A brief look at the state of affairs and a few recommendations

Sorry for the hiatus. I *really* wanted to write more here, it just wasn’t possible.

To make it up, this one is a fairly long one, despite taking an axe to the original draft. 🤣 I hope you like it, and don’t hesitate to ping me if you want me to expand on any areas that I have deliberately kept brief.

Enjoy!

Within the last ten to fifteen years, there has been an almost exponential growth in the use of the internet in the Caribbean. Typically internet use had been lagging behind that of many parts of the world. This dramatic change has occurred rapidly and, unfortunately, without the guardrails typically developed during the progressive adoption of the Internet. The Caribbean has gone from a tiny percentage point in adoption to nearly 70% of the population, totally skipping the progressive uptake as we have seen in the US, the UK and the EU.

Internet use in the Caribbean is primarily through a mobile contract, with more mobile phone connections than people in the region. Many people have two or more mobile phones, often with data connections. And even though mobile internet in the Caribbean remains relatively expensive, with certain caveats, mobile internet usage is greater than that of fixed broadband use and is, for many, the only way they interact with the internet through apps or social networking. Once a subscriber gets a smartphone and a data connection, there is an almost 100% signup rate for social media such as WhatsApp, Facebook and Instagram.

As our lives and the economy surrounding us become digitalised with ever-more products, services and processes moving into the virtual world from the physical world, so does the threat of misconduct. In the same way that crime has followed —and, in some cases, driven innovation— our lives are under pressure from actors worldwide that target us based on our weaknesses. The potential for harm is significant, from losing money to becoming unwittingly part of an organised attack on larger targets like state attacks. As the economies of scale of internet use and online life increase, so do the economies of scale of potential for crime.

This has not gone unnoticed, and small businesses and the public are starting to emphasise protection, detection, and clean-up tools in much the same way that we in the Caribbean are aware of environmental and natural disaster risks and planning accordingly. It is estimated that the biggest spenders on cybersecurity over the next three years are micro-sized and small-sized businesses – the backbone of companies in the Caribbean which are estimated to be somewhere in the region of 95% of businesses in Latin America and the Caribbean.

Cybersecurity in the Caribbean is at an early development stage, and specialised service companies that fill the requirements are few and far between. Small businesses and the public need specialised help at affordable costs to ensure they do not fall victim to cybercrime.

Read on.

The Caribbean Context

It will come as no surprise that Cybersecurity is fast becoming one of the most pressing issues for business and society in the coming years. The Caribbean perspective is no different from that of the rest of the world; however, certain specificities make the challenge more delicate and need particular attention.

The distributed and only somewhat-collaborative nature of the Caribbean (the CARICOM members) and the fractured nature of the regional geopolitical situation (French, Spanish and Dutch West Indies sharing the space with the English West Indies) require a more integrated, collaborative and subtle approach.

For the most part, the larger countries in the Caribbean have tended to follow patterns seen in larger countries worldwide. They have become more outspoken in their knowledge and response to the region's cybersecurity issues. As companies in the Caribbean have become more visible to the broader world, thus increasing risk, governments, businesses, and citizens alike have become more aware of those risks and of the need to implement adequate protection systems to fight unwarranted incursions.

There is an increase in risk proportional to the rate of economic development; thus, as the Caribbean becomes more developed, cybercrime becomes a more viable means of extracting money from any unwitting community simply because the perceived potential financial gain is much more significant. Cyber malfeasance is a business! Pure and simple.

Case Study: Costa Rica – State of Emergency

Regrettably, Costa Rica recently saw this when it had to declare a state of emergency after multiple government agencies fell foul to a Conti ransomware attack. Not only had data been rendered inaccessible by AES-256 encryption and an attached US $10 million ransom (subsequently raised to US $12 million), but government data had been extracted over several months and later leaked openly when the government refused to pay the initial ransom demand. As of late April 2022, some 97% of a 672GB data dump was publicly available. Fears for the extent of data included have mounted, and so far, no review has been ordered to determine the risks for citizens and businesses of Costa Rica. But as some of this data appears to have been extracted from health systems, customs systems and other government systems that deal with payments (Social Security and Social Development), the fear is that many may fall foul of the spread of this data in the coming months and years through phishing the general public or through highly targeted attacks on influential or wealthy individuals.

The Trinidad and Tobago Cyber Security Incident Response Team (TT-CSIRT) recently observed a sharp increase in malicious cyber activity targeting local and regional entities.¹ The TT-CSIRT urges all entities (public and private) to adopt a heightened state of awareness.

The Caribbean has been slow to acknowledge cybersecurity threats to the region. A lack of data and measurement has meant that many successful attacks on business and government have gone unnoticed by the population, exacerbated by a culture of silence. No high-profile witnesses have spoken up about their experience dealing with the initial phases, legal process, and clean up after an incident. Fear of damaging customer confidence is partly responsible for this; however, this only leads to less information on how cybercrime affects the region. It would be safe to say that what is reported is only the tip of the iceberg and that cybercrime is much more prevalent than is generally known.

Recently, governments and institutions have made more effort to address the issues, including public awareness campaigns and working with international NGOs to develop a better cybersecurity posture for people and businesses alike. One example is Get Safe Online. Get Safe Online operates through a network of Ambassadors that organise in-the-community training using the tools and training materials developed by the organisation.

Legislation and cybersecurity strategy

When it comes to cybersecurity law, the picture is not much better. Saint Lucia, for example, has an “in development” National Cybersecurity Strategy, and despite taking the lead compared to its neighbours in the OECS, it somewhat lags behind the international community. Barbados is another country with the ongoing development of cybersecurity legislation. The most significant barriers to establishing and implementing legislation are government capacity and political willingness. A government like Saint Lucia’s faces challenges on many fronts, stretching resources beyond capacity. A general lack of world-class expertise is also apparent in the region, coupled with a general feeling that cybersecurity is only an ICT responsibility, making cross-government and cross-sector priorities challenging to place at the top of the list.

