Sunday, 11 March 2012

Cabinet Office using cyber security budget to increase risks to the public

Can someone advise, please, is there a polite way of asking can any British government tell its arse from its elbow?

The Cabinet Office want to deliver all public services over the web. Public services should be "digital by default", as they say.

The web is a dangerous place to be if you want to maintain secrecy/privacy and if there's any money around. The web is perfectly adapted to breach confidences and to steal money. Let today's Sunday Times make the point. In Chinese steal jet secrets from BAE they tell us that:
CHINESE spies hacked into computers belonging to BAE Systems, Britain’s biggest defence company, to steal details about the design, performance and electronic systems of the West’s latest fighter jet, senior security figures have disclosed.

The Chinese have exploited vulnerabilities in BAE’s computer defences to steal vast amounts of data on the £200 billion F-35 Joint Strike Fighter (JSF), a multinational project to create a plane that will give the West air supremacy for years to come ...

Professor Anthony Glees, director of the Centre for Security and Intelligence Studies ... said: “It seems the Chinese were getting plans which allow them to undermine the defence capacity of the country. It’s deeply unsettling that GCHQ [the government eavesdropping centre in Cheltenham] didn’t spot this for so long because they are the people who are meant to be leading the fight against cyber crime.”
There's a wide selection of cock-ups to choose from here:
  • With £200 billion at stake, the Sunday Times reported on 12 January 2012 that Royal Navy’s new jet cannot land on aircraft carriers. Never mind, you may say, it's only £200 billion and we haven't got an aircraft carrier anyway.
  • And three years ago, the Sunday Times reported that BT had bought equipment from China's Huawei telecommunications equipment company despite warnings that it could be used to "shut down Britain by crippling its telecoms and utilities" and that "government departments, the intelligence services and the military will all use the new BT network". Patricia Hewitt, trade and industry secretary at the time the contract was being negotiated, declined to intervene because it was "a competitive tender between two commercial companies". How very upright of Ms Hewitt not to let security interfere with competition.
But put those cock-ups aside. For current purposes, consider instead the following.

Rt Hon Francis Maude MP is the Cabinet Office Minister and according to his entry on the Cabinet Office website:
He leads on:

• Public Sector Efficiency and Reform
• UK Statistics
• Civil Service issues
• Government transparency
• Civil Contingencies
• Cyber security
• Overall responsibility for Cabinet Office policy and the Department
With his cyber security hat on, Mr Maude disposes of a budget of £650 million. Much-needed, judging by the success of GCHQ and BAE's attempts to fend off the Chinese.

With his public sector efficiency and reform hat on, Mr Maude wants to put Whitehall on the web. That's what "digital by default " means and that requires him to ignore his cyber security hat.

But it's worse than that. Digital by default requires something called identity assurance, a service which doesn't exist yet but is supposed one day to allow us all to prove who we are, over the web, while we're busy communicating with the government. The development of this service was unfunded until 31 October 2011 when Mr Maude announced that he'd found £10 million of public money to give it.

And where did he get this cyber security-busting £10 million from?

You can have 650 million guesses.

----------

Updated 23.6.14

Whitehall considers security shake-up

The government is understood to be carrying out a review of Whitehall organisations with a remit for electronic and computer security to determine any possibility of consolidation.

Informed sources say that one of the suggestions being considered is that CESG, the government's National Technical Authority for information assurance, should be separated from GCHQ, the signals intelligence agency.

That could mean the Cabinet Office taking over responsibility for CESG, with whom it has an ongoing relationship.
 "That could mean the Cabinet Office taking over responsibility for CESG". Oh God.

    Cabinet Office using cyber security budget to increase risks to the public

    Can someone advise, please, is there a polite way of asking can any British government tell its arse from its elbow?

    Friday, 9 March 2012

    You know you've arrived when ...

    Towards the end of a long and illustrious career, already garlanded in the seats of power the world over, what bauble could possibly further crown his achievement? This was the conundrum perplexing DMossEsq.

    The Governership of Hong Kong? Too late.

    The Order of the Garter? All things considered, no.

    Could he be the next Pope? His lips are sealed.

    The answer recently came to him. At last. As so often in today's global world, it was thanks to Google.

    Enter "david moss" "cabinet office" into Google, go down to the bottom of the page, click on 3 or above and, when the page has refreshed, towards the bottom of the page you will see:
    In response to a legal request submitted to Google, we have removed 1 result(s) from this page. If you wish, you may read more about the request at ChillingEffects.org.
    One hit has been removed from Google's list. Which one? You want to know. You click on the read-all-about-it link and you get:
    Notice Unavailable

    Defamation Complaint to Google
    Sent by: [individual]
    To: Google

    The cease-and-desist or legal threat you requested is not yet available.

    Chilling Effects will post the notice after we process it.
    Defamation? What defamation? This could be fruity. Who is the individual who complained? There is a certain dignity in these matters. Pray God it's not someone dull.

    ChillingEffects.org? No, me neither.

    Some sort of a kangaroo court? No. According to their website, Chilling Effects is:
    A joint project of the Electronic Frontier Foundation and Harvard, Stanford, Berkeley, University of San Francisco, University of Maine, George Washington School of Law, and Santa Clara University School of Law clinics ...

    Chilling Effects aims to help you understand the protections that the First Amendment and intellectual property laws give to your online activities. We are excited about the new opportunities the Internet offers individuals to express their views, parody politicians, celebrate their favorite movie stars, or criticize businesses. But we've noticed that not everyone feels the same way. Anecdotal evidence suggests that some individuals and corporations are using intellectual property and other laws to silence other online users. Chilling Effects encourages respect for intellectual property law, while frowning on its misuse to "chill" legitimate activity.
    Mystifying. Has DMossEsq defamed someone? Allegedly. Has someone allegedly defamed DMossEsq? Who knows? It's not clear. Let's hope that Chilling Effects hurry up and process the "cease-and-desist or legal threat" submission. The suspense waiting for them to post their notice will be hard to bear. Is DMossEsq at last the subject, or even the object, of that must-have for a career to be complete, a superinjunction?

    You know you've arrived when ...

    Towards the end of a long and illustrious career, already garlanded in the seats of power the world over, what bauble could possibly further crown his achievement? This was the conundrum perplexing DMossEsq.

    The Governership of Hong Kong? Too late.

    The Order of the Garter? All things considered, no.

    Could he be the next Pope? His lips are sealed.

    The answer recently came to him. At last. As so often in today's global world, it was thanks to Google.

