Showing posts with label cyber security. Show all posts
Showing posts with label cyber security. Show all posts

Monday, 24 June 2013

Wake up, Spectator

As you will know thanks to Edward Snowden, the National Security Agency (NSA) in the US and the UK's GCHQ have been intercepting hundreds of millions of people's communications.

Mr Snowden's revelations have been published in the Guardian from 6 June 2013 onwards and here in the UK the public have been thoroughly patronised ever since by all other major media outlets.

Take the Spectator, for example. In their 15 June 2013 edition the leading article, 'Top Secrets', says:
This week’s exposé of the US National Security Agency has been heralded as the greatest intelligence leak since the Pentagon Papers. It is nothing of the sort. Far from revealing some institutional outrage, the whistleblower Edward Snowden merely appears to have found what any low-level intelligence source might find. Intelligence agencies try to find things out about certain people. Spies spy, and can be innovative in their techniques. Rapid technological advances mean that the amount of snooping is growing at a faster rate than laws and regulations have been able keep up. But where is the scandal?
The spying is being done for our own good, to protect us, by two benevolent states, the spies are dedicated public servants doing their patriotic duty, what else would we expect, we would have to be naïve and credulous and other-worldly to be surprised, everyone knew about it, ...

That's the line. Strange, in that case, that the Spectator have never mentioned it before.

The allegation is, according to the Spectator, that the NSA and GCHQ spy on each other's citizens, thereby getting round the fact that it's illegal for them to spy on their own citizens:
Even if true, this has not proven to be a matter of any great concern for the general public. Opinion polls on both sides of the Atlantic suggest that people are not particularly bothered. People appear to recognise that the security agencies must exercise unique powers to intercept and thwart people who wish to harm us.
Since when did the Spectator abdicate thought and resolve political issues by appealing to opinion polls?

There's a one-word answer to that – never. Which suggests that the article wasn't written spontaneously. The editor is following a script. And not very well, because the article goes on to say:
The same is not true for the taxman, who would quite like some of these powers for himself. The government’s ‘snooper’s charter’ is an attempt to give any government department, even town halls, various degrees of power to pry in the name of ‘national security’ ...
"The same is not true for the taxman"? Why not? Same logic – it's all for the public good, the state has a duty to collect the right amount of tax, nothing-to-hide-nothing-to-fear, what else would we expect, ... Now who's being naïve and credulous and other-worldly?

Given that the occasion for the Spectator's leading article is the publication of the NSA's and GCHQ's secrets, how could they expect to be taken seriously when they write:
Spies are quite good at keeping secrets; governments are not.
And then this:
... what might happen if information relating to people’s medical records were leaked to a government employer or a health insurance company?
"What might happen if information relating to people’s medical records were leaked"? What do they mean "if"? This is on the way to becoming government policy, as the Spectator should know.

Stephan Shakespeare, the founder of YouGov, the political polling organisation, has been asked to produce a National Data Strategy. The state should allow people's health and education data to be exploited, he says in the Shakespeare Review, and his recommendations have been welcomed by Francis Maude, Cabinet Office minister.

The Spectator should also know that Mr Maude's digital-by-default policy for public services depends on so-called "identity providers" getting us all on-line with a personal data store. And that his Electoral Registration and Administration Act provides for us all to maintain our entry on the electoral roll on-line – the electoral roll, that is, which will be used for the 2015 general election. And that his G-Cloud policy is the fastest way yet discovered for the government to lose control of our data.

It's about time the Spectator woke up to midata, the Department for Business Innovation and Skills initiative which is meant to use the same "identity providers" to get us to store our personal data on-line where GCHQ and the NSA can get at it for our own good:
My name is Stephen and I head up the work on consumer confidence and trust which is part of the midata voluntary programme ... A data-enabled online market place will create new services that will take your data and do some really interesting things with it ...

Hi I’m Dan, Director of the midata Innovation Lab, part of the midata voluntary programme ... By putting information back into the hands of consumers, and by encouraging business to release data, investing in products that consumers want and that use this information, we will help empower UK consumers in a really meaningful way ...

