What does ‘system update required’ say about Labour’s IT?

What does ‘system update required’ say about Labour’s IT?

As part of the ‘drains up’ undertaken after the 2019 General Election, a coalition calling itself Labour Together undertook a review of what went wrong and as part of that review commissioned an organisation called the "common knowledge co-op" to look at Labour’s IT and its management. They produced a report called “System update required”. (original | mirror ) What did it say? I think this is important, but like so many learning opportunities that challenge power and the bad behaviour of the powerful it seems to me to be dramatically under-valued.

When I first read it, I was outraged. I hoped to summarise it in a sensationalist fashion to see if I could interest someone who might pick it and make things better. What I have written is not that exciting and I suspect little will change because the Party doesn’t have the knowledge and experience and today is led by people who care more about their control and position within the Party than they do in winning an election and becoming a government. I mean they’d be happy to be in Government but it’s more important to them that they control the Party.

In summary, the report says, portfolio management was unacceptably poor and not accountable to the highest levels of management although they too didn’t have clue. There weren’t enough IT staff and the more numerous IT management layer wasn’t good enough. The report makes no mention of ‘requirements management’, nor of any benefits analysis tools to allow an understanding the effectiveness of the software applications provided. Labour’s voter ID/GOTV software is no longer the best. Local adoption of the IT tools is low, partly because of poor commitment to training, partly due to a high turnover of local activists and partly because the Labour machine didn’t care.

In the rest of the article, overleaf, these failings are explored in more detail. ...

Some thoughts on IS programme management

I wrote a note on information systems programme evaluation and management on my linkedin blog. It considers business value vs reliance and observes that this technique permits the management of software products to have different governance policies, that measuring competitive advantage is hard, that IT strategy must be aware of business strategy which will drive the build vs. buy decision together with other project management decisions. Importantly it decries the practice of buying and adapting a software package. These ideas were first taught to me by Dan Remenyi. …

More consequences of Labour’s cyberbreach

More consequences of Labour’s cyberbreach

The Labour Party can’t issue the ballots for their internal elections; they claim it’s a consequence of the cyber-breach last October.

The Party seems to have attempted to create a replacement membership database by updating its mail manager system and presumably adjusting the feeds although much of the functionality previously offered is no longer available and the feed from the financial system is now days or weeks out of date. We should note that the membership self administration tool is also now not available. The mail manager is obviously from observation slowly dying. It is known to be inaccurate; there are errors in terms of who it considers to be a member, their addresses, and their payment status.

The Party plans to replace this recovered system with an off the shelf package[1] from Microsoft. At the moment we are advised that it is unlikely that local party role holders will get access to this until next year.

Until then we have to use a known to be inaccurate database. From observing, presumably NEC authorised actions, it seems to be considered accurate enough to select councillor candidates and run trigger ballots. Procedure Secretaries have been told that they may not override the membership system even when variances are well known and provable. I question that this is legal in it breaches the duty to be accurate and not to automatically profile people.

What seems to be forgotten that is data protection rests on seven principles, Lawfulness, fairness and transparency · Purpose limitation · Data minimisation · Accuracy · Storage limitation · Integrity and confidentiality. Often too much or too little attention is paid to integrity and confidentiality and issues such as lawfulness, fairness, transparency and accuracy are forgotten.

They are running selections and triggers on data known to be inaccurate. This isn’t right.

This has taken 9 months to get here. While culpability for the breach may be questionable, not having a recovery plan and or not funding it is the fault of the Labour Party and thus its NEC. CEO’s have been fired for less.

Why was there no recovery plan? Did they do vendor due diligence on the member centre hosting provider, did they keep it up to date? Is there a risk register? Has the NEC or the risk committee approved the mitigations? In fact, what is the NEC doing about IT Risk? Is there a DPIA on reusing the mail system? Is there a DPIA on reusing the SAR Tool? Is there a DPIA on using the social media scanners they use? When will we get a data protection capability that protects members data from bad actors rather than from themselves?

Nine months failing to recover is shameful and unprofessional. NEC members should be asking why it has come to this and determine if they, through their inaction, are in fact culpable.

[1] This I consider to be wise, although they will need additional software modules to support Labour’s unique processes, such as donation monitoring. Although it seems they plan to customise the UI 🙁 …

A note on Data Protection Officers

A note on Data Protection Officers

Data Protection Officers roles were revised by GDPR and the member state implementations. Here is a reminder for those that need it.

Article 37 states that a processor or controller requires a DPO if it is a public authority, if it requires regular sys systematic monitoring of data subjects on a large scale or if it processes special data.

A DPO may work for multiple companies, but Article 38 requires the DPO to be adequately resourced and supported.

The DPO must be appointed on the basis of professional qualities and, in particular, expert knowledge of data protection law and practices and the ability to fulfil the tasks specified in the GDPR Article 39.

Article 38 states that the DPO must be involved in in all issues which relate to the protection of personal data, be properly resourced to perform their duties and to maintain their professional expertise, not receive instructions on the conduct of their duties, not be dismissed for doing their job, and report to the highest levels of management.

The tasks of the role are defined in Article 39, the job is to advise the highest levels of management on their obligations, to monitor compliance including the assignment of responsibilities,  training and operations’ audits, to assist and monitor the data privacy impact assessments, to cooperate and act as a contact point for the supervisory body, in the UK, the ICO.

I have used the EU text as the source of my summary and is reproduced overleaf/below ...

This post was originally posted at linkedin.

