Category: Hospify

  • Ads are coming to WhatsApp

    The move reveals Facebook’s intention to harvest yet more of your personal data for gain.

    So, finally, the inevitable has happened. Facebook has completed its mission to turn the world’s greatest private, ad-free communications platform into a massive pipe to suck up the personal data of billions of people and sell it on to advertisers.

    This is what we now know as “surveillance capitalism”, as defined in the  best-selling book  of the same name by Soshana Zuboff. And we also know, thanks to a recent  announcement by Facebook  at its recent Annual Marketing Summit in the Netherlands, that the ads will look like this:

    How WhatsApp ads will look within the app, photographed by head of media at Be Connect digital marketing agency, Olivier Ponteville.

    How WhatsApp ads will look within the app, photographed by head of media at Be Connect digital marketing agency, Olivier Ponteville.

    And in case you’re thinking that this whole surveillance capitalism thing is just a conspiracy theory, you should check out last Sunday’s Commencement address by Apple CEO Tim Cook at Stanford University:

    Tim Cook, CEO of Apple, addresses Stamford University students on the disasters wrought by irresponsible technology platforms, 16 June 2019

    “Too many [in tech] seem to think that good intentions excuse away harmful outcomes,” says Cook [timecode 6:26], “but whether you like it or not, what you build and what you create define who you are. It feels a bit crazy that anyone should have to say this. But if you’ve built a chaos factory, you can’t dodge responsibility for the chaos.”

    Or for the ultimately numbing effect it will have on our society. “In a world without digital privacy, even if you have done nothing wrong but think differently, you begin to censor yourself. … The chilling effect of digital surveillance is profound, and it touches everything.”

    This is why Apple has just announced a “private log in” feature, that will allow people to register with websites in a way that will prevent those sites from garnering and exploiting their data. And it’s why, here at Hospify, we’ve spent the last few years designing and building an alternative to WhatsApp that allows doctors, nurses and patients to communicate with each other about health matters without their privacy being compromised.

    According to a survey recently conducted by EY and announced at the  Telegraph Frontline HeathTech Conference  in May, 60% of doctors “believe that smartphones will become the main tool to help connect patients and healthcare professionals” within the next few year.

    EY survey finds that 60% of doctors “believe that smartphones will become the main tool to help connect patients and healthcare professionals”

    EY survey finds that 60% of doctors “believe that smartphones will become the main tool to help connect patients and healthcare professionals”

    It is therefore clearly more important than ever for the 600,000 or so clinicians in the UK currently using tools like WhatsApp and Facebook Messenger to communicate, to switch to using tools like  Hospify.

    So if you work in health and you haven’t done it already, what are you waiting for! Hospify is free and is available right now in the  Android  and  Apple  app stores. It’s a messaging tool that looks and feels like WhatsApp, but it doesn’t serve you ads or monetise your data, it doesn’t even store your data, it’s compliant with GDPR, UK data protection and NHS information governance, and the mobile app is free for anyone to use. Go and check it out today.

  • What’s the matter with WhatsApp?

    Broken-Whatsapp.png

    Given that I run a messaging platform,  Hospify, specifically designed to offer people a data-compliant alternative to tools like WhatsApp, Messenger and Telegram when chatting in a health care context, it’s no surprise that I’m often asked: “What’s the matter with WhatsApp?”

    So here it is: my cut-out-n-keep guide to the subject, in eight easy lessons.

    1. Where it’s at

    Under the EU’s  General Data Protection Regulation, which got enacted in UK law back in May (just in case you’ve had your head under a rock all year), personally identifiable data held about other people by you as a user of a technology platform should be stored, physically, somewhere in Europe. Meaning that the servers have to be in Europe and only in Europe, not spread all round the planet, like WhatsApp’s are.

    Why does this matter in health care? Because users of a health care messaging platform are likely to include doctors and nurses, and doctors and nurses tend to talk about patients. As soon as you mention a patient by name in a text message and add any details about their condition, then you’re holding personally identifiable data about them — and data of the most personal kind.

    If you worked in insurance or marketing, you’d have to ask (and get a record of) the patient’s permission before you could send or store that information on the internet. But  thankfully GDPR contains an exemption for those who work in health and care: they are allowed to communicate and store details about patients without asking express permission, as long as they’re doing it in the course of delivering their care.

    To take advantage of this exemption, though, UK & EU-based health care professionals need to use a communications system that handles data in a way that is otherwise compliant with both GDPR and the information governance rules of their health care employer. WhatsApp is compliant with neither, purely on the basis of the geographical location of its servers.

    2. Hand it over

    The second problem is to do with accessing the information once it exists. WhatsApp messages are encrypted both in transit as they ping around the internet and at rest on WhatsApp’s servers, where they’re stored. But storing them like this creates big problems. If you’re a doctor and you’ve chatted with another doctor about one of your patients — to get some advice or a second opinion about their condition, for example — then you don’t own that data. Your employer, i.e. the hospital or surgery where you work, owns it instead, even if it’s on your phone. Your employer is therefore ultimately responsible for it, and — by law — has to be able to hand it over to the patient if the patient asks for it, which patients can do by issuing a fairly straightforward subject data access request.

