Australian Customs CIO Murray Harrison dislikes SLAs and runs away if a vendor talks to him about innovation. In this interview, he also explains why getting excited about gadgets can be dangerous and talks about how Customs' outsourcing strategy has evolved.
You are not a fan of SLAs. Why is that?
Harrison: When you ask the person who's looking after the box whether it makes a difference if they have got an SLA, the answer is usually no. Whether the box is up for 99.23 per cent or 98.47 and we argue about whether that equals a $2,000 penalty or a $4,000 penalty ... it's not actually focused on the business service.
So that's one of the things we think is quite innovative in our new approach and it is all based around performance improvement.
While we measure SLAs, we don't apply a penalty regime to most of them. We still say that in a couple of areas — and in a couple only — we can't tolerate downtime. Sydney Airport in the early morning when all the planes come in, our passenger system has to work otherwise we're in serious trouble. Equally our cargo system has to work, otherwise, cargo doesn't move. So those two areas, we are saying they have to be up and running and we measure that on an SLA basis.
We've developed a score-card approach, which is quite complex, but essentially it says that every three months we'll do an assessment, we'll subject ourselves to that too — our service desk is in that.
We've got a scale from 0 to 10 and we expect eight. If you're between five and eight, of which five being "acceptable", then we'll put in a performance improvement program and then measure that three months later. If you're less than five, which we consider to be unacceptable performance, then equally we'll put in the performance improvement regime and if you don't get over five the next time, then that's when the penalty will apply.
So we are putting the focus on assuming that we will have a performance improvement plan that will be successful. And frankly, I'm also assuming that when you have all the various players in the room — IBM, EDS and Kaz and the other players we have involved are going to want to be the bad guy. So I think there's an incentive to provide good performance rather than to focus on whether a box is up by 99.25 per cent.
How important is open source software?
Harrison: We have some open source capability in the organisation.
We're primarily a Microsoft shop, but and our approach to open source is really on a case-by-case basis, as to whether it's appropriate or not. I think we are an organisation that needs to have a conservative approach to that because we need to take risk out of the provision of software in relation to supporting our business ... if we don't have control then we get nervous.
But that doesn't stop us looking at it on a case-by-case basis. We're not a big user of open source, but we do have examples and we're quite happy to look at it. It's just that we basically have a conservative approach. Middleware is the area that we use it in the Web space, but it's not a big part of the system.
Which technologies are you most excited about?
Harrison: I don't want to sound like a technical philistine but I think it's actually dangerous to get too excited about new technologies. Everybody likes playing with new toys, but the reality is that our job is to support the business and our task is to apply technologies where they are sensible in business support roles and not to get over-excited about the technology itself.
Whilst there are clearly quite a lot of new technologies about, in an organisation like Customs, we have a number of varied businesses. We have boats, planes, dogs, cargo and passengers, and applying the right technology in each of those different business areas is the thing that is exciting rather than the technology itself. But in answer to the question, we are rolling out a biometric tool in what we are calling SmartGate at the passenger airports.
We are looking at RFIDs and the like. We've got a very mobile workforce so mobile computing is very important to us. Network communications — we're looking at improved video conferencing. As I said we've got a mobile, very dispersed workforce and the less travel we can do the better. So areas like that are important to us and in many cases at the cutting edge, particularly around facial recognition and biometrics.
Tell us some more about SmartGate.
Harrison: It is a facial recognition system that is designed to handle the increased workload that's going to come through, you know people are travelling more, we're getting a significant growth in a number of people who are passing through our primary lines at the airports and an automatic process where they can measure their -- being photographed and that's compared with the electronic image that's contained in an electronic passport.
The image is taken from all the different angles and stored. It is based on structure of the skull -- how far your eyes are apart and various sorts of things, so that if you put on a false nose, it doesn't fool it.
Will you be spending more or less on IT this year than you did last year?
Harrison: It's public record that we spent about $105 million last financial year. That's probably decreasing as we find more efficiencies in the service. We're actually in the middle of a very significant change program where we did a market testing exercise that finished in the middle of last year, which kind of started with the end of the ... outsourcing contract with EDS, which had run for nine years.
We broke the services up into a number of different categories, we have a number of different contracts and all of that is going to save us money, but we are at the moment transitioning into those new arrangements, so it's all up in the air at the minute, including taking some of the delivery of the services back in-house. We're now running our own desktop, we're running our own service desk, which were previously provided by EDS.
How has your outsourcing strategy evolved?
Harrison: Customs outsourced all of its IT in a big bang approach back in the late 90's. It was Customs did it prior to the whole of Government outsourcing exercise on the basis that, you know, we do it ourselves before the others done to us, I guess.
We obviously learned a lot of lessons during the course of that period and it was a contract that was expiring in the middle of last year, so for the two years before that really we did put a lot of thought into what our new sourcing strategy would be and how we would approach the market around that.
We broke our services up into six services and specifically, main processing, telecommunications, what we call internet and secure gateway application, maintenance and support, service desk and application development.
And the first four of those we put to the market and application development we're going to do on a case by case basis and the service desk we decided to bring back ourselves.
Four different companies won those four different components as a result of the market testing exercise and as I said, we are in the middle of transitioning to those new providers.
We believe that a multi-party arrangement, a multi-sourced environment was the best of breed from our point of view. I have been managing outsourcing contracts for 10 years, my manager that was leading that exercise is doing a PhD in outsourcing, we approached the task on the basis of saying we must have learned something over that period of time.
And equally, we didn't want to just catch up with others. We wanted to see if we could push the boundaries a bit. We think we've come up with some quite interesting components of that multi-party arrangement — particularly around performance management.
