Opinion: That AP Twitter Hack and Issues of Responsibility and Security

Clout is might

Two days ago, we had a major Twitter event that should give those with a large following cause for concern with regards to the responsibility they bear.

Associated Press (AP) was founded in 1846 and it is a news syndication agency that provides a news wire service which I believe is monitored as a reputable source of information by markets, governments and the global public at large.

AP also has a Twitter account @AP with 1,920,114 followers at the time of my writing this blog having posted 50,298 tweets.

It was all of AP

At no time were the AP news wires compromised but by sleight of social engineering someone obtained the password to their Twitter account, posted a few mischievous tweets about explosions in the White House with the President hurt and well, all hell broke loose before the level-headed realised the account had been hacked.

On that alone, the Dow fell 143 points besides other consequences of that unfortunate incident.

For me, it highlighted the burden of responsibility that falls on both AP and Twitter with regards to having the power to disseminate information that can result in inadvertently serious consequences well beyond the intended purposes of the instruments of dissemination.

The duty of care that comes with responsibility

If anything, AP must now realise that the reputation and clout of the organisation undergirds any medium of expression that the organisation chooses and though Twitter has a low security threshold, it is by no means an insignificant vehicle of almost overarching influence on public sentiment.

Therein lies some responsibility on the part of AP to understand that they cannot afford to be hacked even if it is easy to do so and where that might happen some monitoring, evaluation and vetting system needed to be in place to ensure that whatever is posted by that AP Twitter account does not suffer a loss of integrity leading to a loss of face and reputation by a highly reputable organisation.

Premium security for Twitter

On the part of Twitter, a security rethink is required. They provide the medium for the dissemination of content but being a postmaster does not mean you have not responsibility if you end up delivering a packaged bomb to a recipient.

It is clear that especially for verified accounts, there has to be additional security protections beyond just the password, probably verified accounts can be given some premium service that includes multifactor authentication, tweet preview processing with approval processes, delayed publishing on sensitive matters and much else.

More importantly, when a reputable organisation tweets, those tweets should be verifiably authenticated from source to destination, they should be tamper-proof and once published readers should be sure that they cannot be repudiated.

Protected Tweets

Obviously, this adds payloads to tweets if these security mechanisms are to be implemented, but it is a worthwhile price to pay for organisations with reputations to keep and uphold beyond the mere responsibility they have to their followership.

It might also mean that certain tweets be protected from modification and can only be retweeted as posted, possibly with a PT tag, PT being Protected Tweet, audit trails might also be added as the need arises.

Security and responsibility lessons

The main issue here is that security needs to be improved on and organisations knowing the burden of responsibility they carry have to institute workflows to ensure that what is tweeted in their name is what they have sanctioned and approved to be tweeted.

Twitter is no more the playground for lax security controls which could impact negatively on sentiment in the marketplace and other forums of engagement.

Neither AP nor Twitter could have foreseen the consequences of a hacker’s mischievous prank of false news, the lesson to take away from this episode is if you are trusted with a great following, you are responsible for what your followers read from you in professional excellence and in error, what you cannot afford is to be in error. 

Survey Report: How not to conduct or sell a survey

Surveys to purvey

Almost two weeks ago, an ex-colleague of mine asked that I fill in a survey to give an opinion about him, his work habits and subjectively assess what areas I felt he could improve on.

I was co-opted into this enterprise from within LinkedIn, the professional social networking site. I believe this survey had been integrated into LinkedIn because it immediately roped me into asking my ex-colleagues to assess me.

There is no doubt that self-assessment surveys trade on our curiosity and if someone thinks there is a monetary prospect in this most subjective element of measuring ourselves against others, it would be exploited.

Better tools

To be honest, I have preferred the concept of the Keirsey Temperament Sorter which has now become a commercial venture but evidently very useful in gauging where I am at emotionally and temperamentally as I project myself in all my interactions.

Survey Report is a different kind of beast, unlike the recommendations you find in LinkedIn or even the new endorsement feature, it apparently follows the Holland Codes Assessment allowing others to offer an opinion of your work personality listed as Realistic, Investigative, Artistic, Social, Enterprising or Conventional.

My survey returns

Of the over 400 connections I have on LinkedIn, I selected 35 contacts and asked for their opinions about my work personality and since then I have been nagged by Survey Report with emails bordering on spam.

Apparently, Survey Report has conducted 6.2 million surveys and received 1.3 million responses. That is a 21% return on the effort, whilst in my case; I got 28 responses of my 35 requests, which looks like a thumping 80% result.

The propeller-head in charge of research has let me know that I am well liked by my ex-colleagues, I am not too impressed with this view which is reductive at best if not lazy. If they want me to shell out $95 a year to listen to people boost my ego, I need a better proposition than being patted on the head.

Not impressed

It is in view of this that I wrote the letter below to the person in charge at first as an advisory and with the hope that the person with see beyond the critique of the product they are selling to the point that the constructive elements of what I had to say will be taken on board.

When I got the response to my letter, I could almost say that the response was a canned response and no attention was paid to any of what I had to say. Indeed, it would be nice to see the other 23 responses but I have to be sold that proposition convincingly and I hoped they will be curious to know how I determined my dataset to yield an 80% response.

In my view, the survey is flawed and I think LinkedIn can produce a better vehicle for assessments that people will readily use. If I were to be candid, Survey Report is an excess to requirements for assessment and a business proposition in a form that does not have a viable future.

That title I alluded to in my survey that I did not mention but was already formed in my mind was ‘How not to conduct or sell a survey.’

