Big IT is past its sell by date, but Scotland is ripe for the picking

In Westminster the government has just woken up after decades of slumbers and realised that IT can be done efficiently and can be done well. But in so doing, it is re-writing the whole way it deals with the big IT suppliers that have lived off government contracts since the beginning of time.

So all those big name IT businesses realise that they need to restart some long contracts with the Scottish Government before Scotland realises what’s going on.

Here are some of the things they are likely to do that the Scottish government would do well to recognise:

1. They will want to try to create as many long-term contracts now as possible so that the government is tied in to them when they realise what they should have done. This means that they will probably offer to exit from existing contracts on beneficial terms that seem surprisingly generous.

1. Working off the back of the poorly thought out McClelland report, the big IT suppliers will find it easy to persuade the Scottish Government that it can save money by centralising procurement and enforcing standards. They will argue that government has to make the ‘hard’ decision of enforcing change across the board all at once in order to save money.

1. They will encourage the importance of ‘governance’: because big bureaucracy encourages centralised decision making and big committees and boards can’t make decisions so they will end up ‘consulting’ industry.

1. They will supportively help Scotland the create its own Public Sector Network. They will unreluctantly acknowledge that it is essential for security and reliability. It will be so complicated that only they will understand it but, in their embarrassment, government officials will pretend to understand it because they know that they should.

1. They won’t use Open Source software, indeed they’ll try not to let it enter conversation, and if it does they will laugh it off as not a serious suggestion.

1. They will insist that contracts are commercially confidential. How could industry survive if they weren’t!

1. They will retain ownership of the technologies they use and make sure that they are tied to some proprietary systems that are ‘industry standards’.

1. They will offer lots of stuff at such competitive rates in the short term that it seems like an offer that just can’t be turned down.

Scottish Government - be warned!

What is the Public Sector Network (PSN): a cloud of confusion?

Recent announcements on the ICT Infrastructure programme for the Scottish Government and press coverage have drawn my attention to the Public Sector Network programme. Read around the topic I have become increasingly concerned that this programme is seriously flawed.

In summary, the PSN programme is a programme for creating a single public sector network for all UK public sector organisations including Universities. It is a programme that appears to be driven by the need to save money and a recognition that the existing arrangements are often outdated and inefficient. However, the proposed solution is very complex and potentially costly despite being argued publicly as a mechanism for saving costs and introducing a level playing field for commercial suppliers.

But you can’t really explain this all in one paragraph, so here’s a more extended attempt to explain what this is all about, starting with a look at the background and the surprisingly ambiguous definition of what the programme really is.

Programme establishment

In early 2007, the CTO Council articulated a vision for a Public Sector Network described as a network of networks delivering the effect of a single network for the public sector. In July 2008, the Public Sector Network (PSN) programme was established by the UK Government, principally coordinated by the Cabinet Office. (PSN-OM p.10-11)

But what is it?

Below is a selection of definitions or visions of what the Public Sector Network is. These are mostly from programme documents and should give a flavour of how confusing this whole thing is.

• A single, integrated infrastructure, delivered by multiple selected service providers
• A ‘private network of networks’ for the public sector, addressing the various special; security, resilience, service and availability needs of public sector organisations
• Global, including overseas posts and other international UK public bodies
• A secure version of the Internet for the UK Public Sector

(PSN PowerPoint Presentation)

---

The PSN vision is one of creating the effect of a single network across the public sector, to be delivered through multiple service providers in order to ensure ongoing value and innovation. In some respects, this is similar to the Internet model, whereby “service consumers” experience flexibility and inter-working without much concern for underlying inter-network “plumbing”. However, the vision is also one of a “private network of networks” for the public sector, addressing the various special security, resilience, service and availability needs of public sector organisations. (PSN-OM, p.10)

---

The Public Sector Network (PSN) will change the approach to the acquisition of Information and Communications Technology by the UK Public Sector, allowing public sector customers and select partners to harness changing technology to better support their delivery of service and the transformational government agenda. This will be achieved through a commonality of standards, a customer-centric operational model and a flexible approach. (PSN-PM, p. 1)

---

PSN is not a physical entity.
PSN is

• an industry standard
• an enabler for network interoperability benefits
• an enabler to deliver procurement effort benefits
• a process that provides a commonality

