I was thinking of exporting the site content into a PDF and deleting it from the web. But there’s a lot of stuff here, including comments from friends past that I deeply value, and I don’t want to tear all this history down, even if some of it can be a little cringe-inducing.

So I’ve done a little cleanup with a newer theme, fonts, header, and so on. I’m updating the About page as well, to reflect changes in how to find me. For example, I have abandoned Twitter in the wake of the Musk Meltdown of 2022, fully deleting my account (just like I did with Facebook in 2018). That was hard to do — I started on Twitter in 2007 and made a lot of friends, especially in Alaska and across the digital community inside public media.

But life, and the Internet, moves on. (Except, apparently, WordPress, which is still kicking and getting better. They even seem poised to join the Fediverse in some fashion this year.)

These days (early 2023) you’ll find me here:

• PROFESSIONAL persona
  • LinkedIn — https://www.linkedin.com/in/jmproffitt
  • Medium — https://medium.com/@jmproffitt
• PERSONAL persona
  • Mastodon — https://techhub.social/@jmproffitt
  • Pixelfed — https://pixelfed.social/jmproffitt

If you’ve stopped by, say hello anytime, anywhere.

From Codas to Coding

Many years ago I was a kid living in the Raleigh area and I met a music teacher who was leaving her job to go work for IBM as a programmer. I asked whether she had any programming background and she said no — but IBM was going to train her. She said IBM was recruiting new talent into the software field and wanted folks that could handle some math and logic, and to their thinking, music majors fit the bill for them. They were going to provide months of training and bring this music educator up to speed with new skills and then use her to create software for IBM.

That’s how you solve a lack of skills in your industry: you find people that are smart and trainable, and you train them.

The So-Called Security Skills Crunch

These days you can’t swing a dead cat around without hitting a hand-wringing or cheer-leading security industry article talking about:

• OMG you guys — there’s no one to hire! …or…
• If you have security skills, get ready to cash a big check! …or…
• We have ideas about how to train people up into all these get-rich-quick security jobs being left open!

Well that sounds good to me! I’ve been doing IT security work for years as part of my various IT infrastructure, project, and management jobs. I work with firewalls, VPNs, networks, servers, directories and so forth all the time. I’ve been a HIPAA Security Officer in the healthcare sector. I’m gonna be rich!

So… where’s my big fat check?

Reality of Corporate Attitudes Toward Security

The truth is corporations really don’t like security and they aren’t hiring nearly as much as the salary surveys and feel-good security industry articles would have you believe. To most corporate leaders, IT security feels extravagant and wasteful: “Why would I hire even more people to not produce anything marketable?” Even worse, more security slows productivity for those that actually are generating marketable goods and services. And to guys in the C-suite, it’s painfully boring to boot — whether it’s endless policy discussions or technical reviews, it ain’t sexy or fun.

The data breach explosion and the corresponding breach fatigue come from these corporate attitudes: that security is boring, too expensive, and anti-productive. Corporations that get “hacked” — like Target, Home Depot, the USPS, your local hospital chain — aren’t getting taken by brilliant mastermind super-villains with supercomputers. They’re getting their data splattered across the Internet because they’re lazy and cheap.

It’s Not Good to be the King

All that said, I feel for these corporate leaders. They’re living through a Catch-22 situation. Since they haven’t yet spent any attention or money (to speak of) on security, their only internal line of defense is a socially-inept neckbeard who’s answer to every threat — no matter the real risk — is “lock it down” and scold everyone for being so foolish. When that proves fruitless and frustrating they turn to outside security consultants, who cost them a fortune, but who cannot — no matter how much you pay them — force your company to develop and follow better policies or allocate capital or operating budgets to really, truly solve the most pressing security problems.

If you’re a CEO or COO or even if you’re the CIO, most likely you’re better at politics than policy, and you simply don’t know how much to spend in cash or attention to solve enough of your security problems to be helpful without spinning off into infinite expenses.

Security, at the policy and prioritization level, is damn hard. Someone needs to be smart enough on the tech and the business, but have enough political pull to guide changes in daily behaviors throughout the organization. That’s a really rare combination of skills and political powers.

So About That Hiring Problem…

Yep, the situation stinks for the CEOs, CIOs, and other leaders. But the fact remains that they need good security techs and security policy wonks, and they need to keep them moored to the reality of the business and market while also funding their work to a sufficient level.

Given the Breach-a-palooza we’re living through, clearly there’s not enough hiring going on for security-minded people, and security is not part of most companies’ core cultures. But let’s assume that changes. Let’s assume businesses want to get rolling with security-minded hiring. How do they find the talent?

Create it.

Because the Catch-22 that’s stopping businesses from hiring also creates a Catch-22 for potential candidates. Companies that do start hiring security people slap on all kinds of prior-experience and certification requirements. If you’re a candidate with limited or even tangential-but-relevant experience… too bad, chump. You’re not a CISSP? HR’s resume-scanning software will kick out your resume before you even talk to anyone. You haven’t been doing IT security work in a dedicated security role for the last 10 years? Don’t bother applying.

Welcome to the Catch-44

I’ve seen this before:

• the software company that wants to hire coders with 10 years of Java experience when the language was only 7 years old
• the marketing group that wants 5 years of social media experience only 3 years after Facebook opened to the public
• the certification group that wants you to prove you have industry experience before you sit for the test, but you can’t get the experience without the cert.

This is what I call the Catch-44: companies that can’t hire for security because they’ve never hired for security and are scared to start, and candidates that can’t get security jobs because they haven’t done security work in the past. Employer Catch-22 + Candidate Catch-22 = Catch-44.

Someone has to make the first move here.

Investments Are Made by the Guys with the Capital

So here’s the deal. Companies are the ones with something to lose. They’re the ones traded on the touchy risk-averse stock market. They’re the ones with the deep pockets, funded by tax breaks and 10+ years of depressed employee wages. It’s their responsibility to foot the bill and break this Catch-44 logjam (to mix metaphors).

Follow IBM’s lead… from the late 80s. Hire the music teacher with the raw skills and train them. Only this time you can actually hire experienced IT folks who’s jobs are being outsourced and automated anyway. Move them “up the stack” into security work.

The training is out there, ready to be absorbed. The policy frameworks are out there. Start making the investments.

And until we see real investments in the field by the incumbent businesses, I don’t want to see another “security staffing shortage” article, mmmkay?

