Department of Defence: Greg Farr, CIO (part one)

Australian Department of Defence CIO Greg Farr, who took over the position in October 2007, recently spoke to ZDNet.com.au about how the organisation's networks are kept secure and why virtualisation and green issues are high on the agenda.

As CIO of the Department of Defence, what are you responsible for?

Farr: Ultimately, I'm responsible to provide the secretary and the chief of the Defence Force with a full, stable, operating platform for IT to support the administrative part of Defence — but ultimately for the war fighters as well. Within Defence ... at the last count we had about 120,000 workstations.

So, we have a military component probably of about 58,000; we've got probably about a full time equivalence of 20-something thousand civilians as well. And of course, when you look at it, [they are] very geographically dispersed — everywhere from Canberra to Afghanistan, Iraq, Solomons... We have to be able to support the communications networks that allow that to occur and it has to be very robust.

How do you secure the Defence Department's IT systems?

Farr: Security is a major issue for us. We incorporate that security thinking into everything we do, it's very pervasive. Any time we want to do something one of the first things we think is: how do we make this secure? Everyone is very conscious of that.

One of the things that we are looking at is how we are able to exchange information with our allies and the use of a public key infrastructure, which will be the main way of authentication. Just every project, I think, it's just incorporated in it.

This topic is a really interesting area for us because we have multiple security domains so, for example, on my desktop I have a restricted network and I have a secret network. You can't actually have those two running at the same time; so you have to have a switching box to actually switch between whichever network you're in.

That causes some problems because the secure network, or the secret network, is the critical one for our operations, our military operations. But, at the same time, they need access to information that is on a restricted network, like personnel information.

So, we need to be able to get these two lists of information and put them together into one picture for people and that's going to be a challenge for us in the next roll out as well. At the moment, it's too clunky.

Any idea how you're going to overcome that?

Farr: I have some ideas, probably a bit early to look at it in technical terms. I don't think we'll be able to mix the two networks together, but hopefully we might make the experience of people using it a lot better by being able to open sessions in either one within the same screen, if they need to.

It has been done by some of the US agencies; so I would be very interested to see how they've done it and whether we can actually replicate that as well.

How important is green computing?

Farr: The other big challenge that I see for us is — and how I hate the term — "green computing". We have a lot of computer equipment in Defence. I think, the last time I looked it was — apart from a couple of mainframes — about 8,400 servers.

So, we've got a lot of gear. It uses a lot of power and the air conditioning and all the rest of that. I think, that's going to be a major issue not only for Defence, but more broadly: how, with potentially an emissions trading scheme being introduced in Australia, get better use of that and more friendly use of that sort of technology. It's going to be a major issue for us.

So, how are you going to do that — maybe just a standard server consolidation project?

Farr: Server consolidation is certainly on my agenda. We have a very large number of server rooms or datacentres and I'm looking for a very significant consolidation of it. Also, we need to look at more environmentally friendly technologies; we need to look at more environmentally friendly, purpose built datacentres that use renewable technology.

It's not something that's going to happen in 10 minutes, it's something that we have to start planning for and make real progress on.

I don't know how much power we're using, but I do know that even some simple things that we're planning — turning computers off at night, and then remotely turning them back on again, or giving the upgrades and the patches when people log on or just before they log off when they log off doing the patches and then shutting it down automatically — have the potential to save us about two million dollars a year.

If you actually took it to the next level and started really focusing on it and bringing some of those purpose built, really environmentally friendly datacentres, then I think, the savings could be much more extensive than that and they'll only get bigger as the processing power goes up.

The first thing I'd like to do is consolidate — initially, we were going to consolidate into nine datacentres, but I don't think that's enough.

What from?

Farr: About two hundred. Some of them are quite small — they're more like server rooms. So, I don't think that's enough, I'm looking to consolidate much further than that. Once we're able to do that, once we have consolidation and once we can virtualise, make the savings there, then we need to look at where we house these things, what sort of building, what sort of power we're using. I think, that's certainly on the horizon for the next 12 months as well.

