Apple’s decision to deprecate access to the Unique Device ID is problematic for a lot of applications besides Advertising and other Privacy-Challenged cases.  It will actually make the devices less secure, not more secure as many imagine.  “Deprecation” can mean anything from elimination of the capability entirely to making enough changes in the API that it will require a lot of work to deal with the changes and all points in between.  I’m hoping that rather than doing away with the deprecated capability, they will instead embellish it so it can only be used for good.

What is a UDID and why is it a problem for anyone?

The UDID is a threat to privacy because an application can uniquely tell which device it is running on by checking the UDID.  It’s kind of like having the device say, “This is Bob’s iPad, not Mary or Jane’s iPad.”  As such, it can use that information to index the behavior on that device over time and transmit information about how it is being used back to some central service.  In other words, it can keep that service apprised that not only did you look into wedding-related arrangements on one particular day, but you’ve been steadily looking at them more and more over the last week.  Hey, maybe you’re involved in a wedding!  The advertisers would love to target that.

But there are other cases where UDID can be pretty handy.  Consider security.  Seems like revealing too much information is the antithesis of security, but in fact, being able to reliably identify who is using your credit card is pretty valuable.  So much so that it is the essence of credit card security.  Being able to limit that credit card use to devices that have been verified might just save you a lot of pain in the identity theft department.  Perhaps your corporate IT or SaaS software provider would like to be able to identify and track which devices are accessing sensitive corporate data.  They would like to do that so they can limit access to devices that have again been carefully verified (the credit card case), but also so they can audit whenever changes to data are made and know which device made the changes.

This all hinges on the idea that it is harder to physically steal the device than it is to steal your password–a bet I would certainly be willing to make and I suspect you would too.  If you can’t reliably and securely identify the device, you’re left with nothing but the password.  But having both the correct password and knowing it was entered from a valid device is a much more secure proposition.

Apple shouldn’t eliminate this capability, rather they should look at ways of regulating its use so that it is used for good and not evil.  If they don’t provide an alternative and simply eliminate UDID’s, they’re just making identity theft easier.  Which thing would you choose if you’ve only got 2 choices:

1.  Easier Identity Theft

2.  Easier tracking of your online behavior

Here’s the other reality, which works sort of like the argument about gun control.  You know, the one where they say the criminals will always have guns?  In this case, for purposes of doing the kind invasive tracking advertisers need, they don’t have to be perfectly right.  Being nearly right or right most of the time works pretty well for them.  In the worst case they’re just going to show you a couple of ads that aren’t of interest.  But when you’re fighting credit card fraud and identity theft, it’s more important to avoid being “almost right”.  Almost right in those cases means they’re going to choose the flavor of “almost right” that’s conservative to their interests.  They’re going to assume, in other words, that fraud is happening more often than it is, which penalizes you with a credit card being turned down too often.

How’s that happen?

Well, there are lots of ways to go around the UDID to try to get some sort of “signature” going to identify the device.  These boil down to trying to collect some sort of “fingerprint” for the device, or by leaving cookies of one kind or another hanging around.  The cookies get more and more surreptitious as we fight the arms race against those who want to delete tracking cookies.  The fingerprints are more interesting because they’re passive.  Nothing new has to be added to your machine.  Instead, they rely on the idea that you will inevitably personalize your machine and this personalization will add information that can be cataloged to provide the fingerprint.  You can’t avoid it, no matter what you do.  Your machine will have a series of things that are unique about it.  For starters, you will have a unique set of applications and versions of those applications installed.  You may have a unique set of fonts installed.  Your wallpaper may be different.  The photos in your photo folders are different.  If the fingerprint software is clever, it runs a lot of different checks and keeps it very secret what it is looking at.

Suffice it to say the marketing guys will find a way to track you.