Here are my own thoughts after reading Rob’s piece, and after more than a week of watching this train wreck…

You’re either naive or lying

The call for a “pure” form of games journalism — one free of graft or political intermingling of producers and reviewers — is either

1. driven by hard-core gamers that tend to be young and poorly informed about the world, or
2. an intentional cover-up of the deep and ugly misogyny that started the whole GamerGate mess, or
3. a little Column A, a little Column B

Every industry, every job, and every aspect of public life has ethical dimensions. Some people walk one side of the line while others walk the opposite. That’s life. You have to assess which side a given writer is coming from and take an appropriately-sized grain of salt with what they say. It’s true for every form of journalism, commentary, blogging, prognosticating, business, politics, relationships — everything.

People talk about the cozy relationships of the press and the political class all the time. It’s the subject of TV and radio shows, blogs, books, podcasts, speeches… there’s an endless discussion about ethical dilemmas created by these relationships (and rightly so). But they don’t slap “-gate” at the end of every media analysis show and then threaten to kill a few women for participating in the conversation.

So either GamerGaters are deeply naive about the real world — which is lamentable but means we can ignore them — or this violent call to arms over ethics is really just a cover for the violence itself.

Or, again, a little Column A, a little Column B.

When attacking women, the safe word is “ethics”

I suspect this #GamerGate mess can be boiled down to a simple sequence of events brought about when both kinds of GamerGaters (the naives and the misogynists) came together around the hashtag itself. The “pivot” from misogyny to ethics worked like this:

1. A few prominent games voices took note of several things surrounding the dissolution of the gamer identity via the arrival of new thinkers, producers, and ideas as the games world expanded. With just a few posts, the scapegoating and anger quickly gelled around those “outsiders”: women, and especially women that took public positions out of step with hardcore games culture. There were some interesting elements in this phase that focused on ethics, but they were relatively minor. Still, this is where the naives and misogynists first teamed up, but for different reasons.
2. The attacks quickly went way over the top, driven by the misogynists, which attracted attention from responsible writers in the games world. Once cooler heads showed up saying, “You guys are disgusting…” the naive attackers realized, “Maybe this doesn’t look so good from the outside…” and turned their attention to the journalists themselves and cried out, “It’s about ethics!” And there’s just enough meat on that bone to make a soup, so it’s the perfect diversionary pivot.
3. As #GamerGate flame wars continued to expand (and get automated with bots), it even got the attention of mainstream journalism and culture, but not in the way the GamerGaters hoped. Everyone — outside of hardcore misogynists and naive GamerGaters — was utterly horrified. The full-on mainstream cultural backlash began, including articles in major publications that exposed the horror and didn’t give a rip about any #GamerGate reactions. (Sadly the games press was stunned by the controversy and couldn’t mount an effective backlash themselves.)

Game Over. Insert 25 cents to continue.

So that’s where we are today: #GamerGate Over. Even celebrities are speaking out against it.

The only folks still beating the “games journalism ethics” drum at this point are folks that don’t yet realize the war is over and #GamerGate lost: the naives and the folks that feel guilty for saying some truly awful things.

Pro Tip: If you want to discuss games journalism ethics now — and by all means, go for it — you’ll need a new hashtag. This one’s ruined.

I was very sorry to hear about the death of writer Joe McGinniss. He had a large, and unexpected impact on my life, though we never met (but I did once see him at Bernie’s Bungalow in downtown Anchorage). He’s a big reason I moved to Alaska briefly in 1996, and again for a much longer 12-year stay starting in 2001. He wrote Going to Extremes.

Published in 1980, Going to Extremes was a sort of journal McGinniss kept as he traveled around the state, from southeastern Alaska to Barrow on North America’s northern edge, from Bethel to Anchorage and Fairbanks and along the pipeline — everywhere. He visited at the end of the 1970s and traveled like a local, using the Marine Highway (the ferry) to travel up from Bellingham, Washington and then ride with a gregarious salesman in a new pickup truck into Canada and back down to Anchorage in the dead of winter. He flew in small planes, tasted the bitter petroleum ice smog of Fairbanks, discovered the depression and racism of Barrow, and the culturally enticing yet isolating communities of the Y-K delta. He watched midnight sun baseball and recounted rampant drug abuse in Juneau at a time when the State was rolling in new oil money and didn’t really know how to govern itself.

I read this book back in the mid-1990s before moving to Alaska in the summer of 1996, after a failed attempt at teaching high school. I was drawn to the land of extremes, the world of possibilities that an Alaska re-invention represented. I left at the end of that summer, returning to reality in the Lower 48. But the romantic notions of the Last Frontier never left me.

I took my girlfriend to Alaska in March 2000 for a brief vacation and proposed to her in the back of a flightseeing plane after landing on a frozen lake. That wasn’t as romantic as it sounds, however, due to the drunk guys also in the little plane. But you know, Alaska and alcohol have a long history together.

After the dot-com crash of 2000, things slowed down at my job and we looked west for adventure, for something new. I stumbled across a job in Anchorage, took my fiancee with me on an interview trip, and by February 2001 we were packed into a Honda CR-V with a dog, a cat, and a lot of stuff, heading north from Louisville, Kentucky. We figured if we didn’t try Alaska then, while we were younger, we’d never try it. We thought we’d move there for 2 or 3 years, then move back.

12 years later we finally left Alaska. But in those years we explored the state and hosted friends and family that wanted to sample the adventure. We were hugely separated from family most of the time, but we found a new community while there, one we’re not finding so easily now that we’ve returned to the Lower 48. Anchorage is a city of transition for so many, and we fit in there. Not so much down here.

Sure, McGinniss wasn’t the only reason I moved to Alaska. But that book had an effect. And I can tell you his perspectives from the late 1970s still apply today. Alaska is indeed a land of extremes, whether it’s the dramatic swings of day and night, of heat and cold, of ice (glaciers) and fire (volcanoes), the earthquakes, the political insanity (McGinniss also wrote a book on Sarah Palin), and the many cultures across the state. I even asked a friend in Bethel whether he’d met any of the characters described in McGinniss’ book. He had. Were the descriptions accurate? They were — absolutely. Some people were proud to have been in the book, while others thought the descriptions were unfair.

