tfpl blog

Breaking the e-mail compulsion

Todays Technology section of the Guardian has an article describing research that quantifies the negative impact of e-mail on our working life.

Researchers have found that:

• People respond incredibly quickly to e-mail alerts: Dr Thomas Jackson of Loughborough University  found that 70% of alerts got a reaction within six seconds. That's faster than picking the phone up after three rings.  (Jackson wrote up his research in this pdf)

• The interruptions caused by e-mail take significant time to recover form:  Jackson found that it takes an average of 64 seconds to recover your train of thought after interruption by email.

• People check their e-mail more often than they think:  In a survey of office workers the majoriy told Karen Renaud that they checked their e-mail once an hour.  When she monitored their PCs she found that most of them checked it every five minutes.

• Checking e-mail is compulsive: Tom Stafford of the University of Sheffield believes that the compulsion to check e-mail has the same root cause as the compulsion to play slot machines.  The best way to ingrain a really strong habit into someone is to reward them for it occasionally and unpredictably.  The slot machine player often gets nothing, but sometimes hits the jackpot.  The e-mail checker often gets nothing interesting but sometimes gets rewarded with an invitation, some news or gossip, or some humour.

I attended a useful training course on e-mail management by my colleague Ian Wooler.  Four of the nuggets I picked up from it were:

• Don't send an e-mail to a colleague that you can see: This is a rule I have stuck to and has benefited me (it takes longer to compose an e-mail than to go and chat to them, and because you can see them you can pick a moment when they are not busy).

• Turn your automatic e-mail alerts off: this breaks the pavlovian reaction between being told you have an e-mail and going in and checking it.

• Identify set times in the day when you will check your e-mail:  I try to check mine at 10am, 2pm and 4pm.  I am more productive when if I don't start the day by checking e-mail.

• Don't put your out-of-office alert on if you are only out of the office for one day: Out of office alerts increase my vulnerability to spam (by advertising that the e-mail account is live) and is unhelpful to most or all of the people that are likely to be e-mailing me on any particular day

From a records management point of view the biggest problem with e-mail is that an important communication sits only in the in-box of the recipient and the sent items of the sender.  This means that:

• It is not accessible to others, even to close colleagues

• it is not related to the other information, documents and correspondence about the same piece of work.

The challenge that I would like organisations and vendors to address is this:

• How do we enable colleagues to generate, send and store an important communication about a project within the same application that holds the rest of the documents, communications and information relating to that project?

The closest I have seen to this situation is in SharePoint team sites, where a team site can have an e-mail account, and where mail can be sent from the team site, or to the team site.  Anyone with access permissions to the team site can view all the e-mails sent from or to the site.

I would like my e-mail to be nothing more or less than an alerting mechanism. I want my e-mail to alert me when a colleague has posted a question about a particular project in our team site, when my sister posts a message for me on Facebook or Last FM, when someone in America posts a comment in response to one of my blogposts.

The alerts enable me to go off to the appropriate application, make whatever responses I choose, and all the content stays in the appropriate application, in context, and accessible as  appropriate to other colleagues/friends/readers.

James Lappin

TFPL goes to the British Library

A necklace to hold used chewing gum in, a self pouring teapot, the Magna Carta and Shakespeare’s mortgage deed, were among some of the exhibits CIG members were invited to see by the British Library last Tuesday. A tour and presentation were given, first of the Public Treasures Gallery followed by the Business and IP centre. Members of CIG, including Katy Crosse, Lee Seymour and Claire Valentine from TFPL, all enjoyed finding out what research facilities the British library held, whilst chatting to other members and enjoying some wine and nibbles. It was also good to hear that gaining a library pass for the reading rooms was now a lot more accessible.  An enjoyable, memorable and pleasant event, promoting the Library as the valuable and facilitating resource it is. More information about the CIG can be found at  www.cityinformation.org.uk and to learn about the British Library visit click here.

By Katy Crosse

Loss by PA Consulting of Home Office data on prisoners, serious offenders and others

The Times and the BBC report this morning that contractor PA Consulting have lost an unencrypted memory stick containing:

• personal details and intelligence on 33,000 serious offenders
• dossiers on 10,000 “priority criminals”
• the names and dates of birth of all 84,000 prisoners in England and Wales.
• information on an unspecified number of people enlisted on drug intervention programmes.