I’m Richard and I chair one of the expert working groups looking at what we need to do to ensure that consumers can be confident when they allow their data to be passed to and used by third parties who are developing new and innovative applications to aggregate and use existing data in a way that brings benefits to users of these new services ... A data rich economy will allow lots of innovative companies to create brand new services that will enable you to take your data and do some really interesting things with it, with the ultimate goal of making sure you can get the best deal across a range of services.
There are safeguards, the Spectator tell us:
In reality, MI5 and MI6 already have powers to intercept anything categorised as a ‘communication’. Permission is needed — but it is sought and granted. It is wrong for MI5 or the CIA to engage in a ruse to cut out the paperwork. But let us not pretend this makes either into a 21st-century Stasi.
Public confidence in those safeguards is not increased by Mr Maude's attitude to data-sharing between, say, GCHQ and HMRC:
I want to bust the myths around the complexities of data sharing ... we aim to find effective ways of using and sharing data for the good of everyone.
Who's in charge of the £650 million cybersecurity budget that presumably paid for GCHQ's communications interception systems? Francis Maude.

The Spectator quite properly holds out against the provisions of the Leveson report. Let's see a little of the same prudently sceptical spirit applied to this NSA and GCHQ business.

----------

Updated 27 December 2013:

Wake up, Spectator?

Fraser Nelson is the Editor of the Spectator.

And judging by an article of his in today's Telegraph six months after the post above was published he's woken up, please see The state should be exposing the cyber-snoops, not joining them.

Hallelujah.

Wake up, Spectator

As you will know thanks to Edward Snowden, the National Security Agency (NSA) in the US and the UK's GCHQ have been intercepting hundreds of millions of people's communications.

Mr Snowden's revelations have been published in the Guardian from 6 June 2013 onwards and here in the UK the public have been thoroughly patronised ever since by all other major media outlets.

Tuesday, 13 November 2012

Cybersecurity, and GDS's fantasy strategy

For some time now, the Government Digital Service (GDS) have made the meaning of their digital-by-default agenda clear – they want the UK to be like Estonia.

It is thanks to the fact that practically every service in Estonia is delivered over the web that, back in 2007, Russia was able to bring the country to its knees in a matter of days. If GDS succeed with their "modernisation" plans, there will be nothing to stop that happening here in the UK.

GDS are in awe of the financial success and popularity of Apple, Amazon, eBay/PayPal, Google and Facebook. With no experience of government behind them, the over-promoted software engineers at the head of GDS want to bring their heroes' tricks to the delivery of public services in the UK.

Sensible people will see Facebook et al as latter-day Pied Pipers of Hamelin – sensible people, including the tens of thousands of public servants who will be laid off and replaced by GDS's computers when government is, as they say, "transformed".

Many of these organisations are famous for avoiding tax on their UK profits and for using their near-monopolies to tyrannise their suppliers and to milk their customers. But GDS somehow maintain their naïve veneration and on 6 November 2012 they published their Government Digital Strategy.

This fantasy strategy is an elaboration of Martha Lane Fox's ideas, set out in her October 2010 letter to Francis Maude, Directgov 2010 and beyond: revolution not evolution. Ms Lane Fox is the Prime Minister's digital champion, she's a historian, and when she says "revolution" she means it.

Her revolutionary fervour is carried over into last week's GDS strategy, which Sir Bob Kerslake – head of the home civil service, permanent secretary at the Department for Communities and Local Government (DCLG) and previously the chief executive of first the London Borough of Hounslow and then Sheffield City Council – has greeted with a post on GDS's blog, Welcoming the Digital Strategy:
Our reform plan also made a clear commitment to improve the quality of the government’s digital services, and to do this by publishing a Government Digital Strategy setting out how we would support the transformation of digital services [how does publishing a wishlist improve the quality of public services?].

