Chapter 7

Chapter 7

Information technology issues

Introduction

7.1        During the course of the committee's inquiry, the Presiding Officers initiated a review (Roche Review) of information and communication technology (ICT) for the Parliament. The review examined the management and delivery of ICT service and equipment for the Parliament including operating context, resourcing, services and equipment provided, security issues and future institutional arrangements.[1] The President informed the committee at the October 2012 Supplementary Estimates that the review had been completed and tabled a copy of the report.[2]

7.2        The implementation of the 11 recommendations arising from the review will result in a significant change to the way in which ICT services are planned for, and provided to, all users of the Parliamentary Computer Network (PCN). These changes are aimed at addressing the many concerns raised about the provision of ICT services and providing a coordinated, streamlined and responsive approach to ICT.

7.3        However, while major changes are being introduced as a result of the ICT review, the committee considers that it is useful to provide an overview of ICT issues which have been raised during the committee's estimates hearings. The committee will also examine the development of the new Parliament House website project undertaken by the Department of Parliamentary Services (DPS).

ICT services for parliamentarians and staff

7.4        Until the recommendations of the Roche Review are fully implemented, ICT services for parliamentarians, their staff and the staff of the parliamentary departments are provided by the four parliamentary departments and the Department of Finance and Deregulation (Finance) as follows:

7.5        Parliamentarians also often provide their own ICT equipment, principally iPads and iPhones, many of which link to the PCN as 'unmanaged' devices.

7.6        The Roche Review provided the ICT expenditure reported to the Australian Government Information Management Office by the three parliamentary departments for 2010–11 as follows:

The Parliamentary Computer Network

7.7        The PCN provides IT services to around 4,800 clients.[4] This includes parliamentarians, their staff both in Parliament House and in electorate offices and the staff of the four parliamentary departments. The PCN also hosts applications to:

(a) support the day-by-day work of the parliament (such as the Table Office systems, Hansard Production System, broadcast camera management system, and archive systems for Hansard and broadcast records);

(b) provide information to parliamentarians, notably from the Library and Chamber Departments;

(c) provide information to the Australian community, notably through the Parliament House website;

(d) manage finance, human resources and procurement for each Department; and

(e) support some operations of the building, including security systems.[5]

7.8        In 2010–11, the average staffing of DPS IT services was around 100 officers. DPS also accesses commercial providers of equipment and applications. Key commercial providers include Microsoft, SAP, Honeywell, Integ, IBM and Hewlett Packard.[6]

Electorate office ICT

7.9        In May 2003, the Presiding Officers and the Special Minister of State signed an agreement whereby DPS would provide IT support to electorate offices on behalf of Finance with Finance meeting agreed costs of this support. While this agreement expired in 2006, it continued to be the basis for the service agreement. Under this agreement, DPS developed and maintained the Standard Operating Environment which is used in Parliament House and electorate offices and provided by the 2020 Service Desk. Finance used external contractors to supply, maintain and support onsite hardware in electorate offices, to maintain links to Parliament House and from electorate offices and to provide training services for electorate office staff.[7]

7.10      During 2008, talks commenced between DPS and Finance to transfer responsibility for electorate office IT support to DPS. It was hoped that agreement for the transfer to occur would be reached by June 2009.[8] Mr David Kenny, then Deputy Secretary, DPS, commented that the intention of the transfer was to improve service levels and to deliver a consistent service to parliamentarians whether in Parliament House or their electorate office. In addition, the change would simplify support for clients. Mr Kenny explained:

The intention—and these are my words—was to improve productivity and to get consistency. At the moment, there are four organisations involved in supporting parliamentary IT services. That is us, the two chamber departments and the Department of Finance and Deregulation. I think it is a generally held view that we do not need that many; that it can work very well with fewer parties involved.[9]

7.11      It was noted that the responsibility for parliamentarians' entitlements for IT hardware would remain with Finance.[10] However, at the Additional Estimates 2011, Mr Kenny indicated he understood that decisions about IT entitlements would pass to the Presiding Officers.[11]

