UK government tool to monitor its legacy application estate is… LATE

A system designed to keep track of the UK government's ageing application portfolio promised by Joanna Davinson, who was once responsible for overseeing £1bn additional costs on the much-delayed Emergency Services Network, has — you guessed it — been delayed. Speaking to the House of Commons Public Accounts Committee last …

[John Robson]

Why

Does a system to track legacy IT need to be dynamic... surely it's just a case of maintaining a list with each having a planning process for replacement.

Of course if you want a system to track all IT systems, then that might need to be dynamic...

[Anonymous Coward]

Re: Why

Not enough lines in Excel for tracking legacy IT systems...

[leadyrob]

Late?

I'm struggling to understand how such a tool could be late?

Surely it's just a case of:

1) Start Excel

2) Create new Blank workbook

[Security nerd #21]

Re: Late?

That assumes they aren't using an old version of Excel and hit the max number of records issue (sound familiar ? looking at you NHS test and trace :) )

[Strahd Ivarius]

Re: Late?

They are still using Visicalc...

[Lazlo Woodbine]

Re: Late?

Loath as I am to defend the Government, but based on my attempts to log make / model / OS version & software installed on the ~500 PCs across the couple of dozen buildings at my last employer, I can imagine how much of a nightmare it must be across the whole UK Gov estate...

[Trigonoceps occipitalis]

Re: Late?

@ leadyrob

More complex:

3) Column 1: Project Name

4) Row 1: Date

5) Fill rest of cells with "Delayed"

Stretch Goal: Add "Double Budget" at every anniversary.

[martinusher]

Re: Late?

I think a more suitable system would be to mail out sets of punch cards to each facility along with typewritten (mimeographed) instructions how to mark/punch them using predefined fields. (To make things easier the cards could be preprinted with the fields laid out on them). After filling them out they would be mailed back and tabulated at Head Office.

[Fred Daggy]

Re: Late?

Unfortunately, the software to do such a project, is also, late as well. The person responsible has been given a golden parachute, fired and the re-hired at double the going rate.

[colinb]

4 box model?

BS Buzzword Bingo is a game all can play

Want to guess where this lot lands in the four box model of competence

Unconsciously Incompetent | Consciously Competent

-------------------------------------|----------------------------------

Consciously Incompetent ...| Unconsciously Competent

[Valeyard]

Re: 4 box model?

it's based on the conjoined triangles of success

[jollyboyspecial]

Words Fail Me

They don't have an inventory of the hardware and software they use?

Words have failed me, so I'll have to resort to letters instead.

W T F?

[Doctor Syntax]

Re: Words Fail Me

Define "they".

"They" as an office (i.e. your local JobCentre) might have an inventory but "they" as a department (ministry) might not have an inventory of what the offices have, nor might it be easy to get one as some offices might not have an inventory.

Alternatively "they" as a department might have an inventory but "they" as the Cabinet Office or whoever it is who's doing this might not - in fact obviously doesn't.

Then we come to define "inventory" and its relationship to reality...

[Pascal Monett]

Let us start by defining the word "administration".

[Stuart Castle]

Re: Words Fail Me

In terms of organisation, the government isn't one entity. It's a group of hundreds, if not thousands, with each entity that makes up the government (be it a Ministry or Department) having it's own procedures and systems for inventory, admin and other processes.

Even assuming they have followed their own procedures and best practices, which in most companies is far from given, there will be thousands of systems to track down, and the individual departments may not have complete lists.

Even with government procedures, it's likely that some of these systems will have slipped through the net, even it's just something small running on a single PC.

This is a massive job. It's not just a case of adding a few machines to a spreadsheet or database. It's finding those machines.

.

[Lazlo Woodbine]

Re: Words Fail Me

Look at your workplace:

Does each department know what kit they use?

Does the senior management know what each department uses?

Now multiply that by every division in every department within every ministry of Government.

I'd be surprised if a competent Government even knew how many Windows licences they hold, never mind the shower of shit in charge at the moment...

[cantankerous swineherd]

screwed up so promoted and told to go and count the computers. nice work if you can get it.

[Doctor Syntax]

The technical term is "failing upwards".

[David Lewis 2]

Well it’s worked splendidly for Dido, perhaps they should give the job to her?

It couldn’t get any worse could it?

[Doctor Syntax]

It seems to have worked for Amber Rudd as well. I see she's just got a non-exec directorship of Centrica. And - please do not read the following whilst eating, drinking or operating machinery - her wokypedia entry describes her as a cyber-security consultant.

