Showing posts with label Phil Pavitt. Show all posts
Showing posts with label Phil Pavitt. Show all posts

Friday, 15 November 2013

Can the Government Procurement Service count?

The "Digital Services framework, which is now open with 183 companies evaluated and selected to supply services" is the result of a year's work by GDS, the Government Digital Service.

So says joshr (?) in a post today on the GDS blog, A supplier framework for building digital services.

"It gives government access to a competitive and wider pool of innovative suppliers, to design and build user focused digital by default services in an agile way". That's joshr's entry in the competition to get as many buzzwords as possible into a single sentence – "user focussed", "digital by default" and "agile" all in one sentence is good, but surely we can do better.

Anyway, there's going to be a Digital Services Store according to joshr on which suppliers can offer their services and government users can buy them:
Suppliers have one place to go to apply to offer these services, and in the upcoming store, buyers will have a single place to procure. The framework will also be the first one of its kind to be supported with a managed service from Government Digital Service and Government Procurement Service.
But hang on a minute.

Suppliers can already offer their services on the CloudStore. Buyers already "have a single place to procure". What joshr means is that suppliers will now have to register with two different stores doing the same thing and users will have two places to procure.

GDS must know about CloudStore – they've been responsible for it since 1 June 2013. The Government Procurement Service must know about it as well – Phil Pavitt told us a year ago that supliers on CloudStore are "required to meet a set of mandatory criteria set out by Government Procurement Services".

joshr should say that the Digital Services Store is the second one of its kind "to be supported with a managed service from Government Digital Service and Government Procurement Service".

Why launch a second store to do the same thing?

Left hand not in touch with right hand?

Maybe.

Or maybe GDS don't like CloudStore. Not invented here.

In which case, CloudStore, having crashed twice in the past two weeks, beware. GDS have been known to let projects hang out to dry if they don't approve of them. GDS avoid "becoming fully involved", as the ruthless ex-Guardian man Mike Bracken told the FT, and "not that close to it" as he told the BBC about Universal Credit going down below the waves for the third time.

The Digital Services framework is "iterative, evolving and adapting, the framework itself being designed in an agile way and based on user needs" – that's joshr's second entry in the buzzwords competition, and much better than his first. Can anyone on the G-Cloud team beat that?

----------

Updated 12.3.14

Four months later, surprise, surprise:
GDS to combine G-Cloud and digital frameworks

12 March 2014

The Government Digital Service (GDS) is currently exploring plans to merge the G-Cloud and digital services frameworks.

The service is hoping to create one single marketplace by amalgamating the Cloudstore (which acts as a catalogue for services and suppliers on the G-Cloud framework) and the Digital Services Store (which provides the same function for digital services) ...

Updated 20.5.14
Digital Marketplace – May update

...

Two frameworks to build digital services
What’s the difference between the two frameworks? Simply put, G-Cloud provides access to commodity, cloud-based services. Digital Services framework (DSf) allows the public sector to commission capabilities to help design and build bespoke digital services ...

Rolling out the Digital Marketplace
... The Digital Marketplace will then replace the current CloudStore for G-Cloud 6 – which we expect to be live in Autumn 2014 ...

Updated 27.1.15

Over a year after this all started – the duplicate/rival digital services forums – where have we got to?

According to ElReg in one of its more impenetrable headlines, Gov.UK inhaled G-Cloud, spat out framework:
Mark Craddock, former G-cloud lead, said: "GDS is obsessed with what I call pub-prietary software – the public sector building everything in-house and putting itself in danger of replicating the failures of the large [system integrators]" ... Craddock added: "G-Cloud needs to be handled with care, because too many people want it to fail."
That was on 23 January 2015.

Then yesterday we read Ex-G-Cloud bigwig Chant weighs in on GDS' framework rebrand:
Former G-Cloud head Chris Chant has entered the growing row over the status of the framework under the UK's Government Digital Service (GDS), criticising its decision to ditch a brand "that has won hearts and minds" ... According to Chant, "G-Cloud is about a fundamental change in the way the government does computing – not just about cloud computing".
GDS is in danger of replicating the failures of the large systems integrators, says Mr Craddock. So is G-Cloud. G-Cloud has won hearts and minds, says Mr Chant, and it's not just about cloud computing. The same could be said of GDS.

G-Cloud is by no means the biggest casualty of the GDS juggernaut. Its demise will leave the excellent Mr Chant even freer than he has been until now to pursue his six month-long truth-not-trust campaign.

Unlike G-Cloud, GDS has always enjoyed powerful political support. It's seen to have votes attached to it.

Those votes will disappear when people notice the daily diet of hacking stories in the media and realise the implication – that GDS is incapable of delivering the secure public services it promises.

Secure public services delivered over the web – digital by default – depend on identity assurance. Central government departments and local government need to be sure that you are who you say you are on-line. Ever the fashion victim, GDS has hitched itself to a "trust framework" to deliver identity assurance through the stillborn GOV.UK Verify service. It doesn't work. It can't.

And who better to convey that message than Mr Truth-Not-Trust himself, Chris Chant?

Can the Government Procurement Service count?

The "Digital Services framework, which is now open with 183 companies evaluated and selected to supply services" is the result of a year's work by GDS, the Government Digital Service.

So says joshr (?) in a post today on the GDS blog, A supplier framework for building digital services.

"It gives government access to a competitive and wider pool of innovative suppliers, to design and build user focused digital by default services in an agile way". That's joshr's entry in the competition to get as many buzzwords as possible into a single sentence – "user focussed", "digital by default" and "agile" all in one sentence is good, but surely we can do better.

Anyway, there's going to be a Digital Services Store according to joshr on which suppliers can offer their services and government users can buy them:
Suppliers have one place to go to apply to offer these services, and in the upcoming store, buyers will have a single place to procure. The framework will also be the first one of its kind to be supported with a managed service from Government Digital Service and Government Procurement Service.
But hang on a minute.

Thursday, 14 February 2013

Skyscape – would you invest £4 million? Thousands haven't.

There are other cloud computing suppliers than Skyscape.
Some of them comparatively well-established.
What is Whitehall doing?
How did the Cabinet Office and the Government Procurement Service
manage to give G-Cloud accreditation to Skyscape?
And how did the MOD, HMRC and GDS
decide that Skyscape is a safe home for our data?

