As reported in Ars Technica, the South Carolina (SC) Supreme Court iruled that gaining access to someone else's email does not violate any laws, specifically the Stored Communications Act. In the case, Jennings vs Jennings, the husband (M. Lee Jennings) was suing his ex-wife's (Gail M. Jennings) daughter-in-law, Holly Broome, (from a previous marriage) for unauthorized access to his personal email account. Holly had guessed the correct answers to the secret questions and gained accessed to his email accounts. She had been asked by her mother-in-law to look at M. Lee Jennings's email because he admitted to her that he was having an affair and had exchanged email correspondences with this woman. Holly printed the emails and provided it to Gail and her defense team, who used it against ML Jennings during their divorce trial.
The Supreme court found that the hacking was not in violation of the Stored Communications Act (SCA) because cloud-based email does not meet the "definition of "electronic storage" within the SCA [which] requires that it must be both temporary and intermediate storage incident to transmission of the communication and storage for the purposes of backup protection". It should be noted that, as pointed out by William Shapiro on this episode of This Week in Enterprise Tech (it's the first segment so you don't have to listen to the whole episode), that this judgment is only limited to South Carolina.
Wow. In these few small sentences, the SC Supreme Court has allowed unauthorized access to anything that is stored on the cloud. In the last few posts on the UWCISA blog, I have commented on industrial espionage and Microsoft's move of Office to the cloud. On my entry on cloud I noted that the cloud pretty much gives access to law enforcement:
"In terms of privacy, the way the privacy rules works is that if the provider tells you in the ToS that they will hand over things to law enforcement then they are covered from a privacy compliance perspective. (See the Privacy Commissioner's handling of the complaints against CIBC). Furthermore, as noted in this article both American and Canadian law enforcement and other agencies can access what you put on Office 365 and they don't need to do tell you about it. "
On my entry on industrial espionage, I highlighted that, in addition to the risks highlighted by US government officials on using Chinese hardware manufacturers, "it is important to recognize that other factors are at play on the specific issue of ZTE and Huawei and that the risk of Chinese hacks should not be overstated. After all, non-Chinese companies do conduct industrial espionage against one another. For example, SAP had to pay $120 million to Oracle for such activity, which occurred in 2007. But if you raised the threat of German firms hacking to get into American companies, people would think you are not well. So although this threat is real, it is not new and it's not just coming from the Chinese."
Furthmore, I have been immersed in the last few week's in Kevin Mitnick's (wiki, his site) Ghost in the Wires, which details how he hacked into Motorola, Sun, and other major companies.Once you read his story, you will quickly realize how this ruling by the SC Supreme Court makes it open season on any corporation that uses the cloud as means to outsource processing. If an average person, like Holly Broome can access confidential email - imagine what a determined hacker like Mitnick could do! For example, if you use Google Docs or the soon to be released Microsoft Office 365, then a competitor can gain access without violating the SCA and use that information. Will this judgement spur hackers to relocate to South Carolina and access all types of confidential information stored on the cloud? Of course they can't take patented or copyright information, but what about companies that likely don't have such information patented, trademarked etc or protected by other laws (e.g. privacy legislation, theft of credit cards, etc)?
It's interesting how vulnerable cloud, and technology in general, is to the inability of law makers and judges to see into the future. Common sense would dedicate that a person that buys or uses a service and keeps it secret via a password, expects that the information to be confidential to them. But I am not a lawyer, just an accountant in tech. That being said, it is unlikely that Google, Microsoft, Amazon, and the other tech giants will take this ruling lying down. One can expect that they will use their dollars and influence to allay fears that their services are safe from "legal industrial espionage".
Wednesday, October 24, 2012
Tuesday, October 9, 2012
Huawei & ZTE: Corporate spies or victims of non-tariff trade barrier
On this episode of the TWIT network's Tech News Today had an interesting discussion regarding the recent allegations that Huawei and ZTE were spying on US companies that purchase and use their equipment. As they hosts of the tech news show pointed out, Congress does not have any evidence that the firms were involved in such activity, but were rather concerned with the relationship of the two companies with the Chinese government. Another interesting point that they pointed out was that Cisco would benefit from such a ban. And according to this article, Cisco has paid $640,000 in lobbying on "measures to enhance and strengthen cyber security". As one analyst quoted by Bloomberg put it, "This is going to allow Cisco and Juniper to compete more fairly". However, Huawei too has been lobbying the US government to the tune of $820,000. Although many have cited Chinese hackers as a threat, for example, it is suspected that Nortel was targeted over a ten-year period by such hackers. However, it is important to recognize that other factors are at play on the specific issue of ZTE and Huawei and that the risk of Chinese hacks should not be overstated. After all, non-Chinese companies do conduct industrial espionage against one another. For example, SAP had to pay $120 million to Oracle for such activity, which occurred in 2007. But if you raised the threat of German firms hacking to get into American companies, people would think you are not well. So although this threat is real, it is not new and it's not just coming from the Chinese.