7.12      At the Budget Estimates May 2010, DPS indicated that agreement had not yet been reached for the transfer of responsibilities for electorate office IT as there were governance and legislative issues to be resolved and Finance had indicated that it was not likely that the transfer would occur before the next election.[12] The transfer for responsibility of electorate office IT took place on 1 July 2011. From that date DPS took over management of IT equipment and desktop applications in electorate offices of parliamentarians from Finance.[13] Responsibility for mobile devices including mobile phones and their costs and the car kits as well as residential phone lines and multifunction devices in electorate offices remained with Finance.[14]

7.13      DPS was to receive the allocation funding that had been made to Finance, less an amount arising from the Gershon review of Commonwealth IT, for the new responsibilities.[15] Mr Kenny indicated that DPS was undertaking a review of all electorate office equipment but noted that much of the equipment in electorate offices is old and has presented DPS 'with quite some headaches about how we go about scheduling the replacement'.[16]

7.14      Ms Carol Mills, Secretary, DPS, also commented on the replacement electorate office ICT equipment and noted that the provision of equipment by Finance was based on a lease-of-equipment model. However, with government moving to a model of purchase rather than lease, 'what that means for us is that we have a demand on our capital budget that we do not really have adequate funding for because we have a peak of having to replace equipment with purchased equipment, not leasing'.[17] Ms Mills commented that because of DPS's tight budget, not all equipment will be replaced in the next financial year:

We are going to have to look at a strategy of, I guess, stretching that replacement out, prioritising those that are genuinely non-functional and then those that are not quite obsolete—they are working but they are not meeting contemporary standards—and then moving into our regular cycle of purchase. Inheriting everything at once creates an artificial situation where we are putting a lot of money in upfront and we do not, therefore, have the capacity to spread the budget in a way that would make it easier to manage.[18]

7.15      Ms Mills stated that there is 'probably a gap of around $2 million if we were to replace everything that we think needs replacing at the moment'.[19]

Issues canvassed at estimates

7.16      Major issues canvassed at estimates hearings have included lack of consistency of IT services, fragmentation of responsibility, lack of clarity in service provision, response to emerging technologies, security threats and reliability of services.

Fragmentation of responsibility

7.17      The lack of consistency of services and equipment between electorate offices and Parliament House offices has been a major concern for senators. For example, it was noted that the systems were such that the docking stations for laptops were different in electorate offices and Parliament House offices.[20] The fragmentation of responsibility for IT services has meant that committee members have found it difficult to resolve problems with equipment. For example, problems with BlackBerries including the frequency of the need to re-enter passwords, the length of the password, frequency of resetting passwords and the disabling of the blue light, which indicated that Bluetooth was active, were raised at a number of estimates hearings before a satisfactory resolution was achieved.

7.18      One example which highlights this problem was in relation to resetting Blackberry passwords. This matter was first canvassed at the February 2011 Additional Estimates. DPS indicated that Finance was responsible for the policy on length of passwords and frequency of resetting.[21] At the October 2011 Supplementary Estimates, following advice from Defence Signals Directorate (DSD), DPS stated that DSD gives advice on password requirements, some of which were mandatory and others recommended only. DSD requirements relating to parliamentarians' BlackBerries were that they should be mandatory. DSD however, explained that agency heads may choose not to comply with policy controls in cases where there are valid reasons to vary from a control. DPS went on to comment that it did not provide BlackBerries so that Finance was the relevant decision maker.[22]

7.19      At the February 2012 Additional Estimates the matter was canvassed again and Mr Kenny advised that at the end of 2011, advice had been received from Finance that DPS was the decision-maker in relation to BlackBerries. DPS had then received more recent advice from Finance that it believed that Finance still had a role in this matter. In relation to who would make the decision if there was a difference of view between DPS and Finance, Mr Kenny stated:

If it remained not in dispute but with different views, they would presumably escalate to the Special Minister of State and we would brief the Presiding Officers.[23]

7.20      At the May 2012 Budget Estimates Mr Kenny noted the large amount of 'toing and froing' to come to a resolution on security levels, but it was now the position that DPS could set the minimum password.[24]

7.21      A further matter canvassed at the 2012 Budget Estimates was the access to certain services such as Wi-Fi in electorate offices. DPS indicated that while there were no technical issues with the supply of Wi-Fi to electorate offices, there were security considerations.[25]

