You forgot but I remember and frankly it will cost you or make you rich.

Do you remember when you were boycotting Netflix?

America the land of the forgetful, we are supposed to remember when people do things that aren’t cool but we don’t.  We forget and then someone makes millions from our poor memory, it’s like we have cultural amnesia.   How about we talk a little about a company named BP.  Let’s look at some numbers..

Now the figure below doesn’t look like a company that America has punished as a matter of fact if you bought stock in June of 2010 you would be pretty happy right now.

 

 

 

 

 

 

 

 

We could go over many examples of this kind of behavior but the bottom line is that we Americans forget. Now with all the companies we deal with and all the social media how are we going to handle when something or someone does something wrong?    SO, with all that said here is my advice to you if you are reading this blog today, this is time-tested and proven advice….. ready??? Consider buying stock in Carnival Corporation CCL if I am right people will forget that one of their cruise liners just crashed and they have already forgotten about how many people have gotten sick on cruises!   When you make your millions just send me a note..

You’re welcome..

Howie


What the “means” means/

Ron Batdorf is a leading DoD Civilian who brings new fresh ideas to the DoD.  Ron believes in helping people and he practices helping one person at a time.   Here are some of his thoughts!

Ron Batdorf thoughts:
Humans have always judged what is normal and looked for answers to why we have discrepancies from normal and at what point do these discrepancies/errors/conflicts, etc. need to be addressed. How do we define normal? For most of us it is the steady-state of our environment or in systems speak it is what the system was designed to perform (range or specifications) that fit within a normal distribution curve. The means of the normal curve is the optimum performance of the system and the closer we can get to the means the better our specification are for consistent performance and a better steady state environment.
The question we all have to ask is “what is included in our environment” or “system”. Let me redefine the term I am using as “system”. To me a system whether we are talking about one human being or an organization, or for that matter, whole cultures’ can be summed up as a “system”. The rationale I am using is similar to what has to happen in order to have a capability, which I am very familiar with. It entails the cause/effect or fishbone diagram. Simply put, all systems whether cultures, organizations or down to one human being, have to have at the center the fishbone which includes a human in the loop; materials (physical or non-physical) which usually are stated as machines and the expendables [energy, raw materials (elements), information, etc.]; and, finally the methods/logic/processes, etc to make all of the other components work towards a single capability.
I have found these same attributes exist in every area of professional work. For example in Information Technology the person is replaced by the user interface; the methods or processes by business logic; machines refer to infrastructure; and, materials are directly related to data. All these components of the fishbone diagram affect our notion of normal or steady state?
Do others have normals that counter our normal or do they parallel ours? What happens when other “system” (again using systems in the broader context explained above) enter our boundaries or our environment? For example if we breakdown very large “systems” we would be able to see what our own inputs and outputs for the merged system’s entails. What we are beginning to realize is for organizations to be agile we need these individuals’ inputs and outputs functioning separately but still able to be a part of the larger system. This is where the term loose coupling has been suggested in Information Technology circles.
As we strive for perfection which from a knowledge standpoint in normal is the means (the point of the Alpha and Omega of the system at its apex of performance) we know that we will never reach it but instead have to have some acceptable variation or for us humans’… a tolerance level where we don’t reach deadly conflict. This measure has been defined in statistics as sigma. When we are at the switch of going from positive to negative or vice-a-versa we then know and understand our choices and how they will affect the direction and possible outcomes. Our perfect world is distorted because we have choices. This is what impacts the universe around us and what the Creator put into motion when He created it. When we stop having choices we cease to exist and I believe we pass to another world where gray areas (errors to normal) are not gray any longer but where we see the means and can tell with clarity what is black or white.
This quote was attributed to Aristotle however I could not verify it: Virtue is the means between extremes. This is a very sage statement relevant to our own times today and into infinity and please don’t confuse means with moderation.


“Shut up”..! That was the best advice I got this week.

About a month ago I changed jobs.   I went from a military component organization to a DoD component organization.  Don’t know the difference?  Don’t worry it doesn’t matter, that much.  Well, at least that is what I think after a month or so.  I am not writing about the job though as much as I would love to start putting key to board on my thoughts.  I am writing about what one person told me this week that I thought was interesting and important.

I changed positions not only from one company to another but from one government organization to another, I started to look, listen and learn about the culture, the job itself, the organization etc.   In my head I started to see a picture, it was becoming clear and I was convinced that my coming in would CHANGE things for my new organization.  After all, I have experience with my ABC’s and 123′s.   Where I left people would say “ask Howie” and I would come to meetings with my trusty notepad and pen with various process and methods to help whomever has a problem.   You could say that I was there long enough to be a known commodity.  I have spoken and written about Joint Forces in the past, it is no secret that the Joint world has a certain flavor / culture that is based on the Joint lexicon and taxonomy and fundamentally like the rest of the world you are who others perceive you to be.   In other words,  if someone in leadership says “that is the smart guy” then that is the smart guy.    Now, I wasn’t the smartest guy in the room and I wouldn’t pretend today that I should have been labeled as such.   What I did have was “trust credit” which means that leadership knew if I read something or wrote something or better yet attended a meeting, that they would get my honest opinion but I would back my perspective with some facts (where possible).   This is important, because YOU have this too in some degree.

I left my position at what was Joint Forces because I felt strongly that I can help more people from the DoD enterprise.   What I didn’t count on was that it is going to take a long time.  

I thought I would come in and start looking at the situation, perform analysis, make assessments and start to ask questions that would challenge my new leadership into thinking in ways previously undiscovered.   What I found was different from what I thought.   It doesn’t really matter why but it has really challenged my thinking in ways that were previously undiscovered.

I miss my friends and co-workers at what is now Joint Staff and I miss the others that have since left and moved on to other positions due to the Joint Forces disestablishment.  Looking at my work today, I see connections between what I did and what I do.  I have asked both my current leadership and my past leadership if I can find and bind these connections and thankfully they both agreed.   Which brings me to this past week.

There are days that I am sitting in my old office not far from where I used to sit, hanging around the people I grew up with career wise.  It is nice to see them and spend time with them knowing that they mean a lot to me and that I mean something to them.  This past week I had some things to do in the office and went down to take care of them.   One of the civilian leaders came down and saw me sitting there.   Immediately he was interested in what I was up to and sat down to have a chat.   I explained that I am working hard and running on the old hamster wheel trying to figure out the best ways I can help my new organization in ways that made sense to them.   He knows me pretty well and he understood clearly what I was going through.   He looked at me and said “You know what your problem is?”  ”No sir” I said .  Then he paused and said “shut up.”    He went on to explain that I have been in my new position for a very short period of time.   He said “I know you, you are a great leader and after 27 years I know who will be leading and who will be left behind.”  He continued “You need to listen for at least 90 days, you need to LISTEN not speak, not write, not know, just listen.”   My first class when I took my MBA was about “effective listening” and of course, he threw me back there in a blink.   I thought I was listening and taking note and looking and learning, but maybe not.   It wasn’t a punch in the face or anything, it was simple truth and I like to say that when I am talking to people who I am giving them the same.  It was a good dose of my own medicine and I think I needed it.   He didn’t just leave it at that, he gave me a plan to execute after the 90 days and he asked me to follow-up with him to see how I was progressing.   I have that plan written and I have my listening ears on.  All this time, I thought I was going to just go in there and help them but really my helping them is helping me.

I don’t know what the results will be 90 days from now for the people I am currently working for but I do know that 90 days from now I will have practiced better effective listening skills and I will look make every attempt to “shut up” unless there is something I have to say.   With all the talking and communication we have to do today it does seem that we do a lot of this wha wha wha something important wha wha wha something something and really the only thing we needed to say was the something important part.  All the wha wha’s are just to hear ourselves.

“Wha Wha”

 

 

 


What do you do with 41cents?

My family went on an adventure this evening to IHOP.   The food was normal for IHOP and the deal was good because the kids eat free after 4 or something.   Sometimes on the rare occasion that I take the brood out we go there because it is family friendly.   After we ate dinner we paid with a gift card that one of our dear friends provided.   After the meal was rung up 41 cents remained.  My wife asked if we could just get the 41 cents and of course they said “no.”   This is the icing on the cake for a wonderful day of great customer service.  DEERS the military personnel system was down all day and I sat and waited for hours.. I mean HOURS and it never came back up.   When I was driving home talking to my wife and others my phone dropped calls……..every call.   We bought some stuff at Sears last week and they were supposed to make a price adjustment but that couldn’t happen because “the system” couldn’t do it today.  We have to wait until next week.   What the hell has happened to this country?  What the hell has happened to customer service?  Since when does the machine rule us?  We don’t have to wait for the Terminator scenario, our lives are already controlled by the machines.

