Posts Tagged

Data

U.S. Air Force to pilot blockchain-based database for data sharing

The U.S. Air Force (USAF) is planning to test a blockchain-based graph database that will allow it to share documents internally as well as throughout the various branches of the Department of Defense and allied governments.

The permissioned blockchain ledger comes from a small Winston-Salem, N.C. start-up, Fluree PBC, which announced the government contract this week. Fluree is working with Air Force’s Small Business Innovation Research AFWERX technology innovation program to launch a proof of concept of the distributed ledger technology (DLT) later this year.

The ledger could include intelligence gathered during military operations and supply chain parts tracking.

fluree architecture revised Fluree

A diagram of the core components of Fluree

“Fluree is effectively a database. We call it a data management platform because it also plays the role of an application server in certain contexts,” said Brian Platz, Fluree co-founder and co-CEO. “It also even allows you to embed data into Web apps so you can quickly build them.”

Fluree ensures secure communications and data integrity by combining transactions into immutable time-stamped blocks and locking in each block via advanced cryptography. Users who are authorized on the blockchain gain access through a private-public key infrastructure.

The DLT platform also allows certain features to be turned on or off, such as full decentralization with Byzantine Fault Tolerance or a plain database without cryptography for use in internal project or app development, Platz said.

The USAF requires interoperability for its units around the globe; the platform can also search and ingest data from existing legacy systems and data stored on third-party Wikis through the use of the SPARQL query language and the Resource Description Framework (RDF) for data interchange standard.

The USAF declined to answer questions about the project.

Fluree’s platform, FlureeDB, was selected because like all blockchains, it’s peer-to-peer architecture is highly scalable, uses data encryption, offers semantic data standard formatting and data stored on it that is immutable.

fluree schema explorer Fluree

Fluree’s graph voyager that can explore a data schema

“We’re trying to allow a blockchain-backed security to power an entire application, which you really can’t do today unless the app is really trivial or it’s a cryptocurrency,” Platz said. “Anyone using blockchain in the enterprise is building a traditional application and then some part of that is hooking into Ethereum or some blockchain platform like that.”

Smart contract rules on the blockchain also allow the permissioned DLT to be configured to restrict who can view information according to their security clearance and project involvement.

The USAF wouldn’t be the first government agency to consider blockchain. The DoD has been testing it for supply chain and logistics management, and the Federal Reserve is considering it for a real-time payment service, according to Avivah Litan, a vice president of research at Gartner.

The U.S. government is actually ahead of other sectors, such as healthcare, in testing blockchain, Litan said. “I’ve seen a few use cases,” she said. “They’re not the slowest sector.

“Fluree has a pretty clever structure,” Litan said. “It’s an intriguing use case for intelligence sharing because it’s cryptographically secured and immutable, so no one can change it. You’re always worried about an enemy or insider intercept. You still have to worry about bad actors getting a hold of someone’s account and writing data that way, but it’s still harder than it is with conventional systems.”

Copyright © 2020 IDG Communications, Inc.



Source link

CERN bails on Facebook’s Workplace, cites cost and data management concerns

Research organization CERN will replace Facebook’s Workplace collaboration application with an open source alternative, citing concerns around the management of user data following changes to Workplace’s payment plan.

CERN, the European Organization for Nuclear Research, began a free trial of the enterprise social network in 2016. It has since been testing the app with staff, including corporate HR and IT teams. Approximately 1,000 members of CERN’s staff have a Workplace account, with around 150 active weekly users on the platform. 

However “reactions were not always positive,” CERN said in a blog post this week. explaining the move. “Many people preferred not to use a tool from a company that they did not trust in terms of data privacy.”

While CERN had accessed the app as part of a free trial, it was told to either begin paying for the service or use a free version after Facebook announced new payment plans in July 2019. CERN said the move to a free version would remove admin rights and involve handing data to Facebook. 

“Losing control of our data was unacceptable, as was paying for a tool that was not part of our core offering for the CERN community; therefore, we will end the trial of this platform,” the organization said.

CERN now plans to use an open-source tool, Mattermost, for instant messaging, alongside several other internal communications tools already available for staffers. It has requested that all content hosted on Facebook’s servers be removed.

