With GBP 2 billion in payments annually to 120,000 farmers and traders in the UK running through the Rural Payment Agency (RPA), the Agency relies on an efficient and secure IT infrastructure and electronic business applications. The introduction of the Single Farm Payment Scheme in 2005 added new challenges to the development of the IT system. RPA Security Officer Ian Pittock has particularly found the transformation to be full of bumps and pitfalls.
The RPA is the main body handling the different EU schemes for providing payments to English farmers and traders, and also handles the UK-wide schemes. In addition the RPA carries out claim compliance inspections, livestock tracking and handling of milk quota allocations, and deals with rural development and other environmental issues.
“A few years back we started a Change Programme to make the Agency more efficient,” says Ian Pittock. At that time they had more than 80 different payment schemes. These schemes were backed up by an equal number of systems and subsystems, some of which were old and cumbersome.
“Our plan was to make a core digital system with a common workflow handling the different claims,” he says, continuing: “System integrator Accenture was engaged to lead us through this process. In the middle of the process, the EU decided (quite surprisingly and almost over night) to implement one common system – the Single Farm Payment Scheme (SPS); this was the biggest change in the Common Agricultural Policy for 30 years.”
In many ways the SPS was great news. Previously, farmers had to file different claims for such things as growing wheat, beetroot starch or if they were raising cows, pigs or sheep. Under the new single payment scheme, the subsidies were based on the size of the farmer’s land.
However the SPS created a set of new challenges related to the ongoing IT Change Programme, and the RPA soon ran into trouble. The Agency was heavily criticised, and the UK Parliament’s Environment, Food and Rural Affairs Committee published an interim report raising several concerns about the RPA’s ability to meet the deadline for making payments to farmers under the SPS. As a consequence, the former CEO had to leave the RPA.
What were the main reasons for the problems and late payments?
“Many of the problems encountered were based on the fact that the whole of the Change Programme relied heavily upon experience imported from industry. Whilst this is fine in theory, this industry experience had little exposure to the unique rigours of working within public sector constraints and specifically those arising from the EU. Therefore, there was a divergence between the specified business requirements, delivery of these and the needs driven by Civil Service and EU regulatory policies. Basically, the programme lost touch with what was needed as an effective delivery system that also met regulatory requirements,” says Ian Pittock.
However, expert consultants from DNV-acquired Echelon were hired to develop an information security assurance process in order to implement both UK and EU Paying Agency security requirements, according to which the RPA is now subject to external audits from a number of sources.
What were some of the security issues at hand?
“One of Prime Minister Tony Blair’s focus areas has been to transform public sector services and to ‘deal with the public electronically’. Traditionally the RPA used self-contained systems that did not communicate outside the organisation. Now there was a demand to open up the systems and have them talk to systems in other organisations, including to introduce e-commerce via the Internet. The SPS was new, and what were most important were its data protection and information assurance aspects,” says Ian Pittock.
He also mentions one of many pitfalls they have encountered. “Certain data is limited to a few entrusted persons. On implementing the access control, we discovered a security breach when sensitive data were not automatically deleted from the user’s cache on his or her local PC.”
Generally speaking, there has been a lack of understanding of the security issues within some areas of the Agency, according to Mr Pittock. “For instance, there was a suggestion that access to real customer data be allowed from a third world country for testing purposes, based on using the Internet as an access channel. This was refused as a big security issue was identified since this could have led to organised crime trading sensitive details, such as bank account information, through having either intercepted data in transit or through placement of employees in the third country facility. There is a confidence factor involved and we have to convince the public that information about them is safe and that data will stay secure.
“In this respect the DNV team has played an important role in providing close support, including business continuity consultancy and penetration testing services,” says Mr Pittock.
“Unfortunately difficulties in implementing the SPS, cost overruns and schedule issues relating to the Accenture delivery have impeded the launch of the Internet-based service. The SPS system is Internet ready with a digital certificate process built in if we choose to use it. However, due to the problems related to the payment processes which are resulting in late payments, we will concentrate on these issues before taking the next step towards the Internet and e-commerce,” concludes Ian Pittock.
Text: Ole Magnus Grønli
Date: 2007-06-08