Big Data: Some resources
For the CAs and CISAs, looking for the coles notes version of what's going in the world of big data, check out the following podcast by David Linthicum and company; some of the most knowledgeable people on Cloud computing. Chris Daly (who works with Dave) provides a good nine item list based on this article. Chris did us all a big favour by breaking down the slideshow into a nice list of nine points. I will let you click on the link to see what they are, but I thought it was interesting to comment on the first two:
If you have any other resources, especially from an IT Auditor (i.e. security, data integrity, etc), perspective, please do share.
- "Define the business drivers". It's pretty amazing how this single premise is one of the most critical concepts on business-technology, that requires constant attention! Ironically, I just finished answering a question to a fellow accounting profession who is taking a course on IT controls to emphasize this point. What I explained to him was that the fundamental concept here is that technology changes are driven by business. In other words, IT Strategy or investments must be driven by the overall value drivers of the business.As for why you would not make changes to the system because of technological improvements is because those technologies may have no actual "Return on Investment" (ROI) for the business. In other words, companies should not adopt technology for the sake of technology.
- "Discover the data and it’s location". Wow! For those of IT-auditors that run computer assisted audit techniques (CAATS) can really appreciate how these six words can represent a mountain of work! When I teach the computer-assisted audit techniques course at University of Waterloo, I always make a point of warning my students of the practical limits of running CAATs: getting the data can be the hardest aspect of the whole process. For those of you not familiar what CAATs are, they are basically automated tests that auditors will run using "generalize audit software" on data that is used to support items on the financial audit. You can also use these technique to identify security issues or fraud; see IDEA's Caseware. (Full disclosure: Caseware is a both a sponsor of the Center that supports this blog as well as the course I teach at UW). For example, these tools help perform full analysis of a set of data e.g. identify all the negative amounts in an inventory file or link files to together using a unique identifier to compare the data from one file (e.g. credit limits) to the data in another file (e.g. total amounts owing by the customer. Also, check out the wikipedia entry it's pretty good.
For other sources, check out the massive (and free) report from McKinsey on Big Data, which they have even made available to run on your Kindle App on your Android or iOS device. Also, check out this CAMagazine article on the topic. This HBR blog post has provides a look at the overall issues, including privacy problems.
If you have any other resources, especially from an IT Auditor (i.e. security, data integrity, etc), perspective, please do share.
Sunday, September 30, 2012
MS Office goes Cloud: Quick overview of benefits and things to watch out for
Earlier this month, CNET's Mary Jo Foley reported on Microsoft's move to Office 2013. As noted on a previous blog post, this is a huge year for Microsoft as it moves to the tablet-centric Windows 8 operating system. Well, they seem to be doubling down on dramatic shifts as they launch a SaaS offering of their infamous Office productivity suite; Office 365. Mary Jo reports that Microsoft will be giving a choice between purchasing Office 2013 as "normal" or as a subscription to its cloud version of the software. To sweeten the offer Microsoft is offering the following extras (credits: Mary Jo and Paul Thurrott):
- Ability to log-in to 5 different PCs or Macs
- Access to Word, Excel, Powerpoint, OneNote, as well Access, Publisher and Outlook
- 60 Skype World Minutes a month
- 20 GB of SkyDrive storage
- Update on security and other patches
- Access to new functions through the subscription period (i.e. you don't need to wait for the next version)
In contrast, the standard PC-installed version of Office 2013 can only be installed on one machine. Also, to get access to Access, Publisher and Outlook you need to Professional version (Mary Jo has a great table here that explains the different options).
Office 365 Home Premium is $99.99/year, which
covers an "entire household" (i.e. Paul Thurrott explains that it is not tied
to a single individual, but can be used any person located at that address).
Assuming that this will be same price in Canada, this would amount to $9.42/month
(including HST) which is cheaper than two venti lattes at Starbucks. This is in contrast to
However, the big story here is that Microsoft
getting the average user - to the Cloud!
(Oh, yes – it was Microsoft that came up with those terrific ads didn't they?). Some may say that this is yesterday's news because Google Docs has already brought cloud-based office productivity. Although that may be true, if you ask my students they're using Google Docs to collaborate but still rely on MS Office to print a report or assignment. And of course when they go on their work terms, the firms are still using MS Office (so they need to know how it works and be able to use it well).
In other words: Is the world ready for moving their recipes, financial budgets, and other personal documents to the cloud?
For those that want the full low down on cloud, they can download this whitepaper from the CICA, which I wrote with Yvon Audette of KPMG. Alternatively, here is a short list of things that you can talk to your friends or whoever that are wondering what happens if they decide to go to go with Office 365 or another cloud based app.
Pay for what you use: In terms of benefits, MS has really sweetened the pie with the extras they noted above. The other implicit benefit is that you are not paying for a static piece hardware upfront. Furthermore, if you decide to change your mind later on you will be out only $100 instead of $400. For example, to buy Office Professional you have to fork over $400 on the spot, where as with Office 365 you pay as you go (i.e. $100 per year). So if you decide a year from now that you don't use all the extras that Office 365 comes up (i.e. let's say you are not using the extra software, such as Publisher, Access, Skype, etc) you can buy the Starter version or switch to an open source alternative.
