Summer Source Camp, Croatia: Summary & Audiofiles

Basically, this camp couldn't have turned into a let-down because even if it had been lacking content or commodities, you still would've been in a place featuring charming beaches, crystal clear water, nice weather and a continuously low price-level. There's worse than to be stranded on this Mediterranean island. And still, this Software Camp for NGOs - 'Summer Source' - was a logistical success that's worthy of praise. Together with the Multimedia Institute of Zagreb (MAMA), who had had experience as co-organizers of several other cultural events on the island, the Tactical Tech Collective from Amsterdam made a great effort to have everything run smoothly. That, by the way, wasn't all that easy:

Among the 100 or so people present there was people from countries as remote as Mongolia, Tajikistan and the United States. While the Americans didn't have it as difficult to get into Europe -apart from maybe the traveling exertion- others had an adventurous trip getting to Vis. For many, direct entry into Croatia was not possible. For instance, many of those coming from Central Asia had to take a detour via Moscow to get Visas and plane flights to South-Eastern Europe.

Those who had it most difficult were the ones coming from Africa. As Matthias Masawe of the Science and Technology Commission in Tanzania told me, he and his fellow travelers from Mocambique and Zambia first had to visit the nearest Croatian embassy in South Africa to get their Visas, which had already been granted. After spending about one week waiting, negotiating with authorities, come the final day before their departure plane to Zurich, they entered the office of the official responsible and asked what in hell took them so long to be handed their Visas. The official looked at them in slight surprise and asked "Why, are you in a hurry?". One hour later they held their Visas in their hands and were able to take their flight into Europe. Having arrived at Split Airport, however, authorities gave them trouble again. They just couldn't (or wouldn't) believe Africans were trying to get into their country and demanded evidence on business invitations, which after almost another half-day of waiting they were able produce.


"A HIPC solution to a HIPC problem" [1]

The Summer Source Camp was an attempt at bringing together people from the open source/free software world with activists from the non-profit sector and to promote dialogue. It offered hands-on workshops and talks by experienced non-profit activists talking about their successful projects and giving away ideas.

One of them was Ethan Zuckermann of Geekcorps (http://www.geekcorps.org/), an organization that is doing IT development work, among other places in Africa. He told us about the infrastructural problems they are dealing with there and which are meaningful ways to help and which aren't. One of the projects that Geekcorps is helping with is a Ghanaian ISP. This ISP had to make use of such a terrible telephone network that at some point they decided to stop using it. Also, the costs of the proprietary software to be used was much too high. The solution to this was to erect a network of wireless LAN access points across the capital of Accra using a custom Linux distribution that is now serving a quarter of all internet cafes there. Said company is so successful, they're now busy expanding their business into neighbouring countries. You can hear more about this in an audio recording of Zuckermann's session at: http://cleveland.indymedia.org/front.php3?article_id=6773&group=webcast .


"What are you using to log into your Server, Telnet or SSH?" [2]

One of those present gave the wrong answer and had the pleasure of having Jacob Appelbaum, a freelance security consultant from San Francisco, explain to him the advantages of encrypted communication using SSH. In general, Jacob criticized, security at NGOs is not at the very best. He went on to explain how important it was, especially for NGOs operating internationally, such as human rights organizations, to dedicate themselves to the issue of security, since at worst health and lives of people may be at risk. One example for weak security is unencrypted email correspondence, which enables individuals with far less experience than Jake to see content that is going over the network (user and server passwords, names, home addresses, telephone numbers and anything you talk about). Centralized and unencrypted storage of supporter lists, especially in countries with a questionable legal system, can be very dangerous for the people there once the data is compromised.

There is several ways to overcome these insecurities, first and foremost doing email encryption using GPG (http://www.gnupg.org/) or PGP (http://www.pgpi.org/), which are both compatible. Another way of securing your data is using cryptographic filesystems that make it much more difficult for an attacker (such as the government) to steal them, even when they do have physical access to your hard disk. Examples for such cryptographic (or encrypted) filesystems are CFS (http://www.crypto.com/software/ - an older project that is no longer maintained; a complete rewrite has been announced) and TCFS (http://www.tcfs.it/ - a cryptographic filesystem for Linux developed by the computer science department at the University of Salerno, Italy, which is especially suited for use in a network; they are also planning ports to Digital Unix and BSD). If you want to find out about how to encrypt your Linux root filesystem, there is a good HOWTO at http://tldp.org/HOWTO/Encrypted-Root-Filesystem-HOWTO/index.html .

