Bird’s Eye view on Live maps – how cool is that?

The Windows Live search team did a pretty major update (a few months ago) to a number of elements of the search engine at live.com, but one of the nicest is the maps integration. Type in a postcode, a place or business name and click on Maps and you’ll hopefully go straight there…

image

As the Virtual Earth technology behind the Live Maps site improves, and as the quality of the data behind it gets better too, I’ve noticed quite a few sites shift to using it, sometime away from other mapping services like Google Maps or Multimap (which Microsoft recently acquired, so that may have something to do with it).

Whilst shooting the breeze on the web the other day, I thought I’d check out Rightmove to nose through a list of property that’s for sale near my home (having found Rightmove and PropertyFinder, Google Earth and Virtual Earth so valuable when I was house-hunting a couple of years ago). Rightmove now has a service called "AboutMyPlace" which is shown in response to searches of an area, but also pinpointing the exact location of specific property that’s for sale.

Anyway, I found a house not far from mine which was for sale; on the AboutMyPlace site, I was quite impressed to see their use of Virtual Earth, then saw that Bird’s Eye view was available…

image

View from AboutMyPlace, showing the Virtual Earth UI

I hadn’t realised that Bird’s Eye view had been improved so much, or that its reach had been so expanded – previously, it was really just major cities and the likes which got it, but during last summer, it’s clear that planes have been criss-crossing the UK and taking some really good quality pictures from multiple angles (so you can rotate the view)…

Now I can see my own house (and all of the neighbours’ too!) in a while new way – it’s  amazing, and can drain hours out of your day if you’re not careful.

Here’s Microsoft’s TVP just as one example (try it for yourself by searching for RG6 1WG and clicking on Bird’s Eye view)

image

Now isn’t that good?

I need some Flo Control – or Arnie Control, more like

Regulars may remember the trouble my PC was having with Arnie the cat well I could use some more technology in and around the house to solve another little problem.

Arnie & his sister have now got quite big – they’re just over a year old, so fully-functional adult cats (well, not entirely fully functional, if you know what I mean), with a keen sense of how to catch, kill and sometimes eat quite a bit of the local rodent population (which given that we live in the country, is quite high).

Now it’s not much fun catching live mice that have been hauled in through the cat flap, it’s not a great deal better picking up the (sometimes partially consumed) cadavers of others, and I’m sure it’s not exactly a great time for the poor little meeces either.

Today, we spent some time dragging the fridge out to locate where the stink was coming from – and eventually located a long-dead mouse underneath. Less than an hour later, whilst we were sitting in the kitchen having lunch, Arnie came steaming through the flap with his latest victim in his gob – prompting stern and immediate attention, in slamming doors, shooing him back outside again etc.

So, a solution must be found.

A few years ago, I came across an intriguing project called Flo Control, where someone had rigged up a PC to the cat flap and performed facial recognition on the cat that was trying to come into the house – in this case, a cat called Flo. If Flo was alone, the flap would open, but if she was carrying anything in her mouth, it would stay resolutely shut.

It seems the guys behind Flo Control think that processor technology has come on so much in recent times, that it will be possible to release a box that fits to the door, without needing the PC attached.

The current solution looks pretty cumbersome – not just with the PC attached, but the box on the other side of the door.  It essentially takes a snapshot of the silhouette of whatever sticks it head towards the flap, and then uses shape recognition technology to decide whether to open the door or not…

All clear, Flo Not so fast, buster…

I Want one of those

This kind of idea could even be a winner for the likes of Dragons’ Den – I’d be quite happy (as a consumer) to pay ~£100 for something like this, and since there are reckoned to be more than 6 million cat owning households in the UK, there’s clearly an opportunity in this country alone. Magnetic flaps which only allow a cat wearing a specific collar to come in & out cost about £40, so it’s not outrageous to think people would spend a good bit more.

A basic device would have a mini-USB port that could take a laptop controlling it (to check on settings etc), would have a rechargeable battery and a simple training mechanism where the cat is plonked on the other side, and (like those fingerprint recognition devices) a few attempts of cat coming in are used to let the device’s cheapo camera figure out what “normal” looks like.