    As we’ve seen from cases like the  2017 Westminster knife attack, when WhatsApp refused to hand over the content of the attacker’s messages to the Home Office on the grounds that even it couldn’t de-encrypt them, getting access to WhatsApp messages is tricky. This creates a paradox. In the case of the patient, the law says that the hospital has to hand them over. But if they’re on WhatsApp it cannot hand them over, because without de-encrypting them it can’t work out which ones they are. So because a doctor talked about a patient on WhatsApp, and that patient issued a subject data access request, the hospital is now in data breach twice over: because the messages are being stored on a server outside of Europe (most likely at a WhatsApp server farm on the Eastern seaboard of the US), and because it cannot de-encrypt the messages and hand them over.

    3. Snap happy

    Another issue one is photos. Have you ever received a picture on WhatsApp? Have a look in your phone’s main photo gallery. The picture will most likely appear there, as well as in WhatsApp itself. This is because nearly everyone’s devices automatically backup such pictures to cloud services that are likely to be geographically-located outside of Europe, and often shared with other members of your family. Even if you switch this feature off, gaffs by Apple and others can mean it gets switched back on without your knowledge.

    4. Notify me

    Another inadvertent source of data breach is the home screen notification. You can switch notifications off for WhatsApp, but almost no one does — you want to know when you’ve got a new message, after all. The trouble is that the notification contains a snippet of that message, available for anyone within viewing distance of your phone to see. This potentially exposes sensitive patient data to prying eyes, breaks most employers’ “clean screen” policies, and is therefore another reason that WhatsApp doesn’t pass muster when it comes to health care information governance.

    5. UnPINned access

    It’s also not possible to set a separate PIN code or fingerprint lock on the WhatsApp app itself, which therefore relies solely on your phone’s security lock to keep intruders out. If your phone is stolen or you leave it on the train and you’ve left it unlocked for any reason — increasingly likely now that lots of phones offer to keep themselves unlocked for convenience when they’re connected to wireless devices like keyboards or headphones — then there’s nothing to stop someone getting access to your entire message history.

    6. Conspiracy theories

    Then there’s the question of what WhatsApp is really doing with your data. Earlier this year Google  struck a deal  with WhatsApp (which itself is owned by  Facebook) to allow WhatsApp users to back up all their chats and photos to their Google Drive accounts without impinging the 15GB free storage limit set on those accounts.

    Now, this seems quite an odd thing for Google to agree to, given that Google and Facebook are major league competitors for online advertising spend. Would Google do such a deal out of the goodness of its heart? Call me paranoid, but I don’t believe it would. Presumably it’s getting some kind of value out of storing all that content which, despite being encrypted, would still be rich with all kinds of associated metadata that the search giant could use to improve its profile and advertising of — yes, dear reader — you.

    7. Secure doesn’t mean secure

    All of which bring us to the thorny issue of security. People think that WhatsApp is really secure because all its messages are encrypted. But it turns out that it’s not that secure at all. A bunch of white-hat hackers called  Check Point Research  recently found that WhatsApp’s QR-code feature, which allows a user to route his or her account via a laptop or desktop computer for ease of access, contains a vulnerability that allows an attacker to intercept group messages, change the identify of the sender, alter the text of replies to the group, and send private messages that go public to a group when responded to — all of which open the app to abuse and compromise privacy.

    8. WhatsApp is changing

    Finally, did I mention that WhatsApp is now owned by Facebook? Back in June WhatsApp’s original founders Jan Koum and Brian Acton  resigned from the board of the company  in protest at Facebook’s plans to introduce marketing and advertising into their chat app — which they’d faithfully promised from the service’s inception would never be allowed. (They were serious, too — their resignations cost them around $1.5bn in forfeited share options; a hefty price to pay for sticking to your principles). What does this mean? It means that Facebook’s coming after the data you expose through WhatsApp in order to allow businesses to target you. And if the data you’re exposing is information about someone else’s health, then that’s a major problem.

    To conclude…

    Don’t get me wrong. WhatsApp is a great tool that delivers 65 billion messages a day to its 1.5bn users around the world with incredible efficiency. I use it to keep in touch with family and friends, and you probably use it too. But that utility does not make it appropriate for communicating in situations where one user has a legal and social responsibility to safeguard another user’s privacy, and that’s the case in health care.

    Which is exactly why we built  Hospify  — a chat app with the utility of WhatsApp but without the vulnerabilities outlined above, that health care professionals and patients can use without worrying that they are inadvertently going to fall foul of the increasingly stringent data protection laws now in place in the UK and EU.

    If you work in health care check it out — the basic service is free because there’s a premium version that people pay for, not because we sell your data!

  • The intersection of art and science

    Very pleased to see my piece about my experiences on the Springboard Data Science Career Track Course — and the impact of digital on the art/science divide — go live on the Springboard blog, complete with portrait by Sean Geer.

    You can read the piece here.

