Showing posts with label Lin Homer. Show all posts
Showing posts with label Lin Homer. Show all posts

Tuesday, 16 July 2013

IPS temporarily Rapsonless

The Identity & Passport Service (IPS) doesn't exist any more, of course, it's now HM Passport Office (HMPO) and the Home Office is IPSless.

The executive director of IPS between about June 2010 and March 2013 was Sarah Rapson. Her predecessor, James Hall, presided over the British public being over-charged for passports by about £300 million a year. He also presided over the disaster of Whitehall's attempted introduction of state-produced ID cards.

Ms Rapson has delivered a £5 reduction in the cost of a 10-year adult passport since then, from £77.50 to £72.50. Otherwise her tenure seems to have been without incident.

She is perhaps lucky that IPS/HMPO were banned from having anything to do with Whitehall's latest attempt to re-enact the ID cards massacre – that honour goes to the Cabinet Office (individual electoral registration and the Identity Assurance Programme) and the Department for Business Innovation and Skills (midata). If you hold futures in either organisation, sell, sell, sell.

Now her luck has broken.

Home Office press release, 16 April 2013:
New interim Directors General appointed

Two interim Directors General have been appointed to lead the new immigration commands in the Home Office that were announced by the Home Secretary on 26 March.

Sarah Rapson will lead UK Visas and Immigration, bringing her experience of managing a successful customer-focused organisation as Chief Executive of the Identity and Passport Service.

David Wood will lead Immigration Enforcement, drawing on his background with the Metropolitan Police and as Director of Operations for UKBA ...
The history of the UK Border Agency (UKBA) is spectacular and its demise under Rob Whiteman even more so. The Home Office is now UKBAless. It's shattered into three pieces – the UK Border Force, Immigration Enforcement (ambiguous name) and the piece Ms Rapson has picked up, UK Visas and Immigration (UKV&I).

Interim Director General Sarah Rapson gave evidence in front of the Home Affairs Committee on 11 June 2013:



Next day, the Times newspaper reported the session and found themselves with an over-abundance or superfluity or excess or nimiety of scoops. Too many to handle. They settled for Visa system might never be up to job, admits chief.

A month later, the Home Affairs Committee published their report, and they went with Backlogs hit half a million at immigration service. This followed Ms Rapson's revelation that there are 190,000 unresolved immigration cases that her predecessors unfortunately forgot to tell the Committee about.

The Times and the Committee and the BBC could equally well have led with Ms Rapson's management approach – she wants her staff to discover for themselves how to do the job, she doesn't intend to issue "decrees" (16:34:40 to 16:35:44), instead, she's holding "workshops". She has 7,400 staff in 150 countries and an annual budget of £450 million. There's something missing from the concept of leadership there or "command" as Ms Rapson keeps calling it.

Or they could have led with Ms Rapson's repeated claim to have only just started in the job – e.g. "I'm 54 days in" (16:59:43). According to the DMossEsq slide rule, that's nearly eight weeks. Eight weeks in, and she still doesn't know how many categories there are for the cases UKV&I deal with and didn't realise that the category with 190,000 cases in it was new to the Committee. Clearly it takes some time for a new boss to get their feet under the table, but surely eight weeks is long enough to get to grips with some of the basic metrics of the business. If eight weeks isn't long enough, is it ever going to happen?

IPS temporarily Rapsonless

The Identity & Passport Service (IPS) doesn't exist any more, of course, it's now HM Passport Office (HMPO) and the Home Office is IPSless.

The executive director of IPS between about June 2010 and March 2013 was Sarah Rapson. Her predecessor, James Hall, presided over the British public being over-charged for passports by about £300 million a year. He also presided over the disaster of Whitehall's attempted introduction of state-produced ID cards.

Ms Rapson has delivered a £5 reduction in the cost of a 10-year adult passport since then, from £77.50 to £72.50. Otherwise her tenure seems to have been without incident.

She is perhaps lucky that IPS/HMPO were banned from having anything to do with Whitehall's latest attempt to re-enact the ID cards massacre – that honour goes to the Cabinet Office (individual electoral registration and the Identity Assurance Programme) and the Department for Business Innovation and Skills (midata). If you hold futures in either organisation, sell, sell, sell.

Now her luck has broken.

Monday, 21 January 2013

Skyscape Cloud Services push the boat out

Time was, when you went to the cinema, there was always an advert for the local curry house.

These short promotional films followed rules from which no deviation was permitted.

The cameraman had to have the shakes. The soundtrack had to be just as unsteady, as though it was hanging on, rather listlessly, and didn't much care if it lost its grip.

The first grainy shot would have the proprietor, off-centre, trying to smile naturally and failing. All expense spared, the film would cut to a close-up of congealed entrails in a cracked bowl and then pull back to show a lot of worryingly pasty-faced people with no make-up sitting round a table and looking as though they might try eating the entrails. Or not.

Finally, without warning, it would stop being daylight and while the sound recordist replaced the sitar music with something more Hawaiian a voice-over would explain to us that the restaurant was just three doorways from this very venue, as though we didn't know, next to the betting shop.

It's always been a mystery. What happened to the professionals who made these gems? Where are they now? Let's face it, we miss them, it's part of our heritage.

Mystery solved. Take a look at this. Five-and-a-half minutes of Skyscape Cloud Services – Storage as a Service on EMC Atmos.

Let the whole thing waft over you and then try to answer a few questions:
  • How much training was the graphic designer given? Any?
  • Why didn't they just re-record the voice-over instead of editing it, apparently with a trowel?
  • Who is being advertised? Skyscape? Or EMC?
  • What are they selling and why should you buy it?
  • How far are they from the betting shop?
  • Can you remember anything about the film you've just seen?
It's a hugely nostalgic five-and-a-half minutes. Especially when you realise that HMRC have contracted with this company, probably Skyscape but maybe EMC, to store a lot of our data currently kept at HMRC local offices. And that GDS, the Government Digital Service, have contracted with them to host GOV.UK, the website on which all public services are supposed soon to depend.

Does this little film inspire you with the confidence to host your website and store your data with Skyscape/EMC? Or would you rather eat the congealed entrails after all?

Skyscape Cloud Services push the boat out

Time was, when you went to the cinema, there was always an advert for the local curry house.

These short promotional films followed rules from which no deviation was permitted.