The data had been entrusted to them by the Home Office.

The rash of recent data protection reports in the UK, arising from the high profile data losses by the HMRC and the Ministry of Defence, all cited the use of removable storage devices (memory sticks, CDs, laptops etc.) to store personal data  as a major information security risk.

In the months after the data losses most central government Departments clamped down on the downloading of personal data from databases.  Many Departments eliminated the risk of human error by putting controls into their systems that denied staff the ability to download data to removable devices. 

The Cabinet Office's Data Handling Review published this June came up with a minimum set of measures that Central Government departments must abide by when handling large aggregations of personal data.  The Review stated that transferring personal data out of its host database increased the risk of information loss. Wherever possible data should remain in situ.  Controlled remote access to data is preferable to physical transfers of data on removable media such as disks and memory sticks.

The measures state that if personal data needs to moved and can only be moved by removable media then the data must be encrypted and minimised.

If contractors are handling personal data on a government Department's behalf then the Department must write in contractual clauses to ensure that the contractor protects the data to the government's minimum standards.

According to the Times the Home Office did encrypt the data when they sent it to PA consulting.  PA consulting then had to unencrypt the data to use it. The loss appears to have happened after a member of PA consulting's staff was able to download the data onto a memory stick without first encrypting the data.  PA consulting at the time of writing are yet to comment on why this unencrypted download to memory stick was allowed to happen.

The Home Secretary told the BBC that the Home Office had written clauses into PA Consulting's contract that required PA to follow the Government's standards for the handling of data.

If this is true then the loss appears to be more PA Consulting's fault than the Home Office's.  However I am wary of coming to conclusions at this stage as experience of previous data losses shows that a fuller picture only emerges days and even weeks after the incident is first reported.

This incident is likely to call  into question whether contractual clauses are a strong enough protection for personal data being processed on the government's behalf by contractors.  PA Consulting are an established reputable firm who perform a lot of work in the military and security sector:  if they are making these errors then one presumes that other contractors will have similar weaknesses.

James Lappin

Transforming HMRC in response to its data loss

Review of information security at HM Revenue and Customs by Kieran Poynter

The Poynter Review is no ordinary information management consultancy report.  But then HMRC's loss  in October 2007 of disks containing the addresses and bank account details of 7.5 million child benefit recipients was no ordinary data loss.

• The review cost a staggering £3.6 million.  It encompassed a full investigation of the circumstances leading up to the loss in October 2007;  a detailed assessment of 15 HMRC business units against criteria derived from the Information Security Standard ISO 27002; and the review of an audit that HMRC carried out of its information outputs across the organisation.

• The consultant, Kieran Poynter is Chairman and Senior Partner of Price Waterhouse Cooper.

• The findings go further than purely information security: they set out a new strategic direction for HMRC.

• As soon as it was published the Information Commissioner slapped an enforcement order onto the HMRC for breach of the Data Protection act.  The order requires HMRC to periodically report back on how they are proceding in implementing the report's recommendations (effectively making the findings mandatory)

The findings of the Poynter review set out to do two things: to change the organisational design of HMRC, and to change the culture of HRMC, both in order to improve information security

Changing the organisational design of HMRC

Poynter states that:

• The main vulnerability to personal data loss occurs when data transfers from one system or process to another.

• The great many different types of taxation and benefit that HMRC administers each have seperate systems for capturing, maintaining and using personal data about the individual citizen/business.  This increases risk of personal data loss.  It necessitates the maintenance and control of large number of different systems which hold significant aggregations of personal data; and it multiplyies the instances where data moves from one system or process to another.

• In the short term HMRC should try to increase its level of information security control over these different systems, but the fragmented nature of the existing organisation design will always leave HMRC with a higher than desirable level of vulnerability to data loss.

• HMRC should start moving on a long term direction of travel towards keeping one central record for each individual citizen and each business.  Each seperate process for the administration of a particular form of taxation or benefit would then draw from that central record, and update that central personal data as and when they worked with that individual.