    Wednesday, 7 March 2012

    The behaviour of the Cabinet Office is infantile

    The Government Digital Service operate a blog so that we can all see what they're up to.

    GDS is part of the Cabinet Office and what they're meant to be up to is making public services more efficient.

    On 6 March 2012, one Bob Kamall published a post on the GDS blog called Engaging With The Hard To Reach. It's all about his visit to a charity in Southwark, St Mungo's, which provides care for the homeless.

    You can read Mr Kamall's post. But you won't believe it.

    The following comment has been submitted in response. Will it be published? Will the Cabinet Office pay any attention?
    Mr Kamall

    In the circumstances, the Riot Act will now be read.

    You say:
    We recognise that if we are to succeed in driving channel shift to digital then services and transactions need to be developed with a relentless focus on users. We want to make use of the most innovative and versatile technology to deliver products that match industry leaders while ensuring that no-one is left behind.
    You mean:
    We recognise that if we are to focus relentlessly on users then concentrating on driving channel shift to digital is to miss the point. In public services we are the industry leaders and there is no comparison with the Facebooks and Amazons of this world – they can leave people behind, we can’t. Our job cannot be achieved by the use of innovative and versatile technology. That is for children. We are grown up and responsible. People depend on our services and we know it.
    You say that you want to show how GDS can engage with the hard to reach. There are nine or ten million of them, Bob. All that you actually offer in your post is oiling bicycle chains in the basement of St Mungo's.

    In 18 months time DWP's Universal Credit goes live. When the public realises that nine or ten million people have been excluded from the universe by default there will be fury in the land. DWP will be blamed. And DWP will blame GDS, pointing to ex-Guardian man Mike Bracken's post Identity: One small step for all of Government in which he unwisely pretends to have control over DWP.

    The Cabinet Office will then look like a branch of St Mungo's in Whitehall, a junior school feeding the main one in Southwark. A junior school housing a roster of unfortunate derelicts incapable of dealing with reality. Derelicts in need of care, expensively provided by taxpayers whose patience has run out.

    People will re-read Paul Downey's Blurring Boundaries post:
    I joined GDS because there's nothing cooler than working on something that touches so many peoples lives ... sitting on one part of the floor can feel a little like being in a bouncy castle. There's a nice kitchen that's only missing one essential bit of kit: we could really do with a dishwasher! ... Rather impressively by lunchtime of my first day I'd been given a Cabinet Office Email address (accessible using Google Apps for Business), a laptop (a security hardened 13" MacBook Air) ... Just before heading home we decided to create a commemorative Valentine's Day homepage for GOV.UK. A Kanban card was added to the sprint wall and Ben quickly came up with a design. I sat with James Weiner and Dafydd Vaughan whilst we built, tested and deployed the new ‘heart-shaped wood’ homepage, meaning I witnessed concept to delivery all in the space of half an hour.
    And through the blur they will see an expensive Eton in SW1 housing the Potemkin equivalent of the privileged children of the aristocracy, but without Eton's success rate, more like the op-ed team of the Guardian, forever insulated from reality, or at least until the money runs out, also in 18 months time:
    On my first day I hung my satchel on a peg with my name on it. Me and Pete did a potato print of a flower. It was cool.
    No wonder Universal Credit didn't work, people will say, looking back in 18 months time. And even if the front end had been delivered it couldn't have worked because some hippy teaching assistant in the second form had switched off the Government Gateway, promising to replace it with a cloud, the answer is blowing in the wind, man.

    And even before that, before October 2013 – which to us old people by the way is just around the corner, like tomorrow – GDS and DWP are promising to have provided 21 million Brits with an electronic identity by the Spring of 2013. That's what it says in the OJEU ITT. What drugs are you dealing in that bouncy castle? After eight years of unstinting political support and an unlimited budget IPS had issued just 4,000 ID cards. And GDS think they can equip 21 million people with working accounts six months after awarding the IdA contract, do they? Including nine or ten million who have never used the web? On which planet?

    And who is the contract going to be awarded to? Not the chicklets in the Technology Strategy Board incubator. They haven't got the scale. Not the banks. Why would they want their brands destroyed by confessing to any connection with this train crash? Who does that leave?

    Facebook and Google. Take a look at ex-Guardian man Mike Bracken's asinine what-I-did-on-my-holidays post, Thoughts on my recent trip to the West Coast with Francis Maude, Minister for the Cabinet Office:
    Andrew Nash, Google's Director of Identity, ran us through the current issues facing identity.He explained how Google aim to grow and be part of an ecosystem of identify providers, and encouraged the UK Government to play its part in a federated system. The UK ID Assurance team and Google agreed to work more closely to define our strategy – so look out for future announcements. Andrew also took the opportunity to walk the Minister through the Identity ecosystem.
    There is no trust in Google. Or Facebook. GDS's claims that they can create trust are laughable, like the magician at a children's party who claims to have pulled a white rabbit out of an empty top hat. GDS can't create trust at the throw of a switch. They can't create a market where there is none. They can't create an ecosystem.

    Do you have any idea what these infantile delusions look like to the grown-ups not yet in St Mungo's? Can you imagine what they make of it in Brazil? Or the US? Or Russia or China?

    They must look on amazed that a once-adult country has entrusted its public services to a group of imbeciles in a nursery school chanting the word "agile".

    What does Ian Watmore think he's doing?

    Why does Francis Maude put up with it?

    If I don't tell you, someone else will. You're making fools of yourselves. At public expense. There will be tears before teatime, Bob. You're facing disaster and public humiliation, quite properly, unless you guys wake up quickly, come out of your privileged little bubble, sort yourselves out and shape up.
    Cribsheet:
    • The Cabinet Office have failed before with this plan. It was called "transformational government" then. Only the name has changed. There is no reason to believe they can succeed this time.
    • As the name suggests, the Government Gateway is the computer system that many adept individuals and organisations in the UK currently use to communicate with the government. Unlike the "open source" code on which GDS's dreams depend, the Gateway actually exists. GDS want to throw it away and replace it with a government cloud, G-Cloud, that will look more like their juvenile heroes' websites – Amazon and eBay and Google and Facebook – replete with an ad server (see p.9) so that we can all book a holiday while submitting our tax returns.
    • GDS are acting under the influence of Martha Lane Fox's "digital by default" initiative. All public services are to be delivered over the web and only over the web. They ignore the problems of cyber security. And they ignore the fact that between nine and ten million people in the UK have never used the web and will be excluded by default.
    • GDS depend on IdA, a putative identity assurance service somewhere in the currently non-existent G-Cloud, a sort of private sector ID card scheme without the cards. IdA doesn't exist. There is no such thing as IdA. Another hole at the heart of their plans, along with security, and accessibility by their parishioners.
    • Any lawyers present might like to consider whether IdA requires primary legislation. There isn't any and there's no time left before the IdA contracts are to be awarded in the Summer of 2012 to fill the hole.
    • The problems of large computer systems persist. GDS's modish references to "cloud computing" and "agile" systems development methodologies have not made them go away.
    • Anyone with any energy left after getting to grips with the Cabinet Office and DWP could use it up looking at the related Department of Business Innovation and Skills midata project.
    • As for the Guardian, on 8 August 2011 they wrote in their own paper: "Andrew Miller, the GMG [Guardian Media Group] chief executive, has warned that the group could run out of cash in three to five years if the business operations did not change, adding that the newspapers would aim to save £25m over the next five years, releasing funds to be reinvested in other activities". The Daily Telegraph's 16 December 2011 article reported the closure of some Guardian supplements, the curtailment of others, several hundred redundancies and a so far unimplemented plan for the Guardian to get out of printing paper altogether.
    ----------

