Showing posts with label CESG. Show all posts
Showing posts with label CESG. Show all posts

Tuesday, 13 November 2012

Cloud computing, and GDS's fantasy strategy

For some time now, the Government Digital Service (GDS) have made the meaning of their digital-by-default agenda clear – they want the UK to be like Estonia.

It is thanks to the fact that practically every service in Estonia is delivered over the web that, back in 2007, Russia was able to bring the country to its knees in a matter of days. If GDS succeed with their "modernisation" plans, there will be nothing to stop that happening here in the UK.

GDS are in awe of the financial success and popularity of Apple, Amazon, eBay/PayPal, Google and Facebook. With no experience of government behind them, the over-promoted software engineers at the head of GDS want to bring their heroes' tricks to the delivery of public services in the UK.

Sensible people will see Facebook et al as latter-day Pied Pipers of Hamelin – sensible people, including the tens of thousands of public servants who will be laid off and replaced by GDS's computers when government is, as they say, "transformed".

Many of these organisations are famous for avoiding tax on their UK profits and for using their near-monopolies to tyrannise their suppliers and to milk their customers. But GDS somehow maintain their naïve veneration and on 6 November 2012 they published their Government Digital Strategy.

This fantasy strategy is an elaboration of Martha Lane Fox's ideas, set out in her October 2010 letter to Francis Maude, Directgov 2010 and beyond: revolution not evolution. Ms Lane Fox is the Prime Minister's digital champion, she's a historian, and when she says "revolution" she means it.

Her revolutionary fervour is carried over into last week's GDS strategy, which Sir Bob Kerslake – head of the home civil service, permanent secretary at the Department for Communities and Local Government (DCLG) and previously the chief executive of first the London Borough of Hounslow and then Sheffield City Council – has greeted with a post on GDS's blog, Welcoming the Digital Strategy:
Our reform plan also made a clear commitment to improve the quality of the government’s digital services, and to do this by publishing a Government Digital Strategy setting out how we would support the transformation of digital services [how does publishing a wishlist improve the quality of public services?].

We fulfilled that commitment yesterday with the launch of the Government Digital Strategy, Digital Efficiency Report and Digital Landscape Report and I very much welcome their publication.
But why? Why does Sir Bob "welcome" this emmental cheese of a strategy? It's full of holes. Consider cloud computing for example.

The Executive summary of the Government Digital Strategy tells us that:
Government is improving the way it provides information by moving to a single website, GOV.UK. Transactional services now present the biggest opportunity to save people time and save the government money [the writers mean "save the people money", the government doesn't have any money, only the people do].
GOV.UK is the implementation of Martha Lane Fox's dream, a single government domain, one website, on which all government information is to be published, and on which we will all communicate with the government via "transactional services".

Every central government website is in the process of being re-written and subsumed in GOV.UK. No more HMRC.gov.uk, no more Education.gov.uk, etc ... One day there will just be GOV.UK. Why? What's the point of all this energetic and agreeable re-writing of what has already been written? The answer has never been made clear.

How many government transactions will GOV.UK need to carry out every year? According to the Government Digital Strategy:
There is a huge volume of transactions with government. There were around 1 billion individual transactions a year with central government departments in 2011/12. This number rises to nearer 1.5 billion when other governmental organisations such as local government are taken into account ...
Clearly GOV.UK is intended to be a remarkably important national asset. It will act as the gateway or hub through which personal and corporate tax returns are made, passports are applied for, the electoral roll is maintained, benefits are paid, student loans are granted, vehicle excise duty is paid, licences are applied for, and so on – 1½ billion transactions a year.

Further on in the Government Digital Strategy we find:
Principle: Broaden the range of those tendering to supply digital services including more small and medium sized enterprises
and
The ICT Strategy stressed the need for government to procure its technical infrastructure - its servers, internet hosting, etc - as commodity services. The CloudStore framework is an example of this shift, with over 300 suppliers offering cloud-based solutions on a pay-as-you-use basis, with a maximum 12 months contract. The learning from the development of the CloudStore framework will be fed into other digital procurement and commissioning reform.
So-called "cloud computing" is being championed by Whitehall's G-Cloud team (government cloud) and they have provided an on-line shop, the CloudStore, making it easy for central and local government to buy IT services. It's just like using Amazon. There's even a little supermarket trolley to fill up.

GDS have elected to host GOV.UK in the cloud. And elected to do so, with a company called Skyscape Cloud Services Ltd whose wares are for sale on CloudStore.

