tfpl blog

Where is data protection going?

This week, TFPL hosted the latest CiG seminar Data Protection - is it really possible or just a pipe-dream?  There were presentations from Jonathan Holbrook, the Head of Data Protection Practice Private Sector at the Information Commissioner's Office and Sunny Bath, the Data Protection Officer at Euromoney Institutional Investor (EII).   Martin Sanderson, from our Records Management Team, attended and reports below:

"When attending a Data Protection meeting in Europe in 2007 I was surprised to hear that the UK was reported as the weakest European member in implementing DP with Spain the strongest.  Perhaps Jonathan provided the answer to this position in explaining the lack of ICO’s enforcement powers or indeed the lack of interest by the press (for their own reasons) to push this as a key public issue.

However I was encouraged on hearing how seriously EII has taken Data Protection, and the level of effort and investment they have put into this over the years.  Their starting point was to carry out a thorough audit of the personal information they were holding across the organisation.  I wonder how many other organisations have even taken this first step in bringing their management of personal information under control. Recent events in the UK suggest there is a long way to go but until we witness a stronger enforcement regime in the UK I cannot see this happening".

See more about this event on Fenton Research blog 'But why do you need to know?'

My notes from TFPL's SharePoint conference

Val has spent the last month fending off phone calls, e-mails, texts and bended knee entreaties from people pleading to be given a precious ticket to TFPL’s SharePoint conference.

The big day finally arrived: Tuesday April 1 2008.  The 140 seat Sir Henry Wellcome Auditorium was packed out all day.

It didn’t disappoint. The speakers gave a great overview of what organizations in the UK are doing with SharePoint, and the opportunities and issues presented by what looks like becoming an all pervasive information environment.

Here are the notes I tapped (as quietly as I could) into my little Asus Eee pc, as I listened to the speakers

WHERE HAS SHAREPOINT COME FROM AND WHERE IS IT GOING? Jeremy Bentley, CEO SmartLogic

How Microsoft’s rivalry with Google has influenced SharePoint’s development
The first release of SharePoint, was simply aiming to replace the shared drive.  After several iterations, and huge investment, it is now aiming for much more than that:  a genuine enterprise information platform.

The difference between the second release, in 2003, and MOSS 2007 is $800 million of development.  Most of this massive development spend went on improving the search facility. This was prompted by the threat to Microsoft posed by Google's move into corporate market.

Gartner said that the main fault of the earlier versions of SharePoint was the poor quality of its search functionality.  Microsoft  had not put significant resources into the search features because they didn’t regard Google as a threat.  Google was concentrating on search in the world wide web, rather than inside organizations.

The enterprise search market has until recently been dominated by Autonomy, Endeca and Fast: three relatively small companies.  Google was the first of the big boys to enter the enterprise search market. Google's enterprise search offering was radically simpler, cheaper and quicker to implement than its competitors.  Implementing Autonomy involves nine months of building taxonomies and developing teaching scripts and training the Autonomy tool.  Implementing Google's enterprise search tools takes one afternoon. 

There is no way that companies the size of  Autonomy, Endeca and Fast could compete with Google.  Google's R and D spend per year is bigger than the combined market value of all of these companies.  Once Google went into the Search market then other big boys piled in:  IBM, Oracle and Microsoft.

Search is the new portal for individuals into their information world.  On the web people use the Google search interface and never bother with any classifications or metadata fields.  They expect the same inside their organization.  MOSS 2007 is the first SharePoint release to address the search requirement of people in modern organizations.

What is missing from MOSS 2007?
SharePoint does not have support for:

• classification
• taxonomy and ontology
• metadata integration
• guided navigation

SharePoint only supports controlled vocabularies in the form of flat-lists.  Information scientists within Microsoft lost the battle to support multi-level taxonomies because of the focus on improving search.