The cameraman had to have the shakes. The soundtrack had to be just as unsteady, as though it was hanging on, rather listlessly, and didn't much care if it lost its grip.

The first grainy shot would have the proprietor, off-centre, trying to smile naturally and failing. All expense spared, the film would cut to a close-up of congealed entrails in a cracked bowl and then pull back to show a lot of worryingly pasty-faced people with no make-up sitting round a table and looking as though they might try eating the entrails. Or not.

Finally, without warning, it would stop being daylight and while the sound recordist replaced the sitar music with something more Hawaiian a voice-over would explain to us that the restaurant was just three doorways from this very venue, as though we didn't know, next to the betting shop.

It's always been a mystery. What happened to the professionals who made these gems? Where are they now? Let's face it, we miss them, it's part of our heritage.

Wednesday, 28 November 2012

HMRC, Skyscape and a 2nd response from Phil Pavitt

G-Cloud, GDS, HMRC and Skyscape, the company with just one director, who owns all the shares – Whitehall SNAFU
Open letter to Lin Homer, Chief Executive, HMRC, asking about the wisdom of entrusting their data (our data) to the cloud with Skyscape Cloud Services Ltd.
Response from Phil Pavitt, Director General Change, Security and Information, HMRC, on behalf of Lin Homer.
Open letter to Phil Pavitt.
28 November 2012
Response dated 26 November 2012 from Phil Pavitt, please see below:

[Skyscape has subsequently changed its name to UKCloud: "London – August 1, 2016 – Skyscape Cloud Services Limited, the easy to adopt, easy to use and easy to leave assured cloud services company, has today renamed and relaunched as UKCloud Ltd (www.ukcloud.com), to reinforce the company’s exclusive focus on supporting the UK public sector in the digital transformation of services".]


HMRC and Skyscape Cloud Services Ltd

Dear Mr Moss

Thank you for your letter of 24 October 2012 expressing your concerns in respect of Skyscape Cloud Services Ltd suitability to host HMRC data. I apologise for the delay in responding to you.

Further to my reply of 22 October, I wanted to provide you with some more information to alleviate your concerns. I must reiterate our assurance that using Skyscape HMRC data will continue to be kept in accordance with existing legislation and HMRC security policies.

When fully operational, Skyscape Cloud Services Ltd will securely host all HMRC data currently held on office File and Print Servers (FAPS). FAPS support the work of many HMRC offices and hold data for a wide range business purposes e.g. administrative and customer related. FAPS do not hold the definitive tax records for the UK and these records remain distributed across a number of secure systems.

HMRC routinely risk assesses and tests the security of our solutions and services. Our secure connection to Skyscape will be delivered in line with HM Government standards to protect our data, with ongoing assurance checks throughout the life of this service.

As emphasised in my letter of 24 October, in order to deliver through G-Cloud, Skyscape were required to meet a set of mandatory criteria set out by Government Procurement Services (GPS) including financial standing and Experian risk assessments. Additionally, HMRC carried out its own standard taxation and financial compliance checks before awarding the contract and Skyscape passed the standards set by HMRC and Government.

All G Cloud contracts are let on a one year basis, with exit provisions agreed to transfer the data to a new supplier should this prove necessary.

Data security remains integral to HMRC and a pre-requisite of any of our data being migrated to Skyscape is for their solution, including all the constituent parts, to be formally accredited by CESG (the Communications-Electronics Security Group) to Impact Level 3 (IL3). All security aspects of the service will have to be proven in line with HM Government security standards. This will include the need to ensure the ‘cloud’ is hosted in a UK domiciled, secure data centre(s) and operated by staff with appropriate security clearance. We are also carrying out internal accreditations including Internal Risk Management and Accreditation Document Set (RMADS) and PSN risk assessments.

I trust that this answers your concerns and you are able to appreciate our decision to contract with Skyscape.

Yours sincerely

Regards

Phil Pavitt
HMRC Director General Change, Security and Information

HMRC, Skyscape and a 2nd response from Phil Pavitt

G-Cloud, GDS, HMRC and Skyscape, the company with just one director, who owns all the shares – Whitehall SNAFU
Open letter to Lin Homer, Chief Executive, HMRC, asking about the wisdom of entrusting their data (our data) to the cloud with Skyscape Cloud Services Ltd.
Response from Phil Pavitt, Director General Change, Security and Information, HMRC, on behalf of Lin Homer.
Open letter to Phil Pavitt.
28 November 2012
Response dated 26 November 2012 from Phil Pavitt, please see below:

[Skyscape has subsequently changed its name to UKCloud: "London – August 1, 2016 – Skyscape Cloud Services Limited, the easy to adopt, easy to use and easy to leave assured cloud services company, has today renamed and relaunched as UKCloud Ltd (www.ukcloud.com), to reinforce the company’s exclusive focus on supporting the UK public sector in the digital transformation of services".]


HMRC and Skyscape Cloud Services Ltd

Dear Mr Moss

Thank you for your letter of 24 October 2012 expressing your concerns in respect of Skyscape Cloud Services Ltd suitability to host HMRC data. I apologise for the delay in responding to you.

Further to my reply of 22 October, I wanted to provide you with some more information to alleviate your concerns. I must reiterate our assurance that using Skyscape HMRC data will continue to be kept in accordance with existing legislation and HMRC security policies.

When fully operational, Skyscape Cloud Services Ltd will securely host all HMRC data currently held on office File and Print Servers (FAPS). FAPS support the work of many HMRC offices and hold data for a wide range business purposes e.g. administrative and customer related. FAPS do not hold the definitive tax records for the UK and these records remain distributed across a number of secure systems.

HMRC routinely risk assesses and tests the security of our solutions and services. Our secure connection to Skyscape will be delivered in line with HM Government standards to protect our data, with ongoing assurance checks throughout the life of this service.

As emphasised in my letter of 24 October, in order to deliver through G-Cloud, Skyscape were required to meet a set of mandatory criteria set out by Government Procurement Services (GPS) including financial standing and Experian risk assessments. Additionally, HMRC carried out its own standard taxation and financial compliance checks before awarding the contract and Skyscape passed the standards set by HMRC and Government.

All G Cloud contracts are let on a one year basis, with exit provisions agreed to transfer the data to a new supplier should this prove necessary.