System availability and reliability

7.22      Systems availability and reliability has been a major issue with the PCN since the early 2000s. For example, at the February 2004 Additional Estimates the committee sought explanations for a major failure of the PCN during the previous sitting week. It was noted that parts of the system had failed for up to one and a half days. Committee members commented that the PCN was a source of major complaints.[26] Problems have also occurred with the email system.[27]

7.23      In its submission to the inquiry, DPS reported that there are increasing demands on the PCN and 'the network was not originally designed, nor was DPS funded, for such high demand'.[28] Mr Kenny explained:

I would certainly agree that the current version of the system is overloaded, which you can take to be agreement that there is insufficient capacity. It is not that we cannot acquire more; it is just that the logistics of putting in the new servers with the new software and migrating people across to them, along with all their historical data, is time consuming and we cannot schedule it until we are confident that the new system is reliable.[29]

7.24      DPS has pointed to funding as well as security concerns as the reasons for problems with the PCN. Nevertheless it submitted that it provided a 'credible level of service':

...given the history of the DPS funding (which has been discussed under other Terms of Reference of this inquiry), as well as the diversion of resources to IT security matters, we consider that we provide a credible level of service to our clients. Over the last two years we have also been able to improve components of the service, including the introduction of wireless connectivity for IT services through most of Parliament House, and the new service to connect iPad and iPhone devices to the network.

Nevertheless, recognising the feedback from customer surveys and anecdotal advice from Senators, Members and their staff, DPS aspires to provide a higher level of service. DPS proposes that higher standards be included in an expanded version of our services catalogue.[30]

Information security threats

7.25      IT security has been identified as a key challenge for DPS which reported that various forms of attack on IT systems are now occurring on a regular basis.[31] For example, in February 2010 the Parliament House website was targeted and disabled by internet protest group Anonymous, which appeared to be objecting to the filtering regime being proposed by the government. It was accompanied by email attacks, phone calls and faxes. The website was hit with 7.5 million requests for communication per second which disabled the website.[32]

7.26      Mr Kenny described the DPS response as 'basically reactive' by shutting down access in an attempt to block the attacks. He added that information was provided to the AFP and DSD had been consulted.[33] When asked about taking more preventative measures Mr Kenny responded:

As a matter of course, we have a range of measures in place to protect the network and to protect email against malicious or mischievous attacks. Since February we have had a review of all of our defences. Obviously we suffered some inconvenience because the internet was down for probably several days in total. We have reviewed the software and hardware that we use to block such attacks, identify where such attacks are coming from and try to block them. We have had discussions with our internet service providers and with a couple of other government agencies who are obviously also interested in being able to protect their own systems from such attacks. We have investigated another product which we are in the process of looking at buying. We have been trialling it.[34]

7.27      Concerns with hacking of the PCN arose in 2011 when the email system had been hacked. It was reported that 'unknown parties, possibly foreign intelligence agents, accessed thousands of emails in the Australian Parliament House network, used by parliamentary staff and ministers'.[35] DPS responded that:

...yes, there has been a lot of media about hacking into a range of systems internationally, including corporate sites around the world and other parliaments around the world, and there were a couple of articles referring to the Parliament House network here. Obviously, from the fact that a number of sites were affected, it remains an issue for all of us...IT security and managing IT and generally improving IT reliability is as high a priority for us as any of our other fairly urgent tasks.[36]

7.28      At the October 2011 Supplementary Estimates hearing, Mr Alan, then Secretary, DPS, stated that he expected information security issues would remain in the short and long term.[37] DPS submitted that:

...future models for ICT services to Parliament need to provide adequate funding to ensure security, while still providing innovative and responsive services to parliamentarians and to the Parliamentary Service.[38]

7.29      DPS added that it has been 'actively responding to IT security concerns, and is receiving assistance from Government agencies'. DPS went on to note that 'the major focus on this issue within DPS has necessarily meant that some aspects of service delivery have had a lower priority'.[39]

Responding to emerging technologies

7.30      Improved access to new technologies to assist senators and members in undertaking their work has been raised regularly in estimates hearings, for example, in relation to use of iPads. At the October 2011 Supplementary Estimates, Mr Thompson stated the DPS position:

The dilemma we are faced with, with the whole iPad thing, is exciting new technology and great opportunity but we have been bringing it in against a background where we have been very concerned about information security. We are being very cautious about that.[40]

7.31      As iPads emerged as an effective and convenient technology, many senators and members purchased their own iPads to use for parliamentary business. These were initially not connected to the PCN. At the February 2011 Additional Estimates, DPS indicated that it had commenced trialling the use of iPads, as well as other mobile computing devices in late 2010. DPS stated that the trial would allow it to identify the issues associated with connecting iPads to the PCN. It was noted that if a privately-purchased device was to be connected to the network 'we want a degree of veto over what software gets loaded on it'.[41]

7.32      Mr Thompson reported at May 2011 Budget Estimates that the iPad trial was 'largely' successful and that DPS should be able to provide this service to members in the future.[42] He added:

The conclusion of our trial was that there can be significant productivity benefits to all building occupants, but there is then a logistical thing, which we are close to finalising, and hopefully we can commit to a service. We are very close to being able to provide a service.[43]

7.33      Connection of iPads was again canvassed at the October 2011 Supplementary Estimates where technical issues in relation to email addresses, calendars and the use of iPads were raised.[44] At the February 2012 Additional Estimates Mr Kenny reported:

I think it is fair to say that the iPad service is now well beyond the trial and in very widespread use. It is still on the basis that the individual has to provide their own iPad device, but we have now expanded it technically so that you can use it in two ways. One is just as an unmanaged device, which just gives you access to your emails on the internet; the other is as a full parliamentary computing network portable device so that you can access all services on the PCN.[45]

7.34      Mr Kenny also stated that, in the context of assessing electorate office IT, the provision of a device such as an iPad was under consideration.[46]

Review of ICT for the Parliament

7.35      The report of the review of ICT for the Parliament by Mr Michael Roche was provided by the President at the October 2012 Supplementary Estimates. The scope of the review included the PCN and the services delivered by that network, both in Parliament House and in parliamentarians' electorate offices. It included web-based services, mobile and other devices capable of connecting to the PCN such as tablets and smart phones. It also included audio visual services to the extent that they are digitised and available over the PCN.[47]

7.36      The report included 11 recommendations with three key themes:

7.37      The President informed the committee that the Presiding Officers had agreed in principle to the recommendations made, and had instructed the parliamentary departments to facilitate their implementation. The Presiding Officers had also agreed on a governance structure for the delivery of parliament-wide ICT services with the Presiding Officers retaining overall responsibility. A joint appropriations and staffing committee with oversight of the delivery of parliament-wide ICT services by DPS would be established and a chief information officer (CIO) for the Parliament would be appointed.[49]

7.38      A parliamentary ICT advisory board is also to be established. The board will oversee the development of the strategic plan for parliamentary ICT. It will be chaired by the Secretary of DPS and will comprise one senior representative from each of the other parliamentary departments, the Parliamentary Service Commissioner or the Parliamentary Service Commissioner's nominee, one nominee from the government party, one nominee from the opposition party and one nominee from the minor parties and Independents. There will be user groups which will include a parliamentarians group, a members of parliament staff group and a parliamentary departments group, and these are in the process of being established. The President stated that the Presiding Officers believed that the new governance structure provides greater opportunity for input by senators and members into the type of ICT services they receive.

7.39      The President indicated that discussions had commenced with the Special Minister of State in relation to the issues identified in the report. In particular, that discussions were being held regarding the recommendation made by Mr Roche that BlackBerries and multifunction devices be transferred to DPS along with all other electorate IT, and the recommendation relating to the approval of the acquisition of new technology by senators and members through an amount to be sacrificed from their stationery and office requisites allowance.[50]

7.40      Ms Mills also commented on implementation of the Roche review and stated:

...I strongly support those recommendations and that direction. I think it is imperative that we provide as streamlined a service as possible to members and senators and their staff. I feel that there are a vast number of areas in which we can improve on the delivery of ICT services through enhanced coordination and particularly with a stronger focus on understanding what it is that members and senators require. You are a mobile work population. Mobility is now in a technical sense much more available to us than ever before and it is certainly one of the things that I want to focus upon in the next few months.[51]