Deluxe editions might be inobtrusively mains-powered, offering the delight of being able WiFi attached, so you could help train it, provide a log of when the cat came in & out (and even which cat it was, if you have a collection) etc etc. Even get alerted on your PC if the cat’s trying to come in but the flap’s not sure if he is solo or accompanied…

Added finesse could even be automatic timing control – eg. cats can’t leave the flap after 9pm but if they’re still outside, then can come in until 11pm after which it closes for the night…

Is this a great example of a techy toy, or something that only a techie could dream up but which could find a following in the general populace? Or another “seems like a good idea at the time” gadget that would gather dust in one of those catalogues full of things you didn’t know you needed, that fall out of the Sunday papers..?

Happy New Year!

The lost art of the OOF

Some time ago, I posted about how the ".sig" has faded from grandeur. I’d like to add the somewhat terminal dryness of the OOF message to that list, and propose a solution.

OOF is a Microsoft term for Out of Office. It should really be OOO, but is stuck in the days of the predecessor to MS Mail and Exchange. See http://msexchangeteam.com/search/SearchResults.aspx?q=oof for myriad stuff on OOFs, and here (on why it’s OOF and not OOO) for one of the first – and for a while, most-read – blog posts on the Exchange team blog.

I’ve seen a lot of OOFs in my time, and many are of a hugely unimaginative nature. Some are kind-of smart in that they convey the most information in the shortest amount of characters (eg "oof til 7/1 – mail jbloggs if urgent") whereas some have clearly been lovingly hand crafted.

When I worked in the Exchange product group, I sent a mail to one particular guy (who is ex-pat Brit but had been over in Redmond for some time) on the 16th December. Turns out, he’d gone "home" for "the holidays" and I got:

I am so on vacation. By the time I get back, I expect things will look different. See you on 1/17/05. I probably won’t ever read your email. Sorry.

There’s something refreshingly honest about that – it’s admitting that he’s not going to be on email for at least a month, by which time, anything he got sent in email will be out of date. Brilliant. Helps build a case for Instant Messaging if you ask me.

Probably the best OOF I’ve seen came from a somewhat eccentric Canadian (who once replied when I mentioned I’d seen him the previous evening in New Orleans, clearly having a Nice Time), "oh yeah… any night when I don’t end up in jail has to be a good night"). Enjoy…

It happened. I knew it would happen some day, but never dreamed it would happen so soon. I tried to hide it from everyone, but word got out and boy did I catch hell for it. Yes, as embarrassing as it is, I must confess before God and country that I was caught, red-handed, Getting Productive Work Done In The Office!

People, please: do try to control your Shock and Horror. I know we used to do real work Long Ago, but we’ve moved past that, haven’t we? It was an honest mistake; an accident in the truest sense of the word. I did my best to hide it from everyone and thought I was successful around the children and my more-dense co-workers. But there is only so long one can live a charade, and in the end, like a house of cards in a hurricane it came down, down, down…

To pay for my egregious act of productivity and practical effort, I’ve been sentenced to two days of offsite meetings by a jury of my direct management.

Yes, kiddies, that is Two Whole Days of unbridled Tag-Teaming, Outlining, Problem-Solving, Situation-Analysing, Team-Building, Proactively-Leveraging, Federating, Brainstorming Facilitation and Group Contemplation. Unpack the markers and the big pads of paper, Martha: we is gonna have an offsite!!

Can you already feel the sweat drip slowly down ewers of water; the ice cubes grumbling with frustration at their inevitable doom in a pastel room filled with inoffensive Corporate Art? Can you see the elegant buffet of Northwest Grilled Salmon Medallions lounging in a Light Cream Sauce over chirping steam trays, accented by a tossed salad of Garden Fresh Greens? Can you hear that first person raise their hand to state, two hours into to the discussion, that "Before we go any further, we need to define the problem" only to be followed seconds later by another person wondering "what are the criteria for success?"