(SG-Breakouts, p. 7)

---

PSN offers a vision of ICT services from many suppliers being shared across the Public Sector and delivered over a common network infrastructure, itself provided by several network operators. (PSN-Comp, p.7)

---

The PSN is a supply-side “network of networks”, making network-oriented services utility-like for the public sector. Hence, it is essentially an inter-working and standards framework for the suppliers of network-oriented services to the public sector, governing both interconnection of supplier services and the relevant key service characteristics/attributes that ensure inter-working and end-to-end service assurance across supplier portfolios. (PSN-GCN, p. 7)

These definitions tend to raise more questions than they answer:

1. Is the PSN a separate physical network that duplicates the Internet but is intended just for the public sector?
2. When the PSN documentation talks about open standards does this mean that this is technically just using Internet standards or is it actually a network running under a protocol unique to the UK public sector?
3. Why can’t the public sector just use the Internet?
4. If this is separate from the Internet does this mean that staff in the public sector won’t be able to access the Internet?
5. What will this cost and how can it possibly save the government money?

Let’s try and tackle some of these.

So is the Public Sector Network a physical entity?

A breakout session of a joint Scottish Government, Socitm and Cabinet Office PSN workshop held in Edinburgh in January 2011 was clearly told that the Public Sector Network, “is not a physical entity”. But the extensive documentation around PSN includes description of the Government Conveyancing Network (GCN) - a part of PSN that “will be used to interconnect supplier data networks and other services in terms of network transport” (PSN-GCN, p. 8).

Similarly, the Operating Model document describes the PSN vision as “one of a ‘private network of networks’ for the public sector, addressing the various special security, resilience, service and availability needs of public sector organisations” (PSN-OM, p.10). If the PSN is not a physical entity then how can it possibly address issues of resilience and availability that are not ‘virtual’ concerns?

Looking at the various specification documents available on the Cabinet Office web site it is clear that the specifications include physical requirements like network timing and the implementation of domain name resolution across the network.

Ultimately the only way to make sense of all the documents and the conversations is to look at the terminology.

The truth, as far as I can tell, is that the PSN is the specification and not the network itself. Just like a car manual is not a car, the PSN is not a physical network but it does define the standards required to supply a physical network that is essential for it to run. To put this simply, whenever a document talks about the Public Sector Network you should probably insert the word “Specification” at the end. So, the phrase “The Public Sector Network is not a physical entity” should be read, “The Public Sector Network Specification is not a physical entity”, but parts of the actual network will be!

This is a very unfortunate and ambiguous choice of terminology.

What is the Public Sector Network Specification and what is the network it specifies?

So, the Public Sector Network (PSN) is the specification of a network that will deliver network services to users in a consistent manner throughout the country and even beyond the UK. These services will be physically delivered by private sector suppliers who have won contracts to deliver these services and who have met the compliance requirements set by government.

Third party private sector suppliers are providing something akin to an Internet connection, except it isn’t connecting directly to the Internet: it is connecting to a special public sector private network with what it terms, “segregated access” to the Internet (PSN-OM, p.21). This, the theory goes, allows the public sector to maintain a security separation from the Internet with communications running on networks which are provisioned to deliver higher resilience and availability standards than the Internet can provide.

So the idea is that the private sector will supply separate parts of this one single network and they will work together by virtue of adhering to the PSN specification. Hence, the PSN is not a physical network owned by the public sector: it is network that meets a specification and runs over networking hardware supplied to government by the private sector on a service contract.

Obvious!

So, why can’t the public sector use the Internet like everyone else?

This is a very good question. Indeed I would argue that this is ultimately the question that every government minister and civil servant should be asking repeatedly.

The proposed reasons why the public sector needs its own network appear to fall into the following headings:

• For consistency across the public sector
• For efficiency
• For reliability and capacity
• For security

Let’s take these one at a time.

Consistent networking across the public sector

The truth is that, to the present day, the public sector is a mish-mash of networks developed independently and often intended to be kept separate from each other. The need to bring these networks together to allow for sharing of information and intercommunication is hard to deny.

But given a choice does it makes sense to standardise on the networking standard of the world or create a unique one for the UK public sector?

