Q1 Review

Miami winning 5-4 in the championship series...but it's close

It's been a busy start to the year beginning with having Swiftbiscuit show me how it's done on the kart circuit - even if he didn't bring is own racing boots, gloves or helmet from Miami. The marshals came up to him afterwards and mentioned their awe of his racing line. Total focus and precision - awesome to try and chase through the corners.

(I've also knocked a couple of seconds of my lap times and made it into the elite class since)

My birthday last month was pleasantly uneventful - although managed to get another kart race in on the weekend - there was one less birthday card this year which forced poignant reminder of the events of Jan and Feb.

Dad didn't tell us until it was too late and even though we knew he was ill, he didn't let on about how much pain he was in until right near the end. That was kind of his way of doing things (i.e. refusing to listen to anyone else). It didn't really sink in that he was beyond the point of no return until I got a call from the care home telling me he'd been taken into hospital.

We'll scatter his ashes in his home county of Cornwall this year so he can enjoy the countryside and coast he came to know as a boy. A lesson to all of us to make sure we take care of ourselves and always keep talking. Every hill is a victory in potentia after all.

There's too much to do on the information assurance front and I've re-focused my efforts significantly. The last two months or so has been flat out - no thanks to laptop problems and a 192 mile round-trip commute. This week should allow me to break the surface again whilst migrating corporate accounts to both a different package and different accountants.

All whilst studying for my CEH & CISSP...

I've made significant progress on the spam front too - from hundreds of spam emails a day down to between 20-100 is a big plus. I spend far less time trawling through nonsense looking for potential business or emails from friends & relatives. It's like whack-a-mole though...you get a domain disabled or an ASA complaint upheld against one and another pops up. Eventually the pattern will become obvious as individuals are already being tracked.

One thing I have noticed quite consistently is the attitude of spammers and their lawyers (with a handful of notable exceptions) - I'm becoming less and less surprised by the lack of knowledge surrounding DPA and PECR, as well as case precedent such as Vidal Hall vs. Google. I'm not suggesting an ambulance chasing model is ideal but it seems like the regulators are being restrained whilst the data traders and spammers are not.

Until the balance is restored however, ProtonMail, EFF and WWF will be getting more donations from me after winning or settling my cases.

Hopefully ICO's GDPR education campaign will keep momentum up as it's vitally important to drag the private sector into the current decade (before it finishes).

Fingers crossed that the EU referendum passes with a Stay / Remain vote and we can all get on with commerce again; as well as a wider, considered approach on privacy and information assurance in future.

Surface Pro 4 vs. Linux

Surface Pro 3 seemed to be stable, relatively efficient and a good mix for a dual boot laptop. Things were pretty good all round and Windows 8.1 Enterprise worked well on the touch-screen led device - probably not a popular statement but it was designed for Surface.

My own belief is that Microsoft didn't enter the laptop market to dominate it but to force the competition to get off their lazy backsides and start thinking again. We've had a stagnated market for over a decade and it's taken the software & keyboard kids to initiate change. Apple has had to improve it's hardware to compete with both Surface Pro & Book; HP and Lenovo have had to reconsider their clamshell laptop propositions too.

Moving beyond a simple single-OS laptop replacement a growing number of penguinistas have noticed the Surface and blogged about supporting it. Personally, I'd gotten to the point with Ubuntu 15.10 on SP3 where I was pretty much using it for everything work-wise - bar Visio and Excel situations, firmware updates for the Microsoft hardware and games or modern apps such as movie streaming or Kodi.
I don't use Windows for email and have my PGP keys available only on non-Windows OS's; all my remote work is done on servers via SSH and I lock drives up with a multi-platform encryption solution. Ubuntu handled all of that and seemed to get the most support for SP3 out of all the Debian-based distros.

Ubuntu didn't really do brilliantly with touch-screen but the stylus was a pretty good mouse replacement (assuming you don't need a right click...). The SP4 stylus was a big improvement on the SP3 variant - and didn't go to sleep at random whilst you were using it.

A big plus. And not generating a BSOD when you attempt to disable power management would have been a bigger plus. Although Windows 10 - in all it's greatness - decided to fail software licensing management services without any bidding on the replacement SP3, meaning I had to deploy W8.1Ent anyway...

Then the connector between the SP3 and the type cover stopped detecting anything - I have Type Cover 3 & 4 so tried both - and with John Lewis' support policies meaning a 3 week period without a laptop whilst they repair it; I was running out of options as I need a laptop to earn money / work on client site.

Perhaps rashly, I elected to buy a Surface Pro 4, take an image of my old SP3 and deploy straight onto the SP4.

