Which is what makes GDS's latest guidance so surprising. At the start of the month, NHS England made the bizarre and irresponsible decision to close all their Open Source repositories due to unfounded fears of AI hacking¹. Lots of people within the NHS were outraged. As were many outside - with this petition against the move gathering over 2,000 signatures.

Within other parts of government there was also alarm. Although I no longer work for Government Digital Service, I was contacted by several concerned people there who remembered all my work on Open Source. The brilliant team in Whitechapel have now published their guidance "AI, open code and vulnerability risk in the public sector".

It is brutal.

They utterly repudiate the NHS's stance and forensically eviscerate it. I'll let you read the whole thing, but here are a few choice excerpts:

Recent public reporting about organisations restricting access to public repositories due to AI-enabled code analysis illustrates how quickly leaders may reach for blanket closure in response to uncertainty.

Basically, non-technical managers need to stop over-reacting.

Private repositories can create a false sense of security.

I think that's the crux of the argument. Closing code doesn't solve the underlying problems.

Making code private is not an appropriate mitigation for lack of ownership, patching capability, or operational assurance, so systems that cannot be safely maintained should be remediated or retired.

If you are so concerned about the poor security of your systems, you should shut them down completely to mitigate the threat.

Closure can become a one-way door.

As I said to the BMJ, "nothing lasts longer than a temporary fix".

Where code has been developed in the open, making a repository private later may not remove access for a capable adversary as popular repositories are often mirrored or forked

Indeed. A friend of mine has already archived all of the NHS's repositories. You can see the ones they've tried to hide.

But the killer blow, I think, is this:

Moving code from public to private as a substitute for investment in secure-by-design delivery, ownership and remediation is a warning sign because it reduces sharing and scrutiny, can slow coordinated improvement across government and suppliers, and does not remove the underlying weaknesses in a running service.

Exactly! Coding in the open has been shown time and again to produce high quality and secure work. The looming threat of AI vulnerability scanners doesn't change that - security is a shared responsibility. Technical teams need to be well enough resourced to create secure systems; hiding code is as reliable as papering over structural cracks.

GDS was created was to be a strong centre with vast technology expertise. This was to counter the frankly shoddy approach to tech in other departments. Back then, a Service Assessment was a way for a department to prove that they were actually capable of designing, launching, and managing a complex IT project.

Most departments have become significantly better at the development and running of these sorts of projects, so the raison d'etre of GDS has somewhat waned. Departments feel more confident in running off on their own. Usually I'd celebrate that - it's important that GDS doesn't become a bottleneck and that the talent is distributed throughout the whole Civil Service.

But NHS England has always been a bit of a weird one. One of the reasons NHSX was created² was to ensure that the health service had strong expertise in technology and its deployment. As the Head of Open Technology there, I helped craft the policies which embedded Open Source and Open Standards within it³.

I don't know what discussions have taken place within NHS England - although I looking forward to receiving a response to my FOI request. It looks to me like a small group within NHS England have received a report showing some potential vulnerabilities discovered by Mythos. Rather than following their own internal guidance, they've over-reacted and slapped a blanket ban on coding in the open.

I fervently hope that this new guidance will encourage DHSC to bring NHS England into line with best practice. If not, perhaps GDS ought to reassert itself as the technical authority with power to veto a department's incomprehensible decisions?

Right now you can go to https://www.contractsfinder.service.gov.uk and search for whichever bête noire has you riled up. You might want to argue that the company is corrupt, incompetent, or overpriced - but you can't argue that its contract is secret. There's no conspiracy. There's no secrecy. There's not even "beware of the leopard" shenanigans. It's all out in the open⁰.

The Government says who it paying money to.

But, of course, there are some things the Government can't say. It's rare for them to publicly disagree with a supplier, or call out how crappy they were. They need to maintain cordial relations with people¹. They don't want to scare off new suppliers who can't risk being publicly humiliated. When contracts are cancelled or ended, it is usually done quietly.

So you need to learn to read between the lines.

Let's take this excellent blog post from the Ministry of Housing Communities and Local Government²

"From emergency to sustainability: creating Share Homes for Ukraine data".

It's exactly the sort of blog post that some Civil Servants excel at writing. It clearly sets out how an ambitious and technically challenging project was delivered, why it is important, and who it benefits.

The blog post describes how the team…

exited our contract with our supplier.

And that:

Moving to this in-house model is already saving MHCLG millions of pounds a year in running costs.

They show user feedback for their new system saying:

It’s easier to navigate than the previous system

Of course, what they don't say is who supplied the previous system which was so costly and hard to use.

It was, of course, Palantir.

The original contract (CPD4124104) wasn't secret - although it was mired in some controversy as an urgent exemption to normal procurement rules³.

In 2023, the National Audit Office reported on the scheme - including Palanitr's software. They said:

The initial arrangement was put in place to help get the scheme up and running quickly. Consequently, the system did not undergo the usual research and testing that would be involved for the roll-out of a new digital system. There were initial issues such as the way it presented duplicated application data received from Home Office systems, and confusion from local authorities as to how to engage with the main data system.

How bad was Palantir's software? I've sent in a Freedom of Information request to find out. But we can tell that it was bad enough to convince MHCLG to rewrite it themselves.

A lean Civil Service may not have the in-house capability to rapidly create a new service. But, as their blog post shows, when given suitable resources Civil Servants can often outperform the private sector. More importantly, the new software is under the Ministry's direct control. This open source code is a triumph for sovereign technology.

MHCLG have shown the door to Palantir. They've built something better, easier to use, and cheaper.

I don't want to oversell this as the first victory in the war against this abominable company - but I hope where MHCLG leads, others will follow.

You can read more about this story on BBC News.

Throughout my time working for the UK Government - in GDS, NHSX, i.AI, and others - I championed Open Source. I spoke to dozens of departments about it, wrote guidance still in use today, and briefed Ministers on why it was so important.

That's why I'm beyond disappointed at recent moves from NHS England to backtrack on all the previous commitments they've made about the value of open source to the UK's health service.

It's rare that multiple people leak the same story to me, but that's what gives me confidence that lots of people within the NHS are aghast at this news.

A few days ago, I was sent this quote which was attributed to a senior technical person in NHS England.

We are obviously looking at things like Mythos, which is more sophisticated at finding vulnerabilities. In the next week or so, we will be changing our tack on coding the open and making our code public until we're on top of that risk.

Most of our repos, unless they're essential, will be removed for security reasons.

As I've written before, this is not the correct response to the purported threat by Mythos. Neither the AI Safety Institute nor the NCSC recommend this action. While there may be some increase in risk from AI security scanners, to shutter everything would be a gross overreaction.

