Outside Innovation

US Citizens' (Small) Victory in Fight Against Govt. Search & Seizure

The Customer Revolution Continues....U.S. Patriot Act Expires

Thanks to courageous stands taken by Republican Senator Rand Paul and Democratic Senator Ron Wyden, and to an outpouring of calls and emails from American voters (thank you!), the three portions of the US Patriot Act that authorized the mass collection and data mining of the phone records of US citizens expired on June 1st, 2015.

"Historic Victory for the Rights of Every Citizen"

In a video interview with The Guardian and then in an Op Ed column in the Sunday New York Times, Edward Snowden commented on the victory:

"Privately, there were moments when I worried that we might have put our privileged lives at risk for nothing — that the public would react with indifference, or practiced cynicism, to the revelations.

Never have I been so grateful to have been so wrong.

Two years on, the difference is profound. In a single month, the N.S.A.’s invasive call-tracking program was declared unlawful by the courts and disowned by Congress. After a White House-appointed oversight board investigation found that this program had not stopped a single terrorist attack, even the president who once defended its propriety and criticized its disclosure has now ordered it terminated.

This is the power of an informed public.

Ending the mass surveillance of private phone calls under the Patriot Act is a historic victory for the rights of every citizen, but it is only the latest product of a change in global awareness. Since 2013, institutions across Europe have ruled similar laws and operations illegal and imposed new restrictions on future activities.

The United Nations declared mass surveillance an unambiguous violation of human rights. In Latin America, the efforts of citizens in Brazil led to the Marco Civil, an Internet Bill of Rights. Recognizing the critical role of informed citizens in correcting the excesses of government, the Council of Europe called for new laws to protect whistle-blowers."

Edward Snowden: "Our Right to Privacy Remains Under Threat"

In the same NYT Op Ed piece, Snowden goes on to say:

"Though we have come a long way, the right to privacy — the foundation of the freedoms enshrined in the United States Bill of Rights — remains under threat. Some of the world’s most popular online services have been enlisted as partners in the N.S.A.’s mass surveillance programs, and technology companies are being pressured by governments around the world to work against their customers rather than for them. Billions of cellphone location records are still being intercepted without regard for the guilt or innocence of those affected. We have learned that our government intentionally weakens the fundamental security of the Internet with “back doors” that transform private lives into open books. Metadata revealing the personal associations and interests of ordinary Internet users is still being intercepted and monitored on a scale unprecedented in history: As you read this online, the United States government makes a note."

Edward Snowden, NYT, June 7, 2015

USA Freedom Act Replaces the Patriot Act

Not surprisingly, one day after three major provisions of the Patriot Act expired on June 2nd, Congress passed replacement legislation--the USA Freedom Act.

The US Senate passed the USA Freedom Act with a vote of 67 to 32. President Obama signed it into law within a few hours.

 

What did US citizens gain? And where does the new law fall short in protecting citizens' rights against unlawful search and seizure (the 4th amendment of our constitution)?

Is U.S. Government Surveillance Wreaking Havoc with U.S. Tech Firms’ Cloud Solutions?

On February 25, 2015, David Tanis, Manager of Information Systems and Frontline Analytics for Commonwealth Bank of Australia was quoted during a Gartner Information Management Summit in Sydney as saying:

“The policy needs to be clear," said Tanis. "We like our data managed by the company, for the customers and kept here in Australia."

~ Commbank Rules Out Public Cloud Storage

Also in late February, 2015, the Bank of Queensland (Australia) announced that it is abandoning its Salesforce-based CRM system, due to “a failure to meet operational and regulatory requirements” with the cloud-based computer system. The Bank took a $10 million write-off. Liam Walsh, the reporter at the Brisbane Courier-Mail who wrote this story explained:

“Cloud-based systems and outsourcing of information-technology have previously been in the sights of the banking watchdog, the Australian Prudential Regulation Authority. APRA just last year, in a response to the Financial System Inquiry, said while it was not in favour of one technology or another, it had key concerns about cloud computing. These were for banks to be able to continue operations following a loss of cloud services, and issues surrounding confidentiality of data and meeting prudential requirements.”

Anthem Hack: Will It Slow the Spread of Patient Portals?

Why Medical Records Are Tempting Targets for Cyber Crooks

The information that is collected and stored by healthcare providers and by health insurance companies includes incrdibly detailed information about our lives. In the U.S., insured patients are identified by social security numbers and birthdates, as well as full names. Our records include our current phone numbers, mailing addresses, physical addresses, email addresses, and all the same contact information for our next of kin and our closest friends and family members. This information also includes specifics about our current employer and how long we have been employed and on that employer’s insurance plan. These records also include our insurance member IDs. All of this information is sufficient for a crook to steal someone’s identity, to gain access to their accounts, to apply for and gain credit using our names, to begin piling up bills, to damage credit ratings, and to make our lives hell. Identity theft is much more difficult, costly, and time-consuming to combat than credit card fraud or than having a single bank account compromised.

