|
Memorandum from Fujitsu Defence and Security
Background
The current national security and resilience (NSR) situation is complex in that it covers resilience both in response to terrorist action and civil disaster or contingency. The recent publication of the National Security Strategy (NSS) provides a useful opportunity for taking stock.
The UK has had a counter-terrorist strategy (known as CONTEST) for some years. It is based on a framework of four P's, · Preventing things happening by dealing with the underlying causes · Pursuing those intending violence to reduce the threat · Protecting the UK by reducing physical and electronic vulnerability · Preparing for attacks should they nevertheless happen.
The CONTEST strategy was made public in 2006 - in itself a sign of changing times and a recognition of how much information is now in the public domain about the activities and capabilities of the police as well as, intelligence and security agencies.
The latest advance was the publication by the government in March 2008 of the National Security Strategy for the UK. It is important because it acknowledges and captures the nature of the changes that are occurring, and sets out the government's aspirations for the way things should develop further.
The NSS, for the first time, puts terrorism formally in the wider context of other threats to the nation and its people. It carries forward the logic of the Resilience agenda in recognising that responses to threats and catastrophes may have common features independent of their origins. It broadens the scope of national security to look at the risks to the UK from terrorist, criminal, man-made and natural disasters.
The Strategy also notes that the pervasiveness of the internet and mobile communications, and their familiarity and accessibility to those active in crime and terrorism, means that a great deal of the recruiting, planning, preparing and organisation of criminal and terrorist activity now takes place in the electronic space. Increasingly, this is the battle space within which government needs to be effective if it is to detect and prevent malicious activity. At the same time, our electronic dependency also provides opportunities for criminals and, potentially, for terrorists.
The NSS recognises explicitly that measures to reduce vulnerability, and to increase preparedness to deal with disaster, build resilience against a range of threats, and are consistent with a more all- hazards and all-embracing 'comprehensive approach'.
'Because of the scale and speed of the risk they [pandemic, epidemic, flooding, extreme weather] pose, those phenomena have similar potential to other security challenges to threaten our normal way of life... Moreover our approach to them... is similar to our approach to other national security challenges, including terrorism... as economies and societies grow increasingly dependent on national and global electronic information systems, it becomes even more important to manage the risk of disruption to their integrity and availability through cyber-attack whether terrorist, criminal or state-led' National Security Strategy for the UK March 2008
In summary, the government's intention is to encourage a broader and more connected view of National Security that links more closely the integrity of the state and the safety of the individual. It seeks a more effective coalition of central and local government, security and intelligence agencies, law enforcement, business and commerce, as well as non-profit organisations and individuals. In effect, both a globalisation process and a multi agency approach is required if a coherent and effective response to NSR is to be achieved, and if critical national infrastructure (CNI) is to be protected.
The government has a leadership role to play and has made some major changes to address the multi agency approach with: · The creation of the National Security, International Relations and Development Committee (NSID) formed from the Cabinet, chaired nominally by the Prime Minister · The reorganisation of the Home Office. This includes the creation of the Office for Security and Counter-Terrorism (OSCT), a unified Borders Agency and extensions to e-Borders, continued (for the moment) commitment to the National Identity Scheme (NIS) and new Police Counter-Terrorism structures · The last spending round that favoured security, intelligence and counter-terrorism (and constraints on defence spending) · Reviews of intercept as evidence and data security, new asset freezing proposals, new court rooms and judicial arrangements for terrorist trials, and proposals for detention beyond 28 days
In the future, consideration is being given to: · Consultation on ideas for a joint Parliamentary National Security Committee · Strengthening of horizon-scanning and forward planning capability · Creation of an (advisory) National Security Forum with representation from government, the wider political scene, voluntary sector,, academia and others to discuss strategy and exchange ideas
The NSS also seeks to balance terrorism against other threats to civil society, with for instance 'flooding and flu' seen as a greater immediate threat to our way of life than terrorist incidents. The response level will be the same however with the focus on operating within a complex multi agency environment
Problems and Issues
There is a distinction between responding to a large scale crisis, which so far the UK has not suffered, and a point attack, such as 7/7. In a large scale crisis, there will almost certainly be features that distinguish it from a more straightforward situation. Specifically, a complex multi agency environment, significant military engagement and a requirement for interoperability between all agencies, particularly the first responders (police, fire service, paramedics, NHS etc), local and central government, the security services and military. Key to establishing the required levels of interoperability, is the ability for each of those agencies to be working from a common operational picture and able to communicate by voice and data with all other agencies.
The main issue is the need to effect a more 'joined up' approach to any response in the face of this multi agency environment. This involves not only technology but also doctrine and process. This approach needs to be implemented in harmony across all organisations involved so that they may be exercised to a high standard of delivery ahead of any crisis. If not the danger exists that in a crisis, organisations and individuals will revert to what they know best and ignore newer technologies. The widespread use of commercial mobile phones by the emergency services in 7/7 is a case in point.
