John Suffolk

So what are we to do with our cyber security challenges, more talking and finger pointing, or some positive actions?

Thank you all for your feedback on my previous posts – LinkedIn is a marvellous email system. Let me summarise as best as I can the comments. First of all there were those of you who said I am a crazy man and need locking up for suggesting such terrible things; then there were the group of you who said I was an idiot for not recognising how far America had really gone and that "I don't know the half of it". Some of you were kind enough to send me copies of competitors sales manuals, one a particular favourite with a title that says is all "piranha" – all the things you should say to stop Huawei winning business, and another document from another competitor who detailed why customers should never buy Huawei equipment because someone had found a vulnerability, I had seen that one before. Some said China must stop being bad and a similar number said America should stop shouting. So it is good to see that I am creating a consensus.

So what should we do? At some point the world is going to have to work together. It is going to recognise that all of us have a role to play in reducing this threat:

• Governments have a role to demand better security from their vendor's products. If a vendor's biggest customer never asks for security or what they ask for is weak and feeble, that is what they will get.
• Vendor's have to demand more. What does good look like? What are the standards? At the moment the problem with standards is that they are not standard. There are a plethora of overlapping standards, few standards have any sensible measures of success and they are not always accepted around the world.
• Shareholders must demand more. The Mandiant report could have gone further, was there any material loss? I am assuming no as the Boards would have stopped the work, unless of course you had replaced your sensitive material; Mandiant could have detailed what was it that caused the breach and did all of their customers execute best practice; they could have also been their own masters, to omit other countries who were up to no good politicises a report and gives those that need to change their behaviour a cop-out.
• Boards must demand more. My insurance won't pay out if my car is stolen because I leave the keys "unsafe"; my bank won't pay-out if I don't take care of my pin – these are seen as stupid actions. We must recognise not patching has the same impact, not adopting the top 4, or 20 or 35 mitigating actions is just stupid. Verizon say 85% of the breaches could have been stopped if we did the basics, yet we don't. Do not get me wrong – theft is theft and it should not be condoned, but we also have a personal responsibility in technology as we do in other walks of life.

Technology is not going to get simpler; the challenges are not going to get simpler so we need to think differently, how about:

• All countries allow sensors to be placed on entry and exit points of their networks so we can track and trace and begin to fix the attribution issue;
• If a country such as America has technical gubbins that can detect, deflect or stop malicious activity let's share it, all of us share our knowledge to reduce the threat
• Why don't all technology vendor's (who after all have caused the problem) put a percentage of their revenue into an R&D pot solely for the use of defensive technologies
• Let's forget personal privacy (eeck I sense a deluge of emails), the reality is if you are online you must be known and data will be shared for the purposes of crime prevention and detection

We should all be worried where you are seeing more and more countries suggesting they give their intelligence or law enforcement agencies the ability to penetrate, attack or disrupt technology in other countries – where will this end? Whilst many of us accept the www is a bit of a wild west this potential move by Nation States takes us to a place where there are only losers. We need to agree a moral, and legal, line in the digital sand that we should not cross. In this context the creators of Stuxnet did us no favours as in some people's minds it legitimised the use of offensive cyber activity – if it is right for you, you cannot complain if I adopt a similar behaviour.

You will have your own thoughts and ideas. We need to see leadership around the world of people who want to collaborate, who want to work on solutions and who want to take a long term strategic view whilst doing practical things to improve the situation today. In this context the talks between America and China are a good first step which we should all applaud and support.

Should Politicians or Government Officials personally gain from their public position? Is perception reality?

I came across this survey analysis which stated "Americans Are Pretty Cool With Politicians Cheating on Their Spouses As Long As It's Not With A Prostitute" but I couldn't find a question about would they vote for them if they, or their family, were perceived as personally gaining from their work in public office.

As many of you know when I left Government I went through the standard review process before I joined Huawei. The review process sets out to ensure that I did not get my new job on the basis of doing my new employer a favour, i.e. I granted them a big fat contract. It also ensures that I had no advanced policy knowledge or knowledge on one of their competitors. Whilst the process is painfully slow, it is the right process. Officials or politicians should not gain, or be seen to gain from their official position.