    Big thanks to all at Springboard, especially Raj, Kane, Jan Zikeš, Janet, Adenika and Julia for all your support throughout the program (and the edit process!); and thank you also to Tabitha Goldstaub from CognitionX for turning me onto the course in the first place. It was an amazing experience, and anyone who’s familiar with the work we’re now doing at Hospify can easily see how transformative it proved to be.

  • Eating data science for breakfast

    I got up nice and early this morning to chair a data science and data protection breakfast in Soho. Nothing like a sprinkling of support vector machines on your granola and a couple of slices of regulation on the side to get you going on a Friday.

    The event was organised by data strategists the Ammonite Group, and it was Chatham House rules so I can’t be too specific about who was there or what was said. But a really interesting collection of data scientists from various different industries including publishing, motor, gambling as well as straight up tech were in the house, so it was an interesting discussion.

    While each of us was grappling with very different data problems, it was fascinating to discover how united we were by the questions we were asking about the ways in which big data and machine learning models were going to be affected by the arrival of GDPR.

    My own company,  Hospify — which provides compliant messaging for healthcare — is very much predicated on the existence of this piece of legislation. We’re all about making sure that the kind of things we’ve seen happen to people’s Facebook data as a result of the Cambridge Analytica debacle doesn’t happen to their medical data too.

    Handling data in a compliant way is Hospify’s stock-in-trade, but like other businesses we’re looking to wring value from that data for our users by using the latest machine learning tools. The trouble is, the compliance part of the equation makes that very difficult for us to do.

    Machine learning technology — which, beneath all the hype about AI amounts to adding a layer of robust feature recognition (and associated transformations) to the compute stack — is arriving just at the moment that the world is waking up to the ways in which the great open data experiment is making us all very vulnerable to whole new kinds of attack.

    Cybersecurity, however, is just one of the challenges we face. As we know at Hospify, things can be highly secure and still not be compliant, as compliance deals with a whole raft of requirements from data storage, consumer opt-in, subject data access requests and the right to be forgotten, all of which can be problematic for a business at the best of times, let alone when the data concerned have been passed through a machine-learning model.

    And that’s before we even get to the right to explanation. There are already conflicting interpretations about what this even means. If you’ve been turned down for insurance because of a decision that was made by an algorithm, what does having a right to know how that decision was made amount to? Should you be given access to every weight in the matrix of a multilayer neural net, which would not only be hard to deliver but also pretty much meaningless? Or do you just have the right to be told the methodologies involved? And if so, which ones, and to what extent?

    On top of this, the amount of data that the digital operations side of any business needs to retain in order to properly do its job is increasing all the time. User profiles, mobile apps, metrics from IoT devices, APIs and analytics of all kinds are moving beyond the realm of the human and into that of the algorithmic just by dint of the sheer volume of information they generate.

    Equally, and driven by smaller chips, better batteries, the need to remove data bottlenecks, and the security risks inherent in putting any information in transit, more processing power is moving out of the cloud and back towards the edges of the network. This creates challenges of its own around tracking, implementation and security, and is something that I personally am particularly interested in.

    This morning’s conversation ranged across all these topics, and generated useful insights into quite a few of them. As a group we felt that a lot of the demand for “right to explanation” could be satisfied by demonstrating best practice in data collection and pre-processing, and that unpicking actual models might be much less necessary than it initially appears to be.

    Where that wouldn’t be sufficient, there were some innovative suggestions for using input-output correlations to give a very human level of insight into decisions around individual cases. Keeping clear separation, when possible, between customer data and transaction data was another top tip; it was also salutary to hear the extent to which the group felt that the third-party data market was already disappearing.

    One particularly thorny area concerned the tension between the regulatory need to identify problematic customer behaviour in certain sectors, and the need to exercise the right to be forgotten. Another red flag was raised about the dangers of introducing bias into data sets via hidden correlations in otherwise innocuous-data sources — questionnaires, for example, whose question sets inadvertently encourage particular types of answer, or put off particular categories of person. As a former psychology student, I’m very familiar with this particular species of difficulty, and know well how tough it can be to eradicate it.

    Another spectre that loomed over the meeting was the feeling that different pieces of legislation often contradicted one another, making it impossible to be sure that you were complying with everything. We talked a lot about how transparency of process and clear opt-outs/opt-ins for users and consumers would help mitigate the chances of falling foul of many of the new rules, but that in quite a lot of situations best practice wouldn’t really be established until after GDPR was in place and some edge cases had been tested in the courts.

    One question we did settle though, before we went out separate ways: whoever had final sign-off on the GDPR, they probably weren’t a data scientist!

  • Progress report… and moving to Medium

    Hi everyone, 

    as you may – or may not – have noticed, I haven’t posted on this blog for a while. That’s partly because the work on Midland is now tailing off. The book is now funded, of course, so I’ve less reason to bang on about it, and as you’ll know if you read my last post, I put the finishing touches to the final draft at Christmas. Over the last couple of months the Unbound team have therefore been easing the book into the slow publishing production cycle, which has involved a copy edit (now done), some decisions on the font and text layout (also done), and the beginning of work on the cover design (not yet done, but I’ll keep you posted).