Efficiency of delivery, procurement and maintenance

Maintaining the current range of networking services across government is undoubtedly more costly than it needs to be. It makes sense to standardise the platform so that procurement is less costly.

But what is the least costly option, servicing a network that is unique to the UK public sector or servicing a network like every other private sector business in the world?

Reliability and capacity

Enabling the public sector to share a common network that can balance the varying peaks and troughs of demand across services is a good way of dealing with capacity needs where individual and separate networks would be constrained by their individual capacities. Setting standards for the delivery of these networks can help to ensure that the networks are reliable.

But this concept of shared networking is the basis of the Internet. If capacity and reliability requirements genuinely demand more control there is no reason why the public sector couldn’t have a dedicated physical network running on the standards of the internet. In effect this is the model of the UK Joint Academic Network (JANET) used for many years by Universities and Colleges throughout the UK.

A secure network

Clearly the public sector deals with information of a private nature some of which concerns the security of the nation. So, do we need a separate network or unique networking standards in order to deliver the levels of security required?

It turns out that this question is answered by the specification of the PSN itself. It says quite clearly that it is possible to deliver all the security levels required over an “untrusted” network like the Internet.

Coupled with encryption technologies the authentication of individual devices will enable the sharing of information across the same PSN infrastructure from IL0 to IL4. (PSN-OM page 20)

(“IL0” (Impact Level 0) refers to “untrusted infrastructure” for example, the Internet. In other words, the PSN can operate over the Internet. So the special security needs of the public sector do not appear to mandate a PSN.)

The truth here is that much of the public sector has taken a “walled garden” approach to security. The idea is that you create a safe network within which public sector users can operate without worries of outside intrusion. Just like some secured government building, the security checks are made at the exits and entrances so that everyone inside feels safe to walk around with freedom and security. Unfortunately this isn’t really very secure at all. As soon as someone gets into the building they can access anything and everything.

So what do banks and security conscious companies do? They may provide a private network for employees but ultimately they make sure that data and systems that need to be secure are individually secured to the level commensurate with the data risks.

If the public sector took the same approach they could also operate on the standard internet like everyone else does.

So why are we doing this?

It is very hard to see any real justification for the Public Sector Network programme in its current form. So, how has it come into existence and why is it going ahead?

I can’t claim to know why the PSN programme happened but I can make some guesses:

1. In the absence of technical guidance it is quite possible that the public sector decision makers didn’t realise that they might be able to make use of existing technologies to replace all the complex networking systems that are currently in use. From that standpoint the idea of setting up a programme to design a whole new public sector network specification may have made complete sense.
2. Security always has a high profile and leads the public sector to demand the highest possible security standards in some things whilst completely failing to address the obvious issues like the unencrypted laptops, CDs and memory sticks that keep hitting the news. The security provisions in some parts of the public sector are so awkward that they practically force staff to ignore them in order to get their work done. Faced with pressures to be secure it is not surprising that non-technical decision makers probably ruled out the Internet as a viable option even despite then producing a specification that allows the Internet to be used!
3. The need to cut costs has resulted in a massive focus on centralised purchasing and procurement as an apparently obvious way of gaining ‘economies of scale’. This principal is much more widely applied than it is understood. Consequently it doesn’t surprise that government decision makers might feel that it would be better value for money to procure a government specific system for the whole of the country, than let individual regions procure an internationally standard system locally. In reality the latter is almost certainly more cost effective than the former and a lot easier to organise as well.

COSLA Police Summit - 23 Aug 2011

Concerned by the way things appear to be going with plans for a single force in Scotland, I attended the COSLA organised “Police Summit” today in Edinburgh.

Here are some very brief notes:

