John Suffolk

Something for the weekend sir? A private patch perhaps?

First of all let me apologise for not being "on air" recently. I foolishly slipped a disc and caused a few other problems that laid me up over the last few weeks. I would like to say that the damage was caused by undertaking manly activities on the farm, sadly I fear it was more likely from slouching on the settee watching x-factor. Whilst lying on the floor I did have the opportunity to admire the creative genius of spiders and how greedy they are when it comes to flies. I also learned that whilst attempting to watch TV when lying on my back and wearing vari-focal glasses require the glasses to be at 45%, i.e. my left ear needs to be 2 inches higher - time was not wasted.

But now I want to introduce you to the sordid world of the private patch. For some reason this particular issue always makes me think of the song by Madness, House of Fun by Barson and Thompson.

"Good morning miss"

"Can I help you son?"

"sixteen today and up for fun"

"I'm a big boy now or so they say so if you'll serve me I'll be on my way"

Those of you who know the song, and certainly if you are male, will recognise the scenario of desperately attempting to buy one (or three) really important thing and ending up with something totally useless, and certainly not fit for the purpose you had in mind. Software seems to be just like that. You think you buy software that works and does what is says on the tin, but low and behold you have bought something that has a mind of its own and randomises it's operation.

Let me tell you a story, come close....

Once upon a time little Johnny bought three bits of world renowned software, inky, pinky and stinky. They were all meant to do their individual jobs and importantly live happily together. That's what their mummy and daddy said, fibbers - mummy and daddy didn't really know what they were on about.

Firstly inky didn't like to be used too heavily. Whilst on the tin, it said 25 people can use this together, inky didn't like this so added a "go slow" button all by itself and reduced it to 4 (i.e. it locked out each processor for "long" periods of time"). This makes 21 friends (well they were), very unhappy.

Pinky thought that was boring so pinky decided not to save all of the things you had taught it that day, but to add more spice not all the time. So when you came to use inky and stinky the following day it became a mystery tour. This was a real joy for everyone, it made coming to work really fun.

Stinky thought this was also boring. So stinky thought just when you thought you knew what he was doing, he will update himself and introduce half of what Inky does and half of what pinky does, and that way you won't know it is stinky.

Inky, pinky and stinky didn't really like each other much, and whilst everyone thought they would work together, they decided not to bother.

Little Johnny thought, well these things happen, not to worry he will telephone the technical support teams of inky, pinky and stinky and they would help him sort out the gremlins. As ever the technical support teams asked whether little Johnny had looked on the knowledge base. As you know most knowledge bases are self help groups for people with the same problem, but no answer.... and an answer never comes.

Then one of the technical support people said "oh I have heard of this somewhere else, I think we have a private patch". Little Johnny thought his night of fun is on the way but was a bit confused about what a private patch was. The nice technical support man said "well we think it will fix your problem, we don't tell people about it, and you can't use it in a live environment". Little Johnny thought that doesn't sound like fun at all.

end of story... because I am bored with it.

The reality is that individual pieces of software have become increasingly sophisticated and with this sophistication, it becomes increasingly difficult to assure quality. We have always had the issue of integrating software but it appears to getting worse not better. We might all say well that is the world we live in, and I think you are right but it has consequences. I really feel for project managers and SI's, when they take in good faith supposedly quality, widely used software and estimate/bid on the basis of time and capability. The reality is, on occasions, it turns out to be a bit of a lottery. It is also very unhelpful when developers of software do not publish the knowledge they have on problems, even if the problem might seem obscure, or hasn't really been proven as a problem yet.

And as for private patches they should be banned, as the song goes:

"I'm sorry son but we don't stock party gimmicks in this shop"

"Try the 'House of F'un' it's quicker if you run"

"this is a chemist not a joke shop"

Computer operations a real joy, is it today?

I started my career in technology as a trainee computer operator on a very old ICL 1902, one of those things that had paper tape (look it up youngsters) and you had to boot the machine by flicking switches in a certain order... She was an unpredictable beast who would, for no apparent reason, get a parity error after 18 hours of processing and you had to start all over again... lovely for the overtime and you always prayed it took you into double time.