Naturally, I recommend the book, and I’m sorry to hear McGinniss has passed away. His writing fired up my imagination and allowed me to experience the romantic draw of a life on the modern frontier — a place where you can start over, where you can define yourself, and where you live in a community so small it’s naturally close-knit.

He’s better known for other books, but to me he’ll always be the guy that captured the spirit of Alaska like no other writer before or since.

After reading Barb Darrow’s post earlier today asking the question “What about Bill?” in the Microsoft transition, I immediately recognized what happened and quickly commented on Google+. But I wanted to take those notes and expand a little further here, because I have always had a keen interest in organizational strategy and culture, and especially how corporate cultures are set through executive action.

First off, I don’t know if Satya Nadella is the best possible pick as Microsoft’s new CEO, so I’ll leave that to the “analysts” out there (although he looks like a pretty darn good choice to me). But one thing struck me about announcement: it’s brilliant in its almost Machiavellian construction.

Here’s how this delicate-yet-strong power transition works:

• As everyone expected, Ballmer is now 100% out of the picture, which is good because he was rocking the boat too much with his overly-emotional and disruptive monkey-dance style. There was never going to be a role for him going forward because he has only one volume setting (11) and he can be a loose cannon in interviews.
• Meanwhile Gates is removed from the Board Chairman seat and he’ll now “help” Nadella with the transition and participate in product innovations. This is undoubtedly the joint work of the Board and Nadella, who expertly crafted a way to both keep Gates around long enough but also politely escort him out of the executive suite. Gates’ power is now deeply neutered so the Board can discuss matters without him second-guessing them. Whether the Board can really guide the company effectively from here is debatable, but at least they don’t have to play second fiddle to a legendary founder with whom they just can’t compete.
• Nadella has neatly cloaked himself in the Gates shadow by pulling Gates into his own orbit and putting Gates into an active — but not too active — and temporary role as “advisor” to Nadella and selected product teams. This is a way to dazzle the long-time Microsofties with the sparkly goodness of Gates and show that Nadella is the true chosen successor — all while Nadella consolidates power and starts to turn the ship.
• The icing on the cake for Nadella, the Board, and hopefully customers? Gates’ temporary participation is focused on fostering a new culture the Board knows they desperately need: a culture of innovation. Microsoft has blown it on multiple tech revolutions for years, and they need to find the next wave or just drown. Bringing in a legend to work for the new CEO sends a clear message to everyone in the company: help us innovate or hit the bricks, no matter how much money you’ve got.

Going forward, it doesn’t much matter whether Gates actually does anything of technical or product value for Microsoft. His primary value now is being the poster boy for innovation. If he doesn’t deliver much, no big deal — he can fade nicely into Microsoft history and guide the amazing work the Bill & Melinda Gates Foundation is doing. He just can’t sit on the Microsoft Board anymore, telling everyone how he did it in 1995.

This CEO transition strategy really is remarkable. It’s done two seemingly impossible things at the same time: It’s gotten Gates out of the way without setting up a series of narratives that compare Gates and Nadella ad infinitum. And I’ll bet you a tiny fraction of Gates’ fortune that he’s actually cool with it. It relieves him of a lot of pressure to deliver results in a company that he’s not really been running for a very long time. He can spend a year or so hanging out at Microsoft part-time, and slip away.

The Microsoft Board has really set the tone for the next 10 years with three simple messages:

1. We love the company Gates built and the legacy he’s leaving us.
2. But Nadella is our guy now, so listen to him.
3. And you all better get to innovating right away. There’s no time to lose.

I like Chromebooks. I’ve owned 2 of them. But there’s a big problem with all of them. And it’s not the fact they have small SSDs or only run Chrome OS or have a ridiculously high price (hello Pixel!).

The problem is that all Chromebooks on the market in January 2014 stink in one or more ways. Each may have its good points, but there are always more downsides than upsides, and that means as a user you have to contend with both the downsides of Chrome OS (it’s not a traditional laptop) as well as the downsides of your particular Chromebook (poor hardware features A, B, and C).

We need a new Chromebook — perhaps from a new manufacturer — and it needs a tightly-defind set of specs that fix all the problems of the current crop of the delightfully-limited machines. With the hardware fixed, users can focus on adapting to the new world of Chrome OS as a solid low-cost, low-hassle computing experience.

Don’t believe me about the busted hardware? Check out my analysis on this live, public Google Sheet. The bright green boxes highlight the hardware elements the manufacturers got right. Everything else is either just okay or may be downright bad.

What current Chromebooks get wrong

Where do we start? Processor, for one. Consider the Chromebook 11 that HP launched, un-launched, then re-launched this past fall. It uses a processor that’s basically 2 years old (!) and severely under-powers the current generation of Chrome OS (which is getting more capable and complex with each release). It also has the meager 2GB of RAM all too common to Chromebooks, and a weak trackpad and keyboard. I bought it and returned it (and I never return electronics). That said, it has an awesome — albeit small — IPS screen, and it comes in a small, light package with attractive styling. Sigh.

What about the current market sales leader? That appears to be the collection of Acer C720 / C720P Chromebooks. There are literally 10 models out there as of this posting. These beat the HP Chromebook 11 mostly because Acer fixed the processor issue by using a Celeron processor built on the Haswell architecture. Yay! Except Acer makes chintzy hardware. The screen — with our without touch features — is small, dim, and lackluster to say the least. The keyboard is tiny and cheap, and every reviewer despises the trackpad. The exterior look of the unit has improved over past Acer efforts, but it’s still cheap Chinese plastic by nature. Double sigh.

Maybe Toshiba can save us with the launch of their CB30 Chromebook next month! Starting February 16 you can buy the first-ever 13.3″-screen Chromebook — a big improvement over the 11.6″ screens without incurring the weight penalty of the HP Chromebook 14. The case looks nice, with a dimpled silver plastic covering and a clean interior appearance that’s a cross between the old Samsung Chromebook and a MacBook Air. So what’s wrong with it? Not too much — this design comes closest to being the best non-Pixel Chrome OS machine. However, it’s still crippled with 2GB of RAM and has a screen that reviewers have said is a bit dull, with limited viewing angles. Toshiba gets the most “green boxes” in my Chromebook analysis sheet, but it’s still not enough to get me to drop $280 on a pre-order.

So that’s the problem in a nutshell — every Chromebook exacts one or more penalties on buyers that will either get the machine returned to the store or will relegate them to casual machine status on the couch instead of primary computer status everywhere.