• This model would change HMRC's relationship with individual citizens and businesses.  Individual citizens and businesses would be able to update their own tax and benefit record.   

• Individual citizens and businesses would benefit by no longer having to give the same information to different parts of HMRC on different forms.

• HMRC staff time could be concentrated on cases where citizens needed their help in completing information (hard to reach groups) and on improving the tax yield by reducing miss-payment and fraud.

Making information security a management priority

We information professionals have long complained that senior managers do not take good information governance seriously enough.

The HMRC data loss was so large and so traumatic that Poynter has had carte blanche to map out what world class information governance would look like for HMRC.  These are the features that emerge from Poynter's recommendations:

• Set information Security as a corporate objective. Keeping personal data about taxpayers and benefit recipients accurate and secure should be seen as a central role of HMRC as the UK's tax administrators.  It should be written in the list of HMRC's departmental objectives, and translated down into specific objectives for each line of business.

• Articulate an information security strategy.  The strategy should identify critical risks; key responsibilities; how information security will be integrated into the working of HMRC; and what HMRC's approach will be for ensuring compliance.

• Identify key responsibilities at a senior level. The Chief Finance Officer should also be designated the Senior Information Risk Office (SIRO). This is in line with the Cabinet Office's recommendation that all Central Government departments should nominate a SIRO at board level.  Reporting to the Chief Finance Officer should be a Chief Risk Officer, who should head up three teams:  a risk management team, an information security team and a  physical security team.  The information security team should be headed up by a Chief Information Security Officer reporting into the Chief Risk Officer.

• Ensure that managers have access to good quality information security advice.  Prior to the data loss HMRC recruited internally for information security roles. Poynter recommends that the HMRC should recruit strong professional expertise for its central team of information security experts.  It should also embed an information security expert in each of its four Lines of businesses. The central team should take responsiblity for co-ordinating and monitoring information security across HMRC, and keeping up to speed with the implications of new technologies, new ways of working and new threats.   

• Ensure that HMRC has professional capability in risk management. Poynter identified a lack of professional risk management expertise in HMRC prior to the data loss.  This resulted in a bottom up approach to risk management where business units identified and managed their own risks.  There was insufficient consideration of risk at board level.  Poynter recommends the appointment of risk management professionals to support the new Chief Risk Officer and to provide corporate risk management support for the different Lines of Business.

• Establish clear local accountabilities for information security.  Within each Line of business, the line management of each business unit should be fully responsible for, and accountable, for information security.  Each unit should appoint a Data Guardian to advise line management on information security issues and to work on ensuring that colleagues are have the knowledge, skills and motivation to apply information security measure in their work.  Data Guardians should report to the Line of Business's Information Security Professional.

• Ensure senior manager are held acountable for information security in their area.  Poynter recommends that the Chief Executive and his advisors should have regular performance review meetings with each individual Line of Business Directors-General, and that information security should be one of the items on the agenda for these meetings.  The Chief Information Security Officer and Chief Risk Officer should provide advice for the Chief Executive at these meetings.

• Tailor policy, procedures and advice to staff in each area.  A key role of the information expert in each Line of Business is to translate corporate information policy and procedures into specific advice tailored to the needs of their Line of Business.   In the short term very clear and very specific guidance should be given to staff working in areas identified as a high information security risk.

• Build information security into management and leadership training.  HMRC can not entirely eliminate information risk.  Information security is not HMRC's only priority. Determining what level of information risk to accept for any particular process requires the business knowledge of managers as much as it needs specialist knowledge of information security experts.  Poynter wants the HMRC to define its own leadership development programme for its senior managers and to include in that a module on information security.  Poynter also wants information security to be built into HMRC's Process Programme (PaceSetter)  The central plank of Pacesetter is a methodology called LEAN, which enables managers  to analyse their area's business processes and to identify how they can be made more efficient and effective.   Poynter wants the LEAN methodology to be enhanced to equip managers with the ability to identify the information risks of their current processes and of any changes they propose to these processes. He also wants those processes that have already been changed by the 'LEAN' methodology to be re-examined to check that their re-design hasn't added an unacceptable level of information risk.