Skyscape's first accounts appeared on the Companies House website today.

Is Mr Jeremy Robin Sanders still in ultimate control of the company?

Yes.

Except that it's become a bit indirect. He set up a company called Virtual Infrastructure Group Ltd (VIG) in June 2012. Then in October 2012 he transferred all his Skyscape shares into VIG. So VIG controls Skyscape. But Mr Sanders controls VIG.

How is Skyscape financed?

Not by equity, that's for sure. VIG has £180 £1,180 of ordinary shares and Skyscape has £1,000.

Mr Sanders lent some money to Skyscape and the balance outstanding at 31 March 2012 was £93,333. But that's not a lot to fund an operation meant to be able to support the Government Digital Service (GDS), HMRC and MOD contracts let to Skyscape. So what other money is there available?

Answer, in November 2012 – well after getting the GDS and HMRC contracts – a loan note financing exercise was launched. £12 million-worth on offer, of which £8 million-worth had been subscribed for by 7 February 2013, the date on which the Skyscape accounts were signed by Mr Sanders and the auditors, Grant Thornton.

Who are these subscribers/investors? We don't know.

What we do know is that, as set out in the Particulars of a mortgage or charge filed with Companies House on 14 November 2012, if Skyscape goes into receivership or administration or ..., then the noteholders get all the assets, which may include GDS's data (our data), HMRC's data (our data) and the MOD's data (our data).

And who's managing the loan notes? That's the other thing we know. Jeffrey Paul Thomas (15 active companies to his name and 45 inactive ones).

Who?

You remember Jeffrey. He's the man who once held some shares in Skyscape but transferred them to Jeremy. He's the man at ARK Continuity, the data centre specialist, with the Rt Hon The Baroness Manningham-Buller on board, funded by Real Estate Venture Capital Partners LLP (RevCap).

The business review in the Skyscape accounts makes it clear that Skyscape was set up explicitly as a speculative venture designed to exploit changes in UK government IT procurement, particularly G-Cloud, the move to cloud computing.

How's it going?

By 31 March 2012 Skyscape had sales of £44,416 which cost them £327,320 and they'd spent £956,965 on administration. There's no detailed P&L in the accounts, but there is a balance sheet showing negative net assets of £1,240,833.

A bit precarious. Just what you'd expect from a speculative venture. It might come right. You never know. Bit worrying that they couldn't get all the notes away, prospective investors not overly impressed.

Still, there's Whitehall in the background. They could make Skyscape a success. As long as Skyscape is well enough managed actually to cope with a lot of contracts.

And there's Cisco and VMware and EMC and QinetiQ in the background, the Skyscape Cloud Alliance. Skyscape is their Trojan horse. They'll extend their credit terms for a while yet but their patience won't be infinite.

G-Cloud, on which Skyscape largely depends – that's one of the Principal Risks And Uncertainties listed in the accounts – released some sales data last week. It's very early days yet. But between April and December 2012 G-Cloud sold just under £6 million of services. Emergn Ltd got 24% of those sales, BJSS 14% and Ninian 9%. 50 suppliers on the list, everyone else is an also-ran so far, including Skyscape with 2%.

Patience. Tested.

And remember. At some stage, G-Cloud may admit the big boys, Amazon and Google.

----------

(NB DMossEsq is absolutely not licensed to give investment advice.)

Skyscape – would you invest £4 million? Thousands haven't.

There are other cloud computing suppliers than Skyscape.
Some of them comparatively well-established.
What is Whitehall doing?
How did the Cabinet Office and the Government Procurement Service
manage to give G-Cloud accreditation to Skyscape?
And how did the MOD, HMRC and GDS
decide that Skyscape is a safe home for our data?

Skyscape's first accounts appeared on the Companies House website today.

Is Mr Jeremy Robin Sanders still in ultimate control of the company?

Yes.

Except that it's become a bit indirect. He set up a company called Virtual Infrastructure Group Ltd (VIG) in June 2012. Then in October 2012 he transferred all his Skyscape shares into VIG. So VIG controls Skyscape. But Mr Sanders controls VIG.

How is Skyscape financed?

Not by equity, that's for sure. VIG has £180 £1,180 of ordinary shares and Skyscape has £1,000.

Wednesday, 30 January 2013

Skyscape loose ends – still loose

  • Skyscape are late submitting their first statutory accounts to Companies House
  • There are more reasons to believe that HMG will lose control of our data once it is hosted in the cloud on Skyscape's servers
  • It looks as if GOV.UK is still not being hosted by Skyscape
----------

Skyscape's non-existent track record
Source: Companies House, 30 January 2013
Skyscape Cloud Services Ltd were due to submit their first set of accounts to Companies House by 31 December 2012 and, so far, they're a month late.

How did the Government Procurement Service (GPS) and the G-Cloud team determine that it is safe to offer Skyscape's services on the Cloudstore?

What were the Government Digital Service (GDS) going on when they chose Skyscape to host GOV.UK, the soon-to-be-single face of government on the web?

How did HMRC decide to entrust its local office data to Skyscape?

No answers. It remains baffling that all this responsibility for public administration should be put on a one-man company.

And now it transpires that the MOD are relying on Skyscape, too.

Losing control of our data
Does the following snippet give you confidence in Skyscape?
ScienceLogic streamlines IT management for Skyscape Cloud Services
Date: 24 Jan 2013

Skyscape Cloud Services, “the easy to adopt, easy to use, and easy to leave” Assured Cloud Services Company, has selected and deployed the ScienceLogic™ Inc. IT infrastructure management platform to optimize IT operations and rapidly automate processes in their large-scale, Infrastructure as a Service (IaaS) offerings. Skyscape is a supplier to the UK government through the G-Cloud Framework initiative, helping deliver a highly-scalable, secure community cloud for the provision of public services. The innovative service provider is using the robust ScienceLogic platform to simplify the complexities of providing mission-critical cloud services to multiple government organizations including GOV.UK and the Ministry of Defence.

“We needed to take a more proactive, cost-effective approach to managing our government customer IT cloud resources,” said Peter Rossi, Head of Orchestration & Automation at Skyscape ...
It shouldn't.

ScienceLogic is a US company based in Reston, VA.

So what?