    Updated 22 November 2013:

    Ex-Guardian man Mike Bracken made a speech on 16 October 2013, Redesigning Government, in which he argues, among other things, that you've got to have fun at work. No argument with that.

    But what do you call fun?

    The clip below, from his speech beginning at 26'17", suggests that it's a pretty infantile idea of fun at GDS and confirms that the infantilism identified in the post above was built in to the human resources management policy right from the start:


    How do you motivate adults? The finest minds in digital? This generation? The GDS answer is apparently bunting, stickers, fluffy mascots, animal costumes and cake.


    Updated 29.4.15

    It's over three years since the post above was published. DMossEsq had forgotten about it. Then it was cited linked to in an ElReg special report yesterday, The Government Digital Service: The Happiest Place on Earth.

    It's over 18 months since DMossEsq added the update immediately above, dated 22 November 2013, with its reference to GDS's human resources management policy.

    Then lo.

    And behold.

    ElReg's special report quotes extensively from an external consultancy report on GDS's human resources management policy commissioned to "examine staff morale and high turnover at the Government Digital Service". The special report includes the following and three more pages like it:
    The most scathing findings are reserved for the top management, who GDS' own staff say created a “chumocracy”. This would have consequences for morale, contributing to a high turnover of staff.
    Far from being the happiest place on earth, GDS bears an uncanny resemblance to the island in Lord of the Flies, if the external consultants are to be believed. The Northcote-Trevelyan principles which have governed Whitehall for 161 years now seem to have been ignored when GDS was established and in its operation thereafter.

    The consultancy in question is The Art of Work and they have a spectacular client list. There's no reason not to believe their report and there has been no rebuttal from GDS.

    GDS are meant to tell the rest of Whitehall how to organise their IT. There are suggestions that they should in future also have the right to tell local government how to do its IT job. GDS's instructions may henceforth carry a little less weight.

    The attractions for respectable organisations to risk their brand by becoming associated with GDS's GOV.UK Verify (RIP) may similarly be reduced.


    Update 30.4.15

    A number of people are doing their best to be fair, in light of the criticism GDS are currently facing, particularly this report on staff unrest. Quite right too, of course.

    GDS can't respond themselves. They are currently in purdah. True. But they haven't responded to criticism in the three or four years of their existence. Nothing new there. And that's one of the observations of the report, an institutional inability to imagine that GDS is ever wrong.

    GDS is constrained by civil service pay scales. True. But many people work for less. And perhaps part of the need for GDS to "transform government" arises from the fact that the rest of the civil service is also constrained by civil service pay scales.

    Purdah, the dangers of groupthink and the problems of a limited budget affect the whole civil service. GDS are being accused of something special:
    Last year, the UK's Cabinet Office asked an external management consultancy to examine staff morale and high turnover at the Government Digital Service. After interviewing more than 100 civil servants, its scathing confidential analysis described an organisation beset by low morale and run by a “cabal” management of old friends, who bypassed talent in favour of recruiting former associates – while Whitehall viewed GDS as “smug” and “arrogant”.
    No-one is going to try to defend GDS if they really are operating an unmeritocratic old boys' network. Not even the esteemed editor of Computer Weekly, Bryan Glick, who yesterday published If not GDS, then what?, where he is clearly playing devil's advocate.

    Mr Glick quotes extensively from a paper written by Alan Mather in 2003 predicting that the attempt to transform government will always meet an aggressive response. True.

    Many people will know, from his Tweeting if nothing else, that Mr Mather is an exceptionally pleasant person. Others will know how modest he is and how very effective he was in making the Government Gateway a reality.

    The Gateway has provided a way for individuals and companies to transact with the government on-line for the best part of 15 years now. It continues to operate despite being starved of resources. Its replacement, promised by GDS, is nowhere to be seen.

    No-one could imagine Mr Mather operating a cabal of old friends, mushroom-managing the rest of the staff and strutting around the world sneering at his Whitehall peers. The special merit of Mr Glick's article is that he provides an answer. There is an alternative:
    Q. If not GDS, then what?
    A. Alan Mather.


    The behaviour of the Cabinet Office is infantile

    The Government Digital Service operate a blog so that we can all see what they're up to.

    GDS is part of the Cabinet Office and what they're meant to be up to is making public services more efficient.

    On 6 March 2012, one Bob Kamall published a post on the GDS blog called Engaging With The Hard To Reach. It's all about his visit to a charity in Southwark, St Mungo's, which provides care for the homeless.

    You can read Mr Kamall's post. But you won't believe it.

    Tuesday, 6 March 2012

    Always ahead of the game, the Daily Telegraph gets its April Fool's Day story in early

    The Whitehall efficiency drive that increased costs

    A seven-year government efficiency programme has backfired and increased costs for the taxpayer by hundreds of millions of pounds, a public spending watchdog said.

    10:00PM GMT 06 Mar 2012
    Whitehall departments have spent £1.4 billion in an attempt to save £159  million by sharing “back-office’’ functions such as personnel and procurement ...

    The [National Audit Office] discovered that the Department for Transport system had so far cost £129 million more to set up and run than it had saved ...

    Another unit, set up by Research Councils UK, has recorded a net cost to the taxpayer so far of £126 million ...
    See also Shared services disaster: a gain for some officials and ERP suppliers?

    Always ahead of the game, the Daily Telegraph gets its April Fool's Day story in early

    The Whitehall efficiency drive that increased costs

    A seven-year government efficiency programme has backfired and increased costs for the taxpayer by hundreds of millions of pounds, a public spending watchdog said.