The 7 Principles

The 7 Principles

When evaluating Data Protection laws and enforcement appetite, one sometimes needs to refer to the 7 principles. These were agreed by the OECD in 1980 and I summarise them below.

  • Notice, Data subjects should be given notice when their data is being collected.
  • Purpose, Data should only be used for the purpose stated
  • Consent, Data should not be disclosed without the data subject’s consent
  • Security, Collected data should be kept secure from potential abuses
  • Disclosure, Data subjects should be informed as to who is collecting their data
  • Access, Data subjects should be allowed to access their data and make corrections to any inaccurate data.
  • Accountability, Data subjects should have a method available to them to hold data collectors accountable to the above principles.

Europe’s privacy laws are constructed by building legislative infrastructure based on treaties and then the creation of law. This diagram below shows the time line of European infrastructure (above the line) and law (below the line), it was made in a year or so ago and thus does not have the UK’s departure from the EU, nor the assignment of “Adequacy” by the Commission.

While much focus today is on the EU’s GDPR, the principles that underpin it, are more broadly accepted than that law, and in some areas, the GDPR maybe found wanting.

This blog post originally appeared on my LinkedIn blog. …

On Cyber-security

On Cyber-security

I posted a note on cyber security on my linkedin blog. I post some pointers on the standards and controls needed to defend against a cyberattack and implement “adequate technical and organisational” protection. It looks and links at the NIST cyber-security framework and lists some of the necesary controls to implement a reasonable defence and prove “adequate technical and organisational” controls. If you do what I suggest badly, you might get away with it, if you do it well, you might stop and or recover from attacks.  …

Software Piracy and supply

Software Piracy and supply

This is interesting. From the Register, an article called, “Software piracy pushes companies to be more competitive, study claims • The Register“, sub-titled, irreverently as ever, “So, do copy that floppy?”

The article is written by, Wendy Bradley, assistant professor of strategy, entrepreneurship, and business economics at Southern Methodist University’s Cox School of Business, and Julian Kolev, an economist at the United States Patent and Trademark Office. The article describes their methodology, and links to their paper. They define the launching of Bittorent as a shock and examine the intellectual property development of vulnerable companies to that shock.

“When comparing the IP strategies of software firms at risk of piracy (the treatment group) against those of not-at-risk firms (the control group), we find that our treatment group significantly increases its innovative activity after the piracy shock in terms of R&D expenditures and granted copyright, trademark, and patent applications,”

Bradley & Kolev – Software Piracy and IP Management Practices: Strategic Responses to Product-Market Imitation (August 2021)

Interestingly it seems, that Entertainment software companies behave differently. although the academic work done, as quoted in the article does not suggest that piracy reduces the supply of content.

Basically the big software firms use their superior cost structures, achieved by size and source code ownership to increase the rate of innovation to keep their customers coming to them. The entertainment companies don’t. I don’t think they look at the size and cost of investment into regulatory barriers to entry, both buying the laws they want, and pursuing newly created malefactors.

Bradley, Wendy and Kolev, Julian, Software Piracy and IP Management Practices: Strategic Responses to Product-Market Imitation (August 2021). USPTO Economic Working Paper No. 2021-3, Available at SSRN: https://ssrn.com/abstract=3912074 or http://dx.doi.org/10.2139/ssrn.3912074 …

Wiping the phone at the Treasury

Wiping the phone at the Treasury

I wrote a piece on the Guardian story about the Treasury losing the Perm Sec’s texts and posted it on linkedin. One particularly disturbing feature of this story may be that messages from David Cameron about Greensill Capital have been lost. On the linkedin blog, I looked at the story from an IT Security and employment law point of view rather than looking at the political corruption angle. I suggest that for an organisation with a public record, FoI or compliance liability that SMS and whatsapp or any messaging product without central logging should not be used. I suggest that wiping the phone instead of a password reset especially when the device has not been lost might be a bit extreme. I hint that peer to peer messaging without a super user is also inappropriate.

I argue that this is a symptom of the growing contempt that politicians and now it seems bureaucrats have for their record keeping responsibilities which are mandate by statute law. It is likely that the use of personal IT i.e. phones and emails if not laptops/workstations is becoming endemic destroying and designed to destroy audit trails of behaviour. I note and have commented elsewhere on the failure to pass the email & records relating to Johnson’s decisions with respect to Jennifer Arcuri’s trade missions and grants.

I note that such behaviour if undertaken by more junior staff would probably involve disciplinary action. I have dealt with cases where people have been investigated under the disciplinary policy for misuse of their personal IT in the office and also for the destruction or unauthorised amendment to business records. These have usually been considered gross misconduct cases which can lead to dismissal, but most of my members are blue collar workers.

With respect to the Treasury, I wonder if the texts have been truly lost, if they have, it’s either a policy failure, i.e. a failure of the control design or a deliberate breach. Someone should be accountable, just as they should at the GLA. The irony here i.e. at the Treasury is that it looks like the responsible person for either of these failures is the same person. The Permanent Secretary is meant to be a check on the, certainly, financial probity of ministers and occupy an important role in implementing a segregation of duties and avoiding  toxic combinations. These controls are designed to stop fraud and corruption. These ones seem to have failed. …

More nonsense on Bitcoin

The Indy reports on Bailey of the Bank on Bitcoin, who warns, “Cryptocurrency has ‘no intrinsic value’ and investors will ‘lose all your money’, says Bank of England chief” I add, “Bitcoin only works because the ‘proof of work’ is so expensive and time consuming; and its also destructive of the environment due to its useless power consumption. (It’s also very slow, doing 700 TPS, that’s not enough for a business, let alone an economy.) …