Time to build the Chromebook Awesome

But here’s the good news: All the corner-cutting on the current generation of Chromebooks can be fixed. We just have to stop cutting corners, without going nuts and ending up in Pixel territory ($1,300+). So that’s what I’ve done with my Chromebook Awesome design.

In the next-to-last column on the comparison spreadsheet I’ve included what I call the Chromebook Awesome. This is the Chromebook that gathers all the best elements of the other Chromebooks and makes a proper machine. It’s more expensive than the rest at an estimated $450 (except the Pixel, of course), but it fixes everything that’s broken with the other models. In reality, it’s a better Chromebook than the Pixel because it’s accessible to a broad audience, and it’s got everything needed for a very good cloud-based and Google-based experience.

What’s to like?

• A price that’s lower than an iPad Air.
• A screen that’s big enough to be comfortable but not too big to be portable. It also has higher resolution than the cheaper units, at 1,440 x 900. It’s also an IPS screen that’s bright, clear, and sharp, with great color reproduction.
• A great keyboard and trackpad, so using the Chromebook for long periods won’t infuriate you.
• A solid 8 hours or more of mobile life away from an AC outlet, but a weight that won’t make you break a sweat.
• A quick-enough processor and enough RAM to allow for lots of tabs without painful slow-downs.
• All the ports you really need — USB 3, HDMI, and an SD card slot.
• A 720p or better webcam that makes you look good in those Google Hangout sessions. Plus a good microphone and some solid (but not audiophile) speakers.

So who’s gonna build it?

At the moment, Toshiba is closest to the Chromebook Awesome finish line. All they would have to do — it appears, because there aren’t any detailed reviews yet — is improve their screen quality (IPS) and resolution (1,440 x 900), add 2GB of RAM, and add enough battery to cover the increased screen power requirements. Then they can raise the price by $170 and watch the orders roll in.

But really, any major electronics manufacturer could build this machine. Sony could do it. Lenovo could easily add this to their Chromebook lineup (of 1). LG could go beyond their overpriced and underpowered Chromebase and make the Chromebook Awesome. Google could stop showing off with the Chromebook Pixel and hire one of their partners to make this machine. The parts are all off-the-shelf and ready to go. The only really hard part is the industrial design — it has to be attractive, with clean lines, great usability, and good durability. They also have to ensure the hardware components have excellent drivers (e.g. for the trackpad).

For now, all we can do is  hope some product manager out there makes the same spreadsheet I did, and takes action to build the Awesome.

Because until the Chromebook Awesome appears, I’ll be sitting on my wallet.

I bought one on launch day (January 1) and just got it this week. And 295 pieces later I got it assembled. Whew!

It comes with a nice manual / mission overview booklet in several languages. This is definitely an adult toy, as the assembly process would probably frustrate all but the most die-hard young LEGO or dedicated science fans. I think it took me about 90 minutes to get it assembled in a single sitting.

Here’s mine, assembled and on my desk at home:

On thing’s for sure — this thing would not survive a trip to Mars (about 140 million miles, on average). It’s fairly delicate, with spindly arms and legs and protruding parts that are plastic stand-ins for the various sensors and tools on the real rover.

What’s remarkable, though, is that the wheels and suspension system work. You get a pretty good feel for why the suspension was made this way — to bumble over rocks and uneven terrain with independent movement for each wheel.

I’d say the level of detail in the LEGO model is amazing, but that’s not true. What is amazing, though, is how well LEGO did in creating a credible model using mostly common LEGO parts. It seems like there are a few unique parts, but for the most part I’ve seen these elements before in other LEGO kits, but their application is really creative.

So for $30 you can have a little piece of space science history on your desk and get your hands on some of the mechanical design of the real thing. Plus, if you buy this model, you’re helping validate a unique market approach by LEGO — the crowdsourcing of ideas and even model designs through their CUUSOO program. This particular model was created by a JPL engineer that worked on elements of the original rover. Very cool.

Thank you NASA!

It is not.

Don’t be fooled. Yes, continuing to get updates to Microsoft-supplied anti-malware software is a good thing, but that’s just one part of your risks and your defenses. Microsoft did not announce they were extending support and updates for Windows XP itself. And if you’re not using Microsoft anti-malware software, then the announcement doesn’t help anyway.

Here’s the deal: If Windows XP isn’t patched by Microsoft on a regular basis, new exploits are revealed and your computer gets more and more vulnerable over time. Microsoft’s XP patches stop in April. At that point Windows XP gets increasingly dangerous to your business and information. What’s worse is that security researchers have suggested there’s a pile of XP security exploits already developed, and miscreants are just waiting for April to release them. If they’re correct, an avalanche of unannounced attacks on XP would arrive in April or May, and any PCs left running XP could be reduced to quivering jelly. Or something. Anti-malware updates won’t protect against all those possible attacks.

The solution? Well… you already know the solution. Get rid of Windows XP and move to…

• Windows 7
• Windows 8
• Mac OS X
• Linux
• iPad
• Chromebook
• …whatever it takes.

Let’s be honest here. You’ve known XP needed to go for years now, as Microsoft has extended the XP deadline again and again and again. At this point any excuses you’ve got left are hollow and exposed as either laziness or criminal cheapness. There are no legitimate excuses left.

And nonprofits don’t get a free pass here. In many ways nonprofits have it easier than other businesses, given the insanely cheap licensing avaiable via TechSoup or the very affordable charity licensing available from Microsoft.

I’m a pretty compassionate IT professional, recognizing that nonprofits in particular and businesses in general can find IT systems management challenging. But when it comes to Windows XP as of April 2014, I have no compassion left.

As Jim Gaffigan would say, Chip Chop Chip!

I love long distance driving and most of the amazing U.S. Interstate system. But the “broken” parts have always been those within our cities — they’re not scaled quite right, they break up local communities too much, and they’re often ugly. Now I understand where we went wrong in carrying out Eisenhower’s vision. Check out this great piece that explores how we could run our highways so they’d serve our dual needs: intercity driving and intracity transportation.