In the wider OECS region, only Saint Vincent and the Grenadines has specific cybercrime legislation with the Cybercrime Act of 2016. In other countries, cybercrime is regulated under Computer Misuse Acts or Electronic Crime Acts. They are primarily focused on how technology is used to commit crimes without explicitly addressing cybersecurity and how to deal with attacks on information systems. Questions remain on the capacity of countries to adequately prosecute this type of crime which relies on having sufficient infrastructure, personnel and accompanying judicial systems. Many lack the right equipment, software, and training to identify cybercrimes correctly.

Regionally, CARICOM IMPACS has sought to establish harmonised standards of practice, expertise and systematic treatment of cybercrime. It has additionally targeted infrastructure capacity-building to increase crime detection, law enforcement investigation and prosecution. RSS, or Regional Security System, is another organisation with a mandate to prevent and defend against cybercrime that has limited scope for responding to cyberattacks, somewhat because of a lack of harmonisation of policies regionally. Like many regional organisations, they, unfortunately, lack funding and capacity to respond adequately to the modern threat landscape.

What about CSIRTS?

Similarly, the state of Cyber Security Incident Response Team (CSIRT) development in the Caribbean lags behind the South American continent and the broader region. Only Barbados, Jamaica and Trinidad and Tobago have implemented funded and functioning CSIRTS. Suriname has restarted a program after having abandoned it a few years ago.

The impact

Small and micro-sized businesses are the backbone of the private economic structure of the Caribbean, and it is precisely these businesses that are the most vulnerable and the least resourced to deal with the complexities of digital security requirements of today. This has been substantially exacerbated by the COVID-19 pandemic, in which new expectations by employees on how, when, and where to work are becoming normalised. Working from home and the expected turn towards a flexible hybrid model for workers have widened the security exposure for companies. In other words, attacks do not need to target one specific network to gain entry to a company; many distributed networks are potential threats. This makes it difficult for understaffed, undertrained and crucially under-financed IT departments to manage such distributed networks in physical and technological terms.

Whilst cloud computing is still in the early development stages in the Caribbean, not all businesses and administrations are advancing simultaneously. Some are more advanced than others, having moved not only low-hanging fruit applications like email and accounting to the cloud but have embraced the possibilities that cloud computing offers, shifting line-of-business applications and identity services and other business-critical services off the on-premises systems. Moving to the cloud changes the security exposure for the entity in question, requiring specialised knowledge to best protect and monitor for breaches and unplanned downtime.

The COVID-19 pandemic has left MSMEs with budgets for investment at historic low levels. MSMEs are typically small businesses with more pressing day-to-day issues, such as immediate revenue generation to pay the bills. With existing relationships with telecom providers, the telecom companies will likely provide cybersecurity offings soon, given the network-based nature of the threat.

The threat landscape (non-exhaustive)

Understanding global threats and their provenance will also play a prominent role in understanding the landscape and developing solutions to minimise those risks. The most common threats to small businesses and administrations in the Caribbean are estimated as follows:

1. Ransomware

Immediately after a successful penetration of defences, a small application sits in background tasks on the infected computer or computers, slowly encrypting data using a virtually impossible-to-decipher encryption key. Once the data has been fully encrypted, the user is alerted that the data is now inaccessible. A ransom of a significant amount is required to decrypt the data and allow access once again.

2. Social Engineering or Phishing

Social Engineering or Phishing is a psychological technic to garner an employee's confidence in a company or government office and then exploit that confidence to extract information or gain access to restricted data. It is often the method used to deploy ransomware and is the weakest link in the armour of cybersecurity.

3. Internal malicious intent

Although relatively rare by most counts, the risk of a disgruntled employee with access to confidential and vital data is manifest. This can be highly disruptive to a business or administration. For example, employees on social media displaying discontent can be the target for exploiting weaknesses to enter a network.

4. Poorly configured and patched systems

Even the best firewall is only as good as its configuration and patch level. Poorly configured or outdated firmware in IT equipment is a regularly exploited vector for entry into the target network.

5. Poor credential hygiene

Easy-to-guess passwords, not regularly changed passwords, and sensitive data with poor access controls are easy targets. Sparse use of two-factor authentication also plays a role in allowing those that should not be permitted.

Mitigation Strategies and Policy Guidance

The following is just a small sample of the opportunity to improve the threat landscape in the region. If you’d like more detailed advice, please let me know.

Invest in the expansion and capacity-building of CSIRTs and regional cybersecurity organisations

Only with adequate and ongoing funding will the diverse region be able to fully appreciate its desire to develop world-class cybersecurity services protecting the public of the Caribbean. We would recommend regional, local government, NGO and private sector funding be increased substantially and rapidly. Events in Barbados, Trinidad and Tobago and more recently in Martinique show the threat is here and the consequences substantial.

Development of affordable managed services for the region

Security software of the past that required an initial purchase, installation and configuration to become fully operative and successfully manage that threat cannot deal with today’s ever-changing security threat landscape. Capital purchase of security software is no longer adapted, and the business model has changed.

We recommend that a managed service provider (MSP) starts with a small but highly specialised team incentivised and remunerated on contract signups and renewals. As the business grows, so can the team and the incentive structure.

Develop and deliver targeted education for users, managers and decision-makers

As with much in life, better education is the key to fundamentally understanding and acting on the current context. There is, sadly, not enough specialised education in the region for the general public to fully understand the implications of good cybersecurity practices. Although organisations such as Get Safe Online have been doing some of this over the last few years, we recommend that governments and NGOs invest in developing local training and awareness on specific cyber security issues, such as protecting smartphone use on the internet.

