the
validity of requests ‘to be forgotten’;
confirmation of the reliability and
BLOCKCHAIN
security of erasure carried out;
reasonableness of any possible/
proposed fines or penalties imposed.
Ownership of IP:
• Whether relying on third-party
blockchain platforms, or developing
in-house blockchain software, anyone
seeking to build blockchain-based
applications runs the risk of IP
infringement (there are as yet no ISO
standards, and already more than 650
blockchain patent applications filed
with the US Patent Office).
• Assessment of impact, consequences,
remediation: e.g. litigation over patents
and software copyright.
• Expert investigation, search and
advice with regards to Prior Art, and/
or Lack of Inventive Step, for patent
infringement actions and challenges to
the original Grant of Patent.
• Advice and guidance in connection
with negotiations with patent or
copyright owners over use restrictions,
licence fees, and development
capability.
I have been involved as expert witness in
some of the largest contractual disputes
over computer software and systems
failures to reach court, with damages
claimed in the hundreds of millions of
pounds. Nearly twenty years ago, in the
USA Foxmeyer case, the failure of an
entire substantial multi-billion corporation
was due to the faulty implementation and
management of a major company-wide
computer systems upgrade project.
Clearly, whether as disastrous as those
or not, blockchain systems and software
failures, disputes and litigation could
also become an equally active area for IT
experts.
About the author
Dr Stephen Castell CITP MEWI is Chairman
of CASTELL Consulting, and is an award-
winning independent IT expert, manage-
ment consultant and project manager pro-
fessional, with extensive experience in risk
assessment, quality assurance and dispute
resolution.
December 2018 ITNOW 23
 BLOCKCHAIN
TRANSACTION
AND
REGULATION
Distributed ledger technology (DLT) is on the rise. With this in mind, Steven De Lara and
Colin Grech, both from Signature Litigation, ask what exactly does DLT do, and where
does the law stand in relation to it?
A distributed ledger is a database that can
be shared across a network of multiple
participants and updated by accessing
it from any location - securely and
efficiently. DLT has recently come to public
prominence because it underpins a range
of digital currencies, the best known of
Image: Getty/vladans
which is Bitcoin. Although Bitcoin is the
most prominent example, the potential
applications of DLT extend far beyond
virtual currencies.
Ultimately, DLT could fundamentally
change the financial sector, making it
‘more efficient, resilient and reliable’,
doi:10.1093/itnow/bwy094 ©2018 The British Computer Society
according to the World Bank, adding in its
recent report that it has ‘the potential to
transform various other sectors as well,
like manufacturing, government financial
management systems and clean energy’1.
For advocates of DLT, such a prestigious
endorsement is welcome news. But
there is an additional caveat: ‘Since
this technology is still nascent, the
World Bank Group doesn’t have general
recommendations about its use for
international development.’ To understand
how DLT can address challenges in the
financial sector, the bank explains, requires
24 ITNOW December 2018
both research and real-life applications
and pilots. It also requires resolving
consumer protection issues, financial
integrity concerns, speed of transactions,
environmental footprint, legal, regulatory
and technological issues that arise with
the advent of new technology.
It is, therefore, still early days for DLT
and a range of wider applications for
blockchain technology. In May, the research
‘From a legal perspective, regulation is the key
issue – or rather, the widespread lack of it.’
company Gartner found that only one per
cent of chief information officers (CIOs)
had yet indicated any kind of blockchain
adoption within their organisations, while
only eight per cent of CIOs were in the
short-term planning or looking at an active
experimentation phase.
Perhaps as a result of the uncertainty
surrounding applied DLT, there was
no surprise at the widespread media
coverage on the recent warning given to
the Marshall Islands by the International
Monetary Fund (IMF) - not to adopt a digital
currency called Sovereign as an additional
form of legal tender. IMF directors stated
that the potential benefits of Sovereign
were much smaller than the potential costs
of ‘economic, reputational and governance
risks’.
From a legal perspective, regulation is
the key issue – or rather, the widespread
lack of it. In making sure that the law keeps
pace with technology, Gibraltar has helped
to lead the way in recognising that DLT is
not going to disappear any time soon and
in realising, at the same time, the necessity
for regulation within this embryonic ‘free
market’ industry.
On 1 January 2018, the Gibraltar
Financial Services Commission (GFSC)
became the first regulator to introduce
a framework that regulates the use of
DLT. By providing a strong degree of
regulatory certainty, Gibraltar hopes to
deliver a competitive edge and attract
firms involved in DLT activities to develop

new and innovative fintech businesses.
Because DLT is evolving rapidly, the GFSC’s
regulatory framework for DLT Providers
is intentionally designed to be flexible.
Google the term ‘DLT technology regulation’
and most of the top ranked results refer
to Gibraltar - a measure of how far it
is in front of the pack as a DLT friendly
jurisdiction.
But DLT has not yet become the
subject of either UK or EU regulation. In
April 2017 the FCA published Discussion
Paper DP17/3 to start a dialogue on the
potential for future development of DLT.
The feedback suggested that the FCA’s
current rules were flexible enough to
accommodate applications of various
technologies, including the use of DLT
by regulated firms. Last December, the
FCA published a statement on DLT which
concluded: ‘Many respondents suggested
that DLT solutions could deliver regulatory
requirements more efficiently than current
systems, substantially reducing costs for
firms and regulators alike.
It continued: ‘However, some
respondents doubted the compatibility of
permissionless networks (permissionless
networks allow general public visibility
‘Arguably, EU-wide regulation concerning DLT
transactions is what really matters most.’
of transactions online and are open for
broad participation whilst permissioned
networks typically feature a ‘gatekeeper’
who controls access) with our regulatory
regime2. Based on the feedback, and on
its own work, overall the FCA is open to
all forms of deployment of DLT (including
both permissioned and permissionless DLT
networks) provided the operational risks
are properly identified and mitigated.’ The
FCA also noted its commitment to keep the
position under review and to maintain an
open dialogue with interested parties3.
Arguably, EU-wide regulation concerning
DLT transactions is what really matters
most. The European Securities and Markets
Authority (ESMA) published a report on DLT
in February relating to securities markets.
This examined the need for regulation to
facilitate the benefits of DLT and to mitigate
against its risks. The report’s findings were
similar to those of the FCA. There are no
major impediments created by the EU’s
current regulatory framework that inhibit
the development of DLT, and any regulatory
response at this stage would therefore be
premature.
However, as a new financial product,
whether some blockchain transactions
are likely to be caught in the net of MIDFID
II (The Markets in Financial Instruments
Directive) remains to be determined. Its
introduction by the EU, applicable from 3
January 2018, is designed to strengthen
investor protection, and reduce the
risks of a disorderly market or systemic
risk whilst increasing the efficiency of
financial markets. Alongside the 50,000
new regulations already added across the
G20 since the Lehman crisis happened a
decade ago, the MiFID II regulations alone
adds a further 1.5m paragraphs.
Gibraltar is a dualist country - a treaty
ratified by the government does not alter
its laws unless and until it is incorporated
into national law by legislation. In common
with other governments in the EU, Gibraltar
transposed the MIFID II directive into its
local legislation through the Financial
Services (Markets in Financial Instruments)
Act 2018. In practice, this means that if
any digital ledger applications and models
could be regulated, in Gibraltar they would
fall under the authority of the GFSC. The
determination hinges on the question
of what products are being offered on
these platforms and whether they can be
categorised as financial instruments under
MIFID II, if at all.
Beyond the new MIFID II regulations,
there is a distinct lack of jurisprudence
on DLT which makes it a grey area that
BLOCKCHAIN
is particularly fertile for litigation. Some
European countries are competing to
attract the most promising potential
innovators. Cyprus is among them.
In August, the Cyprus Securities and
Exchange Commission (CSEC) launched a
new Innovation Hub using DLT. This means
that there will also be potential competition
in how regulations are applied.
The CSEC development serves to
highlight some of the discrepancies
between DLT regulation and MIFID II across
different EU jurisdictions: the FCA has
declared that DLT could fall under MIFID,
but the Cyprus government disagrees with
the English position. Meanwhile, other
jurisdictions are considering their own DLT
regulations, including Malta, France and
Austria.
In determining whether DLT falls under
MIFID II, the key considerations include:
the scope of the directive and investigating
which transactions could be monitored
and caught by MIFID II. If either a state
or a regulator were to decide that DLT
transactions fall under MIFID II, then
the potential for litigation will increase
drastically as licensees test the scope
of the institution’s jurisdiction over their
affairs.
As more widespread use of DLT
continues to develop, so inevitably
will the regulations underpinning it. In
the meantime, as jurisdictions begin
to compete with different regulations,
litigation will become an inevitable
bi-product.
References
1. Worldbank.org - Distributed ledger
technology and Blockchain Fintech
notes
https://bit.ly/2Ew6IpH
2. https://www.fca.org.uk/publication/
feedback/fs17-04.pdf
3. https://www.fca.org.uk/news/press-
releases/fca-publishes-feedback-
statement-distributed-ledger-
technology
December 2018 ITNOW 25
 BIOLOGICAL
IMPROVEMENT
AT A PRICE
Ian Fish FBCS, Chair of the Information Security Specialist Group, takes a look into the not
too distant future to share his thoughts on the risks associated with nanotechnology in
the field of medicine.
When I originally started thinking about
this edition’s introductory piece I was told
that the theme was to be mobile security.
That has now morphed into something
more general, but while I was musing
on an angle I thought of looking into the
future (perhaps not too distant) of the
ultimate in mobile computing – I started to
think about the burgeoning field of medical
nanotechnology.
Much nanomedicine is about the use
of inert nano-scale particles (or groups
of particles) to perform such functions as
highlighting cancer cells very early and
acting as indicators for such technologies
as MRI scans.
Image: getty/gorodenkoff
Of more interest from a cyber security
viewpoint are pharmaceutical nano-
devices to perform functions such as
Security highlights:
doi:10.1093/itnow/bwy095 ©2018 The British Computer Society
p28-29: John Mitchell
FBCStlooks at what makes a hack
a significant one and revisits
some historical attacks.
26 ITNOW December 2018
highly targeted drug delivery. Eventually
the aim of nano medicine is, to quote
one academic paper on the subject, ‘to
monitor, control, construct, repair, defend,
and improve human biological systems at
the molecular level, with the help of nano
devices and nanostructures that operate
massively in parallel at the unit cell level,
in order to achieve medical benefit’. It
is anticipated that these devices will
be programmable at some level and of
course they are electronic devices and so
will be hackable.
In particular, it will be necessary, in
many cases, to provide control for the
actions of the nano-devices from outside
the body and this immediately has the
potential to introduce a very tempting
attack vector.
p42-43: Dr Tom McCallum
considers how best to protect
your company from malicious
and poor-quality code.
As this technology moves from research
facilities in academia into mainstream use
it will be subject to the same pressures
as we have witnessed in computing over
the last 25 years plus and, therefore, the
risk is very strong that security will take a
back seat. The growth of the IoT has shown
the potential for insecurity in computing
devices to have harmful physical effects
but just think how much worse this will be
for implanted nano-devices.
How many years will it be before there
is a death from a hack that, for example,
causes a nano-robot to release too much
adrenaline and cause atrial fibrillation
leading to a heart attack?
The potential for extortion and persons
being forced to do the bidding of criminals
or terrorists will be very high.
p44-45: Detective
Superintendent Andrew Gould
talks about the threat landscape
and the police response.
 THE BIGGEST HACKS
AND
WHAT THEY CAN TEACH US
John Mitchell FBCS debates what makes a particular hack a significant one and revisits
some noteworthy historical attacks.
When it comes to breaking news about
cyber attacks, many reporters concentrate
on the financial aspects, but I consider
that the most important thing is loss of
trust. Loss of trust in data processing itself.
Perhaps it would be possible to evaluate
several hacks to derive a formula to
measure their significance?
When I was researching for my
doctorate in risk management, I once
created a twenty-seven-element formula
to calculate the significance of a risk. The
only problem was that I only had hard
data for four of those elements, the rest
Image: getty/gorodenkoff
being guestimates, which bought a severe
element of doubt to the result. Could it be
trusted? With hacking, we have the same
problem. How accurate are the numbers?
Tabloid journalism may be important
in alerting the public to a breach, with
headlines along the lines of the ‘biggest
hack so far’, but is such loose language
helpful in measuring actual impact?
doi:10.1093/itnow/bwy096 ©2018 The British Computer Society
In the beginning
The story of electronic hacking begins
almost with the dawn of the electronic age,
when, in 1903, Nevil Maskelyne disrupted
a public demonstration of Marconi’s
purportedly secure wireless telegraphy
technology by sending insulting Morse
code messages through the auditorium’s
projector. What has this to do with today’s
computing? Well, if you cannot trust the
information you receive from a system,
28 ITNOW December 2018
then what reliance can you place in the
system? So, perhaps one of the most
important elements in assessing the
significance of a hack is to determine its
impact on trust.
If I can hack fifty million access
credentials and effectively become those
people, then trust in anything received
from those people is diluted. Conversely,
those people will have reduced trust in
the institution which allowed their data
to be compromised. A word of caution.
Volume is not everything and relatively
small hacks may have a significant impact
on subsequent trust. Anything which
undermines trust in IT is likely to be bad
for society.
Different hacks – Same outcome?
Hacks are emerging as one of the most
significant risks facing all enterprises, but
there are some who seem to be repeat
offenders, mainly because of their visibility.
These customer-facing companies receive
more attention than companies in other
sectors, such as mining, manufacturers
and logistics, where the damage to their
reputations among consumers and
subsequent loss of trust, is unlikely to be
as severe. Perhaps this also needs to be
built into any equation?
The email that arrived in 382,000 BA
customers’ email inboxes in the early
hours of 7 September 2018 served up the
usual platitudes from companies which
have been hacked. ‘We take the protection
of your personal information very seriously.
Please accept our deepest apologies for
the worry and inconvenience that this
criminal activity has caused.’ This data
breach was significant. not so much by
the number of customers affected, but the
potential value of the data stolen. Complete
credit card information, including security
codes and associated bank account details,
together with enough other information to
fool the security checks of other accounts.
BA put the onus on the affected customers
to contact their financial services
providers.
Also, although BA contacted the
impacted customers, they did not send a
reassurance message to those who had
not been compromised, leaving millions of
customers wondering whether their data
had been stolen, but they had missed any
subsequent warning message. Not the
way to restore trust in your operations and
the company is also facing a £500 million
group action lawsuit. The airline may
also receive a fine of up to £897million if
regulators find that it has been in breach of
GDPR where penalties for serious failings
are capped at the greater of four per cent
of global turnover, or €20 million. So,
another couple of elements to be added to
any hacking equation?
A different kind of hack, Wannacry,
stole nothing, but demanded money with
menaces, along the lines of ‘we have