Data security remains integral to HMRC and a pre-requisite of any of our data being migrated to Skyscape is for their solution, including all the constituent parts, to be formally accredited by CESG (the Communications-Electronics Security Group) to Impact Level 3 (IL3). All security aspects of the service will have to be proven in line with HM Government security standards. This will include the need to ensure the ‘cloud’ is hosted in a UK domiciled, secure data centre(s) and operated by staff with appropriate security clearance. We are also carrying out internal accreditations including Internal Risk Management and Accreditation Document Set (RMADS) and PSN risk assessments.

I trust that this answers your concerns and you are able to appreciate our decision to contract with Skyscape.

Yours sincerely

Regards

Phil Pavitt
HMRC Director General Change, Security and Information

Monday, 26 November 2012

HMRC soon to be Pavittless

Computer Weekly, 22 November 2012:
Phil Pavitt has stepped down as HMRC’s CIO to join insurance giant Aviva as global director of IT transformation ...

Under his role at Aviva Pavitt will be tasked with simplifying the firm’s IT services, and modernising and digitising its business.
DMossEsq readers have met Mr Pavitt a couple of times.

Back in May he forgot that the UK already has a Government Gateway and doesn't need GDS – the Government Digital Service – to develop a new one, even if they could.

More recently, he was deputed by Lin Homer, Chief Executive of HMRC, to explain why HMRC have decided to store all our tax records with a one-man company, Skyscape Cloud Services Ltd:
  • Let's hope he has time to explain this transformational decision to the public before he leaves HMRC.
  • And let's see if Aviva, in the name of "modernisation", will store all their insurance records in the cloud and instantly lose control of them.

HMRC soon to be Pavittless

Computer Weekly, 22 November 2012:
Phil Pavitt has stepped down as HMRC’s CIO to join insurance giant Aviva as global director of IT transformation ...

Under his role at Aviva Pavitt will be tasked with simplifying the firm’s IT services, and modernising and digitising its business.
DMossEsq readers have met Mr Pavitt a couple of times.

Tuesday, 13 November 2012

Cloud computing, and GDS's fantasy strategy

For some time now, the Government Digital Service (GDS) have made the meaning of their digital-by-default agenda clear – they want the UK to be like Estonia.

It is thanks to the fact that practically every service in Estonia is delivered over the web that, back in 2007, Russia was able to bring the country to its knees in a matter of days. If GDS succeed with their "modernisation" plans, there will be nothing to stop that happening here in the UK.

GDS are in awe of the financial success and popularity of Apple, Amazon, eBay/PayPal, Google and Facebook. With no experience of government behind them, the over-promoted software engineers at the head of GDS want to bring their heroes' tricks to the delivery of public services in the UK.

Sensible people will see Facebook et al as latter-day Pied Pipers of Hamelin – sensible people, including the tens of thousands of public servants who will be laid off and replaced by GDS's computers when government is, as they say, "transformed".

Many of these organisations are famous for avoiding tax on their UK profits and for using their near-monopolies to tyrannise their suppliers and to milk their customers. But GDS somehow maintain their naĂŻve veneration and on 6 November 2012 they published their Government Digital Strategy.

This fantasy strategy is an elaboration of Martha Lane Fox's ideas, set out in her October 2010 letter to Francis Maude, Directgov 2010 and beyond: revolution not evolution. Ms Lane Fox is the Prime Minister's digital champion, she's a historian, and when she says "revolution" she means it.

Her revolutionary fervour is carried over into last week's GDS strategy, which Sir Bob Kerslake – head of the home civil service, permanent secretary at the Department for Communities and Local Government (DCLG) and previously the chief executive of first the London Borough of Hounslow and then Sheffield City Council – has greeted with a post on GDS's blog, Welcoming the Digital Strategy:
Our reform plan also made a clear commitment to improve the quality of the government’s digital services, and to do this by publishing a Government Digital Strategy setting out how we would support the transformation of digital services [how does publishing a wishlist improve the quality of public services?].

We fulfilled that commitment yesterday with the launch of the Government Digital Strategy, Digital Efficiency Report and Digital Landscape Report and I very much welcome their publication.
But why? Why does Sir Bob "welcome" this emmental cheese of a strategy? It's full of holes. Consider cloud computing for example.

The Executive summary of the Government Digital Strategy tells us that:
Government is improving the way it provides information by moving to a single website, GOV.UK. Transactional services now present the biggest opportunity to save people time and save the government money [the writers mean "save the people money", the government doesn't have any money, only the people do].
GOV.UK is the implementation of Martha Lane Fox's dream, a single government domain, one website, on which all government information is to be published, and on which we will all communicate with the government via "transactional services".

Every central government website is in the process of being re-written and subsumed in GOV.UK. No more HMRC.gov.uk, no more Education.gov.uk, etc ... One day there will just be GOV.UK. Why? What's the point of all this energetic and agreeable re-writing of what has already been written? The answer has never been made clear.

How many government transactions will GOV.UK need to carry out every year? According to the Government Digital Strategy:
There is a huge volume of transactions with government. There were around 1 billion individual transactions a year with central government departments in 2011/12. This number rises to nearer 1.5 billion when other governmental organisations such as local government are taken into account ...
Clearly GOV.UK is intended to be a remarkably important national asset. It will act as the gateway or hub through which personal and corporate tax returns are made, passports are applied for, the electoral roll is maintained, benefits are paid, student loans are granted, vehicle excise duty is paid, licences are applied for, and so on – 1½ billion transactions a year.

Further on in the Government Digital Strategy we find:
Principle: Broaden the range of those tendering to supply digital services including more small and medium sized enterprises
and
The ICT Strategy stressed the need for government to procure its technical infrastructure - its servers, internet hosting, etc - as commodity services. The CloudStore framework is an example of this shift, with over 300 suppliers offering cloud-based solutions on a pay-as-you-use basis, with a maximum 12 months contract. The learning from the development of the CloudStore framework will be fed into other digital procurement and commissioning reform.
So-called "cloud computing" is being championed by Whitehall's G-Cloud team (government cloud) and they have provided an on-line shop, the CloudStore, making it easy for central and local government to buy IT services. It's just like using Amazon. There's even a little supermarket trolley to fill up.

GDS have elected to host GOV.UK in the cloud. And elected to do so, with a company called Skyscape Cloud Services Ltd whose wares are for sale on CloudStore.