    10:00PM GMT 06 Mar 2012
    Whitehall departments have spent £1.4 billion in an attempt to save £159  million by sharing “back-office’’ functions such as personnel and procurement ...

    The [National Audit Office] discovered that the Department for Transport system had so far cost £129 million more to set up and run than it had saved ...

    Another unit, set up by Research Councils UK, has recorded a net cost to the taxpayer so far of £126 million ...
    See also Shared services disaster: a gain for some officials and ERP suppliers?

    Why can't we be more like the Dutch?

    Ministerie van Binnenlandse Zaken en Koninkrijksrelaties
    Bekker: verbetering biometrisch paspoort mogelijk

    Nieuwsbericht | 27-02-2012

    Het gebruik van vingerafdrukken en digitale pasfoto's (biometrie) in het paspoort en de identiteitskaart is niet mislukt, maar levert nog onvoldoende op. De vingerafdrukken staan niet in een centraal bestand, ze worden niet gecontroleerd aan de grens en ook nauwelijks bij de uitgifte van reisdocumenten aan het gemeenteloket. Er zijn nog mogelijkheden om het gebruik van vingerafdrukken en foto's op paspoorten en ID-kaarten beter te benutten. De hooggespannen verwachtingen van tien jaar geleden zijn niet uitgekomen.
    Clear enough. Nothing to add. You may say.

    Oh alright, just for the English. That's Dutch, that is, and here is the Google translation:

    Ministry of the Interior and Kingdom Relations
    Bekker: improving biometric passport may

    News | 02/27/2012

    The use of fingerprints and digital photographs (biometrics) in the passport and identity card has not failed, but supplies still insufficiently. The fingerprints are not in a central database, they are not checked at the border and also largely to the issuance of travel documents to the municipal service. There are possibilities for the use of fingerprints and photographs on passports and ID cards better. The high expectations of ten years ago did not materialize.
    Professor Roel Bekker has investigated the matter of biometrics in Dutch passports and here in his report he concludes mildly that "the high expectations of ten years ago did not materialize".

    A bit too mildly for the Dutch civil liberties campaigners, Privacy First, who have published a commentary on Professor Bekker's report in which they say, among other things:
    An interesting detail in this context is that already the end of 2009 the huge error rate (21%) upon verification of fingerprints known to State Secretary Bijleveld (Kingdom Relations). The House was not until end of April 2011 informed about this error rate ...
    It should be pointed out for new readers that when we say "fingerprints" here, we mean the newish technology of flat print fingerprinting, a glorified photocopying process adopted by the UK Home Office and others. Unlike traditional rolled print fingerprinting – which works – there is no police fingerprint expert involved, it's quick, it's cheap, it's clean and it's utterly unreliable.
    That's a Google translation again but 21% is a massive error rate in any language.

    Suppose you're an officer of the UK Border Force, you're sitting at Heathrow and two A380s have just landed. That gives you 1,000 travellers to check using the Secure ID system the geniuses back at the Home Office have provided you with. You know that on average you're going to get 210 false alerts. You're going to waste your time and the time of 210 travellers because Secure ID wrongly tells you that they are not who they say they are.

    You can see why Brodie Clark told the Home Affairs Committee that fingerprint checks at the border are the least reliable security/identity checks his (now ex-)staff perform, why Secure ID is their ninth and bottom priority, and why when push comes to shove in the immigration hall – as it does with 1,000 tired people – the most sensible thing to do is to drop Secure ID.

    You can see that. And the Dutch can see it. They've dropped their plans to maintain central registers of people's biometrics and to rely on biometrics for security. That's the lesson they learn from the fact that the wretched technology just isn't good enough or, as Professor Bekker puts it, "the high expectations of ten years ago did not materialize".

    But not here in the UK. Oh no. Here in Alice's Wonderland we both acknowledge that the technology doesn't work and continue to spend money on it.

    On 27 February 2012, the same day as the Dutch Ministry of the Interior and Kingdom Relations announcement above, the Guardian told us that "the government is to double the number of people required to have a biometric residence permit (BRP) to stay in the UK, raising the number to 400,000 a year". By all means hand out residence permits where that is the right thing to do. But given that the biometrics don't work, why make them biometric residence permits? The biometrics add nothing. Except cost.

    These biometric residence permits are all part of IABS, the Home Office's new Immigration and Asylum Biometric System. It doesn't just "do" residence permits. It's also meant to do border security. And it's meant to help to keep the 2012 Olympics safe.

    In its first 18 months in power, the coalition government spent £735 million with IABS contractors.

    The Dutch know that the biometric bits of IABS are a waste of time and money. A 21% error rate is a fail. Why can't the UK learn the same lesson?

    Why can't we be more like the Dutch?

    Ministerie van Binnenlandse Zaken en Koninkrijksrelaties
    Bekker: verbetering biometrisch paspoort mogelijk

    Nieuwsbericht | 27-02-2012

    Het gebruik van vingerafdrukken en digitale pasfoto's (biometrie) in het paspoort en de identiteitskaart is niet mislukt, maar levert nog onvoldoende op. De vingerafdrukken staan niet in een centraal bestand, ze worden niet gecontroleerd aan de grens en ook nauwelijks bij de uitgifte van reisdocumenten aan het gemeenteloket. Er zijn nog mogelijkheden om het gebruik van vingerafdrukken en foto's op paspoorten en ID-kaarten beter te benutten. De hooggespannen verwachtingen van tien jaar geleden zijn niet uitgekomen.
    Clear enough. Nothing to add. You may say.

    Oh alright, just for the English. That's Dutch, that is, and here is the Google translation:

    Monday, 27 February 2012

    The collection of people's biometrics is akin to the old-fashioned schoolboy hobby of stamp-collecting

    A courtier asked the Prince [later King George V] if he had seen that "some damned fool had paid as much as £1,400 for one stamp". "Yes," came the reply. "I was that damned fool!"
    George V loved stamp collecting.

    The attractions of stamp collecting may elude you and me but there's something touching about the enthusiasm of a grown man for this harmless pursuit.

    Harmless, at least, as long as it's not being funded by public money. That can rankle. You don't need to be a republican to find the thought distasteful that people's hard-earned money extracted from them in taxes should pay for one privileged man's hobby. Certainly, nothing like that would be acceptable today.

    Except that, apparently, it is.

    In the first 18 months of the coalition government, £140,023,212 was paid to Computer Sciences Corporation and £67,416,851 to VF Worldwide Holdings to collect the fingerprints of non-EEA visa applicants abroad.