Skyscape is a startup so young that it has yet to file any accounts with Companies House. It has filed an Annual Return, though, according to which Skyscape has no company secretary and only one director, a Mr Jeremy Robin Sanders, who is also the only shareholder in the company, holding all £1,000-worth of ordinary shares issued and fully paid-up.

GDS have decided to entrust an important national asset and 1½ billion transactions a year to Mr Sanders, a decision described in an open letter as "dangerous, imprudent, ill-advised, unprofessional, wrong-headed, unbusinesslike, undignified and irresponsible". No response has been received from GDS.

HMRC also have contracted with Skyscape, to store all the data currently held at their hundreds of local offices around the country – presumably all our personal and corporate tax returns and correspondence. In future, Mr Sanders will be responsible for the lot.

HMRC are a sensible lot, you may say to yourself, so perhaps GDS's GOV.UK hosting decision isn't so dangerous, imprudent, ill-advised, unprofessional, wrong-headed, unbusinesslike, undignified and irresponsible, after all? Maybe. Or are HMRC being dangerous, imprudent, ill-advised, unprofessional, wrong-headed, unbusinesslike, undignified and irresponsible, too?

The matter was taken up with HMRC. And they responded. They say that:
The G-Cloud was created by the Cabinet Office and the Government Procurement Services (GPS) ... In order to deliver services through G-Cloud, all suppliers on the Framework, Skyscape included, were required to meet a set of mandatory criteria set out by GPS including their financial standing and Experian risk assessments. Additionally, HMRC carried out its own standard taxation and financial compliance checks  before awarding the contract and Skyscape passed the standard set by the G-Cloud Framework and HMRC.
To which, all one can say is that there must be something wrong with the Cabinet Office, GPS and HMRC procurement criteria if they determine that it is safe to store all our records with a one-man startup with no track record.

The Skyscape contracts are subject to review by CESG, the information assurance arm of GCHQ. There is that one hurdle still to jump. Given that Skyscape's landlord advertises the address of the Skyscape data centre on its website and even provides a map how to get there, it's hard to see how Skyscape can pass CESG's security tests.

If CESG veto Skyscape, well and good. If not, that's another organisation to add to the dangerous, imprudent, ill-advised, unprofessional, wrong-headed, unbusinesslike, undignified and irresponsible list.

Suppose that the GDS and HMRC contracts weren't with Skyscape but with a bigger company – would that make them better?

No.

For several reasons.

The biggest supplier of cloud computing services in the world is Amazon. Reason #1, you will have noted Amazon's appearance in front of the Public Accounts Committee yesterday:
Andrew Cecil, head of public policy at Amazon, was lambasted by Mrs Hodge for avoiding the Committee’s questions. She said she would “summon” Amazon’s most senior executives as a matter of priority to make up for Mr Cecil’s “unacceptable nonsence.”
Amazon are in the dock, along with Google and Starbucks, for tax avoidance and one member of the Committee, Charlie Elphicke, was moved to suggest that:
The tax abuse can be stopped. We can tighten UK tax presence rules, we can stop the 'expenses' used to cut business tax bills in the UK and we should refuse Government contracts for companies that don't pay a fair share of tax in the UK.
We the public all have to pay our taxes, so should Amazon and Google and all of GDS's friends and Starbucks. If moral indignation gets us nowhere, perhaps a ban on government contracts would do the trick.

Reason #2, cloud computing is normally described as being like a utility, you only pay for the services you use, you don't have to pay for any overhead. It's a "no-brainer", as GDS put it.

It certainly is. No brains at all. Someone must be paying for the overhead. Whether Amazon or Skyscape. And they're going to pass the cost on to their customers. Whether HMRC or GDS – ultimately, us.

We've just had a month of daily news about how expensive our utilities are, gas and electricity, about how there's nothing even the prime Minister can do about it and, just yesterday, there was an allegation of utility price-fixing à la LIBOR. The utility model is not an attractive one. Which may be why GDS have taken to describing cloud computing as "commodity services" rather than the previously more conventional "utility services".

Reason #3, "cloud computing" means losing control. You don't own the computers. You don't own the buildings. You don't vet or train or manage the staff. The staff can be anywhere in the world, as can the computers, and your data with them, beyond your control, beyond the reach of English law. Ask the G-Cloud team about that, and they haven't got any answer. They're just following the latest fashion.

GDS have a weaselly argument that Whitehall is no different, they don't have to have secure data centres staffed by their own people, they can be just like all the other organisations in the world – and they use cloud computing. It sounds modest, doesn't it, and realistic.

But it's utterly mendacious. Some organisations do use cloud computing, some don't.

Ask a lawyer. Ask a lawyer about the legal problems. The data protection issues. The jurisdiction problems. The compliance problems. The commercial problems – what do you do if your supplier goes bust or is taken over by Huawei? Most of all, though, ask your lawyer if his or her firm uses cloud computing. Lawyers have to keep their clients' data under control and confidential. They can't do that if they haven't got a clue where in the world the data is or who's taking what backups. They'd go out of business the day after signing up with a cloud computing services supplier.

Whitehall also has a duty to keep control of our data and to keep it confidential. Cloud computing is an abrogation of that duty.

Reason #4, what does Larry Ellison, the President of Oracle, all $41 billion of him, have to say about cloud computing?
Maybe I'm an idiot, but I have no idea what anyone is talking about. What is it? It's complete gibberish. It's insane. When is this idiocy going to stop?
What do you know that Larry Ellison doesn't?

Where there should be answers to these questions in the Government Digital Strategy there are just holes. Revolution is proposed with no justification. And yet Sir Bob, the head of the home civil service, welcomes this fantasy.

Cloud computing, and GDS's fantasy strategy

For some time now, the Government Digital Service (GDS) have made the meaning of their digital-by-default agenda clear – they want the UK to be like Estonia.

It is thanks to the fact that practically every service in Estonia is delivered over the web that, back in 2007, Russia was able to bring the country to its knees in a matter of days. If GDS succeed with their "modernisation" plans, there will be nothing to stop that happening here in the UK.

GDS are in awe of the financial success and popularity of Apple, Amazon, eBay/PayPal, Google and Facebook. With no experience of government behind them, the over-promoted software engineers at the head of GDS want to bring their heroes' tricks to the delivery of public services in the UK.

Sensible people will see Facebook et al as latter-day Pied Pipers of Hamelin – sensible people, including the tens of thousands of public servants who will be laid off and replaced by GDS's computers when government is, as they say, "transformed".

Many of these organisations are famous for avoiding tax on their UK profits and for using their near-monopolies to tyrannise their suppliers and to milk their customers. But GDS somehow maintain their naïve veneration and on 6 November 2012 they published their Government Digital Strategy.

This fantasy strategy is an elaboration of Martha Lane Fox's ideas, set out in her October 2010 letter to Francis Maude, Directgov 2010 and beyond: revolution not evolution. Ms Lane Fox is the Prime Minister's digital champion, she's a historian, and when she says "revolution" she means it.

Her revolutionary fervour is carried over into last week's GDS strategy, which Sir Bob Kerslake – head of the home civil service, permanent secretary at the Department for Communities and Local Government (DCLG) and previously the chief executive of first the London Borough of Hounslow and then Sheffield City Council – has greeted with a post on GDS's blog, Welcoming the Digital Strategy:
Our reform plan also made a clear commitment to improve the quality of the government’s digital services, and to do this by publishing a Government Digital Strategy setting out how we would support the transformation of digital services [how does publishing a wishlist improve the quality of public services?].

We fulfilled that commitment yesterday with the launch of the Government Digital Strategy, Digital Efficiency Report and Digital Landscape Report and I very much welcome their publication.
But why? Why does Sir Bob "welcome" this emmental cheese of a strategy? It's full of holes. Consider cloud computing for example.

Wednesday, 24 October 2012

HMRC and Skyscape 2

The following open letter has been sent by email and by post to Phil Pavitt in his capacity as HMRC Director General Change, Security and Information with a copy to Lin Homer, Chief Executive, HMRC:

[Skyscape has subsequently changed its name to UKCloud: "London – August 1, 2016 – Skyscape Cloud Services Limited, the easy to adopt, easy to use and easy to leave assured cloud services company, has today renamed and relaunched as UKCloud Ltd (www.ukcloud.com), to reinforce the company’s exclusive focus on supporting the UK public sector in the digital transformation of services".]

Open letter [1]

Phil Pavitt          Your ref. CETO /03531/2012
HMRC Director General
Change, Security and Information
100 Parliament St
London SW1A 2BQ          24 October 2012

Dear Mr Pavitt

HMRC and Skyscape Cloud Services Ltd

Thank you for your letter dated 22 October 2012 [2] in response to my letter to Lin Homer dated 11 October 2012 [3].

The point is well taken, of course, that for security reasons HMRC can’t say what data is held where. We're in we-can-neither-confirm-nor-deny territory here. It’s difficult but, given the bizarre nature of the Skyscape contract, HMRC are going to have to find some way to reassure the public about the security with which our tax records, both personal and corporate, are being held.