encrypted your data and if you want to
get it back, then pay us’. This showed that
a denial of data attack could be more
damaging than a straight-forward denial of
service attack, but the result is the same.
Loss of trust in data processing.
Small, but perfectly formed
In the 1990s a legitimate hacking group
within the US military took control of
a warship’s weapons’ control systems
and were able to control the targeting
of its weapons. The same group then
manipulated the flight programme of a
fighter squadron. They were able to direct
the fighters to a non-existent refuelling
tanker which showed their ability to
‘splash’ a squadron of aircraft without
firing a shot, or even being in the vicinity. A
new form of warfare, cyber-warfare, had
been created.
In 2016 hackers took control of the
engine management system of a Jeep and
proved that they could drive it off the road.
This single hack has cast doubts on trust
that can be placed in driverless cars.
The Bangladesh central bank hack
only involved 35 transactions and yet the
perpetrators took just over $100 million
and it could have been as much as $1
billion, but for a simple spelling error.
These hacks did not involve large
numbers of transactions, but along with the
Stuxnet hack, the potential consequences
are so huge as to put them high on the
list of significant hacks. From a learning
perspective it becomes obvious that sheer
volume is not necessarily the thing that
makes a hack significant. Also, these
hacks were external, but what about the
threat from inside the organisation, or
from trusted partners? I will deal with this
aspect later.
Cyber warfare hacks
Nation states are probing for weaknesses
in their opponent’s national infrastructure
as part of an undeclared cyber war. In
2013 it was widely reported that the British
secret service has tapped into at least 14
undersea cables passing through Cyprus
using passive optical splitters which
enabled GCHQ to daily intercept tens of
millions of e-mails, SMS messages and
phone calls. This hack is significant on a
pure volume basis alone, but even more
so when one considers the range of data
intercepted and the use to which it can be
put.
On the other side, the Russian GRU has
been linked to a series of cyber-attacks
around the world. The United States
charged 12 GRU agents with involvement
in the hacking of Democratic Party National
Committee emails before the 2016
presidential election. This may have been a
relatively small hack on a volume basis, but
the subsequent leaking of selected emails
badly damaged Hilary Clinton’s attempt
to become President of the USA, so on an
impact basis this hack was monumental.
Recent reports indicate that the
Moscow’s GRU spy network has also
conducted a series of attacks on the UK’s
energy networks, telecommunication
systems and media groups. Last year the
boss of the National Cyber Security Centre
(NCSC), revealed that since his organisation
was established in October 2016, it had
seen Russia repeatedly target vital British
infrastructure. Staff at the NCSC had
responded to more than 600 ‘significant
incidents’ between 2016 and 2017.
Trusted parties
Genuine errors made by insiders, such
as clicking on dangerous email links,
poor password management, sharing
passwords, losing equipment, etc., occur
daily. I once sat next to someone on an
aircraft and simply by looking over their
shoulder I was able to obtain the system
security log-ins for a major oil company,
plus enough other information to conduct
a phishing attack on their company.
Negligence of the highest order, but not
deliberately malicious. However, what
about the malevolent side?
In 2016 IBM’s Cyber Security Intelligence
Index found that 60 per cent of all attacks
were carried out by insiders, three-
quarters of which involved malicious
intent. Research by Willis Towers Watson
in 2017 also showed that 66 per cent of
cyber breaches were down to employee
negligence, or malicious acts. This
highlights the weaknesses of people within
the organisational control mechanisms.
SECURITY
This means that any up-to-date threat
assessment should have insiders high on
the list. This includes the suppliers and
contractors to which we give authorised
access to our systems and data. We trust
them to do their job and hope that they
will behave. But trust is not a control
and privileged users often have access
to sensitive data, have knowledge of the
system architecture, configuration and
tools and can cover their tracks.
Faith v trust
Volume isn’t everything and incompetence
may be more damaging than malicious
intent. Trusted staff, or third-parties may
be more dangerous to us than external
attacks. Any attempt to measure the
significance of a hack must not only
evaluate the number of records stolen,
or accounts compromised, but also the
indirect cost of the hack and what it may
point to for the future. A single hack
on a solitary car is not in itself of great
importance, but its potential impact on
trust in autonomous vehicles may well rate
it as one of the most significant hacks of
recent times.
Likewise, the Stuxnet worm may only
have affected a single installation, but its
ability to alter the mechanical behaviour
of an engineering system puts trust in
autonomous manufacturing systems in
doubt.
If we cannot trust our vehicles, or our
manufacturing, or our financial systems,
or the news that we receive, then what
reliance can we place on data processing
as being good for society? Faith is defined
as belief without proof.
Trust is must be protected
As an IT auditor I believe that trust comes
from belief in the reliability of a system to
protect my data and always produce the
correct result. If the system is compro-
mised, then trust is also compromised.
So, perhaps what I should be looking
for is an equation which measures trust,
of which a hack is just another element
to be considered when evaluating the
confidentiality, integrity, availability and
compliance aspects of a system.
December 2018 ITNOW 29
Significant hacks
This list includes what many reporters
believe to be some of the most significant
hacks, since Maskelyne’s embarrassment
of Fleming in 1903. I stress that these are
public domain hacks and exclude those
which are classified, and which are often
more frightening in their potential impact.
The list also suffers from the exclusion
of a couple of hacks which, although not
large in volume terms, I deem to be very
important and which I shall discuss later.
The listed examples indicate that the
number of compromised, or stolen user
accounts is seen as the most appropriate
measure of an important hack. I beg to
differ. In some cases, the impact of a
single hack on a solitary device may have
significant consequences. Also, many of
the hacks listed are dwarfed by simple
incompetence, such as that displayed
by TSB’s attempt to upgrade its banking
platform. The full cost of this fiasco could
spiral to as much as £229 million which
would comfortably exceed its last year’s
pre-tax profits of £163 million and easily
outstrip the financial impact of most of the
listed hacks.
British Airways - 2018
Three hundred and eighty thousand
payment details stolen, together with
enough personal information to fool
security checks on other systems.
Superdrug - 2018
Twenty-thousand customer details
stolen. The pharmacy advised thousands
of its online customers to change their
passwords after hackers attempted to
blackmail the chain.
Facebook / Cambridge Analytica - 2018
Not a hack in the accepted sense, but
Facebook allowed a third-party, Cambridge
Analytica, to harvest details of 87 million
users for political purposes.
Cosmos Bank - 2018
Fake credit cards were then used to force
ATMs around the world to dispense cash
worth about $13m (£10m) until they were
empty
Equifax - 2017
Cybercriminals penetrated Equifax and
stole the personal data of 145 million
people.
30 ITNOW December 2018
Yahoo - 2017
Parent company Verizon announced that
every one of Yahoo’s 3 billion accounts
were hacked in 2013.
NSA Hacking Tools - 2017
In April, a group called the Shadow
Brokers leaked a suite of hacking tools
widely believed to belong to the National
Security Agency.
WannaCry - 2017
WannaCry, which spanned more than 150
countries, leveraged some of the leaked
NSA tools. The ransomware targeted
businesses running outdated Windows
software and locked down computer
systems. More than 300,000 machines
were hit across numerous industries,
including health care and car companies.
NotPetya - 2017
The computer virus NotPetya targeted
Ukrainian businesses using compromised
tax software. The malware spread to major
global businesses.
Bad Rabbit - 2017
Another major ransomware campaign
infiltrated computers by posing as an
Adobe Flash installer on news and media
websites that hackers had compromised.
Once the ransomware infected a machine,
it scanned the network for shared folders
with common names and attempted to
steal user credentials to access other
computers.
Voter Records - 2017
In June, a security researcher discovered
almost 200 million voter records exposed
online after a GOP data firm misconfigured
a security setting in its Amazon cloud
storage service.
Uber - 2016
Hackers stole the data of 57 million Uber
customers, and the company paid them
$100,000 to cover it up. The breach wasn’t
made public until 2017.
LinkedIn - 2016
164 million accounts compromised in a
slow-motion breach that took four years
to discover. The reason this is a significant
hack is because of how long it took for the
company to understand how badly they
had been hacked.
FBI - 2016
A 15-year-old hacked the FBI and
released detailed information about every
undercover FBI officer in America.
Bangladesh Central Bank - 2016
Instructions to fraudulently withdraw US$
1 billion from the account of the central
bank of Bangladesh, at the Federal Reserve
Bank of New York were issued via the
SWIFT network. Five transactions, worth
$101 million were successful, although
$38 million has since been recovered.
The Federal Reserve Bank of New York
blocked the remaining thirty transactions,
amounting to $850 million.
Adult Friend Finder - 2016
More than 412 million user accounts. The
FriendFinder Network, which included
casual hook-up and adult content websites
was breached. The hackers collected
20 years of data on six databases which
included names, email addresses and
passwords.
Anthem Health Care - 2015
Seventy-eight million users. The second-
largest health insurer in the United States
had its databases compromised through
a covert attack that spanned weeks.
The company claimed that no medical
information was stolen, only contact
information and social security numbers.
Ashley Madison - 2015
The hacker group Impact Team broke into
the Avid Life Media servers and copied the
personal data of 37 million Ashley Madison
users. The hackers then incrementally
released this information to the world
through various websites.
U.S. Office of Personnel Management -
2015
Certainly, the largest espionage coup of all
time, unknown hackers obtained detailed
records of every employee and consultant
of the U.S. government for the past 50
years, including all top-secret cleared
employees.
Home Depot - 2014
Over 50 million credit card details were
stolen by exploiting a password from one
of its stores’ vendors.

eBay - 2014
145 million online shoppers had their
password-protected data compromised.
This hack is particularly memorable
because it was public and because eBay
was painted as weak on security because
of the company’s slow and lack-lustre
public response.
Mt. Gox - 2014
$460 million worth of Bitcoins stolen over
the course of three-to-four years.
JPMorgan Chase - 2014
83 million accounts were compromised,
including seven million small-business
accounts and 76 million personal accounts.
Target Stores - 2013
Credit/debit card information and/or
contact information of up to 110 million
people compromised. The breach was not
discovered for several weeks.
Adobe - 2013
38 million user records. Hackers stole
encrypted customer credit card records,
plus login data for an undetermined
number of user accounts.
Spamhaus - 2013
The largest DDoS attack to date. This DDOS
attack was sufficiently large to slow down
the entire internet and completely shut
down parts of it for hours at a time.
Global Payments - 2012
110 million credit card details stolen.
Global Payments is one of the several
companies that handle credit card
transactions for lenders and vendors.
Sony PlayStation - 2011
77 million users. Sony took down its
service for several days to patch holes and
upgrade their defences.
RSA Security - March 2011
Possibly 40 million employee records
stolen by a phishing attack.
VeriSign - 2010
Undisclosed information stolen. Security
experts are unanimous in saying that the
most troubling thing about the VeriSign
breach, or breaches, in which hackers
gained access to privileged systems and
information, is the way the company
handled it. VeriSign never announced the
attacks. The incidents did not become
public until 2011, and then only through a
new SEC-mandated filing.
Stuxnet Worm - 2010
This worm subverted more than half of
Iran’s 8,800 uranium centrifuges causing
them to spin out of control while reporting
that they were operating normally.
Conficker Worm - 2008
Still infecting a million computers a year.
While this resilient malware program has
not wreaked irrecoverable damage, this
program refuses to die. It hides and then
copies itself to other machines. This worm
continues to open backdoors for future
hacker takeovers of the infected machines.
Heartland Payment Systems - 2008
34 million credit cards exposed through
SQL injection to install spyware on
Heartland’s data systems. It wasn’t
discovered until January 2009, when Visa
and MasterCard notified Heartland of
suspicious transactions from accounts it
had processed.
TJX - 2008
94 million credit cards exposed. There
are conflicting accounts about how this
happened. One supposes that a group of
hackers took advantage of a weak data
encryption system and stole credit card
data during a wireless transfer between
two Marshall’s stores. The other has them
breaking into the TJX network through
in-store kiosks that allowed people to apply
for jobs electronically.
Estonia Cyber War - 2007
The Baltic state suffered three weeks of
DDoS attacks, which completely crippled
its IT infrastructure. The attackers targeted
political, government, news outlets,
universities, schools and businesses and
eventually Estonia’s banking infrastructure.
The Melissa Virus - 1999
Twenty per cent of the world’s computers
were infected by a virus masquerading as
a Microsoft Word file attachment.
A different kind of hack
Most of the reported hacking relates
to unauthorised people obtaining
unauthorised access, but there is another
SECURITY
more assiduous attack. My American
client’s central system was provided
by a third-party. The contract provided
for access by the supplier to my client’s
machine to maintain the software. Security
was provided by a VPN and a log-in
process. However, to maintain the software,
the supplier required super-user status.
The audit motto is ‘trust, but verify’, so I
decided to compare supplier log-ins with
the change log. My client did not maintain
such a log, but I eventually (and reluctantly
on their part), obtained it from the suppler.
I established that the supplier was logging
into my client’s machine at times which
bore no relationship to the change log.
Out of curiosity I checked for access to my
client’s financial and payroll systems and
established that the supplier was using
his enhanced status to access the data
on those systems. Was this unauthorised
access being sanctioned by the supplier’s
management, or was it a rogue member of
staff? I alerted my client, but what should
be done? They needed the third-party
software and it had to be maintained which
required the enhanced access.
We decided on a two-phased approach.
First, we would disable the user account
and only enable it when maintenance was
required. Second, we would confine the
supplier to a virtual machine containing
only their system. Its ancillary software
and associated files. We explained to the
supplier’s management that we were
simply upgrading our security processes
and they did not raise any objections.
Since then I have identified other cases
of hacking by trusted third-parties which
have been facilitated by the trusting nature
of my client. This unauthorised access by
authorised people is likely to become more
common with the growth of cloud services.
About the author
John Mitchell was awarded the 2017
John Ivinson medal for services to the
Institute. He is a previous member of
Council and the Risk, Audit and Finance
Committee.
He is currently Treasurer of the
Information Risk Management and
Assurance (IRMA) specialist group. He
can be contacted at:
john@lhscontrol,
www.lhscontrol.com
December 2018 ITNOW 31
 KNOW YOUR ENEMY:
SHOULDER SURFING
Researcher and ISSG member Wendy Goucher MBCS provides a timely reminder that
even during the daily commute your data may not be safe from prying eyes.
You know what shoulder surfing is, it’s that
thing you do when the train, bus or plane
is crowded, and you happen to glance over
someone’s shoulder to see what they are
doing.
In the days when I took a train to work,
broadsheet newspapers were the vogue
Image: getty/Laurence Dutton
amongst my fellow commuters. I was
long sighted which meant that instead of
fighting with the opening and folding of the
beast (which I never did master) I would
read the newspapers of those sat around
me. Harmless really, but deprived The
Times, Telegraph or Guardian newspapers
of my purchase.
Working on a train
doi:10.1093/itnow/bwy097 ©2018 The British Computer Society
About eight years ago while travelling
around I noticed that the interesting things
to read were displayed on laptops. I only
looked out of curiosity, no harm done really.
Although I was tempted to get in touch with
the customer of a man I travelled next to
on a train to Glasgow. He was composing
an email to explain how he could persuade
their customer that it wasn’t his company’s
fault they hadn’t delivered the service
promised. It was all going to be smoke
and mirrors, the end point being that the
32 ITNOW December 2018
customer was to be made to believe it was
actually their fault. I really wish I had found
out how that had turned out. The point
is, that was not ‘harmless’ information. It
would just have taken a phonecall to spoil
the salesman’s day.
Research and experiments
Later, I carried out some academic
research to see if I was alone in noticing
sensitive information being displayed in
public. The answer from that work, and by
anecdote almost every time I have talked
‘Although it might be a bit of stretch to call this
a ‘cyber attack’ it can certainly be
cyber-boosted.’
about it since, assured me I was not alone
in my suspicion. While musing on these
results I realised that it was not so much
the casual glance at a display that was
the risk. It was if a copy was taken of that
display.
So, I carried out an experiment to see
what a smartphone could capture from
a tablet or laptop display, this in the time
of the iPhone 4 and iPad 2. The answer
was that the best place to observe from a
laptop or tablet was from about two rows
back with the observer standing. Then the
photos showed a reasonable shot down to
font size 12.
I repeated the experiment a couple
of years ago, using the iPhone 6, to both
display and capture. One had a privacy
screen and one just a standard display. The
headline result was that even two rows
back, a good quality photo could be taken
of the data on a smartphone screen. With
the privacy screen it was best to be stood
directly behind, but two rows back was still
good.
Oh, and it was also possible to take
a little video of the document as the
user scrolled down which is particularly
important for documents on smartphones
as the display is reduced in size.
Why should you care? Well, when your
staff, or you, come to that, are on public
transport, or in a public area such as

a coffee shop, and looking at business
sensitive material, you should be aware
that it can be seen, copied and shared. The
ready availability of the internet means
that not only might an observer share
with colleagues, they could share on social
media. Although it might be a bit of stretch
to call this a ‘cyber attack’, it can certainly
be cyber-boosted.
Taking responsibility for data
In the pain and paperwork of the run up
to GDPR day in May this year, people were
made responsible for protecting personal
data. You don’t want staff working on such
material in public environments because
that could be expensive in ICO fines. Don’t
coat your desk with Teflon and tell your-
self it is the user’s fault for working there.
Generally speaking, I doubt people work in
public because it is their favourite place,
‘There is a risk of someone reading over your
shoulder if you are working or reading in
public. Super clear device screens make it
super easy to capture an image from quite a
distance.’
with the possible exception of working on
a plane on a long flight, because of the lack
of phone interruptions (for the moment).
People work as they travel to fit more
work into the working day so they don’t
have to do it in their ‘own’ time. So, maybe
we have to look at how organisations place
pressures on their staff to frequently do
more work than fits into a working day. If
they do have too much, and they work on
it while commuting, and there is a leak,
whose fault is that? It’s an interesting
question. I suspect the answer will come
on the slow train from case law.
So what is my point? Am I here to just
spread gloom? No. I like to think that’s not
my style. Years ago when I used to lecture
in management, we used to talk about
push and pull motivation.
That is motivation that is generated or
kindled within the member of staff, the
motivation they take to their job, which
is push motivation; and motivation that
is driven on from outside – think a ‘Wolf
of Wall Street’ motivational speech or
information from the security awareness
CPT package, which is pull motivation. Both
can work, best still if both work together in
the same direction.
So how can we make people want to take
care on their devices?
They need to understand the risk at a
personal level. That doesn’t mean they
need to suffer, but they need to be in the
position of understanding the risk to their
own data that viewing their screen in a
public place might bring, and that needs
to be an understanding that drives safer
behaviour.
There is a concept known as
‘behavioural intent’ that talks about the
need to change people’s actions by first
changing their intention to behave. Think
of it like a New Year’s resolution, they
work don’t they? Well, often, no. To change
behaviour in the medium or long-term
there needs to be that internal push
motivation. This then fires up the super-
SECURITY
charger to make the change more likely to
stick.
Too often I find companies believe that
just telling someone to change their way
of working (and threatening to reduce their
access to the coffee machine), means it
will change. No matter how often I come
upon this attitude, I still find it hard to
understand that anyone who has been
around a growing child, or indeed a stroppy
adult, could still believe that telling =
action. We know it doesn’t in just about any
situation, so why do we believe it will in the
world of security? Most especially, when
the users are operating outside the office,
and you really don’t know what they are
doing.
My point? There is a risk of someone
reading over your shoulder if you are
working or reading in public. Super clear
device screens make it super easy to
capture an image from quite a distance.
Connectivity of devices means that more
information than ever can be accessed on
the move, then displayed and potentially
copied by an unauthorised person.
Because there is rarely going to be any
obvious evidence of a copy being made,
we can’t use that as an incentive. We
have to make security more relevant and
reasonable if we want staff to tighten up
their mobile working practice. My Selfish
Security approach leads me to ask users to
consider the screen that is captured is the
user’s own banking app. What about if the
sequence videoed is them logging on to do
a bit of banking admin? Ah, now they are
listening.
Wendy Goucher is the author of
Information Security Auditor, available
from the BCS bookshop:
www.bcs.org/books/isauditor
December 2018 ITNOW 33
 IS YOUR
SMARTPHONE
LEAKING DATA?
How secure is the data on your smartphone? And are the so-called ‘private’ apps really
as secure as they claim to be? Olivier Plante, CEO of Fleksy Keyboard explores how your
personal data can escape your device.
Smartphone users have become
increasingly conscious of the risks to their
data privacy in recent years, however, most
still misunderstand exactly how their data
is leaked.
Revelations about the access and use of
personal data – from GCHQ, CNI (Spain’s
National Intelligence Centre) and National
Security Agency (NSA) mass surveillance,
to Cambridge Analytica’s Facebook data
harvesting – have proved that not all digital
conversations are by any means private.
We’ve also grown to appreciate that user
data can be used for a variety of different,
Image: Getty/Georgijevic
and sometimes unhealthy, means.
Some people became worried about
their governments and other authorities
routinely spying on them. Others grew
concerned that companies would use their
data to bombard them with advertising –
or even attempt to influence their political
views.
doi:10.1093/itnow/bwy098 ©2018 The British Computer Society
An enemy in your pocket
With this increased awareness, smart-
phone users flocked to the likes of
WhatsApp and Telegram. They were per-
ceived as safe havens for privacy, due to
end-to-end encryption. However, even by
using such end-to-end encrypted apps, it
is still possible for data snoopers and har-
vesters to gain access to private data via
an unlikely source.
By connecting with the cloud, some
mobile keyboards used for streamlining
34 ITNOW December 2018
and personalising typing can access and
use data from your device. Anything you
type, from personal conversations to
passwords and credit card details, has the
potential to leave your device via many
keyboard apps. Such data can be leaked
whenever keyboard apps sync with the
cloud. The ‘smart suggestions’ of some
mobile keyboards, which often upload
information as you type in order to offer
more intuitive suggestions, pose another
security risk.
Predicting and listening
There have been several notable cases of
data leaks in recent years. The personal
data of over 31 million users of the AI.type
virtual keyboard app leaked online in 2017
‘In light of growing data privacy concerns
among governments, security agencies and
regular smartphone users, brands must now
take steps to renew trust.’
after the company failed to secure the
database’s server. Names, phone numbers,
location data and Google searches were all
found to have been leaked.
The users of another different keyboard
extension, Swiftkey, reported in 2016 that
their keyboards were suggesting the email
addresses and search phrases of other
users. The bug was found to originate from
SwiftKey’s cloud sync service, which had to
be suspended.
And while being investigated for
intrusive ads in 2017, GO Keyboard, a
widely-used custom Android keyboard app
was found to be collecting extensive user
data, such as Google account information
and even the user’s location.
GO Keyboard was also found to be
running external code. This was connected
to dozens of third-party trackers and ad
networks, meaning that the number of
affected users ranged anywhere from 200
million to one billion.
Even Google’s own Gboard keyboard
extension gives the company another
avenue to harvest its users’ search
queries, regardless of whether it is used
in conjunction with end-to-end encryption
apps.
Despite these problems, third-party
keyboard apps have grown in popularity,
mainly due to the improved usability, new
features, innovative design themes and
smart text prediction that they offer.
This means that the onus is on keyboard
providers to regain the trust of their