Do you get the idea that at some point on the first day, I’ll be screaming out "BINGO!" to a very confused audience?

Ah; they’re used to it…

A co-worker once told me you could solve any team problem with a case of malt liquor, an afternoon of skeet shooting and a strip club. He’s no longer employed at the company (something to do with an offsite of his own gone terribly awry near the Montana state border) but I think he was on the right track.

Where I am going, there are no visiting hours, and even worse: no conjugal visits. I might be reachable at <number>. Heck, if it’s really important, email or text me. Rumour has it the gardener can smuggle those in hidden in his watering can…

See you on The Other Side,

ian

Now I ask only one thing. We must all put some degree of (professionally relevant) imagination into our OOFs. It’s only respectful to the poor sods still at work who’re sending us email whilst we enjoy a few days out, isn’t it?

Have a Happy New Year, everyone. And please, for the sake of the rest of us, make your OOFs mean something special. Or funny. Or whatever.

The downside of online shopping

I bought myself an early Christmas present a few weeks ago. One Saturday morning, sitting at the home PC whilst noodling about on the web, I decided it was time to replace the old warhorse and get something a bit more modern.


So I surfed off to my favourite PC web emporium and specced up a nice new Shuttle box with a quad-core low voltage CPU, 2 GB RAM, 1Tb of disk and a half decent video card. A very good deal at less than £750 delivered, I thought. All from a trusted, well-used website that I’ve spent a small fortune with before.


Problem #1 came when the expected ship-date sailed into the past, and as time got nearer Christmas, I feared for getting hold of this new and shiny toy in time to give me an excuse to excuse myself from the washing-up on the big day.


Repeated attempts to contact the web-vendor failed – “you need to call the web-orders guy on this different number”, said the company’s ‘customer services’ people – and the web guy was either letting his phone ring out (and no voicemail) or was engaged. For two whole days.


Eventually (a week later than scheduled), the goods were showing as “shipped” on ‘reputed’ web company’s site.


This after the goods were showing as in stock on the day I ordered, that is, the day they charged my credit card. Oh, and to add insult to injury, they’d dropped the prices of some of the items the day before they shipped my order… which of course, I’d paid at the higher price.


Problem #2 came when the courier was showing the following day as being “with driver” – and yet nothing happened.


And the following day, it was still the same state.


And the next.


And when I left to take the 1.5 hour round-trip drive to their depot to find out what was going on… guess what… it was really out with the driver this time, and would be delivered before 5:30. REALLY? Yes, said the man. DEFINITELY? Of course.


At 5:20 and with no parcel in possession, I set off to the depot again. Arriving at (cough) 5:55, the nice man took the number of the consignment, checked where it was, and a mere 15 minutes later arrived with the parcel in his hand.


“Why was it not delivered today, as you promised?”, I asked.


“Oh, there’s a real backlog on that route and they didn’t get to deliver it today”, says he.


“And what would you do with that parcel now, had it not been delivered?”


Try again tomorrow. A Saturday. When there’s nobody in the office. And won’t be until the New Year, now. That is, at least a week later than it should have been delivered, according to plan.


And the delivery company says we have two days to pick the parcel up from them if they try to deliver it and nobody’s there, after which they return to sender (see Problem #1).


It’s all made MUCH worse by the fact that this particular courier firm (who I did not choose; the vendor did, because it suited them and was presumably cheaper) is a franchise operation so there’s no single “throat to choke” – they just put you through to the handling depot if there’s any problem. If the depot is incompetent and/or swamped there’s nothing you can do.


In the hour or so that I spent (in total) standing in the depot, the phone was ringing continuously and nobody was answering. There were people sitting at their desks doing “work”, and yellow-jacketed delivery guys hanging about, but nobody manning the phones.