We fulfilled that commitment yesterday with the launch of the Government Digital Strategy, Digital Efficiency Report and Digital Landscape Report and I very much welcome their publication.
But why? Why does Sir Bob "welcome" this emmental cheese of a strategy? It's full of holes. Consider cybersecurity for example.

Iain Lobban, the Director of GCHQ, writing in the Foreword to 10 steps to cyber security says:
Every day, all around the world, thousands of IT systems are compromised. Some are attacked purely for the kudos of doing so, others for political motives, but most commonly they are attacked to steal money or commercial secrets. Are you confident that your cyber security governance regime minimises the risks of this happening to your business? My experience suggests that in practice, few companies have got this right.
Mr Lobban's advice on cybersecurity was pressed on FTSE 100 companies at a 5 September 2012 event organised by the Department for Business, Innovation and Skills (BIS), the Foreign Office, the Cabinet Office, the Home Office and senior figures from the intelligence agencies, please see Business leaders urged to step up response to cyber threats.

It's hardly news. The newspapers are full of cybersecurity stories and have been for years – there's an incomplete digest in With their head in the clouds:
...
29 March 2009: Spy chiefs fear Chinese cyber attack
8 March 2010: Cyberwar declared as China hunts for the West’s intelligence secrets
10 October 2010: Worm cripples Iran nuclear plant
13 October 2010: UK infrastructure faces cyber threat, says GCHQ chief
4 November 2010: Europe attacks itself in cyber-warfare test – As OECD admits major security fail
8 November 2010: Royal Navy website infiltrated by computer hacker
18 November 2010: China 'hijacks' 15 per cent of world's internet traffic
9 November 2010: US embassy cables: The background
9 December 2010: Hackers hit Mastercard and Visa over Wikileaks row
13 December 2010: Gawker falls victim to hackers
13 December 2010: WikiLeaks: government websites could be hacked in revenge attacks
20 December 2010: Hackers leak e-mail account details of government and defence staff
20 December 2010: English Defence League donor details 'stolen' after database hacked
29 December 2010: Gawker was hacked six months ago, say sources close to Gnosis
9 January 2011: Army adds cyberattack to arsenal
14 January 2011: Reducing Systemic Cybersecurity Risk
17 January 2011: Security & Resilience in Governmental Clouds
20 January 2011: Carbon trade cyber-theft hits €30m
21 January 2011: Lush hackers cash in on stolen cards
26 January 2011: Facebook's Mark Zuckerberg 'attacked by hackers'
31 January 2011: British and US stock exchanges fend off cyber raids
4 April 2011: Epsilon email hack: millions of customers' details stolen
26 April 2011: PlayStation Network hackers access data of 77 million users
3 May 2011: Sony says 25m more users hit in second cyber attack
26 May 2011: China admits training cyberwarfare elite unit
29 May 2011: Lockheed Martin computers under 'significant attack'
31 May 2011: Cyber weapons 'now integral part of Britain's armoury'
1 June 2011: Google phishing: Chinese Gmail attack raises cyberwar tensions
12 June 2011: IMF hit by cyber attack from unknown nation state
16 June 2011: LulzSec hackers claim breach of CIA website
12 July 2011: Hackers steal 90,000 email addresses in cyber attack on US military contractor Booz Allen Hamilton
15 July 2011: US forced to redesign secret weapon after cyber breach
15 July 2011: Pentagon reveals 24,000 files stolen in cyber-attack
25 July 2011: Anonymous hacks Italy's critical-national-IT protection
1 August 2011: LulzSec hacking: teenager ‘had cache of 750,000 passwords’
1 October 2011: Flaw in software puts online savers at risk
19 October 2011: Stuxnet-based cyber espionage virus targets European firms
27 October 2011: Chinese hackers suspected of interfering with US satellites
20 November 2011: Cyber-attack claims at US water facility
24 December 2011: Hidden Dragon: The Chinese cyber menace
25 December 2011: Hackers 'steal US data in Christmas-inspired assault'
8 January 2012: Hackers expose defence and intelligence officials in US and UK
16 January 2012: Israel hit by cyber-attacks on stock exchange, airline and banks
3 February 2012: Anonymous spies on FBI / UK Police hacking investigation conference call
7 March 2012: LulzSec leader Sabu was working for us, says FBI
11 March 2012: Chinese steal jet secrets from BAE
27 March 2012: NSA Chief: China Behind RSA Attacks
31 March 2012: Hackers steal details of millions of credit cards
23 April 2012: Iranian oil ministry hit by cyber-attack
3 May 2012: Attack takes Soca crime agency website down
3 May 2012: Hackers have breached top secret MoD systems, cyber-security chief admits
1 June 2012: US role in cyber attack on Iran nuclear plant revealed
7 June 2012: LinkedIn passwords leaked by hackers
5 August 2012: Iranian state goes offline to dodge cyber-attacks
21 September 2012: Chinese hacktivists launch cyber attack on Japan
...
You get the idea. The web is a dangerous place to do business. Dangerous for individuals, companies and governments.