I only operated on that machine for about 6 months before they replaced it with a beauty of a machine called a Honeywell Level 66 and she was housed in a massive computer room. This was a huge time for my personal learning and development: timesharing; real time processing transaction processing; distributed computing; a mix of a dozen computer languages. But what was even better was big computer cabinets all placed in rows and lots of flashing lights. This was important because:

Those cabinets gave us the ability to play computer room cricket. Bring in a bat, take some computer print out, screw it into a ball and surround it with sellotape – Bob's your uncle. There was a slight problem when the batsmen in his over enthusiasm to get a six let go of the bat and it crashed into the back of a computer cabinet causing a huge unsightly dent. No matter off with the door, find the brick and hammer it back into some sort of shape, if that didn't work sticking up procedures over the bump was a dead cert for a cover upJ

However the true joy was competitive computer room Olympics...I'm getting tense just thinking about it. Take two waste paper trolleys (you know the ones where you can sit in). Design a course around the cabinets, around the tape decks, consoles; throw in a few hazards like chairs etc. Split into two teams of two (as at least four on a shift) and see who can get around the quickest, cheating is allowed. We did have a slight crash in one particularly heavily fought competition. Just by the tape racks, there was a very tight left hand corner which you had to take at speed, and you must turn left else you went through the emergency crash exists which had horizontal blinds covering them. You guessed it, didn't quite might make the corner and went head first through the blinds and through the doors...down came the blinds and off went the security alarm...oops

As you can see I went through a torrid time, but it made me what I am today.

Computer Operators, does such personal development exist today?

Technology innovation, are we keeping up and does it matter?

I presented at an IT industry day run by the department of Business Innovation and Skills, on technology innovation. It kicked off with a speech from Stephen Timms, who has a background in technology, reinforcing the importance and criticality of technology to the United Kingdom. I gave an overview of the way technology is used extensively within the public sector, and then we had IT industry innovators detailing how they see technology moving forward. Microsoft presented on how they see Citizen and consumer experience changing - new ways of interacting; BT presented on The "cloud" economy – new models for service delivery; Security and cybercrime – doing business in a dangerous world was presented by Martin Sadler of Hewlett Packard; Healthcare - how our lives will change was presented by Steve Battersby, Philips; Nigel Jefferies of Vodafone presented on how everything is going mobile and last but certainly not least Iain Gray, Technology Strategy Board detailed how they are investing in the IT industry research and supporting key developments.

As ever the best bit is always the Q&A. There were quite a few comments about how difficult it can be to do business with government given its size and complexity, a question on whether Government is structured right to get the best out of technology innovation as there is no one single department in charge of this and a lot of comment on skills.

I posed a question to the audience which was "do you believe that technology and innovation is continuing to increase at a pace?" – The vast majority of hands went up. I followed this question with a second "are you or your boards keeping up with this change and the consequence of this change" – only 4 hands went up. I have asked these two same questions to thousands of people now, and the answers are always the same.

Are you keeping up, take my survey...

If not what are the consequences, if any?

The hidden treasure that lurks within a TCO

A few weeks ago I had the pleasure of spending time with about 20 CIO's ranging from multi-national organisations to local USA health providers, together with a number of CTO's from large software vendors. The subject of ROI and TCO came up in the context of which desktop model is the most cost effective in terms of justifying increased capital expenditure to enable desktop virtualisation.

I was slightly surprised that only two CIO's could state their TCO, but on reflection should I have been? The sad fact is that many organisations have lost sight and control of their IT estate. The continuous drive for new products and services at a pace that is set to beat the competition at the expense of infrastructure efficiency is all too well known by CIO's and CTO's. You only need to keep upper most in your mind that we virtualise because we have servers that are underutilised. I think the figure is still sub 10% utilisation for server's pre virtualisation. How many CEO's know they have capital tied up and not making a return? Not enough in my opinion!