• Ensure that staff are aware of the importance of information security from the moment they start the process of joining the organisation.  Include mention of the importance of information security in the recruitment advert and the job description, mention it at interview, in the letter of appointment, and in the contract of employment.  Itemise responsibilities in the job description.  Include information security as a mandatatory part of the induction process.  Don't let staff graduate through the induction process until they have completed the information security element.

• Ensure that new staff understand what constitutes a data breech and the disciplinary consequences. 

• Provide annual information security refresher training for all staff in information security on an annual basis.  Face to face training for staff working in areas of high information security risk, and a e-learning package for the rest.

Bridget Treacy of law firm Hunton and Williams has posted a well-informed article on the Poynter Review here

Lessons learned from the HMRC Data loss

Independent report into loss of data related to child benefit by the Independent Police Complaints Commission (IPCC)

Reading the IPCC report into the HMRC data loss is like reading one of Shakespeare's tragedies. 

When you start watching Romeo and Juliet you already know that the couple will end up dead in each other's arms.

When you start reading the IPCC report you already know that on 18 October 2007 an HMRC official (Employee J) in Washington, Tyne and Wear, will place two password protected but non-encrypted disks into a yellow transit envelope adressed to an auditor at the National Audit Office, London.  The disks will contain contain the names, addresses and bank account details of 7.5 million child benefit recipients.   He will say the words 'Its gone now' as he places the envelope into an out tray, but the envelope will never reach its destination.

The IPCC report gives you a blow by blow account of the the minor errors of judgement and misunderstandings that led up to the loss.  The deeper fundamental causes of the loss are dealt with in the Poynter Review.  The drama of the IPCC report stems from the contrast between the triviality of the errors of judgement with the enormity of the loss itself, and the genuine anguish that it caused officials.  IPCC found no evidence of deliberate neglect or disregard for the law, or for internal HMRC policy, by officials.

The report illustrates perfectly the point that every time personal data is copied from one system to another it increases the risk of personal data loss.

HMRC had very robust controls in place to limit the circumstances in which HMRC Business Units could obtain copies of data from the main child benefit database.  The child benefit database was based in Long Benton, Tyne and Wear, and operated by a contractor (EDS).  To obtain a data scan from the database a Business Unit  had to fill out a 'URAC' form, specifying what data they wanted copies of and why.  The form had to be costed, approved and signed off by the Information Management Solutions Business Unit (IMS).

But there were no similar controls in place to govern what a Business Unit did with that data once they had obtained it.

Every six months HMRC's Claimant Compliance Business Unit followed the URAC form procedure to order a full scan of the records of every child benefit recipient, which they used to determine a random sample of cases to investigate to check against fraud.  The data-scan was sent to Claimant Compliance on unencrypted disks.  Claimant Compliance then loaded the data from the disks onto a stand alone computer in a secure room.

In the spring of 2007 a National Audit Office auditor asked his contact at HMRC (a junior official anonymised as 'employee D'' in the report) for a scan of all new and completed child benefit cases, so that the external auditors  could come up with their own sample of child benefit cases to inform their audit. 

Employee D worked in the Benefits and Credits Business Unit.  She decided not to go through the formal URAC procedure (which could take weeks or months and incur a cost of several thousand pounds).  Instead she asked Claimant Compliance Business Unit for a copy of their latest routine six monthly scan.

In March 2007 the disks containing a six monthly scan of the entire child benefit database was handed over to the auditor in person, when he visited on-site.  He returned it safely several days later.   In the autumn of 2007 the auditor made a similar request for a similar sample of data.  This time he was not due to visit the site and asked for the disks to be sent to him (the file was to big to be sent by electronic means through the government secure intranet).  The official in IMS (Employee J) who put the disk into the transit envelope was not accustumed to sending physical media in the post.  He mistakenly beleived that the postal system he was using was a tracked courrier system with an audit trail of packages.    The package did not reach the auditor and could not be traced once the loss of data was reported.