The Cloud Can Go Down, but so can your laptop: There have been cases of cloud outages, as I noted in my last post. Consequently, you should create a local backup of your files from Office 365, so that they are accessible off of the cloud (I am hoping Microsoft will make this easy) and won't get corrupted if there is a problem at Microsoft. However, let's be honest - what's more likely to go down Microsoft or your own laptop? The advantage of Office 365 is that if your laptop goes down, you can always access it from another laptop. In other words, your data is no longer tied to your machine.
You have less control, but you've handed it over to Microsoft (who should know a little bit about good computing practices): It should be clear that you are handing over your files to Microsoft to manage for you. But this may be a good thing, as they may do a better job than you. For example, if you don't do local backups (as you should), then Microsoft likely does. According to this link, they perform an ISO 27001 audit (click here to see what that covers) as well as HIPAA, FISMA, and EU Model Clauses. The certification that is absent is the new SOC 2 (see here for the difference between SOC 2 and SOC1. SOC 1 replaced the SAS 70 Type II reports, which outsourcers previously used and abused).
Terms of service (ToS), assume nothing: In general, cloud service providers have an army of lawyers to indemnify them from pretty much everything. So you should assume if anything goes wrong it's tough luck for you. Also, beware on what they say in terms of who owns the data (ZDNet did an analysis last year for online storage, we hope they update it for the new Office 365). According to this post, Microsoft pays back money for downtime for the Office 365 they were offering to businesses - but it is unclear whether they would do the same for consumers.
Is a hacker also using Office 365? Amazon's cloud service, EC2, was used by hackers to launch the infamous attack on Sony's PSN. Security researchers were also able to spy on fellow "tenants". So what do these two facts add up to? Hackers will try to see what vulnerabilities exist in Office 365 to exploit to get data from other users. That being said, hackers are mostly after credit card data and it may be more trouble than it's worth to mine terabytes of cake recipes and essays on Shakespeare to find what they are looking for (but 'big data tools' do make this easier).
Privacy: accidental disclosures and the reality of law enforcement. In addition to nefarious individuals lurking on the internet, there is a risk that something will go wrong and the wrong user will get access to your documents. For example, Microsoft's precursor to Office 365 (known excitingly as BPOS) experienced precisely this kind of breach (to be fair here is MS's defense). In terms of privacy, the way the privacy rules works is that if the provider tells you in the ToS that they will hand over things to law enforcement then they are covered from a privacy compliance perspective. (See the Privacy Commissioner's handling of the complaints against CIBC). Furthermore, as noted in this article both American and Canadian law enforcement and other agencies can access what you put on Office 365 and they don't need to do tell you about it.
With Microsoft's push to the cloud, it will be interesting to "consumer outsourcing" works out. For example, how will the masses react to an outage? Will grade school teachers accept the excuse that the "cloud ate my homework"? Or will we be surprised at how adept people are to the new realities of the cloud? For example, people nowadays have camera free parties to manage the risk of the 24-7 surveillance world we live in due to social networks. Practically, consumers can use free open source alternatives to keep their personal documents offline and use Office 365 for things that they don't consider sensitive or to meet the demands of employers/customers and some of these providers are keenly working to make their offerings interact with Office 365. However, the problem is that if they are used to using Excel offline to keep their budgets are they really going to switch to the open source alternative? I guess we will wait and see what happens.
Pay for what you use: In terms of benefits, MS has really sweetened the pie with the extras they noted above. The other implicit benefit is that you are not paying for a static piece hardware upfront. Furthermore, if you decide to change your mind later on you will be out only $100 instead of $400. For example, to buy Office Professional you have to fork over $400 on the spot, where as with Office 365 you pay as you go (i.e. $100 per year). So if you decide a year from now that you don't use all the extras that Office 365 comes up (i.e. let's say you are not using the extra software, such as Publisher, Access, Skype, etc) you can buy the Starter version or switch to an open source alternative.
The Cloud Can Go Down, but so can your laptop: There have been cases of cloud outages, as I noted in my last post. Consequently, you should create a local backup of your files from Office 365, so that they are accessible off of the cloud (I am hoping Microsoft will make this easy) and won't get corrupted if there is a problem at Microsoft. However, let's be honest - what's more likely to go down Microsoft or your own laptop? The advantage of Office 365 is that if your laptop goes down, you can always access it from another laptop. In other words, your data is no longer tied to your machine.
You have less control, but you've handed it over to Microsoft (who should know a little bit about good computing practices): It should be clear that you are handing over your files to Microsoft to manage for you. But this may be a good thing, as they may do a better job than you. For example, if you don't do local backups (as you should), then Microsoft likely does. According to this link, they perform an ISO 27001 audit (click here to see what that covers) as well as HIPAA, FISMA, and EU Model Clauses. The certification that is absent is the new SOC 2 (see here for the difference between SOC 2 and SOC1. SOC 1 replaced the SAS 70 Type II reports, which outsourcers previously used and abused).