The civil service code also talks about being perceived as being in breach even though you might not have breached any actual rule. I think you would agree this is a much tougher requirement, but perception is reality.

I was therefore very dismayed to read an article concerning a very influential American politician who is giving the impression that he (or to be accurate his wife) might be gaining from his position. Let me be clear I am not suggesting any wrongdoing has occurred just that this behaviour might send the wrong signals – I accept my values are just that, my values, and you might have different and equally valid views. The article Oh Look, some politicians Wife Stands To Benefit Greatly From CISPA Passing... analyses the links between a husband and wife and the perception of personal gain by the fervent pushing of a particular bill.

Now I must declare an interest. This particular politician is on the whole aggressive towards my company and frequently cites lack of transparency. He holds an important position, a position that is influential for the future success of America and whether he, or his wife, likes it or not, perception is crucial. I have no difficulty if people hold different views to my own; I have no difficulty with others having a different set of values and beliefs to my own, but I think we all want people in public office to work to the highest possible morale and ethical standards. I know this in its own right creates an inherent conflict: if no laws have been broken and your values say this is acceptable how are you to know others might perceive it as inappropriate. It isn't easy being in public office.

You can form your own views on whether you think there is a conflict of interest or indeed whether as the article puts it this is "soft corruption", but for me I always worried about creating such perceptions when I was in public office, and more importantly so did my boss and other colleagues. We do not allow this in the UK Civil Service or indeed with Ministers; we certainly would not allow this in Huawei where every year we have mandatory (re)training on Business Conduct Guidelines and we have to pass an online exam to make sure we understand the rules.

Politicians and Officials have to work to the highest levels of transparency and integrity and this does sometimes limit what our families can do. But this is the decision we make when we take up these important roles.

Mr President, we like buy American, Mr Prime Minister we like buy British, would we equally like China to introduce buy Chinese?

It seems absolutely right that countries should promote their industries, promote their companies and encourage people to buy "local". We have Buy American, buy British and probably lots of others. I know there was talk of buy European. However I haven't heard of China promoting a "buy Chinese". I know if I have a choice I favour British first, European second.

When countries introduce their buy local campaigns – in America the Buy American Act was passed by Congress in 1933 - no one assumes that this is a protectionist measure. Quite the opposite we all see this as something patriotic. So there can be no complaints should China introduce such a measure: Buy Chinese technology, buy Chinese cars, buy Chinese clothes etc.

It would be interesting to see an analysis of where countries could be self-sufficient.

Mr President we spend more than 2000 times per person on defence than China but we cannot defend our defence networks, is it true?

Dear Mr President, I have some bad news for you. I know in 2011 we spent 58 percent of the total defense dollars paid out by the world's top 10 military powers and we outspend China, the next-biggest military power, by nearly 6-to-1 or over two thousand times more per person on defence than China but we cannot defend our defence networks. What's more I think we should tell the world we cannot defend them and let us be at the mercy of these heinous hackers.

Doesn't sound right to me, but actually this is what America says, but is it what it seems? I cannot imagine being back in Government and taking this as policy advice to a UK Prime Minister, rightly they would think you are bonkers and dismiss you in more ways than one, so we need to look under the message and work out what IS being said but more importantly why.

In terms of facts America does spend c58% of all worldwide money on defence and it shows. Their capability is second to none – they are THE force to be reckoned with, so why do they claim to be so defenceless? Several possible reasons:

• The first possible reason is one of deflection, sometimes when you are being criticised for the legality of your drone programme, or you are struggling to agree a budget (again, and again) and you are not seeing the growth and improvements in economic prosperity you need, you need something to get everyone focussed on – a bogeyman helps;
• The second possible reason is in a country where Corporate America wins over politics (otherwise politicians do not get re-elected), and Corporate America is driven off profit and Corporate America is also driven off individual greed, anything that gets in the way of these objectives does not make progress. How do you convince Corporate America to make the necessary security improvements – you nudge them in the right direction by driving up the fear
• The third possible reason is it might be true (but words matter)
• And finally another possible reason maybe that the USA is executing a strategy that: drives Corporate America to undertake the necessary security changes; drives Corporate America to bring jobs back home, especially from China by creating such a poisonous atmosphere about China (in this context Huawei is just collateral damage); and the USA looks to slow the economic growth of China outside of its own border and finally it sets its defence networks up as one huge honeypot.