Nevertheless, that's what the NHS is preparing to do.

On the 29th of April, guidance note SDLC-8 was sent out. Here's what it says:

The majority of code repos published by the NHS are not meaningfully affected by any advance in security scanning. They're mostly data sets, internal tools, guidance, research tools, front-end design and the like. There is nothing in them which could realistically lead to a security incident.

When I was working at NHSX during the pandemic, we were so confident of the safety and necessity of open source, we made sure the Covid Contact Tracing app was open sourced the minute it was available to the public. That was a nationally mandated app, installed on millions of phones, subject to intense scrutiny from hostile powers - and yet, despite publishing the code, architecture and documentation, the open source code caused zero security incidents.

Furthermore, this new guidance is in direct contradiction to the UK's Tech Code of Practice point 3 "Be open and use open source" which insists on code being open.

Similarly, the Service Standard says:

There are very few examples of code that must not be published in the open.

The main reason for code to be closed source is when it relates to policy that has not yet been announced. In this case, you must make the code open as soon as possible after the policy is published.

You may also need to keep some code closed for security reasons, for example code that protects against fraud. Follow the guidance on code you should keep closed and security considerations for open code.

There's also the DHSC policy "Data saves lives: reshaping health and social care with data":

Commitment 601 – completed May 2022

We will publish a digital playbook on how to open source your code for health and care organisations

And, here's NHS Digital's stance on open source in their Software Engineering Quality Framework:

The position of all three of these documents is that we should code in the open by default.

All of which is reflected in the NHS service standard:

Public services are built with public money. So unless there's a good reason not to, the code they're based should be made available for other people to reuse and build on.

All of which is to say - open source should be baked into the DNA of the NHS by now. There are thousands of NHS repositories on GitHub. The work undertaken to assess all of them and then close them will be massive. And for what?

Even if we ignore the impracticality of closing all the code - it is too late! All that code has already been slurped up. If Mythos really is the ultimate hacker, hiding the code now does nothing. It has likely already retained copies of the repositories.

And if it were both practical and effective to hide source code - that doesn't matter. These AI tools are just as effective against closed-source. They can analyse binaries and probe websites with ease.

There are tens of thousands of NHS website pages which refer to their GitHub repos - will they all need to be updated? What's the cost of that?

I've no idea what led to NHS England making this retrograde decision - so I've send a Freedom of Information request to find out.

I am convinced that closing all their excellent open source work is the wrong move for the NHS. I hope they see sense and reverse course.

Until then, I've helped make sure that every single NHS repository has been backed up and, because the software licence permits it, can be re-published if the original is closed.

In the meantime, you should email your MP and tell them that the NHS is wrong to shutter its world-leading open source repositories.

Don't let them take away your right to see the code which underpins our nation's healthcare.

Further Reading

• I'm quoted in this article from The New Scientist.
• Matt Hancock on the issue
• Discussion by Jessica Morley, PhD
• Free Software Foundation Europe press release
• Further commentary from New Scientist
• Petition - Keep Things Open
• Update 2026-05-14: GDS have published their Guidance "AI, open code and vulnerability risk in the public sector " which explicitly says closing repos is the wrong approach.

The UK Government publishes a lot of Open Source code - nearly everything developed in-house by the state is available under an OSI Approved licence. The UK is generally pretty relaxed about people, companies, and states re-using its code. There's no desire and little capability to monetise what has been developed with public money so it becomes public code.

What about the Open Source that UK Government uses?

The state uses big projects like WordPress, as well as moderately popular NPM packages, and small Python libraries and everything in between. But can it pay the maintainers of that software?

A version of this blog post was originally published on Hackernoon.

Fixing The Plumbing

Open Source is facing a crisis. The code that the world relies on is often developed by underpaid engineers on the brink of burn-out. While I don't think anyone wants Open Source to have a paywall, it seems obvious that large organisation should pay their way and not rely solely on volunteer labour.

Here are some of the problems I faced when trying to get the UK Government to pay for OSS and how you as a maintainer can help make it easier for large organisations to pay you.

Firstly, lots of OSS doesn't have a well defined owner; so who gets the money?

I'm not saying that every little library you create needs to be published by a registered company, nor am I suggesting that you should remove your anonymity. But Governments and other organisations need to know who they are funding and where the money is going. The danger of accidentally funnelling money to a sanctioned state or person is just too big a risk for most organisations.

If you want to receive funding - make it really clear who you are.

What Can You Offer?

Even when there is an owner, there often isn't an easy mechanism for paying people. Donation sites like GitHub Sponsors, Ko-Fi, and Patreon are great for individuals who want to throw a small amount of money to creators but they can be problematic for larger organisations. Many OSS projects get around this by offering support contracts. It makes it much easier for an organisation to justify their spend because they're no longer donating to something which can be obtained for free; they're paying for a service.

This doesn't have to be a contract offering a 24/7 response and guaranteed SLA. It can be as simple as offering best-effort email support.

The important thing is to offer an easy way for a larger organisation to buy your services. Many organisations have corporate credit cards for lower-cost discretionary spending which doesn't require a full business-case. How easily could a manager buy a £500 support contact from your site?

Maintainers don't only have to offer support contracts. Many choose to offer training packages which are a good way to raise money and get more people using your product. Some project maintainers will speak at your conference for a suitable fee.

Again, the aim here is for maintainers to offer a plausible reason for a payment to be made.

Playing Well With Others

Open Source has a brilliant culture of allowing multiple (often anonymous) contributors. That's fine when there's no money involved, but how does a moderately sized project decide who receives what share of the funding? Services like OpenCollective can make it easier to show where the money is going but it is better to discuss in advance with all contributors what they expect as a share.

If people think they're being taken advantage of, or that a project maintainer is unjustly enriching themselves, it can cause arguments. Be very clear to contributors what the funding is for and whether they're entitled to any of it.

Finally, we faced the issue that some OSS projects didn't want to take money from the "big bad state". They were worried that if people saw "Sponsored by the Government" they would assume that there were backdoors for spies, or that the developer might give in to pressure to add unwanted features. This (usually) isn't the case but it is easy to see why having a single large organisation as the main donor could give the impression of impropriety.

The best defence against this is to have lot of paying sponsors! Having the state as one of many partners makes it clear that a project isn't beholden to any one customer.

It isn't impossible to get Governments to spend on Open Source. But state spending is heavily scrutinised and, bluntly, they aren't set up to pay ad hoc amounts to non-suppliers, who aren't charging money. While large projects often have the resources to apply for Government grants and contracts, smaller projects rarely have the time or expertise. It is critical that maintainers remove the barriers which make it too hard for organisations to pay them.