Key contributory factors to the data loss included:

• The option to reduce the data scan so that the auditor only got the data he needed was not taken up.   The data in the Compliance scan was far more detailed than the auditor required.  He didn't need or want the most sensitive data:  bank account details and home addresses.    Providing this data breached the third principle of the Data Protection Act (that data should be relevent and not excessive for the purpose for which it is required), and massively increased the adverse impact of the data loss.  The auditor had asked for the data to be removed.  His contact at HMRC (Employee D) was concerned about the cost and time implications of filtering the data,  and advised the auditor to discuss his needs with officials from HMRC's  Knowledge, Analysis and Intelligence Business Unit  at his forthcoming meeting with them.  The discussion never took place.  During the investigation into the data loss it transpired that software existed on the Compliance Directorate's stand alone computer that that could have filtered out the unwanted data without cost.

• It was not clear who was responsible for authorising the sending of the disk to the auditor.  At various points in the e-mail correspondence that preceded the (succesful) transfer of disks to NAO in March 2007 colleagues in  both Compliance Directorate (the directorate who possessed the datascan) and IMS (the directorate who had obtained the datascan for Complaince Directorate)  expressed concerns about the amount of data that was proposed to be sent to the NAO.    But neither directorate knew which of them was responsible for making a decision on whether or not the data is released.  These concerns were never escalated to a responsible officer or senior manager for a decision to be made.  The IPCC's interviews and forensic examination of the e-mail boxes of the official's involved show that no senior manager knew at any stage that this amount of data was due to go off site. The March 2007 transfer passed off without incident, but it set the precedent for a similar but failed transfer in October 2007.

• The relevant data protection and information security policies were insufficiently visible and insufficiently specific. None of the officials involved in the sending of the data were aware of the content or whereabouts of relevant information security and data protection policies.  Information security policies were stored on the intranet and were difficult to find.  HMRC did have a policy on sharing information with the National Audit Office, and it stated that transfers of data to the NAO should be 'cleared with a senior manager'.  If officials had been aware of this and followed it, this may have prevented the data loss.  However the policy was insufficiantly specific:  it did not identify which senior  manager should authorise the transfer and by what procedure the authorisation should be sought and recorded.
  

• The protective marking allocated to the information on the disks meant that the disks were not required to be encrypted. When EDS produced the disks of the data-scan for the Claimant Compliance Directorate the data received the protective marking of 'Restricted'.  It was these disks that would later be sent on to the National Audit Office.  Information in the category 'Restricted' was not required to be encrypted when it is communicated electronically.  This is not a weakness unique to HMRC, it highlights a weakness in the Government's Protective Protective Marking Scheme that guides all Government departments in how to handle sensitive information.  The Marking Scheme had not taken into account the fact that when large amounts of personal data are aggregated in one place the  impact of any loss is magnified.  The Cabinet Office's Data Handling review has adressed this issue by creating a new protective marking specifically for large aggregations of personal data.

The element that gives the report its drama is the e-mail trail that leads up to the data loss.  The report illustrates the disadvantages of e-mail when it comes to making decisions that require the input at different stages of different people.   People appear on the address lines of e-mails, only to drop off those address lines as the plot unfolds.

• The senior manager with ultimate responsiblity for the NAO audits of Child Benefit was copied into an initial e-mail indicating that a small sample of data would be sent to the auditor at the NAO in March 2007.  He was not copied into any e-mails thereafter as the  data transfer escalates to a full download of all records on the Child Benefit database.

• The e-mail trail leading immediately preceding the data loss in October 2007 resembled an electronic version of pass the parcel.  The NAO's auditor asked his new main point of contact at HMRC (Employee C), for a copy of a similar data-scan to the one he had used in March.   Employee C passed him on to Employee E in Claimant Compliance Directorate because they held the data-scan.    Employee E referred the auditor by e-mail to Employee J at Information Management Solutions.  Employee E told the IPCC that he made the referral because he felt that IMS were the directorate best placed to provide or refuse authorisation for the disks to be sent.  But Employee J in Information Management Solutions interpreted the e-mail as constituting authorisation from Claimant Compliance for the disks to be sent.  So he obtained the disks and sent them.    No-one had consciously made a decision on whether or not to authorise the sharing of the data or the posting of the disks.  No discussion had taken place, instead an e-mail trail with attendant miss-readings and blind spots had led to a disastrous loss.

