Does productivity matter?

 

The Solow Computer Paradox, or IT productivity paradox has been running for a while now. The latest installment of the mysteries of productivity has been published recently here.

Obviously, we cannot expect economists to tell us anything useful, so a short listicle on practical reasons for the paradox may help. The Black Box approach to organisations taken by economists is unable to support human-centred automation vs. human-replacement automation. A Glass Box approach is required for this. Good intentions that lead nowhere useful can be found here and here (both pdf).

Robo-Taylorism

Human activity in physical space is fully exposed to the panopticon of surveillance capitalism and Digital Taylorism here. Chickenized cyborg gig-economy jobs under algorithmic management dominate sectors such as logistics.Within a limited framework, these dehumanized enterprises are being 'optimised' for productivity. One can only hope that the Gradgrinds doing this find themselves locked into a pre-Ocado business model and fail. Attempts at micro-surveillance (bossware, tattleware etc.) in cognitive, social, creative etc. settings backfire, and certainly don't lead to anything resembling real productivity.

Financial engineering

Productivity is a topic of importance to an age of industrial engineering, but of questionable relevance to an age of financial engineering. Anglo-Saxon capitalism has been in the latter for some years. Try and invest based on 'value' or 'company fundamentals'. See here and here.

Productive enterprise as busted myth

The Gervais Principle here shows the organisation as a dysfunctional structure with matters other than optimal productivity on its mind.

Functional stupidity (here pdf) limits individual and collective cognition in an 'information age'. Perhaps the key factor in current productivity shortfalls.

Bullshit Jobs here are all too prevalent, and there seems to be no effort to eradicate them. "The market has a natural tendency to undersupply good jobs." - delicately put by Acemoglu here pdf.

Gammon's Law of Bureaucratic Displacement here is not restricted to a few public sector organisations. " in a bureaucratic system … increase in expenditure will be matched by fall in production …. Such systems will act rather like ‘black holes’ in the economic universe, simultaneously sucking in resources, and shrinking in terms of ’emitted’ production.

 Bureaucracy’s most destructive effectsare due to its permeation and impairment of the activities of non-administrative staff.

An example is the progressive transformation of nurses from patient-centred carers to administroids whose requirement to produce detailed patient care plans and participate in workshops and seminars leaves them little time to attend to patients’ basic dietary needs or prevent them developing pressure ulcers.

The second major cause derives from the mechanical nature of bureaucracy. Its proliferation is not simply the product of individual empire building. Although a bureaucratic organisation encourages, and is nourished by, individual self-interest, proliferation is inherent in the system itself."

Similarly, Pournelle's Iron Law of Bureaucracy: "Pournelle's Iron Law of Bureaucracy states that in any bureaucratic organization there will be two kinds of people":

First, there will be those who are devoted to the goals of the organization. Examples are dedicated classroom teachers in an educational bureaucracy, many of the engineers and launch technicians and scientists at NASA, even some agricultural scientists and advisors in the former Soviet Union collective farming administration.

Secondly, there will be those dedicated to the organization itself. Examples are many of the administrators in the education system, many professors of education, many teachers union officials, much of the NASA headquarters staff, etc.

The Iron Law states that in every case the second group will gain and keep control of the organization. It will write the rules, and control promotions within the organization."

Parkinson's Law is worth revisiting here.

Socio-Technical Systems here is a well-established approach to designing effective, productive organisations, but is seen as a specialist interest.

Office layout

Ever since the Action Office was subverted into cubicles, office layout has been determined by unaccountable bureaucrats with no consideration of productivity (with some exceptions of course). Open plan offices and the 'creativity' demanded now are basically incompatible. If enterprises had any real interest in productivity, this situation would have changed long ago.

Central Banking

Cheap debt from central banks is keeping Zombie companies alive. These companies increase 'productivity dispersion'. Their continued existence highlights the lack of interest in productivity.

Labour market

Labour market tightness may be necessary for productivity increases - here. A post-covid possibility.

Inappropriate automation and technology

"The first rule of any technology used in a business is that automation applied to an efficient operation will magnify the efficiency. The second is that automation applied to an inefficient operation will magnify the inefficiency." Bill Gates

Despite the introduction of cloud documents for group working, office technology has been functionally fossilised for a long time. Simply put: When did everyone stop using Powerpoint? The tools for WFH similarly make no real use of technology for more effective working e.g. do any video conferencing tools use automatic mediation here pdf? How is the budget for facilitator training? How many firms have flipped their offices here? Does management know that email is not work here? Is there any scaleable use of lessons learned from CSCW? Recent automation of the hiring process (and people analytics generally) is awe-inspiringly dreadful.