• It was reassuring to find that there were plenty of people there who were well informed about the limitations of the published reports presenting the various options. Colin Mair (Chief Executive, Improvement Service) did a particularly fine job of pointing out issues with the business case document.
• I was shocked to discover that the leaders of Scotland’s main police bodies had seen nothing of the outline business case document. It put my failed attempt to see the document - as a member of the public - into perspective!
• A running theme was that nobody knew what a proposed single force would mean in terms of accountability. Would it devolve power to local police or centralise it in the Scottish Police Board? Who would elect the members of the Police Board? How would the police interface at the local council level?
• A number of people I spoke to one-to-one said that they recognised that we couldn’t stay with the eight forces model in the current economic climate. I asked why and discovered that they were just assuming that reducing the number of forces would reduce cost!
• A number of the propositions and views seemed to suggest, more or less directly, that ACPOS (the Association of Chief Police Offices of Scotland) had historically acted as a barrier to change. There was a suggestion that, for some, the single force model had the attraction of bypassing the power of ACPOS. This provides a possible explanation why some may be pursuing a single forces model even if it doesn’t provide substantive cost savings over other options.
• The consensus was that the SNP had decide to maintain its manifesto commitment to a single force and was unlikely to shift from this. However, there was also a suggestion that there might still be time to impact the government’s perspective on what a single force actually means.

A single Police force in Scotland, a single Fire and Rescue service in Scotland - a costly change for no good reason

Why does centralisation save money?

A common theme in Scottish public sector thinking right now is the cost saving benefits of centralisation. If rumours are true then the Scottish Police forces, and the Fire and Rescue services are to be merged and centralised. Why? Because, it seems that there is a common unspoken understanding that centralisation, whether we like it or not, will save money.

You might imagine that reading recent government reports on these initiatives would explain some of the reasons why centralisation might bring savings. But you would be sadly mistaken. From the document "Sustainable Policing Project - Phase Two Report: Options for Reform" the nearest thing to an explanation of the benefits of centralisation is the sentence on page 5:

"The single force model represents the most significant change; however it provides the greatest opportunity to manage change, drive efficiency and in delivering operations when the change is complete. The eight force model represents the opposite."

In other words, there is no explanation of the benefits of centralisation. As readers, we are expected to accept - without question - that the author of this report is right in saying that single force is best.

This assumption is then reflected in the traffic light style summary of the report on page 62 (reproduced below). If you have a spare moment you might like to try (as I did) to go back through the document and uncover the justification for the colour coding of this:

Scottish Fire and Rescue

The Scottish Government consultation "A Consultation on the Future of the Fire and Rescue Service in Scotland" takes a similar approach to explaining the need for change when it introduces the subject on page 2:

"Many people, both in the SFRS and beyond, now accept that the current structure of eight Services supported by some national support services is unsustainable over the medium-term."

As readers we are clearly expected to agree with this statement because the people are unnamed and the argument is completely unsubstantiated.

Oddly, on page 5 of this report there is a nod towards decentralisation that is repeatedly scattered through the report from then on:

"To ensure that we can deliver the best possible outcomes for the people of Scotland, we want to see a context in which: the full benefits of the SFRS are de-centralised as far as possible…"

But the application of this principal within a single force is finally explained on page 21:

"A single service offers the best opportunity for de-centralising as many elements of the business as possible across Scotland. Under current structures resource cannot be transferred between services. A single service would give us the flexibility to de-centralise and move resource to meet specific, identified needs wherever they occur in Scotland."

In other words, the word "de-centralised" is included in the paragraph to make it appear that de-centralisation is happening when it's actually centralisation. Interestingly the paragraph also claims that current structure prevents the sharing of services when clearly this is not the case and the recent English riots is one well known example of this.

But back to the benefits of centralisation. On the same page this report says:

"A single service approach offers significant scope for bringing together funding streams and reducing the complexity of governance and the duplication of effort and control. It also allows for the rationalisation of back office and specialist services, but with the opportunity to spread back-office and specialist functions more widely across the country. Through simplifying the delivery landscape in this way, the costs associated with the existing multiple governance and co-ordinating mechanisms would disappear."

To be fair this looks like a reasonable attempt at a genuine explanation of the apparent potential benefits of centralisation. But the unfortunate truth is that the last 30 years worth of research in this area provides conflicting evidence of benefits of centralisation or decentralisation within the public sector. See for example: "Centralization, organizational strategy, and public service performance".

The idea that a single service will reduce the complexity of governance may be true, but it will not reduce the overall complexity of the problem. Centralised control allows for rapid decision making at the expense of a lack of detailed and localised knowledge. In effect it could be argued that any efficiencies of centralisation are in the way that it allows rapid and consistent decisions to be implemented nationwide regardless of whether or not they make sense at the local level. In practice centralisation is very likely to result in a nation of demoralised staff who feel the stresses and frustrations of having to work within a bureaucracy that neither understands, listens to, or has the time for local concerns.

The reports pretend that this is not the case by arguing that a single force will, through efficiencies of processes and interfaces, be able to address local needs better than a decentralised organisation could. But this is smoke and mirrors as addressing local needs would decentralise control and increase the interfaces involved in decision making processes. The force as a whole cannot be both centralised and decentralised at once.

Different operating structures favour different ways of working. Centralisation makes for efficient delivery of very simple standardised unchanging services but adds complexity and bureaucracy to the delivery of complex and highly variable services such as are required to address the diverse needs of a nation like Scotland.

Decentralisation is a potentially inefficient way of delivering simple standardised services but excels at motivating staff who are faced with dealing with ever changing diverse and complex issues at the local level.

The recent Christie Report on the delivery of public services in Scotland makes it clear that we can only operate efficiently if we accept that there are different needs and priorities across the country and that we need to address those differences. In other words, we will deliver cost savings, not by delivering the same service throughout the country but by prioritising the delivery of the services that matter in the areas that they are delivered. The simple truth is that delivering the same service everywhere is a waste of money.

Cost of change

Incredibly, the suggestion of moving to a single force for the police, fire and rescue brings one certainty: the cost of change. Whilst there will be arguments about the predicted cost, there is no-one questioning the fact that changing to a single force will be a big and costly change.

If there was a strong argument why, in the long run, a single force would bring savings and improvements in service then you could understand that this cost of change would be something worth investing in.

But the majority of the published cost savings are not dependant upon a single force. They relate to reducing capacity and lowering salaries.

In simple terms the government is proposing to reduce the workforce, cut salaries and simultaneously ask them to completely change the organisational structures they work within. If that is not a recipe for disaster, what is?

Why?

What is driving the push towards centralised control?

The only answer that seems to make any sense is centralised control itself. It seems that we have a government that does not believe in giving out control to other people. It seems to believe that our country is safer in the hands of a few hand-picked individuals in arms reach of government: but out of touch with you and me.

Investigating the figures behind the facts - The future of policing in Scotland - the one force model

"The projected long-term savings under a new structure are up to £154m a year, every year." (Scottish Government Spokesman quoted in Scotsman, 26 July)

I recently read some newspaper articles about the current political debate on merging Scotland's regional police forces into a single force. One figure kept on being quoted (without reference) and grabbed my attention. The £154m annual savings that would come from this change. Where did this figure come from?

The figure appears to come from the document: "Sustainable Policing Project, Phase Two Report: Options for Reform" (March 2011). This report presents an estimate of potential savings (p.55) which totals £153.9m.

But this figure is not the potential savings from restructuring from the current regional forces into one force: the table shows, to quote: "estimated efficiency potential within the various functions of policing if the Target Operating Model were to be adopted". The "Target Operating Model" is a model for operation which is independent of whether the force is 8 forces, regional forces or one force. To quote, "The majority of these efficiencies are achievable irrespective of structure" (p. 68).

£154m is the estimated savings that could come from other changes to the way that the police forces operate. Some of these savings are quoted as potentially taking up to five years to realise. "Efficiencies were calculated and validated using benchmark data" (p. 54) "from other forces (England and Wales) public and private sector (Industry Standard)", "by considering the potential impact of established and well tested levers, for example: management de-layering, process engineering, shared service economy of scale".

The quality of this report is very poor and the savings take no account of the cost of implementing change. Cosla is quoted (by Scotsman) as saying that a Scottish Government business case, "shows that Scotland would have to spend a whopping £230m (equivalent to 7,600 police officers] in start up and restructuring costs for a single force." I haven't been able to find this document, but it is quite possible that this is just the cost of merging to a single force and not the cost of implementing the "Target Operating Model". Remember, it is the Target Operating Model that is quoted as delivering the savings, not the change to a single force.

I am not interested in politics. I am interested in effective public services.

If the SNP are quoting £154m savings as justification for a single police force in Scotland then they are either badly mislead or badly misleading.

I sincerely hope that those with the power to influence this decision get their facts straight before they make a very costly mistake.

I am disappointed that the media in Scotland seem so keen to present political dispute that they have failed in their job of uncovering the true facts behind the story.