[Eclectic Man]

re: O M G !

Doctor Syntax is correct;

"Amber Augusta Rudd (born 1 August 1963) is a British energy and cyber security consultant. "

(https://en.wikipedia.org/wiki/Amber_Rudd)

I wonder what her day rate* is for installing firewalls, or ISO 27001 compliance audits?

*(I'm guessing that if you have to ask you cannot afford her.)

[Doctor Syntax]

Re: re: O M G !

She'll ensure you have the correct hashtags.

You'll only discover later by just how much you couldn't afford her.

[Doctor Syntax]

It's a very long time since I was in any branch of the Civil Service but at the time I was introducing some IT to the lab. Slightly more recently (it's all a long time ago now) I was working for something with a strong resemblance to the Civil Service in many ways. In either role I'd have been very reluctant to let the sticky fingers of the central organisation near what I was doing - I preferred to keep things working and not have my time wasted by ill-conceived efforts to "help".

[ColinPa]

Depends on what you want

A spread sheet is a little simple - it needs to be updated by many people - but an web driven server should meet the requirements.

The hard part is what will it be used for? If this was for a building - people will want to know does it have asbestos, does it have a cladding problems, is it at risk of flooding?

Step 1 is to build the list along lines of

1)Name(s) of application with a short 80 char description

2)Which department uses it?

3) Who is responsible for it ?.

4) Who do you contact when it goes wrong? - this may be different to 3)

Step 2

Work out how much software is the same - and who uses it.

Step 3

Work out what questions you want to ask about it.

Dont forget in The Register a few weeks ago, there was a server in the mail room which no one knew about till there was a site wide power off.

There is the risk that people will enter "excel" as the application - and not what it is used for (import export of trees)

[EnviableOne]

Re: Depends on what you want

bearing in mind HMGs penchant for all things cloudy and Microsoft, Sharepoint lists seem to fit the bill perfectly...

and rather than let the Cabinet office lead, perhaps some of the more progressive departments (HMRC, or DWP) that are more used to doing IT at scale could lead things...

It's far from impossible, since the dreaded W word, NHS Digital has managed to corral and cajole the majority of NHS organisations to cough up their info, or join the borg and now has a pretty good understanding of the NHS estate

[Doctor Syntax]

Re: Depends on what you want

NHS Digital doesn't even seem to have any understanding of the words "alpha" and "beta" as they refer to software, at least as far as web sites go, although this seems to extend to other gov.uk sites as well (looking at DVLA).

[Tim99]

Re: Depends on what you want

Before retiring I worked in the Civil and Public Services, ran companies for a banker, and then my own technical consultancy. Here is an outline proposal for somebody to create a "top line" system:-

Scoping the problem: 2 leads, 3 person-months total £100,000; 4 juniors, 6 person-months £150,000. Overheads: leases, accomodation, travel & expenses £250,000.

System: 4 basic servers running BSD with hot swappable drives (R350s? should be overkill at ~£2,000 each) i.e. a web server; one Running Python and SQLite; the other 2 as cold backup servers; cabling, etc. £2,000 - £10,000. Software cost ~£0.

"Consultancy" fees, etc.: £9,500,000 (Bolly isn't cheap). Total spend £10,010,000.

Looking at it again, I might have over-specced the hardware...

[Potemkine!]

Re: Depends on what you want

A spread sheet is a little simple - it needs to be updated by many people

A shared spread sheet then?

[Timbo]

There is an easy solution:

1) Develop a small TSR program which is copied to every PC in the known / unknown UK Govt/Civil Service "system".

Each person then runs the TSR, that basically copies all their data and installed programs to their own account on the "govt cloud" (a suitable resourced central server housed in some bomb-proof, idiot-proof, hacker-proof building, somewhere near GCHQ

TSR then deletes and then overwrites everything on the local HDD (using suitably defined c:/del *.*" command).

TSR terminates with display saying "Please turn off this machine and dial 0800 xxxxx to arrange it's collection/disposal).

2) Send everyone a Raspberry Pi 4, with a pre-written SD card carefully superglued into it's socket.

3) Users can then boot the Pi and access their data on their own account via the cloud...

All non-Pi 4 machines can then be scrapped, all data is on the cloud (and suitably protected from being hacked)...and Raspberry Foundation gets a nice big order.