Once HMG put our data in the cloud, it passes beyond their jurisdiction. What happened to Megaupload.com could happen to us, too. The FBI impounded all the data on Megaupload's servers and no-one has been able to get their data back since.

According to Megaupload's lawyers, the prosecution's case amounts to saying that you lose your property rights if you store data in the cloud – if you'd wanted to retain those rights, so goes the argument, you wouldn't have used the cloud.

The FBI have the powers of the USA PATRIOT Act available to them and of the Foreign Intelligence and Surveillance Amendments Act (FISA).

The USA PATRIOT Act powers can be exercised wherever in the world the cloud data is stored and, as they say on the G-Cloud website, "public cloud is often non-geographically specific" – HMG often won't know where our data is. Location doesn't matter to the FBI. All that matters is that a US-registered company should be involved or any other company with a substantial business in the US.

Skyscape were already known to be involved with EMC, QinetiQ, VMware and Cisco. Then they emphasised the involvement of EMC with the release of a promotional film, Skyscape Cloud Services – Storage as a Service on EMC Atmos. EMC is a US company based in Hopkinton, MA. And now their Head of Orchestration has added ScienceLogic to the list.

FISA was recently "renewed", please see U.S. Spy Law Authorizes Mass Surveillance of European Citizens.

The reasons why the FBI might be interested to take a look at our data are manifold. It was suspected copyright infringement in the case of Megaupload. In our case, it might be that or anything else. Now that the Foreign Account Tax Compliance Act (FATCA) has come into force, they might for example just want to see if there are any US citizens or companies or trusts in the UK evading US tax.

And that's the US, the kindred country we know and trust. HMG will have even less control over our data in other jurisdictions.

Where is GOV.UK?
Back in October 2012, GDS announced that GOV.UK would be hosted on Skyscape.

30 January 2013
This came as news to its then current host, a cloud services company called Akamai. Has GOV.UK moved to Skyscape now? It doesn't look like it. It looks as though it's still hosted with Akamai.

What's going on? Was the GDS announcement about Skyscape nonsense? Who knows. GDS don't answer questions. Four months after Skyscape came into public view, we're none the wiser.

----------

Added 31.1.13:
US authorities can spy on the iCloud without a warrant

Skyscape loose ends – still loose

  • Skyscape are late submitting their first statutory accounts to Companies House
  • There are more reasons to believe that HMG will lose control of our data once it is hosted in the cloud on Skyscape's servers
  • It looks as if GOV.UK is still not being hosted by Skyscape
----------

Skyscape's non-existent track record
Source: Companies House, 30 January 2013
Skyscape Cloud Services Ltd were due to submit their first set of accounts to Companies House by 31 December 2012 and, so far, they're a month late.

How did the Government Procurement Service (GPS) and the G-Cloud team determine that it is safe to offer Skyscape's services on the Cloudstore?

What were the Government Digital Service (GDS) going on when they chose Skyscape to host GOV.UK, the soon-to-be-single face of government on the web?

How did HMRC decide to entrust its local office data to Skyscape?

Monday, 21 January 2013

Skyscape Cloud Services push the boat out

Time was, when you went to the cinema, there was always an advert for the local curry house.

These short promotional films followed rules from which no deviation was permitted.

The cameraman had to have the shakes. The soundtrack had to be just as unsteady, as though it was hanging on, rather listlessly, and didn't much care if it lost its grip.

The first grainy shot would have the proprietor, off-centre, trying to smile naturally and failing. All expense spared, the film would cut to a close-up of congealed entrails in a cracked bowl and then pull back to show a lot of worryingly pasty-faced people with no make-up sitting round a table and looking as though they might try eating the entrails. Or not.

Finally, without warning, it would stop being daylight and while the sound recordist replaced the sitar music with something more Hawaiian a voice-over would explain to us that the restaurant was just three doorways from this very venue, as though we didn't know, next to the betting shop.

It's always been a mystery. What happened to the professionals who made these gems? Where are they now? Let's face it, we miss them, it's part of our heritage.

Mystery solved. Take a look at this. Five-and-a-half minutes of Skyscape Cloud Services – Storage as a Service on EMC Atmos.

Let the whole thing waft over you and then try to answer a few questions:
  • How much training was the graphic designer given? Any?
  • Why didn't they just re-record the voice-over instead of editing it, apparently with a trowel?
  • Who is being advertised? Skyscape? Or EMC?
  • What are they selling and why should you buy it?
  • How far are they from the betting shop?
  • Can you remember anything about the film you've just seen?
It's a hugely nostalgic five-and-a-half minutes. Especially when you realise that HMRC have contracted with this company, probably Skyscape but maybe EMC, to store a lot of our data currently kept at HMRC local offices. And that GDS, the Government Digital Service, have contracted with them to host GOV.UK, the website on which all public services are supposed soon to depend.

Does this little film inspire you with the confidence to host your website and store your data with Skyscape/EMC? Or would you rather eat the congealed entrails after all?

Skyscape Cloud Services push the boat out

Time was, when you went to the cinema, there was always an advert for the local curry house.

These short promotional films followed rules from which no deviation was permitted.

The cameraman had to have the shakes. The soundtrack had to be just as unsteady, as though it was hanging on, rather listlessly, and didn't much care if it lost its grip.

The first grainy shot would have the proprietor, off-centre, trying to smile naturally and failing. All expense spared, the film would cut to a close-up of congealed entrails in a cracked bowl and then pull back to show a lot of worryingly pasty-faced people with no make-up sitting round a table and looking as though they might try eating the entrails. Or not.

Finally, without warning, it would stop being daylight and while the sound recordist replaced the sitar music with something more Hawaiian a voice-over would explain to us that the restaurant was just three doorways from this very venue, as though we didn't know, next to the betting shop.

It's always been a mystery. What happened to the professionals who made these gems? Where are they now? Let's face it, we miss them, it's part of our heritage.

Wednesday, 19 December 2012

Cloud computing supplier raises doubts about cloud computing suppliers – "suicidal mission with no exit"

It should be made clear that Mr Peter Dawes-Huish, the chief executive officer of LinuxIT, is in favour of cloud computing. "G-Cloud is a great opportunity for government", he is quoted as saying in computing.co.uk.