    The next step will be the page proofs, which is when I get to read a dummy version of the actual pages as they will be sent to the printer, and get a last chance to pick up on any mistakes. Then, once the cover is approved, the hardback will go to press, and those of you who’ve pledged for one will, I hope receive it around about October. After that the process of page proofs and cover design will be repeated for the paperback, which is due to hit bookshops in January. 

    And what will I be doing all of this time? Not writing very much, that’s for sure (though I do have a thing or two up my sleeve on that front). Nearly all my waking hours are currently being taken up with the launch of the healthcare messaging app Hospify, a project I started a few years back with two surgeons,  Neville Dastur  and  Charles Nduka.

    Hospify has been a slow burn, but with new data protection regulation arriving in May and the Facebook/Cambridge Analytica scandal waking the world up to the importance of personal data security, things are really taking off. The company’s trials in the West Midlands with Unison Healthcare and Birmingham Community NHS Trust, which I’ve mentioned before in this blog, are going great guns. And in an unusually fortuitous piece of good timing, about six weeks ago Hospify was offered a place on the prestigious  Wayra Velocity Health  accelerator programme in London, as a result of which we are now working with Telefonica, O2 and MSD. So that’s all very exciting. 

    As it’s not really appropriate for me to bore all you loyal Midland supporters with tales of my adventures in the wacky world of compliant health chat, I have started a new blog on Medium where I can talk about that at a safe distance. I kicked it off last week with my first post,  Move Slow and Fix Things, and those of you who are interested are welcome to click on the link and check it out.

    Move_Slow_and_Fix_Things.png

    For the rest of you, the ones who’d prefer to stick to purely literary matters, I’ll post the occasional update here about Midland so that you’re aware of its progress, but beyond that I will for the most part now be making space for the book to speak for itself.

    Have a great Easter, thanks again for your continued interest and support, and talk soon.

    Jim

  • The NHS needs best practice guidelines on instant messaging, and it needs them fast

    Hospify’s recent Freedom of Information request reveals that only 2% of NHS Trusts have appropriate policies in place for staff use of instant messaging

    As I’ve  written previously  in this blog the recent news coverage about the Facebook/Cambridge Analytica scandal has left no one in any doubt about the extent to which the internet giants are abusing and misusing their users’ data. However, recent surveys have found that 43% of all NHS staff and as much as 89% of doctors are regularly using consumer tools like the Facebook-owned WhatsApp to communicate at work about patients.

    Instant messaging apps like WhatsApp are popular with healthcare professionals wanting to keep in touch with their teams using their smartphones in the fast-paced environment of a hospital. But these apps do not comply with NHS Information Governance guidelines or the European General Data Protection Regulation (GDPR), which comes into force in the UK, er that’s right: today!

    I’m CEO of an increasingly busy start-up called Hospify, which I co-founded with two surgeons in order to help hospitals and other medical institutions deal with the data compliance pile-up that was going to happen when all those clinicians merrily speeding along in WhatsApp drove smack into the wall of GDPR.

    When we started very few people knew what we were talking about; and even if they did, for the most part they didn’t really care. But over the last year, as a catalogue of data security issues from the WannaCry attack to Mark Zuckerberg’s congressional confessions has danced across the news bulletins, that’s changed. Everyone now knows what the issues are, and everyone now cares — even if we only care to the extent of wanting to rid ourselves of all the wretched GDPR privacy permissions currently clogging up our inboxes.

    Given this shift in sentiment, and given our vested interest, over at Hospify we wanted to find out what guidance there is to help healthcare staff use instant messaging in a safe and compliant manner. We looked first at the policies issued by professional bodies and found that guidance for instant messaging was limited —we couldn’t find anything really specific, and what guidance did exist was generally concerned posting on forums, blogs and social networks.

    We then contacted NHS England and NHS Scotland who both told us they had no centralised instant messaging policy, and that policy should defined by each Trust. So, not to be defeated, a couple of months ago we sent 175 NHS Trusts a freedom of information (FOI) request to find out if they had a specific policies for instant messaging in place.

    The results were extremely worrying. Many Trusts pointed to their existing social media policies and the ones from various professional bodies that we’d already looked at as if they also covered instant messaging, but the vast majority of these were actually concerned with best practice around the publishing of content on social media networks.

    Instant messaging, with its real-time conversations, is more akin to a phone call than a social media post, and mostly takes place in healthcare during a patient’s treatment. Given the nature of the subject matter in these conversations, sensitive medical information is often shared and discussed — information that can then easily end up stored on unregulated servers in countries outside the European Economic Area, where it is vulnerable to abuse and sits beyond the reach of subject data access requests.

    While 60% of the NHS Trusts that we contacted with our FOI request told us they did not have yet have a policy in place for the use of instant messaging by staff, only 2% of Trusts had actually issued specific and relevant guidance. The other 38% seemed for the most part to be under the impression that their existing policies requiring patient details to be anonymised when posting to social media covered off all data protection issues, without really appreciating that when it comes to instant messaging, anonymisation is very difficult to do in an effective way — and that even when done correctly introduces significant risk of patient misidentification into staff communications and so creates other liabilities.

    The Information Commissioner’s Office (ICO) has given clear guidance on the use of messaging apps, but the guidelines from the Department of Health, NHS England and NHS Digital remain confused. GDPR is finally here, and if clinical staff are to avoid disciplinary action over inappropriate use of messaging and Trusts are to avoid fines of up to 4% of their annual turnover for any messaging mishap that can be classified as a data breach, clearly much more needs to be done to get appropriate instant messaging policies in place and disseminate best practice guidelines.

  • Move Slow and Fix Things

    Hospify — the compliant chat and data company I founded with two surgeons four years ago, in anticipation of the current storm over widespread data abuse

    Hospify — the compliant chat and data company I founded with two surgeons four years ago, in anticipation of the current storm over widespread data abuse

    I’ve been meaning to blog about my role as CEO of  Hospify for a while now, and the events of the last week or two have convinced me that now’s the time to do it. The exposé of the data abuse conducted by Cambridge Analytica, and its impact on the business models underpinning Facebook in particular but also Google, YouTube and many other digital businesses have underlined the reasons that we founded company in the first place.

    I’m often asked what a journalist is doing running a health chat company, and the Cambridge Analytica story allows me to answer that question very neatly. Besides being a writer, I’d always had a strong interest in technology and like many proto-geeks of my generation did a lot of coding as a teenager thanks to the advent of home computers like the ZX81 and BBC Micro.

    I got my first career break — an editorial position on Wired UK back in the mid-nineties — by combining these two interests, and although my career has ranged fairly widely since, these two things have always remained close to the heart of everything I’ve done.

    After Wired I worked at the BBC for a period, building an early social network based around a TV drama. When that project was killed by the September 11th attacks (long story) I migrated to the Telegraph, where I looked after, by turns, online digital development, online video, and the Telegraph Weekly World Edition newspaper — for which I also built a social network, this time for British Expats.

    My proudest moment at the Telegraph Weekly was producing this: a front page that The Atlantic and The Huffington Post deemed “the greatest newspaper front page ever”

    My proudest moment at the Telegraph Weekly was producing this: a front page that The Atlantic and The Huffington Post deemed “the greatest newspaper front page ever”

    My career has, therefore, always been about both content and its expression, “expression” at this particular period in history meaning the internet, the web, social media, and — latterly — mobile, which combines all these things in the almost magical devices that billions of us carry with us everywhere, all the time, and use to mediate all aspects of our lives.

    I was at the Telegraph long enough to earn a coveted window seat, and when I looked out of that window what I saw was Google, whose offices were right across the street from mine. Because every time I looked at my computer I saw Google too, it followed that I should spend quite a bit of time in those offices, which I did, generally discussing the finer details of Search Engine Optimisation (SEO), then in its infancy but still of considerable importance to a newspaper group.

    While the Telegraph initially did well out of the web, as time went by that success began to wane. This was partly as the result of poor strategic decisions by senior management (don’t get me started), but also because the media as a whole and newspapers in particular were being reconfigured by the exponential expansion of Google, Facebook and others, especially as the world began the shift from the desktop to the phone.


    The Block — a valiant attempt to build a social network around a TV drama four years before Facebook (and decent broadband penetration). Set in a 1 kilometre-high tower, the project was shelved by the BBC in the wake of the 9/11 attacks.

    Sitting in that window seat between 2009 and 2012, it became ever more apparent to me that content was becoming increasingly commodified and that I should put more focus on the expression side of my equation if I wanted to stay remotely relevant. It also became clear to me that this data pact that consumers — and, indeed, the newspapers, themselves — were making with the new tech giants by handing over detailed information about their personalities and habits in return for “free” online services was deeply problematic, not least because of the effect it was having on the economics of my own industry, which I witnessed in a very literal way as month after month more of the excellent journalists who sat all around me got laid off. But it was a new world, everyone wanted to try it out for size, and the services were so good that no one really seemed to care.

    Still, I felt that change was coming one way or another, so when the cutbacks reduced my own team to the point where I felt we could no longer put out a quality product, I left the Telegraph to focus more on online video. When that didn’t work out (another long story) I was contacted by two surgeons, one of whom I’d known since university, and ask to bring my media tech experience to bear on an idea they’d had for improving comms in health.

    I didn’t know too much about healthcare as an industry, but my undergrad degree was in experimental psychology and I’d just spent a decade helping my father through an extended battle with chronic lymphatic leukaemia, so the area wasn’t completely alien to me. I did some research and it was soon obvious to me that not only could the kind of consumer messaging and social media tools provided by the likes of Facebook and the companies it had acquired — notably WhatsApp and Instagram — make a huge difference to efficiency in the provision of healthcare, but that here was an area where, however blasé they were in other areas of their lives, people really would care about what happened to their data.

    I therefore threw my lot in with the surgeons, Neville Dastur and Charles Nduka. We talked to the Information Commissioner’s Office, looked at the data protection legislation in health, did a lot of market testing, reviewed the General Data Protection Regulation that was due to come down the line from Europe (and is due to arrive on May 25th), and built a service with an innovative, data compliant architecture for handling chat and data that provided both with best practice, transparency and simplicity for users and employers — without being funded by sharing personal information or serving ads.

    For much of the three years it took us to do this, most people we spoke to told us we were wasting our time, that the service wasn’t necessary, that people didn’t care, that the big companies would surely beat us to it. But our service went live in the Apple and Android app stores in February, and a few weeks later we’ve seen $50bn wiped off the value of Facebook as the extent of the data misuse enabled by its service has become incontrovertibly obvious to everyone.

    In the meantime, Hospify is being all but overwhelmed with enquiries from clinicians, Trusts, unions and chief information officers, app downloads are increasing every day, and several of the big companies that were perceived as such a threat are now instead in the midst of legal, political and cultural firestorms over the chaos that their lax attitudes to handling data have ignited.

    Into this mess rides GDPR, which is looking extraordinarily relevant all of a sudden. It’s true, of course, that regulation doesn’t change things on its own. The Equal Pay Act of 1970 years ago demonstrates that. It’s only now that the #metoo movement has amplified the frustration of women sufficiently (thanks to social media for once acting in the way it was supposed to) that we’re seeing companies opening up their books on the gender pay gap, and change is actually starting to happen.

    So it goes with data privacy. GDPR on its own could easily be in large part ignored. But when week after week we’re hearing about the awful implications of not taking due care over data, revelations that are coming out as a result of the tireless work of reporters such as the Guardian’s Carole Cadwalladr, who I’m proud to say that I know from my time as journalist (and who deserves to pick up a slew of awards for her efforts), we’re seeing not just regulatory change, but culture change too. And the combination is all but unstoppable.

    We are therefore, I believe, about to enter a new era of data compliance. It’s the era we built Hospify for. Yes, it’s taken a while, but good things take time. Unlike Mark Zuckerberg, who extolled his team to move fast and break things until, alas, they ended up breaking democracy, Hospify’s approach is somewhat more measured. “Move slow and fix things” pretty much sums it up. This is not advertising we’re talking about. It’s health. Mistakes have very real consequences, for very real people. You can’t muck about it with it. It really is life and death.

    So join us! Change will ultimately only come if you, the user, demand it, and choose the tools that help you to enact it. Be the change you want to see in the world, as we have tried to do. Hospify is just one of many other great tools coming through that put data compliance and privacy at the heart of everything they do. Seek them out, use them, tell your friends about them. Because information might want to be free — to quote the Wired axiom from my old dotcom days — but as is now abundantly clear, someone always ends up paying.

  • On Planning the Writing of the Business of Writing a Business Plan

    On Saturday I did an event. I was invited to speak at a cultural evening organised by an economist, and as the audience included people from both business and the arts – and quite a few with backgrounds in both – I gave a talk drawn from my experiences of shuttling between these two worlds. The text of the talk follows below; you can also listen to the presentation (which was recorded on the night) in the linked audio file.

    Audio Block
    Double-click here to upload or link to a .mp3.

    Learn more

    On Planning the Writing of the Business of Writing a Business Plan

    I confuse people. It’s my special power. I don’t mean to do it, but I do. I confuse all kinds of people, but the people I confuse most of all are the ones who work in HR, recruitment or executive search.

    These people, they’re sitting at their desks, happily minding their own business, putting everything they see into neat little boxes, and then they meet me and they have some kind of fit and have to go and lie down for a while. After that they usually direct my emails to spam.

    Why is this? Why do I have this effect on these people? You can give me your suggestions at the end, but I think it’s because I just don’t fit. I don’t fit into the little boxes so beloved of HR people, recruiters, and executive search professionals. And I don’t fit because I refuse to do just one thing.

    This started young. As a teenager I loved writing programs for my BBC Micro and wandering through graveyards smoking cigarettes and writing poetry. As a student I studied neurophysiology and designed experiments and read Wittgenstein and had my own band and took a play to the Edinburgh Festival. You could argue that I did too many things and so did none of them very well, and you might be right (the play won Turkey of the Year award). But I wanted to be a writer which meant, as far as I could see, understanding how lots of different human activities fit together to make a whole society. So it made sense to me to dig my hands into as many of these activities as I could.

    When the World Wide Web arrived in my early twenties, suddenly this breadth made perfect sense. The web was science and art combined. Technical form and expressive content became inseparable – to quote Marshall McCluhan, the patron saint of the Internet, the medium was the message, in a manner that had never been so completely true before.

    I became a technology journalist, evangelising this new realm, and at the same time I became a novelist, writing novels inspired by the changes happening in science and technology around me, and to me and my peers this combination seemed the most natural thing in the world. We were the future, and the future was now.

