information security

RT.com interview on 'secure' smartphone apps

On Friday October 17th I was interviewed by Russia Today on the security of 'secure' smartphone apps that turn out to not be so secure. After 18 months of Snowden revelations that should be not news but for the Guardian newspaper it is.

Speaking at Dataharvest+ conference

I will be speaking and workshopping at the 2014 Dataharvest+ conference in Brussels. This conference brings together investigative journalists, (big)data wranglers, coders & hackers to kick journalism into the 21st century.

My contribution will be a series of presentations about applied information security for investigative journalists and hands-on workshops to get security tools working on laptops. So bring yours! Slides I used are here: PPT, PDF. Some tips and links to tools. A video from a comparable worshop last year, since then the situation has turned out to be much more dire.

Many thanks to the Centre For Investigative Journalism for making this possible. Happy to be working with them again!

Keynote & interview Eurapco Insurance

<op 26-09-2013 gaf ik keynote op het Eurapco congres waar top EU verzekeraars expertise delen.>

We live in a world of rapid technological change. Keynote speaker and IT expert Arjen Kamphuis discusses the implications for the insurance industry and its customers, and what measures can be taken to ensure the best possible customer experience. The objective was to raise awareness of the rapid pace of socio-technical development today and what fundamental effects this will have on the insurance industry. Changes in customer behaviour and expectations will have an impact on customer satisfaction with our companies’ claims handling.

Future shock – are we prepared for change? Some of the topics discussed in the keynote

  • What if tomorrow’s world looks really different? The basic rules of our business can change at incredible speed because of changes in technology, national/EU/ international policies, environmental threats and other external factors. New technology can overtake existing business models, and even make them irrelevant. The insurance industry faces the challenge of combining the need to be stable, secure and reliable with being dynamic, fast and responsive.
  • Cyber security needs to be taken care of, both within companies and between companies and their customers. Privacy issues are of great importance for insurance companies. For instance, it would be damaging for the image of a stable, secure and reliable insurance company if it were to be revealed that all customer data had been fully exposed by hackers or the NSA.
  • Today, all large service companies need to balance industrialised processes with the human touch. As a customer, you do not want to be exposed to the internal processes of your service provider. The customer just wants to receive service in an uncomplicated way. Changes in customer behaviour and expectations will have an impact on customer satisfaction with our companies’ claims handling.
  • Our companies’ brands face increasing danger in a fast-paced world of social media. Our customers rely more on the experience of others than on the promises of the companies. Through social media, good and especially bad experiences can be shared easily and quickly. We can join the conversation about our brand, but not control it.
  • A fast-changing world offers opportunities and threats for your business and your position in the market. Are you ready to adapt to changes in customer expectations? Is your organisation positioned to deal proactively with change, or could you be caught off guard? Do you have a plan for what to do if an improbable case scenario does occur? By carrying out regular scenario planning, you can at least have contingency plans for different case scenarios.
In your keynote speech, you mentioned that it’s very hard for anyone inside the insurance industry to see the world the way a customer, or other outsider, sees it. Can you, as an outsider, give us some tips about what is needed to achieve excellence from a customer’s perspective?

NSA intell goldmine, who else has access?

<ook op Sargasso.nl en HuffPo UK>

The War Room, Dr. Strangelove - 1965 Shortly after the initial release of some documents from whistleblower Edward Snowden I wrote a little summary about the IT-policy implications for Europe based on earlier columns. A lot of additional documents have come out since then and we can basically conclude that almost every computer system on the planet is fully broken or at least very vulnerable to NSA interference or manipulation.

Nobody, including the NSA, Edward Snowden, Glenn Greenwald has a total oversight of all the in the tens of thousands of documents let alone the political or strategic implications of the info contained in them. Most of the news keeps focusing on the 'scandal' aspect and/or the person of Snowden. Being angry at the US government (practised by most opponents) and attacking the person of Snowden (a favorite of apologists of the US regime) distracts from defining adequate policy responses and so far there have been precisely none in Europe. This constitutes a massive failure of the various EU governments to protect their citizens' rights and the economic sovereignty of their nations. It is also strange in light of the fact that an adequate policy response had already been formulated in July 2001 and really just needs to be implemented.

But every now and them the disinfo spread by some apologists for the behaviors of the NSA is useful for understanding how much worse the situation may just turn out to be. This article by a former NSA employee is a nice example of an attempt at smearing the whistleblower while actually digging the hole the NSA (and the US regime) is in much, much deeper. The piece claims Snowden secretly worked for Russian intelligence all along. While I do not share the authors views on Snowden's motivations or allegiances the suggestion that outside organisations could have agents inside the NSA has some interesting implications.

Info security workshop Centre for Investigative Journalism

The UK Centre for Investigative Journalism is a non-profit organisation dedicated to educating and training journalists to benefit the quality of journalism and thus public debates on important topics in society. Every year the CIJ holds a 3-day summer school where journalists can follow lectures, participate in workshops and meet with some of the foremost professionals in their field. Several months ago, when the CIJ asked me to help set up a workshop in information security, we had no idea then how hot the subject would become after the revelations by former NSA-contractor Edward Snowden. I was very happy to see the room at London City University was packed with journalists eager to learn both theory and practice of securing their communications and protecting their data. An overview of theory & tools for those who missed it, slides here, video below.

Being in London for a few days also allowed me to contribute to a cryptoparty (a workshop for teaching info security basics to anyone interested) that was kindly hosted and wonderfully supported by the London Hackerspace. Dozens of people from all walks of life showed up and we had a great time.

If you would like to attend such a workshop contact your local hackerspace and join or look at this list of upcoming cryptoparties. If nothing is planned in your area start a group yourself. The time for it has never been more propitious. The links above can get you started. If you get stuck mail me and I'll be happy to put you in contact with people near you.

Below a recording of the theory introduction part of the workshop at the 2013 summer school. After this intro the whole class worked together for several hours setting up software tools for email-encryption, anonymous browsing and testing these new capabilities with colleagues. By the end of the day over 30 journalists were tooled up to receive scoops from high-risk whistleblowers.