Sunday, 16 June 2013

Is data-sharing between consenting adults now legal?

Pat Russell is the Deputy Director of the Social Justice Division at the Department for Work and Pensions.

"Improved information sharing of personal and anonymised data between central government and local agencies – and between agencies on the ground", she says on the Institute for Government blog, "has been recognised as being vital to delivering better outcomes at lower cost".

Oh dear.

The Guardian newspaper said on 24 April 2012 that the government planned to increase the level of data-sharing and next day they were reprimanded by Francis Maude, Cabinet Office minister, for misrepresenting him.

"This is not a question of increasing the volume of data-sharing that takes place across government", he said, "but ensuring an appropriate framework is in place so that government can deliver more effective, joined-up and personalised public services, through effective data-linking".

Has Miss Russell fallen into the same trap of confusing data-sharing with the completely different business of data-linking? Will she, too, be reprimanded?

Maybe not.

She says: "One of the key learning points from the project [an example of effective data-sharing] was that there is a lot of mythology around and that many of the information sharing issues are cultural rather than technical or legal".

It's not clear whether Mr Maude disapproves of culture as much as Ms Russell but, like her, he certainly doesn't like myths: "I want to bust the myths around the complexities of data sharing ... we aim to find effective ways of using and sharing data for the good of everyone".

Ms Russell acknowledges that "of course, we all recognise that there have to be safeguards in place". But when is a safeguard a myth? She doesn't tell us. Neither does Mr Maude.

Mr Hague [that's William Hague, UK Foreign Secretary] was busy telling us last week that there are safeguards limiting the uses to which GCHQ put intelligence data. One assumes that they don't share it with HMRC, for example. Or with DWP or the Department of Health or the Department for Education. Or do they? Is that a myth?

----------

Updated 9.3.16

For all his protestations to the contrary, Mr-now-Lord Maude was clearly in favour of massive data-sharing between government departments.

His successor as Cabinet Office Minister, Matt Hancock, is no different. "Data is the fuel for the digital revolution", he is quoted as saying, as though it means something.

"The very best policies and services", he adds, without giving any examples, "are developed around information that’s current, relevant and makes sure you can access government services just as easily as iTunes".

iTunes?

These quotations are culled from a 29 February 2016 Cabinet Office press release, Launch of new data sharing consultation. Apparently "data sharing in the UK [will] bolster security whilst making people's lives better". Unless it undermines security, of course, and wrecks people's lives.

If you can countenance the notion that the Cabinet Office knows how to improve your life and if you are happy to sweep away the "myths" – or "laws" as we used to call them – which prohibit data-sharing, then you may be impressed by the benefits suggested.

What benefits?

Among others, "government can share data to ... support the administering of fuel poverty payments ... [and prevent] authorities sending letters to people who are deceased". Is data-sharing the only solution to these problems? How about a rational energy policy, for example? Lower fuel bills would reduce the number of people who freeze to death and so reduce the number of deceased people the authorities have to write to.

You thought the Cabinet Office was going to promise that data-sharing would eradicate terrorists, paedophiles and tax-dodgers, didn't you. No. Perhaps they've noticed that these problems persist despite the enormous amount of data already at the disposal of the authorities.

The Cabinet Office claim that the Troubled Families programme needs more data-sharing and then undermine their case hopelessly by linking to a document that claims the programme is already succeeding brilliantly with the current data-sharing arrangements.

Normally the government asserts that the incidence of "fraud against the public sector" is microscopic but for the purposes of this press release it has ballooned and apparently the crisis can only be solved by ... more data-sharing, which will also reduce the £24.1 billion of debt the government has incompetently failed to collect.

It's not just the government. More data-sharing will help "citizens manage their debt more effectively", the Cabinet Office say. How? No idea. What about the government debt of £1½ trillion? No idea.

More data-sharing would "support accredited researchers to access and link data to carry out research for public benefit", but again there is no room for any examples. And no mention of the fact that we already have procedures for carefully controlled research (para.1.16) ...