    But then the dotcom bubble burst and things got reconfigured. The creative explosion that had been the web got tamed and funnelled into a handful of major gateways: Google, Facebook, Amazon, eBay, Twitter, LinkedIn. That set a trend that continued through the 2008 recession and the economic stagnation that’s beset the global economy ever since, right into the new growth phase, that of the Internet of Things.

    As McCluhan predicted, what has value now is not the content, not the message, but the means of organising and transmitting it – the medium itself. When you summon a car from your phone to take you to the airport, you don’t care if it’s a Seat, a Volvo or a Merc. Because what matters to you, what you pay for, is the fact that it’s an Uber. That’s all that really counts.

    And thus science has pushed back on art. The geek inherited the earth, and sought revenge for generations of oppression by subjecting the quality of content to the law of large numbers and rendering it all but irrelevant. What matters now is the engineering efficacy of the delivery mechanism and the scale of that flow, not the detail of that which flows.

    Sensitive to this change, which was a pretty inevitable consequence of a system scaling up by an order of magnitude – from 100s of millions of users to billions – I changed too. I left a newspaper industry that was proving itself increasingly incapable of adapting to this new environment, extended various engineering stubs in my educational background – a handy legacy of trying all those different things when I was younger – and dived into the world of start-ups.

    All that time, however, I was still writing fiction. Working, in fact, on the book from which I’ve read to you tonight. Now it’s written I’m even publishing it in start-up style – through the crowdfunding publisher Unbound (and yes, I do want you to pledge for it – please take a flyer home with you tonight!).

    But when I’m out promoting my book or writing its blog, I don’t really talk about my tech experience, largely because I’ve always been told by agents and publishers and those in the industry that it’s not really relevant. And when I’m job hunting or talking to investors I don’t mention my fiction. Again, largely because I’m continually advised by those pesky recruiters and so on that it will be a distraction, and put people off.

    But why? Why should it put people off, in either direction? Why should novel writing and running a business be seen as antithetical? My thesis, the thesis I’m going to put to you tonight, is that they are have more in common than people realise, that experience of one in fact informs, helps and supports experience of the other, and that the habitual denial of this comes down to the simple fact that the triumph of engineering has codified the job market to the point where if you don’t fit into a box that’s been pre-labelled by an abstracted, algorithmic process you cannot get either funding or employment. A job market that, despite calls for evidence of “creativity” and “leadership” on every single job description in reality wants nothing of the sort, and wants instead to make Uber drivers of us all.

    But enough of that. As I say, this is a positive postulation, not a negative rant. A thesis, not a critique. So: I put to you the proposal that books and businesses are very alike, and as evidence for this I present exhibit A: the business plan.

    I’m guessing that most of you are familiar with this form. The company abstracts, the product descriptions, the unique selling points. Team profiles, total addressable market, target market. Six year financial projections. Growth curves. Competitive analysis. All powerful stuff.

    But as Field Marshall Helmuth von Moltke famously said, no plan survives first contact with the enemy, and this is as true for the business plan as for the military strategy. Key team members leave (or, in the case of the military, get blown up). Legislation and trade agreements change. Competitors prove to be rather more nimble in anticipating and outflanking you than you anticipated. Legal fees mushroom out of control as you’re hit with a patent infringement suit. Your CFO is found lining his pockets with company funds. Customers spurn your flagship product but flock in great numbers to the thing you built as an afterthought – or they just don’t flock at all.

    Random shit happens. And if you put all those possibilities in your business plan, it would be unreadable – not to mention longer than War and Peace. No one wants this. Your employees don’t want it. Your advisors don’t want it. Your investors don’t want it. None of them have time to read it, apart from anything else. What they want most of all from your business plan is a great story. A story that excites them. A story they can believe in. A story that, above all, they can retell to others when they have to justify why the hell they invested in you or allowed themselves to be hired by you. So what is your business plan, really, but one gigantic fiction, a story that will be responsible for convincing people to put their money and/or careers on the line?

    And what this story tests, what it provides proof of, is not whether your target market is the size that you say it is or if you are going to hit cashflow breakeven at the end of Year 3 – everyone knows this is all highly unlikely. What it tests is whether or not you can sell.

    Because the business plan is a sales pitch. Can you sell your business to investors, partners, employees? Can you sell a story good enough to hook them in? If you can, if you get them to commit their cash and resources, then even if they know nothing else about you and don’t believe a single curve or infographic in whatever document you’ve dropped on their heads, they now know this. They now know that you can sell, because you’ve just sold them on your plan, and that means that whatever else happens – and as we’ve already established, random shit will – you’ve got more than a snowball’s chance in Silicon Valley of selling something to the one person that really matters: the customer.

    And it’s the same with writing a book.

    Obviously a novel is all about telling a story. That goes without saying. But stories have to be sold before they can be written, and the first person you the writer needs to sell your story to, both investor, employer and employee, is yourself – you have to come up with an idea for which you think it’s worth sacrificing years and years’ worth of other opportunities, of parties and TV watching and quality time with your children, perhaps even your entire career. And you need to understand too, as CEO of the project, that what you’ve sold yourself is just a fiction, a shadow of a story, a plan that must change as reality strikes.

