When IT Meets Politics

Page 20 of 101« First...10...1819202122...304050...Last »

November 25, 2014  1:47 PM

Is a telecoms merger (BT and O2 or EE) born of weakness good for UK plc?

Philip Virgo Profile: Philip Virgo
BT, EE, Merger, O2, Roaming, Stokab, take-over

The news that BT is in talks with both O2 and EE in order to re-enter the mobile market should come as no great surprise but is it good?

BT spun-off what was then Cellnet and mortgaged its exchanges when it was faced with £30 billion of debt after local loop unbundling destroyed the business case for its plans to deliver broadcast quality video to the home by 2002.

BT’s recent capital spend on communications infrastructure, as opposed to that funded by government, has been little more than that necessary to cover preventive maintenence, replacing obsolete equipment so that can now make use of the fibre to within a mile of most UK homes that it already had over a decade ago. 

Meanwhile O2 and EE have struggled to fund the upgrading of their networks to overcome notspots and bottlenecks as traffic volumes rise faster than revenues, let alone to to meet their obligations and promises for 4G. Hence their desire to offer infrastructure sharing rather than roaming.

Meanwhile global infrastructure funds are said to have tens of £billions looking for opportunities to build 21st century hybrid networks providing gigabit services at a fraction (said by some to be as low as 20 -25%) of the costs currently being quoted for new build, let alone operation.

Is a “mere” share swop between market dominant but financially weak players good for the UK plc, or will it serve to deter the new investment that is needed?

A more positive view is, however, that the merged operations will be so “financially challenged” that, like the Swedish incumbent, it will have no realistic alternative to joining its current competitors in becoming “lead tenants” for the new generation of infrastructure only utilities, akin to Stokab, that are beginning to sprout around the UK

I look forward to readers comments.


November 23, 2014  4:30 PM

Where is the Cabinet Office Identity Programme going?

Philip Virgo Profile: Philip Virgo
GDS, government, idap, Verify

Over the past few weeks I have received a flow of e-mails regarding the status of the Cabinet Office IDAP programme.  

Is it making steady progress towards creating a market framework for inter-operable identity systems?

Or is it muddying the waters by trying to coerce users into new and unproven systems for their dealings with government while the rest of the world moves on?

The alterantive “proven” systems range from the Government Gateway (using by millions, including all small firms for their tax affairs) through the third party services provided by the members of the DCTE, (the European trade association for Digital Trust services) to the identity and access management systems used by industry (from airports through banks to on-line retailers) to identity and give layered access to visitors, customers, employees and contractors.

I find it difficult to understand whether the Government data Service is undertaking genuine voluntary customer trials or whether groups of users are being given Hobson’s choice – e.g. use the new system or stop farming in an attempt to get a bandwagion rolling.

I therefore asked Mark King of Broadsail one of the independent consultants who has been tracking UK and EU debate on electronic signatures on behalf of his clients, to comment. Before you read on you might, however, care to begin by viewing the video of his presentation to a BCS-EEMA event last January.

His “observations”. Including on how and why UK ID policy has got to where it is today, are below:

“The government programme for identification of people for online public services has been very focussed on be being seen to respect privacy, which covers more than data protection, notably in respect of user control. One of the drivers was a reaction to the previous government’s ID card scheme, which also included a national population register, and that has also been cancelled rather than downgraded to fill missing but unfashionable considerations such as people’s jury service status.

Instead of adopting a recognised, existing, privacy-friendly model such as that used in Canada, possibly as a result of the empty coffers, the decision was taken to re-use existing credentials, despite the problem that those suitable for consumers weren’t built for giving out benefits.

Re-use of employee credentials was also investigated, but Government agencies are reluctant to allow staff ID to be used for purposes other than which they were designed, and with no commercial case for other employers to participate, this was amended. There was no enthusiasm for increasing risk by opening up if there was no benefit for the organization.

After a DWP initiative was announced in the EU official journal (OJEU) and then pulled, a call went out for a framework contract for ‘Identity Providers’, with the expectation that banks, supermarkets and other familiar organisations would participate. It was initially a DWP lead, but was novated to Cabinet Office when it became clear how gentle the Universal credit roll out was going to be. Far from being a gravy train, it required participants to invest, but also accept very strict terms as to what else could be done with the data. The only responses were from those not on the envisaged list. They must have been prepared to take the considerable risk of investing, unaware of the extent, or had some separate political motivation. As in Ireland, the Post Office was an obvious contender, and it qualified as being technically private, although some people remained confused about being redirected to the Post Office when they were trying to go online and not use the post.

The group of eight in the framework were a disparate mixture, with at most two of them being household names, although they might have used different branding. Only five went through to a delivery contract, and public testing started on 21 October 2014 with just one.