So: I spent 2.5hrs on hold to these people; maybe 1 hour hanging  about waiting to be dealt with at the actual depot; 2.5 hours or so in total driving down and back to chase them up because they don’t answer the phone, don’t respond to faxes* and don’t have an email address…


I sometimes wonder: is e-commerce really worth the hassle, compared to going down to the local PC shop who can give you advice, sell you what they have in stock and let you take it away with you..?


Would I willingly use this same company again?


 


Damn. I’ve just ordered a couple of new bits for the new PC I have, from the same people – it’s easy, they’re cheap, and they promise to deliver by Christmas Eve.


Bets, anyone?



* This was a story from another guy in the queue. He worked for a different delivery company, yet he was picking something up from this one.


He said, his company get fined (internally) if they don’t answer the phone after a few rings. He spent 1.5 hours on hold to this company from 4:30pm to 6:00pm the night before. At 6:00pm the message changed from (and I kid you not) “There are MANY people ahead of your in the queue” to “The offices are now closed… try again tomorrow”).


He sent them a fax, but got no reply.


Merry Christmas, by the way.


Bah. Humbug.


🙂

Unified Communications licensing made easy

Well, hopefully.


I get asked a lot about what licenses customer need when they want to deploy Exchange & Office Communications Server, in order to keep themselves legal & compliant. It’s sometimes a bit confusing that there are several versions of the core products, and often add-on licenses such as external connectors and the likes.


Taking Exchange & OCS separately, the basics are pretty straightforward, really, and (as ever) the devil is in the detail. That detail is on the “How To Buy” pages for Exchange and OCS, respectively.


Server/CAL basics


Like most Microsoft server products, both Exchange and OCS operate on a “Server/CAL” model, where you buy the actual server software, then acquire the access license to give you the rights to use that software from a client machine. CALs can be assigned to people (“users”), meaning the holder of a CAL can access the software from any machine, or they’re assigned to a machine (“device”), which could allow any number of people to use that machine.


In businesses, the “per user” model is the most common model, since you could license users to be able to connect to the server from their home PC or from an internet cafe, or several devices at a time (including PCs, browsers, phones, Blackberry devices etc). In some circumstances (eg shift workers, or students sharing lab PCs), it makes more sense to license “per device”, and you can mix the two together – so you might have 200 users licensed “per user” but then buy 25 “per device” licenses for the call-centre workers who might actually number 75, but working in shifts and only 25 at a time. Clear?


Along with Sharepoint, Microsoft introduced a new CAL type to Exchange & OCS in the 2007 wave of servers – the Enterprise CAL. The deal here is that some of the most advanced, new, functionality in the server software needs an Enterprise CAL to be in possession by the user or device, and it is an add-on to the Standard CAL which everyone will have anyway. You don’t need to buy Enterprise CALs for everyone – only the users or devices which will make use of that additional functionality.


There’s no actual installation of a CAL, and there’s little real tracking of CAL usage: it’s a legal requirement for the organisation operating the software to ensure that you have enough licenses, and that in itself can sometimes be a challenge. Using software like System Centre Configuration Manager, you can keep check on what users are doing, and with partner services such as Software Asset Management, you can get help with keeping track of what you’ve bought and who’s using what.


Standard vs Enterprise Edition servers & CALs


Where some confusion sometimes lies is that, for years, we’ve had Standard & Enterprise Edition servers, where the more advanced functionality (like clustering) was often part of Enterprise Edition, and cost more. Now that there are Standard & Enterprise CALs, things start to look murky. Some literature even refers to the CALs as “Client Access License Standard/Enteprise Edition” which only heightens that confusion.


There is no dependence on CAL versions vs Server versions: ie you could use clustering in the Enterprise Edition server, but still use just Standard CALs to access it. Or you could deploy a single, Standard Edition server, and have all the users taking advantage of the most advanced functionality that comes as part of the Enterprise CAL. And, of course, you can have a mixture of all of the above, as you see fit.