    Because the book will change as you write it. The story you start with is not the story with which you’ll end up. Stories are dynamic. Your characters evolve as you write them – as they grow, so do you. As a result they will behave in ways that you cannot anticipate when you begin. And it is absolutely crucial to fiction that you allow this process to happen. If you don’t the story will feel mechanical, the characters and dialogue will feel dead on the page, and the reader will not feel involved in the world of your novel. Which means they’ll be unconvinced, bored, and won’t suspend disbelief. In other words, they won’t “buy it”.

    So in its actual writing, writing a novel is like running a business. You have a plan, a great story, but it’s just that. In the execution of that plan, things will change – and the plan has to be flexible enough to allow that. My first novel, Habitus, was written over seven years. I didn’t mean for it to take that long, but it did. My third novel, The Book of Ash, took ten years, if you include the three years I had to take out in the middle to write my second novel, 52 Ways to Magic America, and the entire completed version of the book I had to throw away before I worked out how to get it right.

    My fourth novel, Midland has taken another ten. During that time I’ve got married, renovated a house, had two children, seen my father pass away…  I’m not the same person I was when I started it. I’ve changed, the book has changed, and the book has changed me as I’ve written it – just as an entrepreneur who builds a successful business is changed by that experience and all that it involves. But because I’ve got better at these things, while my first three books had dozens of plans, plans after plans after plans, Midland had just one plan, sketched out on a single side of A4, that stayed pretty much exactly the same throughout that entire decade.

    This journey of personal growth, of self-discovery, is a big part of the reason that we do things. It’s basic empiricism. We experiment and put ourselves in crisis in order to learn, to find out about how the world works and what we’re really made of. Those discoveries will change us – and maybe, if we discover something really big or really resonant or really influential, they’ll change the world a little bit as well. Make a dent in the universe, as Steve Jobs famously said.

    I wrote The Book of Ash to discover what I thought about the nuclear industry, in the hope that I could develop some kind of firm opinion about nuclear power (I’m not sure I succeeded in that, although I’m very happy with the book that resulted). I wrote Midland to discover what I thought about my father dying as I became a father myself, in the hope that I could make some kind of map of the challenges of midlife that would help me better tackle these challenges – and perhaps help others tackle them too.

    Along the way I hoped to make a living, of course. And in that way writing a novel isn’t just like a business, it IS a business. There is a target market, a real one – different for sci fi, and chick lit, and literary fiction, and historical. Your characters are products – products of the times that you’re writing in, and the time that the book’s set, but also part of the book’s packaging, part of its marketing, part of its sell. They have to feel real and true to their milieu, but also have to appeal to the customer – the reader – who lives very much in the now. Your competitors are not only other novelists but also films, and Facebook and families – all the other calls that your potential reader has on their very valuable and very limited time. You’ve got to give them a damn good reason to ignore all those things and settle down to spend twenty hours or so with you.

    So once you’ve pitched the book to yourself and gone and written it, you’ve now got to pitch the result of all that effort to the reader – and it better be a damn good pitch as well, else you’re not going to get very far and your ROI will be nil.

    And this is perhaps the biggest challenge in writing, or in running a business. You can’t be one person. You have to be two. You have to be both the producer, the executive, the creator, and in almost the same breath be the salesperson, the marketeer, the evangelist. Even if the first bit is going horribly wrong, the second bit always has to be confident, breezy, solid as hell. This is very hard for writers, most of whom are natural introverts, to do. For entrepreneurs, the challenge is reversed. Natural extroverts, selling is the easy bit for them. Settling down and maintaining the focus to deliver what they’ve promised, that’s what they find really difficult. It’s why so many entrepreneurs get sacked by their own boards once the business is going. And why writers were traditionally locked in back rooms by the film studios.

    Thanks largely to the communications revolution you can no longer expect to survive for very long on one half of this equation. Entrepreneurs and CEOs are under the spotlight like never before, constantly having to reinvent themselves and their companies as leaner, fleeter outfits snap at their heels, while writers are expected to market themselves like never before. There is just so much content out there now. Publishers won’t even pull you off their slush piles if your manuscript isn’t accompanied with twenty thousand followers on Twitter or your own YouTube channel. Why should they? Their own business plans have been put into crisis by contact with the Internet, and they can no longer afford to take anything that feels like a risk. Your story is the story that sells them on your book. The book’s story, on its own, is no longer enough.

    This is why I find it so mystifying when I’m looking for work or pitching my business that recruiters and investors don’t want to hear about the fact I’m a writer. Because the business of writing is in fact a fantastic training in all the skills needed – both sales and execution – for managing a business at any level. Books are about people, businesses are about people, and the two halves, to my mind at least, make a whole that is very complete.

    Having said all that, of course, as we all know the chance of finding success with either book or business is incredibly slim. You have to be crazy to even try and do either. Crazier still to do both. And maybe that’s the real reason I don’t get along with HR people, recruiters, and executive search pros. They do have a box for me after all. Unfortunately, it’s the box labelled “mad”.