I have written above that words matter, and as no one would want to be caught out lying when America says its defence networks are not defensible (or derivatives) it is true. What it doesn't say is that America is not defensible. All that the American Government and Military are saying is that they have moved their defences into the private sector private network infrastructure. If you think about it, it is quite obvious that to attempt to re-engineer the architecture and rebuild 15,000 separate defence networks is a monumental and thankless task. Why not just agree with the American Telecommunications Operators to install additional defences in their networks so before anything gets to Government, or military, it has been vetted and cleaned etc. Maybe this is why America doesn't want us to sell our equipment to American companies; maybe they will worry that we will see what they do with American Citizens personal data, monitoring and storing of everything that passes through telecommunications.

So why the mention of a honeypot? It's quite clever really. You have just reduced your threat landscape to probably less than 30 network points (just count the undersea cables going into America etc.) and you broadly have less than a handful of telco's, so put on those access points an array of sensors and other top secret gubbins that the USA has spent all of its defence budget on and low and behold you have created a veritable gold mine of information, and a lot of response options – more of this in a future posting.

Just to finish, have you ever asked yourself the question why Governments chose to activate legislation at a particular point in time. You could get the impression that all of these cyber security laws in America about information sharing are about a future requirement, really? More likely the kind of scenario I have detailed above has already created a law breaking situation and these new laws are there to legitimise what might have been happening already – not saying it has just might have been…

Just do four things and stop up to 85% of intrusions states Australian Security Intelligence Office - but do they take their own medicine?

I read a very wide ranging article quoting amongst others David Irvine who is the Head of ASIO, the Australian Security Intelligence Office and it details that

"The ordinarily shadowy DSD has published a detailed study on its top 35 cyber "mitigation strategies". In research that won the 2011 National Cybersecurity Innovation Award in the US, DSD found that 85 per cent of intrusions were thwarted by its first four mitigants alone.

DSD's Mike Burgess recalls that "a few years ago, one of my staff assisted ASIO in responding to a major incident on the network of one of Australia's biggest companies. The first thing he was asked by techies from the affected company was 'what can we do to stop this?'. "As legend has it, my staff member wrote down a list of things to do on the back of a cocktail napkin [which became DSD's] flagship document.""

So, on the back of a cocktail napkin, which I guess is a step up from the back of a fag packet four things that can stop up to 85 percent of intrusions are known, and so well known it didn't take an army of officials, experts et el… just a man (clearly talented), a writing instrument and a cocktail napkin. I might be wrong but I think this list was first published in 2010 (happy to be corrected) and was recently updated.

The question is does Australia or any other Government mandate these four things? When I asked Mike Burgess just over a year ago he said that Australia didn't mandate these items, I could find no evidence or confirmation that the position has changed and if it has not changed why not? If the 85% figure is correct and the USA validated this research why hasn't the G8 or G20, or the EU mandated this?

The article goes on to say how the ""target environment" is becoming richer by the day as our electricity, power, transport, and communications infrastructures are inexorably integrated into the internet" so you would think that there would be greater motivation to protect Federal Government as well as providers of Critical Infrastructure, especially as Irvine goes onto say:

"Electronic intelligence gathering is being used against Australia on a massive scale to extract confidential information from governments, the private sector and ordinary individuals," he says.

"It is used to steal intellectual property, all kinds of defence secrets, weapons designs, and commercially advantageous information. The security threat presented by the exploitation ... of the cyber world is both pervasive and insidious. It is ubiquitous and is enabled by what we would normally expect to be a great social and economic good – technological advance."