In Summary

• Make it easy for Governments and other large organisations to pay you.
• Be as obvious as possible that you are able to accept payments from them.
• Don't be afraid to put a large price on your talents.
• Offer multiple paid-for options like speaker fees, support, and feature development funding.
• Talk with your contributors to let them know how any funding will be shared.

By contrast, a single computer terminal was likely to set you back around £3,000 - and that's before you take into account message transmission costs. That's roughly the same price as sending over 8,000 letters. Is that a sensible investment for the 1980's businessman?

In 1986, British Telecom started producing "The Communications Programme" which was "a new video magazine produced exclusively for the top communications people in the UK's largest organisations".

The show was distributed on video-tape and the archived shows are genuinely fascinating. They're a mixture of business reporting, thinly veiled advertorials, and a glance at the future of digital services.

Buried in the middle of episode 4 is this advert from the Department of Trade and Industry.

There's very little online information about the "Vanguard Project" - it was a VADS initiative (Value Added Data Services) run by DTI, BT, IBM, INS, ISTEL, and FASTRAK. Some of those acronyms survive, some don't!

Its aim was to promote awareness of EDI and its potential for the United Kingdom.

In 1986 the Department of Trade and Industry launched a project called Vanguard to promote the development of this kind of service in 10 different sectors including construction, educational supplies and wholesale food distribution. The major VADS suppliers (BT, IBM, INS, Istel and the Midland Bank) in the UK were heavily involved in the project from the beginning.

Information Sources in Information Technology

What's "EDI"?

Electronic Data Interchange.

A means of transferring data between co-operating enterprises without having to print it out on one computer and key it into another. Requires agreement about standards (proprietary or otherwise).

Did it work? Well, that's hard to say!

There's a paper from 1989 called Survey of Electronic Data Interchange Users and Service Providers in the UK. It dives into the then current challenges of getting British businesses to adopt EDI.

It quotes Sir John Harvey-Jones saying that most people running companies were:

…old people like me not familiar with the technological possibilities! We have great difficulty in making imaginative jumps to see the way in which the whole of our business can be reorganised, revitalised, set up in totally new ways, releasing energy and cost and putting us into the pole position. I can see abundant evidence that the full benefits of EDI will only be reaped by the companies where the Chief Executives is seized with enthusiasm for the potential prize he can grasp.

Which still seems true today! Although over-enthusiasm has led us to a weird AI-in-everything future.

The paper doesn't talk about Vanguard specifically, although it does have this rather cute diagram adapted from one of its reports:

Not quite the Gartner Hype Cycle!

The paper concludes that:

Unfortunately the zealots of EDI tend to be unable to ‘sell’ the benefits to management in most companies, and this is not helped by the way that many companies have been forced to trade electronically. Management tends to think that EDI is about computers, and because they think that computers are technical they abdicate responsibility with the cry of ‘its all too difficult’. This must be wrong. It is up to those who understand EDI to learn how to talk to management, and it is up to management to understand that not only is EDI not about technology, but even if it was it is still their responsibility.

Again, true as it ever was!

Nestled in the bibliography is this tantalising list of publications from the now-defunct Her Majesty's Stationery Office:

None of which appear to be online, although a few are in The British Library - and a few more available on Google Books

The state awarded several contracts for Vanguard - most of which seemed to be in the training space. Here's what The EDI handbook said about it:

(My thanks to Don Thompson, Owen Boswarva, and Ms7821 for digging out some of those references.)

Did it work? By the time I entered the workforce in the 1990s, it seemed like every desk had a computer. Although the Internet was in its infancy, email and electronic ordering was a normal part of business. The various proto-Internet protocols were still around, but were quickly being replaced.

A thesis published in 1991 asked an important question:

why should a non-interventionist Government as Thatchers become directly involved in developing the market and working together with private companies whose normal aim is to increase market share at the expense of their competitors rather, than cooperate with them?

The impact of Electronic data interchange on Irish foreign trade and transport

Metcalfe's Law tells us that there is no value being the only business on a network. It simply isn't rational to invest in connecting to a data service that no-one else is on. But the value of that network increases as more people and businesses get connected. If you've read The Entrepreneurial State, you'll know that governments are often responsible for subsidising technological initiatives like this. The state, its citizenry, and its businesses all benefit from the increased efficiencies of electronic communications, so it is only right that the state should bootstrap these sorts of projects.

I sent an FoI request to find out more but it looks like all the information is now archived.

If you know of any other sources of information about Project Vanguard - please leave a comment.

Some of it is trivial - spell check is AI. Some of it is a dystopian hellscape of racist algorithms being confidently incorrect. The reality is likely to be somewhat prosaic.

Although I'm no longer a civil servant, I still enjoy going to these events and saying "But what about open source, eh?" - then I stroke my beard in a wise-looking fashion and help facilitate the conversation.

For many years, my role in Cabinet Office and DHSC was to shout the words "OPEN SOURCE" at anyone who would listen. Then patiently demolish their arguments when they refused to release something on GitHub. But I find myself somewhat troubled when it comes to AI models.

Let's take a theoretical example. Suppose the Government trains an AI to assess appeals to, say, benefits sanctions. An AI is fed the text of all the written appeals and told which ones are successful and which ones aren't. It can now read a new appeal and decide whether it is successful of not. Now let's open source it.

For the hard of thinking - this is not something that exists. It is not official policy. It was not proposed as a solution. I am using it as a made-up example.

What does it mean to open source an AI? Generally speaking, it means releasing some or all of the following.

1. The training data.
2. The weights assigned to the training data.
3. The final model.

I think it is fairly obvious that releasing the training data of this hypothetical example is a bad idea. Appellants have not consented to having their correspondence published. It may contain deeply personal and private information. Releasing this data is not ethical.

Releasing how the data is trained is probably fine. It would allow observers to see what biases the model has encoded in it. Other departments could use the model to train their own AI. So I (cautiously) support the opening of that code.

But training weights without the associated data is kind of useless. Without the data, you're unable to understand what's going on behind the scenes.

Lastly, the complete model. Again, I find this problematic. There are two main risks. The first is that someone can repeatedly test the model to find weaknesses. I don't believe in "security through obscurity" - but allowing someone to play "Groundhog Day" with a model is risky. It could allow someone to hone their answers to guarantee that their appeal would be successful. Or, more worryingly, it could find a lexical exploit which can hypnotise the AI into producing unwanted results.

Even if that weren't a concern, it appears some AI models can be coerced into regurgitating their training data - as discovered by the New York Times:

The complaint cited examples of OpenAI’s GPT-4 spitting out large portions of news articles from the Times ... It also cited outputs from Bing Chat that it said included verbatim excerpts from Times articles.