So to the subject of money, ROI and TCO, which one should we focus on? One of the group, who is an analyst, and ponders these things for a living, believed that we should focus on ROI, but my view is that you need to focus on both, as TCO is an element of ROI. However there is more to this than an academic debate about method and calculation. Consider this hidden box of treasure:

TCO = SUPPLIER BASE COST multiplied by a

SUPPLIER EFFICIENCY FACTOR to which you add an

R&D FACTOR as well as a PEOPLE INVESTMENT FACTOR and the PROFIT MARGIN

Then multiply this by a RISK FACTOR (you will be seen as a risk by the supplier in some shape or form)

And then modify up or down depending on how tough the competition is or soft you areJ

Many people I talk to do not give a second thought to the overall efficiency of the supplier they are buying from and even less thought to the efficiency of their supply chain. In my simplistic view as detailed above if we could work out what the base cost of a supplier was we would modify this up or down depending on how efficient, or inefficient they were. Again we need to consider if a supplier is investing in R&D (assuming they need to) and importantly are they growing the skills of their people to fulfil the demands their clients are putting upon them. In moments of madness I do compare and contrast what salesmen are attempting to sell me (me being Government rather than me being an actual buyer) and what is actually being bid. It might surprise you to know that invariably what is bid is a lot more mature, polite for old. We shouldn't be surprised as our suppliers are full of people like you and me, all working hard to do a good job, but skilled in what the business needs today, not what the business might need in a few years time. After all would you look to sell something that wasn't your core competence and something that you were not particularly experienced in?

The red herring of the profit margin, yes red herring. Many a time I have split my sides guffawing at procurement experts haggling over a 1% reduction in profit margin, although the bulk of the TCO is in the suppliers base cost, the supplier's efficiency, the suppliers R&D etc. It's the table magician trick of deflecting the eye from the hand that is doing all the workJ finally to the final two elements, risk and competition. In terms of risk suppliers rightly have to ask themselves if the client is going to increase or decrease the risk of the project. If you give the impression of being disorganised, if you have a track record of failure, or are always changing your mind, it would be right for suppliers to factor this into their costings, after all time is money. I know we get agitated every time a supplier raises the change control card, but that is what it is there for, it is a valid control point, but be under no illusion an element of risk will be in the TCO somewhere. Finally in the TCO there is always an element of judgment in the price. Some of this is driven by how stiff the competition is. Suppliers don't bid on the basis that they want to lose. Bidding costs money, someone has to pay for it, but suppliers won't throw away a deal for a small shift in the overall TCO calculation.

That's a lot about TCO, but what about ROI. Well for me this is simple, well not that simple but we will keep it high level. Basic ROI is about ensuring that the overall benefit you are getting from the investment you are making is greater than the cost. TCO is just an element of the cost of a project but important to know if you really want to drive ROI. I have never brought the idea of an IT project; every project is there to deliver a business outcome whether it is customer driven, or internal efficiency or effectiveness. It just so happens that today a lot of projects are fundamentally underpinned by the use of IT. Our jobs as CIO's is to help the business deliver its objectives at the most appropriate capability for the most appropriate price.

The Personal Computer and Security

I don't know about you but I get a fair amount of email and reports from security vendors advising me on the current state of PC/internet security and how users of PC's are being attacked, infected, hard-done-by etc etc etc. They of course want to convince me that by using their products all will be safe in the world of the internet and the humble use of the PC – citizens need not fear anymore, that's of course if they do fear at all. So I was interested to see on the BBC website a few days ago the 'US man 'stole 130m card numbers' article the gist of which a technique known as an "SQL injection attack" (a method that involves exploiting errors in programming to access data ) was used to access the databases and steal information.

This got me thinking about a presentation I did earlier in the year to security experts.

As many people will know I tend to "plan" some of my conference presentations 5 minutes before I go on stage as this gives me the ability to judge the mood of the audience and pitch accordingly. I try not to use notes and avoid slides, especially if I am late on through the event...

