Select Committee on Public Administration Minutes of Evidence

Examination of Witnesses (Questions 60-70)


24 NOVEMBER 2005

  Q60 Jenny Willott: One of the other reasons the Government has given for saying it would be a good idea to have an ID card is that you could use it to tackle benefit fraud, and obviously that is one of DWP's priorities. From my understanding of it, most people who are committing benefit fraud are not lying about who they are: they are lying about their circumstances and saying they are not working when they are, and things like that. Is there any evidence from local government of situations where it has been used successfully?

  Mr Tyndall: No.

  Q61 Jenny Willott: Okay!

  Mr Collins: You are absolutely right that when you talk about benefit fraud you have to distinguish, as you have done, between individuals who are simply trying to sort themselves out and organised rings of people who are in the business of manufacturing false identities to claim wholesale benefits. Obviously there are far more individuals, but the value attached to successful fraud and potential savings to the system all lie with preventing systematic fraud where false identities are systematically manufactured. The prospect of a stronger authentication of identity, both in the base register and at the point of benefit claim, is that that systematic fraud can be squeezed out. Whether that is realised or not we will wait to see, but the prospect is there.

  Q62 Jenny Willott: The assumption that we have been talking about with the IT system is that it would be used by government departments. We already know that banks are potentially interested and in theory lots of areas of business would want to start using the system as well. Does that have IT implications for the sort of system that it would need? Does it have cost implications if there are going to be others accessing the information that is held by government that are not currently able to access it that way? Does that have IT and cost implications? One of the things Professor Dunleavy mentioned in the submission is about leakage of information to unauthorised users. Is that being taken into account with the planning of the IT of this system? Obviously you are always going to have people getting information through dodgy means, but if you have more and more different types of organisations accessing central databases, what is being done to ensure that they cannot access information that they are not entitled to access?

  Mr Tyndall: In general terms, yes, the more doors there are into a room, the more the chances are that they will be inappropriately used. I do not know the answer specifically to the design of the ID card scheme. I am not able to give you evidence on that. It is outside my area of knowledge. But the general proposition must be the case. There are also difficulties of complying with the law. The Data Protection Act is absolutely clear, that you can only collect information and hold it in electronic format for the purposes for which informed consent has been received from the person concerned. Quite apart from leakage and everything else, there ought to be safeguards in place so that the system is appropriately designed from the outset. My experience is that system designers take their Data Protection Act responsibilities very seriously.

  Mr Collins: I think there can be a gap sometimes between what you want to achieve and the system and the implementation. Just to quote the smart card example in the NHS, they planned to issue something like 800,000 smart cards and they had very elaborate security procedures to ensure that only those who were legitimate users could access information—they are building a national database of electronic medical records. All that went out of the window, they discovered, when a contractor wrote the pin number on the smart card, because it gives access—doctors and nurses do not want to have to log on to the system each time and do not want to be logged off if they have not used the system for a couple of minutes. There is not an easy answer to that, even with the elaborate security procedures they have. That comes back to the point I was making earlier that those are the sorts of risks that need to be identified early on, so that you can decide how they can be mitigated.

  Q63 Jenny Willott: Is there any evidence that they have been identified?

  Mr Collins: We ask a lot of questions—What happens if, for example, in the NHS people do not bring their smart cards with them? How do they identify locum doctors?—and we are told the procedures are there and they expect people to adhere to them.

  Q64 David Heyes: It is this unwillingness or inability to learn from mistakes of the past that I would like to take you back to. We keep going into these projects built around IT, not equipped with a reverse gear. Once you are in, you cannot pull out. Everybody is so heavily committed to it, and we do not learn post hoc. You have mentioned already the Revenue and Customs settlement with EDS just announced this week. It sounds very good on the face of it, £70-odd million to be paid back for their failures, but it is an agreement that has what they describe as a "significant confidentiality requirement". This is an area in which this Committee is particularly interested, the foul-ups on tax credits, and this looks like we are closed down from learning through investigating what has gone on. Should it not be the case that the Gateway review is the answer to this problem? We can learn as we go, that can feed back and we can avoid making the same mistakes again.