NY Times copyright suit wants OpenAI to delete all GPT instances

Even if a Government department didn't release its training data - those data are still embedded in the model and it may be able to reconstruct them. So any sensitive or personal training data might be able to be reconstructed.

Once again, to be crystal clear, the system I am describing doesn't exist. No one has commissioned it. This is a thought experiment by people who do not work in Government.

So where does that leave us?

I am 100% a staunch advocate for open source. Public Money means Public Code. Make Things Open It Makes Things Better.

But...

It seems clear to me that releasing training data is probably not possible - unless the AI is trained on data which is entirely safe / legal to make public.

Without the training data, the way it is trained is of limited use. It should probably be opened, but would be hard to assess.

The final model can only be safely released if the training data is safe to release.

What next?

I'll admit, this troubles me.

I want to live in a world where the data and algorithms which rule the world are transparent to us. There will be plenty of AI systems which can and should be completely open - nose-to-tail. But there will be algorithms trained on sensitive data - and I can't see any safe, legal, or moral way of opening them.

Again, I want to stress that this particular example is a figment of my imagination. But at some point this will have to be reckoned with.

I'm glad this isn't my problem any more!

Part of the reasoning behind this, so I understand, is to make it simpler for the Government to update the value of those fines. Rather than having to change every law in the land - and have tedious votes on them - it's possible to change one law and have its provisions cascade down to all others. Efficient!

The modern Standard Scale was brought in by the Criminal Justice Act 1991. The fines are:

(Source: Sentencing Act 2020)

As you can see, the fines increased quite dramatically from their old value.

And, since 1992 the fines have increased by... nothing!

The Bank of England's Inflation calculator estimates that a £5,000 fine in 1992 should be approximately £10,000 in 2023.

As I understand it, the Standard Scale can be increased via a Statutory Instrument. With the stroke of a pen (and a lot of behind the scenes work) the Justice Secretary could increase these fines so they kept up with inflation.

And that nearly happened! In 2014, a Draft statutory Instrument was published. It proposed increasing the Levels 1-4 fines by 400% - so Level 4 would go from £2,500 to £10,000⁰.

Quite why it was never published, I was not able to find out.

All I know is that during this time of rapid inflation, it appears that the Government are doing nothing to make sure crime doesn't pay.

It is estimated that in 2021, 77% of all offenders received a fine. That's approximately 737,000 offenders who are paying less than they would have thirty years ago.

The very least the Government could do is ensure that the criminals who do get caught, charged, and convicted have to pay a fine which reflects the severity of their crime.

The state also issues identifiers. I know, I know, I am not a number, I am a free man. But I have a passport number which is different from my National Insurance Number which is different from my NHS number which is different from my Council Tax reference.

And so it goes.

That made me think. People are vain. Some people are vain and rich. Could we sell these people "vanity" identifiers? People pay big money for lucky or memorable phone numbers. Would they do the same for Government issued IDs?

(No. No they wouldn't. This is a silly idea born out of a brainstorming session. This is not a policy paper. This is a bit of fun on a dreary lockdown weekend.)

There is precedent for this.

The UK's Driver and Vehicle Licensing Agency will happily sell you a personalised numberplate for your car. Most countries - I guess - do something similar.

You can also buy a customised postcode (Zipcode). Handy if you want an easy to remember address.

In the UK, there is no such thing as a legal name, and you're free to rename yourself. But you can pay a modest sum to register your change of name.

I'm genuinely surprised that the hyper-commercial USA doesn't let people pay for a "cool" Social Security Number. Preferring instead to issue them randomly. They don't even let you buy a custom zipcode.

A whole bunch of countries sell citizenship. That gets you a passport. But none that I can see let you pick a Passport Number that ends 007.

Would Apple pay for a custom company number? I bet they'd go for 02241955.

What other customised identifies does the state sell? Do any other countries let you buy weird personalised things? Let me know in the comments!

• Read Kim's post on the Application Modernisation Team
• For more technical posts, read the Just-Tech blog on Medium.

The Irish government recently complied with a Freedom of Information Act request from journalists at RTÉ.

The journalists wanted copies of messages sent via a WhatsApp group. The Irish government complied and sent out several pages of documents. Let's take a look at three of the core mistakes that they made.

Marker Pens

The redaction process appears to be drawing over the offending words with a marker pen.

When the ink is insufficiently dark, as in this example, we can clearly make out the word which is being deleted.

Even when the ink is quite thick, we can digitally enhance the picture to clearly see some letters.

We only need a few letters to discover even more information.

Fixed Width Fonts

The font that this blog is written in uses a proportional font. The letter M is physically wider than the letter I.

The FOI response uses a monospace font - where every letter is the same length.

This allows us to accurately count how long a word is.

This is particularly useful in working out who is speaking - for example ALICE will take up more horizontal space than BOB.

Even using proportional fonts is not a guarantee that information will stay hidden - but there's no doubt monospace makes information recovery easier.

Coverage

As you can see at the top of the page, not all the letters have been covered.

We can make a good guess that any vertical line is likely to be one of the letters IJKLbdhlt.

Each of those letters has a unique layout in a monospaced font.

Using our knowledge of the font, the partial exposure, and how the English language is composed, we can make a reasonable guess at what some of the words are.

Our knowledge of English-language idioms may allow us to guess the next set of letters.

Thoughts

This post isn't intended to convince people to be more closed - but rather to encourage more openness.

These sort of physical redactions offer little protection against the determined reader. It's the digital equivalent putting your door on the latch rather than locking it.

We've known for over a decade that it is possible to recover information from improperly redacted documents.

Scanned documents are difficult for researchers to use. Equally, delivering an FOI response in a non-accessible format is likely to be a breach of the rights of disabled citizens.

The correct response, in my personal opinion, is to take a digital copy of the records to be released and replace every instance of sensitive information with [REDACTED] or [23 WORDS REDACTED]. That way there can no possibility of accidentally revealing information. Of course, if you leave "track changes" on - the data may still be there.

Using ineffective techniques raises the the risk of unwanted information leakage.

Yeah, yeah, so I only played a small part in the (no doubt) hideously complicated process - but I'm happy to take full credit :-)

Last year, the UK Government opened up a Standards Hub. They were actively soliciting for challenges that the UK Government could take on.

I was one of the first to respond.

Terence Eden is on Mastodon

@edent

My suggestion for open formats in government has been published - standards.data.gov.uk/challenge/offe…

---

You can read my modest proposal on the standards hub.

The crux of my proposal was this:

Each user - whether they work for the Government or are a citizen - has the right to read documents. A user should not be expected to purchase new equipment or install new software, just in order to read an official document.