This has provoked fury in the Twittersphere where Chris Haslam has re-Tweeted Mark_Anthony's scorn: "RT @Mark_Antony: Worst article on the @G_Cloud_UK I have ever had the misfortune to read: http://bit.ly/XzwKw0  - shameful drivel...”".

The shameful drivel Mr Dawes-Huish is guilty of uttering is presumably where he described G-Cloud as a military mission "with an entry route and no exit route" that is "not just dangerous, but suicide".

G-Cloud, of course, is the government cloud, a military mission in the safe hands of the Cabinet Office and the Government Procurement Service (GPS). GPS, if you remember, are the people whose procurement service broke down because it didn't have enough space to store the tenders submitted by prospective suppliers in response to GPS's invitation.

In the worst article ever, Messrs Haslam and Mark_Anthony had the further misfortune to read "if you move your applications and data to a cloud service in the proprietary model then you'll be held to ransom" and "some government departments indicate that using G-Cloud is illegal, or against government policy". Drivel. Shameful.

HMRC's decision to store local tax office data in the cloud is perfectly sensible. So is the Government Digital Service's decision to host GOV.UK in the cloud.

Let there be no doubt about that, both decisions have been made with the support of GPS. There is nothing untoward in the fact that the supplier concerned in each case, Skyscape Cloud Services Ltd, is owned 100% by just one individual (when last checked on Companies House) and provides a map on the web how to get to its data centre. That will not stay CESG's hand for a moment, they will be pleased to confirm that Skyscape meets all security requirements.

Cloud computing is the flavour of the month, Mr Dawes-Huish suggests. It is based on the attractions of the utility model, you only pay for the IT services you actually use. The utility model is in some disrepute in the gas and electricity world at the moment but it would be shameful drivel to suggest that the same fate awaits cloud computing – quasi-monopolists ramping prices, consumers helpless in the face of.

What happens, though, Mr Dawes-Huish asks, when there is a new flavour of the month round at GPS Towers? Will the Gadarene lemmings who have signed up with G-Cloud be able to escape and take advantage of the new flavour? Or will HMRC's records and the entire single government domain GOV.UK be locked in to/held hostage by last month's flavour?

Cloud computing supplier raises doubts about cloud computing suppliers – "suicidal mission with no exit"

It should be made clear that Mr Peter Dawes-Huish, the chief executive officer of LinuxIT, is in favour of cloud computing. "G-Cloud is a great opportunity for government", he is quoted as saying in computing.co.uk.

This has provoked fury in the Twittersphere where Chris Haslam has re-Tweeted Mark_Anthony's scorn: "RT @Mark_Antony: Worst article on the @G_Cloud_UK I have ever had the misfortune to read: http://bit.ly/XzwKw0  - shameful drivel...”".

The shameful drivel Mr Dawes-Huish is guilty of uttering is presumably where he described G-Cloud as a military mission "with an entry route and no exit route" that is "not just dangerous, but suicide".

G-Cloud, of course, is the government cloud, a military mission in the safe hands of the Cabinet Office and the Government Procurement Service (GPS). GPS, if you remember, are the people whose procurement service broke down because it didn't have enough space to store the tenders submitted by prospective suppliers in response to GPS's invitation.

Wednesday, 28 November 2012

HMRC, Skyscape and a 2nd response from Phil Pavitt

G-Cloud, GDS, HMRC and Skyscape, the company with just one director, who owns all the shares – Whitehall SNAFU
Open letter to Lin Homer, Chief Executive, HMRC, asking about the wisdom of entrusting their data (our data) to the cloud with Skyscape Cloud Services Ltd.
Response from Phil Pavitt, Director General Change, Security and Information, HMRC, on behalf of Lin Homer.
Open letter to Phil Pavitt.
28 November 2012
Response dated 26 November 2012 from Phil Pavitt, please see below:

[Skyscape has subsequently changed its name to UKCloud: "London – August 1, 2016 – Skyscape Cloud Services Limited, the easy to adopt, easy to use and easy to leave assured cloud services company, has today renamed and relaunched as UKCloud Ltd (www.ukcloud.com), to reinforce the company’s exclusive focus on supporting the UK public sector in the digital transformation of services".]


HMRC and Skyscape Cloud Services Ltd

Dear Mr Moss

Thank you for your letter of 24 October 2012 expressing your concerns in respect of Skyscape Cloud Services Ltd suitability to host HMRC data. I apologise for the delay in responding to you.

Further to my reply of 22 October, I wanted to provide you with some more information to alleviate your concerns. I must reiterate our assurance that using Skyscape HMRC data will continue to be kept in accordance with existing legislation and HMRC security policies.

When fully operational, Skyscape Cloud Services Ltd will securely host all HMRC data currently held on office File and Print Servers (FAPS). FAPS support the work of many HMRC offices and hold data for a wide range business purposes e.g. administrative and customer related. FAPS do not hold the definitive tax records for the UK and these records remain distributed across a number of secure systems.

HMRC routinely risk assesses and tests the security of our solutions and services. Our secure connection to Skyscape will be delivered in line with HM Government standards to protect our data, with ongoing assurance checks throughout the life of this service.

As emphasised in my letter of 24 October, in order to deliver through G-Cloud, Skyscape were required to meet a set of mandatory criteria set out by Government Procurement Services (GPS) including financial standing and Experian risk assessments. Additionally, HMRC carried out its own standard taxation and financial compliance checks before awarding the contract and Skyscape passed the standards set by HMRC and Government.

All G Cloud contracts are let on a one year basis, with exit provisions agreed to transfer the data to a new supplier should this prove necessary.

Data security remains integral to HMRC and a pre-requisite of any of our data being migrated to Skyscape is for their solution, including all the constituent parts, to be formally accredited by CESG (the Communications-Electronics Security Group) to Impact Level 3 (IL3). All security aspects of the service will have to be proven in line with HM Government security standards. This will include the need to ensure the ‘cloud’ is hosted in a UK domiciled, secure data centre(s) and operated by staff with appropriate security clearance. We are also carrying out internal accreditations including Internal Risk Management and Accreditation Document Set (RMADS) and PSN risk assessments.

I trust that this answers your concerns and you are able to appreciate our decision to contract with Skyscape.