An unpaid group of privacy experts were brought together to agree the principles for the programme. Had this been done before going out to contract it any principles would have carried more weight than putting them out for public consultation three months after the system was due to become operational.

More-over, public endorsement of the principles by a cabinet minister precluded (and still precludes) civil servants from debating the issues in public.

The group’s remit was also extended beyond privacy to general user concerns (but, it seems, not non-users); it is not clear if sufficient additional experts were called in, nor who has time to provide unbiased pro bono advice for such an extended period.

The user was not allowed to be able to chose to be consistently associated with a permanent identifier such as a National Insurance or NHS number, but rather a matching data set including ‘current address’ and date of birth – use of both of which are deprecated by online security advice. Nor is the user allowed …
Continued »

November 15, 2014  10:04 AM

Should Broadband advertising be ‘legal, decent, honest and truthful’? If so …

Philip Virgo Profile: Philip Virgo
Broadband, copper, Gigaclear, Hyperoptic, ITS, Openreach, United Kingdom

Further to my recent blog on the way in which the Advertising Standards Authority has been accused of approving serious “misrepresentation” of the broadband offerings from dominant suppliers and thus helping prolong the current distortion of the market, I have received a number of responses as to what their approach should now be.

I particularly liked that from Dave Cullen, now with ITS , which has been providing high speed networks using hybrid (fibre and wireless) technologies for urban centres , business parks and rural communities for nearly 20 years.  The recent rapid growth of ITS (taking over smaller operators as well as winning ever more and bigger contracts) is indicative of the way the UK communications infrastructure market has changed over the past 18 months and now offers the prospect of genuine competition and growth.

Dave believes that, regardless of whether there is a good case for challenging BT’s claim of “19 million fibred homes” as “mis-representation”, the providers of alternative networks should ask the ASA to follow the logic of its own judgement.

Given that the ASA position appears to be that the issue is around customer’s service expectations and performance, it should be pointed out that Fibre to the Cabinet cannot  deliver  the claimed ‘up to’ levels of performance more than about 700 metres from the cabinet – and that distance is as the copper meanders, not as the crow flies.

Therefore, as a minimum, BT should be obliged to clearly state the “risks” associated with their product within EVERY ad, in much the same way as mortgage and loan companies have to warn that “Interest rates can go up as well as down; your home is at risk if your do not keep up repayments… etc”

BT should similarly be required to say: “our fibre optic service relies on copper for your final connection; it cannot guarantee superfast speed or quality to premises using copper cables longer than 700m from your connected cabinet…

The same would, of course, apply to those whose “fibre” services also depend on reselling the BT Openreach fibre to the cabinet services. It would give BT an incentive to repromote its own fibre to the premises service, instead of hiding it away lest too many customers ask for it and thus overload its creaking backhaul infrastructure. It would, of course, also give its resellers (incuidng Sky and Talk Talk) an added incentive to offer “crapfree” (i.e. no copper, rust, alluminium or other pollutant) broadband using rival local fibre and wireless to the premises providers.  

November 14, 2014  10:09 AM

Why IT Projects Fail – forty years on and what is new?

Philip Virgo Profile: Philip Virgo
Cabinet office

One of latest downloads from the Computer Weekly website is entitled “The psychology of IT projects: why they fail”  It is almost 40 years to the day since Computer weekly published the last in a series of ten articles on “Computer Assisted Bankrupcy” based on my London Business School project: “Business Appreciation: a study of the business training needs of DP staff and the current calamitous consequences of its absence”.

When it comes to the reasons that IT systems fails, the pace of change has been about the same as the development of my literary style – including my love of alliterative headlines. 

The more interesting question is – why do we never learn? In the public sector it is because good practice is punished hardest when it matters most , hence the reasons the lessons of how to acheive success are commonly ignored . At least the private sctor has more interesting reasons – but they too remain boringly similar. I leave you to read the download.

November 13, 2014  11:09 AM

Advertising Standards Authority wrecks attempts to promote “genuine” fibre broadband

Philip Virgo Profile: Philip Virgo
copper, Crapband, fibre, ruling

I have just been told of the Advertising Standards Authority ruling that copper to the home from a fibre connected cabinet can be called “fibre”. Meanwhile, it would appear that those offering “true” fibre connections cannot drop the “up to” in front of the speeds they offer.

Even more interesting is the revelation in the small print of the supporting material that as recently as last year BT still hoped to offer genuine fibre to the premises to 25% of the UK. That ambition appears to have have fallen by the wayside with the squeeze on its investment programme resulting from invasion of the content market and consequent price wars – with headlines offering “fibre” for £2.50 a month (rising to X after a given period), provided you take it over a copper line for which you pay £12.50 a month (rising to Y after a given period).