Exchange 2007


The Standard edition of Exchange 2007 is a good bit more capable than Standard Edition previously – there is now effectively no data storage limit to the server (compared to a 16Gb and later, 75Gb, limit in Exchange 2003), though you can only have 5 databases per server (compared to a single one in earlier versions at Standard Edition, and a 50-database limit in Exchange 2007 Enterprise Edition). Apart from some exceptions in how Messaging Records Management works, the only other real difference is that Standard Edition server doesn’t support clustering.


If you want to run clustered Exchange, you need Exchange Enterprise Edition on top of Windows Enterprise Edition (which actually provides the clustering technology that Exchange uses) for the clustered mailbox servers themselves, but all other Exchange boxes can be Exchange Standard Edition running on top of Windows 2003 Standard Edition.


When it comes to CALs, the Standard CAL gives you everything (and more) that Exchange had in the past; but some of the new functionality, like Unified Messaging or Managed Folders, requires the Enterprise CAL. See the CAL Comparison for more information


Office Communication Server 2007


OCS follows a very similar model to Exchange; Standard Edition server does everything that Enterprise Edition does, except it isn’t clusterable and isn’t designed to scale out to the same degree.


OCS Standard CAL gives you the basics of Instant Messaging & Presence/identity, whereas Enterprise CAL adds voice capabilities (which were previously a separate license for LCS2005), along with new stuff like on-premise Live Meeting data conferencing.


There are other options with OCS… if you want to extend the presence/identity piece out to the public networks (AOL, MSN and Yahoo), there’s a subscription license called Public IM Connectivity.  PIC subscriptions are collected by Microsoft then paid to the public networks in lieu of the adverts that you’d be seeing if you’d been using their own client, rather than Office Communicator).


There are also external connectors for both OCS and Exchange which could allow you to provide services to external users who aren’t part of your organisation (eg giving your clients a mailbox/presence entity).


When Microsoft people say “Enterprise CAL” they don’t always mean it


I often hear MS folk talk about “Enterprise CAL” or “E-CAL”, but they don’t mean the Exchange Enterprise CAL which allows you to use Unified Messaging, or the OCS Enterprise CAL which gives you voice & data conferencing. They’re talking about something that should really be referred to as the Enterprise CAL Suite. It’s a collection of both the Standard and Enterprise CALs for a number of different products, available to buy as a package, depending on what licensing agreement you have with Microsoft.


The idea with Enterprise CAL Suite is that if you decided you wanted the full gamut of Unified Communications, rather than having to buy Exchange Standard CAL + Enterprise CAL (since the Enterprise CAL is an “additive” to the Standard), and also buy OCS Standard + Enterprise CALs, you could acquire all of them along with various others (like Sharepoint Enterprise CAL, Forefront Client Security and many more), for a packaged cost.


In true economic terms, the more you want to buy, the lower the unit costs of each becomes. In buying OCS Standard + Enteprise CAL and Exchange Standard + Enteprise CAL, you’ll have almost spent as much as the Enterprise CAL Suite costs, so going to the Suite will add a whole slew of additional licenses and services that you could take advantage of.


Now, I hope that’s all clear. I think I’m going to go off and lie down now.


Explore the Microsoft Enterprise CAL Suite by







Product



Business Need


Tips for using Virtual PC and Virtual Server

Like many people who demo software technologies or who need to perform testing on multi-machine environments, I’ve been using Virtual PC and Virtual Server for years (and VMWare before that). If you’re unfamiliar with these two Microsoft products, both are free and can be used to conduct lab tests, play with new technologies or even run legacy applications in an old OS environment which may not be compatible with the latest OS and hardware. See Virtual PC and Virtual Server homepages for more information.

Once you’ve been using some Virtual Machines (VMs) for a while, the size of the hard disks can get a tad unweildy – one commonly used demo environment in MS has a Virtual Hard Disk (VHD) file in excess of 30Gb!

I routinely compress (at an NTFS level) the hard disk which hosts the VHDs, and try to hold them on a different physical disk from the host OS – it makes a huge difference to performance. I once ran an Exchange 2007 VHD on the 2nd disk in my laptop, and compared startup times when running off the 2nd disk (which was fastest), to holding on the primary disk along with the OS (slowest). It was quicker to even put the VHD on an 8Gb USB drive and run it from there, than holding it on the host HDD!