Governments around the world are calling for more data to be kept on their citizens (just look at the USA, the EU and Australia), but I do not see any mandatory action and standards on what Governments can do to protect themselves. Even this article states:

"Irvine argues that "the ability of the private sector and governments to protect the personal information of their customers and clients in accordance with modern privacy laws is called into question by the apparent ease with which hackers have been able to break into data banks around the world".

Attorney-General Nicola Roxon has referred the proposals to the Parliamentary Joint Committee on Intelligence and Security. She recognises that a signal issue remains – "whether the government needs to obligate the telecommunications industry to protect their networks from unauthorised interference"."

If the Australian Government (DSD) alone is quoting $4.5bn as the cost of cyber crime then Governments must take their own medicine and mandate the top 4 items to stop up to 85% of the intrusions. Governments and the technology community must collaborate and jointly invest to invent technologies that can mitigate the remaining 15% accepting we can never stop the ingenuity of man from doing something stupid. Surely if ever there was a business case that was compelling then this is it.

For some strange reason this article appeared to be quickly moved or updated as original links failed. If the link above does not work I have a copy of the full article if anyone is interested.

A conversation with the founder of Huawei, Mr Ren Zhengfei, on supporting over a third of the planets population and cyber security

As many of you will know when I left the UK Government as the Government CIO I joined Huawei. Some saw it as a mildly controversial move but those of you who know me knew that this is exactly the kind of company I would join. A company that is shaking up the world in terms of technology, a company committed to science, engineering and R&D, but fundamentally a company whose passion is for its customers and their customers to make the world a better place through the use of technology.

I have just completed my first year at Huawei and the boss was grilling me to see if I was a good hire and check whether I had actually done any work. However, when Mr Ren talks he has a hugely strategic long term view of the world, of Huawei, and the challenges and opportunities that we all face. With his permission I thought I would share some of his views from the meeting.

I have reprinted some of his thoughts in italics below;

When your technology already supports in some shape or form 3 billion citizens and you are used by the vast majority of the world's largest and most sophisticated telecommunications companies across 140 countries you have a real duty to keep the lights on and the data moving regardless of the situation.

Mr Ren raised three core points. His first point was:

"The ultimate social responsibility of network equipment vendors is to maintain the stable operation of networks in any circumstances."

"We are engaged in providing information networks to society. The global network needs to be stable at all times. In service to society, the whole industry must focus their energy on ensuring a stable and secure network in any circumstances. This is the ultimate social responsibility of all network equipment vendors, and this is what we have been doing all these years. In times of disaster such as armed conflict, earthquake, tsunami, plague, and nuclear contamination, we have maintained the security of networks by challenging ourselves."

Nice words and I guess many would say the same thing but it is only when you know what it takes to achieve this can you really appreciate the commitment to the phrase "… a company whose passion is for its customers…":

"In the 2008 Wenchuan earthquake, communications services in the quake-stricken area broke down completely. Our Chairwoman of the Board immediately established a work team and chartered four airplanes to Chengdu….

…To provide emergency communications and facilitate coordination, the rescue forces used helicopters to transport our base station to the mountain top in the quake-stricken area; the base station was set up to form a temporary communications network together with antennas and satellites…

…Our employees deploying the base station on the mountain top had to work in the rain and sleep on the wet ground at night. In the mornings, they went down the mountain to fetch diesel oil for the generators. The arduous hike took 4 to 5 hours back and forth…"

Mr Ren provides other examples of ensuring we deliver our commitments to our customers in the most extreme of situations, In Indonesia, in the Libyan conflict, to the terrible earthquake, tsunami and nuclear issues in Japan. It is a feature of a special person where their core value is one of supporting others in the good times and the very very bad rather than focussing on money, personal gain and competitive advantage.

Now why do I tell you this? Well cyber security is a challenge to providing information networks to society. There is not much point in doing a great job in a natural (or unnatural) times, if you do not have the same passion for solving problems that can cause your customers technology to fail, i.e. the cyber challenge which we all face.