Terms of service (ToS), assume nothing: In general, cloud service providers have an army of lawyers to indemnify them from pretty much everything. So you should assume if anything goes wrong it's tough luck for you. Also, beware on what they say in terms of who owns the data (ZDNet did an analysis last year for online storage, we hope they update it for the new Office 365). According to this post, Microsoft pays back money for downtime for the Office 365 they were offering to businesses - but it is unclear whether they would do the same for consumers.
Is a hacker also using Office 365? Amazon's cloud service, EC2, was used by hackers to launch the infamous attack on Sony's PSN. Security researchers were also able to spy on fellow "tenants". So what do these two facts add up to? Hackers will try to see what vulnerabilities exist in Office 365 to exploit to get data from other users. That being said, hackers are mostly after credit card data and it may be more trouble than it's worth to mine terabytes of cake recipes and essays on Shakespeare to find what they are looking for (but 'big data tools' do make this easier).
Privacy: accidental disclosures and the reality of law enforcement. In addition to nefarious individuals lurking on the internet, there is a risk that something will go wrong and the wrong user will get access to your documents. For example, Microsoft's precursor to Office 365 (known excitingly as BPOS) experienced precisely this kind of breach (to be fair here is MS's defense). In terms of privacy, the way the privacy rules works is that if the provider tells you in the ToS that they will hand over things to law enforcement then they are covered from a privacy compliance perspective. (See the Privacy Commissioner's handling of the complaints against CIBC). Furthermore, as noted in this article both American and Canadian law enforcement and other agencies can access what you put on Office 365 and they don't need to do tell you about it.
With Microsoft's push to the cloud, it will be interesting to "consumer outsourcing" works out. For example, how will the masses react to an outage? Will grade school teachers accept the excuse that the "cloud ate my homework"? Or will we be surprised at how adept people are to the new realities of the cloud? For example, people nowadays have camera free parties to manage the risk of the 24-7 surveillance world we live in due to social networks. Practically, consumers can use free open source alternatives to keep their personal documents offline and use Office 365 for things that they don't consider sensitive or to meet the demands of employers/customers and some of these providers are keenly working to make their offerings interact with Office 365. However, the problem is that if they are used to using Excel offline to keep their budgets are they really going to switch to the open source alternative? I guess we will wait and see what happens.
Sunday, July 8, 2012
Electrical and cloud outages: Is it time to bring both on premise?
Amazon experienced an outage that affected a number of companies that rely on their cloud service. The company informed its users that its service went down due to the power outage stating:
"On June 29, 2012 at about 8:33 PM PDT, one of the Availability Zones (AZ) in our US-EAST-1 Region experienced a power issue. While we were able to restore access to a vast majority of RDS DB Instances that were impacted by this event, some Single-AZ DB Instances in the affected AZ experienced storage inconsistency issues and access could not be restored despite our recovery efforts. These affected DB Instances have been moved into the “failed ” state."
This notice was actually taken from CodeGuard (a start-up that takes snapshots of websites enabling owners to undo unwanted changes) who was one of the companies affected by the outage.
As can be expected, many will use this as an opportunity to illustrates the danger of moving from on premise to the cloud. A parallel argument would be to highlight the dangers of drawing on electricity from the central grid. One would argue one is more reliant on power than on computing - so why not bring electricity "back" on premise? This is an absurd argument, but that is exactly the point. Companies, as pointed out by Nicholas Carr in the Big Switch, used to produce their own electricity, but eventually moved to rely on the grid for power. Today hardly anyone produces their own power, but has backup generators in place to provide power should grid go down. And that's the right question to ask: why was there inadequate backup power at Amazon? In other words, society has decided to live with the fact that electricity is delivered centrally - but has built in controls to manage issues that may arise.
Instead of viewing this as a black mark against cloud computing, it is important to view this discussion in the context of risk. Charles Babcock, InformationWeek published a good article on the reaction to the Outage. He noted that some are leaving AWS in reaction to the service. Specifically, Whatsyourprice.com (an online dating service) is moving to a hosted solution - away from the cloud. However, he also mentions, Okta (an identity management service) that was unaffected by the outage because they designed their application to be fault tolerant.
In other words companies need to focus on whether the benefits of cloud computing outweigh its risks. Cloud provide pay-as-you-go computing - giving companies who have uneven workloads the ability to buy compute resources when they need it. It also give start ups, like CodeGuard, a chance to get their offerings into the market. Here,here and here are the follow-up posts to their outage - they were able to get back online and they are sticking with Amazon. And this should not be a surprise to anyone. Technology startups can leverage the pay-as-you-go model of cloud computing to conserve their capital and instead focus on getting their offering out. For example, the founder of Animoto, points out they went from 50 to 80 compute to 3,500 instances over three-days (they were signing up 25,000 new users per hour at the peak) when their app went viral. So companies will hopefully use the cloud outage to highlight the need for good design and appropriate controls instead of an excuse to stick to the status quo of on-premise computing.