I don't think that's too much to ask. You may buy a computer every 6 months - but there are plenty of citizens who only have access to a Windows 95 PC. Or a Nintendo Wii. Or an eReader. Or who don't have admin rights to install new software.

Many of these devices are perfectly serviceable - and all are guaranteed to read either PDF or HTML. Open standards means zero extra cost for the citizen.

Next Steps

Based on my suggestion, two challenges were created:

• Challenge: Viewing government documents
• Challenge: Sharing or collaborating with government documents

After several months of wrangling, the Government announced a solution to both of these challenges - Open document formats selected to meet user needs.

When departments have adopted these open standards:

• citizens, businesses and voluntary organisations will no longer need specialist software to open or work with government documents
• people working in government will be able to share and work with documents in the same format, reducing problems when they move between formats
• government organisations will be able to choose the most suitable and cost effective applications, knowing their documents will work for people inside and outside of government

The selected standards, which are compatible with commonly used document applications, are:

• PDF/A or HTML for viewing government documents
• Open Document Format (ODF) for sharing or collaborating on government documents

Cabinet Office and The Rt Hon Francis Maude MP

And, boom, just like that the open standard of ODF is mandated across government. In the future, you won't have to buy Microsoft Office just to read or respond to a government document. You won't need the latest and greatest computer, or cutting edge software.

Here's the thing. I don't know what would have happened if I hadn't made my initial contribution. Perhaps someone else would have. The tide is turning away from the proprietary standards of the past and Governments around the world are embracing Open Standards.

But I did contribute. I did make my voice heard. And the world has changed a little bit for the better.

And now it's up to you. Find a challenge on the Government's website, contribute, engage, make your voice heard,

Huge thanks to Hadley Beeman for telling me about the Open Standards Challenge, and to Tracey Williams for keeping me informed of its progress. Much of real credit for this amazing achievement belongs to Linda Humphries for running the consultation, and to The Rt Hon Francis Maude MP for listening to such wise counsel.

Over the last few days, I've shown that hundreds of websites run by branches of the UK state are in a perilous state of disrepair. There are multiple sites with hugely embarrassing XSS flaws, running ancient and unsecured software, languishing unmaintained and long since abandoned.

What are the consequences of failing to invest in security and maintenance? The websites become a haven for cyber-criminals. They exploit weaknesses in the sites and use them to push dodgy pills, fake goods, and all manner of illicit schemes.

The exploits which we are about to see range from the trivial - comment spam - to the extremely serious - complete site takeovers.

All the sites mentioned in this blog were notified on 19th February about the specific flaws found. I've no idea how these sites were compromised, nor whether any citizens' data are at risk. All I know is that a disastrous attitude to "cyber security" is rotting away within the *.gov.uk namespace.

Complete Site Takeover

This looks like the perfect site to by some "Genuine* Fashionable Boots", doesn't it? It is seemingly hosted with the endorsement of the Conservative run London Borough of Hillingdon. One of the most prosperous borough in London, and they can't even afford to hire a website security team.

—❦—

The Leadership Centre is funded by the government department for Communities and Local Government. Its mission?

We believe it takes great leadership to create thriving and prosperous communities so we work with and support senior leaders from across the public sector to help them shift their thinking on leadership.

Sadly, that doesn't extend to thinking about leading technology teams. The site has been abandoned for around the last 3 years. In that time, it has become riddled with spam.

—❦—

At the other end of the spectrum, we have the tiny borough of Amble. With a population of barely 6,000, their website plays host to a number of webpages extolling the virtue of knock-off boots.

—❦—

The town of Kidwelly is nearly 900 years old. It has a rich history including medieval castles, nature reserves, and an annual festival.

As far as Google is concerned, it also maintains a cottage industry for cut-price "blue pills".

Having spoken to the council, they have told me that the local police are currently dealing with the matter.

—❦—

Can we reasonably expect small parish councils under the yoke of austerity to have top-notch web security teams? If they are able to find the resources necessary to fund the protection of their digital assets, that's great - but it's highly unlikely.

Instead, Central Government needs to heavily invest in making sure that all councils - big and small - are able to competently run web sites and services.

Comment Spam

Every blog attracts comment spam. Fraudsters leaving vaguely plausible comments in the hope that publication will see a flurry of extra hits on their site. The bigger and more prestigious the site, the more likely the site is to be targeted. And the .gov.uk name is very prestigious.

Amongst the Government sites playing host to spam is the Foreign and Commonwealth Office's blog page for the British Ambassador to Somalia.

—❦—

The Northern Ireland Assembly is the devolved legislature for Northern Ireland. It has hundreds of comments, seemingly all of which promoting dodgy deals.

—❦—

A book of condolence in Oldham for a much loved community member now plays host to spammers.

—❦—

Lewes, and many other councils, have open forums which are overrun with spam messages.

—❦—

Even the UK National Archives have seen fit to save some comment spam for future generations to ponder.

Hidden Links

Finally, we get to the murky world of hidden links. These are spamming messages not designed to be seen by humans. They are hidden within the web pages' source code in the hopes that Google and other search engines will see them and increase the spamming site's popularity.

The spam covers the usual range from pharmaceuticals to knock off designer goods.

Again, there are several sites which exhibit this malicious behaviour.

What Can Be Done?

The State needs to take responsibility for the websites run in its name. If site owners are unable or unwilling, then those sites should be removed from the web. It is simply too dangerous to allow them to stay online without decent security measures in place.

It is time that the Government started to treat cyber-security as a serious subject. They love putting out press releases, and making grand sounding plans with shadowy agencies - what they need to do is spend some money on basic front-line services.

Suppose, for a moment, that a hacker were to interrupt payment processing for banks, or tamper with the UK's water supply, or cut off the phone lines. The economic damage alone could run into the billions.

Anyone discovering such a flaw could illegally exploit it for their own gain, or sell the vulnerability to the highest bidder.

The computer industry's solution to this problem is the "Bug Bounty". Any security researcher / hacker who finds a security bug in, say, Facebook - is then able to disclose that bug directly to Facebook in return for cold, hard cash. And a generous "thank you" note. This provides an economic incentive to find and safely reveal bugs.

Some companies band together to provide bug bounties for critical Internet infrastructure. The giants of Capitalism banding together in Socialism to protect their interests. Lovely!

Ideally, I think, Governments should compel businesses to provide bug bounties. Think of it like a form of punitive fine - inapplicable to responsible companies. Force the privatised utilities, large companies, and infrastructure providers to pay up for security flaws in their software and hardware.

It's not so unreasonable; the Government already fines companies for breaches of the Data Protection Act - so why not fine companies for breaches of a future "Computer Security Act".

But that will be a long time coming. Let's start closer to home.

Why doesn't the UK Government offer a bug bounty for its services?