His second core point concerned the loss, or theft of data of all kinds and he was quite emphatic in his view that:

"Information leakage is first a legal and social issue to the international community; then it is a technical issue, which requires concerted efforts of society and the entire industry"

We frequently talk and plan for the ever increasing growth in data from all devices to all other devices. Mr Ren is quite clear that it is not possible to develop an absolutely impenetrable security assurance system that can keep information flowing securely just as it is impossible to guarantee that water remains in the banks of the Mississippi or the Amazon rivers, especially as information technology is advancing more rapidly than the technology industries capabilities in cyber security.

His final point which he made very clear was his commitment to ensuring that we continue to enhance our policies, procedures and approaches to cyber security within Huawei and within the industry overall:

"We are determined to make internal adjustments to ensure that our equipment is the most secure, transparent, high-quality equipment in the world"

As we all know if it isn't important to the big boss in a company then it will not be important to anyone else. As you can see from his notes, which reinforces his cyber security policy, which you can find here, he is quite clear on what we must do. We must:

• Make sure that whatever technology we develop is transparent so people can inspect what is passing through the system in terms of potential cyber security risks;
• Crucially lead the strategic thought processes encouraging telecommunications vendors to think of their customers first by ensuring that our hardware is interchangeable as much as possible. This means a customer can mix and match hardware with vendor software, not only giving capital investment protection, but once again reducing the risk of potential vulnerabilities being included somewhere in the technology stack. Let us just stop and think about this statement – interchangeable hardware! Giving customers choice and protecting capital investment! All too often we see vendors trying to stop competition under the false banner of cyber security, and yet here we can see the commitment from Mr Ren to openness, competition and transparency – I know who I would buy from.
• Layer the operating system, vendor specifics and any support and management functions so each of these components can be simplified, standardised and ensuring customers have both total control and choice;
• Focus on ongoing awareness, education and training on all things security related and within this emphasise the change of any behaviours and beliefs as much as any technical understanding;
• Promote independent transparent external verification of our products. Really ensuring that we use the talents eyes and hands of experts from around the world to ensure they audit, inspect, test, poke and prod our technology to reduce the likelihood of anything untoward from being included;
• And finally being very clear whose neck is on the block – who is accountable for making this happen.

I have spent much of my life in the transformation business, and I have the scars to show transformations starting but not completing due to not having the right commitment from the most senior person in the business.

The commitment from our founder Mr Ren, is clear, we will do what it takes to drive the cyber security agenda forward, set the highest standards in the industry, focus on the protection of our customer's assets and their balance sheet and be held to the highest independent inspection. We hope that those who wish to close markets, stop competition and innovation under the false banner of national security will take the strategic customer focused lead of Mr Ren and pour their energies into creating a free market with substantial competition and innovation so all citizens can benefit.

What will help solve cyber security? Collaboration and open communication or competition between countries and companies?

Well it has taken over a year to get the "system" out of my system and it is good to be writing again. I was pleased to see that the UK Government has run an event to urge business leaders to step up their response to the threats of cyber security and produced a number of guides to help them understand the challenges and what they can do about it – the details can be found here. Much of the advice centres on basic awareness and training, which reminds me of the challenges of mixing senior people and technology together:

This Executive calls in to complain that he gets an "Access Denied" message every time he logs in. It turned out he was typing his user name and password in capital letters.

Tech Support: "OK, let's try once more, but use lower case letters."

Executive: "Uh, I only have capital letters on my keyboard."

NOT THAT ANY OF US HAVE RECEIVED AN EMAIL IN CAPITALS FROM A SENIOR COLLEAGUE, or indeed only notice the PC turned on in winter as the boss uses it as an extra light source, of course not…

We have also published a "White Paper" that details the difficult marriage between technology and cyber security. My overall premise was that in a world where business, government and citizen interaction is intertwined with technology, and the technology itself comes from a global supply chain, the only way that we are going to make progress on cyber security is to collaborate and have open dialogue and communications between as many parties as possible, even though this might seem difficult to some.

