Now UC IT

The National Audit Office (NAO) have published their report on Universal Credit (UC). UC is the Department for Work and Pensions (DWP) initiative to rescue benefit claimants from the poverty trap created by the UK's inept welfare system. The idea is to rescue them by making work pay.

Universal Credit: early progress is 60 pages long. 60 pages which document the unrelenting and expensive failure of DWP to get to grips with UC. There is a summary for you kindly prepared by Tony Collins – Will Universal Credit ever work? – NAO report.

By 31 March 2013, DWP had spent £425 million on UC. £425 million spent by intelligent and experienced public servants and there is nothing to show for it.

Accenture have picked up £125 million of that money, IBM £75 million, Hewlett-Packard (HP) £58 million and BT £16 million. That accounts for £274 million. £274 million spent with intelligent and experienced software engineers and there is nothing to show for it.

Is it the politicians' fault (Iain Duncan Smith, the Secretary of State at DWP, and his junior ministers)? Is it the officials' fault (Robert Devereux, Permanent Secretary at DWP, and his staff)? Is it the contractors' and consultants' fault? Yes. In each case.

How on earth can such a catastrophic failure happen? It's happened before, please see for example It's all John's fault. The lessons never seem to be learnt.

It's time to stop this nonsense. DWP have "pressed the reset button" apparently and are taking time out to think. About time, too.

The thinking so far centres on the software engineering methods being used. DWP, it is said, failed to use "agile" methods. Appendix Seven of the NAO report, beginning on p.53, provides a handy cribsheet on agile v. traditional software engineering.

This may be a cul-de-sac. After all, no engineering methodology in history has ever recommended spending £425 million before thinking what it is you're trying to achieve. Also, there is no guarantee that agile methodologies would avoid the same problem.

To the extent that "agile" means anything in Whitehall, it means the Government Digital Service (GDS). GDS are great advocates of agile, they claim to be successful exponents of agile and they want to see central and local government become 100 percent agile.

They're getting their message across.

Howard Shiplee, the man in charge of UC for the past 100 days, says in his Telegraph article Universal Credit: The First 100 days:

As the Secretary of State outlined in July, we are working with the new Government Digital Service (GDS) to explore an enhanced IT programme that would offer more flexibility and security to benefit claimants. We’re planning to take the best of the existing system and make improvements using GDS support.

Why?

The BBC and the Guardian give GDS great publicity, please see GDS PR blitz. So do the Times, please see Toe-curling: GDS PR Blitz.

Why?

The Design Museum declared GDS's only product to date, GOV.UK, to be Design of the Year 2013. The Design and Art Direction charity created a new category this year especially to be able to give GOV.UK a prestigious D&AD award.

Why?

The answer in each case is, presumably, competent public relations. An attractive brand is being created. But is there any substance there? What skills of GDS will stop the next £425 million from being wasted?

According to five IT professors, none.

Martyn Thomas gave evidence to the Public Administration Select Committee to the effect that GDS are wasting their time with agile software engineering, please see Digital-by-default, an open letter to the House of Commons Science and Technology Committee (para.13).

That's one professor.

The other four – Alan W Brown, John A McDermid, Ian Sommerville and Rob Witty – reviewed GDS's Government Digital Strategy and were entirely unimpressed. "Simplistic and highly risky", they said about agile, please see Four professors review the Government Digital Strategy.

Just because GDS's staff are an alternative to the hopeless staff of DWP, Accenture, IBM, HP and BT doesn't mean that they're any better.

D&AD, the Design Museum, the Times, the Guardian, the BBC, Howard Shiplee and the NAO would all do well to consider the expert views of the five professors before assuming that GDS is the answer. In the meantime, for the sake of the £425 million lighter taxpayer, and everyone caught in the poverty trap, another reset button should be pressed. On GDS.