The letter

Thank you for informing me about my report. It is interesting that I carefully chose 35 of my contacts though I have over 400 connections and got 28 responses which from my reckoning is a 80% hit for a 400% result as you say people only get around 7 responses.

Obviously, you have done your surveys and have your statistics; my situation might not be altogether unusual.

Am I curious to know what my colleagues think about me? Indeed I am. Am I willing to pay the $95/year subscription to see the other 23 responses? I have not been persuaded of the cost-benefit of the selection-response assessment view has just been reductively suggested as my colleagues just liking me.

I know I am liked in general, if LinkedIn had a recommendation system that was more point-and-click as your survey, with the direct prompting that accompanied your survey, I probably will get up to 50% of my connections to respond - it is just more than "like".

The endorsement system which LinkedIn introduced just over a month ago has had connections I have not even interacted with for years click and endorse without prompting.

LinkedIn only has to refine this and add this to their premium offering to get people interested and that would be a better proposition to me.

In fact, in surveys as yours, I believe the better draw will be to provide a summary of the data-set with the lure of a more detailed analysis on payment. Of what I seen of the 5, the honest truth is I have not been sold on the rest.

In terms, it looks like a good survey which is lacking in the essential pricing-to-market persuasion that it is patently flawed. I wondered if I had doubled my data-set and still received an 80% hit whether I will be curious to see what 51 others have said for the same price.

This advice is free, methinks, ideas, projections, expectations and drawing-board have to meet again, conversely, all I have said might just be irrelevant.

In closing, this looks like the framework for an interesting blog, I have to think about the title to give it.

I am a curious person but not at any cost and I am sure a majority of those who filled my survey will have a similar view in terms of their self-assuredness.

Old Printers Never Die: Obtaining an HP LaserJet 4L Printer Driver for 64-bit Windows 7

Printing desires

My career in information technology does not have office doors or opening hours when I visit friends or relations. There is usually one little problem that requires a good looking at and sometimes I will think up an elaborate solution just because fundamentally I believe using computing tools should be a pleasure to the user at work and at home.

Recently, my cousin just wanted to print to an old printer she was never able to get to work with her laptop – what she wanted was a simple solution and decided to have a look.

Her idea was to connect the printer to her laptop whenever she wanted to print anything but that presented a number of inconveniences I felt should be eliminated.

It’s old but not to be sold

First of all the printer was a HP LaserJet 4L printer, it think a second generation one because it a non-detachable USB cable that went into that back of a not easily accessible old desktop running Microsoft Windows Vista.

Immediately, I thought I could share the printer and that would mean everyone would be able to use the printer over the wireless network.

I have always hated Windows Vista security and the idea of each person having to log on to the system to print was just extraneous, they all belonged to the same IP subnet but each computer was in a different standalone workgroup – all functions of inconsistent installation methods offered by Microsoft.

I shared the printer and then removed password protected sharing which meant any printers and the Public folder were open for usage to those on the network.

Where is the driver?

I started with my cousin’s laptop which was running 64-bit Microsoft Windows 7 Ultimate Edition, it saw the printer but could not download the driver from Microsoft Update. Hewlett Packard said the driver was contained in the installation of Windows but there was nothing I could do to get the driver.

I modified the properties of the printer to allow the Microsoft Windows Vista to render the print jobs for all clients and tried again to no avail. Then I got the printer to work from other laptops running 32-bit Windows 7 of various editions – the installation just downloaded the driver from the Windows Vista system.

Now, if Hewlett Packard was saying the printer driver was within the Microsoft Windows version and consequently obtainable from Microsoft Update but during installation it bombed out searching for the driver automatically, somehow, there had to be a way to obtain the printer driver because Hewlett Packard was just not providing one.

What was even more surprising was none of the forums I contacted had any clearly thought through solutions, it all seemed like some trial-and-error activity eventually solved the problem and that was just not enough for me, I had to understand the how and the why.

Aha!

The most persuasive solution offered was Microsoft has my printer driver, so I decided to search for the printer driver on the Microsoft website.

That is how I came upon the Microsoft Update Catalog, it expects you to be running Microsoft Internet Explorer or a browser with IE Extensions else in my case running Google Chrome thanked me for visiting before asking me to upgrade my Internet Explorer installation.

At the Microsoft Update Catalog, you are presented with a text search box into which you can type in your search terms, I was specific – HP LaserJet 4L – and that offered a number of choices two of which were for PostScript drivers – those were not the ones I needed.

Getting the driver

The description of each driver is clear enough, with a button to Add [1] the driver require, as indicated in the graphic and once the drivers required are added, click on View Basket [2] to see the added driver(s) with the option to download.

Clicking on the Download [1] button on the graphic below presents a dialog box asking for where to save your downloaded file(s) and the downloaded file is a Microsoft Cabinet file with a .CAB extension.

You can either extract the files into a folder but right-clicking on the file and choosing where to extract the files and then install the drivers from that folder using the dialog that appears after Windows Update fails to find the files needed or use the Windows Package Manager (PKGMGR.EXE) from an elevated privileges command prompt with the command line:

pkgmgr /ip /m:<path><file name>.cab /quiet

This integrates the driver into the system so when the driver is being searched for by the wizard, it will automatically be found and installed.

In conclusion

The long and short of this treatise is, if the manufacturer of any of your old devices suggests the driver you require is available within the operating system or from Microsoft Windows Update but the drivers cannot be automatically found and downloaded – go to the Microsoft Update Catalog and get the driver you need.

Your old devices need not be replaced because of the frustration of not being able to find the right driver or because the forums that should provide clear directions just assume too much of enquirers and their knowledge of these things.