In short, productivity doesn't seem to matter, apart from Bezos' galley-slaves.

As a footnote, if you know any of those souls who think that the robots will do all the work and we can sit around being creative and radical on UBI; treat them with compassion but do not join them in their delusion. We are all off to the Precariat if we don't get organised.

Reflections on 'Four Decades, Four AI Papers'

I really enjoyed reading 'Four Decades, Four AI Papers' by Murray Shanahan. The familiar names evoked memories and provoked ideas. Two observations (NOT criticisms) are relevant here.

1. How tangential psychology has been to the AI story over this time. Not what I had expected from my undergraduate experience.
2. The AI development processes over time are completely, conceptually, detached from the development of software tools for human use.

To test these observations, I did some searches on Arxiv CS (Computer Science). For benchmarking, 'psychology'/ 'psychological' got 80 hits, and 'gradient descent' 413.
For 1., a search for 'Gigerenzer' produced two hits, with one of general relevance. There were no returns for 'Turvey'. As a probe into the use of psychology in the CS / AI /robotics world, this is disappointing, to say the least.
For 2., a search for 'Augmented Intelligence' yielded three returns. The Wikipedia article (cf. link) gives a good summary of the long and honourable history of the approach, though the story tails off toward the end. A search for 'Human-Centered' yielded 92 returns (many beyond AI / ML), with a dozen or so of interest. 'Usability' (which also picked up 'usable') yielded 1,316 returns - I did not investigate how many of these were related to AI / ML.

Inferences from this:
As regards 1.,a potentially fruitful two-way exchange seems to have been missed over the last four or five decades. There was some exchange during the expert systems era, but the potential exemplified in 'Expert Judgment and Expert Systems' was hardly explored (AI winter I suppose).

As regards 2., the consequences are more damaging than a missed opportunity. Taking the approach to researching AI, and applying it to practical problems leads to a justified Frankenstein Complex.  The psychology of building "applied AI" seems to come from 'God and Golem' , the 'Megamachine' , or Technetronics. An Augmented Intelligence approach would have pre-empted most of the fruitless discussion over bias, meaningful human control, etc. The AMA seems in favour of the approach. The Knowledge Based Systems community still seems to exist; perhaps a major refresh of KADS is due?

All in all, these decades have been interesting, but have not helped us move to a more humane society.

Why we won't get online safety

 Why data breaches won't go away

Why phishing won't go away

"Those who would give up essential usability to purchase a little technical security deliver neither usability nor security."

There is no prospect of us having online safety in the foreseeable future. The diagrams above show the stories around data breaches and phishing.

The infosec world does not have the tools, resources, culture, management, or incentives to fix things. The bad actors carry on getting smarter.

The IT security world as presented to us ordinary users is confusing, inconsistent, and unpleasant.

Several things are clear:
1. The victim-blaming ("silly users with their 1234567 passwords") needs to be challenged at every opportunity. It is unhelpful in the extreme.
2. Digital literacy needs to highlight Michel de Certeau's 'Arts de Faire / Arts of Doing' - ways of reclaiming our autonomy from the panopticon and bad actors.

3. We need tools and resources to fight back / hold our own against the tide of incompetence and malevolence.

4. There is no obvious source for good advice, training, tools, and resources that will be heard above the noise and used at scale.



The Robert Graham Project says "I think the most important security precaution is to lie to computers compulsively". This includes made-up user names, multiple email addresses, fake answers to security questions, and multiple mobile phone numbers. The recent (very good) UK Government guidance gets close but not close enough.

Passwords and Usability

Usability of advice

Much advice on passwords is contradictory, confusing, and context-free. I propose a Scale for Evaluating Password Advice (SEPA)

1. Does the advice give due prominence to haveibeenpwned.com?
2. Is the advice tailored to specific users and contexts (use cases)? (as opposed
    to being generic)
If 'Yes' to question 2:
3. Are there indications that the threat priorities have been based on
    evidence?
4. Are there indications that the risk mitigation actions proposed are
    based on evidence?
5. Are there indications that the advice has been tested with
    representative users?

Password Managers

There are plenty of reviews of password managers. These all seem to focus on technical aspects, with little or no understanding of usability. On the basis of limited personal experience, I suggest the following criteria for password manager usability:
1. The supplier website sets out what use cases it meets, and how, and what use cases it does not support.
2. The manager has a link to haveibeenpwned.com API.
3. The manager generates user-friendly passphrases  like this. 
4. The manager works without the cloud.
5. The manager helps the user cope with the vagaries of various websites e.g. no paste allowed.
6. The manager is compatible with producing paper storage system.

Use Cases

A collection of not-very-thought-through use cases is below for illustrative (rather than design)purposes:

• A US Secretary of State who steps out of the SCIF to use her personal Blackberry.
  

• A bitcoin miner whose mobile phone account is hijacked to exploit SMS 2FA.
  

• A Cambridge Professor of Security Engineering who refuses to use online banking with good reason
  

"...if you fall victim to an online fraud the chances are you will never see your money again...one of the banks’ most extraordinary feats of recent years has been their ability to shift liability away from themselves and on to the customer – aided by a Financial Ombudsman Service (FOS) that they claim rarely challenges the banks following a fraud."

• A journalist talking to dissidents in a dangerous country.
•  Grandma logging into Facebook while staying with her daughter.
•  Grandma wanting to put her online affairs in order for her estate. 
• A student wanting to prevent his flatmates using his pr0n account when he is out. 
• A businessman going to the toilet while doing online business with the free wi-fi in a coffee shop.
• A Civil Servant wanting to do home banking while at the office.
• An agency ICU nurse called in at short notice needing to look up patient records. 
• A homeless person using a mobile phone to claim benefits and pay bills. 
• Someone on a list entering the USA and being asked to provide their passwords.

Important update from Rachel Tobac: "A useful thing about using a password manager that I don’t always see folks talk about is that my pw manager won’t enter my username and password on malicious lookalike sites. Not the real airline website? Looks real but it’s actually a malicious URL? No credentials entered". So - does the pw manager do this? 

Systems of interest for autonomous platforms

The discussion on various autonomous cars, ships, aircraft has generally been focused on the moving platform - by default, or by assumption. It would be helpful to consider the various systems of interest. A very small start has been made by distinguishing UAV and UAS, but we are still at the point where most of the systems of interest do not have names. There are a number of Technical Systems (identified as TSn) and a number of Socio-Technical Systems (identified as STSn). The systems that we need to consider appear to be as follows: 

TS1; The platform (UAV, UUV, driverless rickshaw, robot, etc.). These usually have names.
TS2; The platform plus off-platform 'cloud' (robo-cloud).
TS3; Collective of platforms. Not necessarily a 'swarm' - but a group of platforms working together.
TS4; Collective of platforms plus off-platform 'cloud'.

 STS1; Any of TS1-4 so long as specified plus an 'Operator' who can be held to account. The 'Operator' may be a pilot, Master etc. Near-Real Time situation awareness for the off-platform Operator is only possible with TS2, 4. This system has a name in the case of UAS (only, I think). It is hard to see how a 'car driver' without specialist training can be held to account. The current standard of media reporting has the "driver of a driverless car" being blamed for an accident!

STS2; Any of TS1-4 so long as specified plus Operator, Responsible Owner, Design Authority. This is the minimum system for proper accountability. It needs a name. Note that TS1-4 plus Operator, Responsible Owner has not been included in the list as it is effectively obsolete.

STS3; Any of TS1-4 so long as specified plus Operator, Responsible Owner, Design Authority, Legal Authority, Insurer, Provider of financial legitimacy, Provider of employment and training legitimacy. This is the system that provides the licence to operate. i.e. the 'blunt end' as well as the 'sharp end' in Dave Woods' terminology.

STS4; Typically, 'Cloud' platform operator, financiers.The system that manages the flow of money and information rights. If the 'values' in this system are unethical, then 'value alignment' of TS2, 4 is difficult to achieve (Milo Minderbinder UAVs anyone?). 'Platform' is often used as a shorthand name here, just to add confusion.

Getting started with safe internet use

This is written for members of my family who are starting out with PCs on the internet (no comments here about Apple).

Install Webroot WSA - it uses less of your computer power running in the background than other AV tools. Remember to run scans regularly - don't just rely on it working in the background.

Putting your data on a separate 'partition' of the disk to Windows etc. is a good idea and may enable you to recover your data e.g. when Windows dies. If you are new to computers, it is best to get help, even though it is straightforward. This guide seems clear (like much from Tom's Hardware). Make sure your application data (such as email) is on the new partition.

Install CCleaner - this is useful for removing crud from your computer - do regular cleaning, including cookies. It is also good for uninstalling programs, and for choosing which programs you want to run when the computer starts up. CCleaner is also available as a Portableapp (see below).
If you don't want to use CCleaner for some reason, you can set up Windows to remove crud.

This guide is a good introduction to staying safe on the internet.  Read it and then come back here.

Internet security is now so complex, that working out your personal threat profile is probably impossible. Treat security like dieting or exercise. Do the important things first and then keep working at it at a manageable pace.
Now go and read it properly, then come back.

The Robert Graham Project says "I think the most important security precaution is to lie to computers compulsively".  This includes made-up user names, multiple email addresses, fake answers to security questions, and multiple mobile phone numbers. If you think the other side is playing fair, read this (technical, I know).

Security questions are broken - more than you would think. Fake answers (that you record safely!) are becoming essential. The first school Robert Graham went to was &*O)IYHPU&G!!!.
Generating a fake identity can be helped with this.

It is worth remembering that Ross Anderson, Professor of Computer Security at Cambridge, does not use online banking because the risks are all with the customer.

Update: you might want to take the Data De-tox to remove any unwelcome public data about yourself.

1.  Re-using passwords.
Checking for data breaches is very sound advice, and not often given. Do this first and regularly.
Data breach is the main threat for most of us. This is why re-using passwords is such a bad thing.
Google, Facebook, and PayPal seem to take our security seriously. If you can use them as a login, that might reduce the risk. Minimising the number of people with your credit card details is prudent.

Don't let your browser store your passwords and fill in forms - that seems to be broken. See also here. If you have a password manager, it might be as well to disable auto-fill for forms (if it will let you).

My limited experience of a password manager (Dashlane) is mixed.  A book, and a password generator set to give you a readable password (passphrase) might be better to start with. NCSC advice is to use passphrases, 4 random dictionary words or CVC-CVC-CVC style passwords, picked for memorability. Advice from Angela Sasse: "A longer password is preferable overall, but that has its own problems,...More than 50% of passwords are now entered on touchscreen devices, and longer passphrases create a significant burden on touchscreen users.
...Passwords are rarely cracked by brute force. They are mostly captured through phishing and malware, and with those attacks it does not matter how long or complex your password is."

Unfortunately, password strength meters (things that tell you if your password is weak or strong) are not good indicators of real strength.

Perhaps a Password Manager for all the unimportant sites, and something personal for the vital ones. Using Charles Dickens might (or might not)be helpful. 1Password now checks whether a password has been breached, which is definitely useful. The fact that this is new and novel shows what a way the security industry has to go as regards usability (or utility).

This advice from NCSC is not bad on password re-use.

Mark Burnett‏: "Always remember the three main authentication factors: what can be easily guessed, what can be left in a cab, and what can be chopped off."

Two Factor Authentication (2FA). Yubikey has not got the idea of usability (yet).  This guide  to it was recommended by Zeynep Tufekci. A good idea if you can get the hang of it (not on day one perhaps). Biometrics (including faceID and fingerprintID) look like being more trouble than they are worth, but if long passcodes for a fully-used smartphone are too hard, then they are probably better than nothing. Barton Gellman points out you can make this less painful with an all-numeric PIN: 11 digits or more provide strong security. Big advantage: you get the big-button number pad on the unlock screen. It has to be a truly random number. Your idea of “random” isn’t. [I am not an expert, but I suspect the randomness required and number of digits is a function of how much you are under threat from major adversaries.]

2. Locking phone
How much do you need to use your phone? Maybe it doesn't need to be a repository for your life. Android phones are not a good place to keep secure matters, whereas iPhones can be ok. Maybe you use a cheap feature phone for some / all of the time? Cheap alternative phone numbers sound a worthwhile investment.

SIM hijacking is a real and frightening thing.  My mobile provider (Three) has security questions that you can set up for when they answer the phone. Well worth doing.

4. Adblockers and browsers
Perhaps use Chrome with a particular Google ID for transactions that matter and a different browser for other matters. Your computer may not support two browsers open at once, because they are so resource-hungry. As regards Adblockers, I use Ghostery, happily. Opera has one built in. Chrome is going to get one fairly soon (from Google). Adblockers are worth it. Read Section C from DecentSecurity here.

5. Backups
Using the cloud helps but remember the cloud is short for 'someone else's computer'.  I haven't used Framasoft but it is an alternative to Silicon Valley. Sort out a device to do backups for any data that matter to you. ("you only need to clean the teeth you want to keep" - same thing with data and backups). Freefile sync will give you more capability than you need, is not too hard to learn, and is blisteringly fast. Also available as a Porteableapp. For important items such as photographs, it is worth investing in 'archival Blu-Ray' - an external Blu-Ray read/write drive is not that dear.

6. email accounts
Go and read the advice again.
Email client: You can use webmail for basic purposes just fine, but an email client means you have the emails on your machine (and can back them up). Chaos Intellect is a great client for PCs etc., it can run on a memory stick, and has a great approach to use on phones, It isn't free, but is well worth it - not least for the quality of support. If you are restricted to free, then the Opera email client might be a good choice. If you are into Chat, it can handle that as well.
You will need several email accounts. A Gmail account makes sense, as everyone has one. If your ISP offers email accounts, that is another. Then maybe Yahoo, or Zoho.  If you start to use Zoho seriously, you will need to pay a subscription, but you could do much worse.
@pogue25 recommends using disposable email addresses when you have to give an email address to a site that is bound to spam you.  This generates them.

Update: Ransomware
If you do get stung and locked out of your computer by Ransomware, then it is possible that the keys can be found here.

Applications
MS Office really likes to run macros - the major risk from dodgy email attachments. Unless you really really need it, don't install it. Use LibreOffice instead.
If you are going to be using other people's computers (or the ones at the library) to help you learn, then it may be a good idea to put applications on a memory stick. PortableApps is a bit more complicated to use than having applications installed on the computer - but only a bit - It reduces the demands on the computer and allows you to take just a stick with you. You can also install the Opera browser on a memory stick (or on your computer). It is pretty good, and then it would mean that your bookmarks travel with you easily. PortableApps include the Opera browser and email client but since these are the main applications, it might be worth installing them on the USB stick directly.

Photos on social media
The pace of facial recognition on social media is alarming. The Spartacus Hack may well be worth doing. Just put up some misleading pics and labels.

Further reading
There is good advice here and here. The do's and don't's here are for folk at higher risk than many (including break-ups and stalking), but the more you follow it, the safer you'll be. Advanced material here.

Does Autonomous = Small?

The Clyde Puffers had a crew of 3 and capacity of about 6 TEU

Wage bills have been a factor driving for ever-larger lorries and container ships. The transport companies have successfully externalised the  knock-on costs of ever-larger ports, depots, and warehouses, and the impact on city streets. Removing the wages bill could open the way to a radical reduction in size. The perennial problems of inter-modality could perhaps also be eased. Changing the scale of logistics could open the way to better 'last mile' operations.

Using cargo bikes to replace or complement vans is an example of the scope for changing scale, and thought is being given e.g. here for the need to standardise small containers (no I'm not proposing autonomous cargo bikes for city centres). Such containers will hopefully be compatible with urban mobility platforms on the lines of M.U.L.E (not the US military MULE project).

Thanks to  @thinkdefence there is a discussion of small container standards; see the section on JMIC. These would be great for mobility platforms but are not for cargo bikes.

The huge electric autonomous trucks being investigated in the USA may have a long-haul role there, but perhaps the real market is for something much smaller.

If delivery drones are ever to gain scale, there needs to be standardised landing pads, preferably palletised and compatible with small scale standard containers e.g. biscuit tins. 

More speculatively, we can envisage a 21st Century replacement for the Clyde Puffer; small Autonomous Ro-Ro vessels (Damen have some starting points), some Mexeflote where local infrastructure is missing, and M.U.L.E like platforms to local depots.

Operations at this more human scale are likely to be more sustainable, and with lower knock-on costs. The trick will be getting the incentives right for it to happen, supported by timely standardisation.

Update: Rio Tinto mining trucks going autonomous and smaller here.