An Insider Makes A Forceful Critique Of Government IT Management. Pretty Solid Stuff!

 This appeared last week.

Technology lessons of COVIDSafe must be learned

Dr Lesley Seebeck
Contributor

17 August 2021

OPINION: As the government turns its thinking to a vaccination passport or similar, it would do well to learn some of the lessons from COVIDSafe.

COVIDSafe illustrates the need for a good understanding of both policy intent and how the technology works.

Aimed at ‘help[ing] assist health officials understand and contain the spread’ of COVID-19, the app is more than a benign study assistant.

It uses people’s smartphone Bluetooth functionality as an incomplete proxy for distance between potential carriers and other people. Collected data provides an approximate, near real-time social network.

That can be both helpful to understanding the spread of infection and highly invasive of privacy. Like all such data, stripped of context, it can be highly misleading and potentially open to abuse.

So, kudos to the government, which realised it needed strong privacy provisions around COVIDSafe data.

However, it’s not enough to do good on the legislative side alone: government needs to follow through on the technology and implementation.

A fundamental lesson of running a technology shop is that most apparently technical faults aren’t technical in nature but organisational.

A ‘technical failure’, for example, may expose how after a reorganisation, no-one had assumed responsibility for backing up key systems, or that a long-departed contractor had hard-coded passwords.

When these events occur, best practice in a mature technology organisation is to run an all-hands retrospective, after-action review, or blameless post-mortem to understand what happened, to identify systemic issues and a way ahead.

Such exercises are not to find scapegoats but to ask ‘why’ until a root cause is found.

Typically, it takes several iterations, digging progressively deeper. And it requires a healthy, open, informed, constructive, and respectful culture. After all, technology done well is hard; the technology savvy organisation will seek opportunities to improve.

The report by independent researchers Richard Nelson, Vanessa Teague, Jim Mussared and Geoffrey Huntley probably offers the best insight into COVIDSafe’s technical, privacy and security issues.

The organisational issues can only be inferred. For example, the hurried implementation that led to oversights on privacy issues, the prioritisation of user interface changes over privacy and security issues, the choice of security advisories by the Digital Transformation Agency, and persistence with a notification protocol that required workarounds that in turn introduced inconsistencies.

Without digging deeper, root causes can only be guessed at.

What is clear, however, is that the government’s technology competence could be improved, at both the technical and organisational level. As policy is increasingly shaped and implemented through technology, that’s needed.

First, people. Twenty years of outsourcing, combined with a continued erosion of public service knowledge and rapid technological change, makes it hard to argue, aside from some niche areas, that the government is an informed judge of technology.

But more ‘techies’ alone won’t help much. Technologists need to be exposed to the complexity of policy and delivery; policy and program managers need to understand the nature, opportunities, constraints, and weaknesses of technology.

Ministers, too, have a responsibility to be much more familiar with technology than they are now. They need to learn to avoid optimism bias, be wary of vendor promises, and be willing to listen to the practicalities of complex design and implementation.

Second, process. Given the fusing of policy, programs and technology, government needs an appropriate means of oversight—one that has a good grasp of technology and the economic, societal, and national security implications in design, implementation, and operation.

…….

Dr Lesley Seebeck is an Honorary Professor at the Australian National University and the former chief executive of the ANU Cyber Institute. She has worked in senior roles across government including as Chief Investment and Advisory Officer at the Digital Transformation Agency.

More here:

https://www.innovationaus.com/technology-lessons-of-covidsafe-must-be-learned/

To me the deeper problem is the undervaluing of technical expertise and thinking this is not a managerial domain. To competently manage and implement technology you need to not only understand the business issues but also tech capabilities, vulnerabilities and limitations at the least.

As an example take the ADHA. A technical policy organization if ever there was one!

Only two of the six executive team have formal IT expertise.

Worse only 2-3 of the 10 Board members have real Digital Health expertise.

All the tech understanding and expertise – and there is really some – are buried in the lower rungs.

No tech organization will really flourish with to many lawyers, accountants and consultants!

IT is hard and complex and needs real expertise and understanding – and the Government has outsourced all these skills for way too long! Hence the debacles we see I reckon.

David.