Brexit and Cybersecurity
Is the UK headed for a cybersecurity disaster? With Brexit looming and cybercrime booming, the UK can’t afford major IT disasters, but history says they’re inevitable.
The recent WannaCry ransomware tsunami was big news in the UK. However, it was incorrectly reported that the government had scrapped a deal with Microsoft to provide extended support for Windows XP that would have protected ageing NHS computers. The truth is far more mundane.
Update Windows
In 2014, the government signed a one-year deal with Microsoft to provide security updates to NHS Windows XP machines. This was supposed to force users to move to the latest version of Windows within 12 months. But with a “complete aversion to central command and control” within the NHS, and no spare cash for such an upgrade, the move failed.
This isn’t the first IT Whitehall IT disaster by a very long way.
During the 1990s, for example, it was realised that the IT systems underpinning the UK’s Magistrates’ Courts were inadequate. It was proposed that a new, unified system should replace them. In 1998, the Labour government signed a deal with ICL to develop Project Libra. Costing £146m, this would manage the courts and link to other official systems, such as the DVLA and prisons systems.
Described in 2003 as “One of the worst IT projects ever seen“, Project Libra’s costs nearly tripled to £390m, with ICL’s parent company, Fujitsu, twice threatening to pull out of the project.
This wasn’t Labour’s only IT project failure. In total, it’s reckoned that by the time the government fell in 2010, it had consumed around £26b of taxpayer’s money on failed, late and cancelled IT projects.
Cancel culture and Brexit
The coalition government that followed fared no better. £150m paid to Raytheon in compensation for cancelling the e-Borders project; £100m spent on a failed archiving system at the BBC; £56m spent on a Ministry of Justice system that was cancelled after someone realised there was already a system doing the same thing. These are just a few of the failed IT projects since Labour left office seven years ago.
The Gartner group has analysed why government IT projects fail, and discovered several main factors. Prominent amongst these is that politicians like to stamp their authority on the nation with grandiose schemes. Gartner says such large projects fail because of their scope. It also says failure lies in trying to re-implement complex, existing processes rather than seeking to simplify and improve on them by design. The problem is, with Brexit looming, we need large, complex systems that are designed to replace existing systems. And fast.
Not alright, chief
A good example is the ageing HM Customs & Excise CHIEF system. Because goods currently enjoy freedom of movement within the EU, there are only around 60 million packages that need checking in through CHIEF each year. The current system is about 25 years old and just about copes. Leaving the EU will mean processing an estimated 390 million packages per year. However, the government’s own Infrastructure and Projects Authority rates the replacement system as “Amber/Red”, meaning it is already at risk of failure before delivery.
Another key system for the UK is the EU’s Schengen Information System (SIS-II). This provides real-time information about individuals of interest, such as those with European Arrest Warrants against them. It also monitors terrorist suspects, returning foreign fighters, missing persons, drug traffickers, etc.
Only countries that abide by EU European Court of Justice rulings can access SIS-II. Described by ex-Liberal Democrat leader Nick Clegg as a “fantastically useful weapon” against terrorism, the UK may lose access to SIS-II after Brexit.
Late last year, a Commons Select Committee published a report identifying the risks to policing if the UK loses access to SIS-II and related EU systems. The report claimed that then-Home Secretary Theresa May had called such systems vital. Vital to “stop foreign criminals from coming to Britain, deal with European fighters coming back from Syria, stop British criminals evading justice abroad, prevent foreign criminals evading justice by hiding here, and get foreign criminals out of our prisons.”
Unlikely Brexit outcomes
The UK will either somehow have to re-negotiate access to these systems. Or somehow quickly and securely duplicate them and their content on UK soil. To do so, we will have to navigate the EU’s labyrinthine data protection laws and sharing agreements to access relevant data.
If the UK government can find a way to prevent these and other IT projects running into problems during development, there’s still the problem of cybercrime and cyberwarfare. Luckily, there’s a strategy covering this.
In November 2016, the government launched its National Cyber Security Strategy. Tucked in amongst areas covering online business and national defence, section 5.3 covers protecting government systems. This acknowledges that government networks are complex, and contain systems that are badly in need of modernisation. It asserts that in future there will be, “no unmanaged risks from legacy systems and unsupported software”.
Shuffle the deck
The cause of the recent NHS WannaCry crisis was probably someone unknowingly detonating an infected email attachment. The Strategy recognises that most attacks have a human element. It says the government will “ensure that everyone who works in government has a sound awareness of cyber risk”. Specifically, the Strategy says that health and care systems pose unique threats to national security due to the sector employing 1.6 million people in 40,000 organisations. The problem is, the current Prime Minister called a snap General Election in May, potentially throwing the future of the Strategy into doubt. If the Conservatives maintain power, there’s likely to be a cabinet reshuffle, with an attendant shift in priorities and funding.
If Labour gains power, things are even less clear. Its manifesto makes little mention of cyber security, but says it will order a complete strategic defence and security review “including cyber warfare”, which will take time to formulate and agree with stakeholders. It also says Labour will introduce a cyber charter for companies working with the Ministry of Defence.
Regardless of who takes power in the UK this month, time is running out. The pressure to deliver large and complex systems to cover the shortfall left by Brexit will be immense. Such systems need to be delivered on time, within budget and above all they must be secure. From both internal and external threats.