Skyscape is a startup so young that it has yet to file any accounts with Companies House. It has filed an Annual Return, though, according to which Skyscape has no company secretary and only one director, a Mr Jeremy Robin Sanders, who is also the only shareholder in the company, holding all £1,000-worth of ordinary shares issued and fully paid-up.

GDS have decided to entrust an important national asset and 1½ billion transactions a year to Mr Sanders, a decision described in an open letter as "dangerous, imprudent, ill-advised, unprofessional, wrong-headed, unbusinesslike, undignified and irresponsible". No response has been received from GDS.

HMRC also have contracted with Skyscape, to store all the data currently held at their hundreds of local offices around the country – presumably all our personal and corporate tax returns and correspondence. In future, Mr Sanders will be responsible for the lot.

HMRC are a sensible lot, you may say to yourself, so perhaps GDS's GOV.UK hosting decision isn't so dangerous, imprudent, ill-advised, unprofessional, wrong-headed, unbusinesslike, undignified and irresponsible, after all? Maybe. Or are HMRC being dangerous, imprudent, ill-advised, unprofessional, wrong-headed, unbusinesslike, undignified and irresponsible, too?

The matter was taken up with HMRC. And they responded. They say that:
The G-Cloud was created by the Cabinet Office and the Government Procurement Services (GPS) ... In order to deliver services through G-Cloud, all suppliers on the Framework, Skyscape included, were required to meet a set of mandatory criteria set out by GPS including their financial standing and Experian risk assessments. Additionally, HMRC carried out its own standard taxation and financial compliance checks  before awarding the contract and Skyscape passed the standard set by the G-Cloud Framework and HMRC.
To which, all one can say is that there must be something wrong with the Cabinet Office, GPS and HMRC procurement criteria if they determine that it is safe to store all our records with a one-man startup with no track record.

The Skyscape contracts are subject to review by CESG, the information assurance arm of GCHQ. There is that one hurdle still to jump. Given that Skyscape's landlord advertises the address of the Skyscape data centre on its website and even provides a map how to get there, it's hard to see how Skyscape can pass CESG's security tests.

If CESG veto Skyscape, well and good. If not, that's another organisation to add to the dangerous, imprudent, ill-advised, unprofessional, wrong-headed, unbusinesslike, undignified and irresponsible list.

Suppose that the GDS and HMRC contracts weren't with Skyscape but with a bigger company – would that make them better?

No.

For several reasons.

The biggest supplier of cloud computing services in the world is Amazon. Reason #1, you will have noted Amazon's appearance in front of the Public Accounts Committee yesterday:
Andrew Cecil, head of public policy at Amazon, was lambasted by Mrs Hodge for avoiding the Committee’s questions. She said she would “summon” Amazon’s most senior executives as a matter of priority to make up for Mr Cecil’s “unacceptable nonsence.”
Amazon are in the dock, along with Google and Starbucks, for tax avoidance and one member of the Committee, Charlie Elphicke, was moved to suggest that:
The tax abuse can be stopped. We can tighten UK tax presence rules, we can stop the 'expenses' used to cut business tax bills in the UK and we should refuse Government contracts for companies that don't pay a fair share of tax in the UK.
We the public all have to pay our taxes, so should Amazon and Google and all of GDS's friends and Starbucks. If moral indignation gets us nowhere, perhaps a ban on government contracts would do the trick.

Reason #2, cloud computing is normally described as being like a utility, you only pay for the services you use, you don't have to pay for any overhead. It's a "no-brainer", as GDS put it.

It certainly is. No brains at all. Someone must be paying for the overhead. Whether Amazon or Skyscape. And they're going to pass the cost on to their customers. Whether HMRC or GDS – ultimately, us.

We've just had a month of daily news about how expensive our utilities are, gas and electricity, about how there's nothing even the prime Minister can do about it and, just yesterday, there was an allegation of utility price-fixing Ă  la LIBOR. The utility model is not an attractive one. Which may be why GDS have taken to describing cloud computing as "commodity services" rather than the previously more conventional "utility services".

Reason #3, "cloud computing" means losing control. You don't own the computers. You don't own the buildings. You don't vet or train or manage the staff. The staff can be anywhere in the world, as can the computers, and your data with them, beyond your control, beyond the reach of English law. Ask the G-Cloud team about that, and they haven't got any answer. They're just following the latest fashion.

GDS have a weaselly argument that Whitehall is no different, they don't have to have secure data centres staffed by their own people, they can be just like all the other organisations in the world – and they use cloud computing. It sounds modest, doesn't it, and realistic.

But it's utterly mendacious. Some organisations do use cloud computing, some don't.

Ask a lawyer. Ask a lawyer about the legal problems. The data protection issues. The jurisdiction problems. The compliance problems. The commercial problems – what do you do if your supplier goes bust or is taken over by Huawei? Most of all, though, ask your lawyer if his or her firm uses cloud computing. Lawyers have to keep their clients' data under control and confidential. They can't do that if they haven't got a clue where in the world the data is or who's taking what backups. They'd go out of business the day after signing up with a cloud computing services supplier.

Whitehall also has a duty to keep control of our data and to keep it confidential. Cloud computing is an abrogation of that duty.

Reason #4, what does Larry Ellison, the President of Oracle, all $41 billion of him, have to say about cloud computing?
Maybe I'm an idiot, but I have no idea what anyone is talking about. What is it? It's complete gibberish. It's insane. When is this idiocy going to stop?
What do you know that Larry Ellison doesn't?

Where there should be answers to these questions in the Government Digital Strategy there are just holes. Revolution is proposed with no justification. And yet Sir Bob, the head of the home civil service, welcomes this fantasy.

Cloud computing, and GDS's fantasy strategy

For some time now, the Government Digital Service (GDS) have made the meaning of their digital-by-default agenda clear – they want the UK to be like Estonia.

It is thanks to the fact that practically every service in Estonia is delivered over the web that, back in 2007, Russia was able to bring the country to its knees in a matter of days. If GDS succeed with their "modernisation" plans, there will be nothing to stop that happening here in the UK.

GDS are in awe of the financial success and popularity of Apple, Amazon, eBay/PayPal, Google and Facebook. With no experience of government behind them, the over-promoted software engineers at the head of GDS want to bring their heroes' tricks to the delivery of public services in the UK.

Sensible people will see Facebook et al as latter-day Pied Pipers of Hamelin – sensible people, including the tens of thousands of public servants who will be laid off and replaced by GDS's computers when government is, as they say, "transformed".