“The data will continue to be kept in accordance with existing legislation and HMRC security policies”, you say. I should hope so, too – the public want, need, deserve and pay for nothing less.

But your statement begs the question.

The public is bound to assume that the data to be stored at Skyscape’s cloud computing facilities is the tax records of every individual and legal person in the country. What other data does HMRC have?

And the public is bound to assume that our data is intended to be stored at Hartham Park, Corsham, Wilts SN13 0RP because that’s the address of the registered office of Skyscape Cloud Services Ltd and it’s the address of the registered office of its “ally” ARK Continuity Ltd and it’s the address of ARK’s Spring Park data centre as noted for everyone to see on ARK’s website [4]. If that isn’t a breach of security, what is?

Skyscape is a young start-up, it hasn’t yet submitted any accounts to Companies House, it has no track record, it has only one director and he owns all the shares in the company. If the Government Procurement Service (GPS) and HMRC believe that Skyscape is an appropriate company to trust with the care of our tax records, then there is something wrong with GPS’s and HMRC’s selection criteria.

CloudStore make the point that the inclusion of a company and its services in its on-line store is not a warranty of appropriateness. It’s up to the customer – in this case HMRC – to determine appropriateness. Eleanor Stewart, the Assistant Director of G-Cloud, says [5]: “as with everything on the G-Cloud framework the customer can determine whether they are happy with any associated risk at the point of selection”.

The references to GPS and to CloudStore in your letter can provide the public with no comfort.

You mention the Skyscape Cloud Alliance [6] in your letter.

Goodness knows what ARK Continuity is doing in the Alliance. HMRC doesn’t promote itself as being in an alliance with Mapeley. Why does Skyscape expect the public to find it commercially persuasive to include its landlord in the Alliance?

QinetiQ, VMware, Cisco and EMC on the other hand are all industry leaders and if HMRC had entered into a contract with a joint venture company involving them then we wouldn’t be having this correspondence.

But you haven’t.

HMRC have entered into a contract with a one-man start-up. That was the case before you wrote your letter and it remains the case subsequently. The question therefore persists, how can HMRC make such an odd-looking decision? How can they risk the nation’s tax records on Skyscape?

There’s no joint venture company there for a Tax Inspector to get his or her teeth into. Just an “alliance”. What is an alliance in this case?

The contract is to provide cloud computing services. “Cloud computing” means losing control [7]. Whitehall promotes cloud computing on the basis that it turns IT into a utility [8]. That is not attractive, as this month’s news about gas and electricity prices will confirm.

None of us has control over the price our suppliers charge for gas and electricity at home or control over their staff. If HMRC enter into a cloud computing contract with any supplier, big or small, they will have the same problem. How can HMRC risk the nation’s tax records on cloud computing?

Salesmen sometimes unfortunately make over-enthusiastic claims about cloud computing being more resilient, secure and efficient than the alternatives. Lawyers don’t believe them. Lawyers don’t use cloud computing. Lawyers are paid to keep their clients’ data under control and confidential. So are public authorities like HMRC.

As I write, I note that the latest cloud computing débâcle is unfolding. Amazon are the biggest cloud computing suppliers in the world and they’ve just had a 12-hour outage [9].

Our tax records are currently stored on hundreds of servers at “multiple” HMRC offices, you say. Good. That looks secure. Much more secure than storing them all in one place with a one-man start-up in some sort of nugatory alliance. And, since you mention it, the allegedly dainty carbon footprint of cloud computing will be no consolation if our records go up in smoke.

According to HMRC’s press release [10] the Skyscape contract will save £1 million a year on running costs. We need to be guided here by the National Audit Office (NAO) report on HMRC’s on-line filing [11].

The NAO examined HMRC’s £8 billion 10-year ASPIRE contract with Capgemini and said:

HMRC uses a range of indicators to measure the performance of its ICT services, which include online services, and it measures availability that relates specifically to online filing. HMRC has a high-level view of the overall costs of ICT provision through the ASPIRE contract. It has been taking steps to improve that information and achieve cost savings. It does not yet have a detailed breakdown of the costs of online filing services, so it cannot benchmark those costs to assess their value for money. HMRC is currently negotiating with the ASPIRE contractors to obtain a clearer breakdown of the costs of ICT services provided. (p.8)
Also:

[HMRC] should proceed with its plans to identify ICT costs specific to online filing services and ensure that current negotiations with the ASPIRE contractors provide sufficient breakdown of cost information for regular benchmarking of costs. (p.13)
In the circumstances, with the suppliers not even prepared to tell HMRC what they are charging for, some scepticism is in order about claims to be able to identify £1 million of on-line filing costs in among the £8,000 million.

CESG have rescued the nation before from other-worldly decisions taken by Whitehall. The Home Office wanted to use DWP’s National Insurance number database as the National Identity Register for the ID cards scheme. CESG pointed out that it was inappropriate and that was the end of that [12].

Let’s hope that they repeat the trick in their review of Skyscape. I look forward to a small piece appearing in the technical press somewhere out of the way regretting that for security reasons which cannot be given the HMRC contract with Skyscape has had to be revoked.

Yours sincerely
David Moss

cc      Lin Homer, Chief Executive, HMRC
          Chartered Institute of Taxation
          Institute of Chartered Accountants in England and Wales




[7]Cloud computing and the Gadarene lemmings of Whitehall, http://www.dmossesq.com/2012/10/cloud-computing-and-fashion-conscious.html
[8]Cloud computing turns IT into a utility, and that's a good thing?, http://www.dmossesq.com/2012/10/cloud-computing-turns-it-into-utility.html
[9]Amazon outage started small, snowballed into 12-hour event, http://www.networkworld.com/news/2012/102312-amazon-outage-263617.html
[11]HM Revenue & Customs – The expansion of online filing of tax returns, http://www.nao.org.uk//idoc.ashx?docId=cd237708-5c6b-472a-af13-f432f80d80cc&version=-1
Updates:
24.5.12
Phil Pavitt says "we don't currently have ID authentication in UK government".
24.10.12
Letter emailed to Phil Pavitt and Lin Homer
25.10.12
Hard copy of letter posted to Phil Pavitt and Lin Homer, links sent to Eleanor Stewart, CIOT and ICAEW
28.10.12
Re last two paragraphs of letter, see Andy Smith affair.
4.11.12
US government argue that signing a cloud services agreement reduces your property rights in the data stored in the cloud, according to EFF.
13.11.12
Cloud computing, and GDS's fantasy strategy: "To which, all one can say is that there must be something wrong with the Cabinet Office, GPS and HMRC procurement criteria ...".
23.11.12
UK.gov to upgrade buying tool after mega cockup downs £1bn deal – Government Procurement Service computer system incapable of handling tenders for government procurement.
26.11.12
HMRC soon to be Pavittless – will Aviva store all our insurance details with Skyscape?

HMRC and Skyscape 2

The following open letter has been sent by email and by post to Phil Pavitt in his capacity as HMRC Director General Change, Security and Information with a copy to Lin Homer, Chief Executive, HMRC:

[Skyscape has subsequently changed its name to UKCloud: "London – August 1, 2016 – Skyscape Cloud Services Limited, the easy to adopt, easy to use and easy to leave assured cloud services company, has today renamed and relaunched as UKCloud Ltd (www.ukcloud.com), to reinforce the company’s exclusive focus on supporting the UK public sector in the digital transformation of services".]

Tuesday, 16 October 2012

GDS – the user experience of misfeasance in public office

Tomorrow's news
17 October 2012 – GOV.UK goes live
22 October 2012 – major announcement on IdA (identity assurance)
26 October 2012 – G-Cloud II
Who knows when? – midata

What does that all add up to?

Whitehall and others wasting your money with impunity – the disgraceful state of public administration in the UK.

You want DMossEsq to draw you a map?

OK:



A map



Transacting with the government
Top left, at the moment, if members of the public including companies want to submit their tax returns to HMRC, for example, they log on via the Government Gateway and do it. That's how we transact with government over the web. It's not a thing of beauty. You have to register separately for each of the various services offered by our public administration and they post us separate user IDs for each one.

Not beautiful, but it seems to be fairly secure. It's hard remembering the user IDs and it's a pain in the neck for the service providers because millions of people ring up every year when they forget their user IDs but perhaps that's the price of security – if you want the security, you have to live with the pain in the neck. There may be no alternative.

It's not that different transacting with the banks on-line. Except that in addition to user IDs you often have to use PINSentry-type machines.

Even with the security of user IDs and passwords and PINSentries, there is a certain level of fraud. The banks in particular and DWP who operate the Government Gateway have done a fantastic job over the years keeping a lid on the level of fraud. Fraud remains a cost of doing business and, so far, a just about bearable cost. If the cost of fraud stops being bearable, on-line business will stop.

That's at the moment.

GOV.UK
Tomorrow we will be told about GOV.UK, the new single government domain. It goes live tomorrow and replaces Directgov and Business Link. Later, GOV.UK is due to replace all central government websites. No more homeoffice.gov.uk, no more education.gov.uk, ..., just GOV.UK.

GOV.UK is the product of the Government Digital Service (GDS) and judging by the 22 posts that have been published on their blog so far this month what we will be told is that the whole project is dedicated to satisfying user needs, it's all being done for us the public, 70+ people working hard for a year, just for us.

That's true. But it's not the whole truth.

GDS aren't just trying to improve the "user experience" as they call it, repeatedly, several times in every one of their 22 posts this month, when we use government websites. They're working towards making all public services digital by default, something not mentioned in a single one of their 22 posts so far this month. They're trying to make it so that we can only transact with government on-line. They're trying to make us Estonian, as ex-Guardian man Mike Bracken among others has being telling us for some time:

Estonia’s technology economy and online service provision- back to the future?

by Mike Bracken on 04/05/2012



... Whilst we met dozens of people at breakneck speed, many of whom we hope to see in the UK soon, over the next week I will be explaining the wider points we have uncovered which reflect directly on our challenge to make public services in the UK digital by default, and how the Estonian experience links to our core principles ...
IdA
Ex-Guardian man Mike Bracken is the Chief Executive of the (UK) Government Digital Service. He is also the senior responsible officer owner for identity assurance (IdA). You can't make public services digital by default if you can't identify the people you're dealing with. GOV.UK needs IdA, please see middle of the map.

Once you've decided that public services should be digital by default you have to try to prove that it works. You need a guinea pig. DWP drew the short straw and digital by default will be tested on Universal Credit (UC).

UC is the coalition government's attempt to spring the poverty trap and make work pay. It could hardly be more important to millions of human beings in the UK. Instead, it has become a sandpit, for adults who haven't outgrown their fascination with technology, to play in.

Asked by the Select Committee on Work and Pensions what are the biggest risks faced by UC Lord Freud, the minister responsible, fingered identity assurance. With no IdA, there can be no UC.

Having wrested control over its own identity assurance from DWP and having thus made himself responsible for it, ex-Guardian man Mike Bracken was due to name the companies he has chosen as the UK's "identity providers" by 30 September 2012.

("Identity providers" may seem an odd locution at first but you've got used to "hate crime", haven't you, and by the same process "identity provider" will soon link to your Estonian core principles.)

He missed the September deadline but the announcement of the winners should finally be made next Monday 22 October 2012.

What to expect?

Facebook, Google, Twitter and the British Constitution
There have been leaks, including a very full one to the Independent newspaper on 4 October 2012, National 'virtual ID card' scheme set for launch (Is there anything that could possibly go wrong?).
If you’d like to know more the Q&A in The Independent gives a pretty good overview (the only thing we’d really quibble with is the headline).
That's what GDS say about the Independent article. It seems fair to assume that they wrote the whole thing apart from the headline.

The article mentions social media sites, mobile phone companies, banks, large retailers, the Post Office, Facebook, Microsoft, Google, PayPal, BT and Experian, the credit referencing agency – please see middle right of the map, nothing new there for DMossEsq readers. We should expect between five and 20 organisations to be appointed as identity providers next Monday, thereby becoming an unlikely part of the British Constitution.

It confirms the link between IdA, GOV.UK and UC and it sets IdA in the context of the US National Strategy for Trusted Identities in Cyberspace (NSTIC) and the Open Identity Exchange (OIX) – who are GDS trying to impress?

The Independent article also claims that IdA will "prevent login fatigue", the suggestion being that as long as you can remember your Facebook or bank login details, then you can "apply for services ranging from tax credits to fishing licences and passports".

Abandoning the Government Gateway in this way may well prevent login fatigue, you won't have to remember your Gateway user IDs and passwords any more, but it reduces security and that threatens the future of on-line business.

The Cabinet Office sandpit may be prepared to take that risk. It is hard to believe that the banks, the mobile phone companies and the major retailers are. They would see their own brands destroyed when IdA goes wrong, even if the problem is caused by Whitehall. That's not a risk worth taking. The chairmen and chief executives of these companies don't normally act against their own best interests. They won't this time. Let's see just how committed the banks, telcos and retailers are, in next Monday's announcements.

Cybercrime
CESG is the information assurance arm of GCHQ. They have issued three reports on RSDOPS – the requirements for the secure delivery of on-line public services, please see top right of the map. Let's see if GDS will show us the documentation certifying that their plans for IdA satisfy the RSDOPS conditions.

On 5 September 2012, GCHQ, the Foreign Office, the Cabinet Office and BIS, the Department for Business Innovation and Skills, got together to tell senior UK businessmen how bad they all are at cybersecurity. Why are GDS in that case entrusting IdA to them?

In the attempt to prove that you are who you say you are before the Department for Education grants you a student loan, or whatever, once we have digital by default IdA will be looking to the identity providers to confirm a selection of your "name, date of birth, address, gender, passport and driving licence numbers, financial history, electoral roll status and telephone numbers" and other such personal data. As the Independent (almost) say, what could possibly go wrong?

Losing control of the personal data in IdA is one possible mishap. Millions of us Britestonians could wake up one morning to find all our personal data for sale on a Russian website, ready to be used to clear out our bank accounts.

Losing access to public services, following an Estonian-style distributed denial of service attack, is another.

Anonymity and book-keeping
When the Department for Education checks to see that you are who you say you are and gets confirmation from the Third National Bank of Tallinn that you are, the process goes through a so-called "hub". The Cabinet Office claim that the "hub" has no memory. No details of the identity assurance transaction are recorded.

That's good, from the point of view of privacy.

But bad from the point of view of audit trail. Surely there has to be an audit trail supporting the grant of a student loan? That's just proper book-keeping and it would be remiss of Whitehall to break proper procedures.

Even if they are breaking procedures, though, there's always the Home Office and their Communications Data Bill, please see bottom right of the map. If the Bill is enacted, all web browsing will be recorded on GCHQ black boxes installed at ISPs (Internet Service Providers). So much for anonymity.

Dematerialised ID
Which brings us to the bottom middle of the map, BIS, and their midata initiative.

There is no announcement date for midata. The Cabinet Office and BIS are keeping quiet about it and hoping that they will thereby get their legislative powers rubber-stamped in the Enterprise and Regulatory Reform Bill currently going through Parliament.

midata would require us all to have one or more Personal Data Stores (PDSs) if the Bill is enacted as drafted. These PDSs would record all our personal data such as the names and addresses mentioned above plus all our transaction data and they – the PDSs – would be in continuous contact with all our suppliers including government departments keeping each one up to date with any change in our circumstances.

The Independent were clearly briefed to emphasise that the government has abandoned its plans to introduce material, plastic ID cards. No doubt that's true. No government department wants to suffer the fate of the Identity & Passport Service which seems to have had a corporate nervous breakdown when the last ID cards scheme failed.

But a PDS is an ID card. It's a dematerialised, dynamic, distributed ID card, but an ID card for all that. The government hasn't abandoned its plans. It's planning for something much more powerful. Something that really could provide identity assurance on-line. PDSs.

It will be worth pressing GDS next Monday on the subject of midata and its attendant PDSs. They can't pretend that it's nothing to do with them. William Heath is on the BIS strategy board for midata and he is the chairman of Mydex, a company which hopes one day to manage PDSs for us all, and he was demonstrating Mydex's wares at the 31 October 2011 identity assurance event where Francis Maude announced his £10 million investment in Mydex and others. And according to him:
We [Mydex] support midata. It will empower individuals and at last give real teeth to the good intentions behind the Data Protection Act subject access request. It goes hand in hand with the new UK and US approaches to ID assurance, which we also support. We think midata needs to apply also to other UK public services including health, education and job-seeking.
The unwebbed
You'd think that would be enough problems for GOV.UK. It's not clear how involving the Post Office, the banks, etc ... will help to provide identity assurance on-line. All that is clear is that GDS want to abandon the Government Gateway and lose the tried and tested security that it's provided for 10 years and more. What GDS really need is PDSs but it's unimaginable that the British people will let them have their way. Meanwhile, the Home Office's Communications Data Bill threatens the anonymity that the Cabinet Office are offering and we have yet to see if IdA has been certified by CESG.

But that's not all.

There are more problems.

Take a look at the map again. Middle left. The Public.

Between eight and ten million adult Britestonians have never used the web. What's the point of trying to make all public services digital by default if the people most likely to need public services can't access them?

And large parts of the country don't have reliable, cheap, fast broadband.

What's GDS doing about these problems?

Answer, they've started a project. It's got a name – "assisted digital". There's an assisted digital blog. It's had all of four posts on it since 28 July 2011. And that's it. We've still got eight to ten million people who can't use GOV.UK and IdA.

Far from offering savings, which is one of the benefits promised for all this playing in the sandpit, we'll end up paying for both the new on-line delivery method for public services and the old one, involving people, in offices, with telephones, and letters, and face-to-face interviews. The question isn't how much we'll save, it's how much more it will all cost.

Cloud computing – the Pied Pipers of Hamelin
And then from out of a blue sky comes another problem.

The IT industry is currently suffering one of its recurrent bouts of tulipmania and talking rubbish about the merits of cloud computing.

Don't take DMossEsq's word for it. Take the OECD's word for it and ENISA's. If you prefer your gurus to be bearded, try Richard Stallman. Otherwise, listen to Larry Ellison, the billionaire President of Oracle, talking about cloud computing:
Maybe I'm an idiot, but I have no idea what anyone is talking about. What is it? It's complete gibberish. It's insane. When is this idiocy going to stop?
Some 12 year-old management consultant had the bright idea of comparing IT to the utilities. Wouldn't it be good if you only paid for the IT you use. Turn on the tap and you pay, turn it off again and you don't. That way IT would be cheaper.

He or she might like to take a look at this week's newspapers, full of stories about how it's impossible to keep utility bills down, particularly energy prices.

But 12 year-olds probably don't read that bit of the newspaper.

The suppliers are talking up the merits of cloud computing and if you work in IT you can hardly hold your head up with dignity if you aren't solving all your problems by moving your applications to the cloud.

You'd better hope that your lawyers aren't following this fashion. Cloud computing amounts to losing control of your data by handing it over to other organisations like Amazon who put it on their servers which may be anywhere in the world, beyond the jurisdiction of the English courts, and under the control of staff about whose suitability you know nothing. Lawyers are meant to keep your data safe and confidential.

So is Whitehall but they've jumped on the bandwagon anyway and they just can't get enough of cloud computing. Cloud computing will make public services reliable, trusted, efficient, green, you name it, they'll believe it.

Somehow, see bottom left of the map, HMRC have agreed to put all their local office data – i.e. all our data – in the cloud. This should be impossible but when tulipmania strikes a tulip bulb really is worth ten years' salary.

HMRC's dangerous, imprudent, ill-advised, unprofessional, wrong-headed, unbusinesslike, undignified and irresponsible decision is important, but it isn't the subject of this post.

What is the subject of this post is this – not only will the public be logging on to the cloud to deal with HMRC, we will have to do the same to use GOV.UK. GOV.UK will be hosted in the cloud. To put it another way, Whitehall will have no control over the data in GOV.UK because "cloud computing" is a synonym for "no control".

There are big companies supplying cloud computing services. Notably Amazon, Apple, Microsoft and Google.

They're not very keen on paying tax in the UK. But they're big.

They're all American and so, by virtue of the USA PATRIOT Act, any data in their possession can be subpoenaed by the FBI, which may not be what you had in mind when you applied for a fishing licence. But they're big.

And being big becomes a virtue when you see who GDS and HMRC have contracted with to provide cloud computing services – a company called Skyscape Cloud Services Ltd, please see map bottom left-ish.

Skyscape Cloud Services Ltd
Skyscape is too young a start-up to have submitted any accounts to Companies House yet. But according to its annual return, it has no company secretary and just one director, a Mr Jeremy Robin Sanders. Mr Sanders is also the holder of all £1,000-worth of paid-up share capital.

HMRC and GDS have entrusted our data to the care of one man. Even in a tulipmania hospital HMRC and GDS would have to be segregated.

There's more.

When they're looking after crucial national data, the location of data centres should be kept secret for obvious security reasons. It looks as though Skyscape have inadvertently managed to announce where our data will be stored and thus where it could be attacked.

The user experience
There's a lot hanging on tomorrow's and next week's announcements.

And it's not about 70+ charming people working in the offices of GDS tirelessly in the interests of the public's needs. (They've published two more posts on their blog, by the way, since DMossEsq started this post.)

It's about GDS ignoring the fact that up to 10 million of their parishioners won't be able to experience GOV.UK at all.

It's about inviting the likes of Facebook and Google into the British Constitution.

It's about an infantile faith in technology.

It's about GDS proceeding on the unproven assumption that you can deliver on-line identity assurance for large populations. Large populations like 60 million+ Britestonians. It's not businesslike and it's not responsible to proceed on the basis of hope alone, to spend public money without first providing evidence.

And it's about holding up Universal Credit, ignoring the predicament of real people, while playing in the sand.

We're looking here at Constitutional lunacy and misfeasance in public office at the heart of Whitehall.

GDS – the user experience of misfeasance in public office

Tomorrow's news
17 October 2012 – GOV.UK goes live
22 October 2012 – major announcement on IdA (identity assurance)
26 October 2012 – G-Cloud II
Who knows when? – midata

What does that all add up to?

Whitehall and others wasting your money with impunity – the disgraceful state of public administration in the UK.

You want DMossEsq to draw you a map?

OK: