Re: Deranged?
I don't disagree that many of here could do it cheaper than the proposed £4m but you have missed a few things. For example, a pen test? Those secure access APIs for the police etc - you realise these will need to come in through a secure Government Data Network, not the Internet, so you need to factor in connectivity to that. Then security (NCSC) won't allow you to have a single server dual-homed (i.e. both Internet facing and on the GDN) so you'll need more than one server and firewalls and have to gain approval for your design from the Government Accreditor, And now you need to rent space in a secure, Government approved DC to host it all in.
Suppose you do manage to persuade the Accreditor that police access to the APIs via the Internet is acceptable: how do you intend to log individual Police access to detect and report on misuse? Who's going to do password changes etc for the police and other privileged users and somehow guarantee against social engineering? Perhaps the police have a federated AD you can use instead? Well, there's another interface to develop for and test against.
And this won't happen quickly. There's probably a six-month waiting list to get time from the people who can actually answer questions about the GDN, which GDN, where to tap into it etc etc. Similarly the Government Gateway if you have to use that to ID the users.
It might not be £4m but I think you'll be surprised just how quickly £100K evaporates. I'm sure I'll get downvotes but this is simply the reality of dealing with Government the moment there is any 'security' related element to a system.
Biting the hand that feeds IT