SharePoint as an enterprise information platform
The addition of enterprise search functionality means that SharePoint can claim to provide an all embracing information platform, spanning the gap between the (Microsoft) operating system and the Microsoft Office tools (Word, Outlook, Excel) that people use to create and receive information.  It fills the gap by providing the collaboration environment people need to work with each other, and a search portal which the organization can shine over as many of its content repositories as it wishes

Massive Growth of SharePoint
Microsoft  claims to have sold 100million SharePoint client licenses worldwide. Even if only one tenth of these is being used that is still massive

SHAREPOINT FOR RECORDS MANAGEMENT  Case study, DEFRA, Roger Smethurst, Head of Information and Records Management

DEFRA’s decision not to go ahead with EDRM
In 2005 DEFRA launched a 500 user pilot of a National Archives approved EDRM system. They decided not to go ahead with the implementation which would have cost £1,000 per user per year.

They looked again at their requirements and decided that:

• Helping colleagues collaborate was a key requirement
• DEFRA didn’t need their system to meet the whole of the National Archives statement of functional requirements for ERM.  They whittled the TNA requirements down to two pages of A4 to focus on what they really needed.
• They would use as much software already in DEFRA, or already purchased, as possible
• They wouldn't go for a one size fits all approach:  if a case management system was working well, DEFRA are happy for people to keep records in that system.
• They would aim to provide colleagues with the tools they need to collaborate, and then build ways of harvesting records from those collaborative environments. 

Customisation of SharePoint to meet records retention requirements

• SharePoint is based on sites:  ‘my sites’ for individuals, ‘team sites’ as a shared collaborative space with colleagues.  Retention schedules cannot be applied to records in team sites,  but documents can be moved to  ‘records centre’ sites where retention rules can be applied. 
• Out of the box MOSS 2007 provides a router to move documents needed as records from a team site to a records centre.  But it leaves a copy in the team site, causing problems of duplication and confusion over what is the official version.
• Defra developed their own customisation: when a document is moved to a records centre a link is left behind in the team site, but no actual copy of the document.  This means that people can still access the document from the team site but they are accessing the record copy in the records centre.

Customisation of sharepoint to accommodate a fileplan structure

• MOSS 2007 does not include the ability to apply a fileplan.  DEFRA have included the fileplan path in the URL of each team site.  They have customized SharePoint to harvest the information included in the URL of each team site and include it in the metadata of records that originated from that site

Governance of team sites within SharePoint

• If you don't control the implementation you get  'SharePoint sprawl’, so many team sites you don't know what to do with them.
• Power users can set up team sites and chose a structure for the team site.  They need to talk to records managers when they set it up to decide where it sits within the SharePoint structure.
• Defra set up an Information Architecture Board, chaired by Roger, to oversee the growth of the system.

USING SHAREPOINT TO SIMPLIFY THE LANDSCAPE  Learning and Skills Council case study:   John Quinn (DCFS) and Alexis Castillo Soto (LSC)

In LSC  MOSS 2007 provides  one enterprise search across the LSC intranet, legacy shared drives, SharePoint team sites and SharePoint my sites. All of these areas are simply viewed as SharePoint libraries.  It has made it far easier for colleagues to understand the information picture within LSC.

LSC have taken off the administration rights that users by default are given over their 'my site'.  This is because with admin rights users can:

• add web-parts which are prone to fall over,increasing the support requirement
• create team workspaces underneath their my site which are invisible to the organisation

USING SHAREPOINT FOR COLLABORATION:  KPMG case study,  Ceri Hughes 

• Use of 'my site' is an important part of the implementation.  An individual's my site functions as their equivalent of a people directory entry, enabling others to find them and find out about them.  It also functions as their window out on the rest of KPMG, they can set up RSS feeds to resources inside SharePoint and beyond, and set up links to key people they want to network with
• Colleagues want an equivalent of Google:  Now SharePoint offers one search over many different content repositories instead of separate search engines.
• Big generation divide:  younger 'generation Y' colleagues are asking for blogs, wikis and to set up Facebook groups, others are suspicious or nervous of these tools
• Internal blogs and podcasts have significantly raised the visibility of leadership figures in KPMG
• Managing expectations is important.   Allowing people to use wikis doesn't mean that we will get a KPMG equivalent of wikipedia in six months time!
• Tried to use it out of the box ( so able to upgrade easily to service pack 2),  but the interface was too simple and therefore KPMG have customised it.
• Without governance around setting up of team sites it can get quickly out of control
• Migrating legacy Sharepoint 2003 into the MOSS 2007 has not proved as easy as one might suppose