I am a technologically oriented guy and still I think it is ridiculous.  You want to know what happens when you put machines in place of people?  You spend more money.  Companies look to save more but they wind up spending more.  Think about DEERS today, it was a worldwide outage.  WORLD WIDE outage and people still went to work and went to the pass and visitor offices to get their common access cards or whatever they needed and the system was down.   It was like a snow day for the DoD personnel associated with CAC or anything that had to do with DEERS.   How much did all the labor and travel cost?  I know it cost me money, it cost me travel, time and I had to buy lunch and moreover I get to do the whole thing again tomorrow!

We really need to think about the costs of trying to save money and create efficiencies.  We really need to think about customer service.. oh yeah.. customer service.   We really need to think about people.  I can tell you that my day wasn’t limited to just this idiocy, there was more.  We need to think about the cascading domino effect of how we touch people and we need to take individual responsibility to make things better.   If we don’t start changing our behavior.. this will only get worse.


Mind Mapping Resources, Tools, and Tips

Here he goes again with the mind mapping…

Happy New YEAR!  It is Sunday January 1st, 2012 and I have to share with you all that I kept my resolution last year and managed to blog throughout the year.  It is important to share information and I believe that it is even more important to write outside of the office in order to keep your thoughts and writing fresh.    With that, I am writing today to bring back a subject that is near and dear to my career which is Mind Mapping!

There are many ways to express information but what I find most valuable is a thought tree with node (thought) connections, linkage types and the relationships in context.   Essentially it is a visual way to write what you think which further enables you to go back and look at your writing from a graphical perspective.

Think that is not important?  Guess again.. http://www.good.is/infographics Infographics are becoming more familiar because the grouping of concepts and information with graphic representation is more natural to consume.  You know “a picture is worth a thousand words?”   How about a picture with words will save you thousands!  If you start with the words in an image it helps pull things together for analysis and saves time in re-work.

Something simple

MindMap

Something a little more complicated

Something more practical

I practice mind mapping almost every day and I even generate documents from the maps I build.   You can use Freemind to do this but I like the MindJet interface.   For high level mapping and document generation I use Freemind and for deep dives and what I call “node traveling” I use Personal Brain.  Below are resources provided by http://t.co/FkHwhqbk but I pasted them here for ease of travel.   If you have questions on how you can use mind maps or you want more information, let me know!

Free Software

mapping your mindFree Mind - the premier java-based mind mapping software known for its quick, one-click “fold/unfold” and “follow link” operations.

Wisemapping - “Visual Thinking Evolution”, offering free web based mind maps you can share anywhere on the web.

Mindplan - mind mapping and project managementcombined with Lotus Notes.

Mindomo - an online mapping application offering both free and paid premium accounts.

Recall Plus - enhance your learning power with the downloadable software for free, or upgrade to Plus for full functionality.

MindMeister - collaborative online mind mapping with free basic, premium, and team plans.

Mapul - online mind mapping using Ajax and Silverlight web technologies.

DeepMehta - software combining open-source and interdisciplinary research for knowledge management.

bubbl.us - a simple and free application that allows users to brainstorm and share ideas online.

Mind42 - manage all your ideas in a collaborative, free browser based software solution.

Compendium - created by the Compendium Institute, with an open online forum for continued support.

Gliffy - easy, free, and fun way to draw and share diagrams on the web.

Wikka Wiki - a flexible and lightweight, php-driven wiki platform designed for speed and security.

IHMC Cmap Tools - designed to construct, share, and criticize mind and concept maps.

Semantik - a mind mapping tool designed for document generation, especially student reports and thesis.

Labyrinth - a lightweight mind mapping tool written in the Python programming language.

View Your Mind - a flexible tool used to generate and manipulate maps which show your thoughts

Mindraider a semantic web outliner, connecting the tradition of outline editors with emerging technologies.

Pimki a personal information manager loosely based on Instiki’s Wiki technology.

Planfacile - software designed to help people organize complex ideas into coherent documents.

The Brain - over 65 features in a dynamic visual interface and information organizer.

Resources

brainMindmapping.org - the most complete resource for mind mapping software on the internet, covering most freeware, open-source, and proprietary software.

iMindMap - unleash the other 99% of your brain using the power of the iMindMap.

About mind mapping - and basic introduction to the concepts and benefits if mind mapping.

Wikipedia on mind mapping - the usual Wiki-style treatment of the subject that you (and Google) as grown to love.

Mindtools - lots of articles and resources to develop excellent skills for an excellent career.

JCU Study Skills - an essay wring resource that discusses using mind maps in preparation.

Mind mapping training & resources - resources provided by Llumine training, the world’s leading provider of Mind Mapping training for business.

Mind mapping strategies- get more done with less time, and turn your data into knowledge.

Mind mapping resource center - InnovationTools – Innovation, creativity and brainstorming resources from InnovationTools.

The Graphic Organizer - covers topics related to mind mapping including concept maps and graphic organizers.

Mind Map Options - resource that is the doorway to the mind map universe.

Professional Training

Visual Strategist - founded by Kyle McFarin to assist Entrepreneurs and Organizational Teams in Strategic Management.

MindMap Training - visual mapping and mind mapping training solutions to manage information and visualize your successes.

Blackbelt mind map training- become a trained black belt in the dark arts of mind mapping.

In the News

Mainstream Matters - insights and intelligence from the analysts of Freeform Dynamics.

Mind mapping on the iPhone - if you thought your iPhone was cool before, imagine what it will do once you have a mind map application?

Helping children learn with mind mapping - the sooner your kids learn the technique, imagine how much they be able to accomplish?

Mind mapping in meetings - Lifehacker shows you yet another method of increasing your productivity.

Makers of mind-mapping software visualize success - CNN Money covers the release of Mindjets’ MindManger software.

Examples of Mind maps

Mind map template - a blank map to help get you started on your first ever mind map

Inconsistency of Laws Mindmap - example of a software generated mind map that’s easy to read and digest.

Learning Power mind map - wonderfully illustrated map about how to build your “LP”.

Motivation mind map - another example of different software mind map generation, with graphics.

Art & design mind map - beautifully hand drawn map related to art and design, a work of art in itself.

Banking Mindmap - mindmap about money and consumer information in a entertaining, comic-book style of illustration.

Mind mapping mind map - a very simple example of mind mapping that discusses the actual properties of the technique.

Relativity mind map - clean, basic map made with software that uses simple colors and shapes to get the points across.

Goals mind map - everyone should have one of these, if you plan on accomplishing anything in your lifetime.

Planning a party mind map - if you’ve never planned a party, it can be tougher than you think; keep this colorful map around for inspiration.

Peter Russell mind map - a mind map of the various teachings and techniques used by Peter Russell himself.

Tony Buzan mind map - a great map discussing the ins and outs of a specific book from the man himself, Tony Buzan.

Books

The Mind Map Book: How to Use Radiant Thinking to Maximize Your Brain’s Unlimited Potential - written by Tony and Barry Buzan, it’s THE book you’ll want to pick up if you’re new to mind mapping.

Mapping Inner Space: Learning and Teaching Visual Mapping - Nancy Marqulies and Nusa Maal discuss various concepts related to visual note taking.

Use Both Sides of Your Brain: New Mind-Mapping Techniques, Third Edition (Plume) - Buzan does it again with step-by step instructions of how to use the potential of your brain.

Idea Mapping: How to Access Your Hidden Brain Power, Learn Faster, Remember More, and Achieve Success in Business - Jamie Nast explores using that hidden brain power to grow your business.

Mind Mapping: How to Liberate Your Natural Genius - Michael Gelb talks about how to organize your thoughts in such a way that is uniquely your own.

E-Books

Power Tips for Mind Mapping software - supercharge your visual mapping skills with these tips, tricks, and best practices.

How to select the right mind mapping software - how to select the right mind mapping software to meet your special needs.

Mind mapping power pack - the advanced course that will explode your mind mapping skills into new heights and help you reach the goals of your dreams.

Articles On the Web

using your eyesMind mapping for project management - Innovation Tools discusses using mind mapping in regards to project management.

Mind mapping at 43 Folders - open thread with over 60 responses about the usage of mind maps.

Guerilla Marketing with mind maps- Squidoo lens discussing the 10 best small business marketing tips.

Mind mapping software resources - another lens discussing the best collection of visual mapping sources.

Mind mapping in 8 easy steps - the Innovation Networks quick-start guide to mind mapping.

Comparison of mind mapping applications - check out the pros, cons, and differences of the top freeware mind mapping programs.

The best external monitor for Tablet PC mind mapping - eric mack online discusses monitors for hardcore computer mapping enthusiasts.

Three web-based mind mapping tools reviewed - Web Worker Daily reviews 3 of the top mapping applications.

PDF Articles

Mapping the Mind - a Google book about about the long dormant view of the nature of human thought.