Many of these organisations are famous for avoiding tax on their UK profits and for using their near-monopolies to tyrannise their suppliers and to milk their customers. But GDS somehow maintain their naĂŻve veneration and on 6 November 2012 they published their Government Digital Strategy.

This fantasy strategy is an elaboration of Martha Lane Fox's ideas, set out in her October 2010 letter to Francis Maude, Directgov 2010 and beyond: revolution not evolution. Ms Lane Fox is the Prime Minister's digital champion, she's a historian, and when she says "revolution" she means it.

Her revolutionary fervour is carried over into last week's GDS strategy, which Sir Bob Kerslake – head of the home civil service, permanent secretary at the Department for Communities and Local Government (DCLG) and previously the chief executive of first the London Borough of Hounslow and then Sheffield City Council – has greeted with a post on GDS's blog, Welcoming the Digital Strategy:
Our reform plan also made a clear commitment to improve the quality of the government’s digital services, and to do this by publishing a Government Digital Strategy setting out how we would support the transformation of digital services [how does publishing a wishlist improve the quality of public services?].

We fulfilled that commitment yesterday with the launch of the Government Digital Strategy, Digital Efficiency Report and Digital Landscape Report and I very much welcome their publication.
But why? Why does Sir Bob "welcome" this emmental cheese of a strategy? It's full of holes. Consider cloud computing for example.

Sunday, 4 November 2012

Cloud computing – how to lose control of your data #94

It's Sunday. Give us a break
Cloud computing is supposed to be cheaper than the alternatives. How many times have we heard that some new management fashion will save us money? How many times can we fall for it? How many times has it turned out to be true? Exactly.

Cloud computing is meant to be more efficient, more reliable, more trusted, more flexible, more scalable, more resilient, more modern, more transformative, ... In each case, the claim is either false or, at best, unproven.

No need to keep banging on about it, the point has been made.

Sign up for cloud computing, like what Her Majesty's Government has in the UK, and you lose control of your data. You want to go out of business? Go ahead. Up to you. Stick your data in the cloud.

We know that. It's all a bit relentlessIt's Sunday. Give us a break.

The gift that keeps on giving
Actually, there's another reason to avoid cloud computing, one that hasn't been mentioned so far on DMossEsq, a new answer to the question why is it foolish to store your data in the cloud.

Kim Dotcom, mega
Still very young, Mr Schmitz
or Dotcom
or Kimble (c.f. The Fugitive)
will be all of 39 years old
on 21 January 2013
6'6" tall and weighing 290lb, the only reason Kim Dotcom (né Schmitz) didn't go to prison after being found guilty on 11 counts of fraud was that ... he was under age at the time of the offences and the judge put it all down to youthful foolishness.

Like most teenagers, he had hacked into NASA. And Citibank. He had also found out how to make international phone calls for free and, unlike most teenagers, had a nice little sideline selling access to these free telecommunications facilities.

He got off the 11 fraud charges with a suspended sentence. And the 10 data espionage charges. But when the insider trading charges started to look a bit serious, he decamped to Thailand. The Thais extradited him back to Germany and he finally served a stretch there. Five months on remand. Quite right, too.

Mr Dotcom loves playing computer games, particularly Modern Warfare 3.

That is not a recognised sign of intellectual achievement, you say.

As you wish. But some people are better at problem-solving than others. How good are you? There are over 15 million players of Modern Warfare 3 worldwide and Mr D was ranked #1, only falling to #2 after a sojourn in a New Zealand prison, about which, more anon.

He also loves cars. Driving in Morocco one day, he became impatient with the car in front and rammed it off the road. These things happen. How was he to know it was being driven by the chief of police?

Kim next set up shop in Hong Kong, picked up a few fines for false declarations to the stock exchange and for marketing a hedge fund that had many fine qualities, like artificial intelligence, but didn't happen to exist and the good ship Dotcom next struck land in New Zealand.

Megaupload
But before that, while in Hong Kong, he had set up a real company, Megaupload. A cloud services company, with 150 staff and and revenues of $175 million p.a., Megaupload had 60 million users, or 180 million according to some reports, it was ranked #13 among all the websites in the world and accounted for 4% of web traffic. Worldwide.

If New Zealand had any qualms about Kim Dotcom's application for residence, the thought of uploading some his money into New Zealand seems to have allayed them. He rented the most expensive house in the country, he laid on a $600,000 fireworks display in Auckland and he donated $50,000 to the mayor's re-election campaign.

Mr Dotcom was rich.

There was a problem when the mayor later had trouble remembering this donation. What would you do, you who have never played Modern Warfare 3? Kim recorded a song called Amnesia. See? Problem-solving. Some people are good at it.

Megaupload was so big that it rented no less than 1,100 servers from another cloud services company, Carpathia, to store all the data people kept handing over.

Got it. You're going to lecture us about contracts. Users may have a contract with one cloud services supplier (e.g. Megaupload) but, if that company hands the users' data over to another cloud services supplier (e.g. Carpathia) with whom the users have no contract, then they have lost control of their data. Ha!

Wrong. Everyone knows that already. That's not a new reason to beware the perils of cloud computing. Think again ...

Hollywood loves a swashbuckler
Not this one they don't.

According to Hollywood, Megaupload has cost them $500 million. It was a seat of piracy, Hollywood's intellectual property rights were being stolen by felons illegally uploading films and TV programs to Megaupload.

That's just my point, you say, you shouldn't be making light of the activities of a seedy criminal.

No-one is making light of anything, least of all Mr Dotcom, who may be a criminal but he is entertaining as well, both, the one doesn't exclude the other.

And not so fast with the "criminal". His Megaupload crimes are alleged. He hasn't been found guilty of them. There's a law. The Digital Millennium Copyright Act (DMCA), which protects the suppliers of a website from the illegal activities of the users of that website. Without that, Sergey Brin of Google would spend his whole time in prison because of all the porn on YouTube. So stick that in your pipe, Roundhead, smoke it and inhale.

DMCA and the evidence against Kim Dotcom were presumably considered by a grand jury and on 5 January 2012 he was indicted on charges of online piracy, racketeering, copyright infringement, and money laundering. That was in Virginia. In the US.
But Mr Dotcom was in New Zealand.