And think of all the "good" coming from this, as a Pi 4 is more energy efficient than an old workhorse PC - so we help to save the planet too.

And the main outcome? There will be a specific number of Pi 4's in use. One line on a spreadsheet to then give to HM Govt saying "problem sorted".

[Doctor Syntax]

There's more to IT than PCs. More even than Pis. Or Macs.

[Timbo]

"There's more to IT than PCs. More even than Pis. Or Macs."

As far as most Civil servants are concerned, they just need a client machine to be able to log in and "do stuff" and to then be able to print off "more stuff" to pass to 3rd parties, or to update records on a central server database.

And given the Covid issues of "working from home", I'm sure the majority of "easy stuff" can be done very easily via a Pi 4...and even more "complicated stuff" can be run on a centralised server without the need for expensive beige boxes sitting under Head of Depts desks that are rarely used to their full extent....and I've seen enough of them.

If people want to play the "power game" (in terms of justifying their "position" within the "organisation"), just give them a bigger monitor...that always works !!

[Anonymous Coward]

Not even close to easy

Take a large organization. Any large organization, public or private. And ask it to enumerate all the legacy applications it runs and the hardware they run on.

Few, if any, will know.

Consider any PCs that are running a Windows version older than Windows 10, or are running an application that requires IE. Then list them. Then move on to Excel spreadsheets with homegrown code to perform business functions but which can't run in the current Office 365 Excel. And then go on to the next home grown application. Et cetera. You soon find it's not just a hole, it's a rabbit warren of rabbit holes.

Think of it this way, every ElReg comment about something breaking because of a new update means that that something can be considered legacy code.

[Eclectic Man]

Re: Not even close to easy

Sorry I could only give you one upvote. I once did a security review for a small organisation (Government Agency). When I asked how many databases do you have holding personal information the answer surprised me.

"Oh, about 300."

Each sales person had their own personal database* with their sales contacts listed. And of course, as each one was created by the individual salesperson, no two were likely to have the same structure, fields, data types, etc.

And, of course, there is always the 'I saw this really useful application on the Internet so installed it on my PC, brilliant, isn't it?' approach to individual software management.

Frankly I'd be surprised if any government department had the actual number of PCs they own correct to the nearest hundred.

*(OK, Excel spreadsheet, but really, is there a difference?**)

**(JOKE, I know there is a difference, but lots of customers didn't.)

[Pascal Monett]

Well of course

"She now heads up the government's 18,000-strong digital, data and technology professions and leads the function for government"

Obviously. She's already failed once, no reason to not let her fail again, right ?

[hoola]

Billions

So running legacy systems is costing billions but replacing them also costs billions, usually an order of magnitude such as 10 x billions.

I really dislike how the term "legacy" is used now in relation to IT.

Legacy if now applied to anything that does not align with the latest and greatest fad so you can have a system that is functioning perfectly that is only a year old yet because it is not "in the cloud" or "cloud-like" or "subscription based" and is targeted as something to be replaced. Venders are the root cause of this because they use the term to incite fear in executives (this is always where it is targeted) to generate sales or panic companies into ill-conceived and unneeded migrations. This takes focus off where the real challenges lie, the genuine, old systems and applications held together with string. The primary reason for this is because the first is a quick buck and easy profit.

Much of the problem is not so much that they are "legacy" but that due to all the political changes of the years they keep having to be updated so there is no time to actually replace them. Then when you do try to replace a system it is a total video-nasty as so much is interlinked, undocumented or simply unknown.

It is very easy to criticise (equally successive governments have been useless at this) but these are horrendously complex systems and if it goes wrong, the implications are equally horrendous. If it does go wrong you then have the unenviable task of trying to unscramble whatever has been scrambled whilst millions of people/businesses are potentially screwed over and everyone is screaming that the government is incompetent.

Constant outsourcing of systems and services has made the situation even worse as there is little incentive to sort things out. If the outsourcer does start it is yet another billion pound contract, guaranteed to fail.

Government IT failures are a mix of endless changes to the requirements after a scope has been agreed, incompetence in project management and little accountability, anywhere in the food chain.

[SecretSonOfHG]

Re: Billions

Wish I could upvote more than one time. Millions of times, in fact

[BearishTendencies]

Four box model?

How very 1980s. Why not a Wardley map or some other trendy bullshit?

Perhaps, as others have said, a list would be sufficient.

[Strahd Ivarius]

Re: Four box model?

As long as it is managed using blockchain