This wealth of personal information also makes it incredibly easy for crooks impersonating healthcare services providers to bill insurers, including large federal payers, for medical and ancillary services (transportation, therapy, medical appliances) that were probably never provided, collecting millions of dollars in reimbursement before they’re ever found out. Medicare and Medicaid fraud is already a multi-billion criminal enterprise. The Economist called it “the $272 billion swindle” in May, 2014:

How Viable Is the Apple Pay Ecosystem?

We published our initial review of Apple Pay functionality on October 11^th.  Our conclusions are summarized in this Report Card:

Customer’s Moments of Truth for Mobile E-Wallets	Grade
It’s not safe! Fear of theft of assets, account information getting into the wrong hands, and identity theft.	B+
I can’t use it! Inability to pay everywhere I want to shop, using my payment type of choice.	D
You’re tracking me! Fear of “big brother” or any entity knowing where I am, what I’m doing, and making that information available to others without my knowledge or permission.	C
Lock-In! Once I start using a mobile e-wallet (assuming it’s safe to do so), how easily can I switch?	B

This week we take a deep dive into the entire ecosystem of partners required to support Apple Pay (or any mobile e-wallet). (See How Good Is Apple Pay's Ecosystem?) We ask the question: How well have the players in the Apple Pay ecosystem aligned to address these four customer-critical issues?

(Click on image to enlarge.)

© 2014 Patricia Seybold Group Inc.

The answers are shown in this chart:

(Click on image to enlarge.)

Apple Pay Is Optimized to Reduce Fraud and Support Banks. The Apple Pay ecosystem is optimized to address consumers’ concerns about credit card and identify theft as well as to eliminate some of the costs born by banks and other financial services providers in the ecosystem—the credit card issuers—by reducing the risk of fraud and the costs of fraud detection and prevention.

Optimizing around the risk of fraud and theft and catering to financial services providers is clearly a studied calculation that Apple’s design and management team made.

Merchants and Retailers Are Not the Design Center of the Apple Pay Ecosystem. If Apple had chosen instead to optimize around ubiquity of payment acceptance, they would have designed a solution that was easier for many more merchants to accept. Such a solution would need to make use of the current installed base of POS devices and provide more cost-effective and safer payment types. A merchant-optimized ecosystem (like MCX CurrentC, which was designed by retailers for retailers) would also enable each merchant to easily capture all the details of each consumer’s transactions and to easily integrate their own loyalty and rewards programs into the shopping and payment experience.

How Would the Apple Pay Ecosystem Look If It Were Truly a Customer Ecosystem?

7 Things the Apple Pay Ecosystem Needs to Change. What would be different if customer experience had really been the design center of the Apple Pay ecosystem? To become a customer ecosystem, Apple Pay should:

1. Work with both NFC (Near Field Communications) and non-NFC Point of Sale systems. Both kinds of transactions would require the same level of authentication (e.g., fingerprint and/or personal code).
   
   
2. Retain the tokenized approach to the payment transaction. Merchants do not need or want to see or to store consumers’ payment details.
   
   
3. Enable direct payments, e.g., direct-from-bank account payments, stored value payments, merchant-specific payments, loyalty points or rewards payments, as well as anonymous payments (e.g., Bitcoin or equivalent) in addition to supporting both consumer and business credit and debit card payments.
   
   
4. Enable consumers to associate particular payment types (e.g., specific rewards credit cards or loyalty cards) as the default for particular payees.
   
   
5. Let consumers combine their brand-specific or retailer-specific loyalty cards with their payment transactions.
   
   
6. Give consumers control, on a brand-by-brand basis, over which retailers and brands are able to “know” their identity and associate their identity with their specific transactions.
   
   
7. Let consumers pay one another by transferring value securely from Apple Pay to individuals’ accounts (including people who do not use Apple Pay).

Notice that none of these customer-requirements would be that difficult for Apple and its ecosystem partners to address.

How the Apple Pay Ecosystem Is Likely to Evolve

Bear in mind that a healthy customer ecosystem will “automagically” begin to align to support and mitigate consumers’ top issues. In fact, you see signs of that happening already; now, only one week into actual operation in the U.S., a number of credit card companies, retailers, and banks are now hopping on board. That’s the first wave of response to consumer demand.

The second wave will be more difficult: Many merchants and retailers will continue to try to resist accepting Apple Pay until Apple supports non-credit and debit card transactions, taking the credit-card issuers (and their fees) out of every transaction. Yet Apple also solves a major problem for retailers: it will now be impossible for consumers’ credit card information to be stolen from their in-store point of sale systems and retail systems, because, with Apple Pay, retailers won’t ever have possession of consumers’ credit card information.