users, particularly in light of next-service
prediction (NSP) – the latest innovation.
This new smart technology suggests
restaurants, bars, cafes, shops, or even
brands, based on what the user is typing,
allowing users to instantly access content
and information from the web, and access
different apps within a single chat. For
example, offering to ‘grab a drink’ with
a friend could bring up suggestions of
local bars, while suggesting a ‘meeting
sometime next week’ with a colleague
could trigger your phone’s calendar. But as
such smart NSP algorithms are designed
to comprehensively learn and predict user
behaviour, particular care must be taken to
ensure data privacy.
In April 2018, the French government
announced its intention to move to using
its own encrypted messaging service this
summer, over fears that foreign entities
could spy on officials using foreign-built
encrypted apps which do not have servers
in France. This is almost certainly just the
start of a new trend of governments and
possibly even large corporates turning to
their own messaging services to avoid the
possibility of ‘data leaks’ – intentional or
otherwise.
Customers aren’t impressed
In light of growing data privacy concerns
among governments, security agencies and
regular smartphone users, brands must
now take steps to renew trust. More and
more users are both aware of and con-
cerned by privacy issues, and, as a result,
are becoming less willing to ignore what
happens to their data behind the curtain.
People are also losing patience with
companies using their data to sell them
products they don’t want, or, in the case
of Cambridge Analytica, seek to influence
them in even shadier ways.
The days of ticking the T&Cs without
reading them are disappearing, and if
brands want to survive and compete,
they need to respect the privacy of their
customers and ensure their data is kept
private.
In the meantime, as a user, take a closer
look at the messaging and emailing apps
you’re using. The first thing to check is
whether they have the right layers of end-
to-end encryption.
One good alternative to WhatsApp and
Telegram is Signal, which has strong
encryption credentials to ensure the
privacy of your conversations.
You should also make sure you review
the free services offered by any app and
understand what data you’re giving away in
return for the service. For instance, using
Google as your search engine exposes
your personal data and behaviours, but
alternatives, such as Qwant, respect your
privacy.
Data leaking can also occur via your
internet browser – a potential gateway to
all of your passwords and other forms of
personal data and information, such as
email and social media accounts.
The primary risk here comes from
hackers, but if you’re concerned about your
browser leaking your data – either directly
or indirectly – it’s worth looking at Express
VPN’s review (https://www.expressvpn.
com/blog/best-browsers-for-privacy/) of
the most popular web browsers for privacy
and security.
A separate risk is posed by Google
Services, which updates Google apps and
apps that originated from Google Play.
These updates synchronise your contacts,
update your location-based services and
other actions. For instance, apps with map
functionality will make use of your Google
Maps data, which can be in-turn leaked to
cybercriminals or be sold to marketers.
Malware (malicious software designed
to harm your device), spyware (software
aimed to snoop on your personal data)
and ransomware (software designed to
blackmail you) are all able to infiltrate your
device via Google Services, but mainly via
web browsing.
Have an antivirus app installed to
minimise your chances of getting stung in
this way. However, hackers have realised
that most people are now wise to the
various ‘wares’ and tend to look for less-
known methods to access their data, such
as keyboard data leaks. As such, it’s always
worth doing some research into the many
private alternative keyboards out there.
SECURITY
References
1. Over 31 million users of the
AI.type virtual keyboard app
leaked online in 2017 after the
company failed to secure the data-
base’s server: http://www.bbc.
com/news/technology-42238574
2. Swiftkey users reported in 2016
that their keyboards were sug-
gesting the email addresses
and search phrases of other
users: https://www.theverge.
com/2016/7/29/12326152/
swiftkey-bug-backup-sync-
down-error-prediction
3. GO Keyboard found to be collect-
ing extensive user data, such as
Google account information and
location: https://www.bleeping-
computer.com/news/security/
popular-android-keyboard-app-
caught-collecting-user-data-
running-external-code/
4. Google’s Gboard keyboard exten-
sion allows the company another
avenue to harvest its user’s
search queries / By connect-
ing with the cloud, some mobile
keyboards used for streamlining
and personalising typing can steal
data from your device: https://
techcrunch.com/2018/04/14/
how-to-save-your-privacy-from-
the-internets-clutches/
5. In April, the French government
announced its intention to move
to using its own encrypted
messaging service this summer:
https://tcrn.ch/2Hcfy1W
6. Express VPN browser privacy
review: https://www.expressvpn.
com/blog/best-browsers-for-
privacy/
December 2018 ITNOW 35

Sometimes, we can overlook the true impact of cybercrime on individuals. Mike Sheward,
Director of Information Security at Accolade, explains how learning to appreciate and
understand the people behind the data makes us better incident responders.
We’re all familiar with the routine. A data
breach occurs, the targeted organisation
puts out a press release reminding us
that they ‘take the security of customer
information very seriously’, and they’ve
‘hired a leading cybersecurity company to
investigate how the breach occurred’. Then
the numbers come in. Millions, tens of
millions, even hundreds of millions of
records are impacted. Finally, sprinkle in
a couple of years of free credit monitoring
for those impacted who wish to sign up
Image: Getty/PeopleImages
for it, and what has become the standard
response process is complete once again.
It happens with such frequency, and at
such a scale that it can be easy to become
immune to the headlines. To accept that
this is a justifiable risk in exchange for the
convenience of living our lives online. That
sentiment is more understandable when
observing from a distance, and focusing on
the number of rows in a database.
doi:10.1093/itnow/bwy099 ©2018 The British Computer Society
Meeting a victim
However, things change pretty quickly
when you’re face-to-face with a real,
individual victim. You realise that behind
the numbers, behind the gigabytes and
terabytes, real people find themselves
in the crosshairs of unwanted distress
and disruption. It’s a sobering feeling,
but one that, as an information security
professional, motivates you to work harder
to prevent incidents from occurring in the
36 ITNOW December 2018
CYBERCRIME:
REMEMBER THE
PEOPLE
(NOT JUST THE DATA)
first place, and better plan your response
for when they do.
Information security is a people
business. I’ve been fortunate enough to
spend the last decade working primarily
on incident response and investigating
digital crimes, and during that time I’ve
met with numerous victims of those
events. Recently, I worked with BCS to
publish ‘Hands-on Incident Response and
Digital Forensics’, a practical guide to those
two information security topics.
During the writing process, I revisited
several old cases and incidents, and
used them to relate the theory behind
the discipline to real-life experiences
and people. This aligns with one of the
greatest lessons I’ve ever learned in my
‘It happens with such frequency, and at such a
scale that it can be easy to become immune to
the headlines.’
career, that information security, for all the
logic, technology, process and anonymity
associated with it, is very much a people
business.
Nowhere has this lesson been more
applicable than in my current position
at Accolade, where I’m responsible for
the safety and security of millions of
healthcare records belonging to our clients
and their families. Protected healthcare
information (PHI) is highly regulated in
the United States, and for good reason.
The risks associated with compromised
PHI include everything from identity theft
to medical fraud, and even blackmail.
Unfortunately, malicious actors are well
aware of this, a fact reflected in the
value of stolen medical records traded
online. Unlike credit cards, you can’t get a
replacement medical history or identity in
the mail if yours becomes compromised.
My team meets with every new
employee to convey this message as part
of our security awareness programme.
When it’s my turn to deliver the training
I frequently use the story of a former
colleague as a prime example of what can
happen if PHI gets into the wrong hands.
Around six years ago a figure entered
my periphery. I looked up from my desk in
a large open plan office to see a familiar
face I’d seen around but hadn’t really
interacted with. This time something
was different. The face was awash with
a steady stream of tears, and I knew
something was very wrong. ‘Is everything
okay?’ I asked, ridiculously. The answer
came in a wave of tears and emotions

as my colleague explained that their
partner had recently passed away, but
there had been a credit card opened in
their name that morning. Identity theft of
a deceased person is an all too common
crime. Typically, in this line of work, we’d
give technical explanations or look for
the indicators as to how this could’ve
occurred, but in this case, the person
at the end of my desk just needed help.
Quick, actionable, reliable help, and they
didn’t know where else to turn. Myself
and another member of the security team
helped direct them to the appropriate
resources and even offered to put in a
couple of calls.
‘Behind the numbers, behind the gigabytes
and terabytes, real people find themselves
in the crosshairs of unwanted distress and
disruption.’
Things got cleared up, and soon
thereafter the source of the breach was
revealed, as a health insurance provider
disclosed an incident that would’ve directly
impacted this person’s information. This
event stuck with me, and helped shape my
personal approach to identity theft cases.
On paper, this was just one of a couple
of million impacted people. In reality, this
incident caused a tremendous amount of
stress to someone whose life was already
incredibly stressful, having just lost their
partner. I think of this person every time
I investigate an incident, am required to
justify the value of a security control, or
write a policy. I don’t want anyone else to
endure what this person had to endure
because I didn’t try hard enough.
The other side of the coin
Of course, people aren’t just victims, they’re
also the perpetrators of digital crimes,
often empowered by the supposed
anonymity that sitting behind the keyboard
or touchscreen affords. In the previous
example, we weren’t in a position to
identify the perpetrators because the
incident didn’t occur on systems within
our purview. However, I can recall plenty
of occasions where it’s been possible to
successfully place a suspect behind a
keyboard, even when this may not have
been the original intent.
In the early days of my career, while
working as a network engineer, I noticed
some strange traffic patterns leaving a
particular subnet. It was the end of the day,
with few people left in the office, so I made
the decision to disable a router interface,
effectively cutting off network access for
an entire building. My plan was to come in
early the next day, contact an IT manager
at that site, and work with them to identify
the source of the traffic. Being relatively
new to the position, I wanted to make sure
my thought process was well documented,
so I bundled together several screenshots,
logs and notes and sent them off to my
manager. I wasn’t sure how cutting off
network access would be received, but
SECURITY
figured at least they’d be able to see it
wasn’t a decision I’d taken lightly.
The next day when I spoke to the IT
manager, they already had an idea of
where the traffic was coming from. ‘It was
a virus, I’ve removed it – please re-enable
the connection,’ came the response. The
phone call ended, and the strange traffic
failed to return. Case closed, or so I
thought.
A few weeks later a member of human
resources came to see me, and let me
know they’d reason to suspect that the
same IT manager had been violating an
acceptable use policy on the network, in
quite a serious manner. My actions that day
had apparently raised suspicion amongst
other members of the IT organisation.
I’d somewhat unexpectedly been a first
responder in a security incident, and
caught someone up to no good.
I felt kind of uneasy. I mean, this would
likely cost someone their job. I just wanted
to protect the network. I didn’t want to
get anyone in trouble. I explained this to
my manager, who sought to address my
concerns. ‘Today it’s this, tomorrow who
knows what they’d be up to if they didn’t
get caught. You’re saving them from getting
themselves into more trouble.’ With that, I
knew this was the work I wanted to do full-
time and embraced that mantra in every
subsequent incident and case I worked.
Always remembering that ultimately, it’s all
about the people behind the data.
Mike Sheward’s book, Hands-on Incident
Response and Digital Forensics, is available
from the BCS bookshop:
www.bcs.org/books/digitalforensics
December 2018 ITNOW 37
 THE ANALYSIS OF
SECURITY
Justin Richards MBCS spoke to Giovanni Vigna, a professor of computer science at the
University of California and co-founder of Last Line, about all aspects of cybersecurity.
What security trends are you currently
interested in or worried about?
The security industry is developing
techniques based on machine learning and
artificial intelligence, but oftentimes these
techniques do not take into account what
we’re trying to learn about, or we’re trying
to model by using these techniques, and
is fighting back. So, if you think about how
machine learning and artificial intelligence
were born, they were born to process
large amounts of data and recognise, for
example, images or the natural voice or
text. All these subjects of analysis are not
Image: getty/moisseyev
fighting back. A picture is not trying to
pretend to be a cat, it’s just a picture.
Well instead, when you apply artificial
intelligence techniques to programs, to
documents that could be malicious, these
documents can fight back and can, for
example, decide, ‘hey, if you’re using this
particular machine learning technique I
can change these few parts and keep from
doi:10.1093/itnow/bwy100 ©2018 The British Computer Society
being bad, and will be classified as benign.’
So, these are the risks that I think are
gonna bite us back in two, three, maybe
even five years from now.
Are the good guys drawing level with the
bad guys or are we losing the battle?
I think that the bad guys will not win the
battle, I think the good guys can and will
win the battle in my opinion, but we need
to be able to use machine learning in an
effective way. There is this concept of
38 ITNOW December 2018
adversarial machine learning where you
have to learn and apply learning modelled
in an environment that is fighting back. It’s
our responsibility, as good cybersecurity
researchers, to develop techniques
that are resilient to this kind of attack.
So, I think that we’re going to lose the
battle if we take the techniques that we
develop, like image recognition, and text
recognition, and we apply those techniques
in a naïve way to this new domain. But,
if we are well aware that the domain
that we’re trying to analyse is fighting
back, then we’ve got a chance to develop
novel techniques that are specific for the
security domain that can be effective at
stopping these criminals.
Do you think we’ve got enough security
professionals?
I think that this is a problem that
permeates the whole security field.
Creating enough people that can effectively
perform security duties of any kind is
something that has been a thorn in the
side of the government, of organisations,
even in education. We cannot, as a
university that has a strong presence in
security, produce enough people because
there is such a demand. So, this demand
is what has driven, in large part, the
introduction of artificial intelligence in
security because many of the tasks that
were carried out by humans they couldn’t
scale up. We didn’t have enough analysts,
enough signature developers, and so forth,
to fulfil the demand and so people started
looking at automated techniques, machine
learning techniques; AI techniques to cover
some of these tasks. Of course, this is not
a solution.
We will always need a human ‘in the
look’ eventually. But you can try to optimise
that time as much as possible. And, in fact,
one of the trends in the industry is really
a focus on what we call the first level
analyst. So, the person who is looking at a
screen looking for the first evidence of a
possible problem in the network.
IBM’s Grady Booch has said that security
is partly the responsibility of the
software developers, to start thinking in
a more security-minded way. What are
your thoughts about that?
Oh absolutely. I teach classes in software
security development and my point is that
we have to start thinking in an oblique way,
so instead of thinking ‘I have this task, the
software has to build this’, after you have
designed it you have to look at it and say:
‘can I abuse it? Can I use this data in a
different way? Can I send too much data?
Too little data? Data of a different kind?
What is my program going to do with this
anomalous input?’ So being able to look
at this and understand the implications
of the data that you didn’t foresee is very
important because this is exactly what a
vulnerability analyst, which will be a hacker