"On June 29, 2012 at about 8:33 PM PDT, one of the Availability Zones (AZ) in our US-EAST-1 Region experienced a power issue. While we were able to restore access to a vast majority of RDS DB Instances that were impacted by this event, some Single-AZ DB Instances in the affected AZ experienced storage inconsistency issues and access could not be restored despite our recovery efforts. These affected DB Instances have been moved into the “failed ” state."
This notice was actually taken from CodeGuard (a start-up that takes snapshots of websites enabling owners to undo unwanted changes) who was one of the companies affected by the outage.
As can be expected, many will use this as an opportunity to illustrates the danger of moving from on premise to the cloud. A parallel argument would be to highlight the dangers of drawing on electricity from the central grid. One would argue one is more reliant on power than on computing - so why not bring electricity "back" on premise? This is an absurd argument, but that is exactly the point. Companies, as pointed out by Nicholas Carr in the Big Switch, used to produce their own electricity, but eventually moved to rely on the grid for power. Today hardly anyone produces their own power, but has backup generators in place to provide power should grid go down. And that's the right question to ask: why was there inadequate backup power at Amazon? In other words, society has decided to live with the fact that electricity is delivered centrally - but has built in controls to manage issues that may arise.
Instead of viewing this as a black mark against cloud computing, it is important to view this discussion in the context of risk. Charles Babcock, InformationWeek published a good article on the reaction to the Outage. He noted that some are leaving AWS in reaction to the service. Specifically, Whatsyourprice.com (an online dating service) is moving to a hosted solution - away from the cloud. However, he also mentions, Okta (an identity management service) that was unaffected by the outage because they designed their application to be fault tolerant.
In other words companies need to focus on whether the benefits of cloud computing outweigh its risks. Cloud provide pay-as-you-go computing - giving companies who have uneven workloads the ability to buy compute resources when they need it. It also give start ups, like CodeGuard, a chance to get their offerings into the market. Here,here and here are the follow-up posts to their outage - they were able to get back online and they are sticking with Amazon. And this should not be a surprise to anyone. Technology startups can leverage the pay-as-you-go model of cloud computing to conserve their capital and instead focus on getting their offering out. For example, the founder of Animoto, points out they went from 50 to 80 compute to 3,500 instances over three-days (they were signing up 25,000 new users per hour at the peak) when their app went viral. So companies will hopefully use the cloud outage to highlight the need for good design and appropriate controls instead of an excuse to stick to the status quo of on-premise computing.
Thursday, July 5, 2012
Tablet: Who will challenge Apple - Google or Microsoft?
Microsoft: Enters with a tablet that it manufactures
On June 19th, Microsoft unveiled it's Surface tablet. Microsoft did its best to enshroud the announcement in secrecy creating a buzz in the press (attendees did not even know until the last minute where the location of the event was - they just knew it was in Los Angeles). Microsoft released the following promotional video of the device:
The big surprise is that the company is following Apple's lead and getting into the hardware manufacturing game. Although Microsoft has experience successfully manufacturing hardware (i.e. the X-Box gaming console), the issue is that it is now competing with the OEMs that have been the key distribution channel for Microsoft's Windows OS. One key advantage of this approach is that they will be able to control the product end-to-end and seamlessly integrate the Windows 8 software and the hardware. The second key advantage is that they will have more control over the pricing, as they can effectively waive the licensing fee and just make profit off of the hardware.
In a recent interview, Bill Gates attempted to quell OEM fears that have emerged as a result of this move. But to put things in perspective, Microsoft has been aware of the issues related to relying on the OEMs to produce a great Windows experience. In early 2011, they started Microsoft Signature program. For $99, Windows 7 user can remove the "bloatware" installed by OEMs and get Microsoft to install a suite of Microsoft software, such as Windows Security Essentials (but this has to be done in a Microsoft Store and there is only rumours of one to open at Yorkdale). Alternatively, users can buy a Signature certified PC from Microsoft directly from its web store. The result is a better performing PC. Consequently, the move to manufacture its own device is a good way to ensure that Microsoft is setting the standard for performance of Windows 8. That way if there are any issues it can be blamed on the OEMs and not the actual OS.
Google's Regroups and Attacks with the Nexus 7 Tablet
Last week at Google I/O, Google unveiled its much rumoured 7 inch tablet, the Nexus 7:
Google, like Microsoft, is manufacturing the tablet itself and has already made it available for pre-order via the Google Play store (and yes, unlike Amazon's Kindle Fire, it can be bought in Canada!).
