John Suffolk

Update: #1 – John Suffolk to become Huawei Global Cyber Security Officer following approval by UK Government

First of all a huge thank you to the hundreds of people who have texted, emailed, and sent LinkedIn messages of congratulations.

However, as a civilian I have been chastised by the Cabinet Office and former colleagues so I have two apologies to make. The first is to my former colleagues in Cabinet Office where, due to my desire to keep words to a minimum, they are concerned that I have not detailed the full terms of the appointment. This has meant that they have had to make several calls to journalists so that they can add the fine detail into their articles… they could have just posted to this blog, buy hey ho.

As I would not wish to be party to the Cabinet Office getting a reputation for opaqueness, being economical with the truth or avoiding answering FOI requests I have detailed the full text of the appropriate section from the letter following the approval from the Prime Minister.

The second apology is to former colleagues who have asked me "what the hell am I doing going through the appointments commission process" as they are concerned that others might now need to follow where in the past many have ignored it, and the Cabinet Office have not policed it.

First of all it is worth saying that I agree with the process. It is right that when former officials leave service before they join a new organisation it is validated that the role has been given on merit and not on past official dealings. We would all agree that it is wrong for an official to have recently signed a contract with a company and then suddenly turn up in a new high paid job at that company. Just as it would be wrong that they had commercial confidential information on their competitors or had inside knowledge on a new unpublished Government policy that might advantage the new employee.

When I decided to leave Government in March 2010, I discussed this matter with Sir Gus O'Donnell, the Cabinet Secretary, and I made it clear then that I would commit to use the appointments code.

Having only met Huawei twice (although in the spirit of declaring who we have all met I did bump into one Huawei person after I had done a presentation and I told him I couldn't speak to him so that might count as the third) in seven years before I physically left; I have undertaken no procurements with Huawei, or have any commercial information on their competitors that might be of use to Huawei and as you know I led the transparency agenda on technology – so there was no advanced policy information either. The tariff, and resultant personal cost of this contact, is detailed above.

Following approval from the UK Government John Suffolk to join Huawei as their Global Head of Cyber Security reporting to the Group CEO

Under the Civil Service Business Appointments Rules, on the 22^nd February I applied for permission to accept an appointment from Huawei to be their first Global Head of Cyber Security reporting into the Group CEO, and founder, Mr Ren. On the 12^th July the Prime Minister, on the advice of the Advisory Committee on Business Appointments and following a thorough investigation of the case approved the application, subject to me waiting for a period of 6 months from when I left the Civil Service. So I join on the 1^st October.

I have to say I am both thrilled and privileged to join Huawei. As a company we serve a third of the world's population with our technology, and 45 of the world's top 50 telecommunications operators are core customers. We employ over 110,000 people from 150 nationalities and operate in more than 140 countries. Supporting this we have 20 R&D centres from San Diego to Dallas, to Stockholm, Milan, Moscow and Bangalore and this is supported by 20 customer centric joint innovation centres.

But what impresses me the most is the passion for excellence with our customers and the brilliance of our engineering. Few organisations can say that over 50,000 of their workforce are engineers that they have 7,500 people with PhD's and contribute to 123 standards organisations such as 3GPP, IETF, ITU, OMA, NGMN, ETSI, IEEE and 3GPP2. We have cumulatively submitted more than 23,000 proposals and served in 180 leadership positions including as board members in various international standards organizations such as OMA, CCSA, ETSI, ATIS and the WiMAX Forum.

So to the role. I will report directly to Huawei's CEO and will be in charge of continuously developing Huawei's cyber security assurance strategy and system and managing and supervising its implementation. The end-to-end cyber security assurance system will be adopted globally by all business groups and across all departments including R&D, supply chain, marketing and sales, project delivery and technical service. The Global Cyber Security Office will be located in Huawei's headquarters in Shenzhen, China and supported by National Security Officers in several countries, such as the UK, India, France and the USA. My role will be to ensure that our cyber security assurance system integrates end-to-end cyber security into solutions covering our cloud computing solutions, pipes/ telecommunications and all devices from mobile broadband to PDA's where appropriate, the customer-oriented business processes and the whole ICT supply chain.

Having spent 7 years in Government with the last 5 as the UK Government CIO and CISO, security was a core part of my thinking, planning and execution. We all accept that as technology becomes more pervasive and we become more reliant on technology we need to come together globally to address the challenges and threats posed by those who would wish to exploit any vulnerability in the technology.

I look forward to the challenge and working at Huawei.

