André Rodier

SeeQuestor is providing to British and international police forces, a complete platform for video conversion, ingestion, and analysis. The platform includes motion detection, face recognition, re-identification, etc. The whole stack is using nVidia GPU hardware and CUDA stack.

I have designed and implemented the whole hardware and operating system stack, necessary to provides these services, using the prototype already in place.

The platform also includes Windows based virtual and physical machines, for proprietary formats analysis and screen scrapping.

Its access is secured through two isolated virtual private networks, for administrators and customers, and is undetectable externally.

I used the same methodologies to deploy the platform on AWS, with little or no modifications. The platform was behind a load balancer and this time publicly accessible. Various strategies have been employed to secure the platform anyway.

To work with national crime agencies in UK, SeeQuestor needed to be certified with strong security credentials, starting with Cyber Essential and Cyber Essential plus certifications.

I have designed and deployed the network infrastructure to optimise the working environment and be compliant to Cyber Essentials.

I have detailed the practices for the developers, the managers and the directors to follow in order to pass the security audit.

I have conducted some basic penetration tests before the official audit company.

I have implemented a platform self decryption on boot, to protect both intellectual property and unauthorised access. The platform is protected by a randomly generated OATH code generated offline, with a mandatory online validation method.

Bulbthings developed an asset management application, to handle their life cycle efficiently, and reduce the costs. Any type of asset was possible, like cars, printers, phones, etc.

The application targeted companies of any size, from small and medium sized companies to corporate with international branches.

The initial application was architectured on top of a MySQL database, a PHP/Symfony back-end used as a REST server, and an AngularJS/Metronic front end. The Back-End was assorted with other programs for HTML web sockets, in go.

I took part in the rewriting the whole application stack, with robust continuous integration techniques and bottom-up vertical development. I have used modern technologies and best practices: For the database, we used PostgreSQL, a hybrid relational database, that allowed querying hierarchical data trees, dynamic schema updates, as well as geolocation and distance calculation.

For the back-end, we used server side JavaScript (NodeJS), with a REST API framework and web socket implementation out of the box.

The whole stack was thoroughly checked using a Continuous integration system, at many level:

• For the back-end: unit tests and integration tests with coverage analysis.
• Asynchronous testing of the Rest API on each commit.
• For the front-end: automated acceptance tests using two real web browsers and automatic screenshots.

The instances were automatically deployed by Jenkins on the GCE. We first used an ensemble of bash scripts, but we later migrated them to Ansible.

Each instance was automatically deployed on a sub-domain and instantly accessible, without having to wait for DNS propagation.

We were using wildcard certificate to ensure simple https support, as well as http version 2 to reduce the charge.

We also used four front-ends to distribute the charge using DNS.

To import customers data, I wrote a Python framework that automatically parsed CSV files and use the back-end API.

• Validation of the data consistency
• Handling of errors
• Automatic errors reporting by email

After working with a more and more Microsoft oriented environment, I have chosen this position as a “return to the roots” to Open-Source. There was in this company a real desire to leave Microsoft technologies for less vendor lock-in solutions. My experience in both domains has been a decisive criteria for this role. I have managed to migrate all the services to Ubuntu and Debian based environments.

It was a challenging position, with a huge workload. The environment itself was built upon a ten years old structure, using mixed open source and proprietary technologies.

All these applications have been gradually replaced by modern LAMP stacks using agile methodologies, continuous integration and unit testing.

I have first installed a replicated and shared authentication system based, so everyone had to remember only one password. I have then replaced AD by a Samba server, and activated roaming profiles.

The Exchange server has been replaced by three email servers hosted on two different internet connections. Emails were digitally signed and certified. A dual internal / external Jabber server was also included.

I have also deployed solutions allowing remote workers to transparently access all the services from home, like a VPN and a private cloud.

Finally, I have replaced in-house developed intranet with a secure and modern wiki.

The “Consumer Directory” is a web site containing a large base of consumers, who can register themselves. Once registered, they receive invitations to take parts into surveys, after filling screeners.

I have used a Drupal as a content management framework to build a feature rich, modern version, and migrated transparently all the members. All their details have been validated and reformatted, and their initial password kept.

One of the prominent feature was geolocation, allowing a simpler search than just by post codes.

The system has been customised to do mass messaging and automatic bounces management. All emails sent were digitally signed with DKIM and SPF, reducing false classification as SPAM.

Finally, all this stack was checked using continuous integration tests in a real web browser.

The company was initially using a Microsoft Access database to store their recruiters details, and was using paper and posts to communicate invoices and payment.

Using the same CMF, I have created an online system, imported the fieldworkers database, and added some useful features:

• Fieldworkers were able to update their details and upload their ID themselves.
• Emails alerts were automatically sent as soon as new jobs were posted.
• Project managers were able to search fieldworkers using various criteria, like domains of expertise, geolocation or personal data.
• Recruiters were able to submit their invoice directly to the system.
• The invoicing process was integrated into a workflow, involving project managers and finance department.
• Each action was logged and emails were sent on specific events.
• Project managers were able to rate recruiters or log misbehaviour. This was then accessible by the rest of the team.
• Statistics and Financial reports by month, recruiter, project, etc. with email alerts on budget exceeding.

The authentication system was transparently integrated with our internal directory server, allowing the project managers to authenticate with their normal password.

To build the new web site, I have used the same framework, but this time as a Content Management System. With a customised responsive theme for mobile devices, the same information was presented differently on phones, tablets and screens.

Using a CMS allowed some departments to add content themselves, which was then validated and aggregated to create new pages. The web site was connected with an analytic system, with weekly and monthly reports sent by email to client services and directors.

I have also integrated of a real time chat system, connected to the client services department.

Some custom modules have been developed, for instance to handle mailing lists unsubscriptions from clients.

Phone interviews from the call centre were manually archived and processed by an operator everyday. I have replaced this by a set of Perl scripts thoroughly tested. Compared to manual processing, this was faster and less prone to errors.

The script was able to combine related records together and encode them in different formats, according to client's preferences.

The system was also able to upload records on client's web sites via FTP or to archive them on blu-ray discs at the end of each month.

Finally, an email was generated every night with a summary of events.

This web site has been developed to query national vehicle registration services in UK, to obtain all details from a plate number. The information returned was the make and model, the power, etc.