that tries to find a vulnerability, tries to do.
When I look at software and I have
to find a vulnerability I try to think, ‘the
developer – what assumptions did he
or she make?’ And I try to take that
assumption and try to break them.
Do you think there should be a bit more
of a voluntary code of practice within the
IT arena, trying to get people, particularly
software developers, thinking more
about security, and making it more of a
professional code of ethics?
I think so. I think that, for example, at UCSB
(University of California, Santa Barbara),
we teach an ethical course for engineering,
for engineers in the college of engineering,
and this is important because every time
you build software, in a way, it’s like you’re
building a house or a bridge. You have to
understand that your software will be used
in certain contexts and you have certain
responsibilities about its functionality.
Right now, we don’t have laws that
determine that the quality must be of a
certain kind because it’s very difficult to
define for an algorithm. We let the market
decide. If you develop software that is
crappy, people, unless they desperately
need it, they won’t buy it. But I think it’s not
the right way to do it. The right way is to
teach people that the software has to be
developed in the right way and we have
responsibilities.
What advantages might a decentralised
architecture have?
Centralised systems have been oftentimes
looked at as problematic because
whenever we have a central system then
you could attack that system and take
down a whole operation. Because of that
decentralised systems were introduced
and, if you think about it, the internet was
introduced by DARPA (Defense Advanced
Research Projects Agency) for exactly
that reason. They wanted a network that
would sustain, for example, entire cities
being annihilated in a nuclear warfare
situation. So, having packets being able to
be rerouted in a decentralised way was
the right way to characterise or to make a
network functional in these cases.
So, in decentralised systems you have
the advantage that you don’t have a single
point of failure. However, you have the
disadvantage that if somebody controls
enough of the nodes it might decide certain
properties of the network. For example,
they are called byzantine attacks where
you control enough of the nodes of a
network or the participants in a distributed
transaction to create, for example,
consensus over things that are not true.
So decentralised is good but could also be
vulnerable to these attacks. So, there are
pros and cons.
Where are we with mobile security?
I think mobile security has not caught up
with the way in which we do security for
other systems. For example, the Android
eco-system is going a little bit through
what the old Windows XP, Windows 7 was
going through. And indeed, there is a core
operating system that has maybe good
security mechanisms, but then it has to
be run on a number of different platforms.
Platform here being different types of
phones from different manufacturers
and each of these phones has a number
of chips; little pieces of hardware that
handle, for example, the gyroscope or the
broadband communication or the audio
or the video. For each of these pieces
of hardware, that are different for every
phone, you need a driver. The core system
might be well-designed and secure, but
oftentimes these drivers are developed
under a lot of market pressure by
developers that are not experts in security.
So, what we have found is that a lot of
vulnerabilities are not in the core system,
but they are in the driver. The problem is
that the driver runs like the core system
and so compromising a driver might lead
to the complete compromise of the phone
in a way that was similar to what was
happening with Windows. Now things have
changed, there are different ways to load
kernel drivers so there is enhancement of
the protection, but for phones this is still a
problem.
How has the internet of things been
causing problems?
The internet of things has introduced a
whole new spectrum of vulnerabilities.
Mostly because the driver in creating this
network of devices is their interaction. Just
SECURITY
having Alexa, or whatever other personal
assistant, is not very useful if you cannot
control the lights, control the speaker, turn
on the TV. Much has been done in order
to have these various devices talk to each
other. The problem is that these devices
are made by different manufacturers with
different standards, and so, in order to talk
to each other, they try to make them as
open as possible.
Openness is a great property because
it allows inter-operation, but oftentimes
this doesn’t go hand-in-hand with security.
And so, the resulting problem is that you
can have, for example, an Alexa being
influenced by a speaker that is under the
control of the television that is actually
networked and somebody just logged
into that and is able to play a sound
that tells Alexa to open the door and
suddenly the apartment is unlocked. These
interactions are not well understood. We
have interactions that we never considered
before like vocal interaction, light
interaction, temperature interaction. These
are not well understood and might cause
problems. And oftentimes the firmware,
that runs on these devices, is not well-
developed and has vulnerability of its own.
We have more surface, new interactions,
and it will take a while before we master
how to have this internet of things in a
secure way.
Where are we in terms of traceability of
attacks?
Tracing attacks, and not only tracing
but attributing attacks, has always been
incredibly difficult. Mostly because digital
evidence is extremely malleable, it’s not
something that has molecules attached
to it that can leave an actual trace.
Sometimes you can spot that certain
tactics and techniques have been used
- things that are often done by certain
groups, in a certain way, and that requires a
lot of experience and a lot of observations.
After a while you can see that these groups
tend to follow certain patterns.
But this is a little bit of a dark art
because you have no real way of knowing.
In some cases, you might have evidence
but it’s very difficult to have hard evidence
that something has been done in a certain
way. So, I would say that you can trace
December 2018 ITNOW 39
the attacks, you can say where they came
from, because you have logging, and you
can see where a connection came from,
but understanding who’s behind it is still
very difficult to do.
The National Cyber Security Centre
recently warned that the threats of cyber
attacks on Britain’s critical national
security infrastructure from hostile
states like Russia, China and North Korea
has soared over the last couple of years.
Why do you think that there’s more
nation-on-nation attacks?
I think that nations, especially certain
nations, are making major investments in
their cyber attacking capabilities. This is
because it’s something that can provide
an enormous amount of benefit with very
little engagement. Very little cost as well.
You don’t have to do a lot of things that
would get you caught, that would get you
identified and, therefore, it makes sense,
from a strategic point of view, to invest
in that. So, it becomes the classic arms
race as more nation states develop more
security attacks, and the nations that are
the targets of these attacks will have to
develop better security measures to block
these attacks and make them ineffective in
some way.
Did you have a mentor that inspired you
to get into the industry?
I had several mentors. I would say that
I got into security because I love the
challenge and I started doing security
stuff when I was very young. I just loved
security, the concept of, from locks to
networks to, ‘hey, what’s in this computer
and why it works that way.’ I did my
studies in engineering and then there was
one professor that was actually in Santa
Barbara that was an expert in security and
I really wanted to do a little bit of work with
him, so I went to visit him after my PhD,
in 1997, and I never made it back. I stayed
there, and worked with him for many
years, so I would say that he is the reason
why I stayed in security for so long.
What are your thoughts about the
security levels in blockchain?
Blockchain is fundamentally a way to
have a distributed ledger where a group
of people can agree that certain things
40 ITNOW December 2018
happen in a certain particular order.
And in those cases, blockchain is a very
useful approach. Blockchain is based
on a cryptographic concept that makes
it possible to have this blockchain, this
ledger, certified.
To me the security problem is born
when you don’t have a centralised
environment and blockchains are
decentralised by construction. Therefore,
you become somewhat vulnerable to
selective denial of service attacks where
I can try to slow down certain operations
to avoid certain people participating in
a certain way. There have been actual
attacks of this kind.
In the cryptocurrency world the problem
becomes more of a policing problem. If you
have a completely untraceable way of due
payments this could look very good, but
could also bring a lot of criminal activity
that cannot be blocked anymore.
Given blockchain’s decentralised nature,
can you talk about decentralised storage
and its advantages?
Decentralisation has several advantages,
which is fundamentally the ability to
sustain an attack to some of its parts.
Sometimes blockchain has been touted
as a solution to a lot of problems. I think
it’s a solution to certain problems, but
blockchaining everything is a mistake, it’s
a little bit of a fad. In order to verify certain
transactions, you actually have to do a
lot of CPU computation, that might not
scale. The infrastructure might scale, but
the proof of work that you have to do in
doing a blockchain might require too much
information.
So, imagine, for example, if all of us
started using bitcoin. That means that
every single transaction in the world will
go through a ledger and has to be verified.
Now suddenly there’s so many of these
transactions, or groups of transactions in
the blockchain, that these blocks that have
to be verified would need so much CPU
power that we might not be able to provide
enough electricity for it. So blockchain is
good for certain things. When you want
to have a community that want to create
consensus on a specific set of actions, for
example. However, I would warn against
using blockchain to solve every problem
because it’s not the solution, it’s one
solution; it’s one building block to build
in secure systems but not the solution to
everything.
There are already cases in which
governments have decided to prohibit
certain forms of bitcoin mining because it
was too expensive, and it was putting too
much stress on the electric grid.
What are your top three malware
nightmares currently?
I would say the use of machine learning
on stolen personal data on an enormous
scale. The ability, with all these breaches
collecting data, is the possibility that
somebody will really collect a ton of
data and find ways to exploit this data to
understand something about people; to
understand who to attack or how to sell
certain services based on this aggregate
information. Once this happens it’s very
difficult to make it stop because once that
information is out, the ‘cat is out of the bag’.
Putting this information back might be
impossible, so these large-scale breaches
are worrying me.
I would say the second issue is this use
of machine learning that is just wrong,
learning the wrong things or learning
things in a way that is too brittle. It can be
bypassed, and I’m afraid it will bite us back
in two to three years from now.
The third thing is evasive malware;
malware that is able to easily escape
detection or can escape detection from
basic detection systems. Unless you get
good malware protection it’s really difficult
to identify these evasive pieces of malware.
What’s exciting you about cyber security?
I think that there are several things that
are exciting. I am personally very excited
about firmware analysis. So, firmware, in
the internet of things, is this piece of code
that runs very close to some hardware.
The difference in analysing this firmware
is that you don’t have all the abstractions
that a normal computer or even a phone
has – the operating system and things like
that, which makes the analysis a lot more
challenging. Usually you don’t have the
source code, so you have to operate at the
binary level, which is more challenging. So,
finding problems in firmware is something
that requires new approaches, new skills
and, for me, that’s very exciting.
 SECURE
SOFTWARE
DEVELOPMENT
In an ever more connected world, Dr Tom McCallum, the Academic Lead Developer at
University of Highlands and Islands, considers how you can best protect your company
from malicious and poor-quality code.
On 12 May 2017, at 07:44 UTC in Asia, a
computer virus made its first attack on an
open connection. Within 24 hours the code
had infected more than 230,000 computers
in 150 countries. This virus was Wannacry
– a ransomware attack that used a flaw in
the implementation of a common network
protocol used for sharing files and printers.
CVSS, an open industry standard
for assessing the severity of security
vulnerabilities, reported over 14,728
registered vulnerabilities in 2017. In the
Image: Getty/gorodenkoff
first half of 2018 a little under seven
thousand entries were registered, beating
last year’s count for the same time period.
As more software is being deployed,
more devices are becoming connected,
so consequently more vulnerabilities are
created and reported.
Over the last 30 years, your computing
infrastructure and applications have
become increasingly connected. With the
doi:10.1093/itnow/bwy101 ©2018 The British Computer Society
current mega trends of internet of things,
autonomous systems and the continuing
growth of the internet, securing your
infrastructure from flaws in your software
is a top priority.
Secure programming?
The Open Web Application Security Project
(OWASP) [https://www.owasp.org/index.
php/Main_Page) was founded in 2001
and produces freely available security
information for web applications. The
42 ITNOW December 2018
number one item on its list of Top 10
security threats is injection attacks. An
injection attack is when an attacker crafts
a carefully written string and passes them
to your website. This string is designed
to either reveal confidential information
or open up access to your systems.
These threats are commonly the result of
minimal or non-existent checking of user
input within the program.
Steve McConnell, a well-cited author
of Code Complete, quoted the industry
average at 15-50 errors per thousand
lines of code (kloc). Latest estimates
suggest that Google has two billion lines
of code under its control with a reported
rate of five errors per kloc. Coverity, a
company specialising in static analysis of
‘Developers should limit the amount of
information returned in error messages that
could give away the software versions being
used, or hint at patterns in user data.’
code, estimates that to get this low rate,
each line costs Google $5. To put this in
perspective, Microsoft applications have
a reported 10-20 defects per kloc during
testing and 0.5 errors per kloc in released
products.
These numbers are estimates as there
is very little official literature in this area
with confirmed figures. Even with low error
rates such as these, the size of the code
bases large multinationals generate mean
that this is a serious concern. Typically,
a security defect in Android or Microsoft
Word is not likely to put lives in danger,
however NASA has rates of 0.004 kloc that
is reported to cost $850 per line of code.
From these figures we can conclude
that good quality code costs money and
there is a trade-off to be made between
security and cost.
What do we mean by secure software
development?
Let us now step back and consider, what
are developers trying to achieve when
we are discussing secure programming.
There are three primary areas of concern.
The first is confidentiality; the property
of ensuring that data and applications
are only accessed by authorised
parties. Common attacks for breaking
confidentiality are injection attacks and
cross-site scripting.
Integrity is the second property, which

is defined as the modification or deletion
of data by only authorised parties. If an
attacker can gain access to your systems,
then the integrity of the system may be
compromised. The impact they can cause
should be protected by limiting their
ability to escalate to that of privileged
user. Broken authentication systems are a
common vulnerability exploited by attacks
of this nature.
Finally, availability is our last key area of
concern. Availability is the timely provision
of service. A denial of access attack is a
common threat resulting in this type of
security issue. This can be caused either
externally by huge increases in network
traffic or internally through malicious
injection attacks.
No programming language is secure,
but many do now come with features that
can limit the likelihood of common forms
of attacks. C# has the concept of managed
code, limiting the potential for buffer
overflows. Ada, often used for military
scenarios, comes with additional compile
time checks and places constraints on
what the programmer can do. Most
languages, however, leave it up to the
programmer to ensure they are using best
practice and the latest versions of libraries.
Programming in a secure manner is
an incredibly difficult and challenging
area, and one which is a constantly
moving target for developers. There is an
asymmetry between the programmer and
any future attacker, in that the attacker only
needs to find one defect to exploit whereas
developers need to defend against all
known and future attacks.
Is Open Source more secure?
Security software can be divided into two
philosophies; open source software (OSS)
and proprietary software. The former
allows anyone to review the source code
for the application, while the latter treats
the source code as a trade secret.
One of the core benefits of open source
software that is often cited is that it is
more secure, as the code is open for
anyone to review and fix flaws in the
software. Underlying this statement is the
assumption that there are people who
actually review the code. This may be true
for the larger, more popular applications.
However, if your product contains code
from smaller niche libraries, it is unlikely
that this would have had the same level of
scrutiny.
For proprietary software, the source
code is hidden away as the intellectual
property of a company. This is also referred
to as ‘security through obscurity’. It would
seem to follow that if fewer people can
see the source code, there is less chance
of an attacker finding an exploitable flow.
However, this is not the case as attackers
can use reverse-engineering to decompile
the binaries and use specialist tools to look
for likely defects. This is an on-going arms
race between vendor and attacker.
On closer examination, the situation can
become blurred. A number of historic flaws
in proprietary software were found due to
defects identified in open source software.
This would suggest that the security of
both philosophies is intertwined. Most
software uses similar patterns of design
and common frameworks, therefore both
parties have an interest in identifying flaws
and working together to resolve defects.
There has been little academic research
in this area as quantifiable data is limited,
it is, therefore, unclear that either approach
is measurably more secure than the other.
There is nothing inherently more insecure
about either approach as long as potential
threats are dealt with and users are alerted
to update their installations.
How can you make your software safer
for your clients?
Like many areas of cybersecurity, security
comes from using best practice at each
stage. As a vendor, you should ensure
your software goes out with a secure
configuration. Clients should not be
required to make configuration changes to
make your product secure out of the box.
CERT, the security division based
at Carnegie Mellon University, offers
recommendations for software developers
to follow. Its primary recommendation
is filtering any inputs coming into your
system. White listing acceptable character
inputs is better than black listing as it
protects against future unforeseen exploits.
Developers should limit the amount of
information returned in error messages
that could give away the software versions
SECURITY
being used, or hint at patterns in user data.
Many applications use third-party libraries,
and these need to be kept up-to-date as
part of any distribution.
There any many tools now available for
References
a range of programming languages that
can help identify insecure development
patterns. These include static analysers
that analyse the source code, detecting
buffer-overflow issues and can prompt on
known insecure functions and libraries. In
addition, dynamic analysers can be used to
watch your code run and identify potential
security concerns such as passwords not
being erased from memory or memory
leaks.
As a system administrator, check
that you are following the vendor’s
best practice. Where possible it is
recommended that you deny all external
connectivity and only allow what is
specifically required for the application
to work. Keep your systems patched
and respond quickly to any notifications
sent by software vendors alerting you to
vulnerabilities. If your company wants
to go further, you can recommend
penetration testing; employing white-
hat hackers who will try and gain
unauthorised access to your infrastructure
for a given fee.
If you have older software then it is
recommended that you partition this away
from the wider infrastructure, that way
should a breach happen any intruder or
infection will be contained.
Be brave, but never take chances
Security will undoubtedly remain a
high-profile issue for developers for the
foreseeable future. However, through
education, better development tools
and improved deployment practices the
likelihood of a successful attack can be
minimised.
About the author
Dr Tom McCallum is the Academic Lead
Developer at the University of Highlands
and Islands, located at Moray College. Tom
has 11 years’ experience in both FinTech
and corporate IT environments developing
and maintaining a range of software and IT
infrastructure.
December 2018 ITNOW 43
 CYBERCRIME:
THE POLICE
RESPONSE
Detective Superintendent Andrew Gould, the National Cybercrime Programme Lead and
former head of the Met’s Cybercrime Unit, talks about the threat landscape and what the
police are doing to combat it.
The threat of cybercrime is ever present.
It seems not a day goes by without some
kind of data breach or cyber threat making
the news. But who is attacking us? What
are they doing and what are the police
doing to counter their threat?
The many faces of cybercrime
The threat from hostile state actors is
well known and significant. States with
substantial resources and highly educated,
Image: getty/Chalabala
technically sophisticated populations, and
who use cyber attacks to support wider
policy objectives, pose a real threat to the
UK, particularly when we consider how
networked we are and therefore potentially
vulnerable in the modern, globally
connected world. Publicly known examples
of alleged hostile state action include
Russian interference in the US election
and North Korea’s WannaCry attack that so
doi:10.1093/itnow/bwy102 ©2018 The British Computer Society
affected the NHS.
Outside of government and the critical
national infrastructure it is unlikely that
an organisation will be targeted by state
action. The biggest and most likely threat
to your organisation is from organised
crime groups. Such groups can be highly
capable themselves and are motivated
by the desire for financial gain often
through stealing data, money or intellectual
property.
44 ITNOW December 2018
Hacktivists who use hacking to make
a political point or to publicly embarrass
governments or companies continue to
pose a threat. Whilst they are far fewer in
number, if you are an organisation in their
sights, the damage hacking collectives
such as Anonymous could do could be
substantial.
The risk from cyber terrorists is
currently assessed to be low. While they no
doubt have the intent to cause harm, they
‘The risk from cyber terrorists is currently
assessed to be low. While they no doubt have
the intent to cause harm, they lack significant
capability. But that could change quickly.’
lack significant capability. But that could
change quickly. It would only take a few
extremists with advanced computing skills
to increase that threat substantially.
Next are our kiddie scripters. While they
may be relatively unskilled, given the lack
of effective cyber security we still see in
so many organisations, it is no surprise
that these young hackers are still able to
occasionally cause damage of the kind
experienced a few years ago by TalkTalk.
Finally, we see a perennial insider
threat. This threat can be deliberate,
from a disgruntled, corrupted or criminal
employee. Or it can be unwitting, when
a member of staff fails to identify a
cybercrime threat and accidentally enables
or falls prey to an attack.
The criminal marketplace itself is also
changing. We see lower barriers to entry
than ever before. Hacking and stressor
tools are readily available and easy to
download and use with video tutorials
from websites such as YouTube. Hacking
is not the preserve of the highly skilled but
can be undertaken with minimal skill and
preparation by almost anybody with an
internet connection. We also see a criminal
tools-as-a-service model with a global
marketplace for skills or exploits available
to rent or buy, often for nominal sums.
At the other end of the spectrum, high-
end capability, traditionally the preserve of
sovereign states, has fallen into criminal
hands and is now more widely available.
The Shadowbrokers group allegedly
obtained leaked US National Security