USING SHAREPOINT AS AN INTERNET Steven Buckley, Christian Aid

• Christian Aid did not waste time and  money rebranding SharePoint (after all it is only an application, and you don't rebrand Word or Outlook)
• Using SharePoint for their intranet, and as a collaboration system
• When deciding the  structure of team sites they didn't show people SharePoint. Instead they just asked people what they wanted to store, how they wanted to find it and what communications feature they wanted in their collaborative enviroment.
• Two years ago Demos wrote a report on 'De-organisation' a term for the phenomenon whereby the links that tie staff to the organisation are weakened through practices like remote working. To de-organise successfully organisations need to create alternative sources of stability and certainty. A collaboration system could be that source of certainty.  A collaboration system is of even more importance to a remote worker than  to a deskbound officer.
• It was important that SharePoint wasn't seen as yet another place to store things, that it is seen as reducing the number of places things are stored.  The day a team was trained on SharePoint its network drives were turned off, with the content already having been migrated to SharePoint.
• People can elect to join specific audiences and communities.  This drives the type of content that is pushed out to them, and even what you see on the intranet home page.  People can subscribe to alerts from other sites so they keep abreast of what interests them.
• Each team has a blog, they are encouraged to put up news and comments on their team blogs as they occur to them.  The central communications teams subscribes to all these feeds from each team and can pick up on stories that are of interest to the whole organisation.
• Internal podcasts and live staff radio broadcasts of meetings have cut down the need to attend meetings and briefings in person.
• Christian Aid decomissioned the line of business system they used to run their multi-million pound grant programme.  They are now managing the process from an application built in SharePoint, saving money on licence fees and maintenance agreements.
• Vendor management is important: always make an effort to understand the road map of your vendor.  Christian Aid make great efforts to be a global reference site for Microsoft and in return they have worked with us to meet our requirements.
• They encourage staff to use Facebook, and to set up Facebook groups with each other.  There are lots of Facebook links around the Christian Aid intranet.
• They kept customisation to an absolute minimum (five minor customisations) in order to make the upgrade path as simple as possible. 

CONCLUSIONS FROM THE DAY  Adrian Dale (Senior Advisor, TFPL)

The speakers have shown the many applications of MOSS 2007 including its uses:

• as a communications tool
• as a document repository
• as a collaboration environment
• for alerting people to new documentation or news of interest to them
• an applications platform:  strip out other systems, reduce number of systems by developing new applications within SharePoint rather than bringing in new systems

Connecting people to people is just as important as connecting people to information. For a lot of organisations 'people finder' is the  killer application of the SharePoint suite:  it is effectively an out of the box people directory. 

For the first time collaborative software looks like becoming a standard part of everyone's desktop. 

Very heavy document centric processes still need industrial strength document management systems. Pharmaceutical, Legal, and some parts of government all continue to need these.  But a great many other organizations may find that most of their knowledge workers do not want or need this strength of system, and can get along better with a well managed SharePoint environment.   

Sharepoint: a viewpoint from IT directors

Charles Christian has posted onto  The Orange Rag a summary of a round table discussion between IT directors of Law firms  on SharePoint.  See Charles' post for the full summary, but below I have grouped together some of the points that most interested me:

What is SharePoint?

• Sharepoint is still perceived as all things to all men -what exactly is your firm trying to achieve and do with Sharepoint?
• Microsoft defined SharePoint as an Information Management Platform – it is a toolset with which a firm can create a multitude of applications.

SharePoint's phenomenal growth

• From Microsoft’s perspective Sharepoint is their number one business application in terms of sales, with over 100 million Sharepoint licenses, that’s one in 20 MS licensed PCs in the world using  Sharepoint!