Develop targeted and highly focused services designed for MSMEs

Customers need to quickly see the value of the offering and be onboarded rapidly and without difficulty. Time spent designing simplified services and automating the onboarding process for the customer will allow the customer to take advantage with less apprehension. Particular attention should be given to building modular services, allowing flexibility in the offering tailored to the customer and not the supplier.

Understand where existing services lack and fill those gaps

Conducting a gap analysis of the state of cyber defences in the Caribbean, looking at the state of government or law enforcement’s resources and role in cybersecurity, including participation from the private sector. This will likely identify complementary areas of interest, encouraging the broadest and most efficient development possibilities.

Develop Security-as-a-Service offerings sold as insurance policies

Just as we have cyberattack software as a service, we should have Cybersecurity as a Service. Software as a Service (SaaS) has been a great enabler for small businesses to use enterprise-grade software that was previously out of reach financially and technically. So it should be for cybersecurity. Providing a service offering akin to an insurance contract (leaving the details of the included/excluded services outside the scope of this report) would allow MSMEs to strengthen their defences in the most cost-effective way.

––––––––––––––––––––––––––––––––

¹ https://ttcsirt.gov.tt/threat-alert-2022/

If you liked (or not) this article, please leave a comment:

Leave a comment

Don’t forget to:

Share The Future is Digital

Writing a paper for an International journal resulted in a better understanding and stopped me in my tracks.

Excuse the rambling. This is written in the true sense of blogging, and it started life as a short blog post idea, transforming into this, for what it’s worth. So I decided to cross-post it here first. I’ll publish it verbatim on my blog soon. That blog is another outlet for my brain, and not exclusively about matters digital.

I wrote a paper proposal for an international hotel industry journal sometime last year. My proposal was accepted, and I started writing in earnest. The paper had a deadline, and I was on track to finish on time, which is extremely rare for me. Sadly, that went south as I progressed and began to formulate a more complete picture of the technology I was writing about and its origins.

The title was:

Is Web 3.0 the next great opportunity in tourism?

The introduction goes like this:

Since the advent of the commercial internet, businesses in the travel and tourism industry have harnessed technology to promote their destinations. Some early tourism websites tried, in vain, to replicate the marketing materials traditionally used to promote destinations, mainly hotels.

This “copy and paste” methodology was seriously limited due to the underlying factors that meant that media-rich websites were near unusable for those with dial-up internet at 56kb/s and invisible for the majority who had not yet become connected to the internet. These simplistic lists of hotels and tourist attractions displaying available amenities neither incited nor informed potential visitors.

Broadband’s wide deployment and adoption enabled a new generation of technologies that would later be named Web 2.0. These technologies allowed media-rich websites to be developed. Many hotel websites today not only market properties in attractive ways but also allow potential visitors to reserve rooms, pay for their stay, and in some cases, simplify check-in and check-out, all achieved automatically without any interaction with reception staff. Today, many of the technologies of Web 2.0 allow hotels to generate first-party data for use elsewhere in their business. For example, for marketing, demand generation or even stock control. It allows benchmarking against other hotels within the same group or in comparison to similar competition. The distinction is important, and it separates these businesses from others that operate through travel agencies, typically providing little or no valuable data for such purposes.

Today, we are at an inflexion point where technology is evolving rapidly, and the adoption is accelerating and becoming more democratised. Technologies like Blockchain, Augmented/Virtual Reality, digital money (through tokens and CDBCs), and the metaverse can allow businesses in the travel and tourism industry to take advantage of this shift. It enables better value and faster client discovery. For example, several key performance indicators, such as the technology acceptance model (TAM), perceived usefulness (PU) and perceived enjoyment (ENJ), showed how virtual reality helped maintain potential visitor interest in destinations cut off by the pandemic and how that technology affected the tendency to visit the actual site (TenAS) (El-Said and Aziz, 2021).

This paper will discuss these technologies and how they may be harnessed so that visitors and non-visitors alike can be incited to visit destinations around the globe, thus generating value for the tourism industry.

Do the new technologies of the Metaverse and web3 provide opportunities for the tourism industry?

Specifically, the following research questions will be addressed:

1. What are the new technologies, and how are they used?

2. What are the opportunities and risks associated with this technology?

3. How can the tourism industry best utilise this technology to its advantage?

The paper’s structure was pretty classic in that there is an introduction (see above), a discussion on what web3 is, a literature review, and a discussion ending with conclusions. All sections are researched and backed up with examples and references.

A lot of it has already been written. Sadly, I started this at possibly the worst possible time for the technology, as it coincided with when web3 began to be exposed for the smoke and mirrors it turned out to be.

I couldn’t faithfully finish the paper as I was becoming increasingly sceptical about the fundamentals of web3, its purported merits and far-right origins. How could I write such a paper and stand by it when I didn’t believe or support most of it?

I have always been crypto sceptical, but I have kept an open mind on blockchain tech and have publicly said so on several occasions here and as a guest on various podcasts. No longer. I’m no longer much of an enthusiast about it.

How did I get here?

Writing a paper is nothing like writing a blog post or firing off a simple observation on social media. For one, papers are generally peer-reviewed before publication. That process starts at the proposal phase, and my proposal didn’t pass on initial inspection, requiring some changes to be considered for publication. Peer review is brutal. If someone doesn’t like or agree with you, they’ll tell you straight and point out why with facts, observations and references as to where you are wrong. When diving deep into a subject, you can quickly build a cognitive bias and eventually see things that aren’t necessarily there or see something that you wish was there (wish casting). During peer review, this is spotted and called out almost immediately.

Secondly, as I researched deeper into the world of web3, I found more things that I couldn’t agree with. It made me uncomfortable and left me dealing with cognitive dissonance. Cognitive dissonances never end well. One example of the things I was struggling with was the criminal amounts of energy wasted by one of the most useless technologies ever conceived. Blockchain. Without getting into the technical details, some blockchains use what is termed Proof of Work. Linked is the Wikipedia article on what that is. Take the time to read it. Reread it if you have already. I refer to it as Proof of Waste, as I have concluded that it is a more accurate term. Blockchains waste disgraceful amounts of energy on slow validations that could easily be done with existing database technology for a fraction of the cost and an order of magnitude faster.

