Introducing the Government Innovation Manifesto

As I work more and more with government innovators, I’ve learned that despite the fact that we come at it from many different angles, there is a common ethos and camaraderie. We’re all after the same thing: to improve government to better serve the governed.

They say we get the government we deserve. We say let’s earn that right to deserve the government we get by contributing to improving it.

To that end, Brenda Wallace and I wrote the Government Innovation Manifesto to bring these aspirations together in actionable statements.

The main headings:

  1. Government innovators are everywhere
  2. We innovate to improve our society
  3. Innovation is a team sport
  4. There are rules
  5. Innovation is risky
  6. Innovation is hard
  7. We are change agents

Read more at The Government Innovation Manifesto.

The perfect alarm ringtone

One of the true delights of having kids is their help in music discovery. One of mine is a diehard death metal fan, and recently introduced me to Zeal and Ardor. I had a little listen to their YouTube collection, and came to Children’s Summon.

It starts off with a pleasantly jingly xylophone solo that covers a range of notes that will cut through ambient noise, followed by a death metally and loud guitar riff, followed by  some quieter but nevertheless jarring rhythmic growling in what vaguely sounds like Latin, and then, you knew it was coming all along, ear-piercing cacophony that will certainly fry your brain if you let it go on for too long.

Which makes the first part of this song the perfect alarm ringtone. You know you had better wake up and press that dismiss button before you get to the last bit.

I present you with the Children’s Summon ringtone, which you can download (right-click on that word ‘download’, then “save link as…”) or just listen to it below.

If you like this, I encourage you to listen to more Zeal and Ardor.

The Public Policy Lean Canvas

I’ve been invited to participate in the Startup Nations Summit in Tallinn, Estonia this coming November, representing New Zealand. The central event at this year’s summit will be a Policy Hack, in which delegates from all over the world will get together to collaboratively nut out government policies relating to startups.

If you’ve ever spoken to me for more than five minutes, you’ll know that I’m a huge fan of Eric Ries and Steve Blank’s Lean Startup Methodology, and that one of my favourite tools is Ash Maurya’s Lean Canvas. Way back in 2013, Rowan Yeoman and I applied the Lean Canvas to Social Enterprise, and produced the Social Lean Canvas, which (mainly thanks to Rowan) has taken off globally.

But how can we apply the key elements of the Lean Startup Methodology to public policy? By that I mean:

  • Your business (or endeavour) can be treated as a science experiment using the Build – Measure – Learn cycle
  • Get out of the building – there is no knowledge inside the building
  • Before you reach product-market fit (ie, a scaleable, repeatable business model), the main measure of progress is learning; any time or resources you don’t spend on learning how to reach product-market fit is wasted
  • You’ll learn a lot more by measuring what people actually do than you will by asking them hypothetical questions.
  • Don’t waste time or resources on premature optimisation

The beauty of the Lean Canvas is that it allows you to quickly jot down and keep track of the key aspects of your business, and identify the key assumptions underlying those aspects, so that you can go out and validate those assumptions. Generally, you’ll want to start your validation with the riskiest assumptions – those assumptions which if proved incorrect (invalidated), will kill your business.

So I cooked up a Public Policy Lean Canvas. You can go and get it at

Knocking vulnerability scanners with fail2ban

I’ve been running fail2ban on my Linux servers for years. It’s a neat little piece of software that detects people trying to break into your system, and then ignores any further packets from the intruder’s IP address for a period of time. It comes as a standard package for many distributions, and is easy to install and set up. It has limitations – it can’t really deal with distributed attacks – but it’s very useful for what it does.