It is clear that those offering future proof fibre to the router/femto connectivity need a new headline slogan over which they can police copyright – so as to ensure that it is not misused by those with market dominance and advertising budgets large enough to sway the judgement of a self-regulator. I have a bottle of House of Lords whisky for the best suggestion.

Ideas to date include: “full fibre”, “home fibre” and “crap (copper, rust, aluminium and other pollutants) free fibre”.

I would also welcome a good definition of “crapband”. The current working definiton is: a service which delivers a speed that is, at best, less than 25% of the advertised “up to”.               
P.S. Copyright is reserved on the terms “full fibre”, “home fibre”, “crapfree fibre” and “crapband” (unless some-one else can demonstrate they have already used them). Free license will be given to those offering fibre to the home router and/or local mast or femto.

November 12, 2014  12:41 PM

City of London to bulldoze broadband blockages while Vodafone parks tanks on BT’s lawn

Philip Virgo Profile: Philip Virgo
backhaul, BBfix, BR, Broadband, bsg, Clacton, fibre, Redburn, Sky, UKIP, Virgin Media, Vodafone, Wi-Fi

The Corporation of the City of London has just voted to publicise and build on their surveys of local broadband supply and demand  with a two stage project. The first stage is to identify the range of solutions that are available and to map demand for fibre broadband, building by building, in the Square Mile. The stated aim in the press releases is to use “this information to ‘nudge’ fibre suppliers into providing connections that SMEs can afford”.

The second stage is to address growing complaints over mobile and wifi cover with a major  upgrade to wireless voice and data services, using City Corporation street furniture and buildings for extra masts and connections.

Mark Boleat, Policy Chairman of the City of London Corporation that looks after the Square Mile business district, said: ‘The 13,500 SMEs in the Square Mile employ many people, are vital energisers of the business environment and need the right tools to deliver productivity both in the City and the adjoining areas that are fostering growth. This project will help close the digital divide by putting  superfast broadband within reach of far more of our vital SMEs, and help residents and visitors, too.

The City of London Corporation, the elected body which runs the global business hub around St Paul’s, has been pushing hard to improve connectivity for SMEs who can’t afford the £500 a month needed for a big-league business connection, and for its 8,000 residents. Both the building-by-building fibre survey of the Square Mile and a tender for a wireless service will begin in January 2015.

The Square Mile is behind others, including its traditional rival the City of Westminster, when it  comes to using its street furniture and building to help pull through upgrades to mobile and wifi cover. However, it looks to be in the lead when it comes to organising a building by building survey with the aim of helping alternative network providers create a genuinely competitive business broadband market.

The Corporation may not be alone in this for long. The Countryside Alliance plans to work with the Actual Experience BBfix project  to identify not only the services actually received in rural areas but also some of the reasons for poor performance. When I first heard of their plans I thought, “why do we need another mapping exercise?”.

I then drilled down into the detail of the maps currently available and what they measure and reflected on discussion at the launch of the Broadband Stakeholder Group report on “Out of Home Usage”  and took a look at how the different “maps” illustrate the supposed broadband and mobile cover across the constituency of Rochester and Strood, a BT near monopoly  serving a UKIP stronghold (rather like Clacton in fact). The picture they give is remarkably rosy compared to the reality found by politicians and party workers as they canvas the area.

The twin approaches of building by building surveys and measurements of actual experience, not just nominal speeds, could help blow apart cosy debate over what we do, or do not need, and help enable market forces to compensate for regulatory failure. Then came the press cover for the announcements from Vodafone, now that it has sorted out the national backhaul network that it acquired from Cable and Wireless.

I suspect the reality is rather different.The headlines are about Vodafone doing deals with BT and others for local access and content, leading to head-to-head competition between BT, Virgin, Sky and Talk in the quad play market. According to investment analysts like those at Redburn, BT’s capital spend is falling, not rising and it has neither the funding nor the incentive to invest in both infrastructure and content. Meanwhile Virgin is extending its local reach and Sky and Talk Talk are exploring connectivity deals with alternative network providers.

The Vodafone announcements might be better seen as a very public warning to BT to stop planning to re-enter the mobile market via wifi and instead to include them within upgraded Openreach services as a shared utility for all to use. Meanwhile Vodafone is well positioned to not only reduce what it pays to BT for backhaul but offer services to BT’s competitors, local alternative network providers and business users. It will be interesting to see it offers next spring to those in the Cities of London and Westminster as well as to those whose local fibre plans are constrained by the availability of affordable backhaul (see page 4 of the BSG “Out of home experience” report. Will it also seek to take a lead in providing seamless local, national and pan-european roaming to business customers, whether or not it is compelled to do so by regulators?  Is this part of its positioning for the world of smart cars, buildings, cities and infrastructures ?