Apple can’t stop that, but it can certainly make it hard, and it can continue to allow the UDID API to work, with the requirement that anyone using it has to go through a process to get their app authorized to access it.  That process should involve explaining to Apple exactly why you need to use it and making sure that use is for good and not evil.  And of course, the identity pirates can certainly find ways of spoofing the UDID, but that’s also an area Apple can work on, and it is again one more piece of information they must have (e.g. the actual UDID) before they can do anything.  Just providing an API that makes the UDID look different to every application would be one way to make the fraudster’s job that much harder.

I’m from the camp that says we’re way past the point of patents fostering innovation, if they ever did.  It didn’t take me long reading Scoble’s post this morning about the value of WebOS’s patents to HP possibly making the unit a profitable venture to be reminded once again that while patents may be a lot of things, they are not a way to foster innovation.  They’ve lately become a currency to value failed innovations, which seems quite the opposite of fostering innovation.  Scoble’s argument went like this:

Last night I was talking with a VP who works at HP on the former Palm team. He told me they have 2,000 patents for webOS, smart phones, and TouchPad.

Now remember, Google paid $12.5 billion for Motorola Mobile, mostly to get their hands on the 17,000 patents that Motorla held. Now, if you just price HP’s patents at the same price, you come out with $1.48 billion. HP paid $1.7 billion for Palm. So that gets you pretty close to even.

But this VP told me that these patents are almost ALL for modern smartphones, while the Motorola patents included a lot of old stuff that isn’t relevant anymore. So, this patent portfolio could get a premium of, say, 2x what the Motorola patents did. That gets you up close to $3 billion.

Something about all that just strikes me as WRONG, at least in the context of spurring innovation.

The Valley is loving the patent discussion right now.  For every meme, it seems there is a matching “here’s-how-patents-relate-to-that” meme.  Just because a thing is popular doesn’t make it right, and thankfully, most commentators on the patent issue seem to agree that it hurting innovation much more than it’s helping it.  It hurts innovation in many ways, but it’s worth going back over at least some of them here.

The Cost of Patents to Innovation are now Tangible and Large

We’re seeing this measured almost daily.  Scoble is working through the math for WebOS even today when he values the WebOS patents at circa $3 billion for 2000, or $1.5 million apiece.  That doesn’t seem too far afield if we look at patents in a way similar to how VC’s have to look at their portfolios.  In other words, many will be worthless, but a few will be quite valuable indeed and will more than make up for all the rest.  We don’t have to spend very long looking at the billions raised by Nathan Myhrvold’s Intellectual Ventures to realize that many astute financial minds really do look at it that way.   In recent years, it’s been a good bet that financial engineering to produce wealth was really inflating a bubble of one kind or another that would destroy a tremendous amount of wealth for the general public.  Why would we be surprised to learn that patents are just another way to play the same Ponzi scheme?

Patents Favor the Patent Holder in a Dangerously Asymmetrical Way

As I’ve written, it costs much less for the patent holder to sue than it does for the defendant to defend.  Any time there is an asymmetry of that form, it creates a virtuous cycle for water to follow the path of least resistance.

It costs an average of $1M just to get to trial.  That’s before you begin the trial–it’s preparation for the defense.  That assumes you’re just trying to prove your work doesn’t infringe a patent.  If, on the other hand, you’re dealing with one of the overly-broad patents a patent troll typically comes after you with, it will cost you $4M to defend and win!  Is it any wonder the trolls can make a business out of suing and then simply waiting for the defendant to do the math and pay them whatever figure makes sense to avoid the pleasure of our legal system.  Typically that figure is a significant portion of the $1M it would cost just to get to trial.  If the troll wants to play more aggressively and they’re confident, it may be a significant percent of the $4M.  And they get to go after multiple companies for that protection money, not just your own.  The more overly broad the patent may be, the wider the net they cast.

Small wonder that these patent trolls are becoming multi-billion dollar enterprises.  And all those billions that make up their ecosystems are billions that create very few jobs, let alone innovations.  They’re billions we can ill afford, particularly given what the economy is today.

The Pace and Timing of Today’s Patent System Prevents them Being of Value to Software Innovators

In the long run, we are all dead.  But startups and similar innovations generally do not have the luxury of waiting for the long run.  They have a year or two to achieve market fit or pivot and try something else.  If they achieve their fit, they have only a couple more years to generate the kind of mega-traction that makes it clear they will be successful.  Innovation markets live in dog years, these days.  Yet, the USPTO takes an average of 6 years to grant a patent.  No innovator in today’s Social/Mobile/Cloud/Software/High Tech ecosystem can afford to base their planning on a 6 year horizon.  The world changes too much in substantially less time.  By the time the patent is sorted out and granted, its purpose can only be to prevent future innovators from usurping the position of power a newly minted and patent wielding monopolist has achieved.  In other words, the purpose of the patent is not to encourage innovation, but to stop innovation in a particular market so the early winners can enjoy the fruits.

Read back over my article on early adoption and how long it takes a technology wave to crest.  The usual argument for patents encouraging innovation is that they grant a monopoly to ensure businesses have enough time to recoup adequate profit from their innovation.  Forget 17 years, Google IPO’d in the 6 years it would’ve taken for their first patents to be granted.  Their patent won’t be 17 years old for many years.  How much value must a company extract from innovation before it goes beyond serving the public good to grant it a monopoly?  Google didn’t need any help from patents.  Most modern tech businesses don’t.  They have a far more powerful advantage called network effects that takes a lot less than 6 years before it can make a difference.  Patents are fine for some other markets, markets that have no possibility of a network effect, or where the burden of research is so high that it will take more than an IPO to recoup costs.  Perhaps pharmaceuticals qualify for that need, but modern software and web businesses certainly do not.  Instead, they are victims of the anti-momentum that happens when a critical mass of patents descend on a particular market and make further innovation impractical.

How do we fix it?

First thing is to realize we have to fix the patent system.  Congress is at least considering some reforms.  They’re too little, but perhaps they’ll start the ball rolling.  When a guy like Seth Godin starts talking about patent trolls, we can take these as signs that public opinion for the idea we need to fix the patent system has reached critical mass.

Second, we have to realize we won’t fix it through fine tuning.  It’s going to take radical surgery to avoid having to junk it altogether.

There is a collection of voices, best typified by Mike Mace’s “The Case for Software Patents”, and Nilay Patel’s, “The Patent System Isn’t Broken–We Are”, that try to argue the patent system is right, it is just, it is simply misunderstood and needs a little bit of fine tuning.

Mace largely wants to quote a 2006 Paul Graham piece to do his arguing for him.  In it, Graham says startups shouldn’t worry about patents because he doesn’t see them being sued.  Oddly, he starts off quoting Mark Cuban, who is one of many investors who says that startups are indeed being sued constantly and that therefore they do have to worry about patents.  The recent suits against apps in appstores, which involve many startups are just one more example.  Ironically, if things can change so much in the short while since 2006 that startups clearly do have to worry patents, that’s an indictment of them all by itself.  It’s a sign things are going to Hell in a hand basket and we’d better do something about it.

Patel says he is not a lawyer and shouldn’t be held accountable as one, but he is only too happy to tease apart the patent laws in great detail to try to make his point.  He wants to argue about how valuable it is to be able to read the patents and see how people did things.  Because we have patents, there’s less incentive for trade secrets, and hence innovation is served.  It’s going to be so great, he argues, when in 17 years we can actually start to use the page rank algorithm.  Lord knows we will have had plenty of time to understand it.  Just a few minor problems with this argument.  I don’t know any engineers who spend their time reading patents to educate themselves on anything other than what they can’t do and then only in cases where they suspect the market to be litigious.  Patents are not a learning resource and anyone who has had the pleasure of having to try to understand one can see they are more often written to obfuscate and create overly broad protection while revealing as little of real value as possible.  Worse, the insights covered in so many of these patents are not scholarly revelations.  We didn’t need to read Amazon’s 1 click patent to get a clue about UX for e-commerce sites, thank you very much.

And speaking of that obfuscation towards the overly broad, Patel applauds and encourages Graham’s notion that if you are against software patents you must be against ALL patents.  That’s balooney born of a lack of understanding, pure and simple.  It ignores the fact that patents specifically seek to avoid patenting mathematics and algorithms by jumping on the bandwagon that since we use math for virtually everything patentable, therefore all patents must be equivalent.  Here is the money quote:

Every invention is “just math” when it comes right down to it — traditional mechanical inventions are really just the physical embodiments of specific algorithms.

In other words, I may invent a splendidly complex and unique mechanism, but because I can use math to simulate it, the mechanism is therefore math and should not be patentable.  But since we did want to patent it, let’s just let all things math be patented.  This is the kind of fuzzy chase-our-tails thinking that our patent office evidently uses when granting patents it never should have granted in the first place.

As disconcerting as that kind of thinking may be, it goes to the heart of why we can’t fix the patent system’s problems through fine tuning.  The heart of the problem is that the patent examiners are not competent to decide these issues of what is math, algorithm, or otherwise patentable invention.  They’re not competent to decide whether there is prior art.  They’ve proven this lack of competence time and again by granting patents that never should have been.  They’ve proven it by not being able to keep up with their backlogs even under these lax standards.  Worse, the courts have proven they’re neither a cost efficient nor particularly insightful way to remediate the bad decisions of the USPTO’s examiners.  These are the same arguments put forward by Marco Arment, who does not believe the patent system is fixable.

I don’t know that I agree the system is wholly unfixable, but Marco at least is a developer who makes a living by understanding what software really is, unlike a lot of those who are arguing for software patents.  When I say I don’t know if I agree the system is unfixable, let me clarify.

To fix the system will require some combination of:

1.  Radically simplifying the patent examiner’s task in some way so they can do a better job and do it faster.

2.  Radically simplifying the process and expense of remediating bad examiner decisions so patents can be cheaply invalidated.

3.  Changing the scope, penalties, or legal process of patents so that they can do less damage to innovation.

4.  Ruling out patents in areas where no good solutions can be found #1, #2, or #3.

#1 and #2 seem wholly amenable to improvement.  In fact, I am quite hopeful about them.

Let Persons Skilled in the Art Decide Prior Art

This is a perfect application for Gov 2.0.  The USPTO should let persons skilled in the art participate.  In particular, let them argue the case for prior art both before and after the patent is granted.  We see many examples, Quora and StackOverflow to name two, where questions can be crowdsourced very efficiently.  They work well.  The patent examiners should be given such tools and they should use them to solicit the aid of the community in determining prior art.  In cases where the community mounts a credible documented argument that there is prior art, the patent application should be rejected or if already granted, the patent should be revoked.  This will cost the USPTO very little extra, and what better way to tell if a person of ordinary skill in the field can identify prior art?  That particular issue, prior art, is the best one to crowdsource, for as many will argue, once you hear the idea, everyone will claim it was obvious.  It’s much harder to be ambiguous about the prior art, and in any event, the USPTO remains the arbiter that will decide whether the evidence of prior art is compelling.

While focusing on prior art does not improve the case of granting a patent on an obvious idea with no prior art, it is still very helpful.  This approach seems democratic, fair, and potentially also economically efficient.

What better qualities could we ask for from a broken system that many are saying should simply be junked wholesale?

We Should Also Change the Scope, Penalties, and Legal Process

In addition to reducing the likelihood bad patents will be granted, we should work hard to eliminate the unfair asymmetry between the burden of the plaintiff and the defendant.  As it stands, this asymmetry means the plaintiff need only file a case and wait patiently with their hand out to be paid.  Making it easier to remediate bad patents will help tremendously, but this fundamental unfairness in the system makes it too easy to use the system punitively.  What’s needed is to make the system less profitable for those not actually engaged in innovating or at least producing something of value from innovations.

Applying a shorter term to software patents would be one easy way of improving the balance.  17 years is a ridiculously long-term given the pace of innovation for software.  Half that is still generous and would go a long ways towards making the system more equitable.  Call it 8 years instead of 17 for “business process” and software patents.  If you can’t make reasonable value from an invention in 8 years plus however long the invention is in the USPTO’s hands, you’re not fostering innovation, you’re standing in its way.

Limiting damages for those not actively innovating or delivering their innovation to the market is another change that would minimize the ability of the patent trolls to tax innovation.  It would give the innovators who created their patents an incentive to hook up with real companies to bring those innovations to market.  There’s plenty of real value to be captured that way, and if there is less value than before, we have to ask ourselves whether every patent should be worth the average of $1.5 million Scoble’s math suggests?

Having gotten all of this down in a post, I took a moment to reflect back on it.  Admittedly, my confidence is very low that the USPTO will take the practical steps needed to get back to adding value for innovators.  Perhaps it is my basic distrust and lack of experience with government adding value.  That’s fine, we can go back to arguing about junking software patents altogether.  Just so long as we agree that something needs to be done now.

It hasn’t even been a year since I suggested things might not go swimmingly for WebOS and now they’re discontinuing it.  Such is the life of products at large organizations when directions are being changed.  Apparently they’re also planning to disgorge the PC business.  Shades of IBM’s moves not so long ago.

For those watching from the outside, and for many watching inside, it all must seem tremendously wasteful when big companies operate this way.  What’s the cause?  How can they prevent these things from happening?

First, Big Companies like to act, well, “Big”.  Some are smart about testing, but for many, they invest a ton in a product and launch it with great fanfare without ever having validated what was going to happen before the money was spent.  Even when they do validate, careers and aspirations ride on these things.  Divisions do not go softly into that good night.  For many, the plan may be to launch it and figure out the problems later.  That’s not a bad idea, BTW.  It’s Agile thinking at its best.  But you should at least try to launch something that is close enough that minor tuning is likely to succeed.  Slow following an Apple Uber Product is not a strategy that has shown a great deal of merit.

Second, Big Companies are all about Big Personalities.  Some executive somewhere made the decision happen.  The skills and qualifications needed to make a Big Organization do your bidding are political.  They don’t necessarily have anything to do with whether the decisions being made are great product decisions.  The market will provide the answers to those questions, and careers may be made or broken, but in the end it’s about the ability of the Executive to get the organization sold on the idea more so than selling it to the market.

Third, any time the CEO changes, particularly with a change like this one, the critical underpinnings and foundations that kept earlier decisions going may either be weakened or eliminated entirely.  For truly huge organizations like HP, even executives in the first level or two below the CEO, or major reorganizations can signal these changes.  Following the change there will be a period of turmoil during which all bets are off.  Whatever bad things that happen will be blamed on the prior regime, making it that much easier to put huge changes through.  And once again, the changes will be more a function of the political prowess and position of those driving the changes than on their market viability.  Shareholders have to hope that whoever is doing the deciding didn’t get there without knowing the market pretty well, but they don’t necessarily have much hard evidence of that.  It’s an act of faith.

The bottom line is we shouldn’t be too surprised about all of this, and certainly not shocked.  Look around.  We’re in a time of Big M&A.  The stars are well aligned.  The Economy puts pressure for change on everyone and Big M&A is the favored tool of large organizations for creating Big Change.  It will be interesting to see what sorts of similar fallout we see from the Motorola-Google merger.  Another corollary is if you are a customer, beware betting on some company’s Big New Idea when times are tough.  There may be a Big Change just around the corner waiting to upset the apple cart.  We’ve seen recently changes were produced by Bad Quarters at Cisco.

Big Company customers have to be wary of Big M&A, Big Executive Change, and Big Bad Quarters.