The Information Commissioner Richard Thomas, and Mark Walport, state in their Data Handling Review that there was no problem with the HMRC sharing personal data of benefit recipients with the National Audit Office for the purpose of informing their audit.  The problem was the unnecessarily large amount of data shared, and the insecure methods used to share it.  They describe the HMRC loss as  a 'multiple-systemic failure':  failure across a range of fronts including cultural (low priority for data security), technological (insecure data storage and transfer methods) and procedural (lack of appropriate authorisations and failure to use data redaction methods to minimise data shared).

The diverse nature of these failings, and the fact that they were by no means unique to HMRC, has resulted in the wide scope of the Government's response to the loss.  The Cabinet Office's set of minimum measures that Central Government departments must put in place when handling large aggregations of personal data include measures to address issues of culture, responsibility, training and technology.

James Lappin

Data Protection comes of age

Five important data protection reports were published in the UK in June and July 2008.

Taken together the reports signpost a change in attitude to data protection:

• moving away from passive, lacklustre compliance, where data protection is seen as the preserve of a small number of staff with designated roles.
• moving towards a far more dynamic approach to data protection where organisations whose business depends on the collection and use of  personal data see the good stewardship of that data as a fundamental part of their operations.

The characteristics of this new approach are that: 

• information risk is actively addressed as a management issue

• awareness of data protection and information risk is identified as a key competency of those staff whose role involves the handling of sensitive personal data

• every significant aggregation of personal data in the organisation has a guardian actively responsible for ensuring the protection and proper maintenance and use of that data

• data protection policies are written clearly, tailored to staff in particular roles, and actively communicated, monitored and enforced.

Three of the reports stemmed from the loss of personal data by HMRC (Her Majesty's Revenue and Customs) in 2007.

• A report by the Independent Police Complaints Commission's  (IPCC) describes the specific circumstances that led up to the HMRC data loss

• A report by Kieran Poyntyer (chariman and senior partner of Price Waterhouse Cooper LLP) looks at the fundamental causes of the HMRC data loss, which he identifies as a failure of management to take information security seriously, and an organisational design ill-suited to information security.   

• A Cabinet Office report sets out a core set of measures that all central government departments must take to ensure that a similar personal data loss does not occur elsewhere in Government

The fourth report also relates to a data loss:  Sir Edmund Burton's report into the loss of a Royal Navy recruiters laptop containing unencrypted personal data of 600,000 people.

The fifth report has a wider ranging topic and theme: it is a review of data sharing by Richard Thomas and Mark Walport, which examines ways in which the data protection regime can be improved to allow beneficial data sharing whilst still protecting personal privacy.

I took the reports on holiday with me, and in the next few blogposts I'll be drawing out the key messages from each one.

Risks and Opportunities in Social Computing II

On Thursday evening the Social Computing project team held a second focus group in Glasgow to get further perspectives on the benefits, risks and challenges associated with the use of social computing tools in the workplace.

In keeping with the blog entry on the first focus group, the discussion is summarised below. First we look at comments related to specific tools and then move onto the identified risks, opportunities and challenges. Interestingly too, in addition to the general issues faced by organisations, there was discussion on the LIS perspective on the tools.

Wikis

• Benefits included: potential for improved productivity and increased currency with greater ease of updating
• There is the ability to control the quality of content by having contributions approved before being published
• Version control and the ability to roll back to previous iterations of a document was seen as a plus
• Concerns include the ability to update anonymously, reliability and authority of contributions and associated legal implications. This was countered with the argument that the more who contribute, the better the quality
• Having a wiki operation in isolation from other internal systems is a limitation

Blogs

• Seen as a good way to disseminate information to staff and a means of engaging with your stakeholders

Social networking

• Effective platform to attract prospective undergraduate and graduate students to an organisation
• Keeping in tough with alumni is made easy with social networking tools

Discussion boards/forums

• In one organisation discussion boards are used for staff to post questions for reply by their colleagues. This is seen as a means for internally marketing one’s skills if you are able to answer the questions

