Secure communication, Camden-style

Peter Gothard reports on how a London borough's attempt to build a secure email network snowballed into an initiative that might one day connect every council in the country

In 2007, Camden Council began to take a close look at how it was communicating with the people who use and deliver its services. It soon realised it needed a new system to allow managers to communicate digitally in a quick, effective and, most importantly, extremely secure way with council personnel such as social workers, agency staff, solicitors and volunteers.

"It started off with seeing how Camden was using its email, and where it was going to, and we found that a lot of our emails were going out to schools and agencies that were supporting vulnerable groups," says Camden's CIO, John Jackson. "And when we looked at it, we had to make these communications more secure, and do it differently."

According to Hilary Simpson, head of ICT business partnering at Camden, the council's first attempt to improve security was "to ask social workers and other users to employ a wide range of [applications such as] WinZip, password-protected Word attachments… a whole selection", but this rather ad-hoc approach proved unsuccessful. "Quite often, the third party simply wouldn't have the right versions of the technology at their end to open the documents.

"In some cases, these were life and death situations, and they had to get a message through,
so they would simply send it insecurely. That was the way it was happening."

Camden's ICT team also found that files were being sent through unsecure networks such as Hotmail.

"We soon realised that what we were proposing was not workable," says Simpson. "We needed to come up with a basic one-click solution. We wanted users to be able to send email securely with just one click."

There was another issue that needed tackling: the council was still spending a lot of money on communication by post.

"Child protection case conferences, local government people, solicitors, clients themselves, volunteers and advocates; things like minutes for meetings for these people would have to have been sent out in paper packs, at significant cost," says Simpson. "We spent something like £40,000 a year on sending out registered post."

Jackson remembers "all sorts of things flying around. Faxes, bits of paper, just the completely wrong way to find things in an efficient way." Inevitably, letters and documents would be sent
to the wrong people, or simply get lost.

Realising that the need for a secure email network was not exclusive to Camden, Jackson and his team began exploring the possibility of developing a shared solution through a now defunct forum called Capital Ambition. Sitting down with IT leaders from 17 other London councils, Jackson built up a picture of what was needed and began looking for a suitable solution, with a bias against "humongous, one-size-fits-all solutions".

The initiative was dubbed the Secure Communication with Third Parties Project (SC3P).

"We looked at eight products," says Simpson. "The main requirement was that it had to be simple for council staff to use - we certainly didn't want to have to send people away for training.

"Some were only offering file transfer or almost SharePoint-like facilities," remembers Simp­son. "We didn't want anything like that - we wanted some­thing that would integrate with email in a very intuitive way."

It was Egress Software Technologies' cloud-based Switch solution that finally emerged as the best candidate.

A policy-based gateway and desktop email encryption service, Switch plugs directly into existing email solutions and is operable via nothing more than a drop-down menu. It was the "one click" approach Jackson and Simpson had been dreaming of. Another key attraction was the service's "follow the data" audit feature, which would make investigating any accidental losses or breaches a relatively straightforward task.

The SC3P team was also drawn by the fact that Switch does not require client software to maintain its encryption code.

"The real innovation here was giving the recipients free access to the emails sent, and making them able to respond to them," says Jackson.

All 17 boroughs adopted the service.

"We had considerable take-up right across the council, often in areas we probably hadn't thought of originally," says Simpson. "Our emergency planning department uses Switch to link up with other organisations, and our child protection lawyers use it to communicate with solicitors. Solicitors themselves are purchasing licences to communicate with their clients securely."

Secure communication, Camden-style

Peter Gothard reports on how a London borough's attempt to build a secure email network snowballed into an initiative that might one day connect every council in the country

After 13 more London boroughs joined the network, SC3P and Egress decided it was time for the project to go national with a new name: the Trust Network.

“It’s been exciting… now there’s a lot more authorities using it outside London, which means more licensed users on the network,” says Simpson.

According to Egress CEO Tony Pepper, the initiative’s success is largely down to the vision and drive of the Camden team.

“They provided the framework, but now Wales is on board, Scotland is interested, and then immediately outside of London, Surrey’s licensed their entire council of over 8,500 users.

Guildford’s done the same. And it’s all because of the work Camden did leading the broad London network.”

Jackson describes the spread of the Trust Network as being “like the early days of Facebook; when everyone realised it was there and it just… took off”.

The Trust Network’s success contrasts with the rather more sedate progress being made by the government’s Public Services Network (PSN).

“The PSN has nowhere near the take-up,” says Jackson. “I don’t want to ‘diss’ the central government initiative, but in a sense what is happening is we’ve seen a speed [with Switch] of execution and scale.”

“This contrasts with some of the big suppliers in local government, who won’t move without a purchase order or change a line of code without a £25,000 development fee, which is quite typical in some cases for even minor changes,” adds Simpson.

”Working with Egress, which is smaller and agile, [has allowed us] to come up with good ideas for tweaking the product. They’ve just been very responsive. There’s been no mention, at any stage, of money,” she concludes.

Jackson says the project has caused him to see the cloud in a new light.

“I’m slightly cynical about the hype around cloud,” he says. “I always think it’s just another word for outsourcing really, but I think what’s interesting with Egress is it’s delivering what I’d call the true cloud – a capability we can plug into existing infrastructures and make it work correctly.

“Just a drop down bar in our email system, and – bam – it’s gone. So it’s bringing cloud capability in without having to move your entire hosting environment to, say, Capgemini. It really is flexible and does what it says on the tin.”

Over the next 12-18 months, Pepper hopes to see “every single local authority in England, Scotland and Wales using the product to share with third parties”.

@PeterGothard