Yes, I know that the new shiny kid on the block is Proof of Stake, and its energy consumption is vastly reduced. But it also goes directly against a central tenet of web3, decentralisation. Proof of stake puts power into the hands of the most invested (as in money). That sounds very distributed and democratic to me. The EU has recommended that Proof of Stake be used instead of Proof of Waste, threatening an outright ban on it. Only one high-profile cryptocurrency has completed the move to Proof of Stake, taking over eight years in the process.

But here’s another aspect that many seem to have misunderstood. Blockchain is directly against the law in the EU, as outlined in the General Data Protection Regulation (GDPR). Of the advertised “advantages” of blockchain is immutability. Blocks are Immutable, i.e., permanent. This is illegal in the EU because the GDPR mandates that people have the right to correct errors and rectify false information through due process. Blockchain doesn’t (can’t) do that. Data on the chain is not erasable. Likewise, illegal. Blockchain prevents ledger data from being deleted. That data is part of the chain. Break the chain, and you break the system.

Then there’s the whole thing of NFTs or Non-Fungable Tokens. What a scam! Personified recently by a certain DT, camply cosplayed up as various imaginary Superheros, and a grift so big it could probably be seen from space.

For the paper —getting back to the subject— I’d thought about how destinations and hotels could mint tokens and sell them as souvenirs. I still quite like the idea and think it has some merit, but the ecosystem is not yet there. Regulation is missing. How do you display them? Can you resell them? What governs gains, losses, and value? Do people really want to virtue signal they’ve been to Bali in this way? How do you prevent grifters and scammers?

For the moment, NFTs are essentially simple pump-and-dump scams that prey on the unsuspecting, the vulnerable, and the plain stupid. I don’t think that is a morally acceptable way to run a business. But then again, I’m not a thief.

On the energy aspect, with energy costs rising and no near-term solution to the impending climate crisis, any project that adds to the planet’s burden should be considered illegal. Yes, you can say that my words here are useless and use energy wastefully in their production, distribution (email) and reading. That’s true. But wake me up when this uses the amount of energy of a small European country, and I’ll gladly stop. Wake me up when the sum total of all the WordPress blogs on the internet reaches the same energy levels as that wasted by Bitcoin to “prove” your magic bean is worth something. And don’t forget that there are literally hundreds of thousands of other magic beans out there too!

They presented some of the systems they’d built and yep, we were impressed. Then, with the startup CTO in the room, one of my fellow engineers asked the key question: “All these systems, are there any that wouldn’t work without blockchain?” The guy didn’t even hesitate: “No, not really.”

The above is taken from a blog post by Tim Bray (AWS). Pro blockchain or not, you should read it as it nicely sums up blockchain’s uselessness.

Even more sinister…

Back to the paper. During my research, I happened upon the following book:

The Politics of Bitcoin: Software as Right-Wing Extremism

Here’s an extract:

By far the majority of interest in Bitcoin came from technologists and those who follow and admire the work of technologists. To those of us who were watching Bitcoin with an eye toward politics and economics, though, something far more striking than Bitcoin’s explosive rise in value became apparent: in the name of this new technology, extremist ideas were gaining far more traction than they previously had outside of the extremist literature to which they had largely been confined. Dogma propagated almost exclusively by far-right groups like the Liberty League, the John Birch Society, the militia movement, and the Tea Party, conspiracy theorists like Alex Jones and David Icke, and to a lesser extent rightist outlets like the Fox media group and some right-wing politicians, was now being repeated by many who seemed not to know the origin of the ideas, or the functions of those ideas in contemporary politics. These ideas are not simply heterodox or contrarian: they are pieces of a holistic worldview that has been deliberately developed and promulgated by right-wing ideologues. To anyone aware of the history of right-wing thought in the United States and Europe, they are shockingly familiar: that central banking such as that practiced by the U.S. Federal Reserve is a deliberate plot to “steal value” from the people to whom it actually belongs; that the world monetary system is on the verge of imminent collapse due to central banking policies, especially fractional reserve banking; that “hard” currencies such as gold provide meaningful protection against that purported collapse; that inflation is a plot to steal money from the masses and hand it over to a shadowy cabal of “elites” who operate behind the scenes; and more generally that the governmental and corporate leaders and wealthy individuals we all know are “controlled” by those same “elites.”

David Golumbia continues to outline how Bitcoin embodies extremist ideologies through Cyberlibertarianism and Internet Exceptionalism frameworks. Simply put, governments should not regulate the internet, and the internet is different and can’t be governed by mere mortals that don’t ‘get it’. This is in line with the extreme right’s ideology, which has brought us to world war, mass ethnic killings, and, more recently, the genuine possibility of a wholesale destabilisation of society. Linking these ideas to the Tea Party, the John Birch Society and conspiracists like David Icke and Alex Jones, the book does an excellent job of showing how the definition of “freedom” is less clear when you question it more robustly. Presciently, he mentions how some public figures do not necessarily outwardly declare their adherence to these ideologies but have demonstrated just that. Elon Musk is one such specimen. There are others, but take note of the ongoing (December 2022) train wreck at Twitter for context. Another article cited in the book is that of Langdon Winner (1997). A must-read, in my view, in which is discussed a personality not talked about much outside Silicon Valley. Ayn Rand. She’s a darling of Silicon Valley but was almost certainly a sociopath. If you have access to the BBC, watch “All Watched Over by Machines of Loving Grace” to better understand her and her effect on the Silicon Valley mindset and culture.

To these people, freedom always seems to mean the freedom to do “what I want”, without regard for others.