  Mr Collins: Gateway reviews are part of the answer, but also the strategic business case and outline business case as well if you can edit them for confidential information. The Gateway reviews are not carried out that regularly. There is a six-stage process that starts with the feasibility of projects right through to the benefits realisation, but at least it would give an idea. Some of these reviews that we have seen just refer to the department's ability to meet its commitments: Does it have the buy-in of stakeholders? That is not commercially sensitive information. I have not seen details of costs. Sometimes these Gateway reviews do refer to the suppliers, but the suppliers themselves do not see them. They are not even passed around departments: there is only one copy made and it is up to the department head to release them. From the Gateway reviews that I have seen that have been published I cannot see why they cannot publish them with sensitive information removed. I think it would be a very good idea because it enables assumptions to be challenged. That is the key thing. If you have the information, you can question whether a problem has been identified as a potential show-stopper. That is the real issue. We have seen time and again with projects that go seriously awry that the potentially serious problems are dismissed as teething. If there were scrutiny, then as parliamentarians you do not need a lot of technical knowledge to see that sometimes a project is going wrong. Usually it is for managerial reasons or policy reasons or a divide between policy and the technical people.

  Q65 David Heyes: So Gateway reviews should be made public. That would be your recommendation.

  Mr Collins: Indeed, suppliers, when asked that question by the Work and Pensions Committee said, "Yes, we would like to see them. We would like them to be published".

  Professor Dunleavy: There are other mechanisms that might be helpful for learning. Sir Gus O'Donnell has recently announced—and no doubt you will be looking at it—the idea of bringing in the equivalent of comparative performance assessments into departments (Capability Reviews). At the moment, the problem is that the departments' basic administrative systems and so on are not reviewed in a public way by other people. They are reviewed by themselves. There is a dialogue between civil servants and ministers, with scrutiny by the select committees. This is not really the same as looking at the ability to draw lessons and to learn lessons and to move things forward. If you were looking at the Home Office, it has a whole set of quite complex IT projects on the go all at once. It would be very helpful to learn lessons from different projects and to see that that was being fed into the way that other projects were being run. And, increasingly, running these projects is what central government departments mainly do. These are very critical. They are not just back-office systems, they are vital to whether or not you deliver on your core objectives and your core targets.

  Q66 David Heyes: Indeed, it could apply across the whole field, with increasing marketing of service delivery.

  Professor Dunleavy: Yes.

  Q67 Chairman: If we had a system that was working well, we would have the plug being pulled on projects at various stages, would we not?

  Professor Dunleavy: That has happened. The Office of Government Commerce has pulled the plug or has done Gateway reviews which have then caused ministers and departments to decide to pull the plug.

  Q68 Chairman: We have departments on the whole and ministers who are committed to projects because they have announced their commitment to the project. As we have heard, they have oversold the benefits of projects, because that is what you do, and you have suppliers who are also in the business of overselling the benefits, because that is what they do. On the kind of figures that we are talking here it makes old kind of lobbying look pathetic. We are talking on a scale here that goes beyond anything that we have seen before. You have a lot of people who in a sense are wanting all this to motor along, even if there are difficult bits of evidence coming along, so unless we build in the critical elements, the external elements, which is what you are suggesting, there are things about the system, are there not, which almost induce us to finish up with these outcomes that cause us unhappiness.

  Professor Dunleavy: Yes. But one thing that happens an awful lot in IT projects, which has been a key source of contractors earning more money than was originally outlined, is that ministers do change their minds. Policy decisions are made and then remade and remade again. A few years back, the norm in the IT industry was a six-for-one ratio, that you would go in for a competition and you would compete for a certain amount of money and you would then expect to get possibly up to five or six times as much extra as a result of policy-induced changes that were made subsequent to the contract having been agreed. That is not a very effective way of running your relations with a very large industry. If you compete for a £100 million contract and you know that ministers are going to change their minds and you are going to end up with a £600 million contract at the end of five years because of policy changes, then you are in a different situation from if ministers have to commit and there is good pre-legislative scrutiny or pre-policy scrutiny and there is a good updating project that keeps Parliament informed on how things are going.

  Q69 Chairman: We did have pre-legislative scrutiny on the Identity Card Bill but your argument is that we did not have it on the kind of information that you would need to have to do it properly.

  Professor Dunleavy: Not only that, but as far as I can see there has been a considerable change in the scheme and a move towards what is basically just a chip-and-pin scheme and biometric validation at the beginning or every 10 years. That is a different scheme from the one which the Home Office conceived.

  Q70 Chairman: But, as we are hearing, it is the nature of these things that the schemes do change long the way.

  Professor Dunleavy: Absolutely.

  Chairman: This has been fascinating. It has been extremely helpful in making us think not just about the particular issue of identity cards but about how Parliament gets a handle on this whole area. The reality is we shall probably reconvene in about 2020 to do a retrospective audit on what went wrong, but you have given us a glimpse of how we might do it differently. Thank you very much indeed for the session.

previous page contents

House of Commons home page Parliament home page House of Lords home page search page enquiries index

© Parliamentary copyright 2006
Prepared 22 February 2006