A Facebook spokesperson said the company is “sorry” about CERN’s decision: “Last October, we announced an update to our pricing and packaging. As part of this we started renewal conversations with some of our customers and we’re sorry CERN [is] no longer trialing Workplace. 

“We make it easy for Workplace customers to upgrade and downgrade based on their organization’s needs,” the spokesperson said. “Each pricing tier comes with different features and terms, all of which adhere to our strict security and privacy standards. We serve thousands of highly-regulated companies, like banks and governments, and have industry-standard security certifications like SOC2, SOC3, ISO27001 and ISO27018.

“We also offer our technology for free to global charities, educational institutions and emergency services organizations through our Workplace for Good program.” 

Workplace has two paid plans: the Workplace Enterprise tier costs $8 per user per month, while  Workplace Advanced, a paid option (at $4 per user per month), has limits on certain features such as storage and the number of people who can join group calls. It has a payment option aimed at frontline workers, which costs $1.50 per user per month. 

There are 3 million paid Workplace customers, according to the most recent data on the app. That number includes deployments at large enterprise such as Nestle and the Royal Bank of Scotland. 

However, concerns have arisen in the past about how controversies around handling of data in Facebook’s consumer business might affect its enterprise operations. A survey by CCS Insight last year showed that 42% of employees felt their trust in Facebook had decreased in the last 12 months.

“There are clearly trust concerns among CERN’s staff about using a tool developed and hosted by Facebook, and this is something we’ve seen become an increasing issue over the last couple of years following the Cambridge Analytica scandal,” said Angela Ashenden, a principal analyst at CCS Insight. 

“Overall, the Workplace team has done well to manage the impact of this on its enterprise business, but it’s inevitable that there will be some fallout as a result, as we’ve seen here.”

She added that, while the Workplace free trial attracted a lot of interest from a range of companies and helped to kick-start its traction in the collaboration market, a move to a revenue model was inevitable, with most organizations accepting they have to pay for enterprise-grade security, governance and full control.

Raúl Castañón-Martínez, senior analyst at 451 Research, said that CERN’s decision points to data management concerns among large organizations.  “It is notable that CERN explained that their decision was based on not having control of their data, even after they discontinued their use of Workplace,” he said. 

“This highlights that … SaaS services like Workplace might not be a good fit for every company; this is further reinforced by the fact that CERN stated they are relying on services like Mattermost, which does provide companies with full control of their data.

“It is also notable that several members publicly stated that they did not trust Facebook in terms of data privacy. While Facebook has stated that its enterprise solution functions as a separate entity to their consumer services, they could benefit from expanding their efforts to address these concerns.”

Copyright © 2020 IDG Communications, Inc.



Source link

CERN bails on Facebook’s Workplace, cites data management concerns

Research organization CERN will replace Facebook’s Workplace collaboration application with an open source alternative, citing concerns around the management of user data following changes to Workplace’s payment plan.

CERN, the European Organization for Nuclear Research, began a free trial of the enterprise social network in 2016. It has since been testing the app with staff, including corporate HR and IT teams. Approximately 1,000 members of CERN’s staff have a Workplace account, with around 150 active weekly users on the platform. 

However “reactions were not always positive,” CERN said in a blog post this week. explaining the move. “Many people preferred not to use a tool from a company that they did not trust in terms of data privacy.”

While CERN had accessed the app as part of a free trial, it was told to either begin paying for the service or use a free version after Facebook announced new payment plans in July 2019. CERN said the move to a free version would remove admin rights and involve handing data to Facebook. 

“Losing control of our data was unacceptable, as was paying for a tool that was not part of our core offering for the CERN community; therefore, we will end the trial of this platform,” the organization said.

CERN now plans to use an open-source tool, Mattermost, for instant messaging, alongside several other internal communications tools already available for staffers. It has requested that all content hosted on Facebook’s servers be removed.

A Facebook spokesperson said the company is “sorry” about CERN’s decision: “Last October, we announced an update to our pricing and packaging. As part of this we started renewal conversations with some of our customers and we’re sorry CERN [is] no longer trialing Workplace. 

“We make it easy for Workplace customers to upgrade and downgrade based on their organization’s needs,” the spokesperson said. “Each pricing tier comes with different features and terms, all of which adhere to our strict security and privacy standards. We serve thousands of highly-regulated companies, like banks and governments, and have industry-standard security certifications like SOC2, SOC3, ISO27001 and ISO27018.

“We also offer our technology for free to global charities, educational institutions and emergency services organizations through our Workplace for Good program.” 

Workplace has two paid plans: the Workplace Enterprise tier costs $8 per user per month, while  Workplace Advanced, a paid option (at $4 per user per month), has limits on certain features such as storage and the number of people who can join group calls. It has a payment option aimed at frontline workers, which costs $1.50 per user per month. 

There are 3 million paid Workplace customers, according to the most recent data on the app. That number includes deployments at large enterprise such as Nestle and the Royal Bank of Scotland. 

However, concerns have arisen in the past about how controversies around handling of data in Facebook’s consumer business might affect its enterprise operations. A survey by CCS Insight last year showed that 42% of employees felt their trust in Facebook had decreased in the last 12 months.

“There are clearly trust concerns among CERN’s staff about using a tool developed and hosted by Facebook, and this is something we’ve seen become an increasing issue over the last couple of years following the Cambridge Analytica scandal,” said Angela Ashenden, a principal analyst at CCS Insight. 

“Overall, the Workplace team has done well to manage the impact of this on its enterprise business, but it’s inevitable that there will be some fallout as a result, as we’ve seen here.”

She added that, while the Workplace free trial attracted a lot of interest from a range of companies and helped to kick-start its traction in the collaboration market, a move to a revenue model was inevitable, with most organizations accepting they have to pay for enterprise-grade security, governance and full control.

Raúl Castañón-Martínez, senior analyst at 451 Research, said that CERN’s decision points to data management concerns among large organizations.  “It is notable that CERN explained that their decision was based on not having control of their data, even after they discontinued their use of Workplace,” he said. 

“This highlights that … SaaS services like Workplace might not be a good fit for every company; this is further reinforced by the fact that CERN stated they are relying on services like Mattermost, which does provide companies with full control of their data.

“It is also notable that several members publicly stated that they did not trust Facebook in terms of data privacy. While Facebook has stated that its enterprise solution functions as a separate entity to their consumer services, they could benefit from expanding their efforts to address these concerns.”

Copyright © 2020 IDG Communications, Inc.



Source link

Fed rule on patient access to healthcare data gets EMR vendor pushback

The largest electronic medical record (EMR) vendor in the U.S. is fighting a proposed government rule to allow patients and their physicians greater access to electronic health information – regardless of the technology platform – to promote data exchange.

According to a number of recent reports, EMR vendor Epic Systems is lookng to derail the finalization of a rule from the Department of Health and Human Services (HHS) that would implement some provisions of the 21st Century Cures Act. In particular, the rules governing information-blocking of patient healthcare information and EMR interoperability are at the heart of the fight.

For its part, Epic said in a statement it supports patient information sharing, but believes the new rules open up security issues related to sharing data with third-party applications, a position some see as a red herring.

“Yet again, Epic is information blocking – this time trying to trick public opinion with privacy concerns,” said Cynthia Fisher, CEO of the non-profit PatientRightsAdvocate.org. “In reality, it is a smoke screen to protect their market share, control, and financial interests. It’s all about the money.”

Mike Jones, a vice president of research at Gartner, agreed, saying that by blocking information, vendors are seeking to define interoperability on their terms. “Gartner’s view is that these rules are an essential part of the solution to drive more open ecosystems.”

The proposed rule would require EMR vendors to give patients electronic access to all of their health information at no cost and to allow those data stores to connect to any third-party apps a patient chooses, such as the Health app launched by Apple two years ago.

electronic medical record Creative Commons Lic.

A sample of a patient electronic medical record.

The new rule, to be administered by the Office of the National Coordinator for Health Information Technology (ONC), would additionally allow for more choice in care and treatment, according to the government agency.

Because of lack of access to health information, patients are misdiagnosed, mistreated and mischarged, Fisher said.

“These rules will invert the power and put the control into the hands of patients, giving them much-needed access and transparency,” Fisher said. “Patients having complete information wherever they get care will allow for proper diagnoses, treatment, and the ability to shop for the best quality of care at the lowest possible price.”

The Trump Administration’s implementation of the bipartisan Cures Act, through the new rules, will begin “a technological revolution in healthcare,” Fisher added. “Allowing technology innovators to disrupt the status quo is the biggest threat to Epic’s business model.”

The U.S. is not alone in its efforts to promote patient rights for better access and sharing of healthcare information. The EU’s General Data Protection Regulation (GDPR) contains a Right to Data Portability article that says industry standard data formats should be used to enable consumer data sharing, as opposed to proprietary data formats.

For example, the rules would require increased interoperability between EMRs through the United States Core Data for Interoperability (USCDI) standard, new API requirements, and data export capabilities to ease switching of health IT services or to provide patients their health information directly.

While industry standards already exist, progress on adopting them has been slow; regulation and enforcement issues so far have allowed EMR vendors to define interoperability on their own terms, according to Jones.

The ONC would oversee conditions and certification requirements for EMR providers developed under the ONC Health IT Certification Program.

Epic reportedly lobbied against the new rule set, and in an email, Epic CEO Judy Faulkner urged CEOs and presidents of hospital systems to co-sign a letter disapproving of the rules.

Epic has even threatened to sue HHS over the rule, according to one report.

This wouldn’t be the first time EMR providers have been accused of actively blocking industry measures to make patient information sharing simpler.

Industry experts have said the patient information sharing isn’t a technological problem but an issue related to vendor profits. By keeping their software proprietary and unable to exchange data, or by actively blocking the use of protocols that would otherwise allow it, EMR vendors can corner their respective markets.

ehr ts Thinkstock

In its statement this week, Epic claimed it supports the proposed ONC rule to enable simpler patient data access, and pointed to its MyChart patient portal; Epic said the portal has allowed patients to download Epic EMR data to a file or thumb drive for the past decade – something disputed by others who say that capability is no more than 18 months old.

Epic, however, argued that the new rule must be amended to ensure patient privacy.

“By requiring health systems to send patient data to any app requested by the patient, the ONC rule inadvertently creates new privacy risks,” Epic said.

There are two “highly likely patient privacy risks,” according to the company.

  1. The data sent to the apps might include family member data, without the patient realizing it and without the family members’ knowledge or permission. Almost all medical records contain family history, which may be threaded throughout the record.
  2. Apps may take much more of the patient’s data than the patient intended. There are no transparency requirements to make it very clear to the patient what data the app is taking and what the app will do with that data.

Epic pointed to a 2019 study that found 79% of health care apps resell or share data, and there is no regulation requiring patient approval for that downstream use.

“For patients to benefit from the ONC rule without these serious risks to their privacy, we recommend that transparency requirements and privacy protections are established for apps gathering patient data before the ONC rule is finalized,” Epic said.

Third-party apps enabling the sharing of EMR information are growing.

In 2018, Apple launched its Health Record feature on its Health app, which allows patients to pull healthcare info from multiple providers onto a single record they can share with clinicians – regardless of where they work.

Apple’s Health Record uses the Health Level Seven (HL7) application programming interface (API) and the Fast Healthcare Interoperability Resources (FHIR) industry standard; the two specifications enable all EMR platforms to upload basic patient data from a standard continuity of care document (CCDA) into a single Apple format, once the patient opts in.

“Today the EHR is a system of record. New systems of innovation and differentiation can help deliver new capabilities (e.g. virtual care, remote patient monitoring, apps and devices to help people care for themselves),” said Jones.

He went on to argue that keeping data siloed is old-school thinking.

“Vendors that block the exchange of health information to ‘protect the patients and health systems’ or seek to charge royalties or focus mostly on proprietary forms of API information exchange are an anachronism from the days of early EHR adoption,” Jones said. “Healthcare needs effective information sharing: Patients want it and many health systems want it.”

Another leading Medical IT vendor, Meditech, said it “is strongly in favor of a patient’s right to have access to their medical record data” and their right to “electronically transmit that data for use wherever they like.