The Politics of Bitcoin is short —70-odd pages— but I highly recommend it. If you are from a technical background, like me, this will provoke thoughts and perhaps challenge some of your preconceived ideas about tech in the 21st Century. You don’t have to agree, but disagreeing through knowledge is infinitely better than a position to the contrary through ignorance.

Final thoughts

The tourist industry is already under scrutiny for its environmental effects, from ecosystem-damaging hotel developments to carbon waste (mostly travel). I didn’t want to be the author of a paper that promotes or encourages damaging consequences through needless and scam-enabling technologies like crypto and NFTs. Especially not just because it is “cool stuff”. I didn’t want to be part of a group that ignorantly legitimises innovation to extinction.

There may be a future for NFT-type spin-offs once regulation and other parts of the ecosystem are ready, and blockchain might evolve to become genuinely useful. But I suspect that evolution to look remarkably similar to database technology we’ve had for decades.

This experience was enlightening, and I wouldn’t change it for the world because it helped me come to a better, more nuanced understanding. In the near future, I may propose a different paper, although I suspect it might not be accepted. We’ll see.

Share The Future is Digital

Have a great holidays, and I’ll probably write some thoughts in the new year.

Take a peek here...

Rather than whine about how I’ve been busy and haven’t had the time or resources to write too much for this newsletter, I thought I’d share a few of the things I’ve been doing so you can get up to speed. Forgive me for the shameless self-promotion.

I’m currently writing an article on tech regulation. I’m looking at it from a different angle that I think will be interesting. I’ll share it here as soon it is in a decent state.

Reports

Firstly, I co-authored a report for USAID Eastern and Southern Caribbean Mission, entitled “DIGITAL ECOSYSTEM COUNTRY ASSESSMENT (DECA) Eastern and Southern Caribbean”

It can be found here and is publicly available to anyone.

I’m immensely proud of the report I co-wrote with a wonderful team. We were 100% online and have still never met in person. Despite this challenge, I think we were all able to put together out some great work within the limitations of the context, but also the limitations a report like this naturally imposes.

We were able to pair it down to 121 pages (don’t be put off, it’s straightforward to read). In reality, we could have all produced around 120 pages each!

From the report, the main findings:

PILLAR 1: INFRASTRUCTURE AND ADOPTION

The broadband and mobile infrastructure for the region is generally good. While networks have appeared to stand up to increased utilization during the shift to online work and school, the COVID-19 pandemic exposed gaps in access to and affordability of the internet. Leveraging universal service funds, testing last-mile technologies, and exploring innovative policy approaches to increase competition could help make mobile data and internet access more inclusive and affordable. Coordinated action across the region may reduce vulnerability among excluded communities and foster online education, training, and work opportunities.

PILLAR 2: DIGITAL SOCIETY, RIGHTS, AND GOVERNMENT

With emerging activities rolling out under CARICOM’s Single ICT Space initiative and digital transformation projects across the region, development actors including USAID can support and coordinate complementary activities. For example, the cybersecurity action plan developed by the CARICOM Implementation Agency for Crime and Security (IMPACS) can strengthen the institutions and systems needed to support digital transformation efforts. With digital identity initiatives, data privacy concerns and misinformation starting to arise in the region, civil society and media play an increasingly important role in fostering institutional accountability. Supporting civil society and media to engage on emerging issues could foster robust and safe engagement for citizens, as digital transformation progresses.

PILLAR 3: DIGITAL ECONOMY

The region boasts some of the first adopters of central bank digital currencies and efforts to utilize new digital financial service technologies. While there have been recent set-backs, particularly with the Organization of Eastern Caribbean States (OECS) DCash pilot, efforts to responsibly pilot new FinTech solutions will inform the global community working to strengthen financial inclusion and resilience. The tech startup environment is steadily expanding. Startups are emerging in myriad sectors, yet entrepreneurs struggle to find investors comfortable with investing in technology solutions. Youth interested in tech have limited options in the formal education system to develop digital workforce skills. E-commerce offers a promising avenue for the region to connect to larger markets and foster innovation. Although the COVID-19 pandemic accelerated e-commerce uptake across the ESC, it continues to be hindered by suboptimal digital payment systems, and the absence of a region-wide strategy and supporting legislation.

I’d like to publicly thank Chelceé, Amy, Ariel, Samantha, Mansfield, and the teams at DAI and USAID that contributed.

I have continued work on the Trade Enhancement for the Eastern Caribbean (TEECA) project. I recently wrote a report on the state of Cybersecurity in the Caribbean and the opportunities in that field. The report is private, but I intend to write something here in the coming weeks.

For the same project, a couple of other reports providing guidance on the tools and services MSMEs can use to leverage cloud and automation have also been provided. Again, these are private, and I cannot share them. As these are pretty focused on the companies involved, I’m not sure I can add much value here in this format. However, if you would like to have some thoughts about those tools and how they can be leveraged, let me know in the comments, and I’ll see if there is enough demand.

I was asked to peer review an upcoming report, and I can say that it is an excellent start and something to look out for when it is out. I’ll let you know, but I can’t say more than that now.

The other big project I’ve been working on is taking shape, and I’d love to share more details about it in the coming weeks.

I’ve been working with a partner, and I think we’ve solved some problems with these reports. This information is so valuable to business that we’d like it to be available to anyone who needs it. That’s the first clue. Don’t ask for others. 😉

I nearly finished a paper on the travel and tourism industries’ potential use of web3 technologies but didn’t finish in time. As I was writing it, the space became very fluid, and the bottom dropped out of many of the (obvious) Ponzi schemes, making my analysis very difficult in such a fast-moving (and not in a good direction) environment.

I’m thinking of picking this up again and re-thinking through, now things have largely settled - or at least the big issues have calmed a little unless some billionaire shitposts something that stirs it all up again!