Yours sincerely

Regards

Phil Pavitt
HMRC Director General Change, Security and Information

HMRC, Skyscape and a 2nd response from Phil Pavitt

G-Cloud, GDS, HMRC and Skyscape, the company with just one director, who owns all the shares – Whitehall SNAFU
Open letter to Lin Homer, Chief Executive, HMRC, asking about the wisdom of entrusting their data (our data) to the cloud with Skyscape Cloud Services Ltd.
Response from Phil Pavitt, Director General Change, Security and Information, HMRC, on behalf of Lin Homer.
Open letter to Phil Pavitt.
28 November 2012
Response dated 26 November 2012 from Phil Pavitt, please see below:

[Skyscape has subsequently changed its name to UKCloud: "London – August 1, 2016 – Skyscape Cloud Services Limited, the easy to adopt, easy to use and easy to leave assured cloud services company, has today renamed and relaunched as UKCloud Ltd (www.ukcloud.com), to reinforce the company’s exclusive focus on supporting the UK public sector in the digital transformation of services".]


HMRC and Skyscape Cloud Services Ltd

Dear Mr Moss

Thank you for your letter of 24 October 2012 expressing your concerns in respect of Skyscape Cloud Services Ltd suitability to host HMRC data. I apologise for the delay in responding to you.

Further to my reply of 22 October, I wanted to provide you with some more information to alleviate your concerns. I must reiterate our assurance that using Skyscape HMRC data will continue to be kept in accordance with existing legislation and HMRC security policies.

When fully operational, Skyscape Cloud Services Ltd will securely host all HMRC data currently held on office File and Print Servers (FAPS). FAPS support the work of many HMRC offices and hold data for a wide range business purposes e.g. administrative and customer related. FAPS do not hold the definitive tax records for the UK and these records remain distributed across a number of secure systems.

HMRC routinely risk assesses and tests the security of our solutions and services. Our secure connection to Skyscape will be delivered in line with HM Government standards to protect our data, with ongoing assurance checks throughout the life of this service.

As emphasised in my letter of 24 October, in order to deliver through G-Cloud, Skyscape were required to meet a set of mandatory criteria set out by Government Procurement Services (GPS) including financial standing and Experian risk assessments. Additionally, HMRC carried out its own standard taxation and financial compliance checks before awarding the contract and Skyscape passed the standards set by HMRC and Government.

All G Cloud contracts are let on a one year basis, with exit provisions agreed to transfer the data to a new supplier should this prove necessary.

Data security remains integral to HMRC and a pre-requisite of any of our data being migrated to Skyscape is for their solution, including all the constituent parts, to be formally accredited by CESG (the Communications-Electronics Security Group) to Impact Level 3 (IL3). All security aspects of the service will have to be proven in line with HM Government security standards. This will include the need to ensure the ‘cloud’ is hosted in a UK domiciled, secure data centre(s) and operated by staff with appropriate security clearance. We are also carrying out internal accreditations including Internal Risk Management and Accreditation Document Set (RMADS) and PSN risk assessments.

I trust that this answers your concerns and you are able to appreciate our decision to contract with Skyscape.

Yours sincerely

Regards

Phil Pavitt
HMRC Director General Change, Security and Information

Monday, 26 November 2012

HMRC soon to be Pavittless

Computer Weekly, 22 November 2012:
Phil Pavitt has stepped down as HMRC’s CIO to join insurance giant Aviva as global director of IT transformation ...

Under his role at Aviva Pavitt will be tasked with simplifying the firm’s IT services, and modernising and digitising its business.
DMossEsq readers have met Mr Pavitt a couple of times.

Back in May he forgot that the UK already has a Government Gateway and doesn't need GDS – the Government Digital Service – to develop a new one, even if they could.

More recently, he was deputed by Lin Homer, Chief Executive of HMRC, to explain why HMRC have decided to store all our tax records with a one-man company, Skyscape Cloud Services Ltd:
  • Let's hope he has time to explain this transformational decision to the public before he leaves HMRC.
  • And let's see if Aviva, in the name of "modernisation", will store all their insurance records in the cloud and instantly lose control of them.

HMRC soon to be Pavittless

Computer Weekly, 22 November 2012:
Phil Pavitt has stepped down as HMRC’s CIO to join insurance giant Aviva as global director of IT transformation ...

Under his role at Aviva Pavitt will be tasked with simplifying the firm’s IT services, and modernising and digitising its business.
DMossEsq readers have met Mr Pavitt a couple of times.

Tuesday, 13 November 2012

Cloud computing, and GDS's fantasy strategy

For some time now, the Government Digital Service (GDS) have made the meaning of their digital-by-default agenda clear – they want the UK to be like Estonia.

It is thanks to the fact that practically every service in Estonia is delivered over the web that, back in 2007, Russia was able to bring the country to its knees in a matter of days. If GDS succeed with their "modernisation" plans, there will be nothing to stop that happening here in the UK.

GDS are in awe of the financial success and popularity of Apple, Amazon, eBay/PayPal, Google and Facebook. With no experience of government behind them, the over-promoted software engineers at the head of GDS want to bring their heroes' tricks to the delivery of public services in the UK.

Sensible people will see Facebook et al as latter-day Pied Pipers of Hamelin – sensible people, including the tens of thousands of public servants who will be laid off and replaced by GDS's computers when government is, as they say, "transformed".

Many of these organisations are famous for avoiding tax on their UK profits and for using their near-monopolies to tyrannise their suppliers and to milk their customers. But GDS somehow maintain their naïve veneration and on 6 November 2012 they published their Government Digital Strategy.

This fantasy strategy is an elaboration of Martha Lane Fox's ideas, set out in her October 2010 letter to Francis Maude, Directgov 2010 and beyond: revolution not evolution. Ms Lane Fox is the Prime Minister's digital champion, she's a historian, and when she says "revolution" she means it.

Her revolutionary fervour is carried over into last week's GDS strategy, which Sir Bob Kerslake – head of the home civil service, permanent secretary at the Department for Communities and Local Government (DCLG) and previously the chief executive of first the London Borough of Hounslow and then Sheffield City Council – has greeted with a post on GDS's blog, Welcoming the Digital Strategy:
Our reform plan also made a clear commitment to improve the quality of the government’s digital services, and to do this by publishing a Government Digital Strategy setting out how we would support the transformation of digital services [how does publishing a wishlist improve the quality of public services?].