... which just leaves us with our old favourite (and an old favourite of the Russian Tsars') – more data-sharing would allow us to carry out the national census more efficiently ... sorry ... more like iTunes.

It's not just the Cabinet Office. Shakespeare's at it, too. And the NHS. Even Her Majesty's Treasury.

Professor Sir Nigel Shadbolt, chairman and co-founder of the Open Data Institute, published The spy in the coffee machine – the end of privacy as we know it in 2008:
... sharing information across government databases will dramatically increase governmental powers – otherwise the UK government wouldn't have proposed it. (p.95)

... we should never forget that bureaucracies are information-thirsty, and will never stop consuming. Indeed, they will never even cut down. They will break or bend their own rules, and any prior specification of how information use will be limited, or data not shared, is not worth the paper it is printed on. (p.212)
No mention of improving people's lives there. Eight years later, you might like to bring that up in your response to the consultation. That, and Government as a Platform.


Is data-sharing between consenting adults now legal?

Pat Russell is the Deputy Director of the Social Justice Division at the Department for Work and Pensions.

"Improved information sharing of personal and anonymised data between central government and local agencies – and between agencies on the ground", she says on the Institute for Government blog, "has been recognised as being vital to delivering better outcomes at lower cost".

Oh dear.

The Guardian newspaper said on 24 April 2012 that the government planned to increase the level of data-sharing and next day they were reprimanded by Francis Maude, Cabinet Office minister, for misrepresenting him.

"This is not a question of increasing the volume of data-sharing that takes place across government", he said, "but ensuring an appropriate framework is in place so that government can deliver more effective, joined-up and personalised public services, through effective data-linking".

Has Miss Russell fallen into the same trap of confusing data-sharing with the completely different business of data-linking? Will she, too, be reprimanded?

Sunday seems like a good day to ask "what is work?"

Towards the end of Jon Manel's report on the Government Digital Service which occupied five minutes of BBC Radio 4's World At One on 10 June 2013 he interviews an "evangelical preacher" called Stephen Kelly who is also the government's chief operating officer.

Mr Kelly says (30'58"-31'59") that it takes his computer seven minutes each day to boot up and that that's like three days a year wasted.

By a curious journalistic operation, Sue Cameron had pre-figured this comment of Mr Kelly's in her 5 June 2013 Telegraph article, Wash the dirty Whitehall linen in private, minister. "You have to ask if someone, somewhere is being economical with the truth", she says. "One insider tells me that, thanks to Mr Maude’s openness agenda, information about Whitehall PCs is easily available. He says the figures indicate that ... the average boot time is two minutes, not seven".

Mr Kelly is wrong about the "average boot time".

And that's not all he's wrong about.

The three days a year he refers to would, indeed, be wasted if he sits gaping at his screen, waiting for the machine to boot up, doing nothing else all the while, his mind empty. But surely there is work the chief operating officer could be getting on with while his machine is springing into action at the speed of light?

And, once his machine has booted up, does he imagine that he is then ipso facto working and doing something useful?




Sunday seems like a good day to ask "what is work?"

Towards the end of Jon Manel's report on the Government Digital Service which occupied five minutes of BBC Radio 4's World At One on 10 June 2013 he interviews an "evangelical preacher" called Stephen Kelly who is also the government's chief operating officer.

Mr Kelly says (30'58"-31'59") that it takes his computer seven minutes each day to boot up and that that's like three days a year wasted.

By a curious journalistic operation, Sue Cameron had pre-figured this comment of Mr Kelly's in her 5 June 2013 Telegraph article, Wash the dirty Whitehall linen in private, minister. "You have to ask if someone, somewhere is being economical with the truth", she says. "One insider tells me that, thanks to Mr Maude’s openness agenda, information about Whitehall PCs is easily available. He says the figures indicate that ... the average boot time is two minutes, not seven".

Mr Kelly is wrong about the "average boot time".

And that's not all he's wrong about.