Mind mapping for web instruction and learning - 12 page PDF from Franciscan University of Steubenville’s Fabio Chacon, Ph.D.

Graphical Knowledge Display - 14 pages discussing the role mind mapping can play as efficient tools in mathematics education.

Blogs

The Mind mapping software weblog - designed to provide businesspeople with a focused collection of resources related to visual mapping.

Beyond Mind Mapping - how to get the most out of mind mapping software for business uses.

Erik Mack Online - the personal blog of Erick Mack, discussing learning and information management through new technologies.

Idea Mapping - training readers to be more creative, more productive, and to become better learners.

The Mindjet Blog - the official blog of Mindjet, the company responsible for the

The Underlying Blog - Kyle McFarlin’s blog, a Visual Strategy Expert and Gyronix Certified trainer.

Mindmapping.org Blog- covering software for mind mapping and information organization.

Eric Blue’s Blog - Eric Blue’s thoughts on technology, philosophy, and personal development.

Activity Owner - a forum for sharing notes, discussion, and solutions using various mind mapping software applications.

People

tony buzanTony Buzan - Wikipedia bio of one of the biggest names and promoters of mind mapping and mental literacy.

Dr. Allan Collins - the history and sometimes controversy surrounding the man who created mind mapping.

Dilip Mukerjea - owner and managing director for the Buzan center, an organization dedicated to the advancement of mental literacy.

Joyce Wycoff - president of ThinkSmart Learning Systems and founder of the Innovation Network,

Nancy Margulies - creator of Mindscapes, a system that uses pictures, visual metaphors, symbols, color and the space on a page to create a graphic representation of ideas.

Peter Russell - covering Peter’s topics of The Spirit of Now, of science, consciousness, spiritual wisdom, global brain, meditations, and the nature of reality.

Videos

Tony Buzan on Mind mapping - five minute video discussing how to maximize the power of your brain.

iMind Map Video Tutorial - a short four minute tutorial going over Buzan’s iMind mind mapping software.

Mind mapping for your business - a power-point video on mind mapping; have a can of Red Bull before watching!

Mind mapping with Brenda Mckinney - video of a class presentation of mind mapping.

Stephen Pierce - business optimization specialist discusses mind mapping.

How to draw a mind map - breaking out the markers and drawing a mind map from scratch.

Noteworthy Paid Software

Gyronix - a system used in conjunction with Minjet’s MindManager software for unit erupted productivity.

Mindjet - save time by visually capturing, organizing and communicating ideas and information effectively.

Concept Draw Mindmap - a business and personal productivity tool that provides versatile integration with MS Office.

Topicscape 3D - mind and concept mapping in 3D, available in both lite and pro editions.

Headcase - mind mapping application for Windows based heavily on ActiveX.

Inspiration - the essential tool for students to think, visualize, organize, and learn.

Nova Mind - “mind mapping at it’s best”, creating visually pleasing graphical mind maps.


Antisocial behavior and the declining leader.

The social network connects us but we are very disconnected.  We have collaboration strategies that go well beyond what we ever imagined yet we struggle to find ways to work together.  We have more physical technology to keep us together than ever before but the webcam isn’t a replacement for the conference room.

I only blog once a week but I write all week on various websites, twitter, and various social media outlets.  What I find that people respond to is when I write about something that struck me emotionally.   While this is my personal observation from content that I generate, I also find that when other people write or say something controversial is when there is a large response or more participation.  In other words,  we are always seeking that shock value and today because things are not shocking anymore we are becoming more and more numb.

This behavior isn’t seeping into the workplace, it has flooded the workplace.  Instead of the cold and shocking text or facebook post, it is in a cold and shocking email.   I have personally witnessed this behavior and I have seen people waiting for the reaction to their emails or messages after they hit the send button.   I have even found myself looking for the response to messages that I had sent professionally knowing full well that they would not be well received.   The underlying problem is that these behaviors are pervasive and they are infecting all of us.

Take the Trolley Experiment which essentially asks a variety of questions based on the scenario that five lives may be worth more than one life.   There are variants where questions are raised about who the five people are versus the one person.

“Suppose that a judge or magistrate is faced with rioters demanding that a culprit be found for a certain crime and threatening otherwise to take their own bloody revenge on a particular section of the community. The real culprit being unknown, the judge sees himself as able to prevent the bloodshed only by framing some innocent person and having him executed. Beside this example is placed another in which a pilot whose aeroplane is about to crash is deciding whether to steer from a more to a less inhabited area. To make the parallel as close as possible it may rather be supposed that he is the driver of a runaway tram which he can only steer from one narrow track on to another; five men are working on one track and one man on the other; anyone on the track he enters is bound to be killed. In the case of the riots the mob have five hostages, so that in both the exchange is supposed to be one man’s life for the lives of five.” Philippa Foot

How does this relate to social behaviors and leadership?

The well-connected “disconnected” person doesn’t see, hear, feel or physically interact with most of the people he or she is connected with.  I am simply saying that in relation to the trolley problem the well-connected “disconnected” person doesn’t do anything to change the situation and/or may not even get involved at all.

How does this apply to you?

Have you been watching the political debates?   The common phrase is “the American people want x.”   Leadership is plugged in to what they think “WE THE PEOPLE” want or at least they say that they are but if you look at their behavior they are not connected.  How about at work?  How connected is your bosses boss to you?  What does your leadership know about you or care?  If you look at the top of the chain they believe they are connected with you but really they are disconnected.   The result of this behavior and this situation is that they don’t care.  I am not saying this to be hostile, it is simply the truth.  You are either a series of numbers or letters to them.  Part of this connected disconnect is disenabling.   This also shows itself with immediate leadership buried in their emails, power point briefs, slide builds or meetings.   They are working on the next big problem or challenge fully consumed in whatever it is but they are disconnected from you.    The true result of this disconnect is that they trolley problem winds up being not just a problem from the five or the one individually but the six holistically.  In other words, the result of being disconnected is that everyone suffers.

Declining leadership is a direct result of being disconnected.   Meaningless trivial meetings take place where most people leave frustrated.   Even good leaders feel disenchanted and powerless.   (Oh, Howie you are just exaggerating.) Really?  If any of what I said is familiar to you, I must be onto something.   Don’t get me wrong, bad leadership has been around since there have been leaders but what I am talking about here is something more than that.  Essentially because we are so very disconnected, the boundaries of unethical and immoral behavior are widening.    There is an increase in how people care about or feel about one another because they aren’t interacting.   In the Bruce Willis movie Surrogates people weren’t leaving their homes and sending out robots as physical avatars.   What I am talking about is actually worse than that because we aren’t even in a situation where avatars are physically representing what we are feeling or saying.   This is a text-based problem.   Intent and context does not convey without additional elaboration.  Passion and inflection do not convey unless the writer is a master of words.   Even then it is the reader’s internal voice that delivers the messages.    Leadership is declining through this communicative failure and breakdown.

What can you do about it?

I think we have to lead from where we are.  In other words, we must individually take responsibility and take on the additional role of leader.  When given a chance to interact with each other physically, we need to take this opportunity to lead and understand when to follow.   We need to take the opportunities we have when we have them to interact and study the people we work with.  We should try to learn more about who they are and pay attention to the details.  While Dunbar’s number suggests that we can manage about 150 relationships we have easily exceeded this number with Facebook, Linkedin, Myspace, yourSpace, etc.   We need to clearly take into consideration the relationships that we can add the most positive value in and actively participate as best we can.

It is our individual responsibility to do good in the world.


Cloud Computing for Lawyers

CASE for Consideration

**DISCLAIMER**   Various sources cited where possible.

Background:

Small law firm with legacy information technology requires reasonable operational analysis in order to increase the functional, operational capabilities and flexible mobility.

Problem:(Initial question)

What is an easy way to synchronize calendar events from Novell Groupwise without having to re-sync with OE, Palm and Apple?

High Level Analysis: (The unintended question)

How can I work more effectively, efficiently saving me time, money and frustration, lowering my total cost of ownership, lowering my investment in resources including software, hardware and energy?

Summary:

Push the easy button.  Here are some high level areas of consideration with some cost analysis.

  • Flexibility
  • Security
  • Easy of Use
  • Cost Effective

Suggested Approach:

Lawyers need access to information but they have an additional responsibility to take great care of the information and services they use.  November 2011, North Carolina addressed ethics of cloud computing noted (http://virtuallawpractice.org/2011/11/new-version-of-nc-saas-ethics-opinion/#more-2087) which has a proposed opinion that states “…a law firm may use SaaS if reasonable care is taken to minimize the risks of inadvertent disclosure of confidential information and to protect the security of client information and client files. A lawyer must fulfill the duties to protect confidential client information and to safeguard client files by applying the same diligence and competency to manage the risks of SaaS that the lawyer is required to apply when representing clients.”  Additonally, Ethics Virginia State Bar Council James M. McCauley (http://www.vsb.org/docs/valawyermagazine/vl0211_consultus.pdf) published an article on a balanced approach to cloud computing.