Instant Messaging

• Lack of archiving of instant messages means that they are not available for future reference; but there is the same issue with face to face or telephone conversations. On the other hand, it offers an avenue for informal messages that are not important enough to archive

LIS attitude

• "We always look at the risks." We tend to thinks of the risks first, rather than opportunities but this is done so as to address the risks
• There is an issue around the validity of information recorded on systems. For example someone labelling themselves on Facebook as an expert in an area, when there are others in the organisation who are in fact more of an expert. There is no control of the terminology used
• Social computing tools are seen as an opportunity for LIS to market themselves and their resources. They can act as mediators. Eg: if staff are communicating on a forum, LIS staff can see what they are talking about and intercept if they can assist in finding the answer
• Tagging is by its very essence supposed to be for user generated tags, however LIS may prefer to decide the terms that information should be categorised by. User contribution can be used to positive effect by collecting the right terminology from staff and then using this to develop a controlled vocabulary

Benefits/opportunities of social computing tools

• Opportunity to promote knowledge sharing
• Possible to improve work practices with greater ease of updating

Challenges of social computing tools

• Winning buy-in from managers and articulating the benefits
• Not all staff may have the same access to tools and there is an expectation by some that they should have access to these tools. This may generate negative feelings amongst staff. For example, an accounting clerk without access versus a marketing person with access
• There is concern over control when working jointly internally or externally on social computing tools. How robust is your system and is everyone using the tools to the same standard
• Trust versus control between employers and employees. Everyone needs to know their rights and responsibilities and what is/isn’t acceptable
• Controlling these tools takes considerable time and effort
• The need for critical mass for tools to work and also the appropriateness of the tools to the groups size and to the task they are working on
• Social computing tools can be used for training needs analysis. Eg: discovering that is the secretaries and not the practitioners who are contributing. As training needs are visible there is an opportunity to use this to market your services and training
• Established and experienced staff have already got good contacts and networks in place. As they have this already in a manual sense, what is the benefit for them to convert to the electronic tools? Why would they want to share what has taken them so long to build up?
• Getting uptake may require a cultural shift. Some users (including LIS) are not actually familiar with the various tools and what they do
• Getting contributions is one thing but then how do others use and interpret the material if they do not understand your context when creating it?
• Establishing ownership of information in the public domain, which may lead to inadvertent misuse. As an aside: One member brought the Creative Commons license to light. This establishes the rights that third parties have to copyright material - it is an intermediary between all rights reserved and free-ware or no rights reserved: "some" rights are reserved

Risks of social computing tools

• Lack of control puts organisations at risk and there is a large potential of damage to reputation
• Lack of awareness of legal issues such as privacy and copyright
• On the flip side of the points above, trying to control staff to rigidly may kill their enthusiasm for the tools. Employees need to be trusted. Those who are out to cause damage will do so regardless of social computing tools being available
• People using the tools may seen to be time wasting. Example given of nurses on Facebook in the ward while families are visiting patients. Additionally there is the risk of bad PR in these circumstances
• The risk of non-adoption. Eg new graduates may choose their employer by the tools and access provided
• Risks are seen to be greater in closed/internal systems
• Is there an accessibility risk in terms of staff who are unable to use the tools as others do. Are organisations leaving themselves open to accusations of discrimination?
• Identity theft - is it a substantial risk or has it been exaggerated via the media? Are these tools really any riskier? It is up to individuals as to what they disclose but additionally, the burden of data protection lies with the organisations which hold users personal details

What is the greatest risk/opportunity/threat?

In summary, the group identified the following as the greatest risk, opportunity and threat

• Greatest risk: Potential for damage to reputation due to a lack of central control over published content
• Greatest opportunity: Improving on current work practices by implementing tools that are easier to use and update and better enable sharing, networking and flow of information
• Greatest challenge: Realising the full potential of opportunities and benefits that social and collaborative tools offer, in terms of buy-in, awareness and promotion, training, uptake, quality contributions

It is interesting to see that the same issues that were encountered when for example the internet was rolled out to staff desktops are cropping up again. We have the same set of problems with a new generation of tools

Thanks to all who have participated in the focus groups and contributed to the project.

The Project Team