Friday, 14 June 2013

GDS PR blitz

10 June 2013, the BBC Radio 4 world news programme World At One (WATO) carries a 5-minute report (27'32"-32'55") by Jon Manel on GDS, the Government Digital Service.

11 June 2013, WATO carries another 8 minutes (24'58"-32'55") of Mr Manel's report on GDS.

12 June 2013, Mr Manel publishes Inside the UK Government Digital Service on the BBC website.

13 June 2013, the Guardian publish a 6'50" video by Jemima KissGov.uk: how geeks opened up government featuring ex-Guardian man Mike Bracken (executive director, GDS), ex-BBC man Tom Loosemore (deputy director, GDS) and ex-Morgan Stanley man Francis Maude, their political boss (Cabinet Office minister).

What are GDS trying to tell us?

Listen, read, watch and what you learn is that GDS's staff are young, everyone dresses informally and each team has a fluffy mascot:
There is an inflatable guitar - a red one. You cannot fail to miss [notice?] the bunting. And then there are the mascots.

"For us, the Platform Team, it's an otter. His name is Jerry," one woman explains pointing to a brown and white soft toy with a rather sad expression on its face ...

As for the young civil servants in the GDS headquarters, some of them seem to have an almost evangelical spirit about them.
Some people will find the evangelical spirit which moves GDS charming. Others won't.

The idea is to model public administration on successful web companies, as ex-Guardian man Mike Bracken tells us in the Guardian video. But do Google and Facebook, for example, provide the right model?

The idea is to promote openness in government. GDS's single government domain project, GOV.UK, and their Identity Assurance Programme (IDAP) are major projects. But the Major Projects Authority verdicts on GOV.UK and IDAP have not been published.

An elite team of digital experts has sparked a radical shake-up in the way the government does its business. Some of the UK's best designers and developers are working on building a new single website for all government departments – gov.uk – but their influence has gone much further.
That's the rubric under the 13 June video on the Guardian website.

Pace Jemima Kiss, at least four professors are unconvinced that the team – or at least the Government Digital Strategy – is elite. And Dr Martyn Thomas, visiting professor at the universities of Oxford and Bristol, makes a fifth unconvinced professor – he told the House of Commons Science and Technology Committee that it's impossible to measure the quality of software systems developed with GDS's so-called "agile" methods.

The idea is to avoid the spectacularly poor value for money of some government IT contracts. An unimpeachable objective.

But how will GDS achieve it?

To be told, as we are in the Guardian video, that GDS are trying to improve the search algorithm on GOV.UK is no answer.

So-called "open systems" aren't the answer either, according to the four professors.

Will the "oligopoly" – as Jon Manel calls them – of government contractors fall in with GDS's plans for shorter contracts? Why should they? There's no need to while the big departments of state continue, as they do, to sign long contracts.

Is it the case that GDS's "influence has gone much further", as the Guardian claim? Francis Maude ends the Guardian video saying that there is enormous demand in Whitehall for GDS's services. Is there?

The Department for Work and Pensions (DWP) spend about £200 billion a year. When Jon Manel asks about DWP's Universal Credit (UC) initiative in the 11 June WATO report, the otherwise jocular ex-Guardian man Mike Bracken becomes guarded, "not that close to it", he says (31'29"), a response which Mr Manel glosses as "not our fault, guv".

GDS hijacked IDAP from DWP and then promised to have it "fully operational" for UC by March 2013. It wasn't and it still isn't. Leaving UC high and dry.

"Not that close to it"? Ex-Guardian man Mike Bracken is the senior responsible officer owner for government-wide identity assurance and there's no getting away from it.

The Department of Health spend about £120 billion a year. What are GDS doing about their computer systems? Or the systems at the Department for Education? And what are we to make of BBC money man Paul Lewis's warning on Twitter yesterday:



Apart from GDS, the only government body we hear from in this PR campaign is HMRC, in the 11 June WATO report. The clamorous demand is muted – Lin Homer, chief executive, describes GDS as "bumptious" but adds that there's nothing wrong with that.