----------

Updated 21 October 2013

1. House of Commons oral evidence taken before the Public Accounts Committee, Universal Credit, Wednesday 11 September 2013
2. Welfare fiasco chief 'to resign'

Updated 14.4.16

In the 2½ years since the post above was written:

• GDS's all-agile system written for DEFRA's Basic Payment Scheme failed, leaving farmers to apply for their EU Common Agriculture Policy subventions using pencil and paper.
• Iain Duncan Smith has resigned.
• Robert Devereux hasn't. And he has become Sir Robert Devereux KCB.
• DWP have fought against Freedom of Information requests to publish the 2011 and 2012 Universal Credit (UC) risk register, issues register and Major Projects Authority (MPA) assessment. They have finally lost that fight.
• The MPA have become the Infrastructure and Projects Authority.
• Some of the documents now disclosed suggest that ministers and officials at DWP did, indeed, mislead everyone about the progress being made on UC. Cyber security arrangements were inadequate, the system would have been open to fraud, there was no precedent for agile being used at the scale of UC and DWP didn't even have a plan for the transition from the existing benefits schemes to UC.

UC is utterly benighted.

As to GOV.UK Verify (RIP), another fairly major infrastructure project where Whitehall keep telling us that there is only good news, indeed the system is meant to go live this month, it's decision time some time in the next 16 days, what do the MPA have to say about cyber security and the use of agile?

Nothing.

The MPA, sitting in the Cabinet Office, haven't assessed the Cabinet Office's GOV.UK Verify (RIP), even though it's meant to provide 60 million people in the UK with an on-line ID, using which we are meant to be able to transact with government.

Risk level? Unmeasured. Could be high. Could be low. The MPA don't know and presumably don't care.

Now UC IT

The National Audit Office (NAO) have published their report on Universal Credit (UC). UC is the Department for Work and Pensions (DWP) initiative to rescue benefit claimants from the poverty trap created by the UK's inept welfare system. The idea is to rescue them by making work pay.

Universal Credit: early progress is 60 pages long. 60 pages which document the unrelenting and expensive failure of DWP to get to grips with UC. There is a summary for you kindly prepared by Tony Collins – Will Universal Credit ever work? – NAO report.

By 31 March 2013, DWP had spent £425 million on UC. £425 million spent by intelligent and experienced public servants and there is nothing to show for it.

You are for sale

The Financial Times have been doing a bit of investigative journalism. Health apps run into privacy snags, they said on 1 September 2013:

Before Celeste Steenburger takes off on her morning run, she taps the orange button on the MapMyRun app on her iPhone to track the exercise. The 30-year-old office manager counts calories, logging the food she eats into a separate Lose It! app. When her menstrual cycle begins, she marks the details in the Period Tracker Lite app. With each bit of health data Ms Steenburger records, third-party companies, some with names she has never heard of, are receiving information about her.

Ms Steenburger thinks she's just dealing with MapMyRun and one or two other apps suppliers to keep track of her health. She's wrong. Behind the scenes these suppliers are selling her health data to other interested parties. The FT mention "advertising companies, ... digital analytics and tracking groups, ... health insurance and pharmaceutical companies":

The trend has serious implications for consumers. Data which an individual has willingly handed over to an app develop[er] to better track their own health, could now land in the hands of a large insurer who might use that data to set policy premiums ... iPeriod will soon have the capability to target ads at a very fine level. So a woman who records in the app that she gets headaches before her period could soon receive an ad for a pain reliever at just the right time of the month ... “By getting certain populations more active, they can reduce the cost burden for employers around those people,” says Chris Glode, the general manager for MapMyFitness. “If you can get people more active, can improve their health outcomes. That’s really cool, we’re really psyched to be part of that.”

"The top 20 most visited apps transmit information to a web of nearly 70 companies", says the FT, naming Google, Apple, Humana, Aetna and Flurry, a mobile data tracking specialist and the recipient of data from nine of the top 20 health-related apps.

That's the business model. You supply the data and the apps developers sell it. Maybe Celeste Steenburger didn't expect that but you should.

Perhaps this business model is restricted to the private sector?

No.

The public sector are at it as well.

It is three years since the Telegraph reported that the Department for Work and Pensions were paying Experian, the credit referencing agency, to analyse the data they hold and try to identify benefit cheats, please see Bounty hunters to cut benefit fraud by £1bn.

And more recently, in May 2013, the Mail told us that Orange/EE (Everything Everywhere) were selling data on their 27 million mobile phone users in the UK and that among the interested parties were the police. In the end, the police didn't buy anything but they were interested and maybe next time ...

Millions of phone records revealing age, address and even the websites you visited were offered for sale to police in controversial deal ... Scotland Yard held a meeting with Ipsos Mori about the possibility of paying for some of the data to fight crime, but yesterday the force said it was not planning to make any offers for it.