LINK: What the Interstate Highway System Should Have Looked Like

Recent editions of Adobe Reader and Adobe Flash have prompted users to install an auto-update feature along with the core application code. Hopefully you’ve got that turned on, because it will pick up security patches and feature updates for you in the background. If not, get a fresh download here:

• Adobe Flash
• Adobe Reader
• Adobe Air

I mention this because some serious new security flaws have been identified this week, and you need to patch your common Adobe plugin and utility software. This applies to Windows and Mac OS users, so check your stuff and get up to date.

So I’m going to move back here to Gravity Medium and start doing my commenting, sharing, posting, and so forth on “my own property”, so to speak.

But I’m also going to change focus a bit.

To learn more about the new Gravity Medium for 2014, check out my updated About page.

BIG NEWS. I will be leaving Alaska at the end of July. I’m headed to the Columbus, Ohio area.

I’m moving south to be closer to family, especially my parents, who live in the Toledo, Ohio area. After the move I’ll be 2.5 hours away from them by car, instead of 12 hours away by nearly-$1,000 airplane flights. Meanwhile I also have family in Louisville, the Twin Cities, western Massachusetts, and Florida. Columbus is a good location for being closer to all of them, not to mention it has a great mainstream American culture and diversified economy. I’m also sorta-kinda from there, having completed high school and graduate school in the area.

I’ve been in Alaska for over 12 years now, which is amazing, because I always thought Alaska would be something I’d try just for a couple years. But those “couple years” kept extending as I got to do some meaningful work in my career, met some great people, and learned how to live in the Land of Extremes.

I will leave in the closing days of July, driving down the Alaska Highway (a favorite experience of mine). My wife Stephanie will follow in the early fall. I’ll share more about the move, my career changes, and so forth in the days to come, both here and over on Google+.

Back in mid-2007 I deployed my first instance of Google Apps, replacing a Microsoft Exchange 2003 server. It was a controversial choice back then — Google Apps was still pretty new and it wasn’t yet clear whether Google was going to stick with the platform and build it out. But there were several deciding factors that pushed me to an Apps deployment:

• I was working at a nonprofit, so Google Apps was free for us; worst case I could always fall back to the in-house system
• Our Microsoft Exchange 2003 server was constantly running out of space and was a pain to backup
• We lived under a monstrous waterfall of spam that required a special appliance outside the Exchange box that worked well but was costly
• Our Internet connection was relatively slow and outrageously expensive, so handling all the mail traffic in-house was painful, especially when the in-house web site was what we really wanted to share with the world, not our email system
• Our users wanted to send and receive larger and larger files via email, which only strained all of the above factors further

We made the switch, I uploaded a bunch of mail using Google’s then-primitive migration tools,  and I put everyone onto the web-based interface — no Outlook allowed. We did trainings and I spent a lot of time helping users get acclimated to the new way of doing things. This was before drag-and-drop email attachments in Gmail. It was before full compatibility with external calendar invitations. It was before Chrome.

And I was immediately hooked.

Why Go Google?

From an IT perspective, this Google Apps thing was awesome. There were no servers to own, nothing to back up, nothing to manage — aside from creating and deleting accounts. The users had far more space than they’d ever had (7GB at the time) and far more space than I could have ever offered locally at a reasonable price. The system was accessible everywhere, and no matter where you got your mail or looked at your calendar, it functioned the same way. And, as a nonprofit, it was all free! We even started using Google Docs right away, sharing selected spreadsheet data with remote workers and volunteers, allowing for real-time collaboration that at the time was mind-blowingly simple yet powerful.

Since then the Google Apps platform has matured with better features, a more homogenized interface in the apps, better administration tools, more reporting, more granular controls, and great (paid) add-ons for email archiving and spam control. And since then I’ve deployed Google Apps 4 more times, not to mention personal use. My most recent migration was last year, again dropping Microsoft Exchange 2003 and Outlook to go all-cloud all the time.

And then there was this past weekend.

Getting Certified

After managing and evangelizing Google Apps all these years, I stumbled across a certification program for Google Apps nerds like me: the Google Apps Certified Deployment Specialist. So I dug through the Study Guide, re-read a lot of stuff I knew, learned a few new tricks Google has developed in the last couple of years, and paid my testing fee.

The weird part was the testing method. Rather than send you to a local testing center — where you might sit for Microsoft or Citrix or VMware or other vendor exams — this one is done at home or in your office. You can take the test anywhere you have a live Internet connection, a Windows or Mac machine, and a special USB webcam they make you buy. Total cost is about the same as those other exams, but you can schedule it on weekends in evenings and take it at home. They proctor the exam through the webcam and special software.

It worked great. The only thing I was “corrected” on during the exam was the fact that I started to read some of the questions out loud, to puzzle them out audibly. That’s verboten, probably because they fear you’d read the questions out loud so you could either record the questions (and give them away to others wanting to take the exam) or ask someone else nearby to provide an answer. It’s too bad, because I like to “talk out” technical solutions. Oh, well.

61 questions after starting, I had passed the exam, so now I’m certified! It’s the first major cert I’ve picked up since the “good old days” of Windows NT 4 and Lotus Notes and Domino. And it’s fun to have a Google certification, perhaps because it’s so rare. My certificate was numbered “1298”, which suggests there were less than 1,300 people certified when I took the exam. That’s cool — I’m in a group smaller than my high school census (except we’re all certified Google Apps pros!).

Can you use Google Apps in a healthcare environment?

I may need to address this further in a future post, but the short answer is yes. People freak out about HIPAA (as they well should) but the key thing to consider is how you use your email system. Bottom line: If you don’t store or share PHI (protected health information) in your email system, then HIPAA rules don’t apply. And for those that are using email systems (of any kind) to share or transmit patient data, I have a question: Are you out of your mind? Email is a promiscuous platform by design — it’ll “sleep” with anyone and it’s 1 degree away from every email account worldwide — so why would you ever push patient information through it? If it helps, I’ve actually addressed the Apps/HIPAA discussion elsewhere before.

Sidebar: I may also have to write a post someday (really a rant) about email footers with lots of legal language in them — a silly practice that has no force of law behind it. If you want to put in a “please don’t share this” message down there, that’s cool, but stop trying to create unilateral contracts with your footers — that’s not a thing.

All that said, I do think Google needs to rethink their stance on signing HIPAA Business Associate Agreements (they won’t sign them). They either need to start signing or they need to post a definitive position paper on HIPAA issues related to Google Apps. Microsoft has shown a willingness to sign BAAs for Office 365 services, which makes their service more attractive, despite their downtime problems. Google has done a good job addressing the overall security of Google Apps, but they need to go a step further, to assuage the fears of healthcare executives and Boards that don’t understand technology very well.