She can afford to be kind. GDS haven't laid a glove on her £8 billion ASPIRE contract. Or on her website, www.hmrc.gov.uk, which GDS falsely claim to have incorporated into GOV.UK.

Meanwhile, GDS have some involvement with the plan to make us all enrol on-line on the new electoral register to be used for the 2015 general election. Why don't the BBC and the Guardian tell us anything about that major project?

What about GDS's involvement with the Department for Business Innovation and Skills midata project? And the related Shakespeare Review? What about their new-found responsibility for G-Cloud? What are GDS's plans for the Government Gateway? And what do GDS have to say about cybersecurity?

MPs are worried about digital-by-default – something else the BBC and the Guardian don't mention. Something like 16 million people in the UK will not be able to use the proposed web-based, digital-by-default public services which GDS are meant to deliver. They launched the assisted digital project on 28 July 2011 to try to solve the problem. And in today's weekly GDS diary, 14 June 2013, what does ex-Guardian man Mike Bracken tell us?
Also this week  GOV.UK won two D&AD awards for our content design and the Assisted Digital team had their first market engagement event with suppliers.
Nearly two years after the starting pistol was fired, they had their first meeting with suppliers?

It's early days, you may say, GDS can't be expected to have achieved much yet. Maybe. But in that case the PR is premature. Francis Maude is up in front of the House of Commons Science and Technology Committee on Monday to give evidence on digital-by-default. Let's see what that adds to the campaign.




----------

Update 17.11.13:

15 November 2013: Government Digital Service: the best startup in Europe we can't invest in
So what is it that GDS knows that every chairman and chief executive of a FTSE100 should know?
And what is it that every chairman and chief executive of a FTSE100 knows that GDS should know?

GDS PR blitz

10 June 2013, the BBC Radio 4 world news programme World At One (WATO) carries a 5-minute report (27'32"-32'55") by Jon Manel on GDS, the Government Digital Service.

11 June 2013, WATO carries another 8 minutes (24'58"-32'55") of Mr Manel's report on GDS.

12 June 2013, Mr Manel publishes Inside the UK Government Digital Service on the BBC website.

13 June 2013, the Guardian publish a 6'50" video by Jemima KissGov.uk: how geeks opened up government featuring ex-Guardian man Mike Bracken (executive director, GDS), ex-BBC man Tom Loosemore (deputy director, GDS) and ex-Morgan Stanley man Francis Maude, their political boss (Cabinet Office minister).

What are GDS trying to tell us?

Thursday, 13 June 2013

Nothing better to do on Monday?

Highly recommended:
SCIENCE AND TECHNOLOGY COMMITTEE
Select Committee Announcement

No. 10 (13-14): 13 June 2013

ORAL EVIDENCE SESSION ANNOUNCED
Digital by Default

The Science and Technology Committee will hold the following oral evidence session into ‘Digital by Default’:

Monday 17 June 2013
Thatcher Room, Portcullis House
At 4.15 pm

· Rt Hon Francis Maude MP, Minister for the Cabinet Office and Paymaster General

Follow the Committee's business on Twitter @CommonsSTC

FURTHER INFORMATION

Committee Membership:
Andrew Miller (Labour, Ellesmere Port and Neston) (Chair)
Jim Dowd (Labour, Lewisham West and Penge)
Stephen Metcalfe (Conservative, South Basildon and East Thurrock)
David Morris (Conservative, Morecambe and Lunesdale)
Stephen Mosley (Conservative, City of Chester)
Pamela Nash (Labour, Airdrie and Shotts)
Sarah Newton (Conservative, Truro and Falmouth)
Graham Stringer (Labour, Blackley and Broughton)
David Tredinnick (Conservative, Bosworth)
Hywel Williams (Plaid Cymru, Arfon)
Roger Williams (Liberal Democrat, Brecon and Radnorshire)

The session is open to the public on a first come, first served basis. Portcullis House is the building directly above Westminster Station, entrance to which is via Victoria Embankment. There is no system for the prior reservation of seats in Committee Rooms. It is advisable to allow about 30 minutes to pass through security checks. Committee rooms and the timing of meetings are subject to change.