Imagine that you've just found a gaping huge security flaw in HMRC. With a single command from your computer, you can subtly alter your tax status - or see how much tax an individual has paid - or erase evidence that someone has paid their owed tax.

Ignoring the illegal aspect of acting on your findings - where's the incentive to responsibly report the problem? After all, you'd get a huge pay-day from selling it to the criminal underworld.

Let's step back a bit - how would you even successfully report your findings to the Government?

Assuming you've even heard of Office of Cyber Security and Information Assurance the only way of contacting them is via email. They don't offer a PGP key, so there's no way of contacting them securely. Oh, and based on my experience, they don't reply.

One could also try contacting the affected Government agency. But again, based on my experience, they won't have the first clue of how to respond to a reported security flaw.

Finally, one could try escalating to GCHQ's GovCertUK - the security agency charged with protecting vital national computing infrastructure. They do offer a PGP key - but its validity expired at the end of January 2014...

Wouldn't it be brilliant if our shiny new GOV.UK were to offer an easy to use form for reporting security vulnerabilities? Obviously, they would need a team acting as a clearing house for all the reports they receive, and the legal authority to test the vulnerabilities reported.

Finally, if a bug was found within the Government’s IT infrastructure, they could force it to be fixed and offer the reporter a suitable reward. It needn't be monetary, of course, it could just as easily be a medal, an honour, or a Peerage - whatever they deem suitable for strengthening the nation's security.

Is this something the Government should be involved in? Or should citizens simply exhaust themselves trying to report bugs with little prospect of them being fixed and no prospect of a "thank you" - let alone a reward?

Without a bug bounty, what incentive does the Government have for keeping its electronic infrastructure secure? Or do they just believe that the "stick" of criminal sanctions is larger than the carrot of rewarding decent behaviour?

The BBC is reporting that the Government is so afraid of prisoners having access to concealed mobile phones, they want to introduce a ban.

UK officials are considering banning the sale of small mobile phones designed to resemble car key fobs.

A government spokesman told the BBC that it was discussing the issue with the National Trading Standards Board and the Serious Organised Crime Agency.

It follows a report by the Times suggesting some of the Chinese-made products were being advertised with prisoners in mind.

Having a mobile phone in jail is a criminal offence.

The article goes on to conflate a number of issues. As well as the illegality of having a phone in prison, there is the trading standards issue that some of these devices have unauthorised logos on them!

How exactly does one go about banning tiny phones? Two years ago, I reviewed the S16 watch phone. As the name suggests, it's small enough to comfortably fit on one's wrist.

A large percentage of the size is taken up by the touchscreen and the bulky battery. Since I reviewed it, sizes have shrunk dramatically - as have prices. You can now pick up a wrist worn phone for around £30. Now, all of the above are 2G phones. For 3G phones, there's the Micromax Modu. At around £50, it's a svelte 76 x 46.5 x 11 mm and features a reasonably competent Web browser.

Is the Government really going to try to introduce a ban on technology under a certain size? Or technology which looks like some innocuous other item?

Or is this just some sabre rattling to make people thing "well, at least they're doing something!"

I've talked before about my time working as an "Adult Material Classifier" for Vodafone UK. In short, my team and I used to watch pornographic videos and classify whether they were suitable for inclusion on Vodafone live.

There were the usual limitations (no more than two participants, all over 18 etc) we also had a list of banned words.

It contained the usual sexual and racial slang which was verboten - as well as strawberry and teabag.

I had obviously lead a very sheltered life. I had no idea that "to teabag" was a thing. Nor that one could "procure a strawberry" to defile. But, you can, and people do.

I can understand that David Cameron wants people not to be able to search for "obvious" search terms - but how do you block ambiguous terms? It's not hard to imagine to sort of depraved search query which would produce this image: As people see what is being filtered, it's fairly easy to switch to a slang which has no "official" meaning. In China, the Government regularly censor discussion about the massacre at Tienanmen Square. Forbidden from mentioning the date of June 4th, locals instead refer to May 35th.

So, how does any search engine filter out "innocent" terms which may lead to "illegal" images?

I'll leave you with a quote from the Central Committee of the Communist Party of China in the Global Times (emphasis added):

Web regulation in public's best interest

Many countries are trying to regulate their Internet services. Under pressure from public opinion, many well-known websites are becoming more self-disciplined. For example, Facebook has started to provide training for its website regulators to help identify and delete inappropriate remarks. In Turkey, where chaos and turmoil are running rampant, the Turkish government criticized social media as the top threat. Similar denouncements have also been heard from the British Parliament.

What exalted company our wise and infallible government are keeping.

Here are my thoughts from the day.

Farmification Of Factories

Fascinating talk from Lisa Ma about living and working with workers in a Chinese joystick factory.

Raises interesting questions about how we treat workers in terms of resources, and whether urbanisation is seen as a universally good thing by young people. It got me to thinking about how we treat factory workers compared to how we treat animals. It's now a badge of pride for cosmetics to carry a label reading "Not Tested On Animals." Following the recent disasters in Bangaladesh, should clothes carry a "No Sweatshop Labour" tag? Or, perhaps as Rob Manuel suggested, shops should publicly display how much tax they pay.

Terence Eden is on Mastodon

@edent

#opentech we have "not tested on animals" labels. Should we have "not built by sweatshop labour"?

---

Rob Manuel 🍳

@robmanuel

Replying to @edent@edent and a x% of purchase price will be paid as tax to HMRC label?

---

Or even

Terence Eden is on Mastodon

@edent

#opentech we have "not tested on animals" labels. Should we have "not built by sweatshop labour"?

---

alex

@alexstapleton

Replying to @edent@edent print the CEO to employee salary ratio on the tags.

---

There's a great interview with Lisa at VisionOnTV

Putting Your House on GitHub

What if you put all your niggling household issues on a bug tracker? Superficially, a very entertaining talk by Francis Irving - but raised a serious point about how we communicate with tradespeople.

Why can't I put a big list of jobs out to tender and let plumbers and electricians compete for my work?

I asked him about the security aspect of the project. In open source software, it's usually considered polite to raise a security bug in private before disclosing it to the wider world. You wouldn't want to raise a public bug which read "Burglar Alarm Broken", would you?

Constitutional Excerpts Project

Another great "what if" made real. What if you were to gather all the versions of countries' constitutions up in one place? What would a searchable database be like? What lessons can we learn? Given that most countries constitutions change over time, and most changes are done by non experts in the field, this could be a very valuable resource.

Alex

@blangry

This taxonomy of constitutional issues is anthropologically problematic. Relies on eurocentric assumptions. But totally fixable. #opentech

---

It also touched on the limits of crowd sourcing from the general population. When very dense legal language is involved, it is usually best to get experts to decide what it means. Of course, that's also an argument for having laws written in plain and unambiguous language.