Podcasts

Since I last published, I have spoken on several episodes of the ICT Pulse Podcast. And today, the latest one is out, where I discuss the USAID report. Please go check it out.

For your convenience, here are all the episodes I’ve featured (latest on top):

ICTP 227: Are we there yet? Understanding the Caribbean region’s digital ecosystem and how developed it is

ICTP 187: Artificial Intelligence, key emerging issues and opportunities, with Matthew Cowen

ICTP 181: Internet Exchange Points and the data scarcity challenge in the Caribbean region

ICTP 160: Understanding how technology perpetuates bias, with Matthew Cowen, of dgtlfutures.com

ICTP 133: Confusing smart with digital, and the challenges of achieving innovative disruption in business

ICTP 080: Discovering Martinique, with Matthew Cowen of dgtlfutures

ICTP 054: Community Chat on ride-hailing services. Can they complement the public transport system in the Caribbean, and what might be their social impact?

I also spoke on the excellent Innovation, Agilité & Excellence podcast with Jean-François Nantel and Éric L’Heureux. This is recorded in French along with my silly accent 🤗. Links here (latest on top):

Épisode 66: Échanges croisés sur la transformation numérique avec Matthew Cowen

Épisode 47: Web 3.0, IA et Blockchain avec Matthew Cowen

Épisode 13: La transformation numérique avec Matthew Cowen

Presentations

A while back, I had a chance to meet with Amazon Web Services in Martinique. We chatted, and I was asked to do a quick presentation on the context of the Caribbean and how it is essential for MSMEs that wish to undertake moves towards Cloud Computing.

I’m waiting to see if the video is available. As soon as I know of a link I’ll share it here.

In the meantime, if you’d like to get a copy of the presentation slides, I’d be happy to post them here with the main talking points annotated. I think the information is useful and quickly gives you an overview of the salient points.

The next presentation share is an older video of a presentation I made for the aforementioned TEECA project. I share the results of an Opportunity Study I wrote back in 2020/2021. Again, I think this is a good summary, and although some data has changed since then (mostly improved), it gives you a good idea of the market in the Eastern Caribbean.

YouTube link here. (French)

Other stuff

I teach Informatique and English (1st year) at Vatel Business School in Martinique. Vatel is an international hospitality management school, and it is a privilege to share some of my experience and knowledge with the bachelor’s students.

Despite its best efforts to make you hate it.

In a departure from some of the writing I’ve done here, I thought it would be interesting and perhaps helpful to mention how I use Twitter and how that keeps me a little more protected from the dreadful content and commentary that is so readily forced onto your retinas.

It starts with using the right tools and then unfollowing everyone. (Well, not “everyone”, but most accounts). Then with judicious use of the largely misunderstood and unused tool on Twitter, the experience is much better and more productive for people like me who primarily use it as a research tool.

How to use Twitter

Let’s face it; Twitter is a hell-hole. You don’t need to be on it too long to discover this. I could (maybe I will one day) get into an extensive discussion on moderation vs privacy vs free speech, a veritable minefield if there ever was one. Despite my urges, I’ll resist.

It is also worth noting that I don’t use it for, let’s charitably call it, performative art. Virtue signalling (or empty boasting), attention-seeking and other forms of engineering to be the centre of attention are anathemas to my personality.

So armed with this, many years ago, I decided I would use Twitter for my research and resist use for entertainment and Doomscrolling. I needed to implement a mechanism that would help achieve these goals. I’m on the inattentive spectrum of ADHD, and Twitter is pretty much Kryptonite for people like me… and me. It contributes hugely to procrastination and losing focus, or, better put, moving the focus from the things that need to be done to the interesting things in the moment, inevitably leading to falling down the rabbit hole.

I’ve been on the platform since 2009. I could see its possibilities for community and exchange of ideas back then, which I would hope, is its future post-Elon Musk. I think the future of social networks is more akin to distributed autonomous organisations or DAOs than the monolithic model of social networks today. As humans, we’re just cabled to interact with thousands or millions of people in a day. We didn’t evolve that way. At best, we had immediate family and a few friends. For most of us, the maximum amount of people we’ve been in close contact with is at school, a large business or a conference. That’s why when you go to a big conference (I was a regular at one that had over 20000 people each year), it’s overwhelming at first until you get your bearings and you start to filter out the stuff you don’t need to see and concentrate on the things you do. I’ll try to write up a little more on that idea in the future, but one name springs to mind, Dunbar.

Back to Twitter, I ignored the potential downsides because the user base was almost exclusively tech at the time, and it intrigued me where it could go. Rose-tinted glasses. The reality turned out quite different.

One thing I did do from the beginning was use a third-party Twitter client. In those days, Twitter was web-only, which didn’t appeal to me. For some reason, I’ve never liked web apps. I can’t articulate why, but something feels “off” for me when I use them. I still use a third-party client, Tweetbot, on both iOS and macOS. But I have used Twitterrific and Tweetie —the first third-party iOS app for Twitter and invented the pull-to-refresh UI element that is so pervasive today— and was subsequently purchased by Twitter in 2010 and ruined.

The advantages of using a third-party app are two-fold. No adverts and a chronological timeline. Twitter has consistently tried to make advertising work for it over the years. Despite having some 86% of its revenue in 2020 from advertising, the financials don’t seem to make Twitter an ad powerhouse or act as a profit centre for them. When I’ve strayed into the official app, the ads have been useless and other forms of online media inform me better.

Similarly, Twitter has flip-flopped from a chronological timeline to an algorithmic one. In 2016 they made it the default, causing consternation and a bunch of articles on how to disable it. This was only temporary, as Twitter reverted to the useless algorithm shortly after disabling it. Then it was possible to make that change permanent, then more recently, it has become vital for Twitter to go back to an algorithm - god knows why? (Heads up: Ads)

I’m not against ads per se; I’m against crass, overly intrusive ads. With no ads, I’m not subjected to the barrage of trite that I see when I open the official web app. The chronological timeline allows me to run down a few pages and quickly get up to speed on a topic without wasting hours and being spoon-fed conspiracies and other distasteful junk.