I thought it would be a good idea, as I was amongst experts, to put myself in the shoes of an average PC consumer who doesn't know all the ins and outs of technology and ask for 3 volunteers from the audience to help me buy a PC from a security perspective – easy.

It was not even easy to get three people to come on stage; strangely they thought it might be a setup. Still the pitch, pause and pounce model worked well. It went something like this:

• [js] "I want to buy a PC, what do I need to do to keep myself really safe if I go online?"
• [a] "Don't turn it on"
• [js] "Where does it say that on the box... you know smoking can damage your health...?"
• [a] "It doesn't"
• [js] "Humour me, I want to go online, I like the additional light coming off the monitor in winter, what would I need to do?"
• [a] "Buy some more stuff"
• [js] "Give me a clue, where does it tell me what else I need to buy?"
• [a] "It's probably in the instructions, or you will need to go online"
• [js] "Let's assume I am online, what else do I need to do to be as safe as I can be?"
• [a] "Buy some more stuff"
• [js] "Such as?"
• [a] "Antivirus, a firewall, anti malware"
• [js] "And how do I know which one to buy?"
• [a] "You need to search, or you might get some preloaded as a trial version"
• [js] "Is there an approved standard that tells me which one is best and which one will stop most of the bad guys?"
• [a] "No, pick the one you best like the look of"
• [js] "So if I have all this working am I now safe from country pursuits such as phishing and pharming?"
• [a] "Safer, as your machine might not be patched"
• [js] "But I have this live update thingy going, so I must be safe, mustn't I?"
• [a] "not necessarily so, as live update doesn't cover all software"
• [js] "How would I know what was still unsafe?"
• [a] "you would need to get more stuff"

It went on for a little while longer and our basic conclusion was that we might have lost sight of some of the basics as we can get so immersed in the crypto space and the high tech end of the debate. When many people buy things they expect them to work after all they don't normally buy a car and then have to add all the safety features on themselves – thank heavens, so shouldn't we be getting to this position with the basics of technology?

But of course it isn't just about the PC, the PC is just a simple manifestation of a complex problem. A problem, in part, stimulated by the consumerism and commoditisation of personal technology where the internal workings hold little more interest than how the electricity grid works.

This challenge was reinforced when I was talking to a group of people who run a business helping organisations security test their systems, through ethical hacking (penetration testers) and also spend time testing new hardware and software for known vulnerabilities. They were saying that whilst the computer code they see is superb, and clearly written by well trained programmers, they seem to lack the knowledge of history – that is experience. A new widget they were testing they hacked in 5 minutes by using one of the first known vulnerabilities found some 20 years ago...

As an industry we have come a very long way but there is still more to do to make the technology we produce "human proof".

But all is not lost, technology is hugely sophisticated. I found this as proof, clearly a true storyJ

"At a recent Sacramento PC User's Group meeting, a company was demonstrating its latest speech-recognition software. A representative from the company was just about ready to start the demonstration and asked everyone in the room to quiet down. Just then someone in the back of the room yelled, "Format C: Return.". Someone else chimed in: "Yes, return!"
   

Unfortunately, the software worked

Rethinking the use of IT in Public Services

Jerry Fishenden has started a very interesting and worthwhile post concerning how IT can be used to rethink Public Services.

I covered in my previous post the whole issue of managing budgets. In essence any new CEO/Team taking over an organisation will want to ensure where money is being spent, it is delivering value and delivering against the strategy and objectives they wish to see the organisation following. It is not about IT projects, they only exist to deliver the objectives of the business. If the project, IT or not, no longer fulfils the objectives of the business it should be closed or modified.

I want to move this post onto Jerry's other point about rethinking the use of IT in Public Services. First of all a little background to help frame the art of the possible: the public services are a collection of central government departments, executive agencies, non departmental public bodies, local governments, trusts etc, i.e.

There are over 750 NDPB's (as at 31/03/2008). There are 423 local authorities who make up the Local Government Association and cover every part of England and Wales. Together they represent over 50 million people and spend around £113 billion a year on local services.