Project reviews completed, moratorium holding firm, renegotiations well advanced, strategy imbedded - so time for me to leave

Sir Gus O'Donnell, the Cabinet Secretary, has announced my decision to leave the Civil Service after 7 years with almost 5 years being the Government Chief Information Officer and Senior Information Risk Owner.

the full statement is

"John Suffolk, Government Chief Information Officer at the Cabinet Office, has announced today that he will be leaving the Civil Service at the end of the year. John joined the Home Office in 2004 as the Director General leading the technology transformation of the Criminal Justice System and was appointed to the role of Government Chief Information Officer in 2006.

John made his intentions clear in March that he wished to consider his position once he had fully supported the new Coalition Government in their first 6 months of office.

John said:

'It has been a great honour to have been a civil servant and a huge privilege to have led the IT profession over the last 5 years. Without doubt we have transformed the UK into a leading user of technology benefiting Citizens and the UK economy.
 
'I am immensely proud of the way we have supported the new Coalition Government in its first 6 months and have greatly enjoyed working with Francis Maude and his team. I know that with his drive and passion for delivery the very good work we have started will continue and be a great success."

Cabinet Secretary Sir Gus O'Donnell said:

'John deserves the thanks and best wishes of everyone in the Civil Service for driving the transformation of technology in Government. His work with the CIO Council and technology professionals across Government has ensured that we are well placed to cope with the challenges that we will face. We wish him all the best for the future.'

Francis Maude, who co-chairs the board which oversees the Efficiency and Reform Group, said:

"'I'd like to thank John for his enormous contribution to the technology transformation agenda, and the civil service as a whole over many years. 'His experience in both the public and private sector has helped to make the transition to the coalition government a smooth one. The Cabinet Office will certainly not be the same without him and I wish him well for the future.""

The Government has announced the most demanding public sector spending review in a generation. In that review the ICT Strategy that we have been working towards and delivering over the last 7 years is baked in, in some shape or other: the rationalisation of infrastructures to create a "cloud" model; the continued sharing of assets and systems; the continued drive to benchmark and drive operational excellence; putting more systems online - but based around horizontal citizen and business needs; focussing more on SMEs; reducing the scale of projects; fixing our procurement processes and finally putting technology at the heart of the next transformation.

I am a great believer in renewal and as new teams enter a business, or as in our case, Government, it is important that they themselves can bring in new ideas, new policies and processes, and crucially new people. Having achieved what I set out to achieve it is time for me to get out of the way and allow fresh thinking and impetus to drive forward the strategy. I know I leave our work in strong capable hands supported by a strong capable ICT supplier community.

Back online, the ICT moratorium, project reviews and contract renegotiations, all up and running

It's good to be back online after the election break. I should have been online earlier but to be honest as you can see from the heading I have been rather busy. So time for an update on the Government ICT front. First of all the Government announced, and are executing, three things in quick succession:

1. The ICT Moratorium. Central government departments, agencies and NDPBs must not sign any new ICT contracts, contract extensions/modifications above a value of £1 million without specific agreement by the Treasury. This agreement will only be given following approval by the Minister for the Cabinet Office advised by the Government CIO. The freeze applies to all contracts and projects where ICT is a key element to deliver the service or outcome. It covers all new contracts, contract amendments and extensions, pilot projects, feasibility studies and proof of concept projects above £1m in value. No new OJEU notices should be issued to imply that new ICT based contracts will be started. There are some areas/projects that are excluded such as the Olympics and specialist defence.
2. The ICT project review, sets about reviewing all core projects. The objective is to ensure we review the majority (>80%) of all projects where ICT is a key element. This is being done in two ways: For a selection of projects above £50m (total life) the Major Projects Review Team will be undertaking an in depth review - this review looks at non ICT based projects as well. For projects less than £50m we believe that departments are best placed to undertake the initial review. Departments understand what projects they are running, why they are running them, have access to all the pertinent project and financial data and can ascertain the impact of closure or reshaping. Therefore, departments are reviewing all their existing ICT projects (those with a significant/ core element being ICT products, services either provided internally or externally) to ascertain if:

• They are key to delivering a required citizen or business outcome which is consistent with government priorities.
• They can be delivered based on their past record of keeping to time and budget.
• They will deliver the agreed outcomes and a positive financial NPV/ROI
• The project could not be done in a different or more cost effective way - By merging with other projects or significantly reducing the scope/ complexity of the requirements.
• It has a poor delivery record; is significantly late or over budget; too much reliance on external resource; poor articulation of benefits, or few tangible benefits.

  Following the departmental review my team will review the departmental actions and results. We will also look horizontally at projects across Government to ascertain if there are any further opportunities for synergy or additional cost savings. Finally decisions to continue or reshape projects will of course be subject to later spending review decisions.