“There are some troublesome aspects to the proposed rule, but we have chosen to communicate those directly to the administration and are hopeful those concerns will be addressed, if not in the rule itself, then in subsequent clarifications,” Meditech said.

Healthcare organizations and government policymakers in some regions are now collaborating to deliver and open health information exchange (HIE) and drive new market requirements.

“Lack of effective meaningful health data-sharing is a major industry challenge and is a barrier to effective joined-up healthcare for many patients and citizens today. The HHS rule, and similar attempts in other countries to open up the exchange of healthcare data are to be welcomed,” Jones said. “The more forward-thinking vendors operating in the market recognize the emergency of integrated health, and in some counties, regional health and social care ecosystems.”

Copyright © 2020 IDG Communications, Inc.



Source link

Galaxy users, take note: Samsung’s probably selling your data

Relying on Google services, as most of us Android-carrying primates do, comes with a certain tradeoff. It’s no big secret or anything: Google makes its money by selling ads, which are more effective when they’re catered to our interests — the subjects we tend to search about, the things we buy (when Google knows about ’em, at least), and often even the places we go with our location-enabled phones in tow (and/or in toe, for the monkeys among us).

That’s all par for the course, as I frequently say — part of the deal we all accept when we use Google services. That’s what makes it possible for Google to give us top-notch apps for free, and it’s also what opens the door to certain advanced features that wouldn’t be possible without that information’s presence.

What you might not realize, though, is that if you’re using an Android phone whose manufacturer makes significant modifications to the operating system or the system-level apps around it — any phone other than a Google-made Pixel or a Google-associated Android One device, really — there’s a decent chance the creator of your phone is adding its own layer of complexity into that arrangement. And even though Google itself doesn’t ever share your data with anyone, the company that creates your phone might be using its position to double-dip and directly profit off the same personal info you assume is protected.

That certainly seems to be the case with Samsung. In addition to making a hefty chunk of change from selling you hardware, Samsung appears to have quietly created an intricate system for collecting different types of data from people who own its phones and then generating extra revenue by selling that data to third parties — or sometimes using the data to power its own self-run ad network. That has the potential to be disconcerting for anyone and particularly red-flag-raising for businesses and enterprises, where information protection is an especially pressing priority.

For all the times I’ve complained about the complexity and confusion created by Samsung’s insistence on gunking up Galaxy phones with redundant versions of Google services, it never occurred to me that part of the reason it was doing that was to dip into user data and turn it into a secondary stream of income. It wasn’t until the crew from XDA Developers noticed a newly present setting in the Samsung Pay app the other day, in fact, that such a notion crossed my mind.

Samsung, as XDA discovered, recently added a toggle into its Pay app’s settings called “Do not sell.” If you find it and activate it — and no, it isn’t activated by default — then and only then, your payment-related data “can be locked away from Samsung Pay partners.”

Samsung Privacy (1) JR

Samsung does warn you that some of its Pay features won’t work if you flip that switch, though it isn’t immediately clear which specific elements of the app it’s referring to.

Samsung Privacy (2) JR

This switch’s addition seems to be tied to a new set of privacy regulations enacted by the state of California: the California Consumer Privacy Act, or CCPA, which went into effect at the start of this year — on the same day that Samsung’s privacy policy was updated. It’s not clear if the same Samsung Pay “Do Not Sell” option is being provided to Galaxy device owners outside of the U.S., but what is clear is that Samsung didn’t seem to provide this option to anyone — or make it at all clear that it was apparently selling payment-related data to third parties — before this point.

And digging deeper into the company’s privacy policy, it seems this isn’t the only place where such data dipping practices are being employed. As part of the policy’s “California Consumer Privacy Statement” — again, making the disclosure specifically to California residents, as now required by law — Samsung says:

We may allow certain third parties (such as advertising partners) to collect your personal information. You have the right to opt out of this disclosure of your information.