The UK broadband market, including the future of digital infrastructure investment, just became much more interesting. 

November 6, 2014  4:21 PM

Who do you trust less with your digital footprint – Your ISP or Your State Security Service?

Philip Virgo Profile: Philip Virgo
consultation, DCMS, GCHQ, Google, Googlette, Govrnance, IETF, Internet, ISOC, ISP, ISPA, Mobile, Roaming, Rockefeller, YouGov

On the eve of the meeting of the Internet Engineering Task Force last March, the Conservative Techology Forum held a meeting  at which there was general agreement  that the time had come for more openness about the  governance procedures of GCHQ in order to help rebuild confidence  after Edward Snowden‘s revelations.  There was also discussion as to whether those procedures were more or less opaque than those of the on-line service providers, who collect and store the fine detail of our on-line footprints. 

When the IETF had a session with MPs of all parties on the following evening, we heard of the “breaking of the Social Contract that underpinned the Internet”. I then blogged on the issues raised during the reception afterwards when leading figures from the IETF and ISOC were candid about the challenges they faced in structuring honest and constructive debate between engineers as opposed to allowing lawyers to dictate the future.  

Since March we have many more attacks on the governance processes of UK and US law enfircement and surveillance services, with no recognition that they are very different.  US based companies (and their lobbyists) would like the UK to copy the court-driven processes with which they have to live back home –  where locally elected judges can authorise, for example, the collection of data to enable investigations into the tax affairs of their political opponents. 

The differences  between the governance processes of GCHQ and Fort Meade can cause tension,  but on balance, the result has almost certainly helped resist the trend toward unaccountable autocracy in both nations – at least on the part of government, if not on the part of the shrinking cartel which now controls the access of most of us to the Internet .

Until publication of Sir Ian Lobban’s  valedictory speech we had, however, almost nothing on public record about how GCHQ’s interprets UK  governance, including the determination of its staff to resist the pressures of politicians  to gather dirt on their opponents (as in France or the US) let alone their opposition to the routine mass surveillance of which it is accused and of which so many of its attackers  are themselves guilty.

Remember that when an Internet Service Provider says its monitoring operations are to “improve customer service”, you are NOT the customers they mean. They mean those who pay them for analyses of the data they have collected about YOU. Even much of the free ad-blocking software is funded by those who pay for loopholes, alias whitelists  .

If information is the new oil, has the time come to break up the Rockefeller Empire?

If so, we should also remember than within a decade the Standard Oil of New Jersey was bigger than the parent had ever been.

Hence my comments on the importance of also looking at the business models of the Googlettes when looking at those attacked by Robert Hannigan for aiding and abetting terrorists and  criminals .

The collective response of the ISPs  was predictable – albeit not necessarily wrong.

At this point, however, we need to look at the evidence available on the balance of public opinion and think long and hard about what that evidence really means – assuming we are serious about democratic values and holding dominant commercial players, as well as government, to account.  

When I blogged on IT at this years’ party conferences, I pointed out the IPSOS Mori data showing that the public trusted law enforcement  and central government with rather more than they trusted their Telco or Internet service provider.
This morning the daily YouGov poll was on attitudes to Internet regulation.  When I voted the tally was running at :

  • Much more regulation of the Internet 18%,
  • A bit more regulation 32%,
  • Currently about right 29%,
  • A bit less 7%,
  • Much less 5%,
  • Don’t know 8%.

Digging deeper indicates that consumers  are more concerned about fraud, abuse and bullying than about cyber-terrorism. The claim that mobile roaming to reduce the number of not-spots should not go ahead because it makes surveillance harder  is therefore likely to get short shrift, were it even true.  I am awaiting details from my moles but suspect the reality is that the mobile operators want any excuse to avoid national roaming and have yet to come up with an alternative solution to the not-spot problem, other than infrastructure sharing. 

Meanwhile the urban mobile traffic of much more interest to the surveillance services is increasingly being off-loaded onto wifi-hotspots. I therefore commend the Matt cartoon in the Daily Telegraph on November 6th: One country yokel to another saying “I wanted to become a jihadist but round here  the internet’s too slow and there’s no mobile phone cover”

The time has indeed come for a fresh look at responsibilities of those who take £billions in untaxed profits out of the UK while claiming they are unable to protect their customers from abuse. As part of that review we should, however, also look at the reliance of state surveillance systems on outdated communications architectures that stand in the way of allowing the UK’s digital infrastructure to evolve in line with customer needs into a world of ubiquitous, seamless, mobile, connectivity.

That almost certainly means tapping, instead, into the systems used by ISPs and their advertising (and other) “customers”, to follow the every move of those whose communications they are monitoring, including via the GPS locations of the devices they use.