But do GDS get the idea? Do they listen to GCHQ? Do they read the newspapers? Read the GDS blog, and you get the impression that digital-by-default is a warm, safe, cosy tea party. In reality, all the magnificent power and convenience of the web is at the disposal of criminals and spies and cyberterrorists to wreak havoc. It's a double-edged sword, the web.

You may notice that the only solution to the problem that Iran can come up with, after long and painful experience of cyber attack, is to secede from the worldwide web altogether and try to create an Iranwide web.

Meanwhile, with no such experience, GDS blithely recommend that all public services should be delivered over the web. They are luring the public into a war zone. Irresponsible? Malign? Or just gullible? But who is more gullible? GDS, or us proles?

What do GDS have to offer by way of defence? The Government Digital Strategy says:
Legality, security and resilience
Transactional services will be redesigned to:
• be robustly protective of the security of sensitive user information
• maintain the privacy and security of all personal information
• be resilient, to ensure continuity of service to users and departments
And that's it. No strategy. Just a wishlist. No defence.

Where there should be answers to these questions in the Government Digital Strategy there are just holes. Revolution is proposed with no justification. And yet Sir Bob, the head of the home civil service, welcomes this fantasy.

Cybersecurity, and GDS's fantasy strategy

For some time now, the Government Digital Service (GDS) have made the meaning of their digital-by-default agenda clear – they want the UK to be like Estonia.

It is thanks to the fact that practically every service in Estonia is delivered over the web that, back in 2007, Russia was able to bring the country to its knees in a matter of days. If GDS succeed with their "modernisation" plans, there will be nothing to stop that happening here in the UK.

GDS are in awe of the financial success and popularity of Apple, Amazon, eBay/PayPal, Google and Facebook. With no experience of government behind them, the over-promoted software engineers at the head of GDS want to bring their heroes' tricks to the delivery of public services in the UK.

Sensible people will see Facebook et al as latter-day Pied Pipers of Hamelin – sensible people, including the tens of thousands of public servants who will be laid off and replaced by GDS's computers when government is, as they say, "transformed".

Many of these organisations are famous for avoiding tax on their UK profits and for using their near-monopolies to tyrannise their suppliers and to milk their customers. But GDS somehow maintain their naïve veneration and on 6 November 2012 they published their Government Digital Strategy.

This fantasy strategy is an elaboration of Martha Lane Fox's ideas, set out in her October 2010 letter to Francis Maude, Directgov 2010 and beyond: revolution not evolution. Ms Lane Fox is the Prime Minister's digital champion, she's a historian, and when she says "revolution" she means it.

Her revolutionary fervour is carried over into last week's GDS strategy, which Sir Bob Kerslake – head of the home civil service, permanent secretary at the Department for Communities and Local Government (DCLG) and previously the chief executive of first the London Borough of Hounslow and then Sheffield City Council – has greeted with a post on GDS's blog, Welcoming the Digital Strategy:
Our reform plan also made a clear commitment to improve the quality of the government’s digital services, and to do this by publishing a Government Digital Strategy setting out how we would support the transformation of digital services [how does publishing a wishlist improve the quality of public services?].