    Can anybody explain why? Is this a justifiable use of public money? How can it be? Note to the Home Office: justify it; either that, or please stop.

    The collection of people's biometrics is akin to the old-fashioned schoolboy hobby of stamp-collecting

    A courtier asked the Prince [later King George V] if he had seen that "some damned fool had paid as much as £1,400 for one stamp". "Yes," came the reply. "I was that damned fool!"
    George V loved stamp collecting.

    The attractions of stamp collecting may elude you and me but there's something touching about the enthusiasm of a grown man for this harmless pursuit.

    Harmless, at least, as long as it's not being funded by public money. That can rankle. You don't need to be a republican to find the thought distasteful that people's hard-earned money extracted from them in taxes should pay for one privileged man's hobby. Certainly, nothing like that would be acceptable today.

    Except that, apparently, it is.

    In the first 18 months of the coalition government, £140,023,212 was paid to Computer Sciences Corporation and £67,416,851 to VF Worldwide Holdings to collect the fingerprints of non-EEA visa applicants abroad.

    Can anybody explain why? Is this a justifiable use of public money? How can it be? Note to the Home Office: justify it; either that, or please stop.

    The belief in the efficacy of biometrics is akin to the belief in astrology

    Warning. In the following paragraphs approximately half the world will be insulted. Please stay your hand revengewise. In no time at all, the other half will be equally insulted.

    Why is it, our ancestors asked, that the children in a given family aren't identical? Some of them are boys, others girls. Some of them are outgoing, others repressed. And yet they have the same parents. What can explain the difference?

    It's a good question and our ancestors came up with a good hypothesis by way of an answer. It had to be something unique about each child in the family, something that distinguished each from the others. And the answer suggested was ... the position of the planets at the moment of birth. Permanently in motion, there is something unique about the position of the planets at any given moment. And they're big, the planets, big enough to influence developments here on earth.

    Astrology looks as though it ought to have some explanatory value. We naturally believe that there is something unique about each individual person who ever exists and we naturally look for reasons for that, or at least for causes.

    Like a lot of hypotheses, astrology has failed. Nothing surprising about that. Most hypotheses fail. Half of science is all about trying to disprove hypotheses. It's that massive failure rate that gives the remaining not-yet-disproved hypotheses their strength. That's what makes knowledge special and rare and hard to come by and valuable.

    (The other half is all about having enough knowledge and dedication and imagination to devise a worthy hypothesis in the first place.) 

    Anyway, as far as about half the world is concerned, astrology is a waste of time. It's bunkum. It doesn't explain character traits. No causal link between the position of the planets at the moment of his birth and the money-making abilities of Richard Branson, say, has ever been established, his life is not written in the stars, the stars give us no hint what to expect from him next, his horoscope is a useless piece of paper.

    You astrologically-inclined persons believe in magic. What the rest of us believe in is science. Scientific experiments are repeatable. Science is respectable and defensible and logical and intelligent and grown up and allows us to predict events in advance.

    At least, that's what we like to believe.

    We're very scientific and we spend a lot of money on science, which proves our faith, and we like it when scientists talk to us on television but, oddly, we still can't predict earthquakes. Or the eruptions of volcanoes. Or tsunamis. Little things like that seem still to elude us.

    Those failures will not detain scientists for a moment. Quite rightly. We may not have all the explanations yet, but we're working on it and we've got a tremendous record of success behind us, a centuries-long demonstration that if we only stick at it, the solution is discovered in the end. The science improves. Technology improves. You can talk to someone in real time on the other side of the planet thanks to telephones. That would once have been considered magic. No more.

    No-one can have any objection to research money being spent legally on science while it's still at the hypothesis stage. Certainly not if it's private/personal money or charitable trust money. That's up to the individuals or charities concerned and none of our business, the rest of us. Equally, we can hardly be expected to rely on unproven science like astrology in our everyday lives and we are quite within our rights to object if someone tries to force us to.

    Things change when it comes to business. His shareholders would quite properly look askance at Richard Branson if he spent company money on astrological research projects rather than on the dividends that could otherwise be paid.

    And they change mightily when it comes to public money. Public money is meant to be spent wisely and in a businesslike way in the interests of the public, so that it contributes to the "common welfare". It's wrong for a public authority to fritter away taxpayers' money, or borrowings added to the national debt, on hopeless (?) hypotheses like astrology.

    Of course, our government here in the UK doesn't do that sort of thing.

    Or does it?

    Consider the Home Affairs Committee report on the Brodie Clark affair, Inquiry into the provision of UK Border Controls. (You knew that was coming. Didn't you?) And consider particularly para.10:
    ... Rob Whiteman [Chief Executive of the UK Border Agency] explained that he believed that the reason Ministers were opposed to any reduction of Secure ID checks was because they did not agree with Brodie Clark's assessment of them as 'secondary checks' due both to the deterrent effect of the check and because "of course, if somebody is found by that, it is actually quite a high-risk case—if somebody has gone to the position of forging the photograph in comparison with the photograph on the chip—so, although the number might be very low, Ministers were of the view that the risk value of an incident would be high."
    Mr Whiteman is slightly confused here. Science is difficult for the best of us, but "Secure ID" is all about fingerprint checks, not face recognition and what UKBA call "opening the chip" in ePassports. Still, it's only a slight confusion, they're both biometrics and biometrics, of course, is a proven science, isn't it.

    No, it's not. The belief in the efficacity of mass consumer biometrics is still at the faith stage, it's magic, it's an unproven hypothesis, and the Home Affairs Committee might just as well have written:
    ... Rob Whiteman explained that he believed that the reason Ministers were opposed to any reduction of Astrological ID checks was because they did not agree with Brodie Clark's assessment of them as 'secondary checks' due both to the deterrent effect of the check and because "of course, if somebody is found by that, it is actually quite a high-risk case—if somebody has gone to the position of forging their date and place of birth in comparison with the star sign on the chip—so, although the number might be very low, Ministers were of the view that the risk value of an incident would be high."
    The unnamed ministers' argument relayed by Mr Whiteman is a candidate for the most stupid argument put forward yet in the Brodie Clark affair. Until the Home Office give us some reason to believe that biometrics work and that public money is being wisely invested in this technology, the UK Border Force procedures with regard to biometrics are no more comprehensible than instructing them to detain all Sagittarians.

    Ah, you may say, but the technology will improve.

    Will it? How do you know that? It hasn't yet. And astrology hasn't improved. So why should biometrics?

