Capita strikes again: Bug in UK-wide school info management system risks huge data breach Capita has admitted a bug in an information management system used by 21,000 UK schools could have incorrectly linked contact details to the wrong pupils – an incident with huge implications for pupils' data protection. The error, which has been pinned on a December 2017 upgrade to the Schools Information Management System, …
I once spent six months working for them as a freelance tester - Government stuff. Unfortunately they had not budgeted for kit, so I spent two months scampering around to gather kit to build a test environment so I could get my team working.
When we started failing applications Capita went ballistic, we were not supposed to actually test it, they had no slack in the budget for fixing defects. I was extremely pleased to reject the renewal.
"Or billing."
Nope, they are rubbish at sending out invoices or chasing for any sort of payment.
They gobbled up a company which supported our Cisco Callmanager system, since then we have to ask them for invoices (They just don't send them, so we have saved thousands of pounds for the past few years).
I am hoping they get dumped, since they can't sell anything either.
That's simply explained.
A system costing £10m/ year to support needs a company that can support a £10m contract, right?
Wrong. In HMG land if the system runs 10 years it needs a company that can support a £100m contract
Why?
Because we're the British Government, and we're special.
Multiply all numbers by 10 or 100 and you see why only "Special" contractors (like Capita, Thales, and the other Usual Suspects) can possibly be considered for this.
Bit like Carillion.
Other MIS providers are available - I'd take a look at the others that ex-SIMS users are flowing to, some stats here: http://bringmoredata.blogspot.com/
I supported education networks for years, and SIMS was a constant problem child. They'd make simple changes with wide reaching consequences and not bother to tell anyone beforehand or specify them clearly in the release notes. In one memorable patch they shuffled lots of the codes used to classify absences, leaving us uncertain if students were away from school by arrangement or needed warning letters to be generated. It'd also hog resources and jam up when stressed... which happened every day at registration. Teachers would often take paper registers and fill in the details later to save time, often a few days worth in one sitting. You can see the issue with that...
Forgive me for not being at all surprised by the cock-up, or their conservative estimate of the impact.
"...some of the parents have double barreled names too, that dosent help"
Names can get tricky [1]. I always ask my adult students to write down what is on their passport/travel documents at enrollment so when they get their certificates at the end of the course there aren't any amusing issues when they go for jobs &c.
[1] https://www.kalzumeus.com/2010/06/17/falsehoods-programmers-believe-about-names/
I hope whoever dropped the date-of-birth match does not work on further education college systems as well... ten to fifteen times as many enrollments often...
"...some of the parents have double barreled names too, that dosent help"
Names can get tricky [1]. I always ask my adult students to write down what is on their passport/travel documents at enrollment so when they get their certificates at the end of the course there aren't any amusing issues when they go for jobs &c.
[1] https://www.kalzumeus.com/2010/06/17/falsehoods-programmers-believe-about-names/
I hope whoever dropped the date-of-birth match does not work on further education college systems as well... ten to fifteen times as many enrollments often...
It comes down to the commissioner needing scale and have no way to critically evaluate if they are any good and can deliver.
Why they can't Google the trail of disasters i don't know but again most of the failures are kept well hidden.
Take Amey for example, they have recently taken to doing council waste services but did not have any capacity to do food or garden waste.
Still got the contract, guess what, there are a lot of maggot infested bins and uncollected garden waste.
Yeah. Amey. West Berks Council.
You'd think people would have learnt and wouldn't outsource to them. They have form going back well over a decade. And some of us <cough> saw this coming
...why I've been getting notifications on the SIMS app on my phone that my son has had 100% attendance at school for the last few weeks...
...despite having left in June after his GCSE's.
I hate the damn app with a passion. Prior to migrating to it, the school used SharePoint. Not everyone's cup of tea but the customisations meant that I could track a LOT of info from my son - from achievement (positive) or behaviour (negative) points, and why they were awarded to whether he was above, on, or below track for a given subject and so on.
The SIMS app would tell me - well fuck all of any use basically. I'd get a popup on a Friday with a summary of his attendance from two weeks before...I could see if he'd had any of the above points but not in which subject or why etc. Nothing about progress.
Basically a waste of space on my phone.
So I do wonder who's kid has been in trouble for not attending the last few weeks :)
>That would be a breach of DP would it not?
This would seem to be a breech of DP and GDPR, as it seems it is automatically linking the details of the new pupil Joe Smith with parent John Smith, to the pre-existing record of existing pupil Zoe Smith with parent John Smith.
Interestingly, at both my children's junior and secondary schools, I had to explicitly link my two children's records together, which would seem to indicate they aren't SIMS users...
Zoe Smith is the child of John Smith and Emily Williams but Emily is now living with Fred Wilson and had a child with him called Joe. Joe Wilson is the brother of Zoe Smith and he has Emily and John down as parents whereas Joe has Emily and Fred.
Now Fred and Emily have Chloe living with them, Chloe is Fred's daughter with his former partner, Susan Jones and retained her mother's family name. However, Emily has parental responsibility for Chloe Jones and so she should be down on SIMS in that case. So should Susan as although Chloe is not living with her, she still is her mother.
So. Zoe Smith; Joe WIlson and Chloe Jones are all siblings but different people living at different addresses need to see their records.
If Emily comes into the school office and says that she has a court order that prevents John seeing Zoe how does that get recorded in SIMS? And does that prevent the school from sending information about Zoe's progress?
So relationships are more complex than in my day so it easy to see that it can get screwed up. And in education software there are fixed release dates set around events in the school year so the pressure is on.
However, there is this thing we have all heard about called testing...
Obviously, this will do Capita's battered reputation no favours.