7.41      At the committee's hearing on 30 October 2012, Ms Mills indicated that an acting CIO had commenced with DPS and arrangements were underway to select a permanent CIO. Ms Mills also informed the committee that nominations for the parliamentary ICT advisory committee had been received and work was progressing on identifying issues to be considered by the board over the next 12 months.[52] The Presiding Officers have also agreed that, as a consequence of the establishment the board, the Presiding Officers' Information Technology Advisory Group (POITAG) will be abolished.[53]

7.42      Ms Mills also noted that DPS was working towards taking over responsibility for the ICT functions currently being performed by the Chamber departments; rationalisation of the number of corporate systems and licences; and developing the 'one-stop shop' concept for users with full implementation by July 2013. A significant matter for DPS is the transfer of electorate office IT from Finance. Ms Mills stated that the issue of parliamentarians' entitlements and the best way to provide flexible support to senators and members in choosing the equipment that best meets their needs will be examined. She went on to state:

There are a significant number of projects that we are doing at the moment that will fall under that umbrella including exploring the best way to provide support services and equipment to electorate offices and how we can deliver a program that is basically a mirror image of what you might see in Parliament House. We are, obviously, working on projects to speed up broadband access in offices at the moment and in a way that is a precursor to other things, because until we can give you good broadband speeds across the country, a lot of the other equipment, as good as it might be, will not be performing to an optimum level. That program is rolling out between now and early March. So by the end of March we should be able to, with confidence, provide access to a full range of equipment and know that it will work in all the electorate offices.[54]

Parliament House website

7.43      At the May 2009 Budget Estimates, DPS informed the committee that the Parliament House website, which had been released in 2002, would be replaced. It was noted that there had been significant changes in technology and user expectations. DPS commented that it would seek the views of users and expected that the new website would be available in 2010.[55] When the website was launched in February 2012, Ms Missingham, then Parliamentary Librarian, described the new functionality of the website and noted that it will be easier for users to find information:

Members of the public will be able to track bills through parliament and get email alerts as bills go through various stages. They will be able to be alerted when their local senator or member gives a speech in the parliament. They will be able to search Hansard separately and find information on it more easily.[56]

7.44      At the May 2009 Budget Estimates DPS indicated that stage 1 of the replacement would be finalised October 2009 at a cost of $86,000.[57] This stage consisted of consultations to determine need in order to draw up a statement of requirements for tender purposes. By the October 2009 Supplementary Estimates, the budget for this stage had increased to $150,000. As well, the completion of the stage had been delayed.[58] Ms Missingham noted that:

...we have not spent all of the money that was allocated. So, yes, it has taken a lot longer but I guess we would say that it was far better to do the right thing in the first place rather than to go to market and have a tender that did not meet everyone's new and evolving needs...

And we went to tender with a statement of specifications that described our current needs and then also said we wanted a solution that was future proofed so that it could be upgraded at additional times.[59]

7.45      Ms Missingham also provided details of the total cost of the website and noted that of the $150,000 allocated for the stage 1, $106,000 had been spent. Stage 2, which included building the website, to install the content management system and testing with user groups, was budgeted to cost approximately $1 million. The total budget for the website was $1.15 million.[60]

7.46      The committee again examined progress of the website at the October 2011 Supplementary Estimates. Ms Missingham indicated that there had been some delays due in part to the vendor's lack of understanding of the complexity of the system and security issues. However, user acceptance testing was taking place and the website was expected to be launched at the end of 2011.[61]

7.47      The new website was launched on 17 February 2012.[62] At February 2012 Additional Estimates DPS reported that the launch of the new website had been delayed by around a year. Ms Missingham described the reasons for the delay:

Work started on coding the website in about November last year and we had hoped that it would be available in the first half of last year, but the complexity of various aspects of the website led to delays. There were a number of issues in regression testing that we found and we also went through a reworking of aspects of the website as the three creators of information on the website reworked some of their business requirements. David [Kenny] has referred to the security environment that we are now in, and there were delays from undertaking security. We have done three rounds of security analysis of the website to make sure that it will not be hacked.[63]