Such an approach raises many questions and the answers need to be based on genuin e public consultation not hurried discussions with vested interests.  In the meantime  I urge all those concerned about  addressing the not-spot problems, urban as well as rural, to respond to the DCMS consultation on mobile roaming.

November 3, 2014  10:57 AM

Environment and Rural Affairs Committee joins up the Rural Broadband and Digital by Default debates.

Philip Virgo Profile: Philip Virgo
ACRE, Defra, Digital signatures, GAF1, idap, SPARSE, TSB, UKIP

The announcement of  Environment and Rural Affairs Select Committee  enquiry into “Rural broadband and digital only services”  should be just in time to spur government into joined up action before the start of the 2015 Election Purdah.The terms of reference  put debate over rural broadband into the context of the demands of the Rural Payments Agency that access to its services be digital by default . The absurdity of these demands (and lack of practical attention to the means of delivering “assisted digital” to those without adequate on-line access) has just been compounded by the decision to force farmers to also use the new Government Verify Service instead of the Government Gateway accounts they use for tax purposes. The consequences of this decision were all too predictable. It should also be remembered that the pilots are the stalking horse for the Cabinet Office attempt to force millions of small firms and all those who make individual tax claims, to similarly move from the Government Gateway, instead of simply offering them the new service as an alternative.

It is as though those taking the decisions concerned are closet UKIP supporters determined to “take-out” not only the current Government’s rural MPs but also the digital by default enthusiasts of the opposition. Or is it merely a short term ploy to help meet DEFRA‘s targeted spending cuts – by making it impossible for farmers to claim anything in the period to March 31st 2015.  

Either way, it signifies political disaster for the Government – even before we begin to consider the implications for all those, other than farmers, who live in rural areas who are losing their buses, post offices, market town bank branches – for whom this is clearly the thin end of a very big wedge threatening to exclude them from public services  … and drive them into the arms of UKIP.

I therefore urge all those with friends and relatives living in rural not-spots (who will not be aware of the Select Committee enquiry because they are unable to browse the web in the first place)  to let them know of opportunity to make their views known before November 19th and to offer to email submissions for them if they cannot get on-line to do so themselves.

I also suggest that All Party Rural Services Group, SPARSE, ACRE, the Countryside Alliance and Country Land and Business offer to collate the views of their members and supporters and that the Federation of Small Businesses offers to collate the views of their 100,000 or so rural members.

P.S. I would also like to take this opportunity to promote a modest suggestion  to make it easier for those in rural areas to deal with all those offering to help them via the growing plethora of fragmented grant and loan schemes: The Gov.UK Unified Grant Applications Form (GAF1) . The “business case” is obvious. The only credible argument against is the job preservation of those who want to be seen to be doing something, even if only wasting the time of everyone else, but do not actually have much, if any, money to give out.


October 20, 2014  4:12 AM

The churn of information security staff is even more dangerous than the shortfalls in quality

Philip Virgo Profile: Philip Virgo

You might like to scroll down and read the last paragraph of this blog entry first.   “The Consultant” was first published in 1978 during the run up to a previous “IT Skills Crisis”. It was based on a cautionary industry case study. Think what has changed since. Be afraid. Be very afraid.

Last year a Frost and Sullivan survey indicated that chief information security officers around the world were more concerned about staff shortages than hacktivism or cyber-terrorism, with over half having under-staffed departments and demand for skills growing at 10% per annum.
We have had regular IT Skills crises over the past 50 years but the overall shortage has rarely been more than 15% (1987-9 “crisis”, “cured” by the 1991 recession: page 17 of 1996 IT Skills Trends report). The 2014 RSA Conference was told that the current shortfall for Information Security staff is 25% and recent US legislation cited a vacancy rate in the Department of Homeland Security alone of 22%. Hence the sharp rise in US spend on cyber security skills programmes.

As yet, the equivalent UK programmes are significantly more modest but competition for experienced staff, the salaries on offer for those with the skills in most demand and staff turnover have all accelerated sharply since I forecast trouble earlier this year.

I therefore spent much of Quarter 2 helping e-Skills trying to get employers in the Financial Services sector to look at the skills frameworks for information security apprentices (both pre- and post- graduate) and continuous professional development and identify any changes needed to help meet their needs.

I blogged on my interim report in June  and you will find a summary below, headlining areas where those I contacted could find little or no relevant training on offer.  I am about to go back the employers to find out who they would trust to train their staff, with a view to inviting the named providers to co-operate on needs analyses and short course modules for launch in Quarter One of 2015.