Not very convincing, you may say, the public sector hasn't actually bought any personal data from Experian or EE, and they certainly don't sell personal data.

Oh yes they do.

Here's the Guardian on 17 May 2013:

£140 could buy private firms data on NHS patients ... On Monday the government slipped out the news that private insurer Bupa was approved to access England's "sensitive or identifiable" patient data, housed centrally by the Health and Social Care Information Centre (HSCIC). It is now among four private firms that have passed the government's vetting procedures. The charging structure for "bespoke patient-level extracts" was revealed when HSCIC put up a "cost calculator" to work out how much prospective customers would pay for sensitive hospital data. The "indicative fee" for a full set of 20 years' inpatient data was about £8,000 including £140 to make the records identifiable.

It's a lot cheaper in the Mail, please see Your confidential medical records for sale... at just £1: Hunt insists plan to sell details to private firms is vital to combat epidemics - but critics fear 'unprecedented' privacy threat.

"So who cares if you’ve got haemorrhoids or athlete’s foot?", asks the Telegraph in Patient confidentiality? Not if the price is right – the answer they give is "more people than you might think". It's all that Jeremy Hunt's fault, the Secretary of State for Health, Jeremy Hunt plans to give anonymised patient medical records to private firms.

"Anonymised patient medical records"? Anonymised? Oh yeah? Mr Hunt might believe that but he's not a professor of IT. Martyn Thomas is, and he told the Public Administration Select Committee that "anonymised research data" is an oxymoron (para.4) – if the data's anonymised it's no use for research and if it's any use for research then it's not anonymised.

He is not alone in that belief, please see for example The rush to ‘anonymised’ data by Professor Ross Anderson.

"Anonymised data" must join "secure website" in your list of count-your-fingers-after-shaking-hands phrases.

Bang goes medical confidentiality. Secrecy. Privacy.

You were warned. By Stephan Shakespeare. Health data is "open data" or PSI (public sector information), he says. PSI belongs to everyone and processing it will boost the economy.

Not just Mr Shakespeare – Professor Sir Nigel Shadbolt, too. He's told you that he wants to mix your health data and travel data with anything you've put in your midata personal data store, and give the whole lot to apps-writers to improve your life.

For further information on the state destruction of medical confidentiality in the UK, please visit medConfidential. They provide a form you can use to opt out of HSCIC sales of your medical data.

You are for sale

The Financial Times have been doing a bit of investigative journalism. Health apps run into privacy snags, they said on 1 September 2013:

Before Celeste Steenburger takes off on her morning run, she taps the orange button on the MapMyRun app on her iPhone to track the exercise. The 30-year-old office manager counts calories, logging the food she eats into a separate Lose It! app. When her menstrual cycle begins, she marks the details in the Period Tracker Lite app. With each bit of health data Ms Steenburger records, third-party companies, some with names she has never heard of, are receiving information about her.

GDS and privacy

Yesterday's Sunday Times:

Google: we are beyond British law The internet giant says the High Court has no authority to rule over a landmark UK privacy claim ... “They don’t respect privacy and they don’t consider themselves to be answerable to our laws on it” ... Last week Google’s privacy policies came under fresh attack in America after it said that its 425m Gmail users could have no “reasonable expectation” that their messages would remain confidential. The admission came to light in a court filing. In its submission to the High Court, Google’s lawyers argue that any information gleaned from the search engine is not “private or confidential”. This means that the company is under no obligation to hold it in confidence, they say.

You know where you are with Google. No "reasonable expectation" of confidentiality/privacy.

Similarly, you know where you are with the UK Cabinet Office. Francis Maude, the Minister in charge, told the Information Commissioner's Conference:

Sharing data is a key enabler in our ambition to see public services provided digitally by default ...the census is another area where I want to bust the myths around the complexities of data sharing ... we aim to find effective ways of using and sharing data for the good of everyone ...

The provisions designed to limit data-sharing in government are no more than "myths", in his eyes, and will be swept away by Mr Maude's modernisation plans – spearheaded by the Government Digital Service (GDS).