But the most effective way to tame Twitter is a two-pronged approach and can be done with or without the official client. And, even if you’re happy with the tracking and the ads and a completely useless “promoted” timeline, this configuration will still help a little.

Firstly, I “follow” only a few accounts; as a principle, the term “follow” is nauseating for me, but that’s where we are. 🤷‍♂️

These are hand-picked, and it is not an endorsement if I follow you. I just want to temporarily see your thoughts or retweets, etc., in my timeline. This changes now and again as I audit, adding and removing follows as I see fit.

Note: If I’ve unfollowed you recently, don’t take it personally. I’m probably keeping up-to-date with you still but not in my timeline. You’ll see why in a minute.

So my timeline is a pretty quiet place, and it helps me avoid too much time-wasting. This brings me to the other tool. I think this is Twitter’s under-estimated superpower.

It’s called Lists.

Use them prodigiously.

When I thought about this shift in the use of Twitter, one thing that was evident to me was that the soup of random nonsense on the timeline was because we have to switch contexts cognitively as we scroll through constantly. One tweet grotesquely shows videos of deaths in Ukraine (complete with burning corpses), the next, a funny dog video, then a serious political news story from a reputable source, followed by a shitpost from Elon Musk or Kanye West, then the inevitable conspiracy theory skid mark.

It’s cerebrally fatiguing and draining. Not to mention the sheer effort required to understand the truth of what you’ve just seen.

I wanted to devise a way where I could be in a particular context and stay in it for the duration of the session on Twitter. This is where Lists come in. Lists allow you to add Twitter accounts without having to follow them. That way, you can keep up-to-date on a subject, research project, or any context you want without being derailed by the algorithm and other deranging information. I’ve been doing this for a few years, which has helped me a lot.

I recommend you look at this feature and put it to use yourself. The rewards are evident with a bit of effort and a little pruning.

My current lists are; Analysts, Antilles, Apple Related, Apps, Caribbean, Culture, News, Research, Researchers, Tech, and Tropical Weather.

In each of these lists is one or more Twitter accounts that are, in the majority, primarily tweeting on the topic (i.e., the list name) I’d like to read. They don’t need any explanation; I’m sure you can work out each context.

You don’t have to drink from the firehose; you can drink more sensibly.

Here’s some more information on them and how to set them up: https://help.twitter.com/en/using-twitter/twitter-lists

Thanks for reading.

Visit the website to read all the archives.

I recently appeared on a podcast with my friend and tutor for my Master’s, Jean-François Nantel, where we talked at some length about web3 and the aspects to take notice of. I really enjoy the format, and I hope you will too. It’s in French, with my ‘Allo ‘Allo accent, but it’s full of interesting tidbits. If you understand French, you should check it out here.

In this essay, I wanted to follow up on some of the things I wrote in Part 1, give a little context, and highlight some of the changes that have happened since. If you’re vigilant, you’ll notice that the world has standardised on Web3 and no longer tends to use Web 3.0. I have complied! I could make a joke about centralisation here, but I’ll resist.

I also wanted to discuss the “other side” of the technology and its use for good. I’m sure this is a more considerable discussion. I might dive into that another time.

I hope you enjoy this essay, tell me if you do or don’t. It’s easy, reply or ping me on Twitter (@virek), or you can find me on LinkedIn.

Web3 Part 1 Follow Up

I wrote in Web 3.0 or Web 1.0 in sheep’s clothing? at a time when I was thinking about all of the different aspects of the web and how they had changed over the years, and what I thought it might become. There’s a lot going on in my brain, and I thought that essay would help me clarify a few things. I’m not sure it did, but even little progress is progress. I guess what it did achieve, though, is that I have a clearer view of the various composite parts of web3.

However, one thing that came out of that reflection is a sceptical view of the unregulated crypto world. I (sort of) didn’t mean for it to sound as negative as it did, but to be fair, If you’ve been following what’s going on in that Wild West corner of the internet, you’ll have noticed that scams, frauds and downright theft are becoming a severe problem, as well as the new trend of crypto-romance scams1.

Another aspect you’ll have no doubt noted is that governments are starting to get serious in their thinking on how to regulate transactions and how to kerb the more significant and larger amounts of energy required to conduct transactions at a fraction of the efficiency of traditional systems. I know that the algorithm is slated to change to reduce the energy requirements substantially, but I doubt that it will have any meaningful effect for a long time yet. Take Ethereum, their planned move to ‘proof of stake’2 from the ‘proof of work’ algorithm started over seven years ago and still hasn’t been completed. Kudos for the foresight from the Ethereum founders, but that particular problem seems to be extremely difficult to solve.

Also, look at this article from the BBC, where they went onsite to see one of the mining farms in Kazakhstan. You might be surprised to learn what is needed and what cost to the environment this trend is. Here’s a link to the full documentary, Our World - Kazakhstan’s Crypto-Boom?

The other aspect that I left hanging without really taking sides on is the state of the current NFT market.

The image above represents what the current NFT market looks like today. And again, you may shrug and tell me that isn’t that what all commerce of art, collectables and the like is? And to some extent, that’s correct. The real value of something is what someone is willing to pay for it. The difference in the current NFT setup is the gambling and Ponzi-scheme structure, as discussed in the last essay:

The other elephant in the room over cryptocurrencies are the obvious parallels to pyramid or Ponzi schemes. Several articles in various reputable media outlets like the FT etc., show how much of the “value” of cryptocurrencies and NFTs is speculation. Speculation that requires new entrants into the market to prop up the value higher up the chain. With the clear Achilles heel, if the supply of those at the bottom of the stack —i.e., those who lose their investments— stop pumping money to the higher level of the stack, the whole thing will most likely come crashing down.