Retailers may be underestimating the importance of that peace of mind for their consumers. We predict that many consumers will buy and use Apple iPhones to pay at their stores specifically to increase their security and peace of mind.

Customers Will Reshape the Ecosystem to Meet Their Needs

We predict that customers voting with their feet and their tweets and their wallets will begin to reshape the Apple Pay ecosystem to better address their critical needs. It will be interesting to compare the Apple Pay ecosystem in one to two years to the Apple Pay system at its launch. Stay tuned.

How Good Is Apple Pay’s Ecosystem?
How Well Does Apple Pay’s Ecosystem Meet Consumers’ and Partners’ Critical Needs?
By Patricia B. Seybold, CEO and Sr. Consultant, October 31, 2014

 

If you were forwarded this message and would like to receive our weekly customers.com emails, click here.

 

Is the JP Morgan Chase Data Breach Related to Apple Pay?

I had an eerie thought when I read about the massive data theft of customer information at JP Morgan Chase. Much was made about the fact that the theft did not include customers’ account information or credit card information. It was “only” their names and addresses—primarily those of customers who use the bank’s several online banking services. So what else did the thieves get? Everyone’s email addresses, I’m betting.

Then, in researching Apple Pay, I learned that Chase worked extremely closely and in great secrecy with Apple to develop the Apple Pay implementation of the credit card issuers’ smart card interoperability specification (EMV). Once your credit cards are loaded into Apple Pay on your iPhone, the account information disappears. It is replaced with a meaningless token (that can’t be reverse engineered back into your credit card number) combined with a single-use, transaction-specific cryptogram that is generated dynamically from the iPhone’s “secure element” (chip). There is now no way that thieves can steal credit card information from those phones or from the merchants’ Point of Sale systems. All the merchant sees are the last four digits of each customer’s credit card number to be used for analysis and reporting: e.g., how much did each unique customer spend with us last month?

But what if the bad guys already had the names, addresses, and email addresses (and maybe the last 4 digits) of everyone who had credit cards? And they could still hack into retailers’ systems to access their transaction data? Couldn’t they reverse-append the two data sets? So they wouldn’t recover people’s credit card information, but they would have their identities and their transaction histories. That’s probably worth something. Just wondering why the world’s largest credit card issuer’s online customers’ data was stolen a month before the launch of Apple Pay.

 

If you were forwarded this message and would like to receive our weekly customers.com emails, click here.

Why the U.S. Government Thinks It Can Search Peoples’ Electronic Communications Located in EU Data Centers

Long-time client and friend, Donald Callahan, sent us his timely analysis of a U.S. Federal Court case involving Microsoft and the attempt of the U.S. government to obtain a customer’s email from Microsoft’s Data Center in Dublin. Donald’s full analysis appeared in the blog post entitled US Law in European Datacenters: Microsoft in Federal Court on May 13^th, 2014. Donald knew we’d be interested in this development because of what we’ve written about the impact of cloud location and privacy in “Where Are Your Clouds? Location Matters.”  “I know that you are sensitive to the issue about data location in the Cloud(s) and the legal jurisdiction that customers want to apply,” Donald wrote.  “You might be interested in my analysis of this ruling, as a contribution to your thinking.” Here are some excerpts from Donald’s great analysis. In particular, Donald looks at the logic in the ruling that rejected Microsoft’s appeal as setting important precedent on three major questions:

1. Does Data Location Matter?
2. Does the American Stored Communications Act require documents to be produced, even if they don’t reside in the U.S.?
3. Where can a search be conducted?

Here are the highlights of Donald Callahan’s analysis:

Edward Snowden’s Call to Action

Edward Snowden has mobilized the Tech and UX communities to improve and to rescue the Internet. This is a watershed event. It’s an irresistible and catalyzing challenge that I believe WILL produce results. This week, Snowden threw down a gauntlet: Save the Internet by designing easy-to-use end-to-end encryption.

I believe this challenge will not go unheeded. I expect thousands of motivated user experience professionals and cryptographers to partner in creating the next generation of communications tools for the Internet and for mobile devices. These tools will not only be more secure; they will also be easy to use. Today, if you want to keep from being surveilled, you have to become a techno-weenie. That’s not right, according to Snowden. We should all have the right to be protected against unlawful seizure and search.