    And why invest in it and rely on it in our everyday lives before it's known to work? If Richard Branson tried that on, then the institutions who hold his shares would take him aside and suggest that perhaps, old boy, you know, the time isn't right just yet, why don't we wait a bit, let the dust settle, see how the cards fall, then it might be worth investing but until then, it really doesn't look businesslike, in fact it barely looks rational.

    The managers of a company have a fiduciary duty to their shareholders to behave rationally and in a businesslike manner. The Home Office even more so – that's public money they're spending. No doubt it seems like magic to Whitehall that we give them £710 billion to spend every year. But there are a few formalities to observe, not behaving like a credulous ignoramus being just one of them.

    The belief in the efficacy of biometrics is akin to the belief in astrology

    Warning. In the following paragraphs approximately half the world will be insulted. Please stay your hand revengewise. In no time at all, the other half will be equally insulted.

    Why is it, our ancestors asked, that the children in a given family aren't identical? Some of them are boys, others girls. Some of them are outgoing, others repressed. And yet they have the same parents. What can explain the difference?

    UIDAI and the textbook case study of how not to do it, one for the business schools

    The Unique Identification Authority of India (UIDAI) came under attack. Its very existence was threatened. Naturally enough, UIDAI decided to defend itself.

    It's worked. UIDAI survives for the moment.

    But theirs is a Pyrrhic victory. The UIDAI defence could undermine the credibility of every public authority in the world which has nailed its colours to the mast of biometrics – which is most of them – and could destroy the multi-billion dollar mass consumer biometrics industry.

    The job of the Unique Identification Authority of India (UIDAI) is to use biometrics to identify every resident of India and to issue them with a unique corresponding number, a so-called "Aadhaar number".

    "Aadhaar" means foundation or support and the idea is that, once everyone has an identifying number, it will be easier for the various arms of government to build systems on that foundation to provide social security benefits, for example, and to facilitate national security. And beyond government, the banks will supposedly find it easier to authenticate payments.

    UIDAI is not without its critics:
    • The Standing Committee on Finance (SCoF), a committee of the Indian Parliament, has considered the National Identification Authority of India Bill, 2010. That Bill would establish UIDAI on a statutory basis if it was ever enacted, but it hasn't been. Meanwhile, UIDAI is operating under executive order only. It's not operating very well according to the SCoF report and it's about time UIDAI came under the control of Parliament.
    • And then there's the Ministry of Home Affairs. They're a properly constituted body and not just a creature of the Executive. And they have a competing identity management scheme, NPR (the National Population Register). Result – a turf war, Aadhaar v. NPR.
    SCoF and the Ministry of Home Affairs pressed their case with the Prime Minister but UIDAI proved too adept for them. The Chairman threatened to resign, which would be embarrassing for the prime Minister – good move no.1. Good move no.2 – UIDAI arranged some convenient PR with the compliant Economist magazine. And then they published not one but two reports making unprecedented claims for the reliability of the biometrics used in Aadhaar:
    Oops. Bad move. There are five problems here:
    1. Both reports are produced by UIDAI only. There is no sign that they have been audited by any independent expert body.
    2. Both reports quote reliability figures. No other public authority in the world does that. Not operational figures – figures measuring the reliability of biometrics in the field, at the border, for example. They should. But they don't. Now, thanks to UIDAI, they will all come under pressure to quote independently audited figures themselves, figures for reliability, to justify their investment of public funds. It is likely that the public are going to be shocked at just how unreliable the biometrics are, that their governments are using. The public will at last understand why their governments have been so reluctant for so long to quote any figures.
    3. Why is that likely? Because the figures quoted by UIDAI are hundreds of times better than anything anyone else has ever claimed following tests of biometrics. Hundreds.
    4. The second report says that (a) Aadhaar uses flat print fingerprinting and iris scanning, (b) the two biometrics are fused to form one composite biometric, so-called "multi-modal" biometrics, and (c) UIDAI use not one matching algorithm, but three of them. Any large-scale identity management scheme that doesn't do the same, they say – (a), (b) and (c) – is doomed to "catastrophic failure".
    5. The suppliers of biometric technology have never had to give public warranties before. Now they will have to.
    Great. Now suppose you're the Australian Customs and Border Protection Service. You've spent millions of dollars of public money deploying smart gates at Australian airports as a security measure. These gates depend on face recognition biometrics. Not on UIDAI's list (a). The Australian (and new Zealand) border security system is doomed to "catastrophic failure". Don't take my word for it. Ask UIDAI.

    You've spent years refusing to divulge any figures about the reliability of your technology:
    Customs refused to disclose the rates at which the system inaccurately identified people.

    "For security reasons, Customs does not disclose the false positive and false negative rates," a spokesman said.
    Now UIDAI have released figures, how are you going to hold the line? You can't.

    You could say that UIDAI's figures haven't been audited and may turn out to be false. Now you've got a fight with UIDAI on your hands. And what's the best result you can hope for? UIDAI's figures turn out to be a pack of lies and actually the reliability of Aadhaar is just as appalling as the Australian system. Not what you wanted. It doesn't help to explain why you've been squandering your own citizens' tax money on joke technology.

    The same applies to the UK, of course, and our planned deployment of smart gates at airports. Another catastrophic failure? And all those states in the US busy incorporating face recognition biometrics into driving licences. These people – the Australian Customs and Border Protection Service, UK Border Agency, et al – are not going to be pleased with UIDAI. UIDAI have let the cat out of the bag and have almost certainly started a fresh collapse of confidence in public administration as a result.

    And neither are the biometrics suppliers going to be pleased. How are Morpho going to sell their products now without giving warranties? They're not.

    And how are IBM and CSC going to be able to sign any more nine-figure biometrics contracts with credulous governments? They're not.

    And how are PA Consulting going to sell any more biometrics assignments? They're not.

    UIDAI are going to be persona non grata worldwide. Especially in India, where the Prime Minister may yet regret his decision to carry on funding them. And stop. He may give almost any reason but the big reason, the one several people have pointed out for a long time, is that far from curtailing corruption, Aadhaar was simply going to automate it.

    A tragedy with a happy ending, the only people who will be pleased is absolutely everyone else in the world, who can now keep some of their tax money and spend it themselves rather than paying public authorities to waste it for them.

    UIDAI's Pyrrhic victory? From now on it's going to be known as an "Aadhaar victory". At least it will when the business schools write it up and teach it all around the world. And when the Economist faithfully report UIDAI's defence, under the heading "Poison pill – that's not the way to do it".