Specific Committee information: scitechcom@parliament.uk / 020 7219 2793
Media information: Nick Davies daviesnick@parliament.uk / 020 7219 3297
Committee website: www.parliament.uk/science
Watch committees and parliamentary debates online: www.parliamentlive.tv
Publications / Reports / Reference Material: Copies of all select committee reports are available from the Parliamentary Bookshop (12 Bridge St, Westminster, 020 7219 3890) or the Stationery Office (0845 7023474). Committee reports, press releases, evidence transcripts, Bills; research papers, a directory of MPs, plus Hansard (from 8am daily) and much more, can be found on www.parliament.uk.

Nothing better to do on Monday?

Highly recommended:
SCIENCE AND TECHNOLOGY COMMITTEE
Select Committee Announcement

No. 10 (13-14): 13 June 2013

ORAL EVIDENCE SESSION ANNOUNCED
Digital by Default

The Science and Technology Committee will hold the following oral evidence session into ‘Digital by Default’:

Monday 17 June 2013
Thatcher Room, Portcullis House
At 4.15 pm

· Rt Hon Francis Maude MP, Minister for the Cabinet Office and Paymaster General

Follow the Committee's business on Twitter @CommonsSTC

FURTHER INFORMATION

Committee Membership:
Andrew Miller (Labour, Ellesmere Port and Neston) (Chair)
Jim Dowd (Labour, Lewisham West and Penge)
Stephen Metcalfe (Conservative, South Basildon and East Thurrock)
David Morris (Conservative, Morecambe and Lunesdale)
Stephen Mosley (Conservative, City of Chester)
Pamela Nash (Labour, Airdrie and Shotts)
Sarah Newton (Conservative, Truro and Falmouth)
Graham Stringer (Labour, Blackley and Broughton)
David Tredinnick (Conservative, Bosworth)
Hywel Williams (Plaid Cymru, Arfon)
Roger Williams (Liberal Democrat, Brecon and Radnorshire)

The session is open to the public on a first come, first served basis. Portcullis House is the building directly above Westminster Station, entrance to which is via Victoria Embankment. There is no system for the prior reservation of seats in Committee Rooms. It is advisable to allow about 30 minutes to pass through security checks. Committee rooms and the timing of meetings are subject to change.

Specific Committee information: scitechcom@parliament.uk / 020 7219 2793
Media information: Nick Davies daviesnick@parliament.uk / 020 7219 3297
Committee website: www.parliament.uk/science
Watch committees and parliamentary debates online: www.parliamentlive.tv
Publications / Reports / Reference Material: Copies of all select committee reports are available from the Parliamentary Bookshop (12 Bridge St, Westminster, 020 7219 3890) or the Stationery Office (0845 7023474). Committee reports, press releases, evidence transcripts, Bills; research papers, a directory of MPs, plus Hansard (from 8am daily) and much more, can be found on www.parliament.uk.

Monday, 10 June 2013

Digital-by-default, an open letter to the House of Commons Science and Technology Committee (updated)

Open letter

By email

10 June 2013

Dr Stephen McGinness
Committee Clerk
Science and Technology Committee
6th Floor
14 Tothill Street
House of Commons
London SW1H 9NB


Dear Dr McGinness
Digital by default
I refer to the Committee’s oral evidence session held on 5 June 2013.

1.    May I bring to the Committee’s attention in case they haven’t seen it the draft report written by Professors Brown, McDermid, Sommerville and Witty. In A Perspective on the Government Digital Strategy (GDS): Balancing agility and efficiency inUK Government IT delivery the four professors cast serious doubt on the prospects for digital-by-default being delivered. The Major Projects Authority (MPA) use a red-amber-green traffic light scoring method to represent their verdicts on major projects. The Committee will note that the professors’ verdict on digital-by-default looks like an amber/red or possibly a simple red. Selected quotations from the report are included at the end of this letter.