The problem with collaboration of course is it implies trust and in a world where every government and every company is fighting to keep their heads above water and not be a victim of the economic and competitive challenges that we all face, trust seems to be pushed lower and lower down the priority scale. However there is much we can and should do. Take the advice just published by the UK Government – good advice it is to – and they should be applauded for taking such an initiative. I just wonder if we could have combined this advice with the advice from the SANS institute, or the advice from NIST or, the advice the Signals Directorate in Australia, and, and and… If we could have got 20, or 40 or 100, or 200 countries to agree on the same advice and have a unified programme of raising the cyber protection bar globally maybe, just maybe we can start to limit the options that the bad "guys" have.

To make progress we must move away from a single company or country trying to change the world to us collectively working together to change the world.

If you are passionate about the huge positive difference technology has made to the world and you want to see this continue and not be slowed down by the ever increasing challenge caused by the challenges of securing technology then all of us should be calling for a unified approach to securing the global technology supply chain and the technology we use in our daily lives. We should ignore the "nay sayers", ignore the "finger pointers" and do our best to ignore anything that is tinged with political trade protectionism or indeed competitive protectionism and focus on things that we can collectively change – there is plenty we can do.

Update: #1 – John Suffolk to become Huawei Global Cyber Security Officer following approval by UK Government

First of all a huge thank you to the hundreds of people who have texted, emailed, and sent LinkedIn messages of congratulations.

However, as a civilian I have been chastised by the Cabinet Office and former colleagues so I have two apologies to make. The first is to my former colleagues in Cabinet Office where, due to my desire to keep words to a minimum, they are concerned that I have not detailed the full terms of the appointment. This has meant that they have had to make several calls to journalists so that they can add the fine detail into their articles… they could have just posted to this blog, buy hey ho.

As I would not wish to be party to the Cabinet Office getting a reputation for opaqueness, being economical with the truth or avoiding answering FOI requests I have detailed the full text of the appropriate section from the letter following the approval from the Prime Minister.

The second apology is to former colleagues who have asked me "what the hell am I doing going through the appointments commission process" as they are concerned that others might now need to follow where in the past many have ignored it, and the Cabinet Office have not policed it.

First of all it is worth saying that I agree with the process. It is right that when former officials leave service before they join a new organisation it is validated that the role has been given on merit and not on past official dealings. We would all agree that it is wrong for an official to have recently signed a contract with a company and then suddenly turn up in a new high paid job at that company. Just as it would be wrong that they had commercial confidential information on their competitors or had inside knowledge on a new unpublished Government policy that might advantage the new employee.

When I decided to leave Government in March 2010, I discussed this matter with Sir Gus O'Donnell, the Cabinet Secretary, and I made it clear then that I would commit to use the appointments code.

Having only met Huawei twice (although in the spirit of declaring who we have all met I did bump into one Huawei person after I had done a presentation and I told him I couldn't speak to him so that might count as the third) in seven years before I physically left; I have undertaken no procurements with Huawei, or have any commercial information on their competitors that might be of use to Huawei and as you know I led the transparency agenda on technology – so there was no advanced policy information either. The tariff, and resultant personal cost of this contact, is detailed above.

Following approval from the UK Government John Suffolk to join Huawei as their Global Head of Cyber Security reporting to the Group CEO

Under the Civil Service Business Appointments Rules, on the 22^nd February I applied for permission to accept an appointment from Huawei to be their first Global Head of Cyber Security reporting into the Group CEO, and founder, Mr Ren. On the 12^th July the Prime Minister, on the advice of the Advisory Committee on Business Appointments and following a thorough investigation of the case approved the application, subject to me waiting for a period of 6 months from when I left the Civil Service. So I join on the 1^st October.

I have to say I am both thrilled and privileged to join Huawei. As a company we serve a third of the world's population with our technology, and 45 of the world's top 50 telecommunications operators are core customers. We employ over 110,000 people from 150 nationalities and operate in more than 140 countries. Supporting this we have 20 R&D centres from San Diego to Dallas, to Stockholm, Milan, Moscow and Bangalore and this is supported by 20 customer centric joint innovation centres.