I used dd more in the last month than I have in years

Of course - that would be too easy. Microsoft have revoked support for Skylake and a significant portion of hardware drivers for the SP4 from anything but Windows 10.

Dick move Microsoft.

I wasn't prepared to disable the driver signing checks and manually install 100+ drivers. Looking forward another 12 months I would not have thanked myself for the maintenance overhead.

After a lot of research and swearing I gave up. Reset the PC.

Plan B. Good thing I took a backup of the SP4 drive before I started eh? Redeploy the boot partition, the W10 partition and the W10 recovery image (a partition at the back of the drive) and run the re-deployment.

What's this? I can put Debian straight onto the SP4? Skip a few kernel versions and maybe get that Surface Pro driver support OotB? Why mess about with downstream distros like Ubuntu? A big thumbs up to Alexander Clouter who's been persistent enough to plug away at Debian 8 on the SP4.

All went fairly well until the reboot then I discovered a problem where putting the home mount point on a LUKS provided partition seemed to keep taking out the installer. Seemed to get confused, dismount the home partition cryptsetup preventing selection for home.

I tried putting all mount points into one partition and got Debian 8 loaded on it. But as soon as I got further into the configuration (around the kernel rebuild) things started going wrong. Despite long hours of research I couldn't get initramfs or hid_multitouch to deliver the right state prior to kernel build. Although I sorted out the sources I think it just needed someone with more linux experience to resolve the errors when it wandered off Alexanders plan.

More swearing. I used a couple of the old SP3 pens as darts on a dartboard and chucked some kittens in a wood chipper to make myself feel better.

At this point I had to carry the old SP3, a usb keyboard and the stylus on to client site and wasn't happy. I'd got plenty of other things to do (on top of the consultancy work during the day) and paperwork to sort out.

Right - so plan B stuffed. Plan C. This time I already had the partitions set up so just invoked the PC reset / W10 recovery process. W10 set up and updates re-installed I just grabbed the ISO for Ubuntu 16.04 Desktop and plodded through the deployment.

Same issue with the LUKS and separate home mount point - eventually gave up on the idea altogether and created a shared encrypted partition which is usable by W10 and Ubuntu, along with separate partitions for later use.

Thanks to Spideroak it was pretty easy to download and re-deploy all those custom .bashrc and .bash_alias type moments - and Evolution backups that I use to replicate my environment across machines.

Finally Operational

Windows 10 is an utter disappointment. If I'd never seen Windows 8 I would have loved it as it's a great step forward from Windows 7. It makes even more sense when you use it on a touch screen device like a Surface and with the stylus & OneNote the whole thing takes on new meanings in meetings.

However my faith in Windows 10 is gone - 8.1 was a pinnacle in user experience and there's a lot of it's logical workflows that I hope will one day be amalgamated into 10; e.g. VPN - the charms allowed me to select a configured VPN adapter whereas in the W10 right-side menu it opens the control panel VPN settings page - a wholly unnecessary screen jump for an "on/off" operation. For now though it's a step backwards.

W10 also has a recently introduced "undocumented feature" which has touch-screen and stylus stop responding seemingly at random. I'm pretty much steering clear but OneNote, Excel and Visio keep that productivity link - there's nothing that comes close on Linux unfortunately. The majority of my work is done in Linux - Architool, LibreOffice, Evolution and Office365 Enterprise (depending on the client).

Game streaming from an Xbox One though is a huge plus for W10 and the new processor & cooling fan doesn't sound like a helicopter on take-off when the slightest CPU utilisation spike hits. Did I mention that I like it that the SP4 pen doesn't fall asleep at random whilst you're using it?

Security Concerns

After all of the recent nag-malware, privacy issues and Microsoft’s collaboration with various data collection schemes I'm left only with concern that my security and data investigation work would potentially be compromised by continuing to use the ecosystem in any great way.

I've already encountered a swathe of spear phishing attempts using email addresses only available to the subjects of spam hunts or AV firms (more of that another time) and not reading my emails on Windows is good way to cut out 99% of that threat vector. The rest I can deal with via opsec & security solutions on Linux.

Hindsight is a wonderful thing and what I should have done was buy a replacement [new] SP3 i7 and just redeployed the machine image from old to new. Maybe there would have been some software licensing tied to hardware ID's - or perhaps a re-sign of secure boot certificates. But nothing as relentless as the SP4 option or as expensive. It has not proved value for money and I'll not be buying an SP5 unless it's device vendors provide drivers for the open source community.

UK Apollo Group (Updated)

The Claim

The Entire Defence (v1)

I don't blog about cases unless there are exceptional circumstances and this is certainly one of those. Of all my cases this is probably the most ridiculous attitude towards data protection and information assurance I've seen yet.