7.48      The President also explained the reasons for the delay:

I would say one thing at the outset. Part of the delay was caused by a major breach of the security of the system externally from this place. That was something that was addressed not only in respect of that website but in terms of the operation of all IT in this place. That occurred in December 2010. That put additional costs on IT right throughout this place. I have not been directly involved in the project itself and I do not know what part of those costs would have been incurred as a result of that, but one would hope that, if we have overcome the security aspects, these sorts of delays should not occur into the future.[64]

7.49      The delay also resulted in additional costs of around $614,000 with a total project cost of $3.1 million. Ms Missingham described the additional costs as:

I think you could say that the delays and the additional costs were as a result of increased complexity of the solution that we needed, increased security testing and an increase in the work that was done compared with what we had anticipated when we initiated the project.[65]

7.50      At the committee's hearing in October 2012, Ms Mills informed the committee that further work is being undertaken on the website including to make it fully compliant with Commonwealth web accessibility guidelines. Ms Mills explained:

...a significant upgrade is still required, in line with the lessons we have learned from its operation. We are looking to spend a couple of hundred thousand dollars in the not too distant future to do the next sphere of that.

At the moment, we have a single web interface into Parliament House, which services a multiplicity of purposes. Therefore, in some areas it is not as easy to search as it would be if you had a standalone website or a very consumer orientated one. I think there are opportunities for us to look in the future, as the development becomes much more cost effective, at whether we have multiple entry points into information about parliament. But, at the moment, we are simply looking at ways of improving from the lessons of the first: what are people using, how are they accessing it, what information are they satisfied with? I do get quite regular comments from people within this building and also citizens that they found it easy or difficult to find certain information. We are tweaking our content all the time to try and adjust to that.[66]

Committee comments

7.51      An effective delivery of ICT services unpins the successful execution of every aspect of the work of the Parliament, parliamentarians and their staff and the staff of the parliamentary departments. IT services now being provided by DPS for the Parliament are not just restricted to those in Parliament House, but also those in electorate offices across the country, the services provided to senators and members on the move and to committees when travelling to remote areas of Australia.

7.52      The review of ICT for the Parliament found deficiencies in the way in which ICT has been provided in the past and the implementation of the review's recommendations will enhance the provision of services across the Parliament. The committee acknowledges that the deficiencies have, in part, arisen because of the fragmentation of service delivery. This has now been addressed with the transfer of electorate office IT from Finance. The committee also strongly supports the transfer of BlackBerries and multifunction devices to DPS. However, the committee considers that the maximum benefit of this change will only be achieved if adequate funding is provided to support the ICT services required by the Parliament. In this regard, the committee notes the comments made about the age of certain electorate office equipment that DPS has taken over from Finance and the replacement of this equipment at a time when DPS is facing significant resource constraints.

7.53      The committee supports the implementation of the review's recommendations. The committee also notes the evidence of past unsatisfactory project management and provision of IT services. For too long DPS appears to have relied on security concerns to hinder access to emerging technologies. The committee is also concerned with ICT project management and points to the new Parliament House website as an example. This project was significantly delayed and costs far exceeded initial estimates. The explanation given by the then Parliamentary Librarian was that the vendor lacked understanding of the complexity of the system and security issues. The committee finds this a rather problematic explanation given that the old website had been in situ for some 10 years and security of ICT systems has been a long standing issue. The committee considers that the delays may point to poor project development and inadequate consultation between stakeholders, DPS and the vendors. The committee is also somewhat disturbed that Ms Mills has indicated that the website still requires a 'significant upgrade' which will costs 'a couple of hundred thousand dollars'. The committee will keep this further upgrade work under close scrutiny through the estimates process.

7.54      The committee anticipates that the appointment of the CIO under the post-review structure will provide a more rigorous approach to the delivery of ICT services. In particular, the committee considers that a dedicated CIO will assist in ensuring that projects are delivered on time, within budget and fit for the proposed purpose and that committee members will not have to resort to the estimates process to try to remedy minor technical problems with ICT equipment.

7.55      The committee also welcomes streamlining the provision of ICT through a 'one-stop shop' and the setting of a level of security that is practical without creating vulnerabilities in the PCN. However, the committee is mindful of the financial resources required to implement significant changes to IT systems and equipment upgrades and will monitor closely developments in this area.

Navigation: Previous Page | Contents | Next Page