2.    Digital-by-default is a major project. The MPA haven’t published their verdict on it. May I suggest that if they haven’t done so already the Committee seek out the MPA’s verdict in addition to that of the four professors.

3.    By 18 April 2013 56 MPs had signed an early day motion to debate the fate, under digital-by-default, of people who can’t use the web. Testimony was given at the evidence session suggesting that there are about 16 million such people who risk being excluded by default. Digital-by-default is the responsibility of the Government Digital Service (GDS). On 28 July 2011 GDS launched their assisted digital project to try to resolve this problem: “It is about taking a more proactive approach to getting people online and thereby sharing the benefits available from being online”. 665 days later on 23 May 2013 GDS published Starting the conversation about providing assisted digital support. The Committee may be expected by at least 56 MPs to investigate just how long this proactive conversation is likely to take and what happens to 16 million excluded people in the meantime.

4.    Dr Martyn Thomas gave it as his opinion that the phrase “anonymised research data” is an oxymoron: if data about a person is released and there is enough of that data to be useful, then the person can be identified; if the person can’t be identified, then the data won’t be any use. Mr William Heath gave it as his opinion that users of Mydex could release their data in such a way as to prove some entitlement of theirs without giving away their identity. They can’t both be right. Which of them, if either, is right? May I draw this question to the Committee’s attention.

5.    Dr Thomas gave it as his opinion that the danger of using so-called “identity providers” is that users lose control of their data. Mr Heath gave it as his opinion that the purpose of Mydex (one of the UK’s appointed “identity providers”) is precisely to allow users to keep control of their data. Again, they can’t both be right. May I draw the Committee’s attention to the question which of them is right, if either.

6.    Dr Thomas gave it as his opinion that the way to maintain standards in digital-by-default is to make the “identity providers” and others pay compensation when the system fails. Mr Heath gave it as his opinion that Mydex’s liability is mitigated as the users hold the keys to their Mydex personal data stores themselves. That argument is specious. Lockheed Martin and QinetiQ hold the keys to their data stores but that hasn’t stopped allegedly Chinese hackers from stealing their intellectual property including the designs for fighter jets and remote-controlled bomb disposal robots. Google, Facebook and Yahoo! accountholders hold their own keys but that hasn’t stopped the US National Security Agency (NSA) from obtaining their personal details, allegedly, if the Guardianare to be believed. The Committee took the point that liability causes the retail banks to maintain standards. May I draw the Committee’s attention to the question whether Dr Thomas or Mr Heath is right about the connection between compensation and standards, or neither of them.

7.    When the Committee asked the witnesses why eight “identity providers” are being proposed for the UK instead of the government doing their job Mr Heath gave an answer referring to the rich panoply of data which people use to run their personal lives. The remit of digital-by-default is set out in Martha Lane Fox’s 14 October 2010 letter to Francis Maude, Cabinet Office Minister. Directgov 2010 and beyond: revolution not evolution concerns improvements to the way that public services are delivered. May I draw the Committee’s attention to the question whether advising people how they should run their lives is beyond the scope of digital-by-default. If it isn’t beyond the scope of digital-by-default then the Committee’s enquiry may have to include Dr Stephan Shakespeare’s national data strategyas well, including the work of Professor Nigel Shadbolt at the Open Data Institute (ODI). Professor Shadbolt is not only the chairman of the ODI but also the chairman of the midata programme (para.21) – the distinction between open public sector data (“big data”) and personal information is in danger of being of being lost.

8.    Dr Thomas gave it as his opinion that the Committee could not be told in open session how effective the UK’s cybersecurity measures are. May I draw the Committee’s attention to the question how responsible it is in that case for the administration to lure people into recording every detail about their lives in personal data stores held on the web, in the cloud. That is the idea behind Mydex, and behind the Department for Business Innovation and Skills (BIS) initiative, midata.

9.    Mydex and the Post Office are two of the UK’s eight appointed “identity providers” and were both represented at the evidence session. The other six include Verizon, which allegedly makes the “metadata” of millions of its customers’ mobile phone calls available to the NSA. The Committee may consider it important to take evidence from Verizon at a subsequent session.

10.           Deploying digital-by-default, as noted, is the job of GDS. They intend to use the single government domain, GOV.UK, to register everyone who uses public services and to manage their cases. GOV.UK is to be hosted in the cloud by a £1,000 company, Skyscape Cloud Services Ltd, under the control of one man, Mr Jeremy Robin Sanders, via another company, Virtual Infrastructure Group Ltd. Skyscape is accredited by the government cloud programme (G-Cloud) to sell its products to central and local government through its on-line shop, CloudStore. Skyscape barely existed a year ago. It now has contracts with GDS, HMRC, the MODand the Home Office. Which means that long-established SMEs with a measurable track record don’t have those contracts. May I draw the Committee’s attention to the question how scientific it is for digital-by-default to be entrusted to an organisation with no track record.

11.           The OECDhave warned against cloud computing: “cloud computing creates security problems in the form of loss of confidentiality if authentication is not robust and loss of service if internet connectivity is unavailable or the supplier is in financial difficulties ...”. So have ENISA, the EU’s Network and Information Security Agency: “[re cloud computing] its adoption should be limited to non-sensitive or non-critical applications and in the context of a defined strategy for cloud adoption which should include a clear exit strategy ...”. Cloud computing is a special case of outsourcing. Any organisation risks losing control of its business when it is outsourced. Are the staff of the contractor and its sub-contractors properly vetted before recruitment? Are proper procedures in place and are they enforced? With cloud computing, the dangers of loss of control are magnified. Data can quickly move to any country in the world, beyond the jurisdiction of English law. May I draw the Committee’s attention to the question how responsible it is of the administration to entrust digital-by-default or any other important national asset to the cloud, where it will be out of control by the authorities and liable to cyberattack and/or to unwarranted scrutiny by foreign strangers via the NSA, the Chinese and others.

12.           GDS have taken on the responsibility for G-Cloud since 1 June 2013. Long before that, 1 March 2012, they claimed responsibility for the Identity Assurance Programme (IDAP). A notice was placed in the Official Journal of the European Union (OJEU) specifying that identity assurance services would be “fully operational” from “spring 2013” for the 21 million claimants who rely on the Department for Work and Pensions (DWP). On 16 January 2013 the IDAP contract was published, repeating the point, this time saying that the service would be “fully operational” by “March 2013”. It wasn’t fully operational then and it still isn’t. IDAP still doesn’t exist. The witnesses at the evidence session were unanimous about identity assurance being essential to digital-by-default. May I draw the Committee’s attention to the question whether there is something wrong with GDS’s software engineering processes which allows an important deadline for 21 million people to be missed without apology or explanation or even acknowledgement.

13.           Dr Thomas gave it as his opinion that it is impossible to measure the quality of most computerised systems and that that will remain the case until systems developers use formalised languages. For background, each statement in a formalised language is a theorem which gives rise to a proof obligation, that obligation is disbursed if a valid argument can be logically constructed to prove the truth of the theorem, in which case development of the system can continue, otherwise it can’t. Martha Lane Fox called for “revolution”. (This emotive language may be forgivable in a salesman but innocent people get injured in revolutions and it is preferable to use the term “innovative”.) Far from being innovative, GDS are using the same so-called “agile” systems development methods as millions of others – methods which require what Dr Thomas called “heroic” amounts of testing and yet you still don’t know at the end whether the system works. May I draw the Committee’s attention to the question whether, instead of conforming to fashion, GDS should be genuinely innovative and start to use formalised languages.

14.           The Committee didn’t elicit much information from the witnesses about the Government Gateway. For over ten years now the Government Gateway has allowed people and businesses to communicate with the government on-line, submitting VAT returns, and so on. It seems to work. It seems to be adequately secure. Users need a different ID for each Gateway service they subscribe to and they may have a different password for each service, too. That is inconvenient. “Identity providers”, according to a DWP press release, “will be required to offer a simplified registration process, minimise the number of usernames and passwords a customer will need to remember and reduce the costs incurred across Government for the management of Identity Assurance”. It is arguable that the adequate security of the Government Gateway is earned by its being inconvenient and that if you take away the inconvenience, then you lose the security, too. May I draw the Committee’s attention to the question whether, if GDS’s replacement for the Government Gateway is made more convenient in this way, it will at the same time lose its adequate security, it will block on-line communication between people, businesses and the government, and it will threaten the administration’s ability to raise revenue and to control state pension payments and welfare.

15.           Also on the subject of the Government Gateway, it has been reportedthat “In the [IDAP] model, the government provides a number of ‘federation hubs’, which provide the data-matching, anonymisation and audit services to support interaction between a market of identity providers (IDPs) and the government departments that will consume identity information”. May I draw the Committee’s attention to the question whether, if the hubs support anonymous use, transactions really can be audited. Contrarywise, if the hubs can be audited, how can users remain anonymous?

16.           The scope of digital-by-default extends to the compilation of the new electoral register which will be used for the 2015 general election. GOV.UKtells us that: “The Electoral Registration and Administration Act has received Royal Assent. The Act allows Individual Electoral Registration to be introduced in 2014 to help tackle electoral fraud and paves the way for online registration from 2014, which will make it more easier [sic] and more convenient for individuals to ensure they are registered to vote”. It is intended that that register should in turn form the basis in future for the national census. GDS have undertaken some of the cross-referencing (para.2.3) between the electoral register and other databases such as the National Insurance Number database designed to ensure that the register is complete and accurate. May I draw the Committee’s attention to the question what connection there is between the new electoral register and IDAP.

Most of these questions have been raised with the Cabinet Office, GDS, the G-Cloud team, BIS, Mydex and others over the past 18 months (e.g. GOV.UK/digital by default – 17 questions for Mr Maude) and remain for the most part unanswered. (HMRC is an honourable exception.) The House of Commons Science and Technology Committee will surely fare better in holding the administration to account.

Extracts from the four professors’ report on the Government Digital Strategy:

... it is not clear how realistic this ideal is ... brevity cannot be an excuse for lack of detail, explanation, and precision ... It is impossible with the detail provided to form any reasonable view of how this key activity will be performed ... there is an urgent need for standards to be developed and agreed ... he had no practical understanding of how to use this strategy to have positive impact on his team’s work; We suspect he is not alone in this view ... The GDS shows no evidence that it is aware or has taken account of the impact of such thinking ... The GDS must avoid falling into the trap of an overly-simplistic response ... Open source solutions are neither free to administer and support, nor are they the most cost-effective answer in all situations ... rapidly changing services will deter the takeup of digital services, not encourage it ... The GDS is remarkably (perhaps alarmingly) silent on the issue of how to coordinate SMEs in project delivery ... We see little discussion of a concrete and practical change management process to support the “digital by default” strategy in the current GDS. We view this as a potentially fatal omission ... the principles on which the current GDS is based centre on too narrow a view of how to attain those benefits, and lack focus on the major adjustment in culture, processes, and technologies that must underpin ... this view is much too simplistic and highly risky ... there is very little detail about how such goals will be achieved, or the broader cultural impact those changes represent ... a lack of consistency in interpretation of how to enact the GDS ... It is not clearly stated in the GDS who is managing the execution process across the 18 UK Government departments to coordinate and assess progress.
Yours sincerely
David Moss

----------

Updated 16:38
Para.7, "Dr Stephan Shakespeare" should be "Mr Stephan Shakespeare", see He's all heart, Shakespeare.

Digital-by-default, an open letter to the House of Commons Science and Technology Committee (updated)

Open letter

By email

10 June 2013

Dr Stephen McGinness
Committee Clerk
Science and Technology Committee
6th Floor
14 Tothill Street
House of Commons
London SW1H 9NB


Dear Dr McGinness
Digital by default
I refer to the Committee’s oral evidence session held on 5 June 2013.