Agency tools and one of those exploits,
Eternal Blue, was used to help deliver the
WannaCry ransomware payload.
It is clear that the cybercrime threat
is more diverse, larger and technically
challenging than ever before.
Criminal motives and objectives
The most common threat remains from
ransomware with new strains or variations
on the old emerging all the time. Strong
perimeter protection, staff awareness
and effective, tried and tested backups
remain the best defence. If infected, you
may be lucky enough to find the private
key to decrypt your files on The No More
Ransomware website.
‘The majority of breaches are still due to well
recognised vulnerabilities. A lack of patching
continues to make organisations vulnerable.’
Large scale data breaches such as
those reported by Yahoo, Uber and Equifax
remain a daily occurrence with stolen
data often used to facilitate other crimes.
The majority of breaches are still due to
well recognised vulnerabilities. A lack of
patching continues to make organisations
vulnerable. Breaches are often followed
by an extortion demand for Bitcoin. Law
enforcement has had good success
locating and arresting cybercriminals for
extortion in the UK and abroad so it is
strongly recommended you call the police
if this happens to you. Check the Have I
Been Pwned website to identify any of your
own organisations credentials that are out
there.
Supply chain compromise is
an emerging and growing threat.
Cybercriminals exploit the opportunity to
attack organisations through third parties.
Last year’s NotPetya ransomware attack
was undertaken through the compromise
of a popular Ukrainian accounting app.
This attack caused huge disruption
and cost the shipping company Maersk
$300m alone. IT service providers are a
particularly valuable target. These attacks
are particularly hard to defend against as
they come from trusted third parties.
Distributed denial of service attacks,
where a website or other service is
overwhelmed with demand causing a loss
of the service, also continue in significant
volume. These are often used as a
distraction to cover for a network intrusion.
The relative importance of 24/7 customer
and staff access to different company
services will dictate how much you invest
in mitigation.
Less technically sophisticated, but
far greater in volume is business email
compromise, often leading to CEO or
mandate fraud. Cybercriminals use readily
available tools to spoof email addresses
and combine this with increasingly
thorough research on social media to trick
employees into sending them money -
often substantial sums. A lack of effective
in-house scrutiny and authorisation
processes has seen companies lose
millions in the click of a mouse.
The law enforcement response
The government has recognised the threat
from cybercrime as a Tier 1 national
security threat and is investing £1.9bn to
tackle it through the UK’s excellent National
Cyber Security Strategy and Programme.
For law enforcement, new structures,
additional resources and new capacity
and capability have led to substantial
improvements in tackling the threat at the
international, national and regional level.
There are excellent joint working
SECURITY
relationships between GCHQ’s National
Cyber Security Centre, the National Crime
Agency’s National Cybercrime Unit, the
Met Police and the Regional Organised
Crime Units and the fostering of a genuine
‘Team CyberUK’ approach. This approach
is bearing fruit as it tackles organised
cybercrime at the highest level.
What has been missing up until now
is the local policing response and a
strong victim focus. For most forces
cybercrime has not been a priority and
they lack officers and staff with the skills to
investigate or advise the public. So, these
crimes have been largely ignored. But
policing is changing.
In October 2017 the National Police
Chiefs’ Council agreed forces will establish
cybercrime units in every force in England
and Wales. The government has made
money available to help fund these teams
at the local level. This initiative will deliver
specialist cybercrime units to provide local
delivery of the cybercrime response. The
focus is on an improved victim experience,
an effective investigative response,
targeted local cybercrime prevention
messaging and work to identify and divert
young people vulnerable to cybercrime.
Forces will also work with businesses
to help develop effective incident response
plans and test them.
They will also become centres of
excellence for the wider force, such as in
the Dark Web and cryptocurrencies, helping
mainstream cyber skills and knowledge
into other areas of policing and the wider
workforce.
Policing is committed to improving its
response to cybercrime and providing a
more victim focused service to victims.
With funding from government these new
force teams will be in place by April next
year. By providing a truly local to global
response we can reduce cybercrime and
bring more cybercriminals to justice.
December 2018 ITNOW 45
 APP SIDELOADING
AND CYBER RISK
Robert Brady MBCS, senior consultant at Capgemini, considers the cyber risks posed by
sideloading in a popular mobile video game.
Fortnite is a multi-player survival game in
which 100 players compete online, guns
blazing, in a last-man-standing arena
battle. The game is available to play for
free, and has proven particularly popular
with older children around the ages of
12 to 16. Epic Games, the developer and
publisher of Fortnite, recently announced
that its upcoming Android port will be
distributed not through the Google Play
Store, as is typical for Android apps, but via
an installer available as a direct download
Image: getty/shulgenko
from their website.
Epic’s decision to distribute the game
deviates from the platform norm of
delivering applications through the official
app store and comes with a significant risk
of exposing its players to a multitude of
cyber threats, while also shining light on a
wider possibility of normalising what can
be seen as a dangerous trend.
doi:10.1093/itnow/bwy103 ©2018 The British Computer Society
Benefits of app stores
Traditionally on mobile platforms, software
and updates are made available through
a distribution platform specific to the
device – for Apple Devices it is the ‘App
Store’, ‘Microsoft Store’ for Windows and
‘Google Play’ on Android. The platform
owner, be it Apple, Google or Microsoft,
provides a marketplace and distributes
the software, eliminating the need for
the publisher to build and manage their
46 ITNOW December 2018
own distribution platform. In addition to
the benefits for developers, app stores
provide user benefits too, ranking apps
by popularity, allowing users to publish
and share reviews and ensuring apps
are automatically updated with the most
recent patches. In return, the owner of
the app store takes a cut from every
transaction, 30 per cent on Apple and
Google’s stores, the two most popular.
This is not an insignificant amount
and, while a desire to establish a ‘direct
‘Google’s researchers have already disclosed
that the first version of Fortnite’s Android
installer is susceptible to a ‘man-in-the-disk’
attack’
relationship’ with the game’s players
was Epic’s stated reason for distributing
their code themselves, it is reasonable
to suspect that the true reason behind
the move might be Google’s high fees,
something that Epic acknowledged was a
concern.
Aside from the usability benefits, this
established app store distribution model
also benefits the cyber security of users
and their mobile devices. While the level
of vetting is variable between stores, all
applications are curated to some extent
before being uploaded, which broadly
prevents fake applications or malicious
code from appearing on the store.
Applications are also ranked according
to the number of downloads and user
ratings, which means that malicious
applications with a low reputation, or those
that masquerade as another, popular,
application are inherently tuned and
filtered out from general visibility.
As users can be confident that software
on the store is unlikely to be malicious,
will be automatically updated, and that
undesirable applications are low on the
rankings, app stores are a mostly safe
space from cyber threat.
Sideloading and cyber risk
It is, of course, also possible to install
code outside the app store. It is possible
to download and run this code directly.
In Android’s terminology this is called
sideloading.
In principle, sideloading is no less
legitimate than running an installer on a
PC. However, this is disabled by default
on Android devices to protect users

from malicious code, and a user must
deliberately disable security settings on the
device to enable it. As Fortnite’s Android
version will be distributed directly, it will
require its users to disable these settings,
sacrificing the safety net of the controlled
app store and exposing the user to the
risks of uncontrolled and untrusted code.
‘There are suggestions in the wider industry
that the firm control over the mobile platform,
that key players enjoy, may be due to change.’
Most power users of technology will
be able to manage the risks they are
exposed to by this, and will likely be very
deliberate in how they use their technology.
Today’s teenagers, on the other hand, have
typically grown up with technology and
mobile devices being a part of their lives
since birth. As a result, while extremely
comfortable in their use, they can often be
confident to the point of complacency and
are generally far more trusting and less
sceptical of technology than those who are
a little older and probably a little wiser.
It is not unreasonable to expect that
many of Fortnite’s younger players,
potentially the majority, will either forget
or will not see the value in re-enabling
their security settings, or may grow tired
of needing to tweak them every time the
game requires a major update or reinstall.
Additionally, as it becomes expected to
install the game in this way, players may
be far more susceptible to being tricked
into installing a fake or malicious imitator
of the game – disabling the settings to do
so will result in no suspicion in and of itself
and already there are reports of malicious
applications imitating the legitimate
Fortnite app (which was perhaps inevitable
anyway).
There is also a real possibility that
requiring sideloading for what is sure to
be a popular app will result in normalising
what has to-date been a discouraged
approach to installing software. This may
result in further dangerous and risky use of
technology by users or developers; if Epic’s
decision to bypass Play Store proves to be
a success, it will surely encourage other
publishers to follow in their shoes.
Google’s researchers have already
disclosed that the first version of Fortnite’s
Android installer is susceptible to a ‘man-
in-the-disk’ attack, a newly discovered
form of vulnerability that can be used
to escape the Android sandbox and
access apps and data that should remain
private. This could have been used to trick
the Fortnite installer into downloading
malicious code with full access to the
mobile device. The installer is now patched,
and some of Google’s own applications are
also vulnerable, but it is a timely warning
and an embarrassment for Epic that has
resulted in a spat with Google over their
full disclosure of the vulnerability.
Looking forward
There are suggestions in the wider industry
that the firm control over the mobile
platform, that key players like Google enjoy,
may be due to change. Google recently
received an astounding €4.3bn antitrust
fine for illegally abusing its position as the
SECURITY
developer of Android and, in particular,
by essentially locking out competitors by
leveraging the necessity of Play Store.
Apple faces a similar case in the US
courts. Regardless of the merits, this
sort of legislative challenge will further
threaten the established models for mobile
computing and the safeties they currently
offer users.
IT practitioners should consider the
implications of this, and be mindful of
the possible future outlook. To draw a
contrast with PC software, it is generally
considered normal to run or install code
from uncontrolled or untrusted locations,
but the risk of malware and cyber-attack
is omnipresent compared to the mobile
landscape. As the use and sophistication
of mobile computing advances, it may
come to resemble the PC landscape in this
respect, which is fundamentally different to
the tightly controlled platform it is today.
This is a somewhat bleak perspective,
and hopefully a worst-case scenario. While
Epic Games will probably reap success in
distributing Fortnite directly, encouraging
other developers to do similarly, it
could also result in Android adapting to
accommodate the behaviour safely, and an
increase in freedoms on mobile devices is
not necessarily a bad thing.
However, macrotrends in computing
such as increased use of mobile devices,
and the freedoms and power of the
platform, result in increased risk to the
user. This necessitates a mindfulness of
the dangers and constant presence of
Cyber Threat in all its forms. The obligation
of IT professionals to encourage safe
behaviours by users is something, however,
that Epic has perhaps in this case worked
against.
December 2018 ITNOW 47
 GDPR
FOUR MONTHS ON
GDPR and the UK Data Protection Act 2018 (DPA2018) came into force in May 2018.
Four months on, Charlotte Walker-Osborn, Partner and Global Head of Technology Sector,
and Gayle McFarlane, a Privacy and Technology Partner, both from law firm Eversheds
Sutherland (International) LLP, give us some thoughts on the legislation with an additional
focus on biometrics in context of the legislation.
Businesses took vastly differing clearly substantial and aimed to ensure ICO will need to issue any penalty, taking
approaches in their seeking to achieve companies maintain this continuing into account the considerations set out in
compliance with GDPR (including as to compliance with GDPR. the GDPR, as well as the Data Protection
their timetable). That said, most took the Fines for breaches will be considered on Act 2018, which include considering the
task very seriously. The Data Protection a case-by-case basis. They will take into degree of responsibility. To therefore try
Act 2018 (DPA2018) itself, however, came account criteria such as the intentional to recover a penalty from a counterparty
to the statute books rather late, putting nature of the infringement, how many data which was issued to you on the basis that
businesses under pressure to map over subjects/people have been affected and the ICO considers you to be responsible
whether compliance with GDPR meant whether there have been any previous could involve arguing that the ICO had
compliance with the DPA2018 and infringements by the business. got this assessment wrong. So, it’s not
Image: iStock.com/Scyther5

whether there were additional nuances. In as simple as allocating responsibility in a

any event, data protection is not the kind of
‘compliance’ that means that you can ever
say: ‘job done’.
Money, money, money
The greater financial responsibility for
any breaches of the GDPR has been a
key driver for many businesses in their
efforts to be as compliant as possible
doi:10.1093/itnow/bwy104 ©2018 The British Computer Society
Allocation of liability
Whilst we await the first enforcement
actions and compensation claims,
suppliers and customers are continuing to
debate how (generally by way of a written
contract) liability should be allocated
between them if there is a breach.
For compensation claims from
individuals, the GDPR states that the
contract and being comfortable you can
rely on that contract.
Indeed, we await clarification as to
whether penalties/fines under the GDPR
could be unrecoverable from your third
party suppliers (even if contracted for)
at law as being ‘against public policy’
– in other words, whether allowing an
organisation to recover a penalty issued

and, crucially, to maintain continuing
compliance.
There are two levels of fines under
the GDPR: a fine of up to €10 million or
two per cent of the company’s global
annual turnover of the previous financial
year (whichever is higher) or a fine of
up to €20 million or four per cent of the
company’s global annual turnover of
the previous financial year (whichever is
higher), and the level depends on the type
of infringements. The potential fines are
individual can bring that claim against any
controller or processor who is involved
in the processing – unless they can
demonstrate that they were not in any
way responsible or, if a processor, they
had complied with all of their obligations.
Both parties to a transaction are, therefore,
often looking for protection if they need to
pay out but it is the others’ fault.
Many organisations are also looking for
protection if they are subject to a penalty
notice. This one is much more difficult. The
under the GDPR/DPA2018 is in the public
interest, or should organisations face up
to the fines that the regulator has meted
out to them? This will be an important
development to watch.
What about insurance?
The insurance market for these types
of losses is not yet mature. It’s worth
checking in detail that the coverage
offered will be sufficient for the losses
you fear you may suffer, but also look

48 ITNOW December 2018


out for terminology such as ‘to the extent
recoverable’, as your insurers may well
exclude coverage for loss which they
cannot recover against another party (for
example, your supplier/sub-contractor),
placing the risk of these public policy
arguments being raised again in your
corner.
Sensitive data, but not as we know it
One of the things your GDPR compliance
plan will or should have touched upon
is creating your record of processing
activities, or ROPA, required by Article 30
of the GDPR. This may be the first time
you’ve/your business has sat down and
considered where and when your business
is processing personal data. And then
businesses have had to consider why, and
which of the prescribed lawful bases for
processing apply to these existing activities.
Let’s take, for example, biometrics.
One change under the GDPR that
may not have jumped out at you is that
biometric data, which is used for the
purposes of uniquely identifying an
individual, explicitly qualifies as a ‘special
category of data’, or ‘sensitive personal
data’. This means that, as well as having
‘The greater financial responsibility for any
breaches of the GDPR has been a key driver
for many businesses in their efforts to be as
compliant as possible.’
one of the standard lawful bases for
processing (such as legitimate interests),
you also need an additional lawful basis, as
set out in Article 9 of the GDPR, and, where
required, authorised by Schedule 1 of the
DPA2018.
This can pose a challenge for the use
of biometric data for things like allowing
security access to buildings. Article 9 of
the GDPR is quite restrictive and protects
sensitive data (in its view for good
reason). We cannot change our biometric
information. If it gets into the wrong hands,
there’s no password reset.
Whilst some providers may argue that
because their systems simply store a
code generated from specific points on an
individual’s fingerprint, iris or palm scan,
they are not actually storing any biometric
information. However, the definition is
very clear – ‘personal data resulting from
specific technical processing relating to
the physical, physiological or behavioural
characteristics of a nature person, which
allow or confirm the unique identification
of that natural person’ – exactly what these
scans do.
So, assuming that you are comfortable
that your business’s processing of
biometric data is justified on the basis of
legitimate interests, and you’ve carried
out your legitimate interests assessment
to ensure that the rights of the individual
are not infringed, how do you comply with
Article 9?
Whilst this data is often used to create
better records to assist with any legal
claims, or to assist organisations in
complying with their legal obligations
such as food safety, by ensuring restricted
access to certain areas, it is difficult to
demonstrate that these are ‘necessary’
for these purposes, as alternative (and
arguably less privacy intrusive) methods
are available and widely used to achieve
those same ends.
In many cases, organisations are left
with the option of ‘explicit consent’. In
the context of employees, it is generally
LEGAL
accepted that consent is incredibly difficult
to achieve, as it is a requirement that it
must be freely given, and the imbalance
of power between an employee and their
employer infringes upon this freedom. Not
least, it’s an important aspect of consent
that it must be capable of being withheld
(and indeed withdrawn). If there’s no other
way to access your workplace, no other
mechanism to identify employees, then
how is consent achieved? This needs
considering carefully for an organisation’s
individual circumstances.
Compliance is a journey
Whilst organisations and the regulator
continue to adjust to the new regime, new
guidance and practical challenges continue
to arise. There’s more scrutiny being given
to the status of controllers and processors,
and market positions on contract clauses
and due diligence slowly settling in. And
UK businesses may also need to start
considering the impact of Brexit on any
transfers of data with the EU27/other
countries in the EU.
Data protection compliance is a journey,
and must be continuously refreshed.
Whatever you do, if you focus on the
GDPR’s general principle of accountability,
and that your organisation needs to take
responsibility for how it uses data, that
vigilance should keep you on the right
track.
Please note that the information provided
above is for general information purposes
only and should not be relied upon as a
detailed legal source.
December 2018 ITNOW 49
 A SMARTER
APPROACH TO
CITY LIVING
Adam Simmonds, Cloud and Identity Architect from Coventry City Council, explores the
diverse approaches of smart cities across a variety of international cities, reminding us
that becoming a smart city is a journey, not a status.
Have you just thrown some litter into a
bin in your city centre? Has that bin just
reported back to say how full it is and
when it next needs emptying? Is that bin
solar powered?
Whether you want to or not, it
is impossible to escape the digital
transformation in your private life. Digital
seems to be ‘all the rage now’ and is
having to become a fundamental part of
city development. This has given rise to the
Image: Getty/LeoPatrizi
notion of smart cities but, with each city
having a different make up of residents
and visitors, how is a smart city defined?
In June this year, a delegation from
Coventry City Council was invited to join
with Keil, Germany, and other twinned
international cities to discuss how cities
deal with digital transformation. Each
delegation was asked to respond to
doi:10.1093/itnow/bwy105 ©2018 The British Computer Society
the same seven questions: ‘how smart
are our partner cities?’, ‘what has been
achieved?’, ‘what is still to be done?’,
‘does the government play a leading role
and how?’, ‘which other players from the
economy, science and society are rising to
the challenge?’, ‘are there joint objectives?’
and ‘what are the data protection and
security risks?’. What was fascinating
is that each city responded to the same
seven questions, but all had a different
interpretation of what a ‘smart city’ is -
50 ITNOW December 2018
although there were two emerging key
themes: e-government and creating a
‘digital place’.
E-government
A significant majority of the
international cities represented focused
on the improvement of council
administration as their interpretation
of ‘smart cities’. This included channel
shift via customer portals to reduce the
number of contacts to services via face-
to-face or telephone and a big emphasis
on the reduction of paper. To some extent,
this way of interacting can be taken for
granted, but in many cities really does
drive a change in people’s lives.
As an example, the Moshi Rural District,
Tanzania, is a popular tourist destination
but still suffers from famine, specifically
within its farming regions. Approximately
80 per cent of its farming community has
access to smartphones and connectivity
so they can check prices, their bills, and
buy and sell their produce online rather
than having to travel to markets and city
centres, giving them more time to focus on
growing crops.
In Brest (France), Malmö (Sweden)
and Hatay (Turkey), the focus has been
to provide open access to the variety
of data sets ranging from district
health information all the way to city
planning. In some cases, there have
been partnerships with local property
development companies allowing them
access to planning information about
public buildings, playgrounds, construction
sites, and childcare facilities. This is then
combined with sensor data to help model
and predict future demand, matched up
with health and education needs within
that area of the community, whilst enabling
residents to comment and engage with the
planning approval process online.
Everyone commented that there is
continued reluctance from residents to
engage like this, largely due to a lack of
digital skills as well as diverse cultural
groups. Kiel’s approach to overcome
this was a ‘digital week’ that promoted
learning and fostered partnerships
between communities, local authorities
and businesses. For example, a newspaper
company had noticed a decline in
the number of print versus online
subscriptions, but there was reluctance
from the remaining print media readers
to switch to the online version because of
skills. Sensing a good business opportunity,
they had started to offer free digital and
computer skills workshops to residents.
Although not entirely altruistic, those
skills learnt have helped engage people
 SMART CITIES

further in government. The ‘digital week’,
driven by the city administration with
little budget and no programme, proved
so successful that it’s likely to become an
annual event.
Digital place
The second theme to emerge from the
talks was around the actual physical
aspect of the cities, the public realm and
this notion of a ‘digital place’. The ability to
provide good, fast reliable connectivity and
for a city to change, adapt and respond
‘automagically’ based on sensors. The
growth of the internet of things has really
opened the world of sensors and data
reporting that can help drive how a city
centre space works.
Take the Smart-Big Belly bins,
something San-Francisco and Coventry
have in common. They are solar powered,
connected bins fitted with sensors that
provide real time alerts when they are full
or reaching capacity. These alerts are then
passed to refuse vehicles and collection
teams who can respond accordingly,
preventing expensive spillages and
unnecessary journeys.
Later this year, paying respect to
Coventry’s car manufacturing history, the
emergence of sensors will increase as
we see autonomous vehicles on Coventry
roads as part of the UK Autodrive project.
This will be expanded to form a West
Midlands testbed as part of the connected
autonomous vehicles (CAV) project, which
is focused on getting vehicles to talk to
each other and their surroundings over a
5G network.
The goal within Coventry is to create a
platform that can be used by residents,
local universities and businesses to
innovate on, and engage with, a real-world
environment, a ‘living lab’. Plans are afoot
to install a low power wide area network
(LoRaWAN) utilising various tall buildings
across the city for an internet of things
(IOT) network across the city for sensors,
monitoring and connected devices.
Most of the delegations touched on some
elements of ‘digital place’ with ambitions
to improve their cities’ internet availability,
transport networks and smarter connected
technology, but said they are being held
back by poor connectivity. Surprisingly in
some cases, it was the opposite of what
we see in the UK, with rural areas being
very well connected, but the denser urban
populations not. Even in areas where
you’d assume fast, good connectivity was
the norm, that’s not always the case.
For example, up to 15 per cent of school
children do not have internet access at
home within San Francisco.
Living lab and platform for innovation
So, if all this and more was discussed
in a couple of hours by cities all trying
to answer the same seven questions,
when do you become a ‘smart city’? It
shows that whilst every city is striving to
achieve a ‘smart city’ status, it’s not easy
to define what a ‘smart city’ is. In some
cases, the local authority’s IT department
is continuing with the internal business,
but also having to engage in city-wide
technology innovation. Coventry has
found itself an ideal ‘living lab’ due to its
geographical size, two top universities
and connectivity that provide a platform
for innovation. Since being announced as
UK City of Culture 2021 there has been an
increase in technology partners wanting to
engage.
It’s hard to say if a ‘smart city’ is
determined based on its implementation
of e-government or digital place initiatives
as it is different for each country, city and
person, and technology evolves very fast.
Gdynia, Poland, summed it up nicely with
a simple goal of being a city to ‘deliver
quality of life’, which when it comes to
smart cities is the use of technology to
enable that, in a sustainable way.
Cities in attendance
Brest, France,
Coventry, Great Britain,
Gdynia, Poland,
Gothenburg, Sweden,
Hatay, Turkey,
Malmö, Sweden,
Moshi Rural, Tanzania
Riga, Latvia,
San Francisco, USA,
Stralsund, Germany,
Tallinn, Estonia,
Vaasa, Finland,
Keil, Germany

December 2018 ITNOW 51

 WHY 3D VIRTUAL
LEARNING
FELL FLAT
Paul Jagger FBCS asks: whatever happened to virtual reality learning platforms, and is a
second life being given to Second Life?
It wasn’t all that long ago that virtual
worlds were being touted as a platform
for design, development and delivery of
all manner of enterprise learning needs.
Second Life, Thinking Worlds, Unity3D and
others were all making inroads into the
realm of corporate learning and there was
a buzz about it in the L&D market, which,
at the time, had a reputation for churning
out spectacularly boring and poorly
designed compliance-based eLearning.
One major mobile phone network with
whom I worked back in 2008 had a vision
of enlivening their learner experience by
Image: Getty/MmeEmi
providing a 3D avatar-based portal into
their learning management system, which
at the time hosted solidly 2D page-turner
eLearning of a very pedestrian nature.
Another client envisaged classrooms
and conferences being hosted in a 3D
virtual world, with break out rooms for
smaller coaching sessions and even
©2018 The British Computer Society
professional examinations being delivered
in this virtual world.
These were just two among many
exciting opportunities to explore the
capabilities of 3D virtual worlds as a
platform for learning, so 10 years later
what happened? Why have 3D virtual
doi:10.1093/itnow/bwy106
worlds not become a mainstream aspect
of workplace learning for the vast majority
of learners?
On the face of it 3D virtual worlds had
enormous potential with their ability to
personalise the learning experience, to
52 ITNOW December 2018
handle vast audiences, to recreate costly
physical learning environments in a digital
realm, and to allow social collaboration
between learners.
Novelty is not the same thing as utility,
and yet the novelty of 3D virtual worlds
caused such excitement that questions
about its applicability or usefulness to
work-place learning were peripheral
to the ‘wow’ factor of experiencing
something new and engaging. However,
the promise of 3D virtual worlds had some
fundamental drawbacks, from a learning
perspective, that haven’t been overcome.
Complexity of the user interface
Most 3D virtual worlds allow an enormous
degree of customisation of the user’s
avatar, and permit a bewildering array
of actions and interactions in and with
the virtual world. If you want to swim,
fly, hover or dress up as a dragon its
all possible in a virtual world, but with
this immense flexibility comes a level of
complexity in the user interface that can
take days to master. Learners cannot
spend hours learning the user interface,
especially in an era when they are time
poor and need to learn ‘just enough, just
when they need it’.
Another consequence of the complexity
of the user interface is that experienced
learners have to put up with a constant
supply of uninitiated learners operating in
the environment, and this can be a source
of frustration and distraction, not least the
instructor or facilitator.
Technical demands of delivery
At the time when 3D virtual worlds were
receiving lots of attention as a platform
for workplace learning the technical
specifications required to deliver the
learning were beyond the reach of many
desktop PCs.
High demands on graphics processing,
memory and network bandwidth meant
that few users could experience 3D in the
glorious detail and smooth rendering that
had become the norm on games consoles.
While desktop PC specifications have
since caught up, the shift to mobile and
tablet devices has created new technology
barriers to adoption.
Distractions of the virtual world
Several companies won major industry
awards for their deployment of learning in
3D virtual worlds, by building environments
that allowed classroom learning, coaching
and assessment to be deployed without the
need for physical infrastructure.
However, the 3D virtual world was often
used to deliver 2D slide-ware, facilitated by
an instructor using audio to present to an
audience seated in a virtual lecture theatre.
In these situations, the distractions of the
virtual world simply replicate those of the
real world where bored learners will look
for stimulation elsewhere.

When the user can interact with the
environment there is a temptation to
explore the environment rather than focus
on the learning. The environment also
becomes a distraction when 2D content
is deployed in a 3D world, such as a slide
presentation, application simulation,
reading an article or watching video.
These elements need to be delivered
through a 3D object such as a virtual
screen or virtual computer terminal, which
usually cannot be expanded to full screen,
thus leaving the learner watching, listening,
reading or interacting without the benefit of
a full screen experience.
Cost and complexity of building the
virtual environment
While virtual worlds are usually far less
costly and time consuming to build than
their physical equivalent, they are much
more expensive than using virtual meeting
software to bring an audience together
in real time. The advent of technologies
such as Saba Centra, Interwise and
Adobe Connect rapidly enabled delivery of
synchronous learning through the web.
More recently the development of Webex
and Zoom with video, screen sharing and
recording capabilities has made virtual
classroom delivery a viable option for just
about every business. 3D virtual worlds
almost always require a client component
installed on the user’s computer, which
in turn creates barriers to adoption in
environments where the installation of
third party software is tightly controlled
and subject to extensive testing, such
as financial services or defense and
intelligence agencies.
Accessibility compliance
Conforming with the Web Content
Accessibility Guidelines (WCAG) has
become a good practice and requirement
for most technology-enabled workplace
learning. Accessibility is a particular
challenge for 3D virtual worlds as it is
exceptionally difficult to meet the WCAG,
especially for the blind, but also for those
with auditory, cognitive and mobility
limitations.
Often the best way to deliver
accessible learning in a 3D world is by an
accommodation whereby the learner is
assisted by another person who navigates
the world for them.
Licensing of IP
By far the most popular of the platforms
for developing 3D virtual worlds is Second
Life by Linden Lab. Second Life and all of
its derivatives include a licensing clause
whereby the user grants Linden Lab ‘the
non-exclusive, unrestricted, unconditional,
unlimited, worldwide, irrevocable,
perpetual, and cost-free right and license
to use, copy, record, distribute, reproduce,
disclose, modify, display, publicly perform,
transmit, publish, broadcast, translate,
make derivative works of, and sell, re-sell
or sublicense and otherwise exploit in
any manner whatsoever all or portions of
the user’s content.’ (Source: Linden Lab
Content Licensing and Intellectual Property
Rights (2018).
This clause also touches the new virtual
reality platform Sansar, developed by
Linden Lab and as such it makes these
platforms unattractive to any workplace
learning where commercially sensitive,
LEARNING AND DEVELOPMENT
confidential or commercialised learning
content is delivered and where the owner
of the IP wishes to retain full control of the
content.
So is there still a place for 3D virtual
worlds in learning?
3D virtual worlds still exist and have
their uses for learning, especially where
interaction with the environment or with
3D objects in the environment is vital to
the learning experience. For example, the
Fire Service College in the United Kingdom
uses 3D virtual worlds to train and assess
firefighters in situations where it would be
dangerous, inordinately complex and costly
to conduct the training in the real world.
The emergency services and armed forces
make extensive use of 3D simulation for
training purposes and one of the leading
providers in the field is XVR Simulation.
In short, any situation where the learning
experience involves navigating a virtual
environment (e.g., evacuation of an oil rig),
handling 3D objects (e.g., fork lift truck
training) or is safety critical (e.g., piloting a
ship into dock) is well suited to 3D virtual
worlds.
These specific examples aside, for the
most part 3D virtual worlds as a platform
for corporate learning seem to have gone
the way of 3DTV, a short-lived novelty that
never really lived up to its initial promise
and has since been displaced by YouTube,
Netflix, Amazon Prime and a plethora of
content libraries we can access from our
mobile phones.
December 2018 ITNOW 53
 WHY DO SOME
PROJECTS FAIL?
(AND SOME SUCCEED?)
Understanding project failure is the first step to putting project management right.
Elizabeth Harrin FAPM explores why businesses and leaders are so slow to learn the
past's most important lessons.
Every researcher, management guru and
project manager have their own view on
why projects fail. Project failure – and
preventing it – has been the subject of
countless academic studies, surveys and
books over the years. So why are we still
talking about it?
There are two reasons why project
Image: GettyImages/filadendron
failure is still such a hot topic. First,
while many business leaders may
understand the causes of project failure
at a theoretical level, they genuinely don’t
understand what that means for their
business. Second, the causes of project
failure are changing as our economy and
business context evolves.
Beyond academic reasons for failure
Projects fail for dozens of reasons.
doi:10.1093/itnow/bwy107 ©2018 The British Computer Society
Business leaders and project managers
may be able to recite the list of reasons in
the box, but they also need to be able to
do something about them. For example,
knowing that poor strategic alignment is a
major reason for project failure is not the
same as redesigning the project kick-off
process to ensure a good strategic fit from
before the business case is even approved.
Poor project management practices
might stand out as a reason for
businesses with low project management
54 ITNOW December 2018
maturity, but is it best addressed by
sending team leaders on a PRINCE2
course? Perhaps a better step would be to
review internal processes, gain executive
support for doing things in a ‘project
management-y’ way and build from there.
Projects fail because businesses fail
to work in a way that leads to success. In
other words, all the good practices we’ve
known about for years somehow aren’t
routinely in use, because other stuff gets
in the way.
'We need project management officers to
lead on embedding good practices - calling
out leaders who fail to create an environment
where projects can flourish.'
We need project management officers
(PMOs) to lead on embedding good
practices, acting on lessons learned
(instead of simply capturing them) and
calling out leaders who fail to create an
environment where projects can flourish.
The evolving concept of failure
Businesses today face new challenges:
the gig economy, tech that evolves faster
than we can keep up, how to interface
dozens of systems, innovation as standard,
Brexit, and running effective flat and virtual
teams. Just as with that economic context,
our understanding of the potential that
projects have to offer has moved on too.
Back in 1994, the original CHAOS
report from the Standish Group defined a
‘challenged’ project based on hitting time,
cost and specification targets.
While no one would argue that these are
totally relevant today, they are no longer
the measures that matter the most. You
can be within schedule, budget and quality
tolerances and still deliver something that
nobody wants.
Benefits, outcomes and value should
matter far more to project teams than the
old constraints.
Success looks different for every project,
and therefore so does failure. When leaders
stop thinking about failure in an academic
sense and start creating an environment
where what it means to fail is understood

per project, we’ll see teams empowered to
be successful.
Why some projects succeed
Project success is simple. Projects succeed
because they are the right projects and
because they are done right. If you can find
a way to get those two conditions in place,
you’re on the path to a successful delivery.
'Ultimately, it is the end-user or customer who
decides whether the project is a success.'
However, there is a pre-requisite step
before that which must be in place if you
are to have any chance of turning in a
project successfully.
What does ‘success’ mean?
Experienced project managers will have
heard the phrase ‘the iron triangle’, which
is shorthand for saying that time, cost and
quality are the constraints that bind every
project. Experienced project managers
will also know that the concept of there
being only three constraints that underpin
success is actually nonsense today.
Success looks different on every project.
On some, it might be hitting a particular
deadline, such as a regulatory change
like the introduction of GDPR. On others, it
might be delivering the lowest risk solution,
or something that has the most impact on
customer satisfaction or saving 20 per cent
of time spent on a process, or
something else.
More likely, it’s a combination of factors.
We need to rethink what it means to be
successful beyond project management
measures, and realise that, ultimately, it
is the end-user or customer who decides
whether the project is a success or not.
Once you’ve worked out what success
looks like for your project, you can then try
to get there.
Doing the right projects
Successful projects are the ones that are
the right projects for the business. You
need to look for strategic alignment. There
needs to be management support. The
project should contribute to the overall
organisational objectives somehow.
In other words, there needs to be a clear
decision taken about why this is the project
to be doing right now, with the resources
you have and the budget available. Or
is there something else you should be
working on that would be a better choice?
A project with a strong reason for being is
starting off with all the hallmarks of being
a success, because people want it to be a
success and the business needs it to be a
success.
Doing projects right
Common causes of
project failure
• Lack of executive support
• Poor strategic alignment
• Poor risk management
• Poor communication
• Poor project management
practices
• Delays to decision making
PROJECT MANAGEMENT
Alone, choosing the right projects isn’t
enough. They also have to be executed
effectively. You can have the best list of
projects in the world, but if no one has
the skills to coordinate the team and get
work done, you’ll hit delays, overruns,
communication problems and all the
reasons projects struggle.
Too often, businesses think that ‘doing
projects right’ means sending a member
of the team on a course to learn how to
be a project manager. They return to the
office five days later, magically equipped
to implement project management
techniques to keep work on track and
customers happy.
In reality, it takes experience, learning
from your mistakes, and a supportive
culture where project management isn’t
simply an add-on but an embedded way
of approaching work. Doing projects
right takes experience and a supportive
culture where project management isn’t
simply an add-on but an embedded way of
approaching work.
A successful project is never delivered
by a single project manager, but by a
team working in an organisational context
where success is expected, supported
and made possible, and where failure is
identified early and embraced as a learning
opportunity.
Strong project management practices
and a willingness to support continuous
professional development will help ensure
that projects are done right.
When you know what success looks like,
you have a clear steer that the project is
an appropriate one for the business and
you have the ability to manage the work
effectively, you have the makings of a
successful project. Good luck!
About the author
Elizabeth Harrin is an award-winning
project management blogger and author
of Project Manager: Careers in IT Project
Management, available in the BCS
Bookshop.
www.bcs.org/books/projectmanager
December 2018 ITNOW 55
 CHINESE BAMBOO:
SOCIAL START-UPS
Chen Mao Davies has experience at the confluence of many strands
relevant to BCS: she has a PhD in computer graphics (being part of
an Oscar and Bafta-winning world-class R&D team); she is a tech-
entrepreneur; and her developing business is one with a
demonstrable social benefit. Brian Runciman MBCS spoke to her
about her app and lessons learned from her start-up.

Like many business passion projects, mouth.