The ICT project review work will feed into two overlapping phases:

1. The projects decommissioning phase. Clearly there will be a period of transition as projects are reshaped, people released, and contracts terminated or changed. As projects are closed/ reshaped this may free up officials who should be used to replace interims, consultants and contractors, if their skills match. We expect decommissioning to start as soon as practicable accepting that there is a potential linkage to the Contracts Renegotiation Phase.
2. The contract renegotiation phase. As we change projects, and therefore contracts, the sum of the project changes, by supplier, and the aggregate spend we have with each supplier will enable us to enter a renegotiation phase with ICT suppliers. This renegotiation team will include my team, OGC, Departmental Commercial Directors, Chief Information officers and legal specialists.

   However we do not envisage this to be a one way conversation. Suppliers understandably will wish us to change some of our ways of doing business, maybe standardise/simplify/ reduce our requirements or indeed think differently about topics such as risk transfer or the way our teams are structured that drive up their costs. The main focus of our Minister is in year financial savings.

Exceptions Procedure for the moratorium Clearly there may be situations where the introduction of the moratorium might go against our objective of finding cashable savings, or might put at risk the viability of an ICT organisation or indeed frontline citizen/business services. Authorised exceptions will only be considered where:

• the new spend/contract needs to be approved to achieve value for money as there will be a direct negative consequence of a delay;
• a delay would stop or directly impact delivery of a current citizen/business facing service that is consistent with the Government's priorities;
• the project/programme delivers a mandated legislative requirement where there is no flexibility on end date and the delay would significantly jeopardize the end delivery date;
• an SME ICT supplier might be put at risk of failure/collapse due to the delay in signing the contract and the contract represents good value for money.

 

So busy busy busy.

I need to go offline whilst the election is on...but one last bit of new tech my wife spotted

A married couple went to the hospital to have their baby delivered. 
Upon their arrival, the doctor said that the hospital was testing an amazing new high-tech machine that would transfer a portion of the mother's labour pain to the baby's father, without the need for any physical connection. He asked if they were interested, Both said they were very much in favour of it.

The doctor set the pain transfer to 10 percent for starters, explaining that even 10 percent was probably more pain than the father had ever experienced before. But as the labour progressed, the husband felt fine and asked the doctor to go ahead and kick it up a notch.
The doctor then adjusted the machine to 20 percent pain transfer.

The husband was still feeling fine. The doctor then checked the husband's blood pressure and was amazed at how well he was doing.

At this point they decided to try for 50 percent. The husband continued to feel quite well. Since the pain transfer was obviously helping the wife considerably, the husband encouraged the doctor to transfer ALL the pain to him. The wife delivered a healthy baby with virtually no pain, and the husband had experienced none. She and her husband were ecstatic.

When they got home they found the postman dead on the porch. 

See you after the election

The PM talks semantic web, Martha Lane-Fox, and tweaking the Tigers tail

I woke up at 03.18 with my head buzzing with so much exciting stuff. I had just spent 2 hours at the Computer Weekly 500 club talking to an excellent, vibrant group about our G-Cloud strategy. We probably could have gone on for days...thanks Bryan. This event was clearly built on the publication of our Government ICT Strategy and enabled us to talk about the opportunities and threats. My summary of the event would be that the strategy is good, we recognise the criticality of the culture change that will be required, getting SME's into the app store will be vital and that the EU procurement process, for SME's, has unintended consequences of being anti innovative and anti competitive because of the cost and time of bidding. We also discussed that the cloud provides the fundamental underpinning of other strategies such as Martha's work as without it, we will just not have the money to do everything.

The second thing buzzing around my head was how the hell did we manage to get the PM to talk about the semantic web? The hero who will have managed this (not me I might add) will have had to work across many departments and stakeholders to develop the evidence and buy-in to the suggested policy to ensure what we suggest we should do, can actually be done.

Three years ago my objective was to deliver the Transformational Government Strategy, Develop the ICT Community as Head of Profession and extend our strategies into Green ICT Strategy, Open Source Open Standards reuse, Power of Information etc etc. etc. We have strategies in the pipeline on offshoring and our standards catalogue and we will publish those as soon as they have been completed, reviewed and signed off.

Many of you might recall that the first strand of Transformational Government was "Citizen Centred Services" and this was all about putting the Citizen at the heart of what we do and deliver services on their terms, not ours.

So to see that Martha lane-Fox will become the UK's Digital Champion is a culmination of years of hard work by many people. At last the use of ICT is becoming centre stage of Government strategy with its rightful place to serve citizens (or people who serve citizens) on their terms at a price we can afford.

But tweaking the tail of the Tiger, and one of the Tiger's chums can be a dangerous thing to do. As the saying goes, "beware of what you ask for". The note from Gus to Martha makes clear the first activity is to focus on developing a digital public services strategy. In the PM's speech on Monday, the PM details what he expects to see: the creation of Mygov, which will "integrate" many backend systems such as pensions, tax credits or child benefits, and a simple approach to citizens identifying themselves to Government. This is no small feat. Neither the PM, nor Martha will take too kindly to people dragging their feet and spending their time in endless meetings talking about theory and governance, who does what, building big teams, lots of reporting, posturing and and and. We have raised the expectation and now we need to deliver, and deliver in an environment where as the Chancellor said yesterday "it will be very very tough on spending settlements" for the public sector. This almost certainly will entail diverting money from existing projects, websites, and indeed scrapping activity that does not conform to whatever strategy Martha agrees with the PM and Ministers. Many people talk about cross cutting delivery but few have done it –it's really tough - I carry 6 years worth of scars from doing this in Government.

This is a culmination of three years activity for me, and it is interesting to note that all the things we created over the last three years and spun off are now all being grouped back together again! What goes around comes around. So I look forward to continuing to work with Martha developing the strategy, and critically implementing it... I'll send one of my Tigers to all of the meetings...

Innovation - what prat thought this up? would you take a bullet for your innovation?

In times of financial strife, the word innovation, gets talked about more and more as if people think it is something that can be turned on and off at whim. We all know in reality to create an innovative environment takes time, patience, leadership and a recognition that for each successful innovation many fail.

So in late 2006, early 2007 I got to learn how innovators really work. First of all they give you snippets of what they are up to. "oh we are just thinking of putting No 10 Petitions online, all right boss?". "that thing I mentioned to you a little while ago it's going live, nothing to worry about...". "oh you know that little innovation we talked about, it seems to be causing a bit of a stir". "I need to go and see Ministers". "you need to go and see ministers".

and then over your port and lemon or snowball one night you read the national news headline "which prat thought this up". Should you get angry or pat them on the back and say right now dream up something else. The reality is if you are going to create an environment that gives people the time to think, to dream up ideas, to push the boundaries and then do something with the idea, you can't worry about the odd bullet heading your way when things don't go as people thought. This reminds me of the three legged chicken joke.

"A man was driving along a road when he noticed a chicken running alongside his car. He was amazed to see the chicken keeping up with him because he was doing 50 MPH. He accelerated to 60 and the chicken stayed right next to him. He speeded up to 75 MPH (u oh...) and the chicken passed him up. The man noticed the chicken had three legs. So, he followed the chicken down a road and ended up at a farm. He got out of his car and saw that all the chickens had three legs.

He asked the farmer "What's up with these chickens?"

The farmer said "Well, everybody likes chicken legs. I bred a three legged bird. I'm going to be a millionaire." The man asked him how they tasted.

The farmer said "Don't know, haven't caught one yet."

Rolling the clock forward three years from the launch of the e-petition site, who would have thought that the e-petition website would have spawned the power of information task force, the releasing of 3,000 data sets to the public under http://www.data.gov.uk/and applications such as the asborometer achieving over 80,000 downloads in two days, and becoming the number 1 free app in the UK iTunes App Store and also an Android Market top 25 free application.

But for people to innovate they need the space to think, to dream, to test ideas, to make mistakes, to be protected, to be trusted. Many processes in a business look to ensure each pound spent is put to good use - how can you tell when you are innovating? Other processes look to take out, or mitigate, as much risk as possible - er that's killed that innovation then! and even more processes ensure that all your resources are aligned behind delivering corporate objectives... well if innovation is a corporate objective then you are ok, but I don't see that often.

Times are going to get increasingly tough financially and this runs the risk of limiting innovation so if we are too see innovation in a business whose predominant culture is to minimise risk, then we need a few candidates to take the odd bullet or two.

Will you volunteer?

and finally as Oscar Wilde said ""An idea that is not dangerous is unworthy of being called an idea at all."

"If at first the idea is not absurd, then there is no hope for it." – Albert Einstein and

"If you're not failing every now and again, it's a sign you're not doing anything very innovative." – Woody Allen

2010 will be both exciting and demanding for the public sector...times are a changing, hold on tight, but let's be nice

As part of the Pre Budget Report, Government published a number of reports to support the Pre Budget Report. One of the reports was an update on benchmarking on back office functions and in summary it said that:

• HR must move to 1 HR person to 77 FTE from a median of 1:44
• Finance to reduce its cost to 1% of operating cost from a median of 1.4%
• Marketing and communications to reduce their costs by 25%
• ICT had to reduce its cost by reusing its systems
• Consultancy costs should be reduce by 50%
• We should reduce occupancy to 10 square metres per FTE
• Reduce the cost of the senior civil service by 20%

You can open many papers on any day and you will see references to public sector cuts, downsizing, reform... And they are right. Whether we wanted a burning platform or not, we have one, and I guess we change or burn. No news there, many companies have gone through it or are going through it. I have gone through this in a past life, when we had to transform a business due to poor financial performance, or basically close down. At times it isn't nice, or pleasant, or something you take daily joy from, but on occasions it does need to happen.

But behind the headlines, comments and thoughts, which are often written with a zeal, are people. People like your family and friends. People you care about, people you want to see succeed and be happy.

Change is a funny old thing, it's dead easy when you do it to others; we must change the process; we must restructure; we must change the ...; in reality this is all code for you must change, but I'm all right. Well not anymore.

Christmas is a coming and the CIO role is changing, but to what?

Christmas is fast approaching so we should do the annual review of what is the role of the CIO going forward.

Historically some wags have promoted that CIO equals Career Is Over, I don't accept that, world domination is still high on the agenda. I do believe that the role is changing, although I am not totally sure to what. When I look at many organisations the shape and design of the CIO role and his/her team vary enormously. It ranges from the very business orientated, main board change agent, to the traditional IT Director focussing on IT Services. It ranges from fully in-sourced, to predominately outsourced. So coming up with one design is inappropriate, so I won't do that.

However the "CIO" role is changing as enterprise IT continues to be consumerised. Not only that I think there is a move towards the CIO title being taken over by a very important person indeed – your Customer, or in my case the Citizen. Yes the Customer (or Citizen) Information Owner. This is not the marketing department who believe they own all the customer information, nor is it the salesman who historically attempted to keep all his data on his clients so only he/she could sell to them. This is the Customer/Citizen owning their own information and determining what they do with it.

William Heath has blogged extensively and passionately on this subject. I am still working through the consequences; I think I understand the theory but I have more work to do to understand the consequences across all business operations and what this means in reality. Would citizens get credit from their financial institution if they didn't tick the box that asks permission to share their data with credit agencies and organisations who want to offer you a deal of a lifetime?

So if the customer/citizen becomes the CIO what does the CIO become... time for a new TLA; How about CCO, the Chief Collaboration Officer? In our world of ever decreasing time to launch our products and services and our increasing reliance on global supply chains and a multi supplier (IT and business service) world, increasingly our roles demand substantial collaboration to get the job done.

We have always had to collaborate internally, and indeed quite a bit externally, but it is going to grow. So for now I will vote for CCO. It would be much more fun if we had the choice of four letters, and no I do not want any suggestions this is family blog.

Have a very merry Christmas and I hope 2010 is a great year for you.

Project costing why do we add in everything, plus the kitchen sink?

I have been wondering why we cost projects as we do in IT. The model seems to be we have to estimate and take into account everything: all the project resource costs; all the hardware and software costs; all the training cost; all the integration, testing, parallel running, user costs for training, loss of productivity costs when we implement. Heaven forbid if the length of the contract takes you through a refresh cycle else that will need to be added in as well.

Can you image if this was the approach to buying a house and the purchase price was set the same way: house value, all the taxes, legal fees, as well as say ten years of heat, light, maintenance. Better throw in cleaning costs as well - it just isn't a sensible thing to do.

Would it better to show project costs net of cashable benefit. So anything with a positive number doesn't look too good, might get a bit more CEO and CFO attention that way.

Of course projects with big revenues for suppliers generate their own challenges. I have always been intrigued by the end of quarter/year deals that come our way. I always ask "do you prefer to reduce your revenue or your margin?". The answer is always reduce margin. I was taught when I was running a business or a bit of a business that "growth is for vanity and profit is for sanity" and as the ICT industry continue to change, this appears to be even more true.

Imagine the scenario that you have built your business on increasing revenues, indeed the analysts that set your credit rating, or even determine buy, hold and sell investor statements look for revenue growth. Margin decline is just put down to the competitive nature of the market. It is hard for the sales team to say lets reduce revenue, when the market expectation of success is revenue growth - a catch 22? But looking forward big revenue projects will continue to reduce - I have just seen this same sentiment expressed by SAP. So revenue declines, margins have declined so profitability will decline not slowly but quickly as the big existing contracts are not replaced. This is not unique to the ICT industry and as other industries have run this particular course evidence shows it leads to consolidation and cost cutting. If revenues are down and margins are down, costs must come down else it is buy-buy business.