Impact of SharePoint on the vendor market

• Some felt quite strongly that Sharepoint is and will continue to enable them to reduce the number of bespoke and niche applications they need.
  It was generally agreed that the vendors to have/are/will suffer from SharePoint are: 1) Portal vendors 2) Web Content Management solutions 3) Workflow solutions
• One prominent IT Director guaranteed that in 5 years there would be no Document management Systems (DMS) as we know it today instead this would all be done through and using Sharepoint.  Neil Cameron Predicated that fairly soon any enterprise portal/intranet will be run with Sharepoint

I like the point about SharePoint being all things to all men:  it has for example driven a coach and horses through the distinction between an intranets and a document management system.  I worked for one organisation which was rolling out a document management system for colleagues to store their working documents,  whilst replacing its intranet with SharePoint.  Pretty soon they realised that by giving every team the ability to create sites on SharePoint they were in effect rolling out two document management systems at the same time.

Google vs Microsoft: Google Sites vs SharePoint

In February 2008 Google launched the latest addtion to their Google Apps suite:     Google Sites.  It has been dubbed as Google's answer to Microsoft SharePoint:  an application that allows teams  and workgroups to create collaborative sites to share information and documents. 

Google are allowing any individual to create a Google Sites application for their organisation for free, and in minutes.   Google's hope is that the application will then spread virally within the organisation, as that individual invites other colleagues to join and collaborate with them.   

Google are by-passing IT departments, hoping that teams impatient with their organisation's systems will jump ship to Google Sites.

However Google are offering IT departments a way back into the loop.  Once a Google Sites application has reached a critical mass in the organisation then  IT departments may want to step in an take control of it.  Google have made provision whereby a Chief Information Officer can sign in and demonstrate that the or she owns the organisation's domain name. They willl then receive administrative rights over their organisation's Google Sites.   They also have the option of  upgrading to Google Apps Premier Edition, and at that point becoming a paying Google customer.

The risk of this model is that it poses a question mark over control of the sites. Could I see my team's collaborative site deleted by our Chief Information Officer who had subsequently secured administration rights?  Conversly, from a Chief information Officer's point of view,what would be the point of paying to upgrade to Premier Edition if I didn't get the ability to weed out reundant sites?

I created a TFPL Google Sites application this afternoon, simply by registering with my tfpl.com e-mail address.  If or when any of my TFPL colleagues creates an account for themselves using their work e-mail address they will be:

• told that there is already a TFPL.com instance of Google Sites
• able to see my name and e-mail adress and the names of any other TFPL colleagues who have already created an account for themeselves
• able set up collaborative sites within TFPL.com (the sites themselves are similar to wikis)
• able to assign access permissions to any site they set up within TFPL.com. They can choose between allowing all TFPL colleagues to see it, restricting access to invited colleagues ( they can  also invite people outside the organisation) or allowing the whole world to see it.

In theory if my other forty colleagues signed up we could be up and running with collaborative sites for our projects and programmes within a couple of hours.

See also  Sarah Perez's article on ReadWriteWeb   Is Google Sites the next SharePoint

The future of RM

Earlier this week, we hosted another free training course for our registered temporary workers.  The course, ‘From EDRM to Google Docs: what does the future hold for records management?' was led by James Lappin.

Around 30 of our temps heard James compare three different models for managing electronic documents  (EDRMs, Microsoft SharePoint and Google Docs).  The advantages and disadvantages of each were examined.

‘I thought James Lappin's presentation was excellent. I was particularly impressed with how the presentation was structured and the content thought out.’

‘James is clearly an excellent trainer and able to relate his knowledge of systems in a relaxed manner which makes the information easy to absorb.’

For more information about temps training events or temporary recruitment at TFPL contact katy.crosse@tfpl.com

What you do once you have successfully implemented EDRM?

On Wednesday I heard an extremely witty and informative talk by Ben Plouviez of the Scottish Government.  Ben is one of a select group of people who can say they have successfully implemented an EDRM system all the way across a large and important organisation.

Rolling out EDRM is a long old slog. You have to procure it; configure it; build your fileplan, your retention schedules and access rules; write your policies and procedures; pilot it; take it to every team, get their folders set up and get them trained.  By the time you've done all that you are three years older than when you started.

And what happens next?    Here is my summary of  Ben's advice on what to expect (or rather what not to expect)

• Don't expect a post -implementation party:  most of your project team will have found other roles in the weeks immediately before the end of the implementation project

• Don't expect much in the way of resources to manage and support the system:  Once you've implemented the system the organisation's attention, energy and resources will be diverted elsewhere.