We fulfilled that commitment yesterday with the launch of the Government Digital Strategy, Digital Efficiency Report and Digital Landscape Report and I very much welcome their publication.
But why? Why does Sir Bob "welcome" this emmental cheese of a strategy? It's full of holes. Consider cloud computing for example.

The Executive summary of the Government Digital Strategy tells us that:
Government is improving the way it provides information by moving to a single website, GOV.UK. Transactional services now present the biggest opportunity to save people time and save the government money [the writers mean "save the people money", the government doesn't have any money, only the people do].
GOV.UK is the implementation of Martha Lane Fox's dream, a single government domain, one website, on which all government information is to be published, and on which we will all communicate with the government via "transactional services".

Every central government website is in the process of being re-written and subsumed in GOV.UK. No more HMRC.gov.uk, no more Education.gov.uk, etc ... One day there will just be GOV.UK. Why? What's the point of all this energetic and agreeable re-writing of what has already been written? The answer has never been made clear.

How many government transactions will GOV.UK need to carry out every year? According to the Government Digital Strategy:
There is a huge volume of transactions with government. There were around 1 billion individual transactions a year with central government departments in 2011/12. This number rises to nearer 1.5 billion when other governmental organisations such as local government are taken into account ...
Clearly GOV.UK is intended to be a remarkably important national asset. It will act as the gateway or hub through which personal and corporate tax returns are made, passports are applied for, the electoral roll is maintained, benefits are paid, student loans are granted, vehicle excise duty is paid, licences are applied for, and so on – 1½ billion transactions a year.

Further on in the Government Digital Strategy we find:
Principle: Broaden the range of those tendering to supply digital services including more small and medium sized enterprises
and
The ICT Strategy stressed the need for government to procure its technical infrastructure - its servers, internet hosting, etc - as commodity services. The CloudStore framework is an example of this shift, with over 300 suppliers offering cloud-based solutions on a pay-as-you-use basis, with a maximum 12 months contract. The learning from the development of the CloudStore framework will be fed into other digital procurement and commissioning reform.
So-called "cloud computing" is being championed by Whitehall's G-Cloud team (government cloud) and they have provided an on-line shop, the CloudStore, making it easy for central and local government to buy IT services. It's just like using Amazon. There's even a little supermarket trolley to fill up.

GDS have elected to host GOV.UK in the cloud. And elected to do so, with a company called Skyscape Cloud Services Ltd whose wares are for sale on CloudStore.

Skyscape is a startup so young that it has yet to file any accounts with Companies House. It has filed an Annual Return, though, according to which Skyscape has no company secretary and only one director, a Mr Jeremy Robin Sanders, who is also the only shareholder in the company, holding all £1,000-worth of ordinary shares issued and fully paid-up.

GDS have decided to entrust an important national asset and 1½ billion transactions a year to Mr Sanders, a decision described in an open letter as "dangerous, imprudent, ill-advised, unprofessional, wrong-headed, unbusinesslike, undignified and irresponsible". No response has been received from GDS.

HMRC also have contracted with Skyscape, to store all the data currently held at their hundreds of local offices around the country – presumably all our personal and corporate tax returns and correspondence. In future, Mr Sanders will be responsible for the lot.

HMRC are a sensible lot, you may say to yourself, so perhaps GDS's GOV.UK hosting decision isn't so dangerous, imprudent, ill-advised, unprofessional, wrong-headed, unbusinesslike, undignified and irresponsible, after all? Maybe. Or are HMRC being dangerous, imprudent, ill-advised, unprofessional, wrong-headed, unbusinesslike, undignified and irresponsible, too?

The matter was taken up with HMRC. And they responded. They say that:
The G-Cloud was created by the Cabinet Office and the Government Procurement Services (GPS) ... In order to deliver services through G-Cloud, all suppliers on the Framework, Skyscape included, were required to meet a set of mandatory criteria set out by GPS including their financial standing and Experian risk assessments. Additionally, HMRC carried out its own standard taxation and financial compliance checks  before awarding the contract and Skyscape passed the standard set by the G-Cloud Framework and HMRC.
To which, all one can say is that there must be something wrong with the Cabinet Office, GPS and HMRC procurement criteria if they determine that it is safe to store all our records with a one-man startup with no track record.

The Skyscape contracts are subject to review by CESG, the information assurance arm of GCHQ. There is that one hurdle still to jump. Given that Skyscape's landlord advertises the address of the Skyscape data centre on its website and even provides a map how to get there, it's hard to see how Skyscape can pass CESG's security tests.

If CESG veto Skyscape, well and good. If not, that's another organisation to add to the dangerous, imprudent, ill-advised, unprofessional, wrong-headed, unbusinesslike, undignified and irresponsible list.

Suppose that the GDS and HMRC contracts weren't with Skyscape but with a bigger company – would that make them better?

No.

For several reasons.

The biggest supplier of cloud computing services in the world is Amazon. Reason #1, you will have noted Amazon's appearance in front of the Public Accounts Committee yesterday:
Andrew Cecil, head of public policy at Amazon, was lambasted by Mrs Hodge for avoiding the Committee’s questions. She said she would “summon” Amazon’s most senior executives as a matter of priority to make up for Mr Cecil’s “unacceptable nonsence.”
Amazon are in the dock, along with Google and Starbucks, for tax avoidance and one member of the Committee, Charlie Elphicke, was moved to suggest that:
The tax abuse can be stopped. We can tighten UK tax presence rules, we can stop the 'expenses' used to cut business tax bills in the UK and we should refuse Government contracts for companies that don't pay a fair share of tax in the UK.
We the public all have to pay our taxes, so should Amazon and Google and all of GDS's friends and Starbucks. If moral indignation gets us nowhere, perhaps a ban on government contracts would do the trick.

Reason #2, cloud computing is normally described as being like a utility, you only pay for the services you use, you don't have to pay for any overhead. It's a "no-brainer", as GDS put it.

It certainly is. No brains at all. Someone must be paying for the overhead. Whether Amazon or Skyscape. And they're going to pass the cost on to their customers. Whether HMRC or GDS – ultimately, us.