There are many places online where tips and tricks are displayed, but I came across Cameron Fuller’s blog recently, and he’s talked about lots of this stuff over the last year or two – if you’re thinking of doing anything serious with VPC or VS, check it out.

Here’s one of the more interesting points:

On Virtual PC disk writes were faster (57%) on a compressed drive, and disk reads were also faster (83%).

So there you have it. If running Virtual PC, definitely compress the VHD. In Cameron’s case, it was clear that his CPU was outstripping his disk I/O, so it was quicker for the PC to read a compressed file and then decompress it in RAM, than it was to read the whole thing uncompressed.

In Virtual Server, the case is slightly less clear cut – disk writes were slower (22%) but reads were faster (52%), so it may be less clear-cut, but still well worth considering, especially if you’re using VS in a training, lab or testing environment, when the dramatically smaller file sizes (both in terms of storage and also copying over the network) may even outweigh any slight performance degradation.

Bulk update Outlook Contacts’ phone numbers to be E.164 compliant

Here’s a quick & dirty tool I put together for Outlook to be able to update all the phone numbers of contacts to make them E.164 compliant. It relates back to a post a while back around the challenges of formatting numbers ‘correctly’, particularly important once you get into using click-to-dial technologies such as Office Communication Server.

The tool itself is basic since it’s only really expected that people will run it once, to sort out the numbers of old contacts you might have. It will check all the contacts in a given folder and automatically fix the numbers up, but there are a few caveats…

  • It’s hard coded for UK numbers beginning +44 … though the code is pretty easy to get to if you know anything about Outlook forms, and you can modify it at will.
  • It doesn’t back up the contacts before modifying, so you might just want to copy your Contacts folder somewhere else before running, if you’re of a nervous disposition. I can verify that it hasn’t mangled any of my contacts and nobody in Microsoft who’s tried it has reported a problem.
  • It’s not exactly straightforward to install – but if you follow the instructions carefully, you’ll be OK.
  • The document in the ZIP file explaining how to install & run it, is in Word 2007 format (docx). If you still haven’t either upgraded or installed the compatibility pack to add OpenXML support to your older version of Office, there’s a link in the ZIP file to go straight to the download page.

A final word: this is completely unsupported, supplied “as is” etc. If it does mangle all your contacts up, just revert to your backup copy – and if you didn’t take a backup then you’ve only got yourself to blame.

Harsh but fair I think 🙂

Enjoy.

The logic converts “from” the format on the left to the format on the right… (_ denotes a space)

Old format number begins New format number begins
0 +44
(0 +44 (
+44_0 +44_
+44(0 +44(
+44 (0) +44
+440 +44
(0) +44_

Examples

old number New number
0118 909 1234 +44118 909 1234
(0118) 909 1234 +44 (118) 909 1234
+44 0118 909 1234 +44 118 909 1234
+44(0118) 909 1234 +44(118) 909 1234
+44 (0)118 909 1234 +44 118 909 1234
+440118 909 1234 +44118 909 1234
(0)118 909 1234 +44 118 909 1234

Drowning in a deluge of spam

I’m sure everyone knows that email spam is a growing problem and that there’s not a great deal we can do to stop it entirely – initiatives like SenderID can help reduce the volume an organisation receives, and by using smart sender and recipient filtering* and connection filtering to drop inbound connections from known spammers or IP addresses that have been dynamically assigned, you can reduce things still further.

* The basic problem here is that by definition, mail arriving from the internet is anonymous. If you’ve ever looked at an SMTP conversation between two servers, you’ll see they’re just a bunch of clear-text commands, with the sending server saying “Hello“, then “I’ve got mail from <…>” and “it’s going to <…>” and followed by the body of the message. There’s nothing to stop anyone sending mail “From:” any address they choose… and anti-spoofing/anti-spam technology has to try to play catch up by filtering out the cases which don’t look legitimate, as well as by filtering content which appears dodgy.