    UIDAI and the textbook case study of how not to do it, one for the business schools

    The Unique Identification Authority of India (UIDAI) came under attack. Its very existence was threatened. Naturally enough, UIDAI decided to defend itself.

    It's worked. UIDAI survives for the moment.

    But theirs is a Pyrrhic victory. The UIDAI defence could undermine the credibility of every public authority in the world which has nailed its colours to the mast of biometrics – which is most of them – and could destroy the multi-billion dollar mass consumer biometrics industry.

    Wednesday, 22 February 2012

    How to fly a kite, I am told

    You're a senior politician. Or you have real power, you're a Whitehall official. There's something you want to say, but you can't be the one to say it. What do you do?

    For years, the answer has been simple. Rachel Sylvester. She used to write for the Telegraph. Now it's the Times. The move was interesting – she was insufficiently sycophantic about New Labour, quite sycophantic but not sycophantic enough. But it doesn't matter to you that she moved – wherever she is, she'll fly your kite for you. The following examples from the Times only:
    • 14 February 2012: But I am told by one well-placed source that the budget for his artwork could be “over £1 million” ...
    • 31 January 2012: I am told that Sir Gus O’Donnell, then the Cabinet Secretary and head of the Civil Service, was among the senior figures who tried...
    • 15 November 2011: She took the decision to do this, I am told, against the advice of Home Office civil servants ...
    • 28 June 2011: I am told that Stephen Gilbert, the political secretary at No 10, and Andrew Feldman, co-chairman of the Tory party, ...
    • 17 May 2011: I am told that the new joint committee will include 12 members of each House, including crossbenchers and a bishop ...
    • 10 May 2011: I am told that he first raised concerns with Andrew Lansley at the end of last year ...
    • Etc ... The reader is spared the other 28 examples easily found with a single search on the Times website. The Telegraph website yields another 53 examples.
    Apparently, somewhere behind the scenes, where people are paid public money to discuss this sort of thing, some conclave of cardinals has been debating the vexed question whether the Home Office isn't perhaps a little too right-wing and the Ministry of Justice a little too left-wing and they've decided to settle the matter by testing the waters in public.

    This week's kite, in Ms Sylvester's Tough on crime, tough on namby-pambies, flies as follows:
    One proposal discussed in Downing Street is to reconfigure Whitehall to end the good-cop-bad-cop departmental divide. Under the plan the Home Office would be responsible for everything to do with crime, including the police, prisons policy and sentencing. The Ministry of Justice would be scrapped and replaced with a new as-yet-unnamed department handling issues relating to national identity. This would bring together immigration, passport control and citizenship. Damian Green, the junior immigration minister, is mentioned as a contender for the Cabinet job. From the liberal wing of the Tory party, he can talk tough without sounding nasty. It may not happen but a change of emphasis is certainly under way.
    If only the cardinals ran a focus group called something like SylvesterRachel.gov.uk, we could all drop by and vote "no".

    How to fly a kite, I am told

    You're a senior politician. Or you have real power, you're a Whitehall official. There's something you want to say, but you can't be the one to say it. What do you do?

    John Vine report published

    John Vine CBE QPM is the Independent Chief Inspector of the UK Border Agency (UKBA). His report on the Brodie Clark affair was published on Monday 20 February 2012. Like the Home Affairs Committee report Inquiry into the provision of UK Border Controls published a month earlier on Thursday 19 January 2012, it is a historic document. It criticises the Executive and yet, there it is, in a brave move of the Home Secretary's, it’s been published by the Executive.

    If you went to bed on 20 February 2012 having learnt about Mr Vine’s report only from reading the Guardian live blog (starting at 4:12 p.m.) and from hearing Yvette Cooper talking about it on the radio, then you probably slept badly with thoughts of something sacred (England) having been defiled (by the invention of Tony Blair and Gordon Brown) disturbing your sleep and perhaps remembering that Hopkins poem, “No worst, there is none. Pitched past pitch of grief,/More pangs will, schooled at forepangs, wilder wring ...”.

    Your mood will not have been improved in the morning by the woodentop predictability of the Daily Mail, with their Britain's 'Mickey Mouse' border controls let 500,000 into the country without any checks for FIVE YEARS headline and so you will have sat down to write your blog, entered the bilious title which wrote itself – John Vine signs death certificate – Home Office RIP – and then ... and then thought perhaps it might be a good idea to read the report first.

    It's long. There's a lot in it. There's a lot to think about.

    First things first, Mr Vine's report describes an exemplary piece of detective work. He has abided by his terms of reference, the work was done quickly and apparently thoroughly and he writes clearly. He hasn't been cross-examined in an open court of law, of course, but prima facie some of his findings look pretty damning.

    Writing about the "intelligence-led" trial in Chapter 4 of his report, he successfully debunks UKBA, who obviously haven't got a clue how to run a trial. At para.4.103 he fingers UKBA for claiming that the trial had been a success on the basis of certain drug seizures they made, without being able to prove that they made the drug seizures because of the trial. If drugs companies conducted trials in the same way, we'd all be dead.

    No-one knows what "intelligence-led" means, least of all the poor old Home Secretary – regular readers will remember this interchange when she gave evidence in front of the Home Affairs Committee:
    Q33 Michael Ellis: ... can you elaborate on what is meant by intelligence-led security measures? ...

    Theresa May: Indeed. The basis on which the pilot was to operate was that it was to enable a greater focus on those who were at higher risk. Intelligence-led, led also at the discretion of the officers at the border so that they would be assessing within the two categories of EEA nationals and the biometric chips, and EEA national children ...
    Mr Vine's dissection of the Secure ID business in Chapter 3 of his report is minute. "Secure ID" is a misnomer and denotes checking travellers' fingerprints.

    Mr Vine is at some pains to show how the failure of immigration officers to do their Secure ID checks can be explained by their inadvertently confusing "Level 2" and "Scenario 2" (para.4.39) or by their failure to understand that Damian Green MP's approval for the suspension of Secure ID checks was a "provisional" approval (para.3.67).

    But in the end he has to give up and decide that the immigration officers at Heathrow, in particular, jolly well knew they were flouting ministerial instructions when they suspended Secure ID.

    Why would they do that? Are they all rogues?

    Maybe not. Maybe they suspended Secure ID because they knew it was a waste of time that they didn't have to waste.

    Brodie Clark said when he gave evidence to the Home Affairs Committee that fingerprint checks are the least reliable security/identity checks available and that they are the ninth and bottom priority. Mr Vine doesn't disagree. Indeed he quotes Brodie Clark in this connection saying that there have only been seven "hits" from Secure ID (3.13) since it was introduced in 2009-10.