We've just had a month of daily news about how expensive our utilities are, gas and electricity, about how there's nothing even the prime Minister can do about it and, just yesterday, there was an allegation of utility price-fixing à la LIBOR. The utility model is not an attractive one. Which may be why GDS have taken to describing cloud computing as "commodity services" rather than the previously more conventional "utility services".

Reason #3, "cloud computing" means losing control. You don't own the computers. You don't own the buildings. You don't vet or train or manage the staff. The staff can be anywhere in the world, as can the computers, and your data with them, beyond your control, beyond the reach of English law. Ask the G-Cloud team about that, and they haven't got any answer. They're just following the latest fashion.

GDS have a weaselly argument that Whitehall is no different, they don't have to have secure data centres staffed by their own people, they can be just like all the other organisations in the world – and they use cloud computing. It sounds modest, doesn't it, and realistic.

But it's utterly mendacious. Some organisations do use cloud computing, some don't.

Ask a lawyer. Ask a lawyer about the legal problems. The data protection issues. The jurisdiction problems. The compliance problems. The commercial problems – what do you do if your supplier goes bust or is taken over by Huawei? Most of all, though, ask your lawyer if his or her firm uses cloud computing. Lawyers have to keep their clients' data under control and confidential. They can't do that if they haven't got a clue where in the world the data is or who's taking what backups. They'd go out of business the day after signing up with a cloud computing services supplier.

Whitehall also has a duty to keep control of our data and to keep it confidential. Cloud computing is an abrogation of that duty.

Reason #4, what does Larry Ellison, the President of Oracle, all $41 billion of him, have to say about cloud computing?
Maybe I'm an idiot, but I have no idea what anyone is talking about. What is it? It's complete gibberish. It's insane. When is this idiocy going to stop?
What do you know that Larry Ellison doesn't?

Where there should be answers to these questions in the Government Digital Strategy there are just holes. Revolution is proposed with no justification. And yet Sir Bob, the head of the home civil service, welcomes this fantasy.

Cloud computing, and GDS's fantasy strategy

For some time now, the Government Digital Service (GDS) have made the meaning of their digital-by-default agenda clear – they want the UK to be like Estonia.

It is thanks to the fact that practically every service in Estonia is delivered over the web that, back in 2007, Russia was able to bring the country to its knees in a matter of days. If GDS succeed with their "modernisation" plans, there will be nothing to stop that happening here in the UK.

GDS are in awe of the financial success and popularity of Apple, Amazon, eBay/PayPal, Google and Facebook. With no experience of government behind them, the over-promoted software engineers at the head of GDS want to bring their heroes' tricks to the delivery of public services in the UK.

Sensible people will see Facebook et al as latter-day Pied Pipers of Hamelin – sensible people, including the tens of thousands of public servants who will be laid off and replaced by GDS's computers when government is, as they say, "transformed".

Many of these organisations are famous for avoiding tax on their UK profits and for using their near-monopolies to tyrannise their suppliers and to milk their customers. But GDS somehow maintain their naïve veneration and on 6 November 2012 they published their Government Digital Strategy.

This fantasy strategy is an elaboration of Martha Lane Fox's ideas, set out in her October 2010 letter to Francis Maude, Directgov 2010 and beyond: revolution not evolution. Ms Lane Fox is the Prime Minister's digital champion, she's a historian, and when she says "revolution" she means it.

Her revolutionary fervour is carried over into last week's GDS strategy, which Sir Bob Kerslake – head of the home civil service, permanent secretary at the Department for Communities and Local Government (DCLG) and previously the chief executive of first the London Borough of Hounslow and then Sheffield City Council – has greeted with a post on GDS's blog, Welcoming the Digital Strategy:
Our reform plan also made a clear commitment to improve the quality of the government’s digital services, and to do this by publishing a Government Digital Strategy setting out how we would support the transformation of digital services [how does publishing a wishlist improve the quality of public services?].

We fulfilled that commitment yesterday with the launch of the Government Digital Strategy, Digital Efficiency Report and Digital Landscape Report and I very much welcome their publication.
But why? Why does Sir Bob "welcome" this emmental cheese of a strategy? It's full of holes. Consider cloud computing for example.

Thursday, 1 November 2012

G-Cloud team soon to be Eleanor Stewartless

G-Cloud ii has been released. There are now over 3,000 conveniently automated ways for central and local government departments to lose control of their IT through CloudStore.

Eleanor has been closely involved in the project and, as a trained archaeologist, she will be particularly well-placed to go through the remains after it all comes tumbling down, identifying the signs of a once-thriving civilisation. "I look forward to watching it happen from my new role in the FCO", she says – G-Cloud's loss is the Foreign Office's gain.

She will be missed. She said G-Cloud ii would be released on 26 October 2012 and it was. She provided a forum for debate and she confronted criticism openly, e.g. "What the heck can we do to resolve some of the scary and largely unknown legal and policy issues that people are nervous about in a globalised world?". Good question. No answer. But at least she asked. The Foreign Office are lucky.

It's not unknown for Whitehall to be open about criticism. Lin Homer at HMRC is pretty good at it and has been for years. We may yet discover from her, HMRC's side of the story about losing control of all our tax records in the cloud with Skyscape, the one-man company with no track record.

Compare that with the Government Digital Service (GDS).

They said they would announce the names of the UK's so-called "identity providers" by 30 September 2012 and they didn't. Then they said the announcement would be made on 22 October 2012 and it wasn't.

Ask them why they've decided to host GOV.UK on Skyscape and they can't answer.

Post a critical comment* on their blog, and they delete it.

Send them an open letter, and there's no response.

Issue a press release with 17 questions, and you get 0 answers.

Security experts at a Whitehall conference pour scorn on GDS's idea of relying on the social networks for identity assurance and ... silence.

GDS claim to want "participation" as they build the new city on a hill with their (tax) dodgy friends. They don't understand the word. Not the way Eleanor Stewart does.

PS At 10:24 a.m. yesterday a notification was emailed to everyone announcing a new post by Mike Beaven on the GDS blog, Refining transactions with help from the Minister. Click on the link and you get "404: Page Not Found". A Twitter enquiry from Kris Coverdale was met with "we just needed to correct something. We'll be putting it back up again later". That was yesterday. 15 minutes ago, via Tim Lloyd, we have "It wasn't displaying correctly. Trying to resolve now". Just how hard is it to participate?