Google's challenge is similar to Microsoft, with an added snag: they depend on the carriers to roll out their OS releases. This, speaking from personal experience, can be a tedious process. As an owner of the Samsung Galaxy Note, I am still waiting on Bell Canada to roll out Ice Cream Sandwich (Android 4.0) - even though Google has already moved on to the next relase of their OS:Jelly Bean (Android 4.1). With this wifi only tablet, they can reach the consumer directly and give the consumer access to the latest and greatest OS. Similar to what Apple does with its iDevices and what Microsoft is attempting to do with the Surface, Google is controlling the hardware, so they can also create a seamlessly integrated product.
Microsoft vs Google: Who will give Apple a run for its money?
The two offerings compete against Apple in two different domains: Microsoft is relying on consumerization to eat into Apple's domination, while Google is going after portability and price.
The primary focus of the Surface tablet (as illustrated by the fancy ad, revealing the tablet in LA, etc) and Windows 8 in general is the consumer market. In the short term, Microsoft is hoping that their tablet offering will be appealing to Corporate IT because of its easier fit into the enterprise (i.e. in contrast to the iPad): executives and other employees that want a tablet can get an easier to integrate Microsoft tablet (e.g. Active Directory, etc) instead of the iPad. Furthermore, it has Microsoft Office - which is a key standard in office productivity that iPad users have to had work around. However, this is a minor aspect of the Microsoft strategy which is more about stopping the bleeding of their corporate stronghold to Apple.
In the short term, the majority business users will resist the move to Windows 8 because it is so radically different. And according to Paul Thurrott, it appears that Microsoft has given up on the business users with this release of Windows 8. However, this may not be a bad strategy. Microsoft realizes that corporate IT was going to take a few years to switch to Windows 8 - even if it was not radically redesigned. During these years between when corporate IT would have migrated from Windows 7 to Windows 8, Microsoft is expecting users to become accustomed to the new windows 8 interface in their personal lives. Once this occurs, Microsoft is hoping that trend of consumerization will play in its favour: home users who enjoy the Windows 8 Metro interface will put pressure over time for corporate IT to switch to the new version of Windows - just as the iPhone users put pressure on corporate IT to dump RIM in favour of Apple.
This is coupled with the fact that users will no longer need to carry a laptop and a tablet: the Microsoft window 8 machines can act as a laptop when you are at work or at home and as a table when you are on the go. There is no need to sync files between the two machines. Of course, this assumes that Window Surface machines have a long battery life and will be as reliable as iPads. But the new Windows 8 is smooth and responsive (I had an opportunity to try it out on a Windows 7 Acer Iconia tablet), so there is a reason to hope that this will work out.
Google's recent foray into the tablet market is a little different. Google is working off its previous failed attempts, specifically Honeycomb, to get something out there that will compete against the iPad. With the success of the Kindle Fire, Google has zeroed in on price and portability as key features of the tablet. Will the fact that it is WiFi only hurt its appeal? I don't think so. With the majority of smartphone (even BlackBerry!) being able to act as WiFi hotspots, this is not much of an issue. More importantly, users are not locked into 3 year contracts with cell phone providers. From Google's perspective, it also removes the carriers as an obstacle to getting the latest-and-greatest Android OS to the end-user. Initial reviews of the device are positive. Although I was tempted to buy this, I realized that since I have the Galaxy Note "phablet" (a term that I despise) it doen't make sense to get a 7 inch tablet. Besides, I should save up for the Surface :)
It appears that Apple is aware of Google's strategy: they have lowered the iPad 2 by $100 (i.e. when they released the 3rd generation iPad) and rumour has it that they are preparing to launch a 7 inch tablet themselves. But is the company underestimating Microsoft? Microsoft's Windows 8 Metro interface appears to be unique enough that Apple can't rely on its armies of lawyers to sue Microsoft (i.e. as it has done to "compete" with Samsung's products). The other problem is that Microsoft still dominates not only corporate IT, but also office productivity - people are addicted to Word, Excel, PowerPoint, etc and it is hard to let go. That being said, Microsoft is rumoured to have a version of MS Office for the iPad. If this is true, then Microsoft would be shooting itself in the foot as it would hand over this key strategic asset to Apple on a silver platter. On the other hand, Microsoft could become a dominant force for tablets when it comes to business users (anyone ranging from a business student, entrepreneur, or cubicle dweller). However, I think that Apple will continue to dominate the pure consumer market because they have been successful a the "toasterfication of IT": using the iPad is almost as easy as operating a toaster. Anyone with kids or older family members, can see how intuitive the device is. Microsoft is attempting to get into the space with the ARM version of the Surface Tablet. However, this is a long shot because they are behind in apps and, more importantly, the device is quite a bit more complex than a toaster.