Background:
breastfeeding support
Breastfeeding support groups are very
popular and highly rated according to
LatchAid’s recent user survey
receiving 100+ responses from mums,
mums-to-be, and breastfeeding
professionals from six different
countries. Mums need emotional and
peer-to-peer support to persevere
during the breastfeeding journey
Image: istock.com/persanitfoto
Chen’s motivation for launching an app to
support breastfeeding was based on
personal experience. ‘When I left the
hospital after having my first child,’ she
says, ‘I felt isolated, emotional, out of my
depth. I was a first-time mum, wanting to
do my best, but I didn’t know how. You are
always told breastfeeding is a beautiful
thing, it has great health benefits, it’s free
and is a powerful bonding experience for
mother and baby. However, mothers aren’t
really well prepared, they have no idea of
the time required, local support can be
minimal or like a postcode lottery, and on
top of that, you get differing advice from
midwives.’
As she spoke to other mothers during
the gestation of her project, Chen found
In addition to the multiplication of costs
to health services (see ‘Facts at a glance’)
there is also the suffering of the individual
mother. As Chen explains: ‘It is easy to
suffer things like cracked nipples when the
latching is not right and even worse when
you are physically and emotionally drained.
I had mastitis three times, then got thrush
after the antibiotics. Then baby also gets
thrush and can pass it back. It’s a
horrible cycle.
‘In those circumstances the pain of
feeding can be intense. For me, it was like
stabbing a knife inside my breast during
the initial moments of latching, sometime
felt even more painful than childbirth.
On top of the physical issues there can
be anxiety induced with the demand to

especially during the early days.
During the questionnaire and
interview study, lots of mums spoke
about the difficulties and isolation they
feel during the middle of night, between
breastfeeding support groups (running
weekly), and when they couldn’t reach
the support groups (breastfeeding
doi:10.1093/itnow/bwy108 ©2018 The British Computer Society
her experience was typical. ‘It seems that
health professionals are sometimes too
quick to recommend formula ahead of
trying to solve breastfeeding problems.’
‘In addition to first-time mothers not
being trained for breastfeeding, our
studies also showed that they had poor
experiences with midwives and GPs.
constantly feed.’
‘Despite challenges during early weeks’,
Chen added ‘breastfeeding gradually
becomes easier with perseverance
and I went on to feed my son till he
was two-years-old and am currently
breastfeeding my baby daughter. The
benefits, convenience, and bond brought

support groups are patchy and lack
funding, and mums sometimes struggle
to attend groups due to physical and
emotional constraints).
The survey showed 78.5 per cent
experience ‘pain and health issues’ (i.e.
sore/cracked nipples, mastitis, thrush,
tongue tie) and 60.2 percent suffer from
‘difficulties in latching-on’ - making
these the two biggest challenges.
Indeed, for GPs, breastfeeding education
appears to be optional. However, lots of
mums had a much better experience with
health visitors and breastfeeding support
counsellors.’
Chen did what many people doubtless
try - to find a video on YouTube. She found
lots of talking but very little that was
visual. What there was employed awkward
camera angles – for example, being unable
to see nipple placement in the baby’s
by breastfeeding are truly amazing and all
worthwhile’
So, what next? Chen explains: ‘I thought,
I work on movies so why can’t I try to solve
a relatively smaller problem like this using
my skills and experience?’
Chen’s idea was for an app to support
one of the key difficulties a new mother can
experience with breastfeeding: latching-
on. The original concept was to produce
a world-first 3D interactive breastfeeding

56 ITNOW December 2018

 SOCIAL START-UPS

Facts at a glance
• 130 million babies are born worldwide annually
• 775,000 babies are born in the UK annually
• The UK has the worst breastfeeding rate in the world. After six months only 1 per
cent of women are still exclusively breastfeeding (for reference, in Germany it is 23
per cent, Brazil 56 per cent, and Senegal 99 per cent)
• Poor latching causes sore nipples, mastitis, thrush, anxiety for mums and weight
gain problems for babies
• Increasing the breastfeeding rate in UK can save the National Gross Income 0.5
per cent, save the NHS 40 million pounds per year, and save a new family a
minimum of £60 pounds per month
• Failing to breastfeed costs the world $302 billion PA
• NHS costs for excess appointments for babies fed on formula (as they are more
prone to illness) runs at £50 million PA

app that utilises cutting-edge 3D scanning, ‘Part of getting the basis right is to For example, I was able to get in contact
motion adaptation, and augmented reality remember to always talk to customers. with Dr Natalie Shenker, the co-founder
technologies. This could help mothers Test the idea. The most challenging bit of of Hearts Milk Bank and Human Milk
to learn visually, thus improving their my app was the 3D scanning, but when we Foundation through my business
latching-on skills. In addition to creating did research later (through a recent online advisor Mark Goodson, at Cambridge Social
personalised 3D breastfeeding animations user study involving 100+ mums, mums- Ventures, where LatchAid is incubated.
in different breastfeeding positions - using to-be, and breastfeeding professionals And through her, I got to know some
3D scanned shapes of the mum’s own from six different countries) I found that influential people including the chair of
breast and first-person cameras as a the demand for this feature was lower than the Association of Breastfeeding Mothers.
visual guide - LatchAid also aims to help expected. I should have spoken to mums Getting involved with the West of England
breastfeeding mothers and mothers-to-be earlier in the process.’ Academic Health Science Network (that
everywhere to connect with and support connects the NHS, academic
each other 24/7 in virtual breastfeeding 2. Partner up! organisations, local authorities, the third
peer-to-peer support groups and to provide ‘Using an incubator gives you a network. sector and industry) through their Health
a platform for mothers to connect with
breastfeeding professionals when they
need further one-to-one support.
In early 2018 Chen started development
on the app itself, putting together the
business case for it, setting up LatchAid
Ltd (with the social mission to help
more mums to breastfeed), as well as
researching, networking, and applying
for grants and investment. Chen told me
the key lessons she has learned so far in
running a multi-strand project:

1. Get the basics right

‘You need to get buy-in from your family
to be a female entrepreneur. The social
expectation is to look after children and
many mums want to work too, so you need
to make sure you don’t burn yourself out. If
you die the company dies!
‘Try to build a team before you set out.
When you are solo, investors don’t take you
seriously. If you get a good team in place, it
can be those who inspire you.

December 2018 ITNOW 57

 4. Go agile
‘I learnt about project methodology in
practice and I would say it has to be agile.
I have been a software developer for over
10 years and I know that if it’s not agile you
will develop things your customers don’t
want. Even brilliant products or features
can be unwanted. Combine agile with the
learn-develop-data collection cycle. New
ideas go into each iteration. It can be hard
to do scrum religiously but do your best to
follow the principles and don’t do waterfall.
Make and test assumptions as early and
frequently as possible.’

5. Choose a passion project

‘With a passion project you are the user
and developer - you know the pain. For
my app I knew the pain points emotionally
and physically and wanting to help other
Innovation Programme and business level of funding. So far it has only been web mums made me even more motivated.
support– was also very helpful. hosting, an intern, and 3D animation Doing something that has social impact is
‘For example, I have learnt that I need assistance from friends at work. I have important - I don’t want this to be only for
to launch in the App Store first, because been doing the app development myself. profit - 800,000 children die a year through
the NHS is evidence-based and launching ‘Now I need money for final animations lack of breastfeeding.
to the consumer market first gives us and refining the app. The experience of ‘The benefit of this product needs to
opportunities to collect data and evidence applying to join Bethnal Green Ventures’ go to people, so in each country we are
to demonstrate the effectiveness of the app accelerator programme and attending planning for pricing relative to the local
before we could collaborate with the NHS the Health Innovation Programme, economy.
in the future. helped me to learn pitching in front of a ‘My feelings were reinforced again
‘Joining support networks of other panel of investors and experts. So now I during our research phases. It turns
entrepreneurs, such as start-up accelerator am focusing on producing a “minimum out that mums were very happy to be
programmes, meetup events, and so on, is marketable product” using the lean start- advocates and easily share stories. They
excellent. The advice and support I received up approach. have a willingness to help other mums.
from the business advisors and fellow ‘For my intern I used the support Our research has told us they will buy the
entrepreneurs at the Cambridge Social from The Student Hub, through their product and advocate it too.’
Ventures incubator programme was, and Social Impact Internship Programme
continues to be, immense. which links students with organisations/ 6. Maintain perspective
‘That was crucial for LatchAid’s projects for social good. My intern Kelly ‘Be adaptable and versatile. I have two
development at this stage of its start-up Wing did a social media launch and an young children with one still being
journey. online user study during her seven weeks breastfed, so I plan what time I can likely
‘In another area of partnering, I come summer placement project. She designed do chunky work, and when smaller things
to realise more and more that I need a questionnaires, undertook interviews, may be done. I always try my best to
co-founder. That needs to be someone you wrote a comprehensive user survey report, prioritise the children and family - work
get on with. And you need other advisers to and produced the infographics and pitch can always fill your time. And, if you look
use as a sounding board. Don’t just develop video. She, as a talented first year student after yourself, then you can work better.
behind closed doors - connect with clever at Cambridge University, got valuable ‘If things take a bit longer it doesn’t
people!’ experience working in a start-up and matter - a lot of work goes on before
picked up on the social problem quickly. useful things come. I use the illustration of
3. Think about assistance and funding She also helped with the development Chinese bamboo – it can be underground
‘I have been speaking to the Swindon and roadmap. We both benefitted.’ for four years, then it grows hugely in year
Wiltshire Innovation Hub about the next five. Everything doesn’t have to be done

58 ITNOW December 2018

 SOCIAL START-UPS

now. But, if you don’t believe in it, no one

else will - so pace yourself to get it done.’

Final thoughts
Some of this interview was performed with
me literally holding the (very cute) baby.
Chen has even taken her to funding pitches
in a sling. We finished off discussing where
Chen needs to go next. ‘Funding is the key
next step’ she says. ‘Then to get a first app
into the App Store so we can learn from
initial traction what further features and
further investors are needed.
‘I also need a co-founder, so at the
moment I am looking for co-founders
online and attending co-founder speed
dating events. Being a woman in a
woman’s business with a niche interest
can be difficult. You need a co-founder
who understands the product and the
philosophy.’

About Mao Chen and LatchAid

Dr Chen Mao Davies holds a PhD in
computer graphics and has 15 years References
R&D and software product development This is some of the background reading Failing to breastfeed may double risk of
experience. For the past seven years she that helped in developing the app – and depression in mothers: study
has been working in a world-class R&D reaffirming some of the approaches. https://bit.ly/2B4NOrB
team to create stunning visual effects for
blockbuster movies including the Oscar and Benefits of breastfeeding Babies and mothers worldwide failed
Bafta-winning Gravity. https://bit.ly/2NfCuMj by lack of investment in breastfeeding
Chen is a mum of three years, with a https://bit.ly/2B2lVk0
young son and a baby daughter, and has Benefits of Breastfeeding for the
first-hand experience as a once-struggling, Environment and Society BfN supports open letter on the crisis in
but later successful, breastfeeding mum. https://bit.ly/1H8ME81 breastfeeding
LatchAid is actively filling its founding https://bit.ly/1V08Dph
team and advisory committee and is UK ‘world’s worst’ at breastfeeding
working with a number of paediatricians, https://bbc.in/2RPC8i4 Failing to breastfeed costs the global
breastfeeding professionals, 3D artists, economy around US$302 billion a year
product designers and business advisors Barriers to breastfeeding: the reasons https://bit.ly/2zuxyRI
for product design and development. why women stop
It is incubated at Cambridge Social https://bit.ly/2z8BIMR Breastfeeding in the UK
Ventures at Cambridge Judge Business https://bit.ly/2PRGPup
School and is supported by the West of Breastfeeding: a missed opportunity for
England Academic Health Science Network. global health Sustainable Development Goals
https://bit.ly/2B2lDJW https://bit.ly/2jHjQmD
www.latchaid.com
www.facebook.com/LatchAid/ 8 Frustrating Breastfeeding Challenges UK survey reveals lack of breastfeeding
www.twitter.com/latchaid and Solutions peer support for millions of mothers
https://bit.ly/2QAuJTr https://bit.ly/2taBVt7

December 2018 ITNOW 59

 TURING BOMBE MOVES
HOME AND LIVES AGAIN
Job Up! Bombe breaks Enigma again at its new home at The National Museum of
Computing.
Just three months after the move of the
reconstruction of the Turing-Welchman
Bombe to its new home at The National
image: The National Museum of Computing
Museum of Computing (TNMOC) in
Bletchley Park, the machine successfully
found the key to break an Enigma-
encrypted message again in a live link-up
with Poland.
In a remarkable few months, a crowd-
funder had financed the Bombe’s move, a
new gallery in TNMOC had been prepared
to house it, and veteran Bombe operators
had visited to see the remarkable tribute
to Second World War codebreakers in
action again.
The Turing-Welchman Bombe
automated the deciphering of Enigma-
encrypted messages during the Second
World War. Based on the work of Polish
doi:10.1093/itnow/bwy109 ©2018 The British Computer Society
mathematicians who first broke Enigma
before the war began, Alan Turing and
Gordon Welchman had created the Bombe
to automate the decryption process to
reveal enemy Enigma messages. More
than 200 Bombes were in operation
during the war, routinely breaking Enigma-
encrypted messages to reveal invaluable
intelligence about enemy operations.
As a tribute to the codebreakers, a
team led by John Harper reconstructed
the machine in 2007 and in April 2018
60 ITNOW December 2018
the Bombe was moved to The National
Museum of Computing, close to the
reconstruction of the Colossus computer
that accelerated the breaking of Lorenz-
encrypted messages of German High
Command. Together these machines are
credited with shortening the war by two
years, saving countless lives.
On 21 September 2018, in recognition
of the Polish mathematicians who first
revealed the secrets of Enigma, the Bombe
team at TNMOC successfully found the
key to an Enigma-encrypted message in
a live challenge and video link-up with the
IFIP World Computer Congress in Poznan,
Poland. The delegates in Poland heard
from Sir Dermot Turing, Dr Marek Grajek
and Dr Roger Johnson about the Bombe’s
origins and technology while the expert
Bombe team at TNMOC broke the message
live and gave the traditional call of ‘Job Up!’
as the message was decrypted.
Encrypted message:
IEEV LDQE WVUQ SHPG PZWL
Decrypted message:
MYXD OGXH ASXN OXNO SEYY (My dog
has no nose)
Ruth Bourne, a 92-year-old former Bombe
operator (who still makes regular cameo
appearances demonstrating the Bombe at
TNMOC to the public), was present at the
challenge to verify the procedures and to
recall those stressful but highly rewarding
wartime codebreaking days.
Andrew Herbert, chair of TNMOC said: ‘In
Block H, the home of The National Museum
of Computing, on Bletchley Park, the public
can now see working reconstructions of
two of the most important machines of the
Second World War. In their hey-day, these
machines changed the world and today
their significance is undiminished. Visiting
student groups and the general public can
watch in awe and be inspired by these
historic working machines that paved the
way to our digital world.’
The working reconstructions of both
the Bombe and Colossus machines can
be seen daily at The National Museum of
Computing on Bletchley Park. See
www.tnmoc.org for details.
This article is a corrected update to a
piece published in the autumn 2018 issue
of ITNOW. The previous article reported
inaccurately the Bombe’s new home. We
would like to apologise for any resulting
confusion.

BCS WOMEN AWARD NOMINATION
Sarah Burnett and the BCSWomen’s AI Accelerator programme receives a nomination for
the prestigious EQUALS in Tech Awards.
By day, Sarah Burnett is Executive Vice
President and Distinguished Analyst at
a boutique analyst and advisory firm
called Everest Group. She’s responsible
for research and advisory services on
business automation trends, developments,
technologies and adoption patterns by
enterprises. Her work focuses on the latest
robotic and artificial intelligence (AI) based
technologies. As ITNOW went to press,
Burnett’s AI Accelerator project received a
nomination for the EQUALS Tech Awards.
Tell us about the award and what the
nomination means to you.
When I became chair of BCSWomen in
late 2016, with my background in AI and
seeing how AI is going to change the
way that we live and work, I set up the AI
Accelerator as a BCSWomen programme
supported by BCS SGAI. This is a series of
free AI-focused webinars, seminars and
workshops by experts, aimed at getting
more women into the field of AI. The
programme reached circa 500 women in
2017 and we are running more courses
and events this year. As far as I know this
is a fairly unique programme that is free
and makes AI accessible to anyone who
is interested. We get men attending our
sessions too.
BCS AI ART AWARD
The 2018 Lumen Award in Artificial
Intelligence, sponsored by BCS, has been
won by Cesar and Lois for their work
‘Degenerative Cultures’.
It is a biological-technological
doi:10.1093/itnow/bwy110 ©2018 The British Computer Society
network where the activity of a living
microorganism, digital networks and
artificial intelligence work together.
Degenerative Cultures at Brighton Digital Festival (September 2018), Photo Cesar & Lois
I heard about EQUALS via Gillian
Arnold, the ex-chair of BCSWomen. She
had won the inaugural GemTech awards
by the UN ITU for BCSWomen in 2014.
EQUALS is a UN Women and ITU-led global
network delivered by a partnership of
corporate leaders, governments, non-profit
organisations, communities and individuals
around the world.
So, I entered AI Accelerator into the
EQUALS in Tech Awards in the Skills
category and was absolutely thrilled
to reach the finals. There were over
350 entries from 80 countries and AI
Accelerator was one of five reaching the
finals in the Skills category.
This nomination means that our purpose
is understood by people who care about
the role of women in technology and that
it is a viable and impactful programme.
This has encouraged me and my team to
do more to establish this relatively new
programme to reach many more women
and to prepare them for the changing
world of work and new skills requirements.
Why is it important that women – and
indeed all groups – are represented in the
teams that make and deploy AI products?
AI will be an incredibly impactful
technology. It has the potential to have a
Using Physarum polycephalum, the artists
developed a ‘bhiobrid’ agent, blurring the
limits between biological and artificial
intelligence. In an interactive installation,
physical books documenting the human
impulse to control and reshape nature are
used as the substrates for fungi. The text
is destroyed in a physical sense, visible
NEWS
huge impact on society, on how decisions
are made about us and how we’ll do our
jobs in the future. And so, we need to guard
against bias in data sets and the decisions
that are made based on those data sets. To
achieve this, we need diverse teams. Such
teams, by their nature, are better placed
to understand diverse customers and
their needs. Diverse teams are best placed
to make products that appeal to a wide
variety of people and organisations.
AI has huge implications for how we all
live our lives. What role do you think
professionalism plays in ensuring
AI-based products – to pinch Google’s
line – ‘do no evil’?
Most organisations will use AI to fulfil
simple business processes faster. The AI in
these cases will learn by watching people
and having some safeguards around its
machine learning ability to ensure that its
decisions remain legal and compliant with
regulatory frameworks.
We can set ethical and professional
guidelines for all activities, but these will
not stop those who are so inclined to ‘do
evil’. We just need to get better at protecting
ourselves and detecting AI-oriented cyber-
crime. Ironically, we will have to use good
AI to fight the bad.
through the redaction or disappearance of
legible text on the surface of the pages.
The AI component analyzes the living
microorganisms’ growth and feeds a [de]
generative algorithm linked to cellular
automata and natural language analysis.
This bio-digital agent searches the internet
for texts that describe human efforts to
control nature. Just as the physical book is
consumed by the microbiological culture,
the digital database is corrupted by the
degenerative algorithm. Readouts are then
tweeted via @HelloFungus.
https://lumenprize.com/
December 2018 ITNOW 61
 COMBATING BIAS IN
Lorem ipsum dolor
Lorem ipsum dolor
Lorem ipsum dolor
AI
Justin Richards MBCS interviews 2019’s Turing Lecture speaker, Krishna Gummadi, from
the Max Planck Institute for Software Systems, in Germany.
What will you be discussing during your
Turing lecture speech?
Image: Getty/Digital Vision
I will be focussing primarily on algorithmic
decision-making and how to train learning
algorithms to make decisions in a fair way.
I will be looking at various different notions
of fairness. For instance, we would want
decisions to be non-discriminatory and
without any bias. We would want them to
be transparent and we would want the
outcomes to be diverse. These all sound
doi:10.1093/itnow/bwy111 ©2018 The British Computer Society
like fine goals, but the key question is how
should we think about this? What does
it mean to be, ‘non-discriminatory’, and
how do we train algorithms to be non-
discriminatory.
How can we train artificial intelligence to
be unbiased?
The important thing here is to essentially
understand the word unbiased; it’s a
word that carries with it a lot of different
interpretations. What do we really mean
by discrimination? One way in which
62 ITNOW December 2018
discrimination can manifest itself is when
you’re learning or when you’re training
algorithms. Suppose that you try to train
an algorithm to make the minimum
amount of errors in its predictions over an
entire population. Let’s say the algorithm
that you’re trying to train is one that we
want to predict who is going to recidivate
or reoffend in the near future. There was
a lot of discussion in the news about an
algorithm called Compass, which was
being used in several jurisdictions in the
U.S. to help judges or federal officers by
giving them some assessments as to how
likely some criminal defendant was to
reoffend in the near future. Now, suppose
you were training that algorithm over
some existing historical data. You have
some historical data that shows which
type of criminals have reoffended in the
past. You want to train your algorithm to
pick up patterns in this historical training
data. That data would contain some
features of the criminal. So you would
want to see what types of criminals are
more likely to reoffend, as opposed to
criminals with different types of features
that might be less likely to reoffend. Those
are the kinds of patterns that you would
want to train your algorithm to take.
Traditionally, in learning, when you
try to pick up these patterns you tend to
specify an objective function. That objective
function typically is of the form: ‘I want to
pick up the pattern so that when I make
predictions I minimise the sum of the
errors that I make for all the individuals
in the population.’ Now that seems like a
very reasonable goal because whenever
you make a prediction you might go wrong
for certain individuals in the population. It
seems like a very reasonable thing to do
to minimise the errors you would make
in predictions for the entire population.
The problem occurs when the population
has two different sub-groups of people.
Say these correspond to gender or race
or whatever else. When you’re trying to

