Its MINE and its BEAUTIFUL!

My wife used to run a little craft shop and her biggest challenge was getting adults to be creative. When she asked someone straight out to do crafts they would usually reply "but I'm not arty" or some such nonsense. Everyone is artistic. We may not all be Picasso or Rembrandt but there is a little artiste inside all of us waiting to get out.

[For both of the guys who read this column for the Information Security bits (thanks mom, dad) , its coming near the end.]

All of these people have cellphones with their own rings tones, themes, personalizations. Even little things that hang off the aerial, little cases, etc etc

The ones that work have PCs that have custom desktops. It may be a soccer team, cute kittens, a nice colour, pictures of their kids etc.

People in the workplace have, in most cases, few opportunities to express themselves creatively. But it has to come out somehow. And hence, people change their desktops and cell phone rings.
This also leads to the attraction of blogging but more to facebook and its friends.

I imagine it would be possible to fill up 8 hours a day for a month customising facebook, adding friends, adding and removing applications, putting in information, getting more applications that need information, drawing, chatting etc etc. And the whole time you are using the creative part of your brain.

How does this relate to Information Security? Well, a big deal of time is spent understanding what users do. A user is a tricky resource to understand. Companies have to accept the fact that their employees need to express their creative side, and not just the advertising guys and the script writers, but Jeff in Accounting too.

The alternative is that users will find ways to bypass measures in place that stifle their creativity. They will spend loads of time on facebook, swap joke emails, download music through p2p or even just spend time by the watercooler.

Or maybe I'm being too lenient, maybe the technological answer is correct and we should just close down undesirable sites, use "managed desktops" where everything is tightened up etc.

But facebook can be used from a cell phone...

Intra-company PreCommunication Policy Exchange

You heard it here first!

I'm sure that someone out there is going to try patent this idea so let me put it out on the Internet first. I'm not interested in the patent - if I make this I'll try my best to be the best and beat competitors that way.

Right - I will try explain this in simple terms.

(As I see it) The problem with mail these days is

• Spam
• Contract law

Mail as we know it (SMTP for the geeks) originated in a wonderful carefree environment untouched by the ugliness of unfettered Capitalism. There was no spam. I remember the days when you could use any SMTP server out on the Internet to "relay" your mail. Sorta like travelling in New Guinea or New zealand or New York and you just happen to pass a letterbox/postbox and you pop your mail in. And it will get where you want it to. For free - the owner of the mailbox paid something ridiculously small to move your mail and secure in the knowledge that if he was in your home town your mail server would relay his mail.

Then companies saw this marketing opportunity - free mail! And decided to abuse it. Hence spam. Now everyone only relays their own mail. And we still have spam.

The other issue with mail's naive beginnings is that anyone could pretend to be anyone. It was based on trust. After the first few times of pretending to be someone else the fun wears off. Not for spammers - they need to pretend to be someone else all the time. Otherwise they would be simple to block and everyone would except for idiots who want to lose money on the stock exchange and make up for it with huge..well... pfiser's blue pills.

Wouldn't it be great to be able to only receive mail from companies we deal with? I think so. setup an information account that can still receive spam and all sorts of junk but have regular users only get mail from companies that are trusted.

The other issue is that email was just for fun - first for geeks, then for cool geeks, the for cool people (like wow!) and then for the man in the street (and his tech savvy kids). Then more and more business people saw the advantage of cheap and quite written communication - untrusted as it was.

And more business information was exchanged over email. As information decided it wanted to stay as bit and bytes and not ink spots on a page the definition of "document" as a piece of paper became increasingly wrong. (I remember a story about this - I will put it in my next post). The laws became wrong and they were changed. South Africa made a new law called the "ECT Act" which mainly extended the definition of "documents".

The law was slow to recognise email as a legitimate business tool but so were the geeks. Email today is the same as email of when it was not important to business. All of a sudden email was important - deals could be made through email. Decisions could be made. Companies could be sued. People could be fired. All through a medium that can be very easily spoofed or lost. How does one know exactly who sends an email? You can't, not easily. Not yet.

So companies have been scared of the laws and scared of the power email has the disclaimer was born. The disclaimers used to say "if you are not the intended recipient of this email - destroy it and forget what you have read,please". Now they are more complex but they say "if you are the recipient of this mail and we have written anything that we may want to take back at a later stage - we can!". I know a company that says the above and adds "The law that makes this a document - ignore that law". Its a technology company.

But then what is the point of email?

I think that it would be a great idea to work out all the companies that your company emails. This may be a mission at first but I doubt it would be as bad as people may think. Then work out what sort of relationship you have with the company. Make out a few contracts - one for suppliers, one for once-off-suppliers, one for customers, etc. Then approach them and ask them to enter into a contract. I will provide an example contract soon. Once that is done - no need for spam checking.. just have a white list. No need for disclaimers. You want to do ordering through email and have it binding - perfect - it can be done legally and (now) safely.

More on this soon.... but, remember, you heard it here first!