And again, for all the bluster and hype, there is no getting away from the fact that the system is lossy on the whole and has been single-handedly responsible for an increase in efficiency to run anonymous ransomware operations that have been responsible for closing down hospitals, disrupting critical infrastructure, and extorting banks, to the tune of over $5B a year. I urge you to read this lecture from David Rosenthal at Stanford University. This site is an invaluable resource to keep up with some of this.

Suffice to say; I’m sceptical of the solution looking for a problem, aka Blockchain, as it is in its current guise for many reasons; decentralisation (it’s not), energy efficiency (dangerously inefficient), anonymity (not quite), speed (ZX81 rapidity), security (at the whim of someone else currently, as well as contributing to a security nightmare for business and public services).

Following on from the discussion —and criticism— on cryptocurrencies, it would be remiss of me not to talk about Central Bank Digital Currencies or CDBCs. These are digital currencies that have some similarities with cryptocurrencies but are fundamentally different from a technical, regulatory and implementation point of view.

One thing that may have escaped your attention is that the Caribbean has and is at the forefront of this technology. Rather than following the word, we find ourselves leading the world. That in and of itself is, in my mind, proof of the possibilities and opportunities that exists here, despite what you may think. Homegrown digital currency companies like Bitt Inc. are leading the world and are developing projects outside the region to Africa and beyond. We are also the home to the world’s first economic union CDBC. In this context, the question becomes “What can Europe learn from us?” rather than the other at round!

Let’s look at a couple of examples in the Caribbean and what they might mean for people living in the Caribbean.

The Caribbean has traditionally suffered from economic underdevelopment, leading to a wholesale stalling of digitisation for the last ten or so years. Where some countries had started their digital transformation that then got a kick in the butt by COVID-19, accelerating those efforts, here, COVID-19 started the process from scratch in most instances. There are several consequences of that economic underdevelopment that I won’t go into here. I’m not an economist, and I’m not sure it’s worth going over old and stale ground. We all know what we’re capable of here and why it hasn’t happened yet too!

However, a couple of things are of interest when talking about the technology of money. According to a CIGI-Ipsos survey in 20173, around 65% of the eligible population (children and adults) were unbanked. A large cash economy has difficulties, notwithstanding a sizeable informal economy that provides no receipts for government or public services, let alone access to ICT-based products and services.

CDBCs promise to resolve some of these structural problems, with access to payments systems and pseudo-banks for people that have traditionally or intentionally avoided the banking system. They also provide security for cash payments, withdrawals, and transfers. That last service is more important in the Caribbean than in other regions due to the distribution of populations around the different territories in the region and beyond.

Additionally, I note that remittances to Latin America and the Caribbean are estimated to be around USD 103 billion4, with Jamaica alone counting for over USD 3 billion. Remittances that are sent need to be transformed into cash, often by relying on convenient but expensive services such as MoneyGram or Western Union. The middleman always gets his cut.

One such CDBC currently in public beta (to use a tech expression) is DCash. DCash is the official CDBC of the Eastern Caribbean Currency Union (ECCU). Having partnered with several of the local banks and businesses in the OECS, the Eastern Caribbean Central Bank (ECCB) has launched its pilot program in Antigua and Barbuda, The Commonwealth of Dominica, Grenada, Montserrat, Saint Kitts and Nevis, Saint Lucia and Saint Vincent and the Grenadines with Anguilla to join the list after the initial test period.

From a technical point of view, DCash uses an open-source blockchain co-developed by IBM, called Hyperledger Fabric, a “permissioned” blockchain, ensuring only known parties are participants, thereby contributing to the immutability and the reduced risk of fraud and theft of assets on the blockchain. It does remain to be seen if it can scale to multiple thousands of transactions per second that traditional financial systems have been doing for decades. That is just a matter of technological maturity rather than anything else, in my view. No one believed the limited capability of the original iPhone would be the cornerstone of practically all that is digital today, either.

On a regulatory note, CDBCs are regulated and controlled by their issuing central banks by their very nature. In the case of the Sand Dollar —another CDBC that was the world’s first— the Central Bank of The Bahamas (CBB) is the regulating authority. The CBB authorise financial institutions and retailers to accept the Sand Dollar and handle the valuation and volatility of the currency. This should, in theory, provide a basis for trust in the use of the technology.

However, implementing these CDBCs is not easy, as the recent problems with DCash have been highlighted. For context, DCash transactions have been suspended for over a month5, seemingly due to a digital certificate issue. At this point, it would be easy to point out these difficulties and say, “See, it won’t work!”. But to do so is to ignore the substantial potential for a project of this scale and importance. I do not doubt that the currency will be back online soon and that the teething implementation problems will largely be resolved. I am also confident that other issues will be found and will be corrected. I am also a firm believer that the broader adoption by larger countries and currency unions will be streamlined as a direct result of the in-situ PoCs happening in the Caribbean.

If these projects are successful, as it seems they will be, the transformational changes to the Caribbean economy could be profound and in a good way. For example, cross-border trade in digital and physical goods could be unlocked from current restrictions, complexity and costs, not to mention other applications (remember Blockchain Hurricane Protection from CREAD)6. Don’t just take my word for it either, How blockchain accelerates small business growth and development.7

Thanks for being a supporter, have a great day.

Visit the website to read all the archives.

6

I wrote about it here:

The Future is Digital

Digital Commerce. Blockchain (again)

Listen now | If you listened to the podcast version, you’d note I added some music. I broke out my skills in Garageband to make a quick accompanying jingle to spice up the podcast. Let me know what you think. 🎵 On to this week’s topics. I’m astonished I didn’t get roasted for completely dissing Blockchain as a useless technology a couple of weeks ago. I thought I’d t…

Read more

3 years ago · 1 like · Matthew Cowen