GOV.UK

The GOV.UK team have gone from a twinkle in the eye of some techies - to a fully fledged team kicking arse in the heart of the Civil Service. Of particular interest to me was how they managed a complex redirection project as they closed various sites. Certainly not for the faint hearted.

Also interesting was the tales of some of the internal difficulties they faced. Including some "interesting" thoughts on Open Source.

CESG tech dir: "If anyone in UK government says CESG has banned open source send their name to me and I'll have them killed" #opensource13 Archived Source

I asked an awkward question about their priorities. The DWP site only works on IE6! That means trying to claim benefits if you have a modern computer or browser (or even an old Mac or Linux box) is impossible. The problem, as I understand it, is that contracts have been signed which mean making even simple changes comes with a high cost. As we've seen with PFI contracts in hospitals, the initial cost can seem attractive but outsourced companies with a strong profit motive will screw you over without providing any real benefit.

Another interesting question was asked about the "dumbing down" of content. Firstly, the pages link to the relevant legislation if you really want the nitty gritty detail. Secondly, nerds aren't average users. Average users tend to skim pages rather than reading them comprehensively. Given the average reading age in the UK is 12 (that's a hugely problematic statement, BTW) it's important that the information on the pages is as clear as possible.

I can't begin to describe how incredibly proud UK citizens should be at having such an amazing team reshaping the Government's digital portfolio.

The Bill and Gavin Show

Oh, look, just read Bill's talk and be enlightened. Given that the punk music revolution is now being used to sell cars and butter, how do we stop the digital revolution from being hijacked in such a way? One suggestion is to "weaponize" openness. Can we have a "Creative Commons MAX" licence which promises extreme legal retribution for violators? Can we create Open Source licences which prevent evil being done in our name? I suppose GPLv3 is an attempt at that.

Gavin Stark's talk on Open Data gave me a thought about the ongoing issues with privatizing the PAF (that's the data which makes up the UK's PostCode system). Several years ago, I suggested that mutual ownership would be preferable to privatisation of the Post Office - could the same be true of PAF? Would enough techno-utopians be able to club together to run PAF in an open and sustainable way?

Bribing MPs

I've been thinking a lot about political donations and "political donations". It seems that some people are able to influence the legislative process by donataing modest sums of money, and giving favours to politicians. Other people would call for a database of lobbyists, or some form of push notification service for whenever your MP receives a bribe donation. Not me. I want to make a crowd sourcing site to help you influence your MP.

(Many thanks to Alex Blandford for the name suggestion.) Yes, this talk is (mostly) humorous satire. I haven't really built "KickbackStarter" - although the mood in the room seemed of the opinion that it would be a viable idea. More than a few people came up to me afterwards and asked if they could help get it started. I think they're all crazy...

Permit me to indulge in some vanity over the feedback and photos I received.

Mr Anderson

@kevglobal

Replying to @edent@edent is giving a great talk proposing KickbackStarter to donate to MPs 'when they vote the right way' #OpenTech pic.x.com/mjzcidpdby

---

Reuben Binns @RDBinns@someone.elses.computer

@RDBinns

"Clicktivism doesn't work. Bribe MPs instead" #opentech pic.x.com/jgdtro1zme

---

Alex Ingram

@nuttyxander

KickBackStarter - GLORIOUS. Let's stop funding failed campaigns and just 'gift basket' our representatives. #opentech pic.x.com/hbqquighlr

---

Reuben Binns @RDBinns@someone.elses.computer

@RDBinns

Replying to @edent@edent 's potentially libellous, audience-compromising talk about crowd sourcing political lobbying ( /bribery) Kickbackstarter! #opentech

---

@edent makes a fab point abt the nonsense of MPs and who runs the country. Now this is a question .. do MPs take Bitcoin #opentech #A5 Archived Source

David R. MacIver

@DRMacIver

.@edent have you seen letsfreecongress.org for a related concept and proposed fix in the USA? #opentech

---

Librarian

@Librarian

Delighted2c n hear Valued Patron of the Library @edent 's awesome #opentech talk ... with this satire u r really spoiling us Sir!

---

Faintdreams

@faintdreams

Replying to @edent@edent Your Kickbackstarter talk at #opentech yesterday was amusing educational and inspirational. Bravo sire. Bravo.

---

Essentially, clicking on petitions doesn't work. Emailing doesn't work. Protesting doesn't work. Cash and gifts work reliably.

Thanks to VisionOnTV for conducting this interview with me.

Inclusive Issues In Technology - A Practical Guide

Only 17% of the STEM workforce is female. 2/3rds of female STEM graduates don't enter the profession. 50% of technology customers are female. See the problem?

Three very different speakers talked about how they were helping encourage more diversity in technology.

Firstly Stemettes is showing young women positive role models of women in science and technology. They're showing parents that their daughters can find a rewarding and useful career in computing.

Flossie is a project to get more women involved in the open source movement. They have a conference coming up in November. If you're a woman and want to present - give them a shout. Men are welcome at the event, but not as speakers. Given the aims of the project, I think that's fair enough.

Finally, Meri Williams gave perhaps the most informative talk of the event. Practical Diversity.

We hear a lot about how being a straight white male is like playing life on the easy setting, but this was the first time I'd seen someone talk through practical steps to include more people.

I especially loved her remark about tolerance. No one wants to be tolerated - you only tolerate things you hate. If you're talking tolerance, you're essentially saying "I dislike you and have to put up with you." No one wants that.

I highly recommend having a quick read of her deck.

Odds and Sods

One of the great things about OpenTech is that all the talks are audio recorded. I think, if possible, they should be videoed as well.

There were lots of people I knew - albeit some only digitally

Jonty Wareing ⍼

@jonty

Thirty seconds after arriving: "You're Jonty, I recognise your name from twitter!". I had forgotten #opentech is essentially internet LARP.

---

I wonder what the "newb" diversity is like. Are we just preaching to the choir?

Gender diversity of participants seemed much higher than a "normal" conference. Why is that? 10 speakers out of ~40 were female - perhaps that encourages more attendees. Or, is it the fact that the conference is cheap and held on a weekend?

Scheduling against both finales of Doctor Who and Eurovision was a tactical mistake ;-)

Huge thanks to Sam Smith and his merry band for organising. For all the speakers and attendees for putting such wonderful thoughts into my head, and to everyone who chuckled along at my jokes.

Same time next year? You bet!

But! My my! What's that in the lower left corner? A QR code!