In health they are responsible for the provision of health services through the NHS. These services are delivered locally by 1.3 million staff in more than 300 organisations and through approximately 5,200 GP practice premises, as well as other primary care services. These services are in contact every day with over 1.5 million patients and their families.

In education there are over 24,000 schools, supported by over 400,000 teachers.

The Police as at 31 March 2009 had 243,126 full-time equivalent (FTE) staff working in the 43 police forces of England and Wales.

I could go on...

They are governed differently; they have their own agenda's and strategies and those strategies and local decisions have shaped their own IT strategies and their own IT functions. Many will be outsourced; they will use every kind of architecture, vast amounts of differing hardware and software, some home grown, some COTS. Much of this is selected by the supplier not the public body as public sector European procurement rules enforce non discrimination which means that you cannot generally specify a product or brand-name but must specify the outcome you wish to achieve.

Jerry said "...there is a more fundamental question about the effective configuration of government itself to be considered". So what is the question?

Are we configured correctly? If not what should it be? Will it be better or just different? Is it possible? How long and how much would it cost?

Is the balance right between localism and centralism? What do we mean by local when services are provided over the telephone or the internet? Given the already devolved nature of public services will there ever be one perfect model? \if not what should the models be?

... add your own question...

So given the high level description of Public Services I have provided let's talk strategy, Information Architectures, Enterprise Architectures. Jerry wants to develop "a left to right integrated set of IT building blocks to underpin public service delivery right across the board...", so do I, but first of all what do we mean by underpin? Does this mean every public body is mandated to use them, or will it be optional?

Public Sector Productivity vs. IT Investment

Jerry Fishenden has started a good debate on his Microsoft blog having mapped the recent ONS public sector productivity data against IT spend and he wonders why the investment in IT does not appear to have positively impacted the productivity data. 

 

I am not a statistician but I did ask one for her telephone number once, and she gave me an estimate. So I will leave it to Public Finance, the Times, and the FT to apply their forensic analysis but what they all say is this productivity link is hugely complex and fraught with issues but does pose many questions.  However Jerry’s point that we should not be spending money if we cannot be certain of creating value is an extremely valid one and one that I whole heartedly support. 

 

Some statistics that Jerry didn’t print;  IT spend in the public sector is c4.6% of total public sector spending according to the Operational Efficiency Programme (pp48, 4.5) undertaken independently by Dr Martin Read.  If I took Martin’s most pessimistic figure on IT spend it would push the overall percentage up to 5.3%.  Following benchmarking undertaken by Gartner, a leading analysis and benchmarking company, they state that their global average is 5.9%, EMEA private sector is 7.7%, and the Gartner benchmark for 232 Government departments (63% USA, 16% Asia Pac) is 6.8%.  My budget is 0.068% of the £16bn.

 

The £16bn that is quoted is not held or controlled centrally but is allocated across the thousands of Public Sector Bodies.  These same bodies also run their own project portfolios. 

 

Jerry is proposing two strands of work.  The first strand is “working out which current ICT related to public services should be frozen, which fixed and which failed (and scrapped).”  Absolutely, but it isn’t about IT, it is about what the project is meant to achieve in terms of outcome – transport, health, education.... So this should be a business review first. What is the purpose of the business?  What does the business deliver?  Is it still required? Is what is required being delivered in the most optimum way etc etc etc.  Clearly from this any projects, or units, that are no longer required can be closed down, modified or redeployed to more important areas.  Jerry says “this is the short-term tactical view of how to better optimise the existing ICT assets (and liabilities) of the public sector”

 

It would be right for any new CEO or team taking over a business to undertake a review and make changes, after all that is why they have invariably been appointed.  Some decisions will be able to be made quickly.  Others will need to be taken once the analysis has been done.  We should not see this is a one off process, but a continuous process of ensuring that what is being invested in is still appropriate and indeed the investment will deliver the expected benefits.

 

Jerry restates two options for cost cutting.  The first being a dramatic cut in IT costs, with 50% being suggested, the second being cutting the administration and overhead budgets of departments and letting them decide how they will spend their money.  This seems hugely simplistic.  First of all the IT budget is a budget of the business. The CEO/Accounting Officer should be allocating the money to deliver the agreed business objectives or policy outcomes.  So if the objectives of the business indicate they can cut the IT budget by 50% so be it.  This is not new, this is business.

 

The second option of cutting the administration and overhead budgets again happens today.  In reality there will not be one single solution applied by a new CEO/Team, they are always likely to adopt a blend of approaches:

 

· First of all they will look to be very clear about what needs to be achieved.  What objectives do they wish to achieve, over what period of time by area of the business.  This needs to be as crisp and as specific as possible

· Based on the above, it is common for a review to be undertaken to ascertain whether what is happening today matches the new requirements.  This is both a tactical review and a strategic review.  It is right for things to be realigned, pruned back, stopped, undone, accelerating and new things added to the portfolio.

· To get the best results the CEO will wish to ensure that there is line of sight from the setting of the objectives through to delivery.  He/she will want to ensure that governance is clear and ensure that accountability is clear.

 

Jerry has a s second strand “working out where and how technology now plays a key role as a policy lever, enabling a fundamental re-think and re-design of our public services” and makes a crucial point about the configuration of government in his post on rethinking the use of IT in public services, I will deal with this in a second post

The Future of the IT Industry

Following on from recent blogs, publications and presentation on the Government’s IT strategy I have been asked a number of times what my thoughts are on how this will play out in the IT industry over the next ten years.

A very interesting question and a difficult one to answer, when you are looking out ten years, but here are a few thoughts.

I think we are all in for a shock, a big shock because IT and service provision will be dramatically different and I’m not convinced the IT industry is facing up to the new reality.

Consider a world where:

·         The concept of desktop disappears as a predominant model, as most people are either using a mobile device connected into a cloud or an ultra thin client device at the desk (wherever that might be).  So little revenue & margin from the hardware, the standard software, the design etc.·         Payment comes from infrastructure as a service as well as software as a service.  If you have something that people want, the quality is good, the availability is good and the price is right you might get some business.  If you don’t you don’t get the business.

·         Things like ERP become a sequence of transactions.  You buy the transaction not the ERP; you can construct these transactions to form your own ERP or process.  It’s online self selection and configuration.  It’s predominantly open standards based, lots of people can play.  Gone are the days of big software licences, big rollouts.  There will always be some but you have to question the old, or is it current SI model, where they develop a repeatable rollout model for an ERP, yet the client pays as if there is no retained learning.

·         The number of data centres will be dramatically reduced.  The Green IT agenda, the utilitarian nature of computing, the cloud or G-cloud concept all leads you to less being more.  Dramatically optimised to maximise the compute, storage capacity and security capability for the lowest economic and environmental cost.  So not a lot of people who can truly operate in that complex market and make a positive margin.  Maybe the players you think who do data centres today won’t be the ones who do them in the future?  Maybe the players of the future are more engineering based; understand physics, electricity and how to sweat the asset.  Now there is a term that I don’t hear suppliers talking much about today... they will in future

·         Public and private clouds will be pervasive.  We will have cracked the software provisioning, cloud-to-cloud migration, dynamic application and data shifting (and data locked to a location), the prioritisation and the billing.  The Application Store approach will also be the norm.  So no more getting the client to pay for you to build customised code and then you selling it to other clients.  The code is built, the client publishes it and they take any revenue for other use, not the software developer, consultancy firm, SI etc. 

·         The combined cloud model and the application store opens up the IT market.  Now SME’s don’t have to worry so much about infrastructure, security, provisioning.  They have avenues to publish their software, deal directly with clients, not through larger partners.  They can get access from the application store if open source, to other products that enable them to enrich their offerings.  The SME’s no longer have to rely on the crumbs off the table, as size (honest) won’t matter as much.  What will play out will be a battle of product; intellectual property; agility to solve the business problem at speed and at a price that is much lower than the value that is being created.  More players in the market resets where the revenue will go.  More competition equals lower margin.  Lower margin plus a high cost base is not a recipe for long term success.

 

So those operating on the IT world will need to decide what their true competences will be.  Where can they shine and get recognition for being outstanding.

I’m in the IT industry, IT functions are in the IT industry, and CIO’s are in the IT industry.  It isn’t just suppliers who will be impacted.  We all will be.  Are we prepared?

 

UK Government combined CIO & CTO Council Meeting

Last Thursday and Friday (2-3 July) saw the summer combined CIO and CTO Council meeting.  About 70 CIO's and CTO's got together for one of our regular sessions to review progress and agree the next steps of our approach and strategy.

We had the pleasure of Sir Tim Berners-Lee and Professor Nigel Shadbolt for Thursday evening.  They both put us under pressure, which we quite liked actually, to free up our Government non personal data.  We duly obliged by writing all the data sources we could think of that we could publish on napkins!  Nigel is currently ploughing through the list.  He did tell me within 2 days he had received his first data source.

The main session was all about reviewing what had happened since we last got together and what we need to do next.  We discussed the latest on the Operational Efficiency Report (OEP) and how pleased we are that the core recommendations are perfectly aligned with our existing agenda; we discussed the Digital Britain report and again how it gives an added impetus to what we are doing and then we went on to spend the day determining what we will do next.

The session was quite simple, but also a little profound in many ways.  In groups of ten ish I asked them to answer two main questions:

1). What decisions do we want the combined CIO/CTO council to make today so that when we leave this room we have collectively agreed on our next set of actions to deliver the Transforming IT Strategy; the Operational Efficiency Report; the Digital Britain Report and all our sub strategies that have been published to date.

2). what decisions... (as above text) but where we need a little more time to agree the consequences/ ramifications.

After  90 or so minutes we went table by table and each table asked their colleagues if they agreed with their list... and they did.

So in a nutshell (more details will be published on the Cabinet Office website

www.cabinet-office.gov.uk

when we have the minutes agreed) we agreed to publish raw non personal data as a default (some things still to work through on a few data sources); the adoption of standard desktop models with set designs and price points; the full adoption of the Public Sector Network; the rationalisation of data centres; some slight enhancements to the open source, open standards and reuse strategy; the creation of a private Government Cloud “G-Cloud” as well as the creation of a Government Apps Store (“G-AS”); to ensure we fully resource these activities; to deliver more “Crown” software agreements... and much more.

Part 2, I simply posed the question are we solving the right problems.  Is what we are planning to do the right thing if you look forward 5, 7, 10 years etc.  That was even more profound, but I am still working through the best way to include the thinking in our strategy.

Government Cloud

I have started taking part in a forum to do with Cloud computing and posted this item to answer a few questions. it builds on my previous posting on Digital Britain.

I thought it might be worth just detailing the approach we have been following over the last 3 years to set the context: Sorry it is a bit long.

The strategy has ten strands:

1. Standardise and simplify the desktop. Stop reinventing the design wheel, commoditise what should be commodity. Drive down price, drive up
2. Standardise, rationalise and simplify the plethora of networks. Build with the telecommunications industry the "Public Sector Network (PSN). An open market approach to joined-up secure networking for the Public Sector. Secure, ubiquitous, service model based and a price some 30% lower than we pay today.
3. Rationalise the data centre estate. Most are outsourced but they are in scope. Reduce from the central government 130+ to c9-12. Design a data centre eco system that is scalable, secure, green and economical.
4. Deliver against the Open source, open standards and reuse strategy I published in February. Buy at the "crown" not at an individual public body; treat proprietary software the same as open source (as in it should be available to all Public Servants); level the price comparison so full entry and exist cost to use the software must be taken into account. http://www.cabinetoffice.gov.uk/cio/transformational_government/open_source.aspx. Let me have your thoughts via http://writetoreply.org/ukgovoss/.

Surrounding those four elements are two "wrapper" strategies:

1.  Green IT: For each of the elements detailed above they have a Green IT wrapper. I published this strategy in June 2008. You can read it at http://www.cabinetoffice.gov.uk/cio/greening_government_ict.aspx. Each of the elements must conform to our Green IT strategy.
2. Information Security and Assurance: We published a National Information Assurance Strategy in June 2007 and the Data Handling Requirements in June 2008. Together with the Security Planning Framework that was published a few months ago form the basis for our information security requirements. I chair the Information Assurance Delivery Group and are accountable for helping Public Bodies conform to theses requirements, so security is uppermost in my mind.

This is where Government Cloud or "G-Cloud" comes in. With the elements detailed above we can begin to start the design and thinking about the establishment of a UK onshore, private G-Cloud. In essence infrastructure as a service, middleware/platforms as a service and software as a service. In relation to Saas I can’t see any reason why we couldn’t establish a Government Application Store ("G-AS" for want of a better code).

These six strategic elements have four other supporting strategies:

1. Shared Services: This is about ensuring that wherever possible we share everything... not just HR, Finance etc, but architectures, designs, solutions, people etc. We have moved from few users of shared back office services 3 years ago to many hundreds of thousands. The G-Cloud moves this thinking forward so rather than departments hosting a shared service for others, the applications are put into the cloud and saas kicks in. 
2. Reliable Project Delivery. This is all about starting the right projects, executing them to successful completion and crucially delivering the social outcomes and business benefits. We have already made substantial progress in ensuring central government departments utilise portfolio management and best in class benefits realisation processes.
3. Supplier Management. Central Government is c65% outsourced and therefore having professional skills to deal with suppliers and having the most appropriate relationship with them is important. In this supporting strategy we have already worked with the ICT trade association, Intellect, to add additional tools to help the procurement process as well as implementing a Common Assessment Framework where assessment are made of projects undertaken by suppliers against a Common Assessment Framework! All the projects for a particular supplier are aggregated together to give insight into strengths and weaknesses. Action plans are then developed. The suppliers also provide feedback on the client in a similar way
4. Professionalising IT Enabled business change. Last but very much not least, the bedrock in fact, is growing the knowledge, skills and experience of our IT Professionals for which I am the Governments Head of Profession. We have about 50,000 IT professionals in the Public Sector. This strategic strand focuses on using the Skills Framework for the Information Age as a competency model for our ICT professionals. It is about personal growth and capability.

So in as few words as I can get it, this is the ten strategic strands we are following. They all work together and are all driven via the UK Government CIO Council. Some are more advanced than others, and clearly sitting beneath these strands is a whole lot more work and detail.

The posts also talked about language and getting that right and consistent. I couldn’t agree more. I seem to spend a fair amount of my time doing two things: firstly acting as a marriage guidance counsellor – bringing parties together; separating them when they are fighting; getting them to use the same words to mean the same things etc. The second thing is one of dating agent – someone has a problem and I date them with someone who has a solution. Key thing about language here is that we tend to apply a lot of labels to our problem and the solution provider uses a different set of labels for their solution. There is no easy fix to the language issue, but the more we talk, and listen (in at least equal quantities) the better.

Someone asked the question is the 2mbps a barrier. I can’t see any reason why. If we look at what many people do in their day jobs they don’t need 2mbs today. UK Government online transactions have increased enormously over the last 3 years as almost all services went online. The speed hasn’t been a barrier so far.

The final point was to my question about the Government Application Store ("G-AS"). The Public Sector will own many computer applications. To get full value, these could be moved into the G-AS. I think the Apple App Store is truly innovative and again for me creating something similar has attractions of speed, simplicity, innovation, cost effectiveness etc. I am still mulling over the points on certification of apps on the basis of if I can secure the infrastructure (and run the app in a virtualised world to protect the rest of the cloud), and the commercial model is say saas, if it doesn’t work should we care?

One final question for the time being. We are at the early stages of our thinking as you can see from my mutterings. Would it be possible to design a Government Cloud and a Government Application Store in a web 2.0 environment bringing in communities to detail the requirements, think though the issues, the designs and solutions etc?

Thoughts and comments welcomed as ever.