First, however, I should comment on why the rising turnover rate is even more dangerous than the shortages.  Annual turnover among supposedly permanent staff has rarely been more than 20% (1987 – 90 and again during the run-up to Y2K) and the 2013 ISC2 Information Security Workforce study  found a churn of barely 11% p.a. among its professional members. However, a more recent Ponemon study found a churn rate of 25% among technical information security staff, rising to over 30% among managers and 40% among CISO and Security Directors.

There appears to be a growing gulf between those who focus on giving skills in current demand to loyal, long stay staff, while training their own “apprentices” (of all ages), and those who say this is too difficult and would rather bid against each other for plausible individuals who claim to already have the skills and experience being sought.

This gulf also exposes the real danger. A lot is aid about the need for soft skills. Unfortunately, the most eloquent can include the “front men” for organised crime. In the last century (how long ago that sounds) I used to warn that the organised crime families of South London (where I grew up) were encouraging the brightest of the next generation to go on computer science courses and specialise in information security: not just to learn for themselves but to befriend the high fliers and identify their preferences (sex, gambling, drugs etc.) with a view to future “co-operation”.

I was therefore appalled when looking at current information security skills frameworks to see how little attention there is to processes for selecting and vetting recruits (even topics as basic as “how to check a CV” appear missing) and for monitoring personal behaviour (where is there anything about processes for colleagues to report concerns over suspicious behaviour?).

The relevant paragraph in my report to e-Skills read as follows: ” Financial services organisations are concerned with the motivation and not just competence of staff and several sectors and professional bodies have mandatory requirements (e.g. the Chartered Institute of Securities and Investment programmes to develop and assess attitudes towards good practice). The FLSP has specifications covering the recruitment, selection and retention of colleagues. There is a good case for co-operation with the CPNI  and the Chartered Institute of Personnel Development (CIPD)  on shared modules, including processes for CV checking and behaviour monitoring (including over social media).”  I was therefore delighted to learn last week that the CIPD was not only happy to lead on work in this area but has already assigned staff to do so.

The context and full list of areas that need to be better addressed was included in the summary of my report:

Key Constraints and opportunities

•    The UK Financial Services Industry is internationally focussed not UK-Centric.
•    The drivers are a mix of fraud prevention, resilience, customer confidence and compliance.
•    A focus on cyber and information security results in contact being delegated to those with operational rather than budget responsibility.
•    Roles which do not require understanding of the business are increasingly “co-sourced”, to joint operations serving a peer group and/or to trusted partners providing securities services. Those roles which are not outsourced commonly require skills mixes which cut across professional boundaries.
•    It is therefore easier to get support for adding security components to employers’ existing training and continuous professional development and update programmes but the degree of “outsourcing” and “co-sourcing” means that the in-house skills to organise such additions are often lacking.
•    It appears (needs to be confirmed) that it is more effective to promote action on the part of those with budget and strategy responsibility via sector-based peer groups.

The Skills Gaps identified to date

•    There was favourable comment on the e-Skills “Learning Outcomes Draft”  as a check list to aid the assessment of recruits

•    The Generic Gaps, common to all sectors, found to date were:

o    Mobile: including identity, authorisation, data access, transactions and privacy
o    Big Data: both for detection and for protection
o    Cloud: including secure access and regulatory and liability issues
o    Website Security, including and the handling of abuse and impersonation
o    App Security, including the application of security by design disciplines
o    Collaboration across cultural and professional boundaries
o    Process Control: alias SCADA, Internet of Things, Ubiquitous computing

•    The Sector Specific Gaps, albeit often with common underlying disciplines and technologies, were:

o    Putting risks into business context and justifying spend
o    Intelligence led Security: direction, collection, analysis, reporting
o    Access Control: who has access to what, under what circumstances
o    End User Skills and Processes: including for access control and authorisation
o    Vetting and personal behaviour
o    Identity Management: including individuals, organisations and devices
o    Authorisation Processes: including PCI-DSS, HMG, major suppliers/customers
o    Governance/compliance: inc. AML, KYC, SARS, Data Retention and Protection
o    Support for Small Firms, generic and those in the supply chains of large firms
o    Incident Response: damage limitation, notification, consequent liability, public relations etc.
o    Reporting: what to report to who and how, what response to expect.
o    Investigation: forensics, evidence collection/preservation, co-operation with law enforcement
o    Asset Recovery: local (not just in the UK) and cross border

Action Plan

Organise follow up activities to identify priorities, those willing to comment on their needs in sufficient detail to enable suppliers to address them, plus those willing to work together to achieve common objectives in identifying, recruiting and harnessing talents.


Please contact me if you already provide relevant training, are looking for it or would like to help organise and deliver relevant modules. I also remind you that a sector skills council needs to act as a clearing house for those looking at all levels (from end-user and SME, through pre- and post- graduate apprenticeship to continuous professional development) and all channels (from on-line moucs to personalised  face-to-face).