You know where you are with GDS. Ex-Guardian man Mike Bracken, executive director of GDS and senior responsible owner of the pan-government Identity Assurance Programme (IDAP) has told you:

Andrew Nash, Google’s Director of Identity, ran us through the current issues facing identity.He explained how Google aim to grow and be part of an ecosystem of identify providers, and encouraged the UK Government to play its part in a federated system. The UK ID Assurance team and Google agreed to work more closely to define our strategy – so look out for future announcements. Andrew also took the opportunity to walk the Minister through the Identity ecosystem.

Which brings you back to Google and the "reasonable expectation" of privacy – there is none.

The Privacy and Consumer Advisory Group (PCAG) have worked hard to devise nine privacy principles. And ex-Guardian man Mike Bracken has asked for comments on these principles. But you have to ask yourself whether his heart is in it. PCAG is only an advisory group and GDS can ignore their suggestions.

GDS were asked to produce a version of the nine principles with numbered paragraphs to make it easier to refer to them when submitting responses to the consultation exercise. GDS agreed that this would be a good idea. That was on 20 June 2013. Two months later, and no further action has been taken since.

When GDS held their revivalist The Future is Here event back in January 2013, they got everyone to book their place through Eventbrite, a Californian firm of event organisers. A Californian firm of event organisers who now have all the contact details of 300 civil servants "working across Government and its agencies to deliver our digital ambition statement". A marketing man's dream. So much for GDS and the "reasonable expectation" of privacy.

There has been at least one submission made in response to the PCAG consultation. Compiled by Mark King, it is published in full by the great Philip Virgo. Mr King's submission is masterly and suggests that even if GDS were to agree to the nine principles our "reasonable expectation" of privacy would still be disappointed.

These are the dog days of August, no-one can be expected to respond to consultations while we are all in the doldrums. But come September, if you have any desire to protect your reasonable expectations, it could be worth making the effort to respond.

GDS and privacy

Yesterday's Sunday Times:

Google: we are beyond British law The internet giant says the High Court has no authority to rule over a landmark UK privacy claim ... “They don’t respect privacy and they don’t consider themselves to be answerable to our laws on it” ... Last week Google’s privacy policies came under fresh attack in America after it said that its 425m Gmail users could have no “reasonable expectation” that their messages would remain confidential. The admission came to light in a court filing. In its submission to the High Court, Google’s lawyers argue that any information gleaned from the search engine is not “private or confidential”. This means that the company is under no obligation to hold it in confidence, they say.

You know where you are with Google. No "reasonable expectation" of confidentiality/privacy.

Cyber security is a hangover in Vegas

DEF CON was founded in 1992 or 1993 by Jeff Moss (no relation) and is "one of the world's largest annual hacker conventions, held every year in Las Vegas, Nevada ... Many of the attendees at DEF CON include computer security professionals, journalists, lawyers, federal government employees, security researchers, and hackers with a general interest in software, computer architecture, phone phreaking, hardware modification, and anything else that can be 'hacked' ...".

Not to be confused with Black Hat Briefings, which was founded in 1997 by Jeff Moss (no relation) and is "a computer security conference that brings together a variety of people interested in information security. Representatives of government agencies and corporations attend, along with hackers. The Briefings take place regularly in Las Vegas, Barcelona, Amsterdam, Abu Dhabi and, occasionally, Tokyo. An event dedicated to the Federal Agencies is organized in Washington, DC ...".

Would you like to attend DEF CON? One young lady who attended this year gave an interview to BuzzFeed magazine that gives you a hangover just to read it: "... But I had a good time. It’s always a good time. As long as you remember most of it. Or maybe you don’t want to remember. It just kicks your ass. But once a year? It isn’t the worst thing for your liver".

She was interviewed because she was the only ovine who had appeared on the Wall of Sheep and was prepared to talk about it. The Wall of Sheep is where the DEF CON organisers display the logon IDs and passwords of everyone at the conference who has foolishly allowed themselves to be hacked.

The way our young lady put it, "... at past Def Cons, I didn't really have to worry about it, because someone else was always there to take care of it. When we would get close, he’d say turn stuff off, don’t let any of your wireless devices accept any open Wi-Fi or anything. Turn off Bluetooth, anything that connects to you. So I had someone watching out for me before, but since this was my first one on my own, I didn't take precautions".

"This 28-year-old graphic designer from Utah agreed to tell her story on the condition that we preserve her anonymity — or what remains of it", say BuzzFeed. Not a lot: "I got my alert on my cell phone [saying] that I was using too much data. I knew something wasn't right, so I started making changes when I could. I left on Saturday, so I spent most of that night and the next day cleaning up my accounts that may be associated. I totally got owned. It's just such a rookie mistake".