There is, therefore, a growing 'cross-over' area in which many of the approaches, disciplines, capabilities and skills developed to meet the needs of traditional defence and security clients are equally needed in the UK civil government sector. This cross-over area does not have the degree of coherence, predictability or procurement doctrine familiar in individual departments such as the MOD. The government aspires to something more coherent and joined up. There are some good examples of effective partnership but there appears to be no clear plan to achieve it. For instance, substantial obstacles exist in the range and nature of accountabilities of different parts of the sector, their enabling legislation, and the way budgets are allocated.
There may be plans for a 'single budget' for counter-terrorism and security, but this is likely to be at best, the sum of the parts rather than an accountability mechanism. In effect there is a real risk that the nation will remain so compartmentalised that it will find it impossible to identify and procure the systems up front that would enable it to "join up" across organisational boundaries when faced with a multi agency crisis, and thereby allowing the first responders and the security services to react to crises efficiently and comprehensively.
The consequences of different agencies not being all informed results in confusion and delay when time is likely to cost lives. If the situational awareness of different agencies during a complex emergency is not the same, responses are likely to be both slow and uncoordinated. Relatively simple solutions, either adapting legacy systems or using Commercial off the Shelf (COTS) solutions, can plug these holes quickly and efficiently.
The Fujitsu Approach
Information and Communications Technology (ICT) has a major role to play in enabling this more joined up approach and delivering interoperability. Fujitsu is one of the largest suppliers of IT systems to both government and the private sector; with installations in the Home Office, Cabinet Office, MOD, HMRC and Security Agencies. It is in a pre-eminent position to assist government departments to work more effectively both singly and also with other organisations. Fujitsu Defence and Security, as one of the UK's leading IT Systems Integrators, is well placed to manage this process. As well as helping to enlarge a market for ICT and our services in particular, we are also very aware (in common with much of industry) of the capabilities and technologies available which are not being utilised and could make a real difference to all our lives and security
There are two distinct areas where Fujitsu can bring its defence and government expertise in ICT systems to bear,
- At one level, it is a matter of integrating information across a secure government infrastructure, which is already available in silo systems, to provide the authorities with the right secure information to enable them to manage the crisis at a strategic level. - At another it is bringing new advanced capabilities together to generate interoperability at the operational level - as a key systems integrator. This would include capabilities such as the Crisis Communications Service - integrating incompatible comms networks, and the OpenJop system providing situational awareness for operational commanders at Gold or Silver level. What we are doing and key recommendations
To date Fujitsu has been promoting awareness of the issues around large scale resilience crises, as opposed to the single point attack, which we believe have not been fully evaluated in respect of their impact on any multi agency response. We believe more could be done in the areas of interoperability and the ability of technology (with the associated changes in doctrine and process) to deliver increased capability "on the ground". In many respects there is technology available which is not costly or complex, which could be implemented relatively quickly and which would make a real difference. Part of the problem appears to be the lack of a pan government process of evaluation and procurement that can determine which technologies would deliver effect quickly and cost effectively across the agencies - in some ways analogous to the UOR principle in the MoD. However the multiplicity of agencies including 43 police services etc, makes the implementation of a single UOR process in the civil sector much more difficult to realise - although the appearance of OSCT and similar cross government agencies may make a difference in the future.
To assist recognition of these issues, we have for the past two years been raising awareness in a number of public events. We sponsored a Chatham House seminar in May 2007, for invited leaders of a range of agencies that could be involved in a large scale crisis. This included the police, fire service, government departments, regional resilience forum, utilities, environment agency etc. It was chaired by Sir David Omand, and as far as we are aware, was the first attempt outside government, to collect representatives of all the agencies that might be involved within a large scale crisis (whether prompted by natural disaster of terrorist attack) in a single place - to debate the issues around interoperability and response. There was a follow up event on HMS Belfast in July 2007, which Lord West and Dame (at the time) Pauline Neville Jones attended. We have also spoken at other conferences such as RUSI and CityForum alongside other NSR speakers, as well as promoting more directly our capabilities at Fujitsu open days and major exhibitions such as DSEI last September.
Key Recommendations for the Committee
The questions that might be useful to explore would include,
- What are the capabilities that are available now and which could provide increased performance across the agencies especially in delivering operational interoperability.
- Assuming we have the technologies to improve interoperability, how do we establish the processes, legislation and budget alignment to make effective multi agency working happen
- What is the relative risk, impact and likelihood of a large scale crisis happening as a result of terrorist action, rather than another point attack.
While less likely it is we believe very possible (and becoming more of a threat), and the impact if it occurs could be devastating. The ability of the country to work as a whole, at local as well as national level, would depend to large extent on the ability to improve levels of interoperability on the ground. We need to have this in place, trained, exercised and embedded within the culture of the various organisations, but particularly the emergency services, before the next crisis hits us. Attempting to implement increased levels of interoperability at the same time as managing the crisis, would be extremely hard if not impossible.
11June 2008
|