We fulfilled that commitment yesterday with the launch of the Government Digital Strategy, Digital Efficiency Report and Digital Landscape Report and I very much welcome their publication.
But why? Why does Sir Bob "welcome" this emmental cheese of a strategy? It's full of holes. Consider cybersecurity for example.

Monday, 23 April 2012

Cloud computing – told you so

It's happened to Iran. Twice now. If Francis Maude and others have their way, it will happen to the UK.

The Guardian:-


Iranian oil ministry hit by cyber-attack



Iran's main oil export terminal is cut off from internet after apparent attack on website and communications systems


Saeed Kamali Dehghan
guardian.co.uk, Monday 23 April 2012 17.10 BST


Iran's oil ministry has called a crisis meeting after its main website and internal communications system were hit by an apparent cyber-attack that forced authorities to cut off the country's oil export terminal from the internet.

Local news agencies reported on Monday that a virus had struck the computer and communication systems of Iran's main oil export facilities on Kharg Island as well as the internal network and the websites of its oil ministry and subsidiary organisations.

The semi-official Mehr news agency quoted ministry officials as saying an investigation was under way. "We are making plans to neutralise this cyber-attack," said the deputy oil minister in charge of civil defence, Hamdollah Mohammadnejad ...


• Reuters: Suspected cyber attack hits Iran oil industry
• Wall Street Journal: Cyber-Attack Targets Iran Oil, But Exports Normal
• DMossEsq: Cloud computing is bonkers or, as HMG put it, a "no-brainer"


Iran can't protect its main oil refinery from cyber attack. Even Iran. Even its main oil refinery. Dependence on the web seems ill-advised.

Meanwhile HM Government is planning to move all its data into the "cloud", G-Cloud, the government cloud, i.e. the web. That seems equally ill-advised.

Shall we ask HMG please to explain themselves? Can they tell us what Francis Maude, Ian Watmore, Andy Nelson, Chris Chant and Denise McDonagh know that  Iran's top scientists operating on a permanent war footing don't know?

Maybe there's a good answer.

If not, would they please stop this imprudent waste of public money, cancel G-Cloud, cancel IdA, stop playing with techie toys and get on with the job they're paid to do, viz. competent public administration?

Cloud computing – told you so

It's happened to Iran. Twice now. If Francis Maude and others have their way, it will happen to the UK.

The Guardian:-


Iranian oil ministry hit by cyber-attack



Iran's main oil export terminal is cut off from internet after apparent attack on website and communications systems


Saeed Kamali Dehghan
guardian.co.uk, Monday 23 April 2012 17.10 BST


Iran's oil ministry has called a crisis meeting after its main website and internal communications system were hit by an apparent cyber-attack that forced authorities to cut off the country's oil export terminal from the internet.

Local news agencies reported on Monday that a virus had struck the computer and communication systems of Iran's main oil export facilities on Kharg Island as well as the internal network and the websites of its oil ministry and subsidiary organisations.

The semi-official Mehr news agency quoted ministry officials as saying an investigation was under way. "We are making plans to neutralise this cyber-attack," said the deputy oil minister in charge of civil defence, Hamdollah Mohammadnejad ...


• Reuters: Suspected cyber attack hits Iran oil industry
• Wall Street Journal: Cyber-Attack Targets Iran Oil, But Exports Normal
• DMossEsq: Cloud computing is bonkers or, as HMG put it, a "no-brainer"


Iran can't protect its main oil refinery from cyber attack. Even Iran. Even its main oil refinery. Dependence on the web seems ill-advised.

Meanwhile HM Government is planning to move all its data into the "cloud", G-Cloud, the government cloud, i.e. the web. That seems equally ill-advised.

Shall we ask HMG please to explain themselves? Can they tell us what Francis Maude, Ian Watmore, Andy Nelson, Chris Chant and Denise McDonagh know that  Iran's top scientists operating on a permanent war footing don't know?

