Commonwealth Conversations: Technology

Using Social Networks in Regulated Arenas

Posted by:
Mason Ham, Integration Specialist, Information Technology Division

Social networking (SN) services have stormed on to the scene in the last few years. When first put into service, these networks, like the Internet, were intended and designed for “free access” communities which tacitly agreed to use the information for “good”. Over time the services grew and economic opportunities become available, even needed. In order for the social services to continue to grow, they needed to adopt more secure policies to protect their membership.

As with security for the Internet itself, these protections were afterthoughts that needed to be bolted on to a system that was designed to value ease of communication over security. Over time, these measures have alleviated some of the known issues, but they lack a common design throughout a given SN site or a group of SN sites. Individual rules for “best practice” use of each SN site need to be created.

Another major issue that regulated arenas need to address SN sites is that these sites are designed for ephemeral, time-sensitive, and transient interactions, very few tools exist to provide the kind of auditing, security, and recovery that is generally required inside regulated arenas.

The Promise of Social Networking and Social Media Applications

Social Networking sites allow individual users to create profiles and then “connect” to other people in the system. The sites consist of a “social graph” or a map of degrees of separation that connect all the users in the system. The power of social networking is this ability to enable differing levels of communication among the group as well as allow individual's to transverse this social graph to find other individuals to connect with.Corporations such as IBM and government agencies such as NASA have found that using social networking technologies in their work environments has allowed for greater collaboration and productivity among its workers.  Additionally, such organizations have utilized these technologies for interacting with constituents, customers, and recruits by creating a presence on public sites such as Facebook, MySpace, Twitter, etc.    

The Three Major Types of Technical Solutions In Today's Social Networking Arena

• Platform-the best exemplar for this is Twitter, their corporate strategy even states that the service is trying to be a “protocol” for other services

• Service-the exemplar for this type of social networking is Facebook
  

• Application-the exemplar for this is Jive Softwares Social Business Software

The service and application solutions are more closely tied than the platform solutions; they are generally used through a web browser and they have additional changes that can be used. On the other hand, the Platform solutions have no actual applications; instead, they rely on third parties to create the applications that end users interact with. A classic example is Twitter, which has its own website, but now accounts for very little of the traffic that is moving across it. Most traffic to and from the Twitter service happens through Smart Phone applications, desktop applications, and other third party websites. Also, the diversity of applications and their uses tends to be much higher in the platform space than in the other two.

What To Think About

In deciding if an organization should start to use social networking, three main groups need to be looked at:

• Org to Outside Constituents → this is the organization communicating with users

• Org to Org → this is the organization communicating with its partners

•  Internal → this is the organization communicating internally with its own structures

In all cases, some provision must be made for the lack of temporal permanence that all the current services provide. There are a few tools out there, but none that cross all solution types. On the other hand, none of the social networks are in the business of creating solutions for the regulated arena; they are all designed to solve the fast paced needs of the massive amounts of data generated by millions of people communicating their own personal micro-thoughts. Thus, these services do not consider their “job” to know who did what, when, and to whom. This is one of the first and most important aspects of social network engagement that must be addressed. The organization will be required to provide (either through purchasing or creation) a solution to track and achieve that type of information.

Another key issue that none of platform or services provide, is the ability to delegate. I most cases, if an organization is going to use the social services that are out there, they will want to create a work flow and approval process, as well as signing responsibility. These types of tools are just now being offered, and none are cross service/platform. That is, none provide the ability to control and monitor across service and platforms or applications.

Further Reading

The Challenges of Using Social Networking Technologies in a Corporation

http://darmano.typepad.com/logic_emotion/2009/08/sbd.html

The following are some influential thinkers in the social networking and social media space (not from a technical implementation perspective for regulated arena, but more from a “How can we use social networking tools effectively?” perspective):

Danah Boyd – http://www.zephoria.org/thoughts/

Sacha Chua – http://sachachua.com/wp/category/networking/

Andrew McAfee - http://andrewmcafee.org/blog/

Laura Fitton - http://pistachioconsulting.com/about-us/ceo-blog

Learning not to see

Posted by:
Sarah Bourne, Director of Assistive Technology & Mass.gov Chief Technology Strategist, Information Technology Division

New perspectives

You can unplug your mouse to see what it's like when you have a mobility or dexterity problems. You can turn off the sound to see what it's like when you can't hear. But it's a little more difficult to replicate the experience of being blind.

The human brain has a very strong visual bias. For instance, the thought of ordinary people using computers wasn't even imaginable until there was a graphical user interface (GUI.) Sighted people rarely realize how dependent they are on their vision because it's so central to how they do things. This makes it makes it hard to really understand how different web and other computer experiences are when you have a visual disability. Without this understanding, it's harder to learn and remember specific development techniques, which in turn makes it harder to integrate them with your other requirements.