Moving resources to the cloud is a viable option as long as there is reasonable care taken to protect client information.  Most of the resources available are either a low or no cost technical solution.  This will lower your requirements for on site software and hardware.  With a more detailed analysis of requirements, we may be able to not only decrease your maintenance requirements but your daily operational costs.  In consideration of general requirements for a law practice based on research of common use I have put together a generic but customizable solution set.  Functional areas of consideration are

  • Email with access at every computer and mobile device.
  • Document synchronization including access at every computer and mobile device.
  • Calendar integration and synchronization including every computer and mobile device.
  • Document sharing using collaboration capabilities including the ability to work on or collaborate one document by multiple users.
  • Consideration for security of client information.
  • Functional office suite including document creation, presentation, spreadsheet and drawing capabilities.

Google Apps for Lawyers

Google Premier Apps consists of:

  • Gmail includes email, IM, voice and video chat, and syncs with Outlook and Blackberry.
  • The calendar is integrated with your gmail system, can be shared through the groups function and syncs with Blackberry.
  • Documents includes spreadsheets, drawings and presentations and are easily shared for collaboration.
  • Google Sites is an easy way to create secure web pages for intranets and team projects. No coding or HTML is required.
  • Google Groups can be used as mailing lists and to share calendars, docs, sites, and videos easily with co-workers.
  • Google hosts your videos, creating an channel for your business that can be used either through your intranet or shared on the web.

Here are the highlights of Google’s security policies:

  • Google adheres to the United States Safe Harbor Privacy Principles of Notice, Choice, Onward Transfer, Security, Data Integrity, Access and Enforcement, and is registered with the U.S. Department of Commerce’s Safe Harbor Program.
  • Google has obtained a SAS 70 Type II attestation and will continue to seek similar attestation for the Google Apps messaging and collaboration products as well as for our security and compliance products, powered by Postini. A SAS 70 audit is an independent assessment by an outside audit firm that validates the subject company’s adherence to its defined controls and confirms that these controls are operating effectively. When complete, the audit firm provides a report that details the company’s compliance with these controls.
  • Google will not share data with others except as noted in the Google Privacy Policy.
  • Google provides capabilities for customers to take data with them if they choose to use external services in conjunction with Google Apps or stop using Google services altogether.
  • Some user data, such as email messages and documents, are scanned and indexed so users within a customer’s domain can search for information in their own Google Apps accounts.
  • Email is scanned so Google can perform spam filtering and virus detection.
  • Email is scanned so Google can display contextually relevant advertising in some circumstances.
  • Except when users choose to publish information publicly, Google Apps data is not part of the general google.com index.

Google offers these additional customized security controls:

  • Single Sign-On (SSO) service to customers with Premier, Education, and Partner Editions. Google Apps has a SAML-based SSO API that administrators can integrate into their LDAP, or other SSO system. This feature allows administrators to utilize the authentication mechanism of their choice, such as certificates, hardware tokens, biometrics, and other options.
  • Administrators can set password length requirements for their domain users and view password strength indicators that help identify passwords that meet the length requirement but may still not be strong enough.
  • Administrators can reset a user’s sign-in cookies to help prevent unauthorized access to their account. This will log out that user from all current web browser sessions and require new authentication the next time that user tries to access Google Apps. Combined with the existing ability for administrators to reset user passwords, this feature to reset users’ sign-in cookies improves security in the cloud in case of device theft or loss.
  • Google Apps Premier and Education Editions offer domain administrators the ability to force all users in their domain to use Hypertext Transfer Protocol Secure (HTTPS) for services such as Gmail, Docs, Calendar, Sites, etc. Information sent via HTTPS is encrypted from the time it leaves Google until it is received by the recipients’ computer.
  • With policy-enforced Transfer Layer Security (TLS) for Simple Mail Transfer Protocol (SMTP), administrators can set up policies designed for securely sending and receiving mail between specific domains. For example, an administrator could specify that all external mail sent by their accounting team members to their bank must be secured with TLS — or deferred if TLS is not possible. Similarly, an administrator could mandate a secure TLS connection between their domain and their outside legal counsel, auditors, or any other partners with whom employees may trade sensitive communications

While the security measures offered by Google are significant, there are still two issues of concern that remain. First, Google operates on a multi-tenant cloud platform, which means that your data resides on shared server space with any other Google cloud users. While this is a fairly common practice among cloud vendors, it is not the configuration of choice  for lawyers trying to control their data, even if off-premises. It is better to choose a vendor who stores each customer’s data on a single server.
More importantly, Google will not reveal (to you and presumably anyone else) the geographic location of your data, and it can be transferred from one server to another at any time. This gives rise to jurisdictional issues, since the site where data is located when a cause of action arises may be difficult to determine.  It also renders your data subject to the laws and regulations of the geographic location of your data, which vary Since Google has servers around the world, this could be problematic should a breach ever occur.

Why should a law firm use Google Apps?

  • It’s free for firms with 10 users or less.
  • Costs just $50/user/year for firms with more than 10 users.
  • Filters virtually all spam email.
  • Allows you to share and sync documents with your partners, assistants, paralegals, and secretaries.
  • Allows you to use Outlook or Gmail.
  • Attorneys can choose between which platform they prefer.
  • Works great with other devises: multiple computers, smart phones, iPads, tablets, netbooks, Chromebooks, etc.

The clouds are not reading your e-mail

Read the privacy policy of any cloud-based service you do business with. If you are using a free service, their computers may scan e-mail for the purpose of inserting ads. This does not mean anyone is reading your e-mail.
Instead, you will find that most SaaS providers go to great lengths to ensure your data remains private and secure. Google’s privacy policy for Gmail is a good example.
The difference between free services and paid services is usually advertising. If you buy a premium Google Apps account or you pay for a hosted Exchange server, your provider will not scan your e-mail to insert advertising. They probably will still scan your e-mail and (calendar and other items) so you can search for things, later.

Inadvertent disclosure does not waive the attorney-client privilege

Only the client can waive the attorney-client privilege, although they can do so through carelessness. If using a cloud-based e-mail service is enough to waive the privilege, then many clients have already done so. But at least one New Jersey court did not bring up this possibilitywhen finding that the attorney-client privilege protected a client’s Yahoo! Mail account, even when she accessed it on her employer’s computer.
It seems unlikely that a data breach at your SaaS provider would mean your attorney-client communications must be revealed to opposing counsel.
Although suspicion prevails, talk to your IT provider and your local ethics board before deciding whether or not you are comfortable using the cloud for your client-related data.

Cloud at a tipping point

Microsoft has at last put its shoulder behind the cloud computing movement with the recent beta release of Office365.  It joins the heavyweight Google in this fast growing market. Cloud computing is here to stay.
In this article we put forward three compelling reasons why law firms should be taking the cloud seriously: saving money, improving collaboration and the emergence of cloud enterprise applications specific to the legal market.
Despite these compelling reasons, law firms are still nervous about going cloud.  Concerns about compliance, security and integration are barriers to adoption. However, providers such as Google are actively targeting these issues and the barriers are slowly coming down, pointing to a pending IT revolution, poised at the tipping point.

Reason #1: save money while improving email

Email is without doubt an essential business tool, encompassing email messaging, calendaring and personal contact management.  Providing a fast, accessible, safe and user friendly email service is arguably the most important task of any law firm’s IT department.  This is not as easily done as it might seem; lots of time, money and sleep is lost by CIO’s delivering a seamless email experience to their users.  Let’s look at two very different approaches to providing this service, through two fictional case studies – TradFirm and Cloudy & Partners.

TradFirm’s sprawling email ecosystem

TradFirm established itself in the early 00s and now has 30 partners and 60 support staff, across two cities.  TradFirm is typical of many law firms when it comes to email, using on-site servers which it keeps in a data room at their head office.  Over the years, TradFirm’s IT team has diligently added new services and infrastructure to support them, with full funding from the partnership.

  • The email server machines are replaced every three years; they need to be, with the increasing amount of data and traffic they need to manage.  In addition to hardware upgrades, the server software is upgraded too, itself a significant project.
  • Each computer has Outlook installed, which employees use for managing email.  They’re using Outlook 2003 and are planning to upgrade to 2010 but have not managed to do this yet.
  • For remote access, IT provides Web Access (hosted on another server) and access via VPN; but users must use the company laptop – other PCs are not supported.
  • The amount of data they manage for email is best kept on a Storage Area Network. This is a large storage device which provides the best level of performance and redundancy.  They are expensive and require specialist skills to maintain.
  • As 90% of email traffic is junk, they subscribe to a spam filter service which removes suspect email.  This is an annual subscription, paid on a per user basis.
  • Senior lawyers have started to use their own smartphones and iPads, demanding the ability to use them to access their corporate data; forcing IT to install a separate server to provide this.
  • In the event of a disaster – fire, flood, etc – email data is backed up each night (by a separate backup server) and stored elsewhere by a specialist storage company, which comes each day to collect tapes.  There is a monthly fee for this service, plus they pay rental space for a special remote site which can be activated in the event of a disaster.
  • As well as disaster recovery, they also have strict SLA’s agreed with the partnership. Email must be available for 98% of the time month by month.  IT met the challenge by “clustering”, which means providing two servers instead of one. If one dies, the other takes over.  This doubles the number of servers IT manages to provide email.

TradFirm’s IT department maintain a lot of hardware in the background to support email.  As well as the specialist software, each server has an operating system which must be maintained – regular software updates (or patching) takes a considerable amount of time each month and causes frequent service disruption, scheduled for out of business hours.
Despite the complexity, the email service performs excellently and is well maintained but like other similar sized organisations it costs hundreds of dollars per user to deliver it.

Late last year, 25 partners from various law firms defected from where they were and started their own practice, Cloudy & Partners.  They’re based across 5 cities with support of 30 permanent staff. They chose to outsource some business processes such as recruitment and bookkeeping.  Cloudy & Partners considers itself a “disruptive” law firm aiming to provide fixed price or lower-cost legal services to clients. A strategic focus is to drive value from all their non-billing departments to keep their overheads down.
The IT Manager looked at providing an email service in the same way as TradFirm but her budget was simply not big enough. Realising the firm needed to investigate other options, she eventually chose to Go Google.
Google provides an email service via ‘the cloud’ as part of the Google Apps suite.  For a fixed fee per user per year ($50 USD), Cloudy & Partner’s corporate emails are stored on Google’s servers and accessed over the Internet (or via Outlook).

  • They were able to import data the partners brought with them – a collection of Outlook PSTs, Lotus Notes email files, contact lists and documents.
  • The IT team does not need to manage any email infrastructure – no backups, no spam filters, no clustering, no storage and no mobile servers – all of these email ‘add-ons’ are included.
  • Users can access their corporate data using an internet browser (such as Internet Explorer, Chrome and Firefox) from the office, at home, or on secondment at a client. No VPN is required, just a connection online.
  • The firm can enable a “bring your own technology” policy – any mobile device, PC or Mac, are all supported

Reason #2: new, better ways to collaborate

Attachments = copies, extra work and wasted time

Lindsey works in Business Development at TradFirm and has been tasked with creating a proposal for a valued client.  She puts together the first draft and sends it to the two partners who manage the client relationship, as well as two support staff. They get the document as an attachment and are asked to provide comment.  Three of the four make edits and send it back.
Lindsey has to combine the three edits in Word – not an easy task.  On sending the revised version 2 of the proposal, the partner who failed to reply to the first email has questions about the differences between the two versions and Lindsey feels frustrated at having to firstly combine the edits and now having to check many versions to find out which revision happened when and by whom.

Work on the document together, not your own copy of it

Meanwhile, over at Cloudy & Partners, they need to quickly create job descriptions for a bunch of paralegals they are urgently recruiting to work on a large litigation case.  The matter partner’s PA, Alison, creates a draft job description using Google Docs. When she has finished, she shares it with the partner.
After editing, the partner shares the document further – opening it to the billing solicitor and the head of litigation support.  Each of these make edits, even at the same time (see the screenshot).
While everyone is editing this, Alison is briefing Jeff, the recruiter at the external recruitment company.  As soon as the document is finished, Alison can share the job description with him even though he is not Cloudy & Partners employee.  Jeff is also able to view the complete document history to see who changed what and when, giving him an idea of the evolution of the key skills he should be looking for when interviewing candidates.
Alison also sets up a Google spreadsheet, sharing with Jeff and the group. This is where they’ll keep track of applicants and their relative statuses.  They use one spreadsheet, centrally stored in the cloud, securely shared inside and outside of Cloudy & Partners and which everyone can update as the recruitment process happens.

Even more collaboration apps included with the cloud

The IT department at Cloudy & Partners has a suite of applications which they can call upon to tackle problems that their lawyers bring to them:

  • “We need to communicate better when working from home and with colleagues interstate” – instant messaging, voice and video chat, through Google Talk
  • “The client wants a central store of matter information where we can upload documents, share a calendar and create task lists” – create a website easily using Google Sites
  • “Where can I store these CLE training videos?” – try Google Video for Business
  • “We’re thinking of opening an office in Singapore. What will the cost be to provide email and how quick can you set it up?” – the cost of computers plus $50 USD per user, per year; if we really tried, this can be set up in one day.

For TradFirm to tackle the same issues, they will undoubtedly need to buy more hardware and/or software, embark on a full IT project, or outsource just that particular slice of functionality to a third party; certainly costing more than $50 USD per user.

Reason #3: A growing enterprise app store

Google enables software companies to create their own applications which interact with Cloudy & Partners’ data.  Clio and Rocket Matter are two examples of this, specifically targeted at the Legal sector – practice management software which hooks into corporate data stored with Google.
There are highly effective CRM, finance and HR applications available too, all provided on the same cost basis – an annual user fee – with no hardware or data on site for the Cloudy & Partners IT team to manage.
As more and more businesses Go Google (over 3,000 sign up each day), software providers will be increasingly attracted to develop for the platform, meaning firms will be able to find software which fits their needs closely.

Barriers to law firm cloud adoption

TradFirm, whilst recognising the benefits of cloud, chooses to remain firmly on premises, citing these issues:

  • Existing system integration – TradFirm uses a document management system, voicemail delivery in email and digital dictation software – all of which interact with Outlook and send/receive/store email. Integrating these with a cloud provider like Google would be an expensive task in terms of change management and dollars.
  • Security concerns –  How safe is our data, who owns it and how can we be certain that nobody else can access our intellectual property?
  • Loss of control – If TradFirm’s email servers start performing badly or drop out of service, there is something that they can do about it, instantly.  With the cloud model, you are at the whim of the provider with the only respite being to log service calls.
  • Australian Privacy Law.  Recent changes mean that all Australian organisations transferring personal information overseas must ensure that this information is given the same protection as that provided under Australia’s privacy framework.  TradFirm does not want to risk being held liable for a cloud provider’s negligence or incompetence, should data be compromised in an offshore data centre.

Are these barriers enough to stem the tide?

Google provides answers to the security and data ownership concerns, which are outlined on this blog post. Google operates a 99.9% SLA, with severe financial penalties for them should they miss this target – 2009 and 2010 uptime was 99.91% and 99.98% respectively.  Performance problems have not surfaced despite over 3 million businesses using the service for their corporate email.

Google Apps and now Office365  are changing the IT industry.  Just as you don’t keep a water tank in your garage for that moment when you need a bath, why should your firm maintain processing and storage capacity for 2,000 users when you only need to serve 150?  IT services are becoming a utility, just like water. Turn the tap, there’s your email account.

The barriers to moving cloud reflect nervousness, rather than fact – ‘what if’ rather than ‘because’.  We’re all waiting for one or two more high profile case studies before we follow.  Firms that go first will realise savings year upon year of more than 40% on the cost of providing email.  They would also improve collaboration within the firm and between their clients and suppliers – strengthening relationships.
Are you ready to fly to the cloud?

Further reading

Bradford & Barthel Press Release, ILTA Innovation Award 2010 for Google Apps deployment – linkSocialmind blog post – “Cloud storage and privacy – the dark side of the silver lining” – link
“Google Apps & Microsoft Exchange 2007 – Total Cost of Ownership Analysis (Radicati Group, Inc) – link
How Google Apps improves productivity – “Measuring the Total Economic Impact of Google Apps”, Forrester – link
Google Enterprise Blog – Getting Gmail to 99.99% – link

Moving from Groupwise to Google Apps

http://www.google.com/enterprise/marketplace/viewListing?productListingId=6216+3995015356859345455
http://www.monashores.net/districtoffices/Educational_Technology/googleappsgmailcalendar/

Free Migration Tools:

http://shuttlecloud.com/ – Apparently temporarily free.

Common Cloud Services for Cloud Computing Law Services

Time, Billing and Invoicing
These products use cloud computing to help streamline the billing function, so the lawyer operating on a billable-hour basis is not spending a significant amount of time logging work for each client. The collections process is tied into the time and billing component of these tools, with most of them also offering a web-based invoicing system. Clio and Rocket- Matter, discussed in a later section, also offer time and billing features.
■ Bill4Time (www.bill4time.com) provides time and expense tracking, billing services at both hourly and flat fee rates, invoicing, trust accounting, and integration with QuickBooks. For one user and three clients, the service is free; most lawyers will want to go for the Lite ($15.99 per month) or Professional ($29.99 per month) editions, which offer many more features.
■ Chrometa (http://app.chrometa.com) automatically captures and categorizes your time. There are three pricing tiers. Basic includes two months of data for two devices for $19 per month, Basic Plus includes one year of data for three devices for $29 per month, and Premium includes unlimited data for four devices for $49 per month.
Electronic Signatures
Electronic signatures save time for both the lawyer and his or her clients. These products provide secure, web-based electronic signatures and in some cases will store signed documents online for access by both parties. Features typically include common file format support, biometric and webcam photo authentication and document archiving.
■ RightSignature (www.rightsignature.com) provides 256-bit SSL encryption and Amazon Web Services to ensure privacy of data. Pricing starts at $14 per month for unlimited documents, a premium feature set, one reusable template and one sender. Small group pricing is $49 per month for unlimited documents, a premium feature set, 10 reusable templates, five senders and branded email and logo.
■ DocuSign (www.docusign.com) is an electronic signature service that offers mobile device signing options (for iPhone and iPad), custom storage folder structures, collaboration with third parties to add and edit documents, user and group management, workflows and templates, transaction control and firm-branded envelopes. You can try DocuSign for free, and plans are available at $19.99 and $24.99 per month.
Case and Client Management
Case and client management has become one of the most popular cloud offerings due to its broad use for all different forms of law practice, from solos to larger law firms. These products provide features such as document storage, calendaring and searchable client file organization, which the law firm can access from anywhere. One appealing feature of these tools is the ability to organize all of the firm’s client and case matters into a single web-based system that can be more easily searched and accessible than traditional paper filing systems.
■ Advologix PM (www.advologix.com) includes group calendaring, docket and activity management, client management and marketing, project and matter management, time and billing, document management, account management, mobile access workflow, customization and integration features. It costs $90 per month per user, and $75 per month for each additional user up to 5 users.
■ Clio (www.goclio.com/) offers a dashboard where you can see your upcoming tasks and schedule at a glance. Users can monitor billing targets, link tasks to specific matters, bill time directly from tasks, and run billing, productivity and client reports. It includes a “client connect” feature for sharing documents with clients online as well as online invoicing and bill payment. There is a 30-day free trial and attorney users pay $49 per month after the trial period.
■ LawRD (www.lawrd.com) provides a practice management system with features including management reports, time tracking, matter management, contact management, a billing sheets generator and more. A 30-day free trial is available. After that, it costs $19 per month per user.
■ Rocket Matter (www.rocketmatter.com)  is a web-based time and practice management product that includes calendaring, expense, time and task tracking, invoicing, batch billing, matter-based ledgering, phone messaging, a time-tracking timer, Skype integration, mobile access, contact management, documents and notes, tagging, reports, conflict checking and more. You’ll pay $59.99 per month for the first user, with a decreasing pricing model for each additional user.
Document Management
Online document management services allow you to access files and documents from any computer with an Internet connection, as well as share them with clients, team members and others.
■ DropBox (www.dropbox.com) installs a simple folder on all of your computers; then just move your files into that folder, and they are nearly instantly synched to a cloud location. Dropbox offers 2GB of free storage, and then charges $10 per month for 50GB and $20 per month for 100GB of storage. Note: At press time, the authors cannot recommend Dropbox for storage of confidential documents, due to encryption issues. But it is the best online document manager for nonconfidential records.
■ Box.net (www.box.net), like Dropbox, provides tools to manage users, security and permissions, for rolling documents out to a larger group of employees. It offers 5GB for free, and then $10 per month for 25GB and $20 per month for 50GB. Business and plans start at $15 per user per month for 500GB of space.
■ NetDocuments (www.netdocuments.com) allows you to create your entire folder structure in the cloud. All your files are completely searchable online, and you can easily import email from Outlook into your account. NetDocuments also provides a records management function to automate the retention periods of certain types of documents. There are three levels of pricing: Basic ($20 per user per month), Professional ($30 per user per month), and Professional+ ($38 per user per month). All start with 10GB base storage.
■ Worldox (www.worldox.com), best known for its standalone software product, now offers Complete Cloud, which provides the same Worldox document management service, but with no software to install or upgrade, or servers to purchase. Call for pricing information.
Virtual Law Office Services
These services facilitate the online delivery of legal services and include the use of secure client portals to provide clients with the ability to work with their lawyer online. They combine web-based case and client management products with time, billing and document management and other law office management features, including form libraries, law libraries, calendaring, invoicing, document assembly and automation features, and online client intake procedures, among other features.
■ DirectLaw (www.directlaw.com) provides a secure online client portal with a self-service interface, encrypted attorney-client communications that are time and date stamped in threaded archives, plus calendaring and file storage with upload and download functions. It also includes a web-enabled document automation function and libraries of state-specific documents, legal invoicing and online credit card payment for legal fees. Introductory pricing is available for solo start-ups and new lawyers. Visit the website for pricing details on the DirectLaw Basic, DirectLaw PayGo and DirectLaw Complete services.
■ Total Attorneys (www.totalattorneys.com) provides a secure client portal, online collaboration, document storage and sharing, case and client management tools, online invoicing and bill payment capability, calendaring, conflict of interest checks, jurisdiction checks, trust accounting compliance and data backups, among other features. Pricing for lawyers starts at $50 per month with other pricing based on the number of users.
Project Management
More and more, lawyers are recognizing that project management skills are important to the practice of law. After all, managing a case or a transaction is similar to managing a business project; there are specific tasks, milestones and resources to be assigned to each task. The following provide all of those features, as well as discussion forums, chat rooms and even wikis for collaboration. Some also include practice management tools such as time entry, billing and calendaring.
■ Basecamp (www.basecamphq.com) is one of the pioneers of online project management. Basecamp has all the basic features—message boards, file storage and collaboration, task lists and time tracking, and a number of project templates that can jumpstart your project initiation. Pricing is $49 per month for 35 projects and 15GB of storage space, $99 per month for 100 projects and 30GB of storage, or $149 per month for unlimited projects and 75GB of storage.
■ Onit (www.onit.com), new to the legal project management scene, is designed for lawyers, firms and even corporate legal departments that have to manage multiple projects. The basic version is free. Corporate law departments can subscribe to the new Onit Premium for a monthly fee. Call for pricing information.
■ PBWorks (www.pbworks.com) offers project workspaces that are clean and easy to use. You can choose to be notified when any change to documents, pages or task status occurs. Call for pricing information.
■ Zoho Projects (www.zoho.com/projects) offers an interesting project management tool. The free version gives you one project, with 10MB of storage space. Check out the different value packs ($99, $199 and $699 a year, respectively) to see which option best fits your needs.
Online Document Storage and Backup
It should be noted that online backup and online document management are not the same thing; online backup is designed for business continuity and disaster recovery purposes, either as a primary backup or as a redundant backup for some other backup source. These services encrypt your data and typically back up incrementally, only backing up those files that are new or changed.
■ Mozy (www.mozy.com), one of the first online backup services, is still a strong choice. The company offers a Home version ($5.99 per month for 50GB, $9.99 per month for 125GB) and a Pro edition (per user pricing ranges from $3.95 +$.50 per GB per month) that provides network and server support for larger firms. The new Mozy 2xProtect will also create a local backup to an external drive, providing true redundant backup.
■ Carbonite (www.carbonite.com) is another popular choice for online backup. You can try it for 15 days for free without even giving a credit card. If you decide to purchase it, you pay a flat rate starting at $54.95 per year per computer with unlimited data storage.
Remote Access
Many of you no doubt already use a remote access tool to log in to your work computers. If so, then you are already using a cloud computing service. These applications make it simple for lawyers to have constant access to not only important work and client files, but also to software applications that may not be installed on a firm laptop or home computer.
■ GoToMyPC (www.gotomypc.com) transfers documents between computers, prints to the computer you are working on or the one being accessed, allows for full displays of your computers if you have multiple monitors, and prevents others from viewing your computer’s monitor while you are remotely connected. For one user, the price is $99 per year. The Pro version starts at $198 per year for two computers, and goes up from there. Corporate pricing is also available.
■ LogMeIn (www.logmein.com) essentially offers the same features as GoToMyPC, but also allows you to access your computer via an iPhone or iPad. A single-user version is always free and, while it is not as full-featured as the Pro edition, it provides good basic remote access. A Pro account starts at $69.95 per computer with discounts available as the number of computers increases.
■ Legal Workspace (www.legal-workspace.com) is designed specifically for the legal profession. It serves as an Internet-hosted IT environment and offers more than simple desktop sharing. Lawyers can access all of their software and services online, without having the software installed on local computers. It provides access to Amicus Attorney, Timeslips, QuickBooks, Worldox, Microsoft Office and Trend Micro antivirus tools. With these tools, you can essentially run your entire practice on the Internet. Call for pricing information.
Encrypted Email and Document Exchange
These services offer secure messaging and document exchange, for when you need to ensure that communications with your clients or others are encrypted and safe from prying eyes.
■ Dialawg (www.dialawg.com) provides encrypted communications specifically for attorneys. Files and messages are sent over an encrypted SSL channel. All data is encrypted and stored in Dialawg’s private network, and recipients can view the files or messages securely via the web, Outlook, an iPhone or other device. The basic service is free, with messages costing $.20 per recipient. Bronze, Silver and Gold levels range from $3 to $48 per month.
■ RPost (www.rpost.com) provides a registered email service with encrypted delivery of email and compliance with HIPAA, FSA and other privacy regulations. Services include registered email, electronic signatures and email encryption with document archiving. Pricing ranges from $79 per month for 100 units per month to $9,750 per month for 25,000 units per month.
■ ZixCorp (www.zixencryption.com) will send an encrypted email directly into a recipient’s inbox as an HTML attachment within a plain-text email. Users click on the email attachment and enter a password, after which the message is decrypted in an Internet browser. Stored messages are encrypted. Call for pricing information.

■ SpiderOak (http://spideroak.com) Encrypted document sharing.

 


The Missing Billet in Government

I was going to start my post by blogging about my experience, you know.. “I have been doing this for x years” but, I am thinking as I type this that I am not going to do that.  I had a lot of thoughts this week, as I have started a new job and I have been flooded with ideas and new tasking.   I think about relationships between nodes and the trace ability of the relationships contextually.  I was considering first a discussion about risks but then I started thinking about costs associated with people not listening to others. Which leads me back to an open-ended concept that I feel has not been addressed enough in the DoD  but could apply to any government agency  or business which is the psychological aspect of labor.

Joint Forces was closing and the transition team was working on understanding the functional capabilities and requirements that needed to persist to support the various combatant commands, services and agencies.   Meetings were held infrequently to update the status concerning what functions were critical.  Essentially this equated to who shall stay and who shall go.

We didn’t know when the meetings were going to happen and everything we heard for the most part was rumor or speculation.   There was a time that some even questioned the integrity of the General in charge of JFCOM.  After all he must have known more than he was saying.  The demeanor of the crowd started to change and the work and started to slow down.  It wasn’t long before people started to leave the job out of fear.  The General in charge of our section told us that he would tell us everything he knew except when he felt he couldn’t.   In other words, we were never going to get the whole story.

This behavior continued for a year.  It took an emotional and physical toll on many.  People were concerned about their jobs, their lives and families.   Every week or two there were goodbye lunches and lots of tears.   The halls were filled with depression and accusation and blame were prevalent on the lips of many.

As a society we know of PTSD and we understand the damage that it can do to our soldiers.  Consistent lack of leadership and concern for the human condition can have the same effect on people.  People that have worked in the same place for years that have a passion for their jobs, losing them in an instant.  Others watching these people leave knowing that they will be next.   I once asked the General how people are supposed to act as they effectively dig their own career graves, he simply replied ” I don’t like the sound of that.”

I don’t think that this kind of situation is limited in the DoD to just one area.  I also don’t think it is limited to contractors.   I think it is pervasive throughout the department.  There is a clear need for the Industrial Psychologist perspective.   How do the actions or lack of action affect the team?  What impact does it have on the work?  What impact does it have on the War-fighter?   What behaviors exist that can be modified to help limit the risks for people?

I think this is THE missing billet.


Community Manager Forge

Community Manager for Forge.Mil

 

Up until the end of this week I worked for Booz Allen Hamilton titled as a Senior Defense Researcher.    The title was fairly generic allowing for me as a consultant / coach to help in a lot of areas.   Some in the technology industry don’t have any problem answering the question regarding what they do for a living, historically speaking I have.

 

Tomorrow is the first day working for my new job as a Community Manager for Department of Defense, Defense Information Systems Agency’s software development, community and collaboration platform called Forge.

 

Forge.Mil is cloud oriented (Software as a Service) technical offering that has a great deal of features and functional capabilities.  These include

 

  • Source code and configuration management
  • Track defects, requirements, and feature requests
  • Task hierarchy and alert mechanism
  • Collect, archive, and release packages
  • Real-time reports on tasks and trackers
  • Discussion Forums
  • Project-based Wiki
  • Document Management

 

There is a social aspect to Forge called Forge Community, which augments the technical aspects by integrating a “people to people” framework in support of the user community.

This enables the community to

 

  • Connect with other Forge.mil users
    • Find Software and Projects
    • Discover and join sub-communities or Groups
    • Improve Collaboration
    • Share Ideas or find Ideas to act on
    • Share Knowledge, Experience and Lessons Learned
    • Find Answer and Solutions
    • Expand the Discussions and Cast a Wider Net to Find an Answer

 

My job is to help enable community members, examine technical and non-technical concepts ultimately to enhance the speed and ease of technical projects in the department.

 

As I determine what information I can share based on the nature of the work, I will post from time to time anything that I believe is relevant to the greater public.  For now, I am excited to take on this new challenge and it is my intent to help our defense community work effectively and efficiently to accomplish their individual goals and objectives.


CY83r 83H4v10r

A few days ago Applidium a mobile application company provided the world some insight on how to essentially hack Siri.  Cloud computing as an approach has certain characteristics and patterns from a development or managerial perspective but in consideration of the physical and logical disposition of technical resources most of us if not all of us are already in the cloud.   Lets look today at two examples for consideration, the first is Siri.   Siri is a cloud service, the application is intended to serve a certain community although due to the broad spectrum of users the application must be exposed to the public.   The model of authentication or security is tied to a unique identifier.  Applidium goes into detail on this process and I for the purpose of this discussion I am republishing this here.  This information is freely available on the Applidium website.

Cracking Siri

On October 14, 2011, Apple introduced the new iPhone 4S. One of its major new features was Siri, a personal assistant application. Siri uses a natural language processing technology to interact with the user.

Interestingly, Apple explained that Siri works by sending data to a remote server (that’s probably why Siri only works over 3G or WiFi). As soon as we could put our hands on the new iPhone 4S, we decided to have a sneak peek at how it really works.

Today, we managed to crack open Siri’s protocol. As a result, we are able to use Siri’s recognition engine from any device. Yes, that means anyone could now write an Android app that uses the real Siri! Or use Siri on an iPad! And we’re goign to share this know-how with you.

Demo

The best demo probably is Siri’s speech-to-text feature. We made a simple recording of us saying “Applidium vous souhaite une bonne journé”, and got a perfect result !

Sample_Siri_speech_to_text.zip

70.78 KoDownload

This sound sample never went through any iPhone, but nonetheless we got Siri to analyze it for us.

Understanding the protocol – A brief technical history

At Applidium we’re used to building mobile applications. The best way to chat with a remote server is HTTP, as it’s the protocol that is the more likely to work in any case.

The easiest way to sniff HTTP traffic is to setup a proxy server, configure your iPhone to use it, and look at what goes through the proxy. Surprisingly, when we did, we wouldn’t gather any traffic when using Siri. So we ressorted to using tcpdump on a network gateway, and we realised Siri’s traffic  was TCP, on port 443, to a server at 17.174.4.4.

Going to https://17.174.4.4/ on a desktop machine we noticed that this server was presenting a certificate for guzzoni.apple.com. So it seemed like Siri was communicating with a server named guzzoni.apple.com over HTTPS.

As you know, the “S” in HTTPS stands for “secure” : all traffic between a client and an https server is ciphered. So we couldn’t read it using a sniffer. In that case, the simplest solution is to fake an HTTPSserver, use a fake DNS server, and see what the incoming requests are. Unfortunately, the people behind Siri did things right : they check that guzzoni’s certificate is valid, so you cannot fake it. Well… they did check that it was valid, but thing is, you can add your own “root certificate”, which lets you mark any certificate you want as valid.

So basically all we had to do was to setup a custom SSL certification authority, add it to our iPhone 4S, and use it to sign our very own certificate for a fake “guzzoni.apple.com”. And it worked : Siri was sending commands to your own HTTPS sever! Seems like someone at Apple missed something!

That’s when we realised how Siri’s protocol is opaque. Let’s have a look at a Siri HTTP request. The request’s body is binary (we’ll get into that later), and here are the headers :

            ACE /ace HTTP/1.0
            Host: guzzoni.apple.com
            User-Agent: Assistant(iPhone/iPhone4,1; iPhone OS/5.0/9A334) Ace/1.0
            Content-Length: 2000000000
            X-Ace-Host: 4620a9aa-88f4-4ac1-a49d-e2012910921

A few interesting things :

  • The request is using a custom “ACE” method, instead of a more usual GET.
  • The url requested is “/ace”
  • The Content-Length is nearly 2GB. Which is obviously not conforming to the HTTP standard.
  • X-Ace-host is some form of GUID. After trying with several iPhone 4Ses, it seems to be tied to the actual device (pretty much like an UDID).

Now let’s move on to the body. The body is some raw binary content. When we first looked at it with an hex editor, we noticed it started with 0xAACCEE. Oh, seems like header ! Unfortunately, we couldn’t understand anything of what was after that.

That’s when we took some time to think. As people who are used to designing mobile application, we know there’s one thing which is very important when talking over a network : compression. The bandwidth is often limited, so it’s usually a very good idea to compress your data. And what is the most ubiquitous compression library around ? zlib:“http://zlib.net/”. It’s a very solid library, really efficient and powerful (makes sense, it’s half french!). So we tried to pipe that binary data through zlib. But nothing came out, we were missing a zlib header. That’s when we thought “hmm, so there’s already thisAACCEE header in the request body. Maybe there’s some more ?”. We developers like to keep things packed. 3 bytes is not a good length for a header. 4 would be. So we tried un-zipping after the 4th byte. And it worked!

Now when we unziped the content, we got onto some new binary data. Not very understandable either, but some parts were text. Among them, one caugh our attention : bplist00. Hurray, it seems like the data is some binary plist. After fiddling a little bit with that binary stream, we figured out it was made out of chunks :

  • Chunks starting with 0x020000xxxx are “plist” packets, xxxx being the size of the binary plist data that follows the header.
  • Chunks starting with 0x030000xxxx are “ping” packets, sent by the iPhone to Siri’s servers to keep the connection alive. Here xx is the ping sequence number.
  • Chunks starting with 0x040000xxxx are “pong” packets, sent by Siri’s server as a reply to ping packets. Without surprise, xx is the pong sequence number.

And deciphering the content of binary plists is very easy, you can do it on Mac OS X with the “plutil” command-line tool. Or in ruby with the CFPropertyList gem on any platform.

What we learned

We did really learn a few interesting things about how the iPhone 4S talks to Apple’s servers :

The audio data

The iPhone 4S really sends raw audio data. It’s compressed using the Speex audio codec, which makes sense as it’s a codec specifically tailored for VoIP.

Signature

The iPhone 4S sends identifiers everywhere. So if you want to use Siri on another device, you still need the identifier of at least one iPhone 4S. Of course we’re not publishing ours, but it’s very easy to retrieve one using the tools we’ve written. Of course Apple could blacklist an identifier, but as long as you’re keeping it for personal use, that should be alright!

The actual content

The protocol is actually very, very chatty. Your iPhone sends a tons of things to Apple’s servers. And those servers reply an incredible amount of information. For example, when you’re using text-to-speech, Apple’s server even reply a confidence score and the timestamp of each word.

What’s next ?

Here’s a collection of tools we wrote to help us understand the protocol. They’re written mostly in Ruby (because that’s a wonderfully simple language), some parts are in C and some in Objective-C.

Now What?

Technical resources are created with specific intent and potentially captured and reused for other purpose.   Little history lesson as long as there have been services made available to the public people have been finding ways to re-purpose or use those services without paying.

  • Television
  • Digital Cable
  • Digital Satellite
  • Phone -Phreaking
  • Power -Leeching
  • Water

Most of the time these services were regional or isolated geographically.  People didn’t have as much access to information as they do today.  Just a few days ago hackers took control of a satellite http://www.pakistantoday.com.pk/2011/11/hackers-take-command-of-us-satellites/  or how about the foreigners with the Russian address that damaged a water plant http://www.theverge.com/2011/11/18/2572079/springfield-water-plant-scada-hacked-us-russia at the same time another person got into a system in a Texas plant.

Story after story is the same thing over and again.   In our lifetime, we are never going to stop this behavior.   That is the key to this discussion, this a behavior problem.

Transition ~ L33t H@x0rz http://www.cyberpsychology.com/  http://iconof.com/blog/category/cyberpsychology/

I don’t believe that we can protect the internet.   We can protect technical assets that are disconnected from the network but protecting something connected would be like trying to protect your hand from your brain.  If there is a connection and there is INTENT there will be a result.  People that are curious or driven with unlimited access can and will find ways to access these resources.  What I am suggesting is that we focus on education and identification of behaviors to help work on these challenges.   Recently, I watched the movie Starship Troopers (you know mindless scifi) during the movie the leader Sky Marshal decided to attack the enemy head on.  When the troopers attacked they were overwhelmed by the sheer numbers of enemies.  There was another aspect as well, the enemy was smarter than expected.   Attacking something you don’t understand is not likely to produce a desired result.   At some point the leadership decided that it must understand the enemy to achieve success.   Cyber threats are no different.  We are dealing with thousands of everyday people who have the power of the most up to date and relevant information at their command.   Some of them work together, some of them work alone, some are destructive and some are simply curious or just want to solve a puzzle they are told is unsolvable.

What do you do when the enemy is you?  If we start to pay attention to our culture and recognize or realize our actual connectivity with the global community we can start to find ways to limit our damages.   We are not moving to cloud computing or moving towards a cloud paradigm; as long as we are connected by a logical and physical connection we are IN A CLOUD.   We need to focus on behavior sciences with predictive gaming algorithms to identify the greatest risks based on technological trends, this will help us mitigate the damages that will for certain occur.

1986

http://www.phrack.org/issues.html?issue=7&id=3&mode=txt

File: archives/7/p7_0x03_Hacker's Manifesto_by_The Mentor.txt
                               ==Phrack Inc.==

                    Volume One, Issue 7, Phile 3 of 10

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
The following was written shortly after my arrest...

                       \/\The Conscience of a Hacker/\/

                                      by

                               +++The Mentor+++

                          Written on January 8, 1986
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

        Another one got caught today, it's all over the papers.  "Teenager
Arrested in Computer Crime Scandal", "Hacker Arrested after Bank Tampering"...
        Damn kids.  They're all alike.

        But did you, in your three-piece psychology and 1950's technobrain,
ever take a look behind the eyes of the hacker?  Did you ever wonder what
made him tick, what forces shaped him, what may have molded him?
        I am a hacker, enter my world...
        Mine is a world that begins with school... I'm smarter than most of
the other kids, this crap they teach us bores me...
        Damn underachiever.  They're all alike.

        I'm in junior high or high school.  I've listened to teachers explain
for the fifteenth time how to reduce a fraction.  I understand it.  "No, Ms.
Smith, I didn't show my work.  I did it in my head..."
        Damn kid.  Probably copied it.  They're all alike.

        I made a discovery today.  I found a computer.  Wait a second, this is
cool.  It does what I want it to.  If it makes a mistake, it's because I
screwed it up.  Not because it doesn't like me...
                Or feels threatened by me...
                Or thinks I'm a smart ass...
                Or doesn't like teaching and shouldn't be here...
        Damn kid.  All he does is play games.  They're all alike.

        And then it happened... a door opened to a world... rushing through
the phone line like heroin through an addict's veins, an electronic pulse is
sent out, a refuge from the day-to-day incompetencies is sought... a board is
found.
        "This is it... this is where I belong..."
        I know everyone here... even if I've never met them, never talked to
them, may never hear from them again... I know you all...
        Damn kid.  Tying up the phone line again.  They're all alike...

        You bet your ass we're all alike... we've been spoon-fed baby food at
school when we hungered for steak... the bits of meat that you did let slip
through were pre-chewed and tasteless.  We've been dominated by sadists, or
ignored by the apathetic.  The few that had something to teach found us will-
ing pupils, but those few are like drops of water in the desert.

        This is our world now... the world of the electron and the switch, the
beauty of the baud.  We make use of a service already existing without paying
for what could be dirt-cheap if it wasn't run by profiteering gluttons, and
you call us criminals.  We explore... and you call us criminals.  We seek
after knowledge... and you call us criminals.  We exist without skin color,
without nationality, without religious bias... and you call us criminals.
You build atomic bombs, you wage wars, you murder, cheat, and lie to us
and try to make us believe it's for our own good, yet we're the criminals.

        Yes, I am a criminal.  My crime is that of curiosity.  My crime is
that of judging people by what they say and think, not what they look like.
My crime is that of outsmarting you, something that you will never forgive me
for.

        I am a hacker, and this is my manifesto.  You may stop this individual,
but you can't stop us all... after all, we're all alike.

                               +++The Mentor+++
_______________________________________________________________________________

Follow

Get every new post delivered to your Inbox.

Join 100 other followers