How much will you spend on IT this year?

Farr: It's probably in the 650 to 700 million-dollar range. It will be probably less than we spent last year, where we've been asked — as well as everybody else in Government — to find deficiencies, and we'll be doing that. As I said, budgets haven't been finalised, but I would have thought it would still be in that 650 to 700 million-dollar range. So, a lot of money, but saving have to be found as well.

How important is open source software?

Farr: I've always been interested in open source software, interested in my previous role as well. As with Tax, Defence is in the same boat: we need to have it supported. So, open source that is properly supported is interesting to me, but obviously we can't have products that when we have a problem we don't have readily available support.

Security is an issue — I won't speak for Bill [Bill Gibson, CIO of the Australian Tax Office] obviously the main issue for me is support. Ultimately, you can have it secure if you want to, you've got to put the effort into it, but we have to have that support there when something goes wrong.

I'm not sure whether we'd go to open source office products — StarOffice or something like that. But, I think, there's a path in components of our infrastructure to have open source.

What will be your most important project this year?

Farr: If I had to say one thing that I'd be focusing on in the next six months to 12 months, it's how we manage information, how we give the information to decision makers very quickly, to allow them to make decisions both for administrative purposes, but also of course for war fighting, which at the end of the day is what we're here for. That's going to be a major challenge for us.

What is the biggest IT challenge you face?

Farr: Increasingly the way IT will go, or ICT will go, is that there will be a commodity platform and it will be run as a commodity. I've used the expression before, it's like a light switch. You want to turn it on, you want the power to be there, you don't care what sort of generators are being used. You probably don't even know what the power company is. You just want it there. You want it cheap, you want it reliable, you want it robust.

I think, the big challenge is how we deal with information. Once upon a time, the paradigm was, "How do I get enough information to do my job?" Not anymore; the information's all there, now it's how do you get it in a way that's usable to actually make decisions?

When you're being bombarded with thousands and thousands and thousands of bits of information per minute, how are you going to make a decision? You can't. So, how are you going to use technology to assist you in that decision making?

There's a saying in Defence, I think, it's called the OODA loop in military terms, which is you Orientate, Observe, Decide and Act. Well, you have to wonder if that's a paradigm that can continue in the future. Because by the time you orientate, observe, decide and act, the moment's passed you by.

So, increasingly, it could be something like: observe, decide, act; or decide, observe, act. Having the scenarios in advance to say, "In this sort of scenario, I will do this," or, "The reaction will be this". The decisions are all there. I guess it's like a rules engine. [laughs] As soon as you observe it, the decision's already made, and then you act.

So, those cycles have to be cut right back. I guess, in Defence terms, "the sensor to shooter cycle".

What sort of technologies are going to be able to deliver that?

Farr: That's a really interesting question. But, I think, it's something that all the Defence agencies are struggling with a bit. But, in a sense, I sort of see it as business intelligence. So, if we get the information management right and we get the decision making tools right and we get the high speed connectivity to the decision maker right, I think, we can draw some parallels.

I might be totally wrong here, but I think, we can draw some parallels with the speed in the finance industry, particularly in the US — where they have to make things like Sarbanes Oxley, meaning hundreds of thousands of transactions occur and the CEOs of companies are being held accountable for the accuracy of their financial accounts.

How do they check it? Well, they can't, clearly. They have to rely on machines to do it. And so that sort of technology, I think, we can borrow. As I said, I could be wrong, but I like to think we can learn some things from that.

I think there's a lot of hype around unstructured data. And I have seen it accurate or useful to a certain extent, but nowhere near as accurate as you would want it. Being able to pull data from everywhere, present it in such a way that is useful to people, is certainly the challenge.

But I think, once again I could be wrong, the industry is a little way away from doing that — to my satisfaction, anyway.

Next Monday, in the second part of this interview, Farr explains why managing passwords is a high priority for the Defence Department while Windows Vista continues to take a back seat. He also talks about how Defence manages almost 600 outsourcing contracts and 13,000 different applications.