Maybe there's a good answer.

If not, would they please stop this imprudent waste of public money, cancel G-Cloud, cancel IdA, stop playing with techie toys and get on with the job they're paid to do, viz. competent public administration?

Wednesday, 11 April 2012

The government's plans for cloud computing – hot air?

HMG have come up with another one of their questionable posts about cloud computing. And once again, the questions have been duly submitted as a comment on the HMG blog. Will they publish the comment this time? They didn't last time. And will they answer the questions?

It's all getting very butch. Under the picture of a leopard with its impressive mouth open Chris Chant, the Programme Director for G-Cloud, says:
There is still plenty more to do and, if I look back on the last dozen years and honestly reflect on those I’ve worked with and interacted with, this is still a pretty difficult list of stuff to do and some of those people just don’t have the capability to do it.  They will have to look hard at themselves and decide how they are going to resolve that because it will turn out to be the toughest thing that they have done in their career so far.
The leopard's got plenty but does the G-Cloud Programme have any teeth?

Dear Mr Chant

Few would disagree with your analysis of the current problems with a lot of UK government IT. The search is on for a better way. The question is, have you found a better way?

The better way you propose is digital by default and customer-centric. But the two don't mix. 10 million of your customers have never used the web. To concentrate on digital by default is to ignore 10 million of your customers and – I say this more hesitantly than it sounds – you are fooling yourself if you think otherwise. Is digital by default, for 10 million people, the very opposite of customer-centric? Your answer to that? So far, a phrase – "assisted digital". An empty phrase.

The media is knee-deep in cyber (in)security stories. Every time you re-announce your plans there's always just been another one of these stories. Apart from Anonymous taking down the Home Office website for Easter, the latest serious insecurity story is the update on RSA themselves being hacked by the Chinese. If RSA can't operate securely, how can Whitehall? They can't. Is G-Cloud a strategic mistake, securitywise? Your answer to that? So far, silence.

Judging by Mr Scaife's "no-brainer" post, the Cloud means no capital expenditure. Which means Whitehall would be using Amazon's servers. Or Google's or whoever's. And where will these servers be? Wherever Amazon or Google or Microsoft or whoever put them. Which could be anywhere. Which could be beyond British jurisdiction. And access could anyway be subject to Anonymous's permission. Will Whitehall literally lose control of its applications and its data? Our data, rather. Your answer to that? So far, silence.

Last time the world used timesharing – the 1970s – costs went through the roof. Why wouldn't the same happen this time? Your answer to that? So far, silence.

What we do get from you is assertions about the agility and affordability of cloud computing. But no examples. How about taking a big government contract, an existing one, as a worked example, and telling us in detail how we can avoid the saga-length contracts and the King Midas costs while at the same time delivering customised services instantly? ("Instantly" is probably going a bit far but a lot of your sales talk sounds as though that's what you're offering.) Without a worked example, it's all just talk.

At least that's the danger. It was great the first time. 20 October 2011. And it's great listening to you every few weeks telling the dinosaurs to show themselves out of Whitehall. But meantime the dinosaurs are still in situ, still signing contracts, sagas just like the old contracts, they're still denominated in years and in billions of pounds and the counterparties are still the same old suppliers. Where's the agility? Where's the affordability? Your answer to that? So far, silence.

I shan't ask you to defend your claim that Whitehall is now "open". There's quite enough else there for you to get your leopard's teeth into.

Yours sincerely
David Moss

The government's plans for cloud computing – hot air?

HMG have come up with another one of their questionable posts about cloud computing. And once again, the questions have been duly submitted as a comment on the HMG blog. Will they publish the comment this time? They didn't last time. And will they answer the questions?

It's all getting very butch. Under the picture of a leopard with its impressive mouth open Chris Chant, the Programme Director for G-Cloud, says:
There is still plenty more to do and, if I look back on the last dozen years and honestly reflect on those I’ve worked with and interacted with, this is still a pretty difficult list of stuff to do and some of those people just don’t have the capability to do it.  They will have to look hard at themselves and decide how they are going to resolve that because it will turn out to be the toughest thing that they have done in their career so far.
The leopard's got plenty but does the G-Cloud Programme have any teeth?