However, if you're talking of the SIMS Parent App, it is actually a good piece of software that provides almost real-time access for parents to attainment, progress, conduct, attendance, homework, timetables and more. Clearly, your experience was not a very good one, but I suspect this was down to inappropriate configuration, either of the underlying SIMS system or of the Parent App coupling. This requires considerable expertise and knowledge if parents are to get a good experience - the software certainly does not "just work" out of the box.
But this is still not good news.
Yes, local authority managed schools in Scotland mostly (like 95%) use system called SEEMIS which is run by a strange entity which is both owned by and independent from the authorities.
It's not without it issues either.
Private schools in Scotland might well use SIMS but more likely Pearson Phoenix.
"...Why are we outsourcing to Crapita? Can someone explain it to me?.."
Because it works out cheaper in the long run
Because Capita have such an outstanding record of delivering robust solutions on time, under budget and that perform exactly as required
Oh yeah - because it lines the pockets of various ministers with their pudgy fingers in the pies of these companies?
Capita are, of course, big beneficiaries of outsourcing. But SIMS, the MIS in question, is not an outsourced product. It was already the dominant school MIS in England when SIMS (the product and the English company behind it), was bought by Capita, many years ago. Schools are not forced by Government or Ministers to by any particular MIS. However, as more and more schools are absorbed into multi-academy trusts (a trend where there *is* a strong whiff of political leverage being applied), we are seeing those MATs impose a chosen MIS - maybe SIMS, maybe others - onto their schools.
"How do they keep getting these contracts?"
"Why are we outsourcing to Crapita? Can someone explain it to me?"
Three words - Lowest Economic Bid
Not helped by the marvellous tangle of budgets from LEAs, Central Gov, and lord knows what else. I understand in some instance it is only Capita that bids for these things.
Always the cheapest
Consequently, always the worst.
That's the thing though with SIMS - it is by no means cheap. In fact its about the second most expensive on the market.
The reason schools keep using it is that moving is a massive job and "everyone is used to SIMS". It takes a *lot* to convince management that changing how things are done would be a good thing.
While hurling well-deserved brickbats at Crapita, spare a thought for the poor sods who are going to have to sort this mess out: the schools' data managers. These downtrodden individuals have to work with SIMS (or equally appalling products like CMIS) all the time. As non-teaching staff they are treated as being the lowest of the low and, usually being term time plus some holiday working, get paid three-fifths of damn-all with pensions to match.
Summer holidays? Forget it. School management will leave it until the last moment to tell you about the assessment scheme they want you to implement for next year, so what with that and exam results analysis it leaves precious little time to squeeze in a vacation.
Some will even be forced to produce the school timetable using Nova T6, a package so evil that 'user hostile' doesn't come close to doing it justice.
Couple all of this with execrable software from practically all suppliers to schools, dealing with teaching staff who have all the IT skills of a small piece of putty, laughable local authority support and lies from Capita and you'll get some idea of how happy I am to be retired.
I agree with with much of what you say, but 'laughable local authority support' depends on who your local authority is/was - it's wrong to generalise because there are many good, dedicated teams out there. Our LA team works damned hard, damned long hours, for damned little money ('gold-plated pensions' - hah!) and does a damned good job in advising and supporting schools, especially when it hits the fan like this.
“If you have imported a CTF for pupils joining your school, that included parents or other contacts with a name that matched exactly to a contact record already in your database, the applicant may have been linked incorrectly to this person and some data may have changed.”
Have Capita ever considered indexing the Pupils on a unique record id and checking for duplicates. Or whatever indian intern they 'hired' on to write the software.
The data controller is liable under the GDPR. However Capita are not the data controller.
What legal recourse does the data controller have against a supplier who wilfully or by gross misconduct causes the controller to breach the law?
Futhermore, as the data controller is not able to control the SIMS in any way - they cannot choose not to use Capita and SIMS - how can they ensure compliance?
Then there's the sanction. What is a school's revenue? Or is it the LEA?
Simpler and better to just fine Capita 4% of their annual revenue 21000 times.
But in this case Capita are the data processor so likely to be the liable party. Since the data controller didn't, presumably, ask them to screw up then it is the processor who is the more liable party (as I understand it). This risk of penalty to Data Processors is one of the changes that GDPR brought in.
What ever happened to UPNs? As already stated, a check against name, address, post code and DOB won't result in unique or matched result. But pupils are assigned UPN and ULN in school which follow them through their educational life. Since they are generated with an algorithm and have validation rules against errors... Why not use these?
I used to work for Crapita, running a large SaaS app focussed at certain market segments (not saying which for anonymity reasons). The app predates Capita acquiring the company I worked for, it wasn't developed in house by them.
Anyway, in my tenure there (more than 5 years, less than 10), we had one outage of around 50 minutes, and that was due to a bug in a third party subsystem we were using.
I've just chatted to an old colleague and had a look at their uptime page, they're now seeing 1 extended outage PER MONTH on the service - they've not upgraded the hardware (or refreshed old hardware), buggy releases going out as most of the original development team have left and they insist on paying new developers peanuts, so only get ones who aren't used to running a huge distributed system. It's an utter shambles.
Utterly dysfunctional company.
Why are we supporting rubbish there are better MIS out there which some schools have been using for a while and find it better. Also why are we propping up a company Capita that if it was not so tied in with the government would have gone bust after its stock warnings... Councils need to stop insisting on SIMS and let schools choose and stop putting money into a company that will never change.
Do you know that its happened again, and lots of schools will hit the same data problems as last year. Once, you can forgive developers for incorrect code and algorithms and not testing thoroughly enough. However it happened again in April and its happening again this July.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