I know. You're going to hold forth on RICO, the Racketeer Influenced and Corrupt Organizations Act, the law they said would only ever be used against suspected gangsters, when opponents of its introduction suggested that its powers were so useful that prosecutors would be unable to resist the temptation to charge everyone with offences under RICO. No, no, said the legislators, that will never happen. But of course it has.

You mean like the surveillance laws here in the UK? The ones they said would only ever be used against suspected terrorists and now local councils use them for fly-tipping offences and dogs fouling the pavement and parents lying about living in the catchment area for desirable schools? No. Completely wrong. Everyone already knows about that. The question is what new reason is there to believe that it's foolish to store your data in the cloud? If all else fails, as teachers used to tell their students, try reading the question.

Due process
The indictments are in Virginia and Dotcom's in Auckland. What would Clarice Sparrow Starling do?

She would probably have a quiet word with her opposite numbers in New Zealand's Government Communications Security Bureau (GCSB). Point out how much appreciated it would be if they could help in this matter. She might maybe exert a bit of pressure. US tariffs on New Zealand lamb imports could be lifted. Or they could be increased. Extraordinary rendition? That kind of thing.

Kim Dotcom appears in court in Auckland in January.
The US wants New Zealand to extradite him
to face internet piracy allegations.
Photograph: AFP/Getty Images
Whatever the FBI said, GCSB went into action immediately. They put Dotcom under surveillance and two weeks later, on 19 January 2012, they got the assault rifles out, started up the helicopter and armed police invaded the Dotcom manor, impounded his possessions right, left and centre, arrested Kim, locked him in prison and froze his assets worldwide.

Which made it hard for him to pay his rent. Or his lawyers. When he was finally allowed access to a bit of his money, the lawyers argued successfully that it was against the law for GCSB to put New Zealand citizens under surveillance, including Kim Dotcom, and that the arrest warrant had been wrongly drafted – too non-specific.

The Prime Minister of New Zealand has subsequently apologised for these mistakes to Mr Dotcom personally and to New Zealanders in general and he has confirmed that GCSB officers mistakenly allowed FBI officers, who happened coincidentally to be present, to take copies of Mega Kim's impounded disk drives.

Prime Minister Key's re-election prospects are in doubt. So are President Obama's. Kim Dotcom blames him personally for his enforced stay in Mt Eden prison, Auckland.

At some point, Mrs Dotcom gave birth to their fourth and fifth children, girl twins, and Kim toyed with the idea of sending the placenta to the FBI to check for pirated DNA, another solution that would never have occurred to you, would it, but let's leave him there, he's clearly quite big enough to look after himself, and turn our attention instead to Kyle Goodwin.

OhioSportsNet
Back in January, the FBI took control of all Megaupload's domain names and their computers and they told Carpathia to keep the 1,100 servers Megaupload rented from them untouched.

The FBI also managed to freeze Megaupload's bank accounts.

Given that Megaupload is a Hong Kong company, how?

Bloomberg think it's something to do with one of Mr Dotcom's fellow defendants having a US address and being an "alter-ego" of the company. Any port in a storm.

Thing is, among the 60 million users of Megaupload, just a couple of them may not be copyright pirates or pornographers. Some of them, like Kyle Goodwin, may run their own legitimate business in Ohio, filming sports events for local high schools, and streaming the footage to sports coaches and the doting parents of the athletes. And Mr Goodwin would kind of like his footage back, please, he's got a business to run, Megaupload have no objection to the return of his data and neither have Carpathia but the courts have:
  • Who says it's his data, the US government asks? Or as their lawyers put it: “Mr. Goodwin has yet to demonstrate whether he has an interest in any property seized by the government ... the mere fact that he may claim, for example, an initial copyright to a version of the files he uploaded is not sufficient to establish that he has an ownership interest in the property that is the subject of this motion”.
  • Suppose we look at what is allegedly Mr Goodwin's data and find he's been infringing copyright? Then what? If he doesn't have "clean hands", we just might start doing a bit of indicting in Ohio.
  • But look, we can't possibly entertain Mr Goodwin's request. It would take ages.
  • And suppose everyone else started asking for their data back, too? Then where would we be?
  • And Carpathia are moaning, too, claiming that it's costing them $9,000 a day to keep these pestilential 1,100 servers out of use. Far as we're concerned Carpathia can just delete all the data on them, all 25 petabytes of it (that's 25 million gigabytes), a course of action various fussy defence lawyers have asked Carpathia please to not pursue.
http://www.megaupload.com today

Your data
And there, ladies and gentlemen, we have the answer.

Mr Goodwin is being represented by lawyers from the Electonic Frontier Foundation (EFF) and they say that "the [US] government maintains that Mr. Goodwin lost his property rights in his data by storing it on a cloud computing service ... both the contract between Megaupload and Mr. Goodwin ... and the contract between Megaupload and the server host, Carpathia ..., likely limit any property interest he may have in his data".

Sign a cloud computing contract and you lose the rights to your property.

The question was, what new reason is there to believe that storing your data in the cloud is a mistake?

And the answer is that you're going to have the devil of a job getting your solicitor to nip over to Quantico to prove that it's yours at all. And as for actually getting it back, forget it. The courts don't have time for all that nonsense. Easier just to delete it.

They wouldn't do that to HMRC and all our tax data stored on Skyscape Cloud Services Ltd's servers. Would they? There are 60 million of us for goodness sake. That could never happen. Could it? And then there's GDS and all our state benefits data stored on ditto ...

Don't you worry about that. Whitehall aren't worried. Don't you worry.

----------

Updated 5.11.12

Philip Johnston, Daily Telegraph, 'Whitehall has its head stuck in the cloud'


Updated 21.2.17

Andrew Orlowski, ElReg, 'NZ High Court rules US can extradite Kim Dotcom after all'

Cloud computing – how to lose control of your data #94

It's Sunday. Give us a break
Cloud computing is supposed to be cheaper than the alternatives. How many times have we heard that some new management fashion will save us money? How many times can we fall for it? How many times has it turned out to be true? Exactly.

Cloud computing is meant to be more efficient, more reliable, more trusted, more flexible, more scalable, more resilient, more modern, more transformative, ... In each case, the claim is either false or, at best, unproven.

No need to keep banging on about it, the point has been made.

Sign up for cloud computing, like what Her Majesty's Government has in the UK, and you lose control of your data. You want to go out of business? Go ahead. Up to you. Stick your data in the cloud.