Over the course of 2015 I've spent a lot of time speaking to people in and around data protection and those who've been taking spammers to task. Within a group of people there are different motivations and slightly differing goals but one key factor is common: Spam fatigue and being fed-up with personal data being sold, re-sold and profited from without any kind of consent or reparation.

If you sign a EULA with Microsoft, Apple, Google and many others and read enough of the small print (yes - I'm one of them, sorry...) you'll discover that you haven't actually bought the Thing in your hand or the Thing installed on your device. You've paid for license to use that Thing on your device. Your use of that Thing can be terminated at any time by the owner - you (the licensee) have rights to use the Thing but you don't actually own it.

In legal terms personal information is not property [yet] and so this doesn't necessarily follow in the literal sense of authorised ownership / resale. However in the terms of an agreement where you license an entity to use your personal information for a given purpose you have the right to withdraw that consent at any time.

Since 2014 I've started using a mechanism which allows me to trace the path of personal data from capture to spam; there are edge cases where data traders may be between the capture point and the spammer but it's up to the spammer whether or not to "'fess up" and disclose those sources. Incidentally, disclose of source is a statutory duty under the Data Protection Act if requested to do so under SAR.

I agreed / licensed the use of my information (arguably a product in itself) to Monster.co.uk for the purposes of finding a job. I'm a contractor and am "client cycling" on a semi-regular basis so use jobsites fairly often. However Monster's own T's and C's - as well as the consent conditions I agreed to - do not allow anyone to acquire this jobseeker profile information for anything other than recruitment for a live job role.

That means you cannot acquire this data arbitrarily on the promise of a future job role being created nor can you scrape this data and monetise it via offering products or services - whether they are relevant or not.

When I started getting spam which used email addresses only added to Monster profiles from Taylor CVs advertising their CV writing & design services it was pretty clear that it wasn't by mutual consent. I spoke to Monster's abuse team and they agreed with me.

After one of the most insane SAR-based email exchanges with them I've ever borne witness too I raised a claim in the courts for their blatant breaches of statutory duty, the DPA and the PECR. It didn't take long to find some really extreme examples of Apollo's persistent offences. In one case one of their representatives posted a very personal email from a complainant to attempt to belittle their criticism of Apollo - not only an abhorrent breach of data protection but a galling breach of privacy.

I wouldn't have considered this course of action (normally some polite emails to ask them to adjust their policies and perhaps a blog post or two to help others dealing with the same situation) but the attitude of some organisations really hacks me off. Had they put their hands up and said "Ok, we did something we shouldn't and we're sorry" I would probably have left it at that and added a note for future reference.

By they didn't - they actually tried to tell me I'd consented and that I'd subscribed via their Executive Partnership brand (since shut down). They tried to weasel out of it and I suspect they know exactly what they're doing wrong.

What's worse I know from other witnesses that they have no way of tracking which sources they compile their central lists from as they don't have the infrastructure to manage it - even if they did care.

In this case I applied to the court to force the Apollo to re-write their defence so that it was coherent and actually answered the claim - as you can see from the photos at the top of this article the defence looks like it was written with the same attitude that Apollo spoke to me directly with: through arrogance and ignorance.

TL;DR - Re-write the defence. Another CM hearing to see if it's worth an actual hearing

Apollo have until 4pm today (15 mins from the scheduled publish time of this post) to file a proper defence and the court then has a case management hearing to determine whether or not Defence v2 will actually answer the case or not. I've already raised the issue with ICO and the ASA as Apollo have spammed me more than eight times since "deleting my data from their systems".

ICO's response was essentially: "Yes, they're very wrong and need to improve their data compliance but we're not going to do anything about it". Considering they know I'm taking action directly I think that's reasonable but I think a decision notice would be applicable as it's not a first offence.

It's beyond a joke and as no-one else - especially the regulators - seem interested in doing something about it much outside of the public sector...but why should it be up to people like me to force these companies into compliance with the law? Surely that's not the way it should be?

If you have views or concerns please feel free to get in touch directly (secure contact details open in new window).

Update 25th July

There was a mishap at the Birmingham County Courts resulting in being sent to the court rooms on the wrong floor. Because there was no usher that day there was no way of easily finding out how to correct the mistake until 10 mins into the hearing. Case dismissed as the claimant (yours truly) didn't attend - despite being less than 10 metres away the ushers in the district court area didn't use the tannoy.

Application submitted to have the dismissal set aside, hearing fee paid and awaiting a date for the hearing. Apollo have also spammed me since the original post - four times.