At Microsoft, for example, our IT group filters any email which is coming from the outside and claiming to be “From:” any @microsoft.com address. The thinking is, there is no valid case where anything will ever traverse the internet legitimately coming from a Microsoft address, and enter the Microsoft network from outside via SMTP. So – if you’re a spammer trying to mail into Microsoft and pretending to be Bill, don’t bother. Your email will be “dropped on the floor”.

My own problem is that I have a personal email address which has been the same for about 13 years, and I was generally very careful about giving it out (registering on websites etc), but in recent years have relaxed my policy since the junk mail filters in Hotmail/MSN/Windows Live are generally pretty good and I got very little spam.

Now, some *&”%#!^ spammer has started spoofing mail from my address, and as a result I get a vast number of Non-Delivery Reports, Out of Office messages or notifications that my message has been junked since it looks too spammy. We’re talking anything up to 1,000 messages a day, which Hotmail manages to categorise as unwanted and sticks in my Junk folder, and maybe 50 or 60 that make it through to the inbox.

I’m sorry if you’ve ever had spam from my address – believe me, I don’t want to sell you Meds, offer you cheap replica watches, or present a solution for lengthening any anatomical components. Really, I’m quite happy working in IT.

I can’t think of what to do. I really don’t want to close the account since it’s a very short & sharp email address, and I use it for lots of legitimate non-work related things. I can’t stop someone pretending to be me, so I’m destined to be spending ages cleaning up my mailbox every week until the spammer gets bored and picks on some other address to spoof instead.

Unless anyone else knows different? Let me know if you have any suggestions which might stop the spammer and yet not cripple my own email address…

Fun and games with identity (and keeping it safe)

I was going to title this post, “the Wizard of Id” but decided against it.

It hasn’t been a great week for the UK government’s HMRC (Revenue & Customs) department, who admitted losing a couple of CDs which had an unencrypted export of the name, address, national insurance number and in some case, bank account details, of some 25m UK citizens, including every child registered for Child Benefit.

The media has gone to town on the department, decrying “how could this possibly happen?” and demanding the head of whoever is responsible. The chairman of HMRC has already resigned, and it wouldn’t surprise anyone if other follow.

More info on the story from the BBC.

The public consciousness

There are many questions about the whole sorry affair – such as, why on earth the National Audit Office needed the information in the first place, why HMRC decided to send it on CD rather than using the Government Secure Intranet (GSI) to transfer it, and why it would have been such a big job to filter out bank account information as had been suggested at one point. The Telegraph seems to think it would be at a cost of £5,000 to clean the data up, and take a software engineer a week. I’d be surprised if the content isn’t just a giant CSV file or similar; it should be a matter of loading into Excel 2007, deleting the columns to do with bank accounts, then saving again. If HMRC (or anyone else) wants to pay me 5 grand for doing that, I’m at your service.

What is interesting is the raising of the threat of identity theft in the public’s mind, from the sudden over-reaction of many to the casual indifference of most, at least until the story broke. Some newspapers have reported of large numbers of customers resetting their bank account PINs, and even wondering if they should move banks…

I personally shred every piece of correspondence which has my name and address in it, unless I need to keep it, and am generally pretty careful about identity. If someone did get hold of my name, address, date of birth, mother’s maiden name, bank account details etc, then it’s always possible they could mount a serious attempt to compromise my online banking – so the passwords and PINs are always unlinked to anything surrounding them… I wonder how many parents have bank cards with the PIN formed from their child’s date of birth?

I remember reading Kim Cameron’s Laws of Identity a couple of years ago and being impressed with the clarity, succinctness and yet completeness of what he said. If you’ve never read Kim’s work, go and check out the paper now or just check out the laws as bullet points.

It turns out the UK government breaks every single one of those laws at some level. And the press were saying that the HMRC crisis is a nail in the coffin for national ID cards… at least implementing an ID card system might give the government the opportunity to sort out how it deals with users’ data…