It was won by the companies that won purely on a competitive basis, on a value for money assessment.
How is the Cargo system running these days?
Harrison: The Cargo system has been operating very well for a couple of years. We have had a continuous improvement program in place and we work very closely with the industry about what they're looking for so we can make improvements ... but I think, you know, despite the difficulties we had with the introduction, I think we all recognise it's a very good platform.
It's very complex-based. I think we stopped counting at about 24,000 function points and 18,000 pages of design specifications, so it's a very difficult and complex environment, but it has been operating very well with processing millions and millions of transactions ... in the time it's been running, we get about 80,000 to 100,000 transactions per day through that system.
We have an electronic system before, so it was a new upgraded version of that and it's Web-based. It is 24/7 and we receive, as I said, 80,000 to 100,000 messages a day.
If we don't respond to that, then boxes don't move from wharfs to warehouses and from wharves to homes. So that was part of the difficulty we had initially — that people had trouble working with it and things were piling up on the wharves.
How much of your IT budget do you spend on security?
Harrison: I asked that question of our security guys and it was a difficult one to answer in that security is so, sort of, invasive across the whole spectrum, that I can't tell you what we spend. But we estimated it to be somewhere between 10 to 15 per cent.
Internally, we have a security section, as I said we run our own desktops, so we have a lot of rules that we need to apply internally. We're a very security-conscious organisation, as you'd probably appreciate — we have a lot of sensitive information.
We recently redeveloped the whole desktop and built it under Vista, as you probably know, we were one of the first organisations to do that. We had to buy everybody new computers and we thought why put an old operating system on a new computer.
But part of that is we've changed the nature of the fleet, so that we would know since we've got a 50-50 split of laptops and notebooks and we have — I don't know whether it was two-factor or about four-factor security on the notebooks, in particular with BitLocker. We use Vasco tokens and we have password protection as well, so it's a very secure environment.
Does Customs use Web 2.0 technologies?
Harrison: My people would say that we have got a new presentation layer but the problems are still the same problems you had with client/servers or even back with green screens.
It's a matter of getting the right applications available — building applications that are useful for the business is no different whether it's in a Web 2.0 environment or any other.
It is clearly very rich and it's clearly far more useful. We've been very surprised by the demand for SharePoint in the organisation. We've got SharePoint as one of the tools and everybody wants it. We don't consider it to be a silver bullet in terms of solving any particular problems that we have it is just a more useful method of delivering the service.
It creates other quite interesting sort of challenges for people like me, in the sense that no longer are we just responsible for our own environment, we're responsible for people who are using the system that we've never heard of. But in terms of services, no question that, you know we can provide better services with the use of those sorts of technology.
You once said that when vendors mention innovation, you should run! Why was that?
Harrison: Innovation is something that I've heard vendors and others talk about for a long time and in my 10 years on the job I've never actually seen an innovation program of itself that's been useful.
Innovation I think means different things to different people and ... those different things are almost contradictory.
What I mean by that is that, from our point of view, innovation would be where you could provide either increased or at least an equal level of service at the same time saving money.
From a vendor's point of view, it might be that it's an opportunity to increase revenue because of the different way of approaching something. We need to marry the two incentives in order to be able to provide real innovation.
I think you have to fund it. I think you have to have a fairly sophisticated arrangement with vendors and others ... so we can provide money that is simply at risk in terms of providing the hard work necessary to allow innovation to occur.
I don't believe vendors are unable to do that. I just think that they mean different things when they talk to us about innovation than we do and I've yet to see the two come together in a way that everybody's happy with.
Have you been affected by the skills shortage in Canberra?
Harrison: We were a bit lucky in the sense that our major development particularly around our cargo system was two and three and four years ago when it was a bit easier to get those special skills.
We're not big hirers of staff at the moment, so it's not a particular pressure. It so happens that today is the first day that we've taken on three of the government's apprentices. The Australian government has an apprentice scheme. We've taken three of those and they are starting today.
This is a fairly small town and frankly, my strategy is to try and create an environment that people like to work in and that we are dealing with things that people like to work on and that's one of the reasons why we were going down the Vista path — we think that that's attractive to people to be involved in something like that. Our cargo system is all around Websphere and a number of the sort of leading edge Web technologies.
So I think if you can provide that sort of an environment then you tend to attract staff in a competitive field.
But as I said, we're not in the same boat as some of the other organisations around town where they are doing major change programs and looking for lots and lots of people. We're not in that environment.
As CIO, how do you know you are doing a good job?
Harrison: I get told when I don't [do a good job] fairly quickly!
I don't think you can underestimate the basic services that you need to provide. The systems need to keep up and running and you need to do it within your budget. You need to look after the housekeeping, so to speak, I think is the primary goal.
But the next task is to be responsive to the business, you know as a business. As a business manager in my past life, I'm experienced in the sense of not getting a service from the IT and very happily going outside and saying "if you're not going to do it, go get somebody else to do it". There's no point for us being here if we are unable to provide that responsiveness.
The challenge of course is to be able to be responsive to any one of the business areas and at the same time providing the central discipline and control that can lead to manage efficient, effective operation.
To some extent that mitigates against being overly responsive. We often get asked the question, "I want one of those", and we keep pushing back with a question, "what is it that you're trying to achieve?" That's about managing a wider environment in a controlled, disciplined way. So again, there's an incentive problem there about who is trying to achieve what.
That's a long-winded way of saying, basically, the first task is to make sure everything works and it does so efficiently and effectively. I think basically the first task is to make sure everything works and it does so efficiently and effectively. And the second task is to be responsive, provide the solutions that business requires to get the job done.