The most common way of demonstrating assistive technology for vision impairment is to fire up a screen reader. This is very effective at showing that you don't have to be able to see to use a computer. However, this experience is frequently overwhelming to a visually-oriented person. They have to actively translate sounds into what they're used to seeing in a glance. This cognitive load, plus having to learn how to do it, makes it difficult for most developers to use a screen reader for ad hoc testing.

What does a screen reader see?

If you are a sighted person, you automatically scan a web page for clues: What are the different areas of the page? What's most important? It's the first step in creating a "mental map" of the page. You do this before even consciously thinking about things like, "What's in each area?" and "Where is the thing I'm looking for?"

The equivalent for someone using a screen reader is to listen to a list of the headings on a page. On a web page, they may alternately listen to a list of the links. These pieces of information give you an idea of what your options are. Screen readers have tools that allow you to jump directly to items in the lists, either headings or links. You could choose to have the entire page read to you, but it takes a lot longer and is rarely a first choice. Being able to navigate by headings and links means you can skip over the parts you don't care about, the same way a sighted person glances over parts of the page they don't care about.

Help for sighted developers

Fortunately, there are tools for desktop testing that can give a visual interpretation of what a non-visual user "sees" on a web page. If you find using a screen reader too difficult, you may be more comfortable using some of these for day-to-day testing. You can think of them as assistive technologies, compensating for your visual bias.

Microsoft Word

When you made your Word document, did you use headings, or did you just make it bold and bigger? You can easily see by viewing it in Outline mode, which allows you to collapse and expand sections to make sure you've used the proper heading levels and nested lists correctly. Or you can turn on the "Document Map", which does the same thing in a more abbreviated way, but can also be used to jump to those places in the document.

Firefox extensions for web pages

Some of my favorite desktop testing tools are available as extensions to the Firefox browser. They have a lot more features than I'm going to discuss here; I encourage you to look at them in more depth. You may be surprised at how much can learn about accessible development just by using tools like these.

• Fangs (https://addons.mozilla.org/en-US/firefox/addon/402/) provides a text view of a web page as a screen reader sees it. The first tab, "Screen reader output" shows what a screen reader would read, in the order it would read it in. Words that are in shaded boxes are things screen readers add to give more information, such as "link" and "graphic". The other tabs show a list of headings and a list of links. Blank lines on the link list mean that there is no text for it, which means someone using a screen reader won't know what it's for.
• Web Developer (https://addons.mozilla.org/en-US/firefox/addon/60/) has tools for "linearizing" a page (displaying it in the order a screen reader would read it in) and adding outlines around various elements, including headings and links. It can also produce a document map, which is very similar to the Word Outline mode.
• Firefox Accessibility Extension (https://addons.mozilla.org/en-US/firefox/addon/5809/) creates pop-up boxes to list links and headers. You can sort the lists by any of the information columns it provides. When you select an item, it highlights that element on the original browser window.

Do you have any other strategies and tools for desktop accessibility testing? We would love to hear about them!

SAI Interchange Goes Live

Posted by:
Stephanie Marsan, SAI Communications Manager, Information Technology Division

Commonwealth citizens demand access to an increasing number of online services and transactions.  These services must be fast, reliable and secure.  The challenge for the Commonwealth is to find innovative ways to provide IT services across multiple business concerns with a shrinking budget. Citizens will be better served by the creative and flexible use of Enterprise technology solutions and that is what the Shared Application Infrastructure (SAI) Interchange service has to offer.

So what exactly is Interchange?  The SAI provides Enterprise infrastructure and service solutions to agencies of the Commonwealth.  An integral component of the SAI offering is the Interchange service.  Interchange now delivers Enterprise services for agencies that require data files to be securely transferred between them and their business partners.

Why is this important?  Cyber challenges evolve every day and agencies’ free standing systems are under strain, outdated, too expensive to replace and constantly need to be updated. This is a financial burden for agencies that have limited budgets.  Executive Order EO504 has required agencies to have systems in place that protect citizens’ personal information identity from theft.  Agencies resources are consumed by security compliance requirements and their focus has shifted from supporting business needs to operational maintenance.

What’s in it for me? The SAI Interchange will provide agencies access to a centrally-managed system in a secure environment for applications that deliver sensitive data.  This will enable agencies to support their growing business needs, refocusing their IT resources from technology alone to their core business mission: providing citizens services that are fast, reliable, and secure.

The Interchange is just the start of securing a vision for Commonwealth technology that is flexible, centrally-managed, secure, efficient and able to deliver services needed and demanded by their citizens while at the same time saving money and time. The Interchange will improve system performance, reduce need for Capital funds and enable agencies to focus on their business and not on operational detail.

For further information on the SAI
Interchange please contact me at stephanie.marsan@state.ma.us

Transparency, Collaboration, Social Media and Open Data

Posted by:
Rich Wolverton, Senior Architect, Executive Office of Health and Human Services

 

There is tremendous interest in making governmental data public in useful ways that encourage and enable fruitful discourse on the manner and direction of public programs and government policy. One of the most visible is the Data.gov initiative at the Federal level. The technology behind these activities combines the collaborative underpinnings of the Open Source movement with the capabilities of Social Networking to share analysis and discuss insights. Of course when the data is about citizens, government takes seriously its stewardship of every individual’s privacy and confidentiality concerns. But there is a vast amount of non controversial data that is of interest and should be made available for use to the public in computer friendly forms so that interested party can access the information and perform their own analysis.  As a state, Massachusetts was an early leader in this activity with its MassCHIP Community Health Information Profile and MassGIS Geographical Information System mapping initiatives. These set an example by pushing data into the community in new ways that supported analysis and exploration. 

The next step is to not only provision and maintain relevant data in an Open Data Catalog but to provide sufficient infrastructure to encourage energetic online communities and creative new uses of governmental data. This means provisioning the data in accessible formats that allow immediate review or visualization in place and fairly straightforward programmatic interaction for new applications and analysis. MassDOT got the ball rolling by publishing bus and train schedule Application Programming Interfaces (APIs) and creating a developers challenge to encourage entrepreneurs to create new applications such as the OpenMBTA iPhone app.  

Some of the Open Source technologies and public standards that are being explored to foster this vision are:

Drupal Content Management System as a hub and host for first order presentation and community interaction.

OpenStreetMaps OpenLayers and Google Maps API for mapping visualizations. This is an analysis friendly precursor to the extensive and professional work done by the Geographical Information Systems group.

RFD, OWL and SKOS  as the building blocks for the Semantic Web that Kate blogged about and to provide interoperability of the Massachusetts’ Data Catalogue with other data catalogues

Data is just the raw materials for the Information Age. One of its beauties lies in the possibility of reusing it multiple times and in a variety of ways at no additional cost if we just make it available. Please join the conversation by suggesting other technologies that should be explored as we go forward and other data collections that you might find of interest.

 

Think Before You Link. A Look at Social Media and InfoSec

Posted by: 
Jess Weiss, Project & Social Media Coordinator, Mass.gov and the 
Enterprise Security Office, Information Technology Division

Once upon a time, a state agency wanted a more nimble way to communicate with the citizens of its fair land. The agency believed that directly engaging in dialog and discourse would help them meet citizens’ needs. A blog, they thought, would facilitate that goal.

But the Knights of the kingdom were cautious. They understood what strong tools blogs were. They used them frequently. They also knew that blogs could lead to invasion. An evil-doer, or perhaps just a careless soul, could infect their own computer, the computers in the castle, or even the computers across the land, by linking to malware, viruses or worms. A compromise must be found, they thought…

All kidding aside, there are real security challenges presented by social media use. Social media encourages real time conversation; it also creates real time social media threats. Social media has been connected to several security breaches around the world. Hyperlinked text in blog comments, shortened links on Twitter and worms embedded in Facebook images all create security risks. 

Additionally, unlike email, which we host and monitor in-house, most social media tools are hosted by third parties. We get very little insight into their security practices and systems. 

There have been many different responses to the information security threats posed by social media. We believe it is crucial to undertake some strategic steps to help mitigate these risks. Taking these steps helps us fulfill our very real responsibility for protecting computer systems both inside and outside our firewall.  

Here are a few tips and resources to help reduce the likelihood of social media security threats:

• Expanded links: Expanded links are those where you can see the website domain. For example, www.mass.gov/socialmedia is an expanded link. But sometimes even if you can see the domain, you may not know what is on the page you are linking to. To help you figure out whether a link connects to a virus, malware or other threat, please use these expanded link scanning tools.
• Shortened links: Sure, those shortened links save space in Twitter. Bit.ly, tinyurl, ow.ly, is.gd. They are everywhere. But, they present an additional security risk because they hide destination URLs. To confuse matters even more, the link checking tools mentioned above only check the service that does the shortening, not the shortened link itself. To get around this problem, please use one of these shortened link scanners. 
• Think before you click: Just as with email, it is important to think before you click. We like to believe that everyone who engages in social media is interested in sharing valuable, helpful content. But, current statistics demonstrate that spammers, scammers and phishers are using social media to gain access to your valuable private information. Follow these cyber-security tips when using social media to help protect your online experience. And be sure to follow our Enterprise Security Office on Twitter!

We would love to hear your thoughts about how to balance security challenges with the openness of social media. Let us know!