On June 19th, Microsoft unveiled it's Surface tablet. Microsoft did its best to enshroud the announcement in secrecy creating a buzz in the press (attendees did not even know until the last minute where the location of the event was - they just knew it was in Los Angeles). Microsoft released the following promotional video of the device:
The big surprise is that the company is following Apple's lead and getting into the hardware manufacturing game. Although Microsoft has experience successfully manufacturing hardware (i.e. the X-Box gaming console), the issue is that it is now competing with the OEMs that have been the key distribution channel for Microsoft's Windows OS. One key advantage of this approach is that they will be able to control the product end-to-end and seamlessly integrate the Windows 8 software and the hardware. The second key advantage is that they will have more control over the pricing, as they can effectively waive the licensing fee and just make profit off of the hardware.
In a recent interview, Bill Gates attempted to quell OEM fears that have emerged as a result of this move. But to put things in perspective, Microsoft has been aware of the issues related to relying on the OEMs to produce a great Windows experience. In early 2011, they started Microsoft Signature program. For $99, Windows 7 user can remove the "bloatware" installed by OEMs and get Microsoft to install a suite of Microsoft software, such as Windows Security Essentials (but this has to be done in a Microsoft Store and there is only rumours of one to open at Yorkdale). Alternatively, users can buy a Signature certified PC from Microsoft directly from its web store. The result is a better performing PC. Consequently, the move to manufacture its own device is a good way to ensure that Microsoft is setting the standard for performance of Windows 8. That way if there are any issues it can be blamed on the OEMs and not the actual OS.
Google's Regroups and Attacks with the Nexus 7 Tablet
Last week at Google I/O, Google unveiled its much rumoured 7 inch tablet, the Nexus 7:
Google, like Microsoft, is manufacturing the tablet itself and has already made it available for pre-order via the Google Play store (and yes, unlike Amazon's Kindle Fire, it can be bought in Canada!).
Google's challenge is similar to Microsoft, with an added snag: they depend on the carriers to roll out their OS releases. This, speaking from personal experience, can be a tedious process. As an owner of the Samsung Galaxy Note, I am still waiting on Bell Canada to roll out Ice Cream Sandwich (Android 4.0) - even though Google has already moved on to the next relase of their OS:Jelly Bean (Android 4.1). With this wifi only tablet, they can reach the consumer directly and give the consumer access to the latest and greatest OS. Similar to what Apple does with its iDevices and what Microsoft is attempting to do with the Surface, Google is controlling the hardware, so they can also create a seamlessly integrated product.
Microsoft vs Google: Who will give Apple a run for its money?
The two offerings compete against Apple in two different domains: Microsoft is relying on consumerization to eat into Apple's domination, while Google is going after portability and price.
The primary focus of the Surface tablet (as illustrated by the fancy ad, revealing the tablet in LA, etc) and Windows 8 in general is the consumer market. In the short term, Microsoft is hoping that their tablet offering will be appealing to Corporate IT because of its easier fit into the enterprise (i.e. in contrast to the iPad): executives and other employees that want a tablet can get an easier to integrate Microsoft tablet (e.g. Active Directory, etc) instead of the iPad. Furthermore, it has Microsoft Office - which is a key standard in office productivity that iPad users have to had work around. However, this is a minor aspect of the Microsoft strategy which is more about stopping the bleeding of their corporate stronghold to Apple.
In the short term, the majority business users will resist the move to Windows 8 because it is so radically different. And according to Paul Thurrott, it appears that Microsoft has given up on the business users with this release of Windows 8. However, this may not be a bad strategy. Microsoft realizes that corporate IT was going to take a few years to switch to Windows 8 - even if it was not radically redesigned. During these years between when corporate IT would have migrated from Windows 7 to Windows 8, Microsoft is expecting users to become accustomed to the new windows 8 interface in their personal lives. Once this occurs, Microsoft is hoping that trend of consumerization will play in its favour: home users who enjoy the Windows 8 Metro interface will put pressure over time for corporate IT to switch to the new version of Windows - just as the iPhone users put pressure on corporate IT to dump RIM in favour of Apple.
This is coupled with the fact that users will no longer need to carry a laptop and a tablet: the Microsoft window 8 machines can act as a laptop when you are at work or at home and as a table when you are on the go. There is no need to sync files between the two machines. Of course, this assumes that Window Surface machines have a long battery life and will be as reliable as iPads. But the new Windows 8 is smooth and responsive (I had an opportunity to try it out on a Windows 7 Acer Iconia tablet), so there is a reason to hope that this will work out.