There are serious business  opportunities in this space which are better addressed  by using the sector skills partnership and exploiting the evolution of e-Skills into the Tech Partnership In that context I also recommended reading the report on which current BIS cyber security strategy appears to be based . I do not agree with the emphasis on commerical opportunities with regard to the SME marketplace (unless the arguments elsewhere about the need for segmentation are taken to also apply to the SME marketplace) but it is, otherwise, more thoughtful and thought-provoking than most such studies.

My big concern is, however, that those who seek to recruit cyber-security specialists on the open market, as oppose to retraining existing long-stay employees, lay themselves open to recruiting skilled insiders who will unlock their defences without them ever knowing  who was responsible.

Younger generations will not have had the opportunity to read or watch The Consultant”  written by John McNeill, one of the founders of Logica. It was supposedly based on a case study he used when advising clients on the risks of hiring information security consultants whose provenance they did not know.

Plus ca change …

October 13, 2014  12:22 PM

When IT fails to meet politics: why non-discussions at 2014 party conferences were so dangerous

Philip Virgo Profile: Philip Virgo
Big Data, Broadband, Cabinet office, capitalism, Conservative, Corporatism, CTF, Facebook, freedom, Google, ISP, Labour, Microsoft, Schumpeter, Skills, techUK, twitter, UKIP, United Kingdom, Web

 Antony Walker’s summary of the differences between the Labour, Conservatives and LibDem conferences  on the TechUK website Is excellent but should  be read alongside a rather less polite commentary in the Register on the similarities between them. There are overlaps between the indivduals involved in the “Number One in Digital” exercise, (which he aptly describes as a “Beta version” of a policy study) and those who have volunteered to help the Conservative Technology  Forum Digital Infrastructure working group (the second of the CTF policy studies to get under way).  Both groups mix digital enthusiasts and political activists with “determined optimists” (scarred from trying to deliver improvements in practice), although the balance is different. 

The bigger differences are, however, within the parties.

They reflect tensions between the different interest groups trying to influence politicians of all parties. They particularly reflect a growing gulf between the lobbyists of currently dominant suppliers and the electorate – the users whose needs their clients claim to meet, while not listening to their concerns or, worse, patronising them. “You can tell some-one from IT, but will they listen.”  

Most of the world is now on-line . It has lost its naive faith in the good will, let alone competence, of its current suppliers. Antony Walker may well be correct in thinking the Labour Party gives a higher priority to those who lack the skills to use conventional PC-based technologies but activists in all parties appear equally concerned about those who cannot get a connection or signal that is fit for purpose for transactions over mobiles. I was genuinely delighted with his perception of the embrace of a “Schumpeterian model of discontinuity”  within Conservative thinking (by original discipline I am an economic historian). But this can also be found within the other parties. Schumpeter, like Marx, believed in the death of capitalism and UKIP supporters would argue  that the Westminster village has sold out and only they believe in “capitalism not corporatism

The similarities between the mainstream parties should facilitate co-operation in identifying who is lobbying for what and why. But we need to remember that the stakes may be even higher than the untaxed $billions currently haemorrhaging from the UK into offshore tax havens or supposedly being lost to piracy. We need to address the issues that divide the industry and set the “digital by default” and “big data” enthusiasts against the bulk of the electorate, (if research by IPSOS Mori is to be believed). We also need to address the  practical issues of delivery that set both Local Authorities and the “Silos of State” (and their respective Shadow  Ministers) against the Cabinet Office (and the Shadow Cabinet Office team).

For the second year running IPSOS  MORI and the Royal Statistical Society organised event at all three parties using data analysing public trust in various groups. This year the analyses distinguished between trust in organisation as a whole and trust in their ability and/or willingness to look after our personal data.  The “trust deficit” for internet service providers was greater than that for government and significantly greater than that for law enforcement. The shows clearly now much the public dislike and distrust the advertising funded business models of Google, Facebook and  Twitter but feel they have no choice.  That is a very dangerous position for even dominant players to be in. It helps explain why George Osborne singled out the tax avoidance behaviour of the technology companies 

Antony Walker mentions the LibDem enthusiasm for a Digital Bill of Rights. This appears to be shared across the rank and files of all parties (although the IPSOS Mori data  is not split by political allegiance). David Willetts led a very informal Conservative Technology Forum  discussion that was supposedly to be about Cybersecurity but homed in on the need to reconcile the privacy, surveillance, confidence and choice agendas in ways that would help position the UK as a globally trusted location of choice.