But what impresses me the most is the passion for excellence with our customers and the brilliance of our engineering. Few organisations can say that over 50,000 of their workforce are engineers that they have 7,500 people with PhD's and contribute to 123 standards organisations such as 3GPP, IETF, ITU, OMA, NGMN, ETSI, IEEE and 3GPP2. We have cumulatively submitted more than 23,000 proposals and served in 180 leadership positions including as board members in various international standards organizations such as OMA, CCSA, ETSI, ATIS and the WiMAX Forum.

So to the role. I will report directly to Huawei's CEO and will be in charge of continuously developing Huawei's cyber security assurance strategy and system and managing and supervising its implementation. The end-to-end cyber security assurance system will be adopted globally by all business groups and across all departments including R&D, supply chain, marketing and sales, project delivery and technical service. The Global Cyber Security Office will be located in Huawei's headquarters in Shenzhen, China and supported by National Security Officers in several countries, such as the UK, India, France and the USA. My role will be to ensure that our cyber security assurance system integrates end-to-end cyber security into solutions covering our cloud computing solutions, pipes/ telecommunications and all devices from mobile broadband to PDA's where appropriate, the customer-oriented business processes and the whole ICT supply chain.

Having spent 7 years in Government with the last 5 as the UK Government CIO and CISO, security was a core part of my thinking, planning and execution. We all accept that as technology becomes more pervasive and we become more reliant on technology we need to come together globally to address the challenges and threats posed by those who would wish to exploit any vulnerability in the technology.

I look forward to the challenge and working at Huawei.

Project reviews completed, moratorium holding firm, renegotiations well advanced, strategy imbedded - so time for me to leave

Sir Gus O'Donnell, the Cabinet Secretary, has announced my decision to leave the Civil Service after 7 years with almost 5 years being the Government Chief Information Officer and Senior Information Risk Owner.

the full statement is

"John Suffolk, Government Chief Information Officer at the Cabinet Office, has announced today that he will be leaving the Civil Service at the end of the year. John joined the Home Office in 2004 as the Director General leading the technology transformation of the Criminal Justice System and was appointed to the role of Government Chief Information Officer in 2006.

John made his intentions clear in March that he wished to consider his position once he had fully supported the new Coalition Government in their first 6 months of office.

John said:

'It has been a great honour to have been a civil servant and a huge privilege to have led the IT profession over the last 5 years. Without doubt we have transformed the UK into a leading user of technology benefiting Citizens and the UK economy.
 
'I am immensely proud of the way we have supported the new Coalition Government in its first 6 months and have greatly enjoyed working with Francis Maude and his team. I know that with his drive and passion for delivery the very good work we have started will continue and be a great success."

Cabinet Secretary Sir Gus O'Donnell said:

'John deserves the thanks and best wishes of everyone in the Civil Service for driving the transformation of technology in Government. His work with the CIO Council and technology professionals across Government has ensured that we are well placed to cope with the challenges that we will face. We wish him all the best for the future.'

Francis Maude, who co-chairs the board which oversees the Efficiency and Reform Group, said:

"'I'd like to thank John for his enormous contribution to the technology transformation agenda, and the civil service as a whole over many years. 'His experience in both the public and private sector has helped to make the transition to the coalition government a smooth one. The Cabinet Office will certainly not be the same without him and I wish him well for the future.""

The Government has announced the most demanding public sector spending review in a generation. In that review the ICT Strategy that we have been working towards and delivering over the last 7 years is baked in, in some shape or other: the rationalisation of infrastructures to create a "cloud" model; the continued sharing of assets and systems; the continued drive to benchmark and drive operational excellence; putting more systems online - but based around horizontal citizen and business needs; focussing more on SMEs; reducing the scale of projects; fixing our procurement processes and finally putting technology at the heart of the next transformation.

I am a great believer in renewal and as new teams enter a business, or as in our case, Government, it is important that they themselves can bring in new ideas, new policies and processes, and crucially new people. Having achieved what I set out to achieve it is time for me to get out of the way and allow fresh thinking and impetus to drive forward the strategy. I know I leave our work in strong capable hands supported by a strong capable ICT supplier community.