We might take more care of our livers but we, too, would "totally get owned" by hackers if the occasion presented itself.

Anyway, DEF CON is the nice conference and, in light of the Edward Snowden revelations, Jeff Moss (no relation) asked the feds to stay away this year. Which they did. They went to Black Hat instead, where General Keith Alexander, the Director of the NSA [National Security Agency] and Commander of the DOD's [Departent of Defense] US Cyber Command was the keynote speaker.

The general would probably have stayed away from DEF CON this year even if Jeff hadn't asked – he was keynote speaker there last year.

Presumably the feds and the hackers attend these events to size each other up. Maybe there's a bit of trading – you tell me how you did x and I'll show you how I do y. Who knows? One thing is clear, though – the rest of us haven't got a clue. Or a chance.

Hypothesis: when we hear that such-and-such website is secure, or this mobile phone operating system or that slab telecommunications facility, we might as well forget it. None of it is secure. Not for the general public. And don't you believe anyone who tells you otherwise.

Cyber security is a hangover in Vegas

DEF CON was founded in 1992 or 1993 by Jeff Moss (no relation) and is "one of the world's largest annual hacker conventions, held every year in Las Vegas, Nevada ... Many of the attendees at DEF CON include computer security professionals, journalists, lawyers, federal government employees, security researchers, and hackers with a general interest in software, computer architecture, phone phreaking, hardware modification, and anything else that can be 'hacked' ...".

Not to be confused with Black Hat Briefings, which was founded in 1997 by Jeff Moss (no relation) and is "a computer security conference that brings together a variety of people interested in information security. Representatives of government agencies and corporations attend, along with hackers. The Briefings take place regularly in Las Vegas, Barcelona, Amsterdam, Abu Dhabi and, occasionally, Tokyo. An event dedicated to the Federal Agencies is organized in Washington, DC ...".

Would you like to attend DEF CON? One young lady who attended this year gave an interview to BuzzFeed magazine that gives you a hangover just to read it: "... But I had a good time. It’s always a good time. As long as you remember most of it. Or maybe you don’t want to remember. It just kicks your ass. But once a year? It isn’t the worst thing for your liver".

Toe-curling: GDS PR Blitz

The launch of the Government Digital Service's PR campaign on the BBC and in the Guardian was noted here three weeks ago on 14 June 2013.

Last week a new front was opened up in the Times newspaper with an opinion piece by Rachel Sylvester, Geeks in jeans are the Treasury’s new heroes. Are they geeks? Are they in jeans? Are they the Treasury's new heroes? Precisely what have GDS achieved so far? What is the outlook for all their outstanding projects? Ms Sylvester left her readers none the wiser.

Yesterday, again in the Times, the PR campaign went out of control. Laura Pitel wrote Jordan Hatch: boy wonder civil servant with a plan to save £4m:

He has no university degree, no A levels and wears cargo pants to work. Meet the teenage civil servant who is going to save you £4 million ... Jordan Hatch is the poster boy of the Government’s digital revamp ... Bringing a 17-year-old on to the team was seen as the embodiment of a new, more adventurous way of thinking ... the lack of formal qualifications betrays [?] a talent for IT that began when he was barely out of nappies ... Baroness Lane Fox of Soho, recently secured him a role as young digital adviser to the European Commission ...

This ruthless exploitation of Mr Hatch extends all the way to Sir Bob Kerslake, head of the home civil service, and it smacks of desperation:

@1jh makes headlines today for having a terrific impact @gdsteam, and not a bowler hat in sight #csuncovered http://t.co/e6J1i1Hkm1 — Bob Kerslake (@SirBobKerslake) August 6, 2013

Toe-curling: GDS PR Blitz

The launch of the Government Digital Service's PR campaign on the BBC and in the Guardian was noted here three weeks ago on 14 June 2013.

Last week a new front was opened up in the Times newspaper with an opinion piece by Rachel Sylvester, Geeks in jeans are the Treasury’s new heroes. Are they geeks? Are they in jeans? Are they the Treasury's new heroes? Precisely what have GDS achieved so far? What is the outlook for all their outstanding projects? Ms Sylvester left her readers none the wiser.