Google's recent foray into the tablet market is a little different. Google is working off its previous failed attempts, specifically Honeycomb, to get something out there that will compete against the iPad. With the success of the Kindle Fire, Google has zeroed in on price and portability as key features of the tablet. Will the fact that it is WiFi only hurt its appeal? I don't think so. With the majority of smartphone (even BlackBerry!) being able to act as WiFi hotspots, this is not much of an issue. More importantly, users are not locked into 3 year contracts with cell phone providers. From Google's perspective, it also removes the carriers as an obstacle to getting the latest-and-greatest Android OS to the end-user. Initial reviews of the device are positive. Although I was tempted to buy this, I realized that since I have the Galaxy Note "phablet" (a term that I despise) it doen't make sense to get a 7 inch tablet. Besides, I should save up for the Surface :)
It appears that Apple is aware of Google's strategy: they have lowered the iPad 2 by $100 (i.e. when they released the 3rd generation iPad) and rumour has it that they are preparing to launch a 7 inch tablet themselves. But is the company underestimating Microsoft? Microsoft's Windows 8 Metro interface appears to be unique enough that Apple can't rely on its armies of lawyers to sue Microsoft (i.e. as it has done to "compete" with Samsung's products). The other problem is that Microsoft still dominates not only corporate IT, but also office productivity - people are addicted to Word, Excel, PowerPoint, etc and it is hard to let go. That being said, Microsoft is rumoured to have a version of MS Office for the iPad. If this is true, then Microsoft would be shooting itself in the foot as it would hand over this key strategic asset to Apple on a silver platter. On the other hand, Microsoft could become a dominant force for tablets when it comes to business users (anyone ranging from a business student, entrepreneur, or cubicle dweller). However, I think that Apple will continue to dominate the pure consumer market because they have been successful a the "toasterfication of IT": using the iPad is almost as easy as operating a toaster. Anyone with kids or older family members, can see how intuitive the device is. Microsoft is attempting to get into the space with the ARM version of the Surface Tablet. However, this is a long shot because they are behind in apps and, more importantly, the device is quite a bit more complex than a toaster.
Wednesday, June 6, 2012
Oracle & Google IP Trial: the Judge is the Gem
Last week the "WorldSeries of intellectual property trials" came to a close. Oracle, who purchased Sun Microsystems, was suing Google over its use over Java. Oracle claimed the Google had infringed on 37 of its copyright "APIs" or application programming interfaces.
What is an API, you may ask? I also had the same question and found the following resources that may be of help:
- Simplest definition that I found was on the Guardian's reporting of the trial who defined APIs as "computer language that connects programs and operating systems – known as application programming interfaces". But I wasn't satisfied with that, so I dug some more.
- CNET had a number of good resources on the topic. This FAQ gives a good broad overview of Java and explains the relevance of APIs to the programming language. However, the article that probably sheds the most light on the topic is this one. The article walks through a key part of the trial where Joshua Bloch (former Sun Java-expert-engineer now working for Google) defines an API "as "names or words and a set of rules." When the program speaks to a library, it has speak in a very precise language, he continued. Typically the words are verbs and phrases, such as "remove the header."". What is also helpful is the accompanying slideshow that illustrates the lines of codes that Oracle claimed that Google infringed upon.
Google sought to pay Oracle 2.8 million, but Oracle wanted a cool billion for what it deemed to be a violation of the copyrights. The end result was that Oracle lost; the judge delivered a narrow ruling that Google use of the APIs was not a violation of copyright because APIs cannot be copyrighted. As reported on GigaOm, "The crux of Alsup’s ruling today is that 37 of the Java application programming interfaces aren’t eligible for copyright in the first place. Copyright typically protects authors’ work — in the form of books, music, computer code, etc — but doesn’t extend to functions or ideas."
IP: A drain on innovation
The case is a good piece of evidence for those that are critical over the patenting of software.Critics, such as John C. Dovorak, point out that the system is dysfunctional altogether. From a resource allocation point of view, this trial illustrates that a significant amount of resources are dedicated to litigation. According to Patrick Doody, an-ex partner at Pillsbury law firm, the trial is estimated to cost $50 million. Leo Laporte, owner of the This-week-in-Tech (TWIT network), routinely points out in the podcasts that he produces - that software giants waste money on patent suits instead of spending those same funds on innovation. To quantify his argument: if the average salary paid to an IT professional is $80,000,Google and Oracle could have invested in about 625 full-time equivalents (FTEs) worth of work instead of litigating this trial. Of course such logic is lost on Capitalist enterprise, whose focus is profits over innovation.
Technology & Society: A Watershed Moment
Another nugget that came out of this trial was the reason that judge William Alsup's (the judge presiding over the trial) rejected Oracle's argument. The judge challenged Oracle's assumption that a "range check" was difficult to build - because he knew how to code in Java!
According to Wired, "he had learned to code in Java for the trial — implying that he knew other languages as well — and he said that he had written some of the infringing code at least a hundred times since Oracle filed its suit in August 2010. “I can do it. You can do it. It’s so simple,” he said, adding that it takes less than five minutes. Then looked directly at Boies. “You’re one of the best lawyers in America — how can you make that argument?” he demanded."
Posts in the tech community, notably on I-Programmer and O'Reilly, point out that this is a watershed moment in society: code and technology is "a part of the world we live in".
Can one make the analogy that if judges should be this technology proficient, so should audit practitioners?
Given the nature of the accounting profession, it would be difficult to make it mandatory for audit practitioners to program. However, on the other hand, the profession should use this opportunity to re-examine what aspects of technology should be a part of the audit practitioners skill set - given that is clear that society's attitude towards technology has clearly changed.
Subscribe to:
Posts (Atom)