• Don't expect to be able to find people with the multiple skill sets you need to support the system: your ideal support team understands the business and its operational needs; the technology and the configuration of the system; the organisation's records management policies, fileplan, access rules and retention rules; and the legal framework (particularly Data Protection and FOI).  There aren't human beings alive who combine all of these skill sets.

• Don't expect to know what is really going on in terms of usage of the system:  there are very few benchmarks out there for what constitutes good usage of an EDRM system.   Your system might be able to tell you that a certain team has saved a certain number of e-mails to the EDRM.  But what does that tell you? Should they be saving more than that? or less than that? Are they the right e-mails?  When you do come up with a good key performance indicator don't automatically assume that your system will be able to run you a report on it. 

• Don't expect the system to help with information overload: as the system grows and grows with more and more departments contributing to it and more and more documents on it, so the search results return more and more hits and the quantity of information overwhelms the quality of information.

• Expect technology to always move one step ahead of your EDRM:  How does the EDRM capture things like blogs, wikis and instant messages when these things were barely thought of when your implementation started?

• Don't expect your fileplan to survive organisational change unscathed: however hard you try to ignore the organisational structure when you draw up your fileplan, it will inevitably colour the fileplan and when the organisation changes the fileplan will need to be adapted to.

• Don't expect the work on the EDRM to ever finish!

Ben was speaking at Unicom's conference  'Preserving and protecting data and information assets'

Why use your work computer?

 

Two Saturday's ago I read Stephen Fry's Guardian article Deliver us from Microsoft, about a new laptop called the Asus Eee PC.

He described a laptop which:

• was no bigger or heavier than a normal sized hardback book
• cost £229
• took 20 seconds to start and ten seconds to close down
• had usb ports, speakers,  wifi web access, and webcam
• has no DVD or CD drive
• uses Open Source instead of Microsoft's operating system and software
• allows you to create, read and edit MS excel, word and powerpoint documents through the open source package OpenOffice.
• has a charger that is as light as a mobile phone charger.

In an age when a fully functional laptop is cheaper than an Xbox and as light as a book, what is the incentive for an individual to use their organisation's computers?  Won't they just buy their own devices, configure them how they like and use them for whatever they want in work and in play?

I decided to buy one of these Asus Eee PCs.  They took some tracking down  because they have been selling like hot cakes.  I found a post on a geek forum saying that 237 Tottenham Court Road had received a delivery of 200 of them on Saturday Feb 9.  I got there at 12 noon on Monday February 11.  They only had thirty left, they'd already sold eleven that morning (and sold another while I was chatting to them). They were confident the rest of the batch would be gone by the end of the day.

When I brought it back to the office it was like bringing a new born baby in, lots of colleagues crowding round, wanting a look and a hold.   One week on and I'm delighted with the thing.  My old work laptop is now permanently moored at my desk, kept on for the convenience of its connection to the work e-mail server.  I use the Asus Eee when I am working at a client's office, working on the train, and of course, for playing around with at home.   

The funny thing is that TFPL's head of IT (Michael) is far more interested in my Asus Eee than he ever was in my work (Dell) laptop.  Every time he passes my desk he asks me how it is working, and he sat for the best part of an hour connecting it up to our work shared drive.  He's even offered to rebuild my old Dell.

New job for 2008?

The start of the year is a traditional time for reflection as well as planning for the months ahead.  It's not surprising, therefore, that a number of knowledge, information and records management professionals, along with ICT and sales and marketing professionals, spend January beginning an active search for their next role. 

Despite predictions of an economic downturn, January at least has started really positively here.  Both the number of people registering with us as candidates and the number of roles we are recruiting for, have increased by 10%.   

If you would like an informal chat about the opportunities on offer at the moment, please contact luisa.jefford@tfpl.com

SharePoint versus EDRM

A delegate on one of my recent EDRM training courses told me that his organisation (a large financial institution) had been planning their EDRM implementation for years and were just about to start their roll-out when they received some unwelcome news.  Another part of their organisation had purchased SharePoint. 'What should I do?' he asked me.