Sunday, 11 March 2012

Cabinet Office using cyber security budget to increase risks to the public

Can someone advise, please, is there a polite way of asking can any British government tell its arse from its elbow?

The Cabinet Office want to deliver all public services over the web. Public services should be "digital by default", as they say.

The web is a dangerous place to be if you want to maintain secrecy/privacy and if there's any money around. The web is perfectly adapted to breach confidences and to steal money. Let today's Sunday Times make the point. In Chinese steal jet secrets from BAE they tell us that:
CHINESE spies hacked into computers belonging to BAE Systems, Britain’s biggest defence company, to steal details about the design, performance and electronic systems of the West’s latest fighter jet, senior security figures have disclosed.

The Chinese have exploited vulnerabilities in BAE’s computer defences to steal vast amounts of data on the £200 billion F-35 Joint Strike Fighter (JSF), a multinational project to create a plane that will give the West air supremacy for years to come ...

Professor Anthony Glees, director of the Centre for Security and Intelligence Studies ... said: “It seems the Chinese were getting plans which allow them to undermine the defence capacity of the country. It’s deeply unsettling that GCHQ [the government eavesdropping centre in Cheltenham] didn’t spot this for so long because they are the people who are meant to be leading the fight against cyber crime.”
There's a wide selection of cock-ups to choose from here:
  • With £200 billion at stake, the Sunday Times reported on 12 January 2012 that Royal Navy’s new jet cannot land on aircraft carriers. Never mind, you may say, it's only £200 billion and we haven't got an aircraft carrier anyway.
  • And three years ago, the Sunday Times reported that BT had bought equipment from China's Huawei telecommunications equipment company despite warnings that it could be used to "shut down Britain by crippling its telecoms and utilities" and that "government departments, the intelligence services and the military will all use the new BT network". Patricia Hewitt, trade and industry secretary at the time the contract was being negotiated, declined to intervene because it was "a competitive tender between two commercial companies". How very upright of Ms Hewitt not to let security interfere with competition.
But put those cock-ups aside. For current purposes, consider instead the following.

Rt Hon Francis Maude MP is the Cabinet Office Minister and according to his entry on the Cabinet Office website:
He leads on:

• Public Sector Efficiency and Reform
• UK Statistics
• Civil Service issues
• Government transparency
• Civil Contingencies
• Cyber security
• Overall responsibility for Cabinet Office policy and the Department
With his cyber security hat on, Mr Maude disposes of a budget of £650 million. Much-needed, judging by the success of GCHQ and BAE's attempts to fend off the Chinese.

With his public sector efficiency and reform hat on, Mr Maude wants to put Whitehall on the web. That's what "digital by default " means and that requires him to ignore his cyber security hat.

But it's worse than that. Digital by default requires something called identity assurance, a service which doesn't exist yet but is supposed one day to allow us all to prove who we are, over the web, while we're busy communicating with the government. The development of this service was unfunded until 31 October 2011 when Mr Maude announced that he'd found £10 million of public money to give it.

And where did he get this cyber security-busting £10 million from?

You can have 650 million guesses.

----------

Updated 23.6.14

Whitehall considers security shake-up

The government is understood to be carrying out a review of Whitehall organisations with a remit for electronic and computer security to determine any possibility of consolidation.

Informed sources say that one of the suggestions being considered is that CESG, the government's National Technical Authority for information assurance, should be separated from GCHQ, the signals intelligence agency.

That could mean the Cabinet Office taking over responsibility for CESG, with whom it has an ongoing relationship.
 "That could mean the Cabinet Office taking over responsibility for CESG". Oh God.

    Cabinet Office using cyber security budget to increase risks to the public

    Can someone advise, please, is there a polite way of asking can any British government tell its arse from its elbow?