We know that. It's all a bit relentlessIt's Sunday. Give us a break.

The gift that keeps on giving
Actually, there's another reason to avoid cloud computing, one that hasn't been mentioned so far on DMossEsq, a new answer to the question why is it foolish to store your data in the cloud.

Thursday, 1 November 2012

G-Cloud team soon to be Eleanor Stewartless

G-Cloud ii has been released. There are now over 3,000 conveniently automated ways for central and local government departments to lose control of their IT through CloudStore.

Eleanor has been closely involved in the project and, as a trained archaeologist, she will be particularly well-placed to go through the remains after it all comes tumbling down, identifying the signs of a once-thriving civilisation. "I look forward to watching it happen from my new role in the FCO", she says – G-Cloud's loss is the Foreign Office's gain.

She will be missed. She said G-Cloud ii would be released on 26 October 2012 and it was. She provided a forum for debate and she confronted criticism openly, e.g. "What the heck can we do to resolve some of the scary and largely unknown legal and policy issues that people are nervous about in a globalised world?". Good question. No answer. But at least she asked. The Foreign Office are lucky.

It's not unknown for Whitehall to be open about criticism. Lin Homer at HMRC is pretty good at it and has been for years. We may yet discover from her, HMRC's side of the story about losing control of all our tax records in the cloud with Skyscape, the one-man company with no track record.

Compare that with the Government Digital Service (GDS).

They said they would announce the names of the UK's so-called "identity providers" by 30 September 2012 and they didn't. Then they said the announcement would be made on 22 October 2012 and it wasn't.

Ask them why they've decided to host GOV.UK on Skyscape and they can't answer.

Post a critical comment* on their blog, and they delete it.

Send them an open letter, and there's no response.

Issue a press release with 17 questions, and you get 0 answers.

Security experts at a Whitehall conference pour scorn on GDS's idea of relying on the social networks for identity assurance and ... silence.

GDS claim to want "participation" as they build the new city on a hill with their (tax) dodgy friends. They don't understand the word. Not the way Eleanor Stewart does.

PS At 10:24 a.m. yesterday a notification was emailed to everyone announcing a new post by Mike Beaven on the GDS blog, Refining transactions with help from the Minister. Click on the link and you get "404: Page Not Found". A Twitter enquiry from Kris Coverdale was met with "we just needed to correct something. We'll be putting it back up again later". That was yesterday. 15 minutes ago, via Tim Lloyd, we have "It wasn't displaying correctly. Trying to resolve now". Just how hard is it to participate?

----------

* A lost fragment from GDS's Less About Identity, More About Trust thread recently discovered by archaeologists. What do GDS know about identity? Or trust? And how many other fragments are missing?
Dear Ms Kidney

Thank you for your 12 October 2012 reply.

As you will see on the G-Cloud blog, I have read and responded to Eleanor’s reply, pointing out that it’s not the OJEU rules I’m interested in but the rules of common sense.

It’s not more information about Skyscape that I’m after but an answer to the question how on earth did GDS go through all the hard work of developing GOV.UK and then host it at a one-man £1,000 company?

GOV.UK is meant to be a major national asset and GDS’s decision to host it on Skyscape looks “dangerous, imprudent, ill-advised, unprofessional, wrong-headed, unbusinesslike, undignified and irresponsible” as I say in my open letter to ex-Guardian man Mike Bracken.

And what similarly awful decisions do we have to look forward to discovering on 22 October 2012? IdA Day?

G-Cloud team soon to be Eleanor Stewartless

G-Cloud ii has been released. There are now over 3,000 conveniently automated ways for central and local government departments to lose control of their IT through CloudStore.

Eleanor has been closely involved in the project and, as a trained archaeologist, she will be particularly well-placed to go through the remains after it all comes tumbling down, identifying the signs of a once-thriving civilisation. "I look forward to watching it happen from my new role in the FCO", she says – G-Cloud's loss is the Foreign Office's gain.

She will be missed. She said G-Cloud ii would be released on 26 October 2012 and it was. She provided a forum for debate and she confronted criticism openly, e.g. "What the heck can we do to resolve some of the scary and largely unknown legal and policy issues that people are nervous about in a globalised world?". Good question. No answer. But at least she asked. The Foreign Office are lucky.

It's not unknown for Whitehall to be open about criticism. Lin Homer at HMRC is pretty good at it and has been for years. We may yet discover from her, HMRC's side of the story about losing control of all our tax records in the cloud with Skyscape, the one-man company with no track record.

Compare that with the Government Digital Service (GDS).

Wednesday, 24 October 2012

HMRC and Skyscape 2

The following open letter has been sent by email and by post to Phil Pavitt in his capacity as HMRC Director General Change, Security and Information with a copy to Lin Homer, Chief Executive, HMRC:

[Skyscape has subsequently changed its name to UKCloud: "London – August 1, 2016 – Skyscape Cloud Services Limited, the easy to adopt, easy to use and easy to leave assured cloud services company, has today renamed and relaunched as UKCloud Ltd (www.ukcloud.com), to reinforce the company’s exclusive focus on supporting the UK public sector in the digital transformation of services".]

Open letter [1]

Phil Pavitt          Your ref. CETO /03531/2012
HMRC Director General
Change, Security and Information
100 Parliament St
London SW1A 2BQ          24 October 2012

Dear Mr Pavitt

HMRC and Skyscape Cloud Services Ltd

Thank you for your letter dated 22 October 2012 [2] in response to my letter to Lin Homer dated 11 October 2012 [3].

The point is well taken, of course, that for security reasons HMRC can’t say what data is held where. We're in we-can-neither-confirm-nor-deny territory here. It’s difficult but, given the bizarre nature of the Skyscape contract, HMRC are going to have to find some way to reassure the public about the security with which our tax records, both personal and corporate, are being held.

“The data will continue to be kept in accordance with existing legislation and HMRC security policies”, you say. I should hope so, too – the public want, need, deserve and pay for nothing less.

But your statement begs the question.

The public is bound to assume that the data to be stored at Skyscape’s cloud computing facilities is the tax records of every individual and legal person in the country. What other data does HMRC have?

And the public is bound to assume that our data is intended to be stored at Hartham Park, Corsham, Wilts SN13 0RP because that’s the address of the registered office of Skyscape Cloud Services Ltd and it’s the address of the registered office of its “ally” ARK Continuity Ltd and it’s the address of ARK’s Spring Park data centre as noted for everyone to see on ARK’s website [4]. If that isn’t a breach of security, what is?