Recently I’ve noticed a large number of automated scans from the Jorgee vulnerability scanner, using numeric IP addresses. Apache log entries look something like this: - - [01/Sep/2017:00:51:58 +1200] "HEAD HTTP/1.1" 301 238 "-" "Mozilla/5.0 Jorgee" - - [01/Sep/2017:00:51:59 +1200] "HEAD HTTP/1.1" 301 239 "-" "Mozilla/5.0 Jorgee" - - [01/Sep/2017:00:51:59 +1200] "HEAD HTTP/1.1" 301 242 "-" "Mozilla/5.0 Jorgee" - - [01/Sep/2017:00:51:59 +1200] "HEAD HTTP/1.1" 301 244 "-" "Mozilla/5.0 Jorgee" - - [01/Sep/2017:00:51:59 +1200] "HEAD HTTP/1.1" 301 236 "-" "Mozilla/5.0 Jorgee" - - [01/Sep/2017:00:51:59 +1200] "HEAD HTTP/1.1" 301 236 "-" "Mozilla/5.0 Jorgee" - - [01/Sep/2017:00:51:59 +1200] "HEAD HTTP/1.1" 301 236 "-" "Mozilla/5.0 Jorgee" - - [01/Sep/2017:00:52:00 +1200] "HEAD HTTP/1.1" 301 236 "-" "Mozilla/5.0 Jorgee" - - [01/Sep/2017:00:52:00 +1200] "HEAD HTTP/1.1" 301 237 "-" "Mozilla/5.0 Jorgee" - - [01/Sep/2017:00:52:00 +1200] "HEAD HTTP/1.1" 301 237 "-" "Mozilla/5.0 Jorgee" - - [01/Sep/2017:00:52:00 +1200] "HEAD HTTP/1.1" 301 237 "-" "Mozilla/5.0 Jorgee" - - [01/Sep/2017:00:52:00 +1200] "HEAD HTTP/1.1" 301 237 "-" "Mozilla/5.0 Jorgee" - - [01/Sep/2017:00:52:00 +1200] "HEAD HTTP/1.1" 301 231 "-" "Mozilla/5.0 Jorgee" - - [01/Sep/2017:00:52:01 +1200] "HEAD HTTP/1.1" 301 232 "-" "Mozilla/5.0 Jorgee" - - [01/Sep/2017:00:52:01 +1200] "HEAD HTTP/1.1" 301 233 "-" "Mozilla/5.0 Jorgee" - - [01/Sep/2017:00:52:01 +1200] "HEAD HTTP/1.1" 301 232 "-" "Mozilla/5.0 Jorgee" - - [01/Sep/2017:00:52:01 +1200] "HEAD HTTP/1.1" 301 233 "-" "Mozilla/5.0 Jorgee" - - [01/Sep/2017:00:52:01 +1200] "HEAD HTTP/1.1" 301 233 "-" "Mozilla/5.0 Jorgee" - - [01/Sep/2017:00:52:02 +1200] "HEAD HTTP/1.1" 301 229 "-" "Mozilla/5.0 Jorgee" - - [01/Sep/2017:00:52:02 +1200] "HEAD HTTP/1.1" 301 233 "-" "Mozilla/5.0 Jorgee" - - [01/Sep/2017:00:52:02 +1200] "HEAD HTTP/1.1" 301 229 "-" "Mozilla/5.0 Jorgee" - - [01/Sep/2017:00:52:02 +1200] "HEAD HTTP/1.1" 301 228 "-" "Mozilla/5.0 Jorgee" - - [01/Sep/2017:00:52:02 +1200] "HEAD HTTP/1.1" 301 231 "-" "Mozilla/5.0 Jorgee" - - [01/Sep/2017:00:52:02 +1200] "HEAD HTTP/1.1" 301 231 "-" "Mozilla/5.0 Jorgee"
... and so on ...

There’s no point in encouraging those!

So I cooked up a new fail2ban rule.

In filter.d/apache-numeric.conf:

# Fail2Ban configuration file
# Regexp to catch numeric ip address accesses

failregex = ^ -.*"(GET|POST|HEAD) http\:\/\/\d+\.\d+\.\d+\.\d+.*$

ignoreregex =

# Author: Dave Moskovitz

… and in jail.local:

enabled = true
filter = apache-numeric
action = iptables-multiport[name=ApacheNumeric, port="http,https"]
logpath = /var/log/apache2/*/access.log
bantime = 3600
maxretry = 3

et voila, numeric IP scans curtailed.


Early stage investment tradeoffs

I was asked recently by one of the companies I’m working with that is post-prototype, but pre-revenue:

How can I make this deal sweet enough for early stage investors without jeapordising future investment or diluting founders further?

That is the dilemma.

As a founder, you need to get cash into the company to grow, often just to survive, and you aspire to create massive value for yourself and investors.  You don’t want to be diluted, and you know that later investors will want to see the founders sufficiently motivated.  But at the same time, you need to make the deal really attractive to investors now if you’re going to get them to invest in your company so that you can survive and thrive.

What to do?

Convertible notes are one method, but they are no means a panacea.  Convertible notes let you avoid the question of valuation (and dilution) until the next round, when ideally you’ve reached a much higher valuation. Some investors don’t like them at all, considering them a way of putting off the hard question of valuation, and avoiding showing progress through a series of successive equity rounds at steadily increasing prices.  Most convertible notes come with general security agreements, meaning if you can’t close the next round on acceptable terms, your noteholder might be in a position to bankrupt your company and you could walk away with nothing at all. This rarely happens though, as it’s a “mutually assured destruction” scenario, and your investor would likely walk away with nothing as well.

My wise friend Simon Swallow summed up the issue this way:

[Founders] have to work out their prepared trade-off for speed versus probability of success versus value versus share.

So are they better to bootstrap it and take longer to get to the end point and not dilute as much, or raise money to give them a greater chance of success happening sooner but be prepared to give away a portion of the company?

Companies have momentum and if you generate strong positive momentum then people get on board, but if you don’t, the company sits on the shelf and passes its expiry date eventually.

And finally if you want to get you have to give.

If you’re going to get diluted, you want to ensure that the dilution hit you’re taking results in the percentage you still own experiencing a much great value uplift than had you bootstrapped.

Andy Lark once expressed this one year at Morgo as, “what would you prefer – a small piece of a portion of the hind leg of a cattlebeast, OR THE ENTIRE ANT?”  If you’re seeking investment, make sure you’re selling a cattlebeast and not an ant.

A friend who is a startup CEO and founder adds (slightly paraphrased):

There is another tradeoff – remaining in NZ, or raising overseas where investment terms are generally more favourable.

I suspect that many deals are not optimal in that founders leave money and terms on the table, because they are less experienced at negotiating than the investors on the other side.  If that’s the case, get someone with the necessary experience on your side, and ensure that their goals are aligned to yours.

Back to the original question: for very early stage companies, how do you balance dilution, current terms, and future rounds?  My simple prescription is to figure out how much money you really need to (a) enable rapid growth that you can commit to now and track, showing a path to monetisation, and (b) avoid spending all of your time and energy on raising money for the next 18 months.  Then execute and achieve those goals.  And as a general rule, if you get an investment offer on terms you can live with, take it.

Sounds easy, eh.

InternetNZ Council Candidate Statement 2017

Hello, my name is Dave Moskovitz. I was member number two of the Internet Society of New Zealand (as it was called then) in 1995. I have been on the InternetNZ Council since 2010, and I am asking you to re-elect me for one final term so that I can focus my efforts to bring operational efficiency to our organisation.

TL;DR: I’m an experienced Internet technologist, company director, and innovator. InternetNZ does great work, but has become top-heavy. The time has come to consolidate our gains, and focus on operational efficiency. Rather than growing ourselves, we should put our resources into better supporting other organisations that do good work that is aligned to our objects.

You can find out about my professional background on my blog or LinkedIn profile. Briefly, I’m a software developer by trade, more recently a serial entrepreneur, startup investor, and company director, and passionate about growing the New Zealand digital economy through new companies doing cool stuff on a global stage using the Internet. You might be interested in watching my TEDx Wellington talk on The Four Superpowers of the Internet.

When I entered Council in 2010, InternetNZ was a vastly different organisation, and Council was a very different place too. During my tenure, we’ve seen:

  • The diversification of Council from an all-white-male group to a body that contains a significant number of women as well as Māori representation. Most meetings now have roughly equal numbers of women and men attending.
  • Council lifting its game from being fractious to working well together, respectfully debating the issues to achieve the best outcome for wider society.
  • The professionalisation of staff where InternetNZ is now seen as an important contributor to Internet policy development, and a worthy steward of the dot-nz domain space, as recognised by Government through a Memorandum of Understanding. Our focus areas – Access to the Internet, Trust on the Internet, and Creative Potential – are exactly the areas where InternetNZ can have the most impact. We continue to run a world-class domain name registry with open, transparent, robust policy.
  • The introduction of a formal grants programme and strategic partnership programme whereby we distribute significant funding to other organisations aligned with our objects. We’ve funded a wide variety of important work including such varied initiatives such as relatively early research into SDN, the Christchurch rebuild, the 2020 Trust, and Creative Commons Aotearoa/NZ. Through sponsorships, we’ve also supported Kiwicon, GovHack, Rails Girls, and many more.
  • Key issues supported by our society, such as the rewrite of Section 92a of the Copyright Act to prevent rights holders from wantonly prosecuting alleged infringers, and the nationwide rollout of Ultra Fast Broadband. We also fought against the TPPA, and managed to mitigate some of its worst components, pushed for the establishment of a CERT and rallied against the Vodafone-Sky merger. We’ve also exhibited great leadership in the areas of encryption, copper pricing, and contributed to the Digital Future Manifesto.
  • Much better engagement with our membership and the wider public through events such as NetHui, public speaker series, publications such as dotNews, and stories in the mainstream media.

In many ways, the organisation is on the right track. But things are not nearly as good as they could be. As three organisations (InternetNZ, Domain Name Commission Limited, and NZRS Limited) we lack alignment and could work much more effectively. There has been more than one occasion in the last few years where one of our constituent organisations has “lawyered up” against another. This is not acceptable, and a waste of resources and goodwill. There is unnecessary duplication of effort between the organisations, and no great incentives to coordinate. As a group we’ve sent nine people to an ICANN meeting – without a single structure, there is no way to keep costs like this under control. There are eighteen governors, three CE’s and three deputy CE’s (or equivalent) – that’s crazy for a group of 30-40 people. Our resources are unnecessarily siloed, and we obtain a poor return on investment from them.

I was on the Council’s Organisational Review Committee which recommended that the three organisations be combined into one. It’s worth noting that I am also Council’s nominated director on the board of the Domain Name Commission. This board would be disestablished should the recommendation be carried through, so you could call me a turkey voting for an early Christmas. I also believe that the size of Council should also be significantly reduced.

On the subject of the Domain Name Commission, we could have done a better job in the recent WHOIS consultation. I accept my portion of responsibility for the organisation’s initial poor consideration of vulnerable people affected by the lack of a robust privacy option. However I am satisfied with where the policy landed – we continued to consult, listened, and ultimately ended up with a good result.

I have been a hardworking Councillor, and have a member of the time-consuming but important Grants Committee, and I believe I’ve only missed two Council meetings during my tenure. On Council, I have by far the most experience in governance, and am one of four Councillors with in-depth experience in writing software that implements the protocols that are the core business of our organisation.

Should I be re-elected, my focus will be on Operational Efficiency: turning the InternetNZ group into a high functioning, efficient, authoritative, well-oiled machine that continues to provide world class policy advice, registry services, and works hard for the Local Internet Community as required by RFC1591. Rather than continuing to grow as an organisation, I would rather see InternetNZ deploy its resources in better supporting allied organisations through more grants, sponsorships, and strategic partnerships. Rather than trying to do more ourselves, I believe we will be better off enabling others to do great things with the Internet in their respective spheres of interest.

If you would like to discuss anything with me, I am always available on my email or my mobile +64 27 220 2202.

Publons angel exit

Daniel Johnston and Andrew Preston at Startup Weekend Wellington 2012

Publons, a company that came out of Wellington’s Lightning Lab accelerator in 2013, and of which I was the first investor and (until 31 May) Chairman of the Board, has been acquired by Clarivate Analytics. Publons provides a platform that gives academics credit for the peer review work they do, and whose mission is to “speed up science through the power of peer review”. Clarivate’s mission is to “accelerate innovation”, and are the main authoritative industry source of, inter alia, academic bibliometrics. Clarivate was formerly known as Thomson Reuters IP and Science, and changed its name when it was bought by private equity interests last year.

It is New Zealand’s first significant exit from an accelerator programme.

I’ll write more about this in the coming weeks, as it bodes well for the New Zealand startup ecosystem. Founders, employees, and investors all did well out of the exit, and much of the proceeds of the sale will be ploughed back into local startups.

The Publons story is a textbook case of how to build strategic value: “‘Publons now find themselves at the heart of the rebuilding programme to support Clarivate’s reinvention, and a vital part of the system of reference and authority needed to maintain scholarly communication in a digital, networked age,’ says David Worlock, a UK-based publishing consultant with knowledge of the deal.” [Nature]

“It’s a huge win for startups, their founders, and investors…” [NZ Herald]

More coverage:
Peer review is thankless. One firm wants to change that. [The Economist]

Funders and publishers will likely be glad to see a visible expansion of the pool of peer reviewers with validated track records. And more researchers may see the benefit of easily creating a record of their peer review work. Expansion and independence of publishers may well give Clarivate Analytics sufficient advantage to establish Publons as the de facto standard for crediting peer review. [The Guardian]

Formal recognition for peer review will propel research forward. [London School of Economics Impact Blog]

The companies describe themselves as the world’s preeminent citation database and the world’s largest researcher-facing peer-review data and recognition platform. [Research Information]

Peer review is at the heart of our ability to trust research but is often accused of being slow, inefficient, biased and open to abuse. By recognising reviewers and bringing transparency to the review process, Publons has built a platform to conform these issues head on. And now, with the worldwide reach, citation network and research tools offered by Clarivate Analytics, we can tackle these global issues on a global scale. [Victoria University News]

Peer review is the last, great, closed part of the research lifecycle. Data on peer review needs to become a core component of the research record. Bringing transparency, recognition, and training to peer review will result in better reviewers and a faster, more trusted research process. [Publons blog]

The Publons deal will give a much-needed confidence boost to the local [NZ startup] ecosystem which is very positive. [Ben Kepes’ Diversity blog]

It takes a village to raise a startup, and I’d like to thank the following people and organisations for their hard work and support:

  • The founders, Andrew Preston and Daniel Johnston – visionary, hard working, resilient, crazy smart, coachable, humble, trustworthy, team players, and rigorously scientific in their approach. That’s really the investable founder checklist.
  • The Publons team, who continue to pull out all stops to speed up science
  • Investor and board advisor Simon Swallow, a steady hand with laser focus who backs up his excellent advice with the hard yakka to bring it to fruition
  • Our local Wellington angel investment club, AngelHQ, and particularly the legendary Serge van Dam and Trevor Dickinson
  • Strategic investor SAGE Publishing Group, and their fearless leader David McCune
  • Institutional investors K One W One and NZVIF’s Seed Co-Investment Fund
  • CreativeHQ, Lightning Lab, and Dan Khan for running New Zealand’s first accelerator programme from which Publons was launched
  • My own family whose trust and support are the pillar of my strength
  • All of the reviewers on the Publons platform

Building the entrepreneurial community we want to live in

What are the foundations of a great national entrepreneurial community?

After the Startup Weekend NZ National Hui in 2015, I drafted a plan based on feedback from the hui’s unconference.  It included:

Vision:  Every New Zealander has the ability, tools, and networks to become an entrepreneur

Mission: To provide access to the community, experiences, and support that emerging entrepreneurs need to succeed, working directly with entrepreneurs as well as with other organisations.


  • Community leadership:  Our members – our key resource – are Community Leaders. We believe that a successful startup ecosystem depends on supporting and bringing out the best in those willing to contribute. As leaders in our field, we set an example by the way we work with others, and help others become leaders. We’re confident in who we are, and willing to help, support, and encourage those whose values are aligned with ours. We put the mission before our own glory.
  • Reciprocity: Once we’ve committed, we’re in – our partners can count on us, and vice versa. We are transparent and honest with each other, partners and constituents, and expect the same from them.
  • Responsive, mindful, and enabling: We are responsive to community needs, and enable others to move purposefully and quickly.  We use lightweight and flexible infrastructure to achieve this.
  • Lasting value: We’re in this for the long-term future of New Zealand and its entrepreneurs. We measure the impact of our outcomes, seeking constant improvement in the things that matter.