----------

* A lost fragment from GDS's Less About Identity, More About Trust thread recently discovered by archaeologists. What do GDS know about identity? Or trust? And how many other fragments are missing?
Dear Ms Kidney

Thank you for your 12 October 2012 reply.

As you will see on the G-Cloud blog, I have read and responded to Eleanor’s reply, pointing out that it’s not the OJEU rules I’m interested in but the rules of common sense.

It’s not more information about Skyscape that I’m after but an answer to the question how on earth did GDS go through all the hard work of developing GOV.UK and then host it at a one-man £1,000 company?

GOV.UK is meant to be a major national asset and GDS’s decision to host it on Skyscape looks “dangerous, imprudent, ill-advised, unprofessional, wrong-headed, unbusinesslike, undignified and irresponsible” as I say in my open letter to ex-Guardian man Mike Bracken.

And what similarly awful decisions do we have to look forward to discovering on 22 October 2012? IdA Day?

G-Cloud team soon to be Eleanor Stewartless

G-Cloud ii has been released. There are now over 3,000 conveniently automated ways for central and local government departments to lose control of their IT through CloudStore.

Eleanor has been closely involved in the project and, as a trained archaeologist, she will be particularly well-placed to go through the remains after it all comes tumbling down, identifying the signs of a once-thriving civilisation. "I look forward to watching it happen from my new role in the FCO", she says – G-Cloud's loss is the Foreign Office's gain.

She will be missed. She said G-Cloud ii would be released on 26 October 2012 and it was. She provided a forum for debate and she confronted criticism openly, e.g. "What the heck can we do to resolve some of the scary and largely unknown legal and policy issues that people are nervous about in a globalised world?". Good question. No answer. But at least she asked. The Foreign Office are lucky.

It's not unknown for Whitehall to be open about criticism. Lin Homer at HMRC is pretty good at it and has been for years. We may yet discover from her, HMRC's side of the story about losing control of all our tax records in the cloud with Skyscape, the one-man company with no track record.

Compare that with the Government Digital Service (GDS).

Monday, 22 October 2012

Things happen when Lin Homer's in the loop. Fast.

An open letter was sent to HMRC by email and by post asking about the advisability of contracting with Skyscape Cloud Services Ltd.

An acknowledgement was received today by post promising a response within 15 working days.

And then the response was received, as shown below, dated today. Unprecedented.

With thanks to Phil Pavitt, responding on behalf of Ms Homer, and no further comment for the moment:

[Skyscape has subsequently changed its name to UKCloud: "London – August 1, 2016 – Skyscape Cloud Services Limited, the easy to adopt, easy to use and easy to leave assured cloud services company, has today renamed and relaunched as UKCloud Ltd (www.ukcloud.com), to reinforce the company’s exclusive focus on supporting the UK public sector in the digital transformation of services".]

HMRC and Skyscape Cloud Services Ltd

Dear Mr Moss

Thank you for your letter of 11 October 2012 expressing your concerns in respect of HMRC’s recently announced contract with Skyscape Cloud Services Ltd. I am replying on behalf of HMRC’s Chief Executive, Lin Homer.

Skyscape were selected by HMRC and awarded a 12 month contract due to their innovative, inventive and value for money solution. In terms of the suitability of Skyscape hosting HMRC data I can confirm that HMRC procured the services of Skyscape via the HM Government “G-Cloud” Framework, also referred to  as the CloudStore. The G-Cloud was created by the Cabinet Office and the Government Procurement Services (GPS) via a formal competition process through the Official Journal of the European Union under the Open Procedure.

G-Cloud was established to make government procurement easier and more transparent and was, in part, created as a means of encouraging small and medium sized enterprises (SMEs) to compete on a level playing  field with multi-national organisations.

In order to deliver services through G-Cloud, all suppliers on the Framework, Skyscape included, were required to meet a set of mandatory criteria set out by GPS including their financial standing and Experian risk assessments. Additionally, HMRC carried out its own standard taxation and financial compliance checks  before awarding the contract and Skyscape passed the standard set by the G-Cloud Framework and HMRC.

Skyscape’s services are provided through a number of key, or “Alliance”, Partners. These partners are industry leading organisations that provide services in the data centre or “cloud” arena such as EMC (storage  and security services), Cisco (networking) and Ark Continuity (UK based high security data centres). Ark Continuity therefore are one of a number of partners who supply Skyscape with their products and services which are key to Skyscape’s overall assured cloud computing services.

However, data security remains integral to HMRC and a pre-requisite of any of our data being migrated to Skyscape is for their solution, including all the constituent parts, to be formally accredited by CESG (the Communications-Electronics Security Group) to Impact Level 3 (IL3). For more information please see the link below:

http://gcloud.civilservice.gov.uk/2012/03/09/so-what-is-il3-a-short-guide-to-business-impact-levels/

This accreditation is expected imminently, at which point HMRC will be in a position to begin securely moving data over to Skyscape and decommissioning our old servers. Once the data has been moved it will remain there for the contract duration (12 months) during which time any subsequent data storage contract will be re-competed to ensure HMRC continues to take advantage of innovative, secure and low cost solutions, available within the marketplace, which allow HMRC to easily store, manage and transfer its data.

It should also be noted that for security reasons HMRC does not discuss details of the data that it holds, or where it stores it, however we are able to confirm that by using Skyscape HMRC data will continue to be kept in accordance with existing legislation and HMRC security policies.

Finally, I can confirm that the claims within HMRC’s press release of 26 September are fully justified. The data, which will be securely stored by Skyscape, currently resides on several hundred servers, across multiple HMRC office locations. This change will consolidate that data and place it into a small number of secure and highly resilient cloud data centres hence improving the security of the data, the efficiency of managing that data as well as improving HMRC’s carbon footprint.

I trust that this answers your queries in full and I hope that you can now appreciate that HMRC’s decision to contract with Skyscape was not dangerous, ill-advised or irresponsible.

Yours sincerely,
Regards
Phil Pavitt
HMRC Director General Change, Security and Information

Things happen when Lin Homer's in the loop. Fast.

An open letter was sent to HMRC by email and by post asking about the advisability of contracting with Skyscape Cloud Services Ltd.

An acknowledgement was received today by post promising a response within 15 working days.

And then the response was received, as shown below, dated today. Unprecedented.