This breaks when a request arrives through a load balancer, since the underlying hostname doesn’t match that of the client browser request (the load balancer DNS name), and thus the AD domain controller rejects the token. Microsoft made the change enabling this ability in August 2009, in Security Advisory 973811 and then progressively enabled this for clients and servers of theirs, including Internet Explorer.

When channel binding isn’t requested by a server (in this case the OpenSSO servers), in theory it can be ignored, but currently available versions of Java don’t ignore it, instead passing it on to the AD domain controller, the result of which is a GSS Exception in the OpenSSO logs when using Internet Explorer on the client workstation. Firefox isn’t affected as it doesn’t request channel binding.

There are various workarounds which might be applicable to your situation:

• Ensure all Windows users use Firefox
• Make a registry change on all Windows clients to disable the Extended Protection
• Upgrade to a new build of Java (it’s Java bug 6851973)

If you’re looking to upgrade Java, this fix is available in release candidates of Java 7. It may be available in Java 6u19, but not in the currently release Java 6u18 or prior, unless you’re paying for Java for Business – the fix is in 6u17-rev-b06.

Hopefully this post might prove useful to someone – it took us some time to find the cause of the problem, and the resolution.

The internet landscape of the ‘average Bob’ consumer user has changed significantly over the past year or two, resulting in not only an explosion of logins and of PII scattered everywhere, but of services that allow (or require) this data to be shared from site to site. Bob might well have logins to various sites for online account management (banks, utilities, etc), each of which will hold local copies of his PII (address, DOB, etc), but he also now has a Facebook profile, a Flickr account, and perhaps shares his travel through Dopplr and his location through Google Latitude, and allows his friends to see his data in some or all of these services.

What I want

Because I’m conscious of my PII spreading out over the internet, and of the hassles of managing it all in a secure manner, I’d like a service along the lines of that described by Mark Dixon here to manage it all; though as I commented on his post, I’d like something a bit more outward-facing. My ideal identity service would contain:

1. Credential Vault: Consolidate credentials into one identity (‘me’), which lets me authenticate to services as appropriate. This should be a standard federated identity (an OpenID, InfoCard or whatever) where it can be, but it should also act as a LastPass-style credential vault where the service provider doesn’t support new-fangled federation. This credential store should be cloud-based, but locally cached, and optionally integrated with my OS (for strong auth via smart card, biometric, etc). The credential actually exposed to the end service will vary (I might want to be totally anonymous, or at least pseudonymous – not traceable from one service to the next), so they don’t necessarily need my strongly authenticated, full-on identity, and this is separate to my level of authentication to the broker (which is by necessity always equal, or stronger).
2. Attribute Store / Persona Editor, with Assurance: Collect all my PII, and provide an easy way for me to group this into personae (my personalities, if you will) and present this to SPs.  Services should be able to specify that they need a level of assurance, and that the various attributes I provide are true – and my identity store should be able to keep this and present it when needed. As an example, I might just present a name (it might not be real) to a web forum, but my real address, verified by an independent body, when applying for a new credit card.
3. Auditing and Updating Service: Beyond providing PII to sites, I want to be able to look back and find out who I gave it to. Today, I have no idea how many sites have my addresses (email or physical) – probably thousands over time. I’d like to see a log of this; moreover I’d like to be able to revoke that data from the providers, or force them to update their cache of it from my store when it changes. Furthermore, I want to know where else my data has gone – a list of which of my Facebook friends has synced my contact details to their mobile, perhaps. Ideally I should be able to set terms on registration of what each service can do with my data – this is more of a contractual, rather than technical, assertion.
4. Sharing and translation: For site-to-site sharing of my data (Dopplr updating my Facebook, for example), OAuth describes how permission can be granted at a service-to-service level, but my Identity Store should be a broker in the middle so I can make decisions in one place. By sitting in the middle, this broker could offer additional services, translating data into a shareable format where a point-to-point service doesn’t already work.

I’d probably be prepared to pay for this, or see it as a value-add service from someone I already have a relationship with, as long as I trusted them with all this data.

What Bob wants

Bob, our ‘average internet user’, doesn’t really understand security. He’s the guy whose PC you have to fix when you go to visit, who has 15 browser toolbars from assorted malware running, and who loves to throw sheep at you on Facebook. He isn’t curious about why all those quizzes exist, and on a quiet Friday night wonders if that Viagra email might actually be a good deal.

He’s got online banking, GMail, Facebook and MSN Messenger. They all use his name (or a variant of) for the login name, and every password is the same, but it’s 8 characters and has a number in it – because his work IT policy says so, and that password is the same too.

Bob doesn’t think about where his PII is going, nor about who has it – at least until he moves house and has to tell dozens of companies – and gets a bailiffs letter because he missed one off the list and bills get sent to his old house. He’d likely be pretty confused with the concept of the identity service I’ve described.

What the services want

Service Providers (like my bank, Facebook, or even government) want me and Bob to use their services. They want to capture enough PII from me to provide that service without scaring me off (because the service is insecure, or they’re taking too much PII) or scaring Bob off (because signup is hard and confusing), in the cheapest way possible. They want users to be ’sticky’ to their services, locking me in as much as they can so I don’t leave for a competitor. And if they’re less than scrupulous, they can sell all my juicy PII to ad companies.

The attributes actually needed by the service provider, and how sure they need to be that the attribute is trusted, varies according to the service. Twitter doesn’t care that I’m me – unless I’m a celebrity – but the government wants to be pretty sure I’m who I say I am when issuing me a passport.

There aren’t too many standalone Identity Providers, and no ‘Identity Store’ brokers in the way I describe that I’m aware of. The best we have today are things like OpenID and OAuth. These allow me to use the credentials from one service provider to access others, or to set up point-to-point data sharing, but these are far from perfect… Google is of course keen for me to use my Google login to access services like Plaxo or Facebook – but they wouldn’t let me use a credential from these sites to get into all my Google services. This is done to assert the Google brand, and to keep me using their services.

Will we meet in the middle?

The various great technical minds in the identity world will no doubt come up with excellent solutions to a lot of this, but I don’t think the technology is the real challenge; instead, it’s the fact that the bulk of internet users are like Bob.

Service providers are generally not independent enough to build a complete service like this, and for it to be truly trusted, and there isn’t a business case for a standalone identity provider because most people are like Bob, and wouldn’t pay for an identity service.

It’s not all doom and gloom, however. The fact I can use my Facebook, Twitter, Google or Windows Live login to log into multiple sites is a step forward; indeed I even think the ‘NASCAR problem‘ is a good thing, because it’s forcing people to think of elegant ways to move forward. This will over time

I’m not sure there’ll ever be a business case for completely standalone identity providers, but would imagine decent consumer-grade services will evolve out of services like Verisign’s Personal Identity Portal, or equivalents from people who already store lots of your PII (credit agencies, governments, banks etc) when they spot the consumer value in doing so. These will inevitably be multi-tiered services, offering Bob something nice and simple, yet offering me a (perhaps paid-for) more complex service.

As someone working in the identity field, I figure the best way to drive these things forward is to encourage all the Bobs I know to be more aware of their PII and where it goes – if enough of them start to ask questions, the services to support them will fall into place.

It’s a bit tortured, and not exactly representative of the inner workings of SAML, but it gives the basics. For a real, technical explanation, the Wikipedia page gives a good outline, and hardcore nerds can read more at saml.xml.org… But if you’re interested in reading those, you’re probably not the right audience for this post anyway.

The basics

So, we’re trying to achieve federated SSO – that is, I’m a user at Company X, and I’m trying to access resources at Company Y. As the user, I don’t want a new set of credentials to manage at Company Y, and Company Y doesn’t want to have to deal with joiner/leaver for me. SAML allows us to solve this problem fairly easily – indeed in the case of some service providers (Salesforce and Google Apps as an example), this is trivial out-of-the box functionality for some SSO systems.

SAML federation occurs through a series of interactions between the two parties, after first establishing trust between them. So, on to…

The analogy

Imagine I’m a consultant (I am, so it’s easy for me), and I’m going to be working on a client site for a while. We’re going to look at my interactions with my own employer (my identity provider) and that of the client, whose resources I’ll be using (the service provider).

Establishing trust

Clearly, I can’t just turn up unanounced at the client’s site. There’ll be a series of meetings, swapping of business cards, probably some lunch… And then a contract will be signed. This contract will determine the length of the work order, and we’ll probably sign NDAs, and perhaps we’ll be given details of security behaviour (what to do on the first day, etc). The client will conduct due diligence, making sure (s)he knows our company, checks references and so on.

What we’ve done here is established trust between the two entities. They know who each other is, have contractual agreements on information sharing, and some basic protocol information.

Swapping tokens – authentication

So, now that we’ve arranged the work, on Monday morning I’ll turn up at the client’s office. Of course, the guy at the security desk has never heard of me. So firstly he asks me for some recognised ID, and I show him my passport. So now he knows I’m who I say I am – one might say I’ve used a standard protocol and token. But he doesn’t know that I really work for my employer, so a couple of things might happen. He could check in his computer system and call the security team at my employer, or call someone in his own organisation who’s already done this.

He’s now established I’m who I said I was, and that I belong in his building, he gives me a security pass for the building. It’s a temporary pass, obviously. It might be valid for the whole duration of the work order, or a shorter period. If the contract is a long one, he might want to periodically call up my employer to make sure I haven’t been fired – but probably not every day.

So, I’m authenticated at my employer with a token (my security badge). But the client doesn’t understand this so a shared token standard is used to convey this information to the client – my passport. On validating the token, the client needs to check that I belong to the partner and I’m not just a random, so they call up and check, in the same way SAML back-channel validation can occur. Once validated, I’m given a session token with the client/provider, which has a local expiration, and a periodic check against the partner.

Authorisation

The building pass he’s given me lets me into certain parts of the client building, based on the work I’m doing for them (as agreed with my employer). This compares to the pass I’ve got from my employer, which restricts me to access based on the job I do when I’m back at base – but the two cards are completely unrelated and disconnected.

Here we’re highlighting that my level of access on either side of the partnership are disconnected. My employer has agreed the work package with them, so they know what access to give me in their building based on that role. This is of course related to my role in my own office – but the access level given here is completely different.

…For dummies

So, that’s a high level explanation of how federation occurs, particularly with regard to SAML. I’ve found it a useful simplification for people who have no comprehension of how this stuff works – obviously it breaks down if you look more carefully! If you read this and can think of improvements, let me know.

Update: I had some debate with @paulmadsen regarding the ‘passport’ part of this. It doesn’t really work in the analogy – I was trying to convey the idea of the SAML token being something generated to a common standard, that both parties understand, and that’s not the same as the internal auth token necessarily. A passport is wrong since anyone can read your passport in the real world, but with SAML only the two endpoints can read it.

The main message of the talk was that by focusing on flows of data (particularly, but not limited to identity data) and the user owning that data, you can improve security, your user/customer experience and drive improved financial returns. The slides for the talk with accompanying notes should hopefully be up on our website shortly.

The topic is one that’s gaining focus as organisations shift focus from using IAM solutions to manage risk/compliance and regulatory requirements to more intelligent, business-focused solutions. In discussions with clients, there’s an eagerness to bring IAM out of the ‘back room’ and integrate it more tightly with CRM and BI tools – but also to empower users.

This is seen in internet properties from Google and Yahoo (amongst others), giving the user the ability to share logins, contacts, location and other personal data. Whilst this is great for simplifying things for a user across a number of sites, the key is to empower the user to decide which data is shared, and where. Both in an enterprise context and on the internet, it becomes a challenge to present this to the user in a friendly way, highlighting which data is owned by the user and which by the ‘other party’ in each context. This challenge looks to be where my focus is going to be for the next few weeks, at least.

I’d really hoped to convert my scrawled notes into a series of posts on the topics covered, but time has escaped me and so I thought I’d at least post some of the notes I’d taken in rough form so that they didn’t get completely lost… So here are the notes from Day 1. If I get time, I’ll come back and post on some of these topics in more detail!

(There are also plenty of notes from other folks on the event’s Twitter stream, #idm09.)

OASIS IDM 2009 – Day 1

Session 1 – Use of Open Identity Technology In Government

- Leverage existing, open identities for government applications
– New government 2.0 initiative
– Using OpenID / InfoCard vetted providers
– 10 providers -> Can choose which provider / id (Google vs Equifax, for example)

– GSA defining ‘profiles’ – sets of standards at specific versions, guaranteed compatible
– Also ‘levels of assurance’ – criteria for various strengths/token types, according to risk/impact of incident
– Not building again, mapping publicly available identities against government assurance levels

–New concept of open trust framework to certify IdPs
– Jointly presented by OpenID, InfoCard foundations
– Outreach to OpenID, InfoCard, InCommon, Liberty and Kantara

–> Open Trust Framework
– Doesn’t presume any existing circles of trust (vs SAML)
– User controlled identity management
– Open, reusable

Anyone can become an IdP, but need to be vetted.

ICAM profiles force private sector IdPs to be precise, to meet the government-specific requirements
It’s a win for the government, industry and the public:

- Govt doesn’t build in a silo
- Industry gets tighter specs to focus on, and drive wider adoption
- Users get reduced numbers of identities, at government levels of assurance

- No verification of assertion attributes, just that attributes are present (e.g. email attribute not checked to be a valid email)

SAML Profile: Already exists, based on existing SAML use cases in govt.

ICAM OpenID Profile:
- Only for sites at LOA1 thus far
- Based on OpenID 2.0
- SSL enforced on all endpoints
- “Directed Identity” approach, i.e. identity appears different to each RP, so no tracking
- Other restrictions defined in profile too, to ensure appropriate security

InfoCard Profile:
- acceptable at LOAs 1-3 (maybe 4)
- Focus on the UI, digital ‘card in wallet’ – card selector in browser
- Can have varying underlying auth methods
- Only supports Managed Cards, IdP issued
- Card auth mechanisms are un/pw, X509, Kerberos, etc

– Truly user-centric would be self-managed

Don Campinella (Equifax)

Spoke about ‘persona control’ – multiple personas for a given identity
Attribute use assurance
Verification of claims

Suggested that a commercial IdP gives experience, data, scale, trust
Better fraud protection and privacy (some liability?)

Discussed at LOA1 use of pairwise unique IDs, pseudonymous: reusable unique identifier given to each RP, but can’t be traced back to the user unless the user shares attributes. Each pairwise identifier can be revoked from the RP.

Quoted that 20% of Medicare/Medicaid fraud is at the service provider, not the user, so we need to authenticate the service providers as well as consumers. This creates the need for a standalone IdP, outside of the RP.

Session 2 – Mary Ellen Callahan (CPO of DHS) & Ari Schwartz (COO – Centre for Democracy & Technology)

MEC on the baseline of govt idm tech – “It’s got to work for my mum” – what happens if something goes wrong? Not just a data breach, but how do you interact with the individual and manage the problem.

- Should have a plan, since nobody’s infallible
- Elements of redress
- Harm-based analysis
- Not just financial loss, but also reputation, etc.
- Maybe even public safety (location data, etc)

-> All about trust of government

Overall message: “Make it as secure as can be, but also plan for the worst. Have a policy to a) deal with it and b) prevent it recurring”

AS – Test of ‘user-managed identity’ is not in the user interface or the technology, but whether the user is on an equal footing with the IdP and the RP.

Session 3 – John Tolbert (Boeing)

Using XACML and ODF for Export & IP controls

Need to have resource (classification, ECCN, USML)  & subject (nationality, location, US person) attributes

For IP controls, there’s an OASIS-XACML-IPC profile.
By using XACML, there’s a simpler, quicker adoption
-> Government can push out standard policy in XACML format to be used in a central decision engine at each org
-> Facilitates quick updates, easier audit – using standardised XACML means standardised rules (though relies on accurate metadata)

Extending this to ODF document control profiles, to match the XACML-IPC profile. This gives end-to-end authorisation, not just at the point of distribution.

Gives the organisation a single set of policies / rules to manage.

Breno de Medeiros (Google)

Drivers for federated identity standards in Google are predominantly credential reuse and social graph sharing

- Social sites ask for passwords for data harvesting
- This is bad! Users are trained then to share passwords (see Linked In, Dopplr, etc)

More reputable sites are less likely to implement APIs for authorisation/delegation as an RP, since they have little to gain. To succeed, providers should give a rich authorisation/delegation API, and a good UI!

Example of Plaxo & Google – OAuth and OpenID combined, but with friendly simple UI. Google account can be used to login to Plaxo, then OAuth allows for sync of contacts.

UI: Per-attribute authorisation is difficult, every additional checkbox makes the UI more complex and prone to rejection by the user. Also noted that users expect a ‘generated’ ID to be pairwise, but a social site ID, or manually created by the user, to be a global, shared identity. Need to be careful as PII could be exposed in URLs (email address, other correlatable data)

Current UI for OpenID that hides the ID is good (‘use your Google/Facebook/Live ID to login’) but isn’t scalable. There needs to be a good browser interface (like InfoCards) for IdP discovery in a privacy-aware way.

Session 4 – SAML 2.0 in government

Karen Higa-Smith (DHS programme manager)
Anil John

Discussion around use of SAML2 for data sharing.
Authentication is already handled by the PIV smart card.

“Profile” created – this is a set of specs at particular levels along with guidelines and implementation documentation for use within government departments. It’s not a ’standard’, since building these is slow and expensive.

Programme to manage ‘backend attribute exchange’ (BAE).
- Built a deployment profile and documentation
- Build a proof of concept BAE reference implementation, using synthetic data, to show interoperability between multiple vendor products following the BAE profile

- Idea was to document the profile but not to reinvent the wheel, instead to use commercial or free products and existing standards. Programme should allow for multiple approaches and technologies, but to ensure interoperability.
- Encouraging COTS vendors to provide out-of-box support for the US government BAE profile.

Explained two models
1- Direct Attribute Exchange
2 – Brokered Attribute Exchange

In the first case, a simple data exchange using SAML from point-to-point
In the second, smaller departments can use shared infrastructure from a larger department – but the data should be encrypted so that the shared infra provider can’t read the data. This was successfully accomplished using existing SAML standards.

- Specification of supported attributes, name identifier, encryption standards, etc are all specified within the SAML exchange.

- Also integration with the CA, so that user identities can be mapped to those on PIV cards or other certificate issuance.
- Flexible name identifiers, so that there’s no enforcement of a specific unique identifier.

Session 5 – Social Identity

Burton: Leveraging relationships & managing social identity

Discussed benefits of social identity (profiles, social graphs, etc) within the enterprise
e.g. Establishing social data in enterprise portals (skills, expertise, interests)
Leverage within blogs, wikis, forums – munge this data for display on portal -> activity feeds
Allow for ‘following’ of employees, subjects of interest

‘Facebook for enterprise’ – already have business dashboards, sales dashboards – why not a social dashboard?
Supports strategic talent, encouraging interaction, reflects generational shift towards social interactions

BUT
- problems of profile proliferation across multiple internal sites (and external)
- solve this with federation/sharing – but then problems of data leakage?

- Also automated activity stream causes sensitivity issues (e.g. posting on a gay forum, completing a sensitive deal)
- Resolve through access management, but then this risks losing serendipity. Creating a balance of access restrictions and openness is a big challenge.

-> Becomes an even bigger problem when trying to merge social graphs between internal and external tools (Facebook, Linked In)
- Breaking boundary between “work me” and “citizen me”. Is it acceptable for your boss to contact you about work issues on Facebook? Should they know about your out-of-work activities?

Roles:
- Enterprise roles are well defined, though centred around access control
- Social roles proposed, e.g. “News filter”, “wiki gardener”
–> Social ‘talent management’, mining within the enterprise?

Vendor presentations

IDology (Jodi Florence) – identity verification provider
Anakam – government to citizen verification – a sliding scale from anonymous through to vetted proof with liability
Privo (Denise Tayloe) – Parental consent for managing a child’s identity and data sharing

A couple of years ago he came up with a set of Laws of Identity – embracing the ideas that users should always own their data and dictate how it’s shared, that there should be minimal disclosure, and so on. In this post, you can see links to more detailed descriptions of the laws, and a nice image summarising the laws (shown below).

I’m spending progressively more time at work thinking about public/consumer identity as well as that kept within an enterprise, and I find keeping these laws in mind ensures the delivery focus is kept in the right place.

The first by Ian Glazer on the Burton Group Identity blog notes that apps can get access to all your details even if your privacy settings are set to prevent this… Whilst you can prevent a third-party app from accessing your details directly, if you allow your friends to read your profile, when they install the app it inherits the permissions of your friend relationship, rather than your own app settings, meaning the app can suddenly access your whole profile.

The second by the Cambridge University Security Research Lab relates to ads served either through Facebook, or within apps using the Facebook platform, and how these can access your personal data and the pictures you’ve stored. It ends with a worrying note – ‘The platform API remains fundamentally broken and gives users no way to prevent applications from accessing their photos.’

I’ve come across some debate recently around passwords. It seems to be becoming common knowledge that password security generally isn’t good enough these days, and 2FA or other strong methods should be used where possible. However, that’s an issue for another day – passwords clearly are in the majority when it comes to the average user’s experience of IT security.

Some sources suggest that password rotation is a bad idea, and others propose that the asterisks, or similar characters that obscure your password are nigh-on a waste of time – notably security expert Bruce Schneier. Masking passwords mostly serves to annoy users continually to avoid the virtually non-existant threat of someone reading the password over your shoulder.

It’s a potential solution to this password masking problem that I came across this week – a mechanism that displays a colour key next to the password entry box called Chroma-Key.

A hash of the text you’re entering for your password is generated in real-time. Each small change generates a significantly different hash, and it means you can see at a glance that you’re entering the correct password, hopefully avoiding your account getting locked through typos, but without revealing the exact password.

You can find out more about it on the author’s site, and the original article on Infosthetics.

That being said, the thing I really don’t like about Facebook is the crappy applications and quizzes that people seem to expect you to join in with. I don’t care that you’ve thrown a sheep at me, or the Spice Girl you’re most like is ‘Baby Spice’… But more worrying is that these apps are quite often vectors for spam and people are entirely oblivious.

The security lab at Cambridge wrote a good article highlighting how bad this is, clearly spending a lot more time than my totally unscientific analysis of asking a few people I know, and experience of using the site. They noted that it’s relatively easy for an app to get published on the Facebook platform that can steal the user’s Facebook session, then use this to query Facebook’s servers impersonating the user and mine all of their personal data and that of their friends.

Facebook don’t allow you to do this under their terms of use, but obviously there are so many apps being published that some slip through the net. More than this, they’re not inclined to check particularly actively as long as users don’t shout too much – these apps have nicely targeted ads which make them and Facebook money. But of course the ads are targeted – the app stole all your data, so you can be pretty sure they can pick an accurate ad. None of this is new news, there have been a variety of reports in the technology and mainstream press highlighting how identity theft and other privacy concerns abound on Facebook.

The thing that never ceases to amaze me, however, is the fact that users continue to complete these inane quizzes, download free apps that allow them to throw sheep at their friends and don’t stop to wonder why anyone would go to the trouble of building these apps for free. It’s all well and good that Facebook asked me my date of birth when logging in from an ‘unusual location’ (I was travelling for work), but this is of little security benefit when it’s trivial to steal this information during my use of the site from the safety of my own house.

I’m unlikely to stop using Facebook given the amount of friends and work colleagues who use it, but please don’t be offended if I ignore your request for a pillow fight, zombie chase, gang war, or the chance to find out which South Park character you are.

It’s quite a daring advert campaign – and one I have a hard time believing. To me, the Evening Standard, along with its former owner the Daily Mail, have been for a long time synonymous with racism, homophobia and general, widespread negativity. I’ve assumed that every article is pretty much about sending the ‘dirty black, gay, asylum-seeking, dole-scum’ back where they came from.

The Guardian comments on the new advertising campaign, noting that if nothing else it will spark debate, following the paper’s acquisition by a Russian billionaire and his plan to transform the paper.

He stated that he’d like to make the paper younger, more ‘progressive’ and more positive about life in London. This can only be a good thing – I for one would pay for a quality evening newspaper that provided a decent amount of interesting news – a Guardian-lite, perhaps – instead of the drivel that is currently available, whether the freesheets or the current incarnation of the Standard. When the paper is relaunched on 11 May, it’d be great to see this transformation – but I think I’ll wait for the news coverage rather than queuing for my own copy.

That’s right – suggesting you get in a jet and burn a load of fuel as a reward for ‘greening’ your domestic lighting.

I’m all for encouraging people to reduce their consumption, but this needs to be by educating people on the reasons why, not by offering discounts on massive energy consumption as a reward for minor reductions.

Even for those who don’t believe in the cause, there are undeniably good reasons to strive for energy efficiencies, and to remove the Western dependence on Middle-East oil. On a local scale, for individual homes and businesses, there’s a clear economic gain with a very short payback period by installing insulation and low-energy lighting, or simply by planning more efficiently.

At an international level, it’s surprising to see even fairly entrenched ‘traditional fuel’ organisations announcing that they are aiming for carbon-neutrality by 2050. Given this agreement includes companies like E.On and EDF, who are heavily into coal and nuclear respectively, it’s going to be quite a stretch. If they can collectively move forward on smart grid technologies and power distribution, though, the cost savings of stable, European power prices will be much more attractive than the volatile fossil fuels markets – especially if one factors in the cost of wars for oil. I was surprised by quotation from the president of the European Wind Energy Association on the relative prices of fuel -

At current fuel prices, electricity production costs from a new wind farm, coal plant and gas station are more or less the same.

I was under the impression renewables were still a fair bit more expensive. Of course, the statement needs to be taken with a pinch of salt given the source.

Elsewhere in the world, Barack Obama has promised to sign a climate bill into US law, a significant departure from the previous administration. The bill is likely to include a US cap-and-trade system for CO2 emissions, compatible with the system already in operation in Europe. It also seems that a significant amount of Obama’s economic stimulus money is being given to green power, which is great news. Interestingly even companies such as IBM are bidding for funds, in order to invest in smart metering & distribution. We’ll just have to hope that the bill doesn’t get too watered down, and that US carbon trading is more effective than the European scheme has been so far.

Closer to home, things are a little less optimistic. It seems there’s now a chance that the third runway at Heathrow won’t get built, but this relies on the fact that BAA won’t lodge a planning application until 2012, after the next general election, and that the Conservatives are significantly ahead in the polls. They have said they will prevent the project going ahead, as compared to the encouragement from Labour. Whilst I support many of the environmental moves the Tories are making – high speed rail instead of the runway being one – there are enough skeletons in their (not so hidden) closet that I couldn’t bring myself to vote for them.

Talking of Conservative idiocy, in a supposed cost cutting measure, Boris Johnson has cut the environmental staff of the GLA from 40 to 20, reducing the climate change & energy team from 10 to 3. This seems to fly in the face of his stated goal to make London the greenest city in the world. In isolation this would be frustrating – but perhaps necessary to save money – but alongside his abandoning of the Western congestion charge and paying mere lip service to other environmental schemes, it seems we’ll have to look elsewhere for leadership on the environment.

In a pretty unscientific experiment, I turned off everything in the house except the Current Cost meter, then went around switching things on and noting roughly how much power they use. Curiously, with nothing on except the meter, it was still showing around 60W of consumption. I’m not sure where this is coming from, but it’s constant.

Here’s the list of devices around the house that I measured:

Fridge     50W (when running)
Sky        30-50W
NAS        65W (on 1600-midnight weekdays, 24hrs weekend)
Mac mini   20W
Airport    4W
Router     5W
Xbox 360   10W
Wii        5W (in 'red' standby, 10W in 'amber')
TV         5W
Xbox       5W
Amp        5W
Subwoofer  5W
Phone      5W (two cordless chargers)
Laptops    2W (two chargers)
Mobiles    1W (two chargers)
Boiler     2W
Microwave  3W
Appliances 2W (oven / dishwasher / washing machine)
Pong clock 3W

So this highlights mostly that we have too many gadgets. I reckon we could save about 40W by completely switching off some of the stuff in the living room when it’s in ’standby’. Assuming usage of 4 hours per day and the rest of the time on standby, at roughly 20p per kWh, we’d save nearly £60 a year by switching them off – definitely worth investing in a ’standby saver’ adapter, I think… Or just getting rid of the gadgets!