    Let's take a bit of time out here for some numbers. In the first 18 months of the coalition government, the period ending 31 October 2011, two days before Brodie Clark was suspended, the following payments were made by UKBA to contractors involved with computerised border security systems including fingerprint-checking:
    Atos ............................... 67,461,976
    CapGemini .............................. 90,000
    CSC (Computer Sciences Corporation) 140,023,212
    Detica ................................ 821,034
    Fujitsu ........................... 175,743,106
    IBM ............................... 155,438,327
    Morpho .............................. 1,227,389
    PA Consulting ....................... 3,428,522
    QinetiQ ............................... 582,868
    Serco ............................. 103,590,132
    Steria ............................. 19,084,494
    VF Worldwide ....................... 67,416,851

    Total ............................ £734,907,911


    Source: http://data.gov.uk/dataset/financial-transactions-data-ho
    Did those seven hits Brodie Clark talks of cost £105,000,000 each? A cheap mind might say so. Money is the only currency some people can deal in.

    But Mr Vine offers us something subtler and more human. He contrasts the pestilentially inflexible computer system which made it hard for immigration officers to collate the statistics of their drugs seizures (4.98) with the benefit of human beings with the gift of judgement, specifically an immigration officer faced with a traveller with impeccable credentials who turned out to have 93 packets of cocaine inside him (Figure 12, p.66).

    The computer wouldn't have discovered that cocaine. The traveller's papers were in order. The immigration officer did. He disobeyed instructions and questioned the traveller. He had a hunch. He had a certain amount of autonomy and discretion. And presumably a sound understanding of his duty and an admirable commitment. Which one does the Daily Mail want? Which one do you want?

    If you are persuaded that border security depends on people and not on senseless automata then, the more you read John Vine's report, the more you understand what that belief means. It means that forms won't always be filled in correctly. It means that the people at head office will add up the figures and get a different total. It means that one man's "provisional" is another man's "unqualified". No computer would confuse "Level 2" with "Scenario 2", but then no computer will find those 93 packets of cocaine.

    Chapter 2 of Mr Vine's report is devoted to the Warnings Index (WI). The WI checks have had to be suspended too often, usually for good reasons (2.21) ...
    For example, on 15 July 2011, 100% checks were suspended for one hour and 20 minutes and the reason for this was recorded as “Coaches blocking roundabout”, whilst on 16 July 2011, the reason recorded was “Coaches tailed back to motorway”.
     ... but not always for good reasons. Figure 6 on p.23 of Mr Vine's report lists suspensions of WI checks by port, ending with 106 suspensions at "Other ports combined". Mr Vine attaches a footnote, footnote no.13, one for the history books, explaining that these other combined ports include three holiday destinations. One of them is Disneyland Paris, side-splittingly referred to in the Daily Mail headline above. The three holiday destinations reported just one suspension each, which sounds statistically insignificant. It's just that the suspension went on in each case for four years, Yvette Cooper please note.

    It's not good. In fact, it's bad. But look why it's bad. It's profiling.

    Some clot decided that no-one coming home from Disneyland Paris was likely to be a security threat and stuck to it for four years. If you believe in the efficacy of targeting, though, this is the kind of result you must expect. This, and the rogue "Operation Savant" uncovered by Mr Vine and dealt with in Chapter 5 of his report.

    It does have funny consequences. Also in Chapter 5, Mr Vine records the procedure at Portsmouth, where immigration officers didn't bother to "open the chip" in ePassports, except to annoy French travellers.

    But in general, think twice before agreeing that profiling is a good idea.

    It sounds targeted or intelligence-led or risk-based, it sounds advanced and scientific. The suggestion is of a crack team of 26 PhDs in the UKBA command and control bunker using advanced pattern-recognition to detect, hidden away in a mineful of data, the geometry of an organised crime or a planned act of terrorism. But as no-one knows the shape of organised crime or terrorism it's baloney.

    Mr Vine says in his introduction that "there is nothing I have discovered which could not have been identified and addressed by senior managers exercising proper oversight" (p.6). Which senior managers does he mean?

    Go back to the Home Affairs Committee report. The Committee say:
    14. ... The UK Border Agency is described as "an executive agency of the Home Office" but it is in fact an integral part of the Department. While it has its own management and budgetary structure, the UK Border Agency is still under the aegis of the Home Office and it no longer formulates its own policy—that is the responsibility of Home Office Ministers, on the advice of Home Office and UK Border Agency officials.

    22. ... If we are to accept the version of events as recounted by Ministers and senior Home Office staff then it creates the impression that Mr Clark was running the UK Border Force without effective checks or balances from either his superiors or immediate colleagues despite the fact that the Border Force is not a separate organisation, nor even part of an independent agency, but is part of the mainstream responsibility of the Home Office and comes directly under the responsibility of the Permanent Secretary and the Board of the Department.
    So that's who Mr Vine thinks should have exercised proper oversight. The problems aren't all the responsibility of Brodie Clark and a few senior UKBA staff at Heathrow. Responsibility is shared right up into the heart of the Home Office, right up to Dame Helen Ghosh, the Permanent Secretary. And the problems didn't start last year when she started. Dame Helen inherited a lot of the mess from Sir David Normington, her predecessor as Permanent Secretary, who remains as silent about her travails as his ex-boss, Sir Gus, now Lord O'Donnell.

    What's the solution? Split the Border Force from the rest of UKBA? That's obviously what Dame Helen and Theresa May have decided to do. A mistake. Especially if they accompany that move with a lot of opprobrium heaped undiscriminatingly on the heads of all their staff. There are success stories. Like the introduction of checks on lost and stolen passports. Success stories which it might be nice if Mr Vine had included in his report.

    It could work, though, if UKBA stop wasting lorry-loads of public money on glitzy technology and plausible consultants and contractors and spend a bit instead on the human beings that border security really relies on.

    Is there any hope of that happening? On past experience, no. But just maybe the Financial Times story about the deployment of smart gates at UK airports being delayed in advance of Mr Vine's report could herald a break with past experience – maybe UKBA will abort the deployment of smart gates and cut back on their staff cutbacks.

    John Vine report published

    John Vine CBE QPM is the Independent Chief Inspector of the UK Border Agency (UKBA). His report on the Brodie Clark affair was published on Monday 20 February 2012. Like the Home Affairs Committee report Inquiry into the provision of UK Border Controls published a month earlier on Thursday 19 January 2012, it is a historic document. It criticises the Executive and yet, there it is, in a brave move of the Home Secretary's, it’s been published by the Executive.