Virtually invisible encryption, also called 'deniable encryption', can be offered by steganography [3] and a corresponding filesystem called StegFS. This filesystem utilizes an already present Ext2-filesystem on your Linux box and fills it with random blocks of data, on which it adds one or more layers of hidden data. This means that it is impossible for an unsuspecting observer to know if there is another layer of data hidden beneath the one he is looking at. This way, even if some of the data is revealed to the attacker, it is possible to plausibly hide the rest of the layers from him. Read more about this here: http://www.mcdonald.org.uk/StegFS/ .

Listen to one of Jacob's talks that was recorded at the camp:
http://richmond.indymedia.org/front.php3?article_id=4299&group=webcast

Listen to an interview with him done by a fellow camp participant:
http://sandiego.indymedia.org/en/2003/10/101377.shtml

Another project that was presented during the week was 'Martus', a system for tracking and storing information about human rights abuses. On first sight, this not so complicated application looks like a mix between a USENET newsreader and an open publishing form. You connect to a server and create a so-called 'bulletin' with all the relevant information; when, where and by whom a human rights abuse has been committed. Attachments such as photographs can be added as well. As soon as this bulletin has been uploaded it'll be mirrored by several servers and remain locked (i.e. unmodifiable) indefinately. Encryption using a keypair concept ensures that information marked as 'private' or 'confidential' can not be accessed by unauthorized third parties. It has also been suggested to make non-private data accessible for journalists and related professions in the future. The software is available under the GNU General Public License and can be downloaded here: http://www.martus.org/ .


Where to go with all the content?

Another session dealt with the question of what's the right content management system, or CMS [4], to use in an organization or project. It's important to make sure it has the features you need, wether there is a committed developer community behind it and if there's sufficient documentation available. Because of the variety of open source content management systems out there, you should take your time and compare. Following is a number of useful websites dedicated to the subject of open source CMSs:

http://www.opensourcecms.com/
This site lets you try out CMSs without having to install them on your local machine first. It also has guidelines to assist in the selection of CMSs for various purposes.

http://www.cmsreview.com/
Provides comparative charts, reviews and resources to help in selecting CMSs.

http://www.cmsinfo.org/
Good site for user and developer contributed news about CMSs, development plans, new releases, etc.

http://sydney.wilderness.org.au/docs/node.php?id=1
"Content Management Systems on Debian GNU/Linux?" - The results of a comprehensive review of a number of CMSs conducted by the Wilderness Society. Includes installation details, browser compatibility and much more.

http://www.oscom.org/
The OSCOM (Open Source Content Management) organization aims to support several Open Source projects improving compatibility between different Open Source CMSs. This site also has a number of useful tools for CMS identification and selection such as a search engine to identify CMSs matching your criteria, a "Feature Comparator", a "Content Management Frameworks/Systems Overview" with a listing of CM Frameworks/Systems, a short description and links to their website, as well as a list of upcoming OS CMS conferences.

As many participants on the camp found out -partly in surprise- there is a huge number of free software/open source software [5] solutions available for all kinds of tasks. The variety of available programs has become so big that one may wonder why many are still using proprietary software to do their daily work.


Open Source/Free Software and NGOs

So, how do we get NGOs to use open source/free software, or why are you as an NGO still hesitating to do the switch? Uncertainty about the practicability/ease of use/long term financial advantages, a swayed perception in the media by the huge marketing efforts behind proprietary software or the ignorance of the availability of open source solutions can be reasons for why you're using that 'most popular operating system of the world', still. A discussion group that dedicated itself to this question came up with a comprehensive beginner's list of things to consider:

What's there to know about Open Source/Free Software?
- First of, there are applications available for all basic needs. Be it office, accounting, email correspondence or internet connectivity. The most basic of all applications are tried and trusted within open source/free Software environments.
- You can share files between Linux and Windows.
- You can do a slow transition from Windows to Linux.
- Global developer collaboration and peer-reviewing practices have made GNU/Linux and similar free/open source operating systems considered to be very stable. Their open source guarantees security flaws a shortened exposure to exploit.
- While Linux is not entirely virus free, its UNIX-based system environment allows for the most basic security features and user restrictions that are not even available for Windows. This means that in the case of a virus infection, damages are usually limited to the user, not the entire system. (There is a recent article at http://www.securityfocus.com/columnists/188 which sparked an interesting discussion that portrays both side's arguments ("MS apologists vs. open source advocates") very well.)
- Free Software is ideal for groups on a low budget using donated PCs without software licenses.
- There is unmatched international language support for Linux.
- For organizations working in a country without copyright laws, they should be warned that if and when laws are changed, they could be at great financial and legal risk.

What first steps should you take if you're considering switching to a free/open source operating system?
- Go into your NGO and do an assessment of your software needs. Do you really need a multimedia environment or is an office system enough?
- Do an install of Linux on one computer and get introduced to it.
- A good start is to replace 'pirate' software with free software. (*Aarrr*)
- Offer training until all members are comfortable with the new software.
- Using a Windows emulator on Linux may allow NGOs to run specific applications that are not yet available for Linux.
- Open Office on Windows can be a good first introduction to open source software and make a later switch more convenient for the user.
- Provide your NGO with an index of local open source/free software communities that can help.

On the downside:
- There are issues between converting some Windows files to Linux software. (Note: This is usually due to Microsoft's policies, rather than the incompetence of the Linux developer community.)
- There are some particular business skills that may require using Windows. It may be a good idea to include Windows in your office and teach Windows if requested.

What should you be aware of when presenting open source/free software solutions to NGOs?
- Get out of the business marketing model and include more about the social goals of free software/open source.
- Use case studies of other NGOs and what successful experiences they have had with free software/open source.
- Define in simple terms the differences and benefits of open source/free vs. proprietary. Don’t use the 'free beer' argument in countries where the analogy might not make much sense.
- Expenses of support are a key variable. Who is available to train, maintain and answer questions? How often and how long term?
- The very first reason to use free/open source should be to help them succeed in their mission. Focus on their practical needs. Ideology is not enough.
- Don’t sell it as perfect. Be honest about the short term issues.

If you're more interested in switching to a non-proprietary operating system you should probably start with Linux and check out some of the sites listed below:

- http://user.tninet.se/~uxm165t/site_map.html - introductions to Linux and related topics
- http://www.justlinux.com/ - HOWTOs and help files (check the extensive library)
- http://www.linuxbeginner.org/ - news-site for Linux beginners
- http://www.linuxhq.com/guides/SAG/book1.html - Linux System Administrator's Guide (advanced)
- http://www.distrowatch.com/ - lists all available Linux distributions
- http://www.knopper.net/knoppix/ - free distribution, which you can boot live from the cd without installation
- http://www.debian.org/ - homepage of the biggest volunteer Linux distribution
- http://www.redhat.com/ - popular commercial distribution
- http://www.in.redhat.com/AppComparisonList.php3 - a Windows/Linux applications comparison chart
- http://www.suse.de/ - popular commercial distribution


What else was going on at the camp?

Another topic that was presented to participants was Extreme Programming (XP). There is about 12 core practices in XP which are pushed to their extreme (hence the name) to achieve software development that is as efficient as possible. Part of it is programming in pairs within a group of developers and no lone wolves hacking away on their own, rigorous planning, simple design that is to be able to deliver a functioning feature set within 2-3 week cycles and common code ownership. For learning more about extreme programming you can have a look at these introductory sites: http://www.xprogramming.com/xpmag/whatisxp.htm or http://jera.com/techinfo/xpfaq.html .

Also introduced on this camp was Debian NP, a special Debian distribution tailored at the needs of non-profit organizations. Next to the basic operating system and some standard applications, Debian NP is to feature a set of software packages that are best suited for effectively running an NGO and to introduce NGOs to Linux and the open source world. You can find more information on their website at http://np.debian.org/ . An audio interview with Benjamin Hill, one of the people behind Debian NP, which was recorded during the camp, is available here: http://boston.indymedia.org/front.php3?article_id=17495&group= .

There is two more interviews in the same audio report, one with David Turner of the Free Software Foundation, expert of the GNU General Public License, and Kwindla Hultman Kramer, co-founder and technical developer of AllAfrica (http://allafrica.com/), a news syndication site offering news from all over Africa.

If you're interested in how the different participants' websites were linked to and from each other you can take a look at a socalled 'social network map' or 'cluster map' created at the camp. This co-link-analysis went three levels of hyperlinks deep to visualize link-relationships between the various projects present at the camp: http://www.govcom.org/publications/drafts/summer_source.html . I believe I can see a dominance by Indymedia there...

Also, during the camp a collaborative audio live stream was organized between the Summer Source activists and the Independent Media Center in Cancun, Mexico, which was established to cover the anti-WTO protests there. In this live stream, which went for about an hour, participants engaged in a conversation via Spanish-English simultaneous translation and talked about their work, their goals and hopes for the future. Unfortunately, the event could not be recorded in whole, because we were only able to get an additional microphone and minidisc recorder at a later point. You can listen to it here: http://la.indymedia.org/news/2003/10/89294.php

In summary, lots of technical possibilities were presented at the camp and expertise exchanged between the participants. There was certainly no lack of hands-on experiences you could make (as seen above) and everyone present must have returned home with a bag full of fresh knowledge new ideas.

But the camp was also about personal exchange, getting together and having a good time. Some had the pleasure of getting to know each other on a diving trip, others by chatting at the bar. And others, like the visitors from Mongolia took the opportunity of their first stay at a beach to learn how to swim.

I believe that most will have returned home with the impression of having made a positive experience. Some of the Linux distributions that were given away at the end of the week will definately make their way onto a number of hard disks. The sense for security will have been renewed for many, and the fact that there is a lot of like-minded people out there in the world like you will have been reassured.

And even if in the end this camp was financially supported by big money out of Soros' Open Society Institute, it is important to realize that passion, creative grassroots activism and sustainable social change cannot be bought. It is still the motivated individuals, who together in a group spend their personal time and energy in favour of progress and change. And this camp was a good example of this.


Final words

When asked to name one thing they had learned on this camp, participants made a variety of suggestions. Next to the simpler ones like having learned how to do key-signing, the NGO jargon and a renewed sense for security, there were a number of more elaborate ones. Among them: 'the synergy between NGOs and the open source world', 'the beauty of commonality', the realization that 'hackers are not virtual - they exist and they take care of us' and having learned that 'copyright is the export of american law with its repression, but without the protection'.

The spirit of community was to live on, someone reassured. However, Gunner, one of the organizers, excused himself for being a buzz killer when he reminded everyone present to beware of community hallucination. 'The good will is a privilege of the moment. The ideas developed on this camp will need passion, perseverence, and communication. Let's focus on communication to keep the lines open - fixate on that and the projects will happen.'

Dovidjenja.

Copyleft Indymedia 2003. All content is free for unrestricted reuse.


[1] HIPC = Highly Indebted Poor Country
[2] SSH = Secure Shell is a program/protocol that enables encryption and authentication for your communication with a remote system, such as a server; Telnet is an older terminal emulation program which, although it enables communication with a remote system, offers no encryption or sophisticated authentication, which means that passwords can easily be compromised, sessions monitored by third parties.
[3] Steganography: The art and science of hiding information by embedding messages within other, seemingly harmless messages. Steganography works by replacing bits of useless or unused data in regular computer files (such as graphics, sound, text, HTML, or even floppy disks ) with bits of different, invisible information. This hidden information can be plain text, cipher text, or even images.

Unlike encryption, steganography cannot be detected. Therefore, it is used when encryption is not permitted. Or, more commonly, steganography is used to supplement encryption. An encrypted file may still hide information using steganography, so even if the encrypted file is deciphered, the hidden message is not seen.
Special software is needed for steganography, and there are freeware versions available at any good download site.

Steganography (literally meaning covered writing) dates back to ancient Greece, where common practices consisted of etching messages in wooden tablets and covering them with wax, and tattooing a shaved messenger's head, letting his hair grow back, then shaving it again when he arrived at his contact point. (http://webopedia.com/TERM/s/steganography.html)
[4] Content management systems (short CMS) enable you to publish or edit content on a website without the need for technical expertise on how to write in source. One example of this would be the various open publishing systems in use by Indymedias all over the world.
[5] Free and open source software describes software whose source code is free/open, i.e. everyone is free to use, modify and redistribute it, given it remains free/open under a corresponding license. The opposite would be proprietary software whose functionality is only known to certain people; its use, modification or redistribution is prohibited unless you pay.

Free/open source software is based on the assumption that when everyone make their software available for use by everyone else in the community, the total productivity of society will have increased, because you can base your own work on -possibly modified- existing technologies without having to go into an unneccessary competition. Over the recent years it has been proven that this approach is not only valid, it has been successful.
[6] Peer-reviewing is a modern method of bugfixing code in which everyone is taking an (almost) equal part in the bug tracking process. After finding a bug in a software product you can fix it yourself and propagate the solution on to the rest of the developing community. This is much more efficient than sending in a bug report to a closed group of developers and having to wait for them to fix it for you.