Of note, I’ve switched from using the Google Graphs API to RRDTool. This is for two reasons – the Google graphs API just seemed a bit fiddly, even using PyGoogleChart, and rrdtool graphs just seem pretty easy to output. In addition, it means I get averaging for free and don’t have to manage the database.

I’m still using the Python I tweaked from Dale Lane, but I created an RRD based on Paul Mutton’s guidance and update it using a Python module for RRD from Corey Goldberg. Feel free to ask for a copy of the scripts.

For some reason my sqlite db update script liked to bomb out after a couple of hours, but this seems to be working fine and has been gathering data reliably for the last few days.

Of course the whole point of this isn’t just to make pretty graphs, but to try and do something about our consumption. I’m already obsessing about the graphs produced, and they’re making it easy to see when something’s left on – our ‘base load’ seems to be about 200W, so anything more than this means something’s on somewhere.

Our most obvious heavy power usage is the oven, at about 3kW, but there’s not much I can do about that other than cook more with gas  – or eat more salad! It’s generally not on for long, so not the end of the world. Interestingly, the oven seems to heat up in under 10 minutes (solid power use, followed by intermittent bursts to keep it hot). I’d always assumed this to be longer, so that’ll save some time and money!

I’m also quite conscious of the fact we sit in the living room with a few 60W lights on in the evening for quite some time. They’re on dimmer switches so I’m now hunting for dimmable CFLs. The Megaman bulbs seem to come quite highly rated, but I’m not really sure how good they are. If anyone’s readig this and has some insight, feel free to leave a comment!

My next plan with the graphs is to work on aggregating daily/weekly data to show trending totals and ignore the short-term fluctuations, so that I can see how things are improving. When I get some time at home to myself I’m going to try and work out exactly where the 200W base load is going (NAS, router and Sky are the key candidates) and see if I can get it lower.

The lectures are recordings of sessions held at WBS, outlining research work they’re undertaking. I took a few modules on organisational behaviour as part of my degree at Warwick, and it’s something I have quite a personal interest in – unfortunately it’s not necessarily been reflected in the places I’ve worked. I’m hopeful that’ll change in the future.

You can find the lectures on iTunes U – I think they’re definitely worth a listen, though they might be a little dry for some people!

For now, I’ll just link to two articles from the Guardian:

Revealed: police databank on thousands of protesters

This first article shows how police are routinely storing photos and videos of political campaigners or protesters. These people aren’t breaking the law, but their movements and behaviour are being compiled into a large intelligence, to be kept for seven years, alongside evidence of those convicted of public order (or worse) offences. It’s a massive violation of privacy, as far as I’m concerned.

The second article stretches this loss of privacy even further, with the former Whitehall security co-ordinator stating “Finding out other people’s secrets is going to involve breaking everyday moral rules.”

This to me is a staggering admission that the government and civil service are happy to breach the rights of privacy for innocent citizens by routinely capturing and mining it to spot ’suspicious’ patterns. The data to be collected are “personal information about individuals that resides in databases such as advanced passenger information, airline bookings, and other travel data, passport and biometric data, immigration, identity and border records, criminal records and other governmental and private sector data, including financial and telephone and other communications records.”

Even more worrying (though perhaps unsurprising these days), there’s a good chance the data management will be outsourced to the private sector and not held by the government. This means that private organisations, quite likely outside the UK will be responsible for the security of your financial information, communications records (in other words your phone bills, and likely your emails), and travel records.

It seems there’s little general awareness of the scale of these plans. If you happen to stumble across this post, I recommend you try to learn more about this, and if you feel strongly, write to your MP.

The scripts are fairly thrown together as I’ve waded my way through various Python documentation, and the sqlite and Google Chart API modules, but I’ve managed to get some initial graphing up and running, which you can find on the Current Cost tab (or click here).

The graphs should update every couple of minutes, and so far show power usage & temperature readings for the last 15 minutes, and last hour. To get these working, I have a script which listens continually for the output from the CC128 and stores it into a sqlite database. There’s a second script which reads this database and makes calls to the Google charting API, generates PNG files and then pushes those up to my blog host.

I’d like to get 6-hourly, daily and weekly graphs, but these will require a bit more fiddling as the data needs aggregating before passing to the chart API. I suspect it’ll be a few weeks before I have the time to get that working… Likewise the graphs need a bit of tidying up (better axes, labels, etc).

In the unlikely event that anyone’s interested in the Python scripts to do this, either leave a comment in this post or drop me a mail.

There’s a new release of Sun Identity Manager just out, version 8.1. This close to a go-live I wouldn’t normally contemplate upgrading, but it seems to have a good set of features worth investigating – not least better SiteMinder integration and open source identity connectors.

A nice touch, whilst terribly dull, is a blog that features updates/changes to the documentation, so you can get notified via RSS of significant updates. Their competitors could learn a lot from this sort of open way of working.

Interestingly, they also offer ‘Secure VPN exit in Switzerland’, to offer you extra privacy. Your traffic will appear on the internet with a generic Swiss ISP address. In comparison to other ISPs, they have a surprisingly simple acceptable use policy – ‘Don’t do anything stupid or illegal’.

The downside is that they charge £65/mth for an 8Mb service, so for now I’ll be sticking with Be/O2.

It’s slogan is ‘All your stuff, on all your devices, with all your friends — in seconds’. It’s a media manager that seems to have a pretty good UI, and on the Mac mimics somewhat the Finder or iTunes sidebar, showing your music, photos and videos. It also has a ‘friend feed’ for you to see what your Doubletwist friends are playing (or sharing), and you can upload media to Youtube, Flickr and Facebook. Surprisingly, you can even share tracks you’ve bought from iTunes with your friends.

The most impressive feature is that of copying your media (including DRM-protected content, such as purchased iTunes songs). A pretty large set of devices are included, counting Nokia phones, Blackberries, Windows mobile, Android and the PSP – oddly iPod and iPhone sync support is only available in the PC version.

Sync is as simple as it could be – just drag the media you want on to your device, and any encoding or translation is done on the fly.

Whilst some of the more extreme DRM-ripping features have been removed since the initial concept came about last year, and the media playing features aren’t that great yet, it looks like an interesting tool to keep an eye on.

I’ve got my Current Cost meter up and running with Dale Lane’s Python app. This was ever-so-slightly fiddly, so I thought I’d add my voice to those already out there with some step-by-step instructions for OS X users.

1. Get a Current Cost meter
2. Order the USB serial lead
3. Install the drivers for said lead – this creates a new device
4. Install the Apple Developer Tools
5. Download the Python source for Dale’s app
6. Follow the prerequisite list
7. Install MacPorts
8. Rebuild SQLite (run sudo port install sqlite3 +loadable_extensions from an XTerm)
9. Export the DYLD_LIBRARY_PATH (for me this was export DYLD_LIBRARY_PATH=/opt/local/lib)
10. Run the app – python currentcost.py

Not too bad, and you should get a nice pretty graph, like so:

Next up, I’m going to be taking the real-time data into a database and trying my own bit of graphing.

It’s a witty and amusing read for anyone who has any interest in office politics, particularly those in IT. It’s written from the point of view of a development middle manager, and highlights with surprising accuracy the stereotypes of employees and managers you find both in a large organisation or a startup.

For me (with particular personal relevance), the highlight of the book was a paragraph commenting on an average employee who’s drowning in work he’ll never be able to finish because he’s fundamentally not good enough, whom you should get rid of:

If you’re the manager in this scenario, you’ve got to make a major change because you cannot release crap. There are companies that do this and end up making a tidy profit. You are not this person, because once you are rewarded for releasing crap, you begin a blind walk down a path of mediocrity that ends up with you working at Computer Associates on a product no one has heard of and that no one cares about.

It’s already producing surprising data – when I got up this morning, the house seemed to have an ‘ambient’ power consumption of 278 watts, which seems pretty high, but I think the boiler was whirring away at the time.

As I sit here, with some lights on and various other bits and pieces, it’s reporting 674W, or £2.26/day at this rate of consumption.

The real value of the Current Cost though is the cable for attaching to a PC, so you can capture and report on the data. Not being too much of a coder, it’s going to be a bit of an adventure – the CC just outputs chunks of XML every 6 seconds, but handily there’s tons of good work out there to ‘borrow’.

I’m hoping to produce some graphs a bit like these, or even better make the lights on Corneliuss, my Nabaztag light up according to how much we’re using!

Both in my own experience and through stories of others, it seems most large organisations are woefully bad at doing this – most often conducting adhoc manual reviews, orchestrated by an overworked IT Security team. These are almost always achieved through mailing Excel spreadsheets, or people wandering the office with printouts… “Are you the owner of this system, and if so, what does it do?”

There are far better ways of doing this – both as a one-off, and as a regular exercise.

First step – People

Firstly, you need a good source of people data – ideally your HR system or some kind of directory containing names, job titles, locations and line managers of your employees. It’s important to be able to trust this hierarchy – there’s little point worrying about access rights if you’re not sure whether someone’s still an employee, or who they work for.

Current access rights

Once you know who all your people are, who their managers are and what job they do, you need to determine the access they have.

If you’ve got a provisioning system, great – this will already have a store of the rights in most of your key systems. If not, or for systems beyond the scope of your provisioning tool, you’ll need to capture the user access rights.

For critical applications, you might be forced to report on this sort of thing anyway, but if not, get into the habit of capturing simple files of users and group memberships.

Validation – the challenge

So you’ve now got an employee hierarchy and a series of application rights. To validate, it’s just a matter of checking with a given user and his/her manager that the access is what they need and no more, right? That’s a great theory, but most business managers have no idea what group TRD47 does or why you need to be in it or the hundreds of others that you’re in.

Here’s where that ‘better way of doing things’ comes in – most identity & access vendors now have products for role mining & certification.

Let’s take a big warehouse and into it pour all those lists we collected earlier. Next, we’ll take the following steps:

• Get line managers to confirm their direct reports
• Get system owners to describe each access group for their application

From here, we can run some pattern matching giving output like these:

• All employees get a mail account and Windows login
• All IT staff get admin rights to their workstation
• All traders get access to the trading system
• HR get access to the HR system
• …

Starting with really broad definitions that cover as many people as possible, we gradually narrow down on individual teams, defining the rights they have into business roles. When we’re happy, we can start to validate these roles, having the IT organisation confirm each permission group.

This leaves business managers just to confirm that employees have one of these ‘friendly’ roles.

The second time

Once you’ve captured these role definitions and validated them (and their exception cases), it’s relatively easy to maintain this and conduct regular audits.

Whenever a new system or group is created, this gets captured. If you release a new application, you’re most likely aiming it at a set of users, and this should already have been defined as a role (the London sales team, for example), so you add the new system to that role.

When it comes to your next certification cycle, you need the role owner to confirm that a given role still contains the right systems, and you need line managers to confirm their employees. Much easier than trawling around with Excel.

Moving

In between certification cycles, things are much easier too, especially when you tie your role management tool directly to your provisioning solution (this is pretty easy, as all support standards-based communication). If an employee moves within the organisation, you don’t need to worry about what systems they need access to, or cleaning up the access they had – you’ve just got to add the new role to their profile, and take the old one away.

Likewise for a new joiner or a leaver – their access is well defined, so you know exactly what to give, and what to take away.

So next time someone mails you a spreadsheet asking you to describe what a system does, and who should have access to it, tell them there’s an easier way.

My requirements for backup are:

• It happens without me thinking about it
• At least daily schedule
• Backup deferred until I next wake the laptop
• Selected backup (not whole hard drive) – ideally with varying frequency of backup for certain files
• Automatic versioning of files I change (and delayed deletion of things I delete)
• Offsite storage of critical data (which should be encrypted with my own key)

My ideal would be to backup my laptop to the NAS, and from there to take selective data (photos, documents, etc) and upload it somewhere online.

I’ve not really come up with a good way of doing this, so for now I use Jungle Disk, which at least gets all my important data to an Amazon S3 bucket. This is a good solution, but often means remembering to leave my laptop on for hours after taking a batch of photos so they upload to Jungle Disk. I’m not nerdy enough (almost, but not quite) to write an rsync script that runs in my desired ‘lazy’ scheduled way to get my data to the ‘intermediate’ step before uploading.

Any suggestions welcome!

It was my second.

I managed to rationalise the guilt of yet another gadget purchase because it was effectively a free upgrade. I already owned a first generation iPhone, but since it wasn’t subsidised I could break my O2 contract early.

A new contract would entitle me to a free iPhone if I spent £45 a month with O2, giving me some daft number of inclusive call minutes and texts, and of course unlimited data & free use of the ubiquitous Cloud wifi in the City. This seemed reasonable, and there was the added bonus of some free money when I sold my first iPhone on eBay.

Not a bad deal, I thought – except £45 a month now seems a bit steep. So I dug into the terms, and read that I could downgrade to a cheaper tariff part-way through my contract.

I called O2 today and asked about this. After instantly anwering the call, a friendly lady said that I couldn’t downgrade until 9 months into my contract (half-way), from my March bill date.

Oh, I thought, I’ll put an entry in my calendar to call back in March. I was about to hang up when said friendly lady suggested she “diarise the change”. What’s this? “I’ll schedule the change to your account for March, and you’ll get a confirmation email before your bill date to remind you. Call at any time if you change your mind.”.

I’ve had issues with O2’s coverage and call quality, but if this works as expected, I’ll be pleasantly surprised – most mobile phone firms have notoriously bad customer service. Of course the free chocolates O2 Customer World sent me as a Christmas present didn’t harm their brand either…

At work we’re almost done with our first deployment of Sun Identity Manager. Personally, I’ve found it a good product to work with. I like Sun’s approach to deployment – the base system deploys as a Java WAR file that installs into Tomcat, Glassfish, etc, and it’s pretty easy to connect it to your first set of resources for provisioning. The workflow and forms design are a bit more of a challenge, using an XML-based functional language, XPRESS, and that takes a bit of getting used to, but is amazingly customisable.

Some while ago I was invited to a Sun technical day, at which I saw a demo of some SunRay thin-client appliances that link to the Sun Secure Global Desktop (SGD) product. If you’re familiar with Windows Remote Desktop, it works like this from a user’s point of view, except a bit more powerful. Stick your smartcard in the SunRay and connect to your desktop (Windows, Linux, whatever) running on a VM in a data centre. Go home from work, visit a web-based version and fire up the same desktop.

A couple of guys at Sun have put together a demo of how SGD, OpenSSO and Identity Manager can work together, dynamically creating whole new instances of desktops at a user’s request and giving the appropriate access, then killing it all off again when HR deactivate your account.

I think it’s a pretty cool explanation of how these sort of systems can hang together – for many organisations this could represent a huge saving in user administration, desktop provisioning, and even hardware.

Read about it here, or skip straight to the demo video (12 mins or so, with a great soundtrack!)

The plot is in fact a set of loosely coupled stories about people either in or affected by biotech/genetics, and at times it’s a struggle to remember all the characters. Some chapters are quite fun, and the talking animals (really) are an amusement but the entire novel seems largely to be a rant at the biotech industry, indeed the last few pages are things that the author suggests need to change.

Even if you’re a Crichton fan, it’s not one of his best.

Next up, something a little different – Managing Humans: Biting and Humorous Tales of a Software Engineering Manager

It seems that the idea’s gaining some traction – I see more and more references to it. I really like it as a way to get consumers as a whole to talk about their energy usage, something which most people see as inherently fairly dull.

Whilst products like the Current Cost or Onzo are great for getting individual households to reduce consumption by comparing against their own historic use – or even more simply watching how much money it costs to boil a kettle – encouraging people to be competitive seems a great way forward.

As well as the encouraging news that British users will all have a smart meter by 2020, we need to make sure the data provided by these meters is standardised and easily  ‘mashable’ to allow games like this to evolve on their own. I can imagine energy providers or other organisations offering ‘free stuff’ or discounts to the winners of ‘biggest loser’ competitions if all of us can share our energy data safely and securely – though of course there’s some irony in giving out products to people who are best at cutting their energy consumption. It’d be great to see, for example, the government offering discounts on your council tax bill as a reward for consistently reducing your consumption. I suspect, though, that would be a step too far given how most councils still live in the dark ages.

So far, a very basic form of this exists – my Carbon Account posts my carbon footprint to Facebook each time I add a reading, and I can compare with friends, but this is an entirely manual process reliant on my submission of meter readings once a month. I’m sure wider availability of Wattsons, Onzos and Current Costs will get this moving – I can see me handing them out to my family and friends as Christmas presents this year.

Meanwhile, take a look at this video showing a great example of how it might all come together.

You put some money into your Kiva account and then pick an entrepreneur (or more than one) to lend the money to. The money is disbursed to the businesses via ‘field partners’ – organisations located near the recipients who select the borrowers and manage the repayments. The borrowers pay some interest on their loans, which pays the costs of the field partners. Kiva itself is run by donation. As a lender, you don’t receive interest, but once the loan money is returned to you it can be relent. A charitable donation that keeps on giving!

As well as regular donations to some major charities, I really like the idea of directly helping individuals and their small businesses. Developing businesses and encouraging entrepreneurship seems to me a better idea than just doling out aid money.

If you take a look at my lender page, you’ll see the people I’ve lent money to. Since being a Kiva member, I’ve given out $400 in loans – I put in a much smaller sum, but the money has been cycled round a few times! All of my loans so far have been repaid in full, with no late payments. Pretty good, especially if you compare it to Zopa (where you can earn money by lending to UK-based borrowers) – whilst earning interest here, I’ve had two loans that have defaulted.

This video was produced by a Kiva Fellow – someone who left his job at Credit Suisse in London to volunteer in Cambodia. It gives a great insight into how Kiva works – and might encourage you to lend some yourself!

A Fistful Of Dollars: The Story of a Kiva.org Loan from Kieran Ball.

Into this system, you must provide:

• Applicant information (Birth date, full name, email, gender and phone number)
• Passport information (issued date, expiration date, number and country of issue)
• Travel information (flight and city)
• Address whilst in the US
• Health information (diseases, mental illness)

So, in itself, it’s amazing that you’re expected to give up all this personal data to the US government before you even leave your own country. Beyond that, there’s the risk that this system gets hacked, and someone steals all this data about you.

But I’m absolutely staggered by the popup disclaimer you have to accept on entering the site (I’ve added the bold emphasis):

You are about to access a Department of Homeland Security computer system. This computer system and data therein are property of the U.S. Government and provided for official U.S. Government information and use.  There is no expectation of privacy when you use this computer system.  The use of a password or any other security measure does not establish an expectation of privacy. By using this system, you consent to the terms set forth in this notice. You may not process classified national security information on this computer system.  Access to this system is restricted to authorized users only.  Unauthorized access, use, or modification of this system or of data contained herein, or in transit to/from this system, may constitute a violation of section 1030 of title 18 of the U.S. Code and other criminal laws.  Anyone who accesses a Federal computer system without authorization or exceeds access authority, or obtains, alters, damages, destroys, or discloses information, or prevents authorized use of information on the computer system, may be subject to penalties, fines or imprisonment. This computer system and any related equipment is subject to monitoring for administrative oversight, law enforcement, criminal investigative purposes, inquiries into alleged wrongdoing or misuse, and to ensure proper performance of applicable security features and procedures.  DHS may conduct monitoring activities without further notice.

So I have to give up significant amounts of personal data, and have no ‘expectation of privacy’. Makes me think twice about whether going to the US is even worth it.

The first half of the book describes the 1971 Stanford Prison Experiment (SPE), in which the author, Philip Zimbardo, took a group of US college students and created a mock prison, aiming to study the effects of stress and anonymity. After a series of psychometric tests, ‘normal’ students were randomly allocated the role of prisoner or guard, with the intention of analysing their behaviour over two weeks.

In less than a week, two of the ‘prisoners’ left the study suffering extreme stress – effectively a breakdown – and the guards were becoming increasingly sadistic, forcing prisoners to perform ever more devious punishments. The experiment was terminated after 6 days.

Following the early termination of the experiment, Zimbardo conducted extensive post-mortem analysis with both prisoners and guards, and also of his own team. He highlights how even external observers (for example the parents of the ‘prisoners’) became absorbed in the ‘game’ of the prison, instantly forgetting that it was all an experiment and the participants were free to leave at any time.

Zimbardo uses the second half of the book to compare the SPE to the abuses of Iraqi prisoners in Abu Ghraib, made famous by the degrading photographs taken by Military Police officers and shown around the world. Initially this seems quite a leap, comparing a group of relatively passive, middle-class students to trained, hardened soldiers in the battlefield, but the concepts are surprisingly similar.

Despite public assertions from senior US military figures (indeed as far as Donald Rumsfeld and Dick Cheney) that these were just ‘bad apples’ in an otherwise well-oiled military machine, Zimbardo asserts that they were in fact in a ‘bad barrel’ – significantly over-stretched, fearful of their own lives and living in squalid conditions, MPs with little training of how to look after prisoners are expected to maintain order, with little guidance on how to achieve it.

Beyond this, there was seemingly a strong carry-over from Guantanamo, where ‘high value’ prisoners were routinely tortured. CIA officials operated anonymously along-side the military in the Iraqi prisons, outside of military rules and thus giving conflicting sets of behaviour for the soldiers to follow. Staggeringly, it seems a lot of this interrogation was carried out not by military intelligence, but by contracted-out US companies like CACI. This ‘interrogation’ extended as far as using ‘fake menstrual blood’ that was wiped across the faces of Muslims, followed by the denial of cleaning facilities, to make them feel dirty and question their faith, so as to weaken them to retrieve information.