Unsurprisingly, scanning the code takes you directly to the planning application on the web. Although the site isn't specifically designed for mobile, it's light weight enough to access even on a low powered phone. The planning application lets you view and make comments, read the planning application and any associated documents, and track its progress. All rather nifty!

This is close to a perfect use-case for local government use of QR technology.

• QR codes are free (libre and gratis) meaning there's no extra expense for tax payers.
• Increases engagement with the community.
• Reduces friction between citizens and state.
• There's a great call to action (although I got confused when it said "view the application" and thought it might try to install something on my phone!)

So, well done Lambeth for trying something innovative.

These are some random jotterings based on the discussions both at the event and at BeerCamp afterwards. All conversations were under Chatham House Rule.

Social Media is a problem for all organisations - whether public or private. Rightly or wrongly, the "public" see an organisation as having a single mind and a single focus. Anything which gives the impression of a lack of unit cohesion is extremely troublesome.

But troublesome for who exactly? Part of the issue with social media is its novelty - especially among the press. There's a belief (particularly prevalent in the gutter press) that because it happens "on the Internet" that it's somehow new and exciting and - therefore - relevant.

Would a civil servant writing a letter to the paper about a topic be as "controversial" as them tweeting about it?

Would an essay at university be as newsworthy as a blog post?

We all have a digital footprint which is trivially easy for anyone to discover.

So should we try to remain anonymous? Or, at the very least, keep our personal and work lives separate.

Even if we take steps to hide our tracks, it's pretty easy to triangulate a person. FourSquare checkins with a careless friend, geotagged twitpics, who your follow, who follows you - if you can identify sexual preference from Facebook, why not who you work for and what your political agenda is?

There are, to me, three main points of contention.

1. Should employees have personal opinions which conflict with their organization's?
2. Can an employee express those opinions publicly?
3. What should an organisation do in response to a problematic social media interaction?

It seems obvious to me that even the most politically-restricted civil servant has opinions. But I see the sense in keeping them as private as possible.

The privacy question is an interesting one - simply because people don't yet really understand what "private" means in the context of social media. Ranting about your boss over a pint - the words just vanish into the wind. Mostly because you don't expect people to have tape recorders running continuously.

But online? I think I've locked down my Facebook settings pretty well - but I'm still paranoid that my kvetching will leak into my "real" life.

The final one is the killer. Even the most responsible employee is going to run into a problem - either through an innocent misunderstanding, or a deliberate corruption of the position by a malicious external presence.

The key is a good HR team who will back the employee's right to a private life, and ensure that they are not castigated for expressing their opinions.

All the guidelines in the world won't stop people from making mistakes. No policy can stop a newspaper twisting every word you say.

What's equally needed is policies for how the workplace treats mistakes - and for the world to calm down a little.

Here's me chatting about mobile and the WordPress Mobile Pack - from Steph at Helpful Technology.

See my blog post about the day.

As per the meme, here are my 20 points on Gov Camp UK.

Sign up early.

I dawdled and so was only able to get a ticket for Saturday. I feel like I missed out on a lot of interesting conversations.

BarCamps should be recorded for posterity.

It's a point I've made before. Cameras and disk space are so cheap, we should record what we say and do at BarCamps by default. Now, that may inhibit some of the conversations and reduce the "Chatham House" aspect - but individuals can decide whether or not they're happy for their sessions to be recorded.

Take business cards.

Take lots of business cards. So many serendipitous meetings that it's hard to remember who's who. Make sure that your business card carries your Twitter name.

Don't take a laptop (or, at the very least, use it rarely).

As I sat down in one session, a woman said to me "Gosh! You can tell it's a techie event; every one is using their laptops and no one is talking to each other." She was absolutely right. The day is mostly about communication and - while Twitter is great for that - nothing beats turning to the person sitting next to you and having a natter.

Present.

I think it's an immutable law of BarCamp that everyone has to present. Even if it's just standing up and saying who you are.

Guaging interest is hard.

I ran two sessions, one only filled up about a fifth of the cavernous space I booked - which was pretty embarrassing. The other was so full it had people sitting on the floor. Don't be afraid of moving rooms - but make sure you let everyone know where you are going.

WordPress is really popular.

I was surprised by how many attendees were WordPress aficionados. It's good to see that Government isn't entirely tied up in proprietary crap.

QR codes generate a lot of interest.

The session I ran on QR was well attended and produced lots of positive feedback. Some people are just starting out with QR and there were loads of great ideas on how they could be used.

The police have an odd sense of humour.

One was wearing a shirt which read "Keep Calm and Carry Baton Rounds" the other, in his introduction, said "I work for the police, previously I was at Rentokill. It's basically the same job!" While I appreciate near the knuckle humour and value free expression, I found the two incidents made me really uncomfortable. Had I turned up wearing a "Burn down the Government" t-shirt, I doubt I would have received a positive welcome. Still, I'd rather people felt free to express themselves at a BarCamp than not.

HMRC will happily let you take the piss out of them.

They're very good sports and lovely people in real life.

Government needs more freedom to innovate.

That was a moan that I heard from several people. They wanted to do amazing things with the knowledge they'd gleaned - but getting sign off in a risk adverse, budget conscious department is tricky.

Building should mean building.

The second day was meant to be about getting people to build, create, or make stuff. In my WordPress session, I asked for volunteers to upgrade their blog to WordPress Mobile Pack live on stage. Amazingly, three did! Now, none of them were major Government sites(!) but it showed people were willing to take a risk and build things.

Perhaps the grid needs curating?

There were too many sessions in the first timeslot, and empty rooms later in the afternoon. There's no way of judging how popular a slot will be, so many sessions were in an room that didn't suit the attendees.

There's no such thing as a silly question.

As a presenter, it's really important not to dismiss a question. If someone hasn't understood something basic, it's more likely to be the presenter at fault than the person asking the question.

Government needs to celebrate their successes more loudly.

I saw some amazing websites, prototypes, and service - none of which I'd heard about. I think it's entirely appropriate for people to make some noise about things they've done well.

Gender Balance.

For a technology conference - there were more than 3 women! A lot more! It's a common moan in IT that the industry has trouble attracting women. Perhaps they all work in local government?

Not Many Female Presenters.

Perhaps it was the sessions I went to, or perhaps they all presented on day one - but there didn't seem to be many women presenting. I wonder if this is something which needs to be addressed?

Big Business Isn't Much different

Everyone goes on about how inefficient Government is and how they're usless at getting anything done. All the complaints I heard from Government people were the same as those that I've heard while working at big businesses. And start-ups. Every organisation has inefficiencies.

Take Photos

I was too busy chatting to snap anything. Luckily there's a rather good set on flickr.

Overall

A great day, thought provoking, useful. I hope I convinced some people about why mobile is important and how awesome QR codes are.