It also warns California-dwellers that prior to the CCPA’s passage, it “may have” sold several specific categories of alarming-to-the-IT-department info, including:

Identifiers such as a unique personal identifier (such as a device identifier; cookies, beacons, pixel tags, mobile ad identifiers and similar technology; other forms of persistent or probabilistic identifiers), online identifier, and internet protocol address

Commercial information, including records of products or services purchased, obtained, or considered, and other purchasing or consuming histories or tendencies

Internet and other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding your interaction with websites, applications, or advertisements

Inferences drawn from any of the information identified above to create a profile about you reflecting your preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

Yikes. And that’s barely scratching the surface. The company notes that it also may have “disclosed” even more personal info to “vendors” for “a business purpose” — everything from your name, address, and phone number to your signature, bank account number, credit card number, purchase history, browsing history, search history, geolocation data, and once again that lovely-sounding collection of “inferences drawn” from all that info.

I wish it ended there, but the more you dig, the more unsettling stuff you uncover. The privacy page for Samsung’s Customization Service — something that’s integrated all throughout Galaxy devices’ software and the Samsung-branded apps associated with it — collects much of the same device-specific sorts of information. It taps into data about what apps you use on your device along with what music you play on the phone, what websites you visit, what searches you make, and where and when you’re taking pictures. It also relies on Samsung-made apps like the company’s custom Calendar and Internet (browser) utilities to analyze your data from those domains.

And then it uses all that info to “display customized advertisements about products and services that may be of interest to you,” among other things. It reserves the right to “collect, analyze, and share information” in order to provide you with “advertising and direct marketing communications about products and services offered by Samsung and third parties that are tailored to your interests.”

Speaking of ads, there’s a whole other can of worms about that.

But wait: Isn’t all of this already happening with Google, anyway? That’s a valid question. And the answer is: not really. First, and most crucially, Google never sells your data or shares it with any third parties, even when said info is used to help determine what ads you see around the web via Google’s ad networks. That’s where the Samsung thing gets especially icky-feeling and potentially concerning, if you ask me — in the selling of information to other companies.

But beyond that, Google’s use of data for ad personalization is a well-known, core part of its business at this point. Love it or hate it, Google’s incredibly up-front about what type of data it’s collecting and how exactly it’s using it. The company’s got entire websites devoted to that subject, with plain-English, non-legalese breakdowns. And it makes it possible to see exactly what information is being stored about you and to opt out of any form of data-driven activity you want — including the entire ad personalization system — with the understanding, of course, that doing so will affect what features are available to you in certain associated areas.

Samsung’s use of customer data, in contrast, feels slightly sneaky. Sure, you might’ve clicked through some sprawling terms of service screen when you first set up your phone — who can remember? — but the company certainly isn’t going out of its way to make sure you understand and can control exactly what it’s doing with your data. And the fact that its Android-integrated apps effectively give it access to your data from the underlying Google services — like your calendar details, for instance — make it tough not to see those apps in a completely different light, given the realization of what Samsung reserves the right to do with that data.

I reached out to Samsung on Monday to see if the company could provide any further context or comment about any of this. I’ll update this page if I receive any additional information.

Ultimately, though, it boils down to this: With Android or any Google services, you’re accepting the arrangement with Google and entrusting Google to keep your data safe. That’s the company’s entire business, and presumably, you believe it can do a reasonably decent job of protecting your personal and/or work-connected information, even if it does use parts of that info for ad personalization.

When you add Samsung’s software into the equation, you’re creating a secondary layer that sits on top of that — and consequently doubles the number of companies with access to your info and the responsibility to guard it. (Also, one of those companies is openly claiming the right to pass some of your data on further as it sees fit, in addition to using it for its own secondary system of ad serving.) You’re doubling your exposure, in other words, or more than doubling it once you factor in the third-party sharing.

When we talk about Android and privacy — just like when we talk about Android and software support or Android and overall user experience — it’s worth remembering that two very different realities exist: the one Google creates and provides via its own Android phones and the one other companies adapt to their own priorities and business interests. If you opt to venture outside of Google’s jurisdiction and into another galaxy, it’s critical to keep that distinction in mind and take it upon yourself to seek out and disable any secondary layers that you don’t want in your mobile-tech equation.

Sign up for my weekly newsletter to get more practical tips, personal recommendations, and plain-English perspective on the news that matters.

AI Newsletter

[Android Intelligence videos at Computerworld]

Copyright © 2020 IDG Communications, Inc.



Source link