The analysis of Iraqi abuses highlights the ‘evil of inaction’, wherein observers do little to discourage or prevent morally objectionable behaviour, and how this can then encourage conditions to worsen. Examples are cited where soldiers expect to be rebuked by their senior officers, or for comment to be passed, and in its absence, assume tacit acceptance of the behaviour as ‘the norm’.

In the final chapter Zimbardo describes ‘hero’ behaviour, citing a number of examples of individuals who rally against ‘the system’. He notes that often in such severe situations, it can take just a small amount of effort ‘at the coalface’ to change people’s perceptions of acceptable behaviour. He also gives pointers on how to avoid being absorbed into such situations (obviously on a different scale!) by being conscious of the dynamics of a situation. He makes interesting references to the NASA Challenger Shuttle Disaster, caused technically by the failure of an O-Ring washer, but widely recognised to be caused by various organisational failures within both NASA and the manufacturer Morton Thiokol.

In all, a fascinating book. Its reference section runs to some 31 pages, so I can’t hope to cite all the examples I’ve mentioned, but Zimbardo seems to have found good claim and counter-claim examples in many cases, lending some authority to his argument. Highly recommended.

So, here goes, in no particular order.

• Exercise more – to lose 1 stone by my skiing holiday at the end of March
• Read more – at least all the books I got for Christmas
• Write more – I’d like to keep up the blog
• See friends more – especially those who live far away
• Cook more – related to being healthy, but to try and find more interesting things to eat, away from the routine
• See & do more – theatre, galleries, etc.; generally taking more advantage of living in London

This graph shows 4-weekly gas & electricity readings, divided by the number of days between readings, to give an average daily reading. The most striking is our gas usage. Obviously usage declined as the weather got better, but we had a condensing combination boiler installed to replace a 20 year old conventional one at the end of May.

Following the boiler install, our gas usage dropped to basically zero – helped in part by three weeks in the summer when we had our new kitchen installed, so the only use was hot water. Since the weather’s got colder again and we’ve had the heating on, you can still see a significant difference to our gas usage.

For electricity, we’re obviously using less than we were last year. We’ve been consciously trying to be more efficient – I’ve been gradually replacing light bulbs with CFLs, and trying to turn things off when not in use. I’m hoping that getting a Current Cost meter (or hopefully an Onzo) will trigger some further change in behaviour.

I also sold my car in the summer, and instead rely on Streetcar. This is saving me a lot of money, but also is an environmental benefit to a degree. There’s the debatable benefit of reselling my car theoretically avoiding someone else buying a new one, but also the fact that it’s encouraged me to think twice before driving.

What’s next? I’ve noticed our loft insulation isn’t up to much, and there’s a big hole where our cold water tank used to be, so I’m thinking of installing some Thermafleece.

I’d really like to double glaze all our windows, but large double-glazed sash windows don’t come cheap, so I think the best I’ll manage is to install draught strips around the doors and windows.

Any additional suggestions welcome!

I’d come to HomeCamp, an unconference on home automation and energy efficiency. Despite being initially sceptical, I’ve spent much of the weekend mulling over the day, which consisted of a number of sessions that behaved more like one big group discussion.

There were a number of topics that stood out for me.

Data Gathering and Visualisation

The basic assumption of much of the discussion was that people need to understand their consumption, and this is achieved through monitoring devices. Ideally, you’d monitor the usage of every device consuming power in your home (of course minimising the energy used to do so!). Andy Stanford-Clark gave a great talk on his automated, twittering home – with lots about his Current Cost meter, and impressive use of the IBM message brokers that he’s developed, to gather data from everywhere… Even down to his mouse traps!

In reality, I believe the average (non-geek) user needs an easy way to capture this data and see it represented. I had a great chat with Ben from Onzo, who look to be producing some nicely designed hardware and have already done a deal with a major electricity supplier to distribute these to customers. I’m looking forward to finding out more about their products.

I’d hoped that someone from AlertMe might be there too – I’ve followed their security products with interest, and was recently excited to see they’ll be expanding into energy products. A logical step given their network of Zigbee sensors, and low-powered, always-on base station.

Behaviour Change – Demand Shifting, Demand Reduction

Having gathered the data, you need to do things with it. Firstly, smart meters (or better, smart appliances) will allow your utility company to communicate with your devices in order to smooth the demand curve, and operate at cheaper times. This is important given the inefficiencies that result from our varied demand, which results in power stations that have to start up at short notice, or run at less than 50% capacity. Tom Taylor wrote a good overview post on dynamic demand, based on what he learned yesterday.

Real-time national grid data

I’d never really thought too much about “Economy 7″ and how it came about, beyond my grandad running his dishwasher on a timeswitch so it started at 2am to save him money. If this concept were extended into much more advanced variable pricing to encourage us to smooth the power demand curve, electricity could be generated much more efficiently, reducing costs and pollution – but also allowing use of more ‘variable’ renewables, like wind.

In addition to smoothing the curve, there’s clearly an incentive for us to all use less power, full stop. Dan Hill eloquently describes a concept for visualising this sort of data, and this sort of concept was discussed at length at Home Camp.

Of note, there was a debate on how to encourage people to act – between the simple financial savings and leveraging peer pressure to encourage reductions in consumption. There were some great suggestions around something like ‘Xbox Achievement points’ for challenges, or using Facebook, etc., to give context to your consumption. What’s the best way for me to show my friends I pay £50 for electricity a month, and my fridge represents 6% of that, for example? Could we reward people for being the ‘biggest loser’ somehow, for making tangible changes to consumption rather than just advertising cheap CFL lightbulbs and hoping for the best?

I’d love my electricity bill to give me that context. Don’t just tell me I need to pay £50 a month, tell me that other similar-sized houses with a working couple pay £75 a month, and that I could reduce my bill to £40 by getting a smarter fridge that switched itself off whilst the rest of the country made tea after Eastenders.

For businesses, we got to hear about Pachube (pronounced patch-oo-bay, I think), a startup service enabling people to capture real-time data and aggregate/share it. It’s designed for any sort of data from anywhere, but we talked a lot about companies (or even cities) submitting building data (lighting, heating) which can be reused. A fascinating example showed Pachube data being fed into SketchUp for visualisation – not far from Dan Hill’s idea of hovering sparklines of consumption data above buildings.

In summary, then, it was a great day. I learned about a lot of new technologies, and new ways to apply existing ones to help us reduce energy consumption. It was a good start to what will no doubt be a successful series of events in the future. I’ve have had Home Camp thoughts running around my head all weekend – to the point that I think it’s reaffirmed my belief that I’d like to take a career in this field when a suitable opportunity arises, nudged even further by a recent post by a friend. Thanks to Chris Dalby for organising, and I look forward to the next Home Camp in March. Until then, I’m hoping to spend more time thinking about these topics, and ideally writing about them here.

For other people’s perspectives on the day, take a look at the wiki, the Friend Feed, or follow #homecamp or #homecamp08 on Twitter.