EDRM systems and SharePoint are both competing for the same space and market (and as the above example shows, sometimes competing within the same organisation). But there are marked contrasts in the strengths, weaknesses and records management model behind the two types of system.

Strengths
The strength of EDRM is the control it gives to organisations.  They can ensure that all their teams and departments store their documents and records within one organisational classification (fileplan). 

The strengh of SharePoint is the flexibility it gives to teams and workgroups:  a team can set up a team site or a project site within which they can have:

• their own document library to store their documents and records
• a calendar
• a bulletin board
• links to, and feeds from, other sites
• news and pictures etc.

Weaknesses
The achilles heal of EDRM is user acceptance.  The fact that teams are forced to store their records in an organisationaly defined structure brings with it the risk that teams and/or individuals will reject the structure and opt to store their documents elsewhere. Some EDRM implementations have been prematurely aborted due to lack of user-take up. 

The achilles heal of SharePoint is the overall coherence (or lack of it!) of the repository. Each document library inside each team site or project site is a world on its own.  There is no place to maintain an overall classification to bring together and make sense of all the records in the system.  My colleague Miles describes a typical SharePoint implementation as 'a tangled mess of websites, with document libraries popping up all over the place'

Speed of implementation
EDRM is notoriously slow to implement:  not just the time to configure and integrate the software, but the time taken to build the organisation's fileplan, and the time taken for the phased roll out to reach all parts of the organisation. 

SharePoint is not necessarily any easier than EDRM to configure, but once you have got it up and running teams can set up project sites and get working straight away.  Another colleague (John) describes project sites 'spreading like bindweed' as team after team sets them up.

Records management model
EDRM stems from a well worked through records management model, based on the International Records Management Standard and the statements of functional requirements issued by the National Archives (TNA 2002) and the European Union (MoReq).  Retention rules and access rules are linked to fileplan headings and passed down to the folders and records saved under those headings.

SharePoint has not attempted to meet the TNA 2002 or MoReq requirements (the strength of Microsoft's position in the market means it can prosper without them).  Instead SharePoint has its own records management model.  Rules can be defined whereby documents needed as records can be copied from document libraries in team sites, and sent to another type of site, called a records centre.  Retention rules can be applied to those documents copied to the records centre. 

I am sceptical about the value of the records centre in SharePoint.  It is an afterthought, a place where no-one visits and no work is done. A records graveyard rather than a trusted, referenced and used archive. 

Conclusions
I am no fan of the records management model behind SharePoint, but I must admit that the project site is a much more lively and interesting environment to work in than either the traditional hard copy file, or the electronic record folder in an EDRM.  My hopes are that we as a profession can:

• find ways of helping our organisations to structure and make sense of these team and project sites, rather than relying on the SharePoint's unproven Records Centre concept. 
• find ways of influencing Microsoft to improve the functionality of SharePoint in ways that make the above task easier.

SharePoint Summit

On April 1, 2008 TFPL are hosting a one-day conference in London at which practioners and consultants from a variety of UK organisations and sectors will share their experiences in using SharePoint for records management and collaborative working:  to see the programme and for details of how to sign up follow this link

Home-shoring!

Many thanks to Vivienne Winterman who reports from a conference entitled Mobile and flexible working in the public sector.

Flexible working is a key issue in helping central and local government meet 'transformational' targets.  With the reduction in office space being a key requisite to fulfil this initiative, staff need to work more flexibly away from the workplace - ideally from home.

The new term for this is 'home-shoring' as coined by Kevin Breach, a Senior Advisor from ACAS who spoke at the conference.  Changing the culture of both management and staff is key to the success of flexible working.   

TFPL has recently carried out reviews for several councils movng in this direction.  They have realised that access to both internally produced and externally published information at the desktop will be a key requirement to successful out of office working.  If staff can access well managed resources via the web/intranet it will be easy for them to adapt to working from home two or three days a week.

The requirements of EDRM and e-books and e-journals are forcing organisations to look closely at how they manage and share internal documents and how they procure and manage externally published information.  Organisations need to deliver these services centrally, reduce duplication of effort, time and costs and enable the workforce to work collaboratively whether they are in the office or elsewhere.