I suggested that we could achieve our mission and vision by:

  • Providing experiential education for entrepreneurs, including Startup Weekends, and shorter form workshops
  • Building and developing entrepreneurial communities, bringing people of all stripes together, and being a catalyst for serious shifts in the landscape, especially outside the main centres
  • Connecting entrepreneurial communities locally, nationally, and globally, forging better ties across geographic boundaries, sharing our resources, time, and experience for the betterment of all
  • Working on improving startup policies to nurture an environment in which startups can thrive
  • Celebrating entrepreneurship through programmes like Global Entrepreneurship Week

And to make it all happen, I suggested that we could engage in partnerships with:

  • Entrepreneurs and their startups
  • Local and central government
  • Universities and other tertiaries
  • Accelerators, incubators, and coworking spaces
  • Other allied organisations, such as Youth Enterprise Trust, the Innovation Council, NZTech, the Angel Association of New Zealand, and more.

I believe that the governance of an organisation executing this plan should be transparent, diverse, egalitarian, and democratic, and that financially it should be organised as a not for profit, ideally with charitable status.

The plan languished for a year, and was never adopted – it was a bridge or three too far for the other directors. Even though the plan has stalled, I’m still very keen to make it, or something similar based on the same values, happen.

Others have expressed very similar ideas, including Dan Khan, Pascale Hyboud-Peron, Lenz Gschwendtner, Peter Thomson, Jane Treadwell-Hoye, Sarah Day, Colart Miles, and Ants Cabraal. Although our expression is slightly different, there is a large degree of congruence and alignment.

I look forward to working with similarly minded people and building that entrepreneurial community we want to live in, so that we can move New Zealand to the next stage.

Are you in?

Join the discussion in the comments below, or on Twitter hashtag #startupcommunityvalues


Pre-seed advisory board agenda template

I recently took on the role of Entrepreneur in Residence at the Kiwibank Fintech Accelerator, powered by Lightning Lab.  Consider me the “Mentor-in-Chief” – as well as advising the ventures and helping them make great connections and destroy roadblocks, my main job is curating the relationships between the ventures and their mentors, and later in the programme, between the ventures and their [potential] investors.

We have a super strong group of mentors contributing to the programme, and we’ve organised them into advisory boards for the teams. I am totally humbled by the calibre of the mentors, and their generosity in contributing to the growth of these nascent startups.

If you’re a mentor in this programme, or in any other programme, please accept my deepest heartfelt thanks for your contribution. People like you make the startup world go round.

Here is my suggested agenda for a one-hour pre-seed Advisory Board meeting.  NOTE: this is only a template, and should be adjusted (likely cut down) to your specific requirements at the time.

1. Welcome and into (5 minutes)
Roll call
Conflicts of Interest
Approval of previous minutes
Matters arising from the previous minutes

2. Context (10 minutes)
Current pitch and feedback
Changes to Lean Canvas
Learnings from last week
Key things we need to learn
Product update1
Roadblocks we need to destroy3

3. Metrics (5 min)
Site analytics (acquisition)
Users: total, active, growth rate week-on-week (activation)

4. Sales (5 min)
What’s working
What needs improving
Action plan

5. Investor wrangling (5 min)
Who have you talked to?
Who should you be talking to?

6. Strategic Topic (changes every meeting, be sure to set this in advance) (15 min)

7. Other business (5 min)

8. Actions and deliverables (who is going to do what by when) (5 min)

9. Next meeting time and farewell (5 min)

If I had more than an hour, I’d throw a little bit more time at context, and most of the time toward strategic. I’d like to stress that the above is only a template – what you actually use will vary from startup to startup, and from meeting to meeting. Do not stick to the template slavishly, but use it as a mnemonic or a guide.  The timings are so quick, but it is designed for an accelerator, where things happen quickly.  If you want to make a longer meeting, I’d throw the extra time at strategic topics, where you’re going to get the most value.

You can (and should) also make time to meet individual advisors or mentors outside of your advisory board meeting. Also, encourage them to talk to each other (we have a Slack for that) in between meetings.

I’m interested in community feedback for the above agenda. Am I missing anything (like the boat)? Please comment below, and I’ll modify the list as required, with appropriate attribution.

Thanks to the following people for their contributions for improvements to this list:
1 Ryan Baker
2 Andrew Wallace
3 Sunit Prakash