Edward Snowden is, of course, the most famous whistle blower in history. He leaked documents from the NSA to Laura Poitras and Glenn Greenwald, documents which have proved that the U.S. “domestic” security agency has been collecting, seizing, storing, and analyzing all the email and phone traffic that takes place on the Internet. Snowden spoke at an ACLU-sponsored event at the South by Southwest SXSW Interactive conference in Austin, Texas on March 10^th via Google+ video link through seven Internet proxies. You can watch the conversation between Ben Wizner and Chris Soghoian of the ACLU and Ed Snowden here:

Customer Clouds: The Next Big IT Battleground

“Best of” Customer Cloud Articles

We’ve been writing a lot recently about “Customer Clouds.” It’s a term we coined. And it’s a movement we’re fully behind. Most of you rely on us for thought leadership around customer-impacting technology trends. This time, we may be WAY out in front of the parade. But we don’t think so. What’s a “Customer Cloud”? It’s the on-demand computing and networking infrastructure that enables your customers to securely manage their information, their assets, their events, their stuff, and their projects from their mobile devices and/or from their computers.

To catch you up, here are our three best articles on Customer Clouds:

• What's Your Customer Cloud Strategy? Twelve Customer Requirements to Include as Your Firm Migrates to Cloud Computing

• Cloud Computing in 2015: End-Customers’ Priorities Will Drive Companies’ Customer Cloud Implementations

• Priorities for Microsoft’s New CEO: Focus on Cross-Platform Mobile Application Development & Customer Clouds

Mobile = Customer Clouds in Your Pocket

The fact is that mobile application development is driving most companies’ customer, brand, marketing, and IT strategies these days. Mobile and Cloud go together. They need each other. Mobile apps need secure access to customer data from anywhere. Clouds are a good way to provide that ubiquity. They aggregate customer data and keep customers’ information synchronized across all their devices.

Open Letter to Microsoft’s New CEO

I don’t believe I’ve met Satya Nadella, Microsoft’s new CEO. But I do know Bill Gates, Steve Ballmer, and John Thompson (the chairman of the board). I like the new management team.

I’ve been disinterested in anything Microsoft does for almost a decade. Why? My clients—customer-centric, tech-savvy executives in both large and small companies—stopped caring about Microsoft. They used to care a lot. Now, what Microsoft does is largely irrelevant to their business and personal lives. Many of my clients still use PCs. But most have non-Windows phones, and they typically have non-MS tablets. They still use MS Office apps. But they don’t care what Microsoft does.

The “post-PC” strategy that Nadella has telegraphed finally piqued my interest. Of course Microsoft is going to focus on mobile phones and on the Cloud. What else would they do? The big danger I see ahead is for Microsoft to chart a predictable course. If they focus on evangelizing Windows Phones and Microsoft Azure, they’re toast! Nobody will care about Microsoft’s phone OS or about Microsoft Azure, Microsoft’s cloud computing alternative to Amazon AWS, IBM’s cloud, HP’s cloud, or Google Compute cloud.

Recent Important Articles about Surveillance

Here are some articles that have been curated by Scott Jordan and discussed in Patty’s Pioneers’ group over the past few weeks. I have found them to be really informative and provocative. I hope you will too:

Good Articles on NSA Privacy Debate

• How We Killed Privacy – in 4 Easy Steps; Stop blaming the NSA. We did this to ourselves, by Daveed Gartenstein-Ross and Kelsey D. Atherton, published in Foreign Policy on August 23, 2013:

  “Four distinct factors have interacted to kill electronic privacy: a legal framework that has remained largely static since the 1970s, significant changes in our use of rapidly evolving technology, commercial providers' increasingly intrusive tracking of our every online habit, and a growth in non-state threats that has made governments the world over obsess about uncovering these dangers. Only by understanding the interaction between these factors can we begin the necessary discussion about what privacy means in the 21st century — and how to forge a new social compact to address the issue.”

  What I found particularly interesting in this analysis was the authors’ discussion about “Pen Registers” – the data about whom you call on the phone. And the notion that:

  “In other words, when a third party [your phone company] is able to see what a person is doing in an electronic environment, no reasonable expectation of privacy exists.”

  This article does a good job of summarizing the slippery slope we’ve already gone down when it comes to protection of privacy and freedom from surveillance.

• 1,000 Sys Admins Can Copy Any NSA Document Without Anyone Knowing About It; Think Only Snowden Did? by Mike Masnik, published August 26, 2013 in TechDirt. After quoting a recent report that audited NSA’s current practices, Mike writes:

  “So we're left with an agency that collects a ridiculous amount of info, and has around 1,000 employees (who are mostly actually employed by outside contractors) who can look through anything with no tracking, leaving no trace, and we're told that the data isn't abused. Really? … And, do they believe that none of the people whom those thousand sys admins are friends with haven't had their friend "check out" information on someone else? …
  
  Basically, it seems clear that the NSA has simply no idea how many abuses there were, and there are a very large number of people who had astounding levels of access and absolutely no controls or way to trace what they were doing.”

• My Favorite is this “spoof” site: http://getprsm.com/. It positions the NSA’s Prism intelligence tool as a consumer service: A great service you can use to preserve and share all your information with everyone.