Skyscape is a young start-up, it hasn’t yet submitted any accounts to Companies House, it has no track record, it has only one director and he owns all the shares in the company. If the Government Procurement Service (GPS) and HMRC believe that Skyscape is an appropriate company to trust with the care of our tax records, then there is something wrong with GPS’s and HMRC’s selection criteria.

CloudStore make the point that the inclusion of a company and its services in its on-line store is not a warranty of appropriateness. It’s up to the customer – in this case HMRC – to determine appropriateness. Eleanor Stewart, the Assistant Director of G-Cloud, says [5]: “as with everything on the G-Cloud framework the customer can determine whether they are happy with any associated risk at the point of selection”.

The references to GPS and to CloudStore in your letter can provide the public with no comfort.

You mention the Skyscape Cloud Alliance [6] in your letter.

Goodness knows what ARK Continuity is doing in the Alliance. HMRC doesn’t promote itself as being in an alliance with Mapeley. Why does Skyscape expect the public to find it commercially persuasive to include its landlord in the Alliance?

QinetiQ, VMware, Cisco and EMC on the other hand are all industry leaders and if HMRC had entered into a contract with a joint venture company involving them then we wouldn’t be having this correspondence.

But you haven’t.

HMRC have entered into a contract with a one-man start-up. That was the case before you wrote your letter and it remains the case subsequently. The question therefore persists, how can HMRC make such an odd-looking decision? How can they risk the nation’s tax records on Skyscape?

There’s no joint venture company there for a Tax Inspector to get his or her teeth into. Just an “alliance”. What is an alliance in this case?

The contract is to provide cloud computing services. “Cloud computing” means losing control [7]. Whitehall promotes cloud computing on the basis that it turns IT into a utility [8]. That is not attractive, as this month’s news about gas and electricity prices will confirm.

None of us has control over the price our suppliers charge for gas and electricity at home or control over their staff. If HMRC enter into a cloud computing contract with any supplier, big or small, they will have the same problem. How can HMRC risk the nation’s tax records on cloud computing?

Salesmen sometimes unfortunately make over-enthusiastic claims about cloud computing being more resilient, secure and efficient than the alternatives. Lawyers don’t believe them. Lawyers don’t use cloud computing. Lawyers are paid to keep their clients’ data under control and confidential. So are public authorities like HMRC.

As I write, I note that the latest cloud computing dĂ©bâcle is unfolding. Amazon are the biggest cloud computing suppliers in the world and they’ve just had a 12-hour outage [9].

Our tax records are currently stored on hundreds of servers at “multiple” HMRC offices, you say. Good. That looks secure. Much more secure than storing them all in one place with a one-man start-up in some sort of nugatory alliance. And, since you mention it, the allegedly dainty carbon footprint of cloud computing will be no consolation if our records go up in smoke.

According to HMRC’s press release [10] the Skyscape contract will save £1 million a year on running costs. We need to be guided here by the National Audit Office (NAO) report on HMRC’s on-line filing [11].

The NAO examined HMRC’s £8 billion 10-year ASPIRE contract with Capgemini and said:

HMRC uses a range of indicators to measure the performance of its ICT services, which include online services, and it measures availability that relates specifically to online filing. HMRC has a high-level view of the overall costs of ICT provision through the ASPIRE contract. It has been taking steps to improve that information and achieve cost savings. It does not yet have a detailed breakdown of the costs of online filing services, so it cannot benchmark those costs to assess their value for money. HMRC is currently negotiating with the ASPIRE contractors to obtain a clearer breakdown of the costs of ICT services provided. (p.8)
Also:

[HMRC] should proceed with its plans to identify ICT costs specific to online filing services and ensure that current negotiations with the ASPIRE contractors provide sufficient breakdown of cost information for regular benchmarking of costs. (p.13)
In the circumstances, with the suppliers not even prepared to tell HMRC what they are charging for, some scepticism is in order about claims to be able to identify £1 million of on-line filing costs in among the £8,000 million.

CESG have rescued the nation before from other-worldly decisions taken by Whitehall. The Home Office wanted to use DWP’s National Insurance number database as the National Identity Register for the ID cards scheme. CESG pointed out that it was inappropriate and that was the end of that [12].

Let’s hope that they repeat the trick in their review of Skyscape. I look forward to a small piece appearing in the technical press somewhere out of the way regretting that for security reasons which cannot be given the HMRC contract with Skyscape has had to be revoked.

Yours sincerely
David Moss

cc      Lin Homer, Chief Executive, HMRC
          Chartered Institute of Taxation
          Institute of Chartered Accountants in England and Wales




[7]Cloud computing and the Gadarene lemmings of Whitehall, http://www.dmossesq.com/2012/10/cloud-computing-and-fashion-conscious.html
[8]Cloud computing turns IT into a utility, and that's a good thing?, http://www.dmossesq.com/2012/10/cloud-computing-turns-it-into-utility.html
[9]Amazon outage started small, snowballed into 12-hour event, http://www.networkworld.com/news/2012/102312-amazon-outage-263617.html
[11]HM Revenue & Customs – The expansion of online filing of tax returns, http://www.nao.org.uk//idoc.ashx?docId=cd237708-5c6b-472a-af13-f432f80d80cc&version=-1
Updates:
24.5.12
Phil Pavitt says "we don't currently have ID authentication in UK government".
24.10.12
Letter emailed to Phil Pavitt and Lin Homer
25.10.12
Hard copy of letter posted to Phil Pavitt and Lin Homer, links sent to Eleanor Stewart, CIOT and ICAEW
28.10.12
Re last two paragraphs of letter, see Andy Smith affair.
4.11.12
US government argue that signing a cloud services agreement reduces your property rights in the data stored in the cloud, according to EFF.
13.11.12
Cloud computing, and GDS's fantasy strategy: "To which, all one can say is that there must be something wrong with the Cabinet Office, GPS and HMRC procurement criteria ...".
23.11.12
UK.gov to upgrade buying tool after mega cockup downs £1bn deal – Government Procurement Service computer system incapable of handling tenders for government procurement.
26.11.12
HMRC soon to be Pavittless – will Aviva store all our insurance details with Skyscape?