What’s next?

For now I’m a happy Google Apps administrator, still learning, still sharing tips with users new to the platform. Oh, and I’m a Certified Deployment Specialist, of course! So if you’ve got questions about going Google in your healthcare environment (or any business, really) just let me know. I can answer some questions in the comments or we can take the conversation offline.

At the time, and to some degree even today, there was an expectation that mainline IT staff would fill the role of informaticist for the company. And in some small ways, we do. But not in the big ways, not in transformative ways. Our IT staff are saddled with basic systems maintenance, user support, new system installation and integration efforts, and so on. We’re not clinicians by training. While we listen and learn a little every day about our clinical operations, we’re still not doctors or nurses. (Funny how that works.)

So what is informatics? What does an informaticist do? Dr. Gibson explains it like this (boldface mine):

Important informatics skills include change management (not just IT change management, but culture and process change management as well), business analysis, stakeholder engagement, project management, requirements development, strategic thinking to place projects into a larger vision, building for inter-operability, translating between IT & business, system life cycle, communications, [etc.]). A good informatician can speak the language of both IT staff and program staff, and should be a good communicator and group facilitator.

Informatics skills are not necessarily present in IT departments. A programmer may be very skilled in writing a program to do what he wants, but is rarely skilled in getting the thorough understanding of what users need. The database administrator may be very skilled in structuring a database to run very quickly, but usually does not understand the content well enough to create operational definitions that address what program managers want to know.

My recommendation from a couple years ago was that we needed to hire an informaticist, or at least someone who had clinical background and technical chops. With all the reporting and analysis requirements in UDS, Meaningful Use (MU), and Patient Centered Medical Home (PCMH), not to mention workflow changes needed to meet increasing security and privacy requirements (HIPAA, HITECH) and general efficiency needs, having someone who could drive workflow / care / data change projects and communications would help a lot.

In the end we didn’t hire a classic informaticist, but we do have a high-level manager driving Quality Improvement (QI) efforts, PCMH, and MU, and she’s quite technically capable as well as a licensed provider. So we’re covering the need for now.

It’s possible that at our scale (currently around 130 employees), perhaps a full-blown highly-paid informaticist won’t be necessary in the future. It’s possible the EHR vendors and various governmental agencies will settle on a collection of core measurements and workflows that work for everyone and those features will just be built-in to our systems. (Ha! Sometimes I crack myself up…)

But for now, I would argue everyone in the health center space (50-500 employees) needs to be thinking about hiring an informaticist. Someone that has clinical training. Someone that isn’t afraid of computers and likes data and analysis. Someone that can communicate well and can drive change projects. So yeah… a miracle worker!

Meanwhile, everyone on your management team needs to know what informatics is. Your health center needs to get comfortable with data and change. Because “accountable care” demands proof, and the proof is in the data.

BONUS: Informatics Links

• Translator for Nurses Who Don’t Speak Geek: Nurse Informaticists
• Wikipedia: Health Informatics (it’s actually a great reference)
• Healthcare Informatics magazine
• Health Informatics Forum — a social media site for informatics professionals

Fitbit was one of the first to bring a consumer activity tracker + web site + mobile app ecosystem to the edge of the mass market, and they’ve won a lot of converts over the last couple years. But at the same time, there’s been an explosion of other trackers and platforms for capturing physical movement, encouraging more activity, and viewing and sharing the data collected. Can Fitbit stay on top?

Well, they’re certainly going to try.

This week Fitbit introduced yet another revision to their activity tracking lineup, a new design intended to recapture users that defected to the wristband-style Nike+ FuelBand or the Jawbone Up. And the tech press, in their annual CES frenzy, are trumpeting the announcement as the next big thing:

• CES 2013: Fitbit announces Flex wristband, watch out Nike and Jawbone
  
• Fitbit Flex wristband with Bluetooth could be the best activity tracker yet
• Fitbit joins wearable fitness-tracking realm with Bluetooth 4.0-enabled $100 Flex Wristband
• Fitbit looks beyond the clip with new Flex activity and sleep wristband, coming Spring 2013 for $99.95
• New Year’s Resolutions: A Physician’s overview of the best fitness trackers and what’s next (this one is a great in-depth comparison of the Fitbit and FuelBand)

The details are simple, really. The Fitbit Flex will be $100 and launch sometime in the spring. You can pre-order right now.

For me, Fitbit is challenging my devotion to the Nike+ FuelBand by combining what I liked about the FitBit with what I like about the FuelBand. Mostly. So here’s my take on the pros and cons of old Fitbit, current FuelBand, and the announced Fitbit Flex…

Where the Fitbit One Beats the FuelBand

• Because the design calls for you to wear the Fitbit near the center of your body mass (at or near the waist), it’s much more accurate when counting steps or overall body movement than wrist- or arm-mounted activity trackers.
• Fitbit has several data integrations included with its cloud-based platform, so you can send your captured data lots of different places, including Microsoft HealthVault. This bodes well for the Fitbit’s future prospects as a provider-integrated EHR-syncing activity tracking platform. You know… someday.
• The Fitbit web and smartphone app platform is more feature-complete than Nike’s, especially if you’re anal enough to enter all your foods, moods, water, and any exercises not picked up by the activity tracker. Nike has a great iOS app with Facebook integration for social health purposes, but then so does Fitbit.
• All the Fitbit activity trackers are cheaper than the FuelBand. It’s $70 and $100 vs. $150. That’s a big difference.
• The Fitbit One (but not the “Zip” edition) can track steps climbed using an altimeter function. The FuelBand can’t do that.
• Like the new Flex (discussed below), the Fitbit One syncs wirelessly with low-power Bluetooth 4.0 anytime you’ve got the app running on your smartphone.

Where FuelBand Beats the Fitbit One

• The Fitbit One is easily lost in pockets, off your belt, and can end up in the washing machine (and then the trash). The FuelBand, by comparison, just goes on your wrist — end of story. It’s snug and doesn’t have to come off much, so you’re not going to lose it easily. This advantage cannot be overstated. Lots of users have switched to the FuelBand because the data captured, while less accurate, is more complete and consistent because the FuelBand is just more likely to be worn.
• The FuelBand’s integrated display is attractive, engaging, and informative. The Fitbit One’s display is okay and functional, but not all that engaging. For the good stuff you have to hop into the smartphone app.

And Now the Fitbit Flex: Where Does it Win?

• The Fitbit Flex can be used for sleep monitoring, just like its non-wrist predecessors. The FuelBand skips this feature, though the Jawbone Up matches it.
• If you can be woken up by a vibrating wrist, then the Flex can be your alarm clock. LIke the Jawbone Up, it will theoretically buzz at the right moment in your sleep cycle so you wake up refreshed. Reviewers seem to think it works. The FuelBand has no such feature.
• The motion-sensing part of the Flex can be popped out and dropped in a pocket if you don’t want to wear the wristband.
• The Nike FuelBand is sold in 3 wrist sizes and you have to figure out which one is right for you (I screwed up on my first choice). The Flex comes with 2 bands and has a highly-adjustable watch-style wristband.
• You can swap out different Flex wristband colors (if you must) by buying additional bands.
• Using Bluetooth 4.0 means the Fitbit Flex can maintain smartphone connectivity all day without killing either the wristband’s or phone’s batteries. The FuelBand runs on older Bluetooth modes, requiring manual syncing and more power. The Jawbone Up isn’t even wireless, instead plugging in to your headphone jack for syncing.

Potential Fitbit Flex Problems

• The FuelBand has a smooth, rounded shape across its entire body, but the Fitbit Flex has a blocky, squared-off top that’s much more likely to catch on clothing. I’m also wondering whether the watchband styling will be annoying. I haven’t worn a classic watch in years.
• Aside from the 5 LED dots, there’s no multi-function display, so it’s a step ahead of the Jawbone Up, which has no display at all, but several steps behind the FuelBand, which can also act as a watch. (Of course, with Bluetooth 4.0 live syncing, you can view your Fitbit stats on your smartphone anytime.)
• The Flex lacks the altimeter of the Fitbit One, so no tracking steps climbed.
• While wrist placement is convenient, it’s also far less accurate in measuring activity when compared against the Fitbit One or any torso-bound tracker.

Conclusions: Fitbit Flex Wins, But It’s a Fast-Moving Market

• The Fitbit Flex is a winner overall, if it works as advertised. Remember that the Jawbone Up was a disaster at launch and took a year to be revised. Time will tell, but Fitbit has successfully built and launched all prior models.
• The Flex effectively neutralizes the threat of the FuelBand and the Jawbone Up by offering equivalent physical functionality at a lower price.
• The Fitbit platform is a major advantage you can’t see on the box, but it will matter most in the long run. Their platform is purpose-built and widely-integrated with other apps and web systems. The FuelBand is, let’s be honest, a side project for Nike. The Up is similarly a side project for Jawbone, the Bluetooth headset and portable speaker manufacturer. Fitbit is focused where the others aren’t.
• For all the good stuff about Fitbit and the Flex, the truth is the quantified self sector is just starting to reach the mass market. Who knows who wins in the long run?

For now, I’ve pre-ordered the Fitbit Flex for myself. And I can report back here in the spring.

After the harrowing account of a hospice in northern Idaho being slapped with a $50,000 fine for 411 breached patient records, it’s good to see that even the big players — the biggest in the industry — screw up from time to time.

This widely-cited case, first reported by the L.A. Times, tells the story of how healthcare giant Kaiser Permanente got a little sloppy and ended up working with a contractor who stored electronic patient records all over the place, including sometimes storing records — and I love this — in the trunk of his Ford Mustang.

Which raises the obvious question: Are Ford Mustangs HIPAA compliant? What about a Honda Accord? Maybe a PT Cruiser?

And while that’s the wildest part of the story for me, what’s even more fun is the fact that Kaiser and their mom-and-pop patient records handler (yes, literally — mom-and-pop) have been trading accusations in and out of court for the past 2 years, each accusing the other of not caring about patient privacy and data security.

L.A. Times writer Chad Terhune did a masterful job painting a picture of the comical data security with these gems:

• “On a recent day [the patient records] sat next to a red recliner where Ziggy, the family’s black-and-white cat, curled up for a nap.”
• “…kept those patient records at a warehouse in Indio that they shared with another man’s party rental business and his Ford Mustang until 2010.”
• “…Kaiser said the Deans put patient data at risk by leaving two computer hard drives in their garage with the door open. In response, Stephan Dean moved them to a spare room.”
• “‘We could have sold these emails [with patient records] to somebody in Nigeria, but Kaiser doesn’t care about its patients’ information.'”
• “‘[Kaiser] should have signed a contract prior to the commencement of this project,” the manager wrote.”

Be sure to read the article all the way to the end. That last sentence is a killer.

Kaiser got into this mess because they gobbled up yet another smaller hospital and needed to absorb all the patient records quickly. So they outsourced the job. No problem there, really. It’s who they outsourced to that ended up being a disaster.

So far, there’s no known patient data breach, which is great for patients. But authorities are investigating and Kaiser’s got a lot of egg on face with such a high-profile piece hitting the Times.

The lessons for your patient data security efforts? Wait… you really need me to spell this out?

It’s simple. You need your own Ziggy — a certified Patient Privacy Attack Cat — and a Mustang. IT’S RIGHT THERE IN THE FEDERAL CODE, PEOPLE.

BodyMedia will introduce an updated version of their arm-mounted health data collector, theoretically shipping in August. The new version is quite a bit more attractive than the current one. It measures activity / movement, sleep patterns, and calories burned. It competes with the Nike+ FuelBand, the FitBit One, and others.

Withings, who first arrived on the scene with a Wi-Fi weight scale, is introducing an updated scale — the Smart Body Analyzer — but also an activity monitor — the Smart Activity Tracker — to compete with FitBit and all the rest. It’s not clear when these products will ship, though Withings is claiming a Q1 release.

The Smart Body Analyzer is the most interesting addition to the field, as it’s bringing more sensors to the party. This thing will get your weight and body fat percentages, like the current model, but it will also capture heart rate and — this is the amazing bit — air quality, in terms of CO2 levels in the ambient air. Captured data syncs via Wi-Fi or Bluetooth, and naturally goes into their cloud-hosted data monitoring system and smartphone apps. You can sync over to Microsoft HealthVault if you like.

Personally, I’m wearing a Nike+ FuelBand right now and I love it. It actually think the FitBit is more accurate, but the FuelBand goes on your wrist and stays there — you don’t lose it off your belt or send it through the wash in your pants. The only one I really want to try out is the Jawbone Up, which has more features than the FuelBand, but lacks the FuelBand’s integrated data display.

Meanwhile, check out this article from AllThingsD on the trends in the space:

• Health-and-Fitness Tech Grows at CES, but Challenges Lie Ahead
  

This is a new one on me. I follow the “quantified self” market fairly regularly, but it’s the first time I’ve seen activity tracking devices and services being pitched directly to employers.

The idea: As an employer, you want to encourage healthier behaviors, in order to drop your insurance costs. With Fitbug, now your company can hook up with them to provide units to staff and track progress individually and as a group.

The site offers relatively little information and no real studies of effectiveness. But it’s an intriguing idea — one that’s likely to gain traction in the next few years as devices get cheaper and employers (and health insurance carriers) get employees and customers more engaged in health management and promoting healthy behaviors.

New Fitbug Gear

Meanwhile, Fitbug is introducing a bunch of new gear, including the Fitbug Orb, a low-cost ($50) Bluetooth-connected activity tracker (that’s not currently shown on their own web site). They also have a new wireless weight scale (the Fitbug Wow) for $80 and a blood pressure tracker (the Fitbug Luv). None of the new gear is shipping yet, but should all be on the market before summer.

UPDATE: 2012-01-08

While Fitbug has one of the most in-your-face pitches to corporate health device buyers, they’re not the only ones talking to this market. Waaaaaayyy at the bottom of the Fitbit site is a link called Corporate Wellness that takes you to a page pitching the same concept: buy tons of our devices for employees and use them to promote wellness / drive down insurance costs. Sorry I failed to notice that one! If you have other examples from device makers, please let me know.

Security

Today in free-reports-you-might-like we have a new one from a group of major security and IT players at major multinational corporations. And though that may sound dull, the report itself: Information Security Shakeup: Disruptive Innovations to Test Security’s Mettle in 2013 (PDF) is well put together and clear enough even for your CEO (sorry CEOs!). The big trends that will affect security planning this year: cloud computing, social media, so-called “big data,” and — of course — mobile devices. Mitigation techniques are proposed for the growing risks, of course. A nice report, really.

When you’re done with the pretty report, here’s some conceptual thinking for you: Compliance strategies can be the enemy of security strategies. Why? “The downside of compliance initiatives is that achieving a minimum may not result in any real change in the security posture…” Of course, compliance with HIPAA security and privacy provisions does help with security, but there are problems with a HIPAA-compliance-only approach. Namely, advancements in the regulations can’t possibly keep up with security (or risk) developments, and if all you do is comply, you won’t be positioning yourself for real-world security. Sounds like a head-scratcher at first, but it’s definitely not. Aim for security, not compliance.

Management

Healthcare Informatics has a nice profile of La Clinica de la Raza’s new CIO, Tina Buop. She started last May and since arriving she’s been dealing with classic Community Health Center (CHC) issues: data collection and reporting, an EHR deployment, and handling IT services across a sprawling 30-site, 1,200-employee organization.

Meanwhile, I gotta give a virtual high five to Dr. Lyle Berkowitz. He’s effectively addressed the “crisis” of too-few primary care providers with an intelligent crystal-ball look at what healthcare may look like in 2025:

Dashboards provide real-time analysis of the status of his panel of 5,000 patients. Patients in the Green Zone will be managed mainly by computerized systems which check on patients virtually to provide positive feedback and ensure they stay on track. Meanwhile, patients in the Yellow Zone will be visited by the physician’s care team at home or work, or perhaps have a virtual conference with the physician to answer their questions. Finally, those patients in the Red Zone will be seen in the office or home for longer sessions with the physician and his or her care team to help determine what is going on and how to get it under control.

And the title of his piece? “We Don’t Have a Shortage of PCPs, We Have a Shortage of Using Them Efficiently”. Yep. Nailed it.

Collaboration

Email is like Democracy: it’s the worst… except for every other system out there. But that may be changing, as companies discover and deploy new collaboration platforms. SharePoint got things started, but other platforms — especially simpler and more social platforms — are gaining traction, like Socialcast, Confluence, Yammer, Podio, SocialText, Chatter, and more. But here’s an idea: delete your email lists and force employees to use the new platform. Find out what one company learned when they went nuclear on email lists in a company of 17,000.

Mobile

Clinicians and pharmacists in your health center might appreciate this list of 6 mobile apps and resources for information on drugs, diseases and more. Keep in mind you can always deploy iPod touch devices if you don’t want to deploy smartphones.

EHR Technology

Tell us how you really feel, competing software vendor! “I don’t believe healthcare can afford Epic and Cerner, and I doubt you do either.” Those of us in the Community Health Center (CHC) world will never buy Epic or Cerner, for the price tag alone, not to mention they’re really built for hospitals. Still, this guy, hawking an open source solution has a point. Though he only cites one example in detail, it’s a good one: $9 million to deploy OpenVista versus $92 million to deploy Epic in facilities of similar size. Go with the open source solution and then take everyone to Hawaii to celebrate!

Now think back to 2009 and the federal cash that burst onto the scene to help pay for increased digitization of health. Mmmmm… cash! Now imagine where we’d be today without that money and the pushes of the HITECH program and ARRA. This piece over at Healthcare IT News argues we’re a lot further along today than we’d otherwise be with EHRs and other tech. I tend to agree. Healthcare organizations are nothing if not slow to change.

Finally, get ready to move mental health records right into your EHR, or at least link them and make them available to your EHR users. The stigma of mental health care is fading, and the advantages of primary care and hospital care physicians having access to both the “medical” record and the “mental” record at once are substantial. With more and more CHCs covering mental health services alongside medical, we may very well be on the cutting edge here. Who knew?

Telemedicine / Telehealth

Everyone’s getting the telehealth bug, so be prepared to support it in your health center. Even the feds are willing to start spending on remote doctor visits, or at least new legislation was introduced in Congress just after the fiscal cliff mess was (sort of) cleaned up. And of course private payers are covering more of this kind of care, too. Aren’t sure how telemedicine licensing works in your state? Check out where the states stand as of December 2012.