make decisions you minimise the sum
of the errors for all the individuals in the
population, and if those individuals belong
to two different races, it’s quite possible
that you would actually prefer another
algorithm, one that might learn a decision
boundary that makes few errors for one
group, but at the expense of more errors
for another group.
When you’re making certain decisions,
you are essentially trading off between the
errors that you might make for different
individuals or groups of people in the
population. It’s actually quite possible that
you would be highly accurate for one sub-
group of people and highly inaccurate for
another. Now that is what might lead to
discrimination.
If you want to be anti-discriminatory,
you might want to have an additional
objective that’s safe beyond minimising
the sum of errors and predictions for
all the individuals in the population. But,
unless you specify this to an algorithm
it would end up picking up patterns that
could be discriminatory. In our work
what we have argued, and what we have
shown, is actually how to specify these
additional objectives in terms of error rates
at the level of groups to avoid learning
discriminatory decision-making.
Is it possible to measure bias and unfair
decision-making in machines with your
methodology?
The short answer is yes, but the more
nuanced answer is coming up with
those measures and is actually one of
the fundamental problems. When we’re
talking about measuring bias there are
two or three ways in which you could
think about it. You could measure the bias
in the outcomes, or you could measure
in the procedure itself. I think, if you’re
considering the problem of measuring
the bias in outcomes, the results of the
decision-making, then the problem is no
different than the one that you would have
in human decision-makers.
Now the place where it gets a lot trickier
is when you have to reason about bias
of the procedures that are being used to
make decisions. Here the problem is to
understand how humans make decisions.
You could ask a human to explain the intent
of their decision making or you could look
at a particular situation and have a sense
of whether or not the errors that are made
by human decision-makers seem like
reasonable ones or seem like they’re driven
by some extreme bias. These are the sort
of things that people have a good sense
for when it is a human decision maker.
But asking these questions in the context
of algorithmic decision-making and the
procedures by which learning algorithms
make decisions, that becomes a bit more
tricky. Because this raises the question of
what’s the intent of an algorithm when it is
making decisions. That’s where you have to
think more carefully.
What are the biggest challenges you are
currently facing in your line of research?
I think the biggest challenge is the fact this Currently my research is focused more on
is an inter-disciplinary topic, which requires exploring that space of different objectives,
an understanding of the notions of fairness, and figuring ways to formally specify them
accountability and transparency. These are to learning algorithms, so that we can
topics that have been traditionally studied
in social sciences. In these disciplines,
these topics are approached in a very
different manner than the way in which
people in computer science approach
them.
The challenge is we would want to look
at these notions of fairness, accountability
and transparency through a computational
lens, from an algorithmic perspective. This
requires us to essentially translate some
of these notions in formal ways. That is, we
want to be able to say: ‘Well, this idea of
non-discrimination that you are considering
in this decision-making scenario would
translate into this particular pattern of
making decisions and that pattern is
something that you would want to specify
formally in the form of an equation, or in
the form of a constraint.’ This translation is
actually the most difficult thing to do.
What’s your ultimate goal with this line of
research?
TURING LECTURE 2019
How would you formalise accuracy so that
you can actually learn to make decisions
that are most accurate from the data?
Meaning there is just one objective that
people focus on, which is to minimise
the sum of errors that people make for
individual users in the entire data set.
When we make decisions in the real
world, they actually account for a number
of different types of objectives beyond
that. At a high level my goal is to explore
that rich set of objectives that one should
have when making decisions rather than
just hang onto this one single objective.
But that’s what I think is needed to make
the decision-making fair. My goal would
be essentially to explore a different way
to think about the topic of fairness; what
would be a fair way of making decisions.
I feel that today, if you look at how
algorithms are trained to make decisions,
we are failing to capture the rich set
of objectives that people usually have.
train algorithms that will be fair according
to all those objectives. And so, in short,
it will learn how to make fair automated
decisions.
SECURE YOUR 2019
TURING LECTURE
TICKETS
The Turing Lecture 2019 will take
place at the following locations and on
the following days:
18th February – London
20th February – Manchester
21st February – Belfast
Keep and eye on BCS’s social media
and web feeds for more information.
December 2018 ITNOW 63
 BOOK REVIEWS
Business Analyst
Adrian Reed
Publisher: BCS, The
Chartered Institute for IT
ISBN: 9781780174280
Score: 10 out of 10
Who better to write a book on a career in
business analysis than Adrian Reed, whose
own career has developed in parallel with
the maturity of the business analysis
profession itself. Adrian is now a widely
respected thought leader and conference
speaker who is one of the very few people
to hold business analysis qualifications
from the BCS, IIBA and the BA Managers
Forum.
The book itself is an excellent mix of
practical advice and guidance based on
his own experiences and includes, not only
a career road map for business analysts,
but also a summary of the key tools and
techniques that they would use throughout
their working lives.
This publication distils the knowledge
and experience of one of the most
internationally recognised champions of
business analysis into an easily accessible
and comprehensive resource for business
analysts at any level and at any stage in
their careers, including those considering a
move into the profession for the first time.
In addition to a detailed description of
the competencies needed by a business
analyst, the book provides guidance on
developing a c.v. and attending interviews
for a business analysis role. The practical
advice given is supplemented by a set of
case studies summarising the careers of
a range of practicing business analysts.
The book will also be of immense value to
those who are considering using business
analysts to support them in their own
organisations, providing useful guidance
doi:10.1093/itnow/bwy112 ©2018 The British Computer Society
gleaned from years of experience by
someone who has passionately raised
the profile of business analysis across
many sectors, including polling senior
government policy makers to ensure
they make the most effective use of their
business analysts.
A vital read for all business analysts
from new apprentices through to expert
business analysts at the peak of their
careers.
Paul Turner FBCS
64 ITNOW December 2018
Artifictional Intelligence
Harry Collins
Publisher: Polity Books
ISBN: 9781509504111
Score: 9 out of 10
Collins, a research professor at Cardiff
University, has produced a very readable
tome that asks: ‘how far do we still need
to go before we arrive at a point in time
where we cannot distinguish between
the social understanding of humans and
computers?’
While the successes of ‘deep learning’
seem to be blurring the line between
human and machine, Collins rightly argues
that we are getting ahead of ourselves,
caught up in the realms of science fiction.
He suggests that we need, collectively,
to rethink and redefine what we call
‘intelligence’.
Take, for example, a human’s learned
abilities with language and being able
to ‘repair’ and fill in the gaps of other
people’s communications towards us.
We instinctively are able to make mental
adjustments to allow for the slurring of
words, jumbled letters or partly completed
sentences and still understand our fellow
humans, but computers, at present, cannot
do this kind of ‘repair’.
Collins posits that without some degree
of socialisation, computers will never truly
be ‘intelligent’ in the truest sense of the
word. Much human socialisation involves
our connecting with other humans through
our bodies and interpreting physical signals,
something our current AIs struggle to do.
Collins talks about there being six levels
of artificial intelligence, starting from
Level 1, ‘engineered intelligence’, which we
already live with, right through to Level VI
and its ‘autonomous alien societies’.
The author urges us to move away from
being dictated to by stupid computers, who
only understand black and white concepts,
and move toward a more positive future
where human-like computers will be as
context-sensitive as the humans that are
living and working around them.
Harry Collins has produced a fascinating
book which raises as many questions as it
tries to answer. One to be read and reread
for sure.
Justin Richards MBCS
Computational Interaction
A. Oulasvirta, P. O.
Kristensson, X. Bi
and A. Howes
Publisher: OUP
ISBN: 9780198799610
Score: 10 out of 10
This book introduces computational
interaction (CI) which encompasses a
variety of approaches using mathematical
models and algorithms to represent,
explain and evaluate various aspects of
the participation of both user and machine
in human/computer interaction (HCI)
scenarios.
Over the course of its four sections, the
book presents 15 papers, from various
authors, which together reflect the state-of-
the-art in CI and its application to various
aspects of HCI.
The first section considers CI applied
to input and interaction techniques. It
describes statistical methods for optimising
text entry in a range of applications.
Machine learning (ML) is also discussed in
the context of input recognition.
The second section of the book focuses
on HCI design. Here we learn about the
application of combinatorial optimisation
techniques to find optimal user interface
designs with respect to multiple
optimisation functions.
The Systems section considers
approaches to modelling user interfaces.
The final section of the book explores
ways in which computational models may be
applied to various aspects of human behaviour
with regard to HCI. The topics explored include
modelling human multitasking in order to
predict user performance when faced with
various user interfaces in a variety of settings,
and developing economic models of machine
interaction.
This a detailed collection of well written
papers which explores a wide range of CI
techniques and HCI settings. Papers are
each extensively referenced, and the entire
collection is indexed.
Patrick Hill MBCS
If you would like to review books for
ITNOW please email:
publishing@bcs.uk
To see more book reviews visit:
www.bcs.org/category/8429
 BCS JOURNALS
RISK ASSESSMENT OF CRITICAL INFRASTRUCTURE SYSTEMS
The paper ‘Security risk assessment of critical infrastructure systems: A comparative study’ by Samuel
Tweneboah-Koduah and William J Buchanan, published in The Computer Journal: Section A - Computer
Science Theory, Methods and Tools (Volume 61, Number 9), examines six existing assessment frame-
works and provides a steer on how such frameworks should be designed in future.
Recent cyber attacks on critical
infrastructure systems, coupled with the
technology-induced complexity of the
system of systems, have necessitated a
review of existing methods of assessing
critical systems security risk exposure.
The question is: do existing security risk
assessment methods adequately address
the threats of modern critical
infrastructure systems?
Having examined six existing
assessment frameworks, the research
team argues that the complexities
associated with modern critical
infrastructure systems make existing
methods insufficient to assess systems
security risks exposure. Hence, from a
systems dynamic perspective, the work
carried out by the team concluded by the
proposal for a dynamic modelling approach
as a safer alternative.
More art than science
Assessing security risk is more of an art
than a hard science. The research group
therefore sees a need for current methods
ACADEMIC JOURNALS - LATEST CONTENTS IN BRIEF
Interacting with Computers; The
Interdisciplinary Journal of Human-
Computer Interaction
Volume 30, Issue 4, July 2018 contains the
following papers:
• Exploring interactivity and
co-creation in rural China
• The new snapshot narrators:
changing your visions and
doi:10.1093/itnow/bwy113 ©2018 The British Computer Society
perspectives!
• Design of interactive mechanisms
to support the communication of
user’s intentions
• I-typed DMML: a novel DSL for
direct manipulation interaction with
virtual objects
https://academic.oup.com/iwc
to factor in quantities and qualities that are
inherently uncertain to predict and/or
difficult to quantify.
They believe that critical infrastructure
systems and their supporting technologies
are becoming too complex and dynamic to
predict, due to convergence with advanced
technology. Similarly, systems’ boundaries
have become too difficult to define due to
systems interdependencies.
The business impact of a successful
threat attack on a critical infrastructure
system could be very damaging, not
only to the systems themselves but their
interdependencies, and, in some cases, the
health and social well-being of the citizenry.
Although there are currrently a number
of security risk assessment methods in
existence, the complexity and increasing
interdepencies of modern critical systems
render many of the methods less useful.
There is, therefore, the need to develop
different methods of security risk
assessment in order to better address the
gaps in the existing methods since there is
no universal all-encompassing ‘silver bullet
Formal Aspects of Computing - Applicable
Formal Methods
Volume 30, Issue 5, September 2018
contains the following papers:
• A fully verified container library
• A formal approach for detection of
security flaws in the android
permission system
• Model-based problem solving for
university timetable validation and
improvement
• Automated circular assume-
guarantee reasoning
• Mechanized proofs of opacity: a
comparison of two techniques
http://link.springer.com/journal/165
solution’ to security-related problems.
Seven is the number
The modelling and simulation presented in
the paper in question have been developed
to specifically assess the security risks
with controlled technologies supporting
critical infrastructure systems (power
distribution, for example). In developing the
modelling approach, seven key
assessment metrics were identified.
Systems characterization was based
on controlled technologies (for example,
ICS-SCADA). While the approach has
focused on critical infrastructure
systems, it gives vendors, asset owners,
customers and regulatory agencies the
ability to comparitively assess the relative
robustness of different critical
systems offerings.
Members can get a reduced
subscription to The Computer Journal
https://academic.oup.com/comjnl at:
www.bcs.org/category/17544
Journal of Innovation in Health Informatics
Volume 25, Issue 2 contains the
following papers:
• Development of a national core
dataset for the Iranian ICU patients
outcome prediction; a
comprehensive approach
• The Heimdall Framework for
supporting characterisation of
learning health systems
• Understanding optimization
processes of electronic health
records (EHR) in select leading
hospitals: a qualitative study
https://hijournal.bcs.org/
December 2018 ITNOW 65
 SPOTLIGHT ON
CHRISTOPHER
CURRY
Christopher Curry was co-founder of Acorn Computers, which was probably most famous
for creating the BBC Micro. Curry also managed to develop GIS, a system for cashless
money, and created an ID card with medical history, called Bluefish.
Christopher Curry was born in Cambridge
in 1946 where he has lived and worked
throughout his life. He has always been
fascinated by computing and automation
and used to build amplifiers and radios out
of old valves found in televisions at the
local dump.
Early career
Image: GettyImages-517235492
After doing a Dip Tech course, Chris began
his IT career at Pye, where he became an
expert solderer. After only a few months he
left to join the Royal Radar Establishment
in Malvern where he was working on
superconductivity, making superconducting
junctions. He moved on to Sinclair
Radionics in 1966.
At Sinclair he developed the matchbox
radio, Micromatic. Sinclair came up with
an idea, and Chris would then take the
idea right through from drawing board to
end-product. For example, they developed
the first pocket calculator, the Executive.
doi:10.1093/itnow/bwy114 ©2018 The British Computer Society
Later Chris used one of the calculator
chips to make an early programmable
microcomputer. He was approached
by a sales engineer from National
Semiconductors, who offered to design
what later became the MK14, which had
no storage and only 256 bytes of memory.
Curry also set up a consultancy on the
side called Cambridge Processor Unit,
which handled special builds for people.
Their first successful custom build was the
twin processor Hart for a gaming machine.
66 ITNOW December 2018
One processor switched the lights on and
off, and another did the calculations and
controlled where the wheel stopped – the
results were fixed!
By the late 1970s, Sinclair could see
that a microcomputer had consumer
appeal and started development, but it got
taken away from them as an unnecessary
expense by the National Enterprise Board
(NEB), who, by then, had shares in Sinclair.
The project went instead to Newbury
Electronics and became the NewBrain,
which became the basis for the BBC
microcomputer.
Acorn
At Cambridge Processor Unit, Christopher
felt they needed to have a brand suitable
for the consumer market, hence Acorn was
formed as a company. They used the basic
designs of the modular card system in a
single board computer called the Atom.
When the BBC were planning a computer
programme, Chris offered them a 16-bit
processor with properly structured BASIC.
The BBC offered them the contract. The
purpose of the BBC microcomputer was to
teach programming.
After Curry and Sinclair fell out over
the BBC Micro, because of the Micros
in Schools scheme, Chris built a cut-
down BBC computer (the Electron). Chris
also bought the Acorn Communicator, a
network computer based on the BBC’s
hardware and with the best modem chip
available, and put it in a business called
GIS, whilst remaining a non-executive
director of Acorn.
While in GIS, Chris created a system
for cashless money. The Transactor was a
smart card on to which you loaded money.
They teamed with an organisation called
Mondex who enlisted MasterCard to get
global coverage.
Achievements
Chris remains very proud of the Sinclair
Executive calculator, as it was his project
from beginning to end. He is also proud
of the MK14 as it was the first of its kind.
He realised that if you can give an existing
market something that takes it into a slightly
new area, you create another market.
Advice
Christopher Curry believes it is important
to build a business based around a
fundamental need, not just something you
are interested in yourself.
Further Information
Archives of IT is a registered
charity (no. 1164198), which aims
to capture the past and inspire
the future.
Twitter at: @ArchivesIT
Visit: http://www.archivesit.org.uk