One of the more unpleasant messages for the ISP and Internet communities is that UK voters appear to trust GCHQ rather more than they do Google and to trust the Metropolitan Police (for all its problems) rather more than they do Microsoft. It also appears that they would prefer to support effective action against on-line predators than protect an increasingly illusory anonymity and support information sharing across government while being higly suspicious about sharing between industry players or between government and industry.
Were UKIP to offer user choice, in line with such priorities as part of a technology manifesto reflecting  views common to  ream which won them the European elections in May. the response of the other parties might well cause industry lobbyists  to pay rather more attention to the need for realistic responses to Sir Tim Berners-Lee‘s call for a Magna  Carter  for the web. He put that call into commercial and political context   in his address to the Lord Mayor, Aldermen and Common Council of the Corporation of London when he accepted  his honorary freedom  It was the first event I have attended as a Court Liveryman of the Worshipful Company of Information Technologists and it was good to see how well his challenging comments went down. His text does not appear to be available on-line (an odd piece of censorship given that, as part of the ceremony,  it was formally entered into the official roll of the City in front of several hundred  witnesses) but he built on the past role of London, working with its peers, from the days of the Hanseatic League onwards, in imposing international agreed standards of behaviour on the governments  of the day.
Another thread of discussion during the reception in the crypt undeer the Old Library after his speech, was the state of play with campaign being run to improve the quality and speed of broadband connections available to small firms in the City  That leads me back to a topic that was almost taboo at the party conferences: Broadband. When  I asked the audience at the informal launch of the CTF Digital Infrastructure study  if they were content with their broadband less than half a dozen hands went up. When I asked if the were fed up with their service, about 30 hands went up. The other half of the audience was disenfranchised, having a glass in one hand and a plate of sandwiches in the other. There is a strong groundswell of political discontent, particularly among those trying to put their SMEs on-line or to grow high tech businesses. 

There was similar frustration among those pressured to use “digital by default” public services over lines that freeze or go down when they try to download documents from government websites or complete transactions on-line.   It may be no accident that UKIP, which is said by many to be more effective than the mainstream parties in its use of social media, appears to be gaining strength in areas with poor broadband.  The digital infrastructure issues do, however go well beyond “mere”  broadband and my own views on the scale of change under way are now on record .

All three party conferences featured events on skills and training, particularly apprenticeships and the cost of education. The issue of employers who import skilled staff rather than train their own is another area where there was a disconnect between IT industry lobbyists and the party faithful.  Conservative and Labour MPs may express support in private for a “smart immigration” policy but few would dare do so in public – unless and until the concepts are fleshed out, particularly the means of deterring and reducing abuse, as with the group of “skilled programmers” with impeccable paper qualifications, who lost contact with their courier and were discovered to be almost illiterate, with little English and no computer knowledge.     

The pressures are mounting for an exercise which  addresses the reasons why we have yet another round of domestic skills shortages and (or rather mismatches) and finds constructive ways forward for a world in which career paths and R&D teams are increasingly global and UK universities depend  on fees from overseas students. Unless the mainstream parties find realistic policies which address both skills and immigration we risk pressure to add further layers  of  irrational, ineffective and counter-productive controls, which deter those whose skills and enterprise we want while allowing in those we do not.  Hence the reason the CTF 21st Century Skills working group is tasked to try to address the meaning of “smart immigration” as well as the means of breaking out of ground hog day.

Once again, however, this is an exercise that is much better addressed on an all-party basis and, as requested at the first meeting of the Digital Policy Alliance skills group, I have summarised the material I have on file in a submission to the current House of Lords enquiry  There are some obvious ways forward that could command consensus support across all political parties but these are incompatible with the current staffing models of several major  technology employers.  Hence the need either to persuade those employers to help pilot the business models of the future or to help their, as yet, embryonic future competitors put them out of business.

Perhaps that is where there is a real difference between the parties – “persuade” and “help” rather than “plan” or “regulate” . But, in practice, even that difference is more imaginary than real. Meanwhile UKIP would  argue that the big difference is that they wish to see such issues debated in public rather than behind doors in Westminster.

They will have that wish, because, for good or ill, the 2015 election campaign is now under way. Remember that those who do not speak out get stitched up. Join the party of your choice and be active including via their policy forums. 

P.S. I have just been browsing the most recent Yougov. Apparently over 80% think taxing Google properly would be a good idea but only 20% think HMG will succeed. Half support more Internet regulation and nearly 70% support more surveillance to help prevent terrorism. Interestingly while 60% feel that social media have had a positive effect on society, only 14% feel it has been very positive. I was surprised to discover just how well my own prejudices (alias well informed opinions) gell with the majority of Yougov respondents. I had thought I was more of a maverick but found myself in the minority on only a handfull of issues – some of which surprised me – such as the strong support for windmills.   

Page 20 of 101« First...10...1819202122...304050...Last »

Forgot Password

No problem! Submit your e-mail address below. We'll send you an e-mail containing your password.

Your password has been sent to: