SBA

An Authentically Digital Company

Everyone in the Isle of Man Finance sector is familiar with KYC - Know Your Customer. Similarly we customers are all too aware of this regulatory regime; it is the bane of our lives whenever we wish to make any substantial financial change - moving bank account, starting a pension, renting a flat - everyone wants to know where our hard-earned money came from (whatever happened to the adage “never look a gift horse in the mouth”?). KYC identifies us to financial counter-parties, but how does it work on the web?

Digital Certificates are packets of encrypted data which identify data as being genuinely issued by the issuer. They are used to establish encrypted communications between computers, to check that data has not been modified between issue and receipt, and to validate the identity of the issuer of the data. Digital Certificates are therefore basically KYC for electronic communications, and they can be used to validate websites, email, PDF documents etc. as being authentic. For some of you this will answer a question you’ve never before bothered to ask - how do I know this thing I’m viewing on my computer is not a forgery?

It’s logically a small step to realise that someone must do KYC before issuing a Digital Certificate, and that obtaining a certificate is likely to be a pain in the proverbial. Digital Certificates are issued by CAs (Certificate Authorities) and there are several major and many minor CAs in the world. One of the big players is Thawte Consulting, which was founded in South Africa by island resident Mark Shuttleworth - that’s how he made his first serious money. The CA is the organisation which does KYC on an organisation or individual and then issues a Digital Certificate (also called a Public Key Certificate) accordingly. Digital certificates may be issued in different levels, with Extended Validation certificates requiring more due diligence and therefore costing more and being more hassle to buy and manage.

Which brings us to TBS Internet. TBS Internet started in 1996, in France, as the country’s first certificate “manager”, basically an intermediary or broker which took away much of the pain in managing certificates for large corporates by managing the certificates and helping customers through the regular re-authentication process for them (digital certificates normally have to be renewed every one to three years). TBS also developed their own in-house system to assist customers with the process of getting their documentation correct so that certificates could be processed the same day. By 1998 TBS had 50% market share for server certificates in France. Over time the company developed relationships with several of the top global CAs who issue the expensive high-credibility certificates, and in 2006 TBS internet became a CA in its own right and started issuing lower-cost certificates for SMEs etc. Buying and installing Digital Certificates is complex, and technically tricky - installation on the computer has to be just right in order for the certificate to function correctly. TBS expanded their role from simply helping companies buy certificates into providing technical support for the installation process, and now publish over 900 pages of technical documentation to guide people in installing their certificates into different applications on different operating systems. Going a step further they also developed a system which checks the installation of customer’s certificates shortly after purchase so that the company can advise them if the certificate has been incorrectly installed. TBS estimate that approximately 30% of certificates are incorrectly installed by customers, which is one of the most common causes of the padlock symbol being unlocked or crossed out when you’re browsing the web.

This path of expanding both the product set and the depth of service offered to customers enabled TBS to establish itself as a major supplier in France, to the extent that for further growth it was necessary for the company to expand internationally. TBS CEO, JP Donnio, soon concluded that France was not the best base from which to expand internationally due to the country’s overbearing business and employment bureaucracy, so he started looking for another base. JP was already aware of the Isle of Man due to his interest in satellites (JP is the author of The Satellite Encyclopeadia) and a conversation with Mark Shuttleworth, who as founder of Thawte had been a major supplier, led JP to visit the island in 2011 for a closer look.

He liked what he saw - a business friendly environment welcoming to entrepreneurs and espousing the philosophy that small is beautiful. Working with a CSP he established a new office for TBS Internet on the island, and by the end of 2011 had his first programmer working on island and redeveloping the TBS web platform, which is hosted locally.

In 2012 JP started looking for a second programmer on island, and that’s where our limitations started to show. The TBS Internet system is developed on a classic Internet technology LAMP (Linux, Apache, MySQL, PHP) platform and, as I have written previously, these technology skills are in a minority on the island. Eventually JP found someone and currently has two full-time programmers on island developing the TBS system, but that has not always been enough and the company has needed to consider outsourcing development, using off-island contractors, and hiring in from abroad in order to find the IT development skills it needs. The local scarcity of Internet technology skills is a constraint to expanding on-island employment.

JP himself was not able to move to the island when he established the new Isle of Man HQ, however he has subsequently relocated here and very much enjoys the island. It does however have its limitations. The offices of TBS Internet, overlooking Athol Street, are served by a fibre Internet connection. It’s not the fastest although it’s certainly much better than most of us have, but it looks distinctly inadequate when compared with the connectivity enjoyed by tech hubs in the UK and mainland Europe. Bluntly JP is not impressed by the island’s technology infrastructure and believes we have an overly inflated opinion of our local facilities and capabilities. Certainly the class of Internet connection generally available is far from ideal for Internet businesses.

Another local weakness concerning JP is the absence of a technology community. The lack of tech meetups, hackathons, startup weekends and the like compared with other locations has made it harder to meet other technologists and find potential employees and collaborators. In respect of employment TBS is considering, although it is a small company, taking on trainees next year to grow its own local talent given the shortage of available skills.

I asked JP where next for the company. He has a large market to go at, the huge majority of websites, c. 97%, currently have either no authentication and encryption or very low quality certificates, and he sees the demand for certificates expanding and the lower quality certificates diminishing as web users demand better assurance that their data and money is going to genuine organisations. JP also sees a move away from purely digital certificates towards authentication being more embedded in physical objects or authentication tokens - which of course will require the same underlying validation as existing certificates but can provide increased security.

TBS Internet is clearly an Isle of Man success story; the company enjoys being here and the business climate has suited its desire to expand internationally. As a very specialist organisation it is an excellent example of the “small is beautiful” philosophy that suits the small scale of the island and shows the possibility for us to attract many similar small companies to establish a real footprint here from which to serve their global markets. As I have written previously however, if we want more of these businesses we will have to address our digital skills availability, and in particular the crippling shortage of Internet technology skills.