Ian Cuddy

The Department for Work and Pensions' Government Connect project has just issued an alert to councils 'strongly advising' them to review any Windows Mobile deployments for security reasons. The missive, included in this GC bulletin put out on 1 July, reads:

The current CESG policy/ guidance states that Windows Mobile version 6.1 is not deemed suitable to access, store or process RESTRICTED (IL3) data. This policy statement goes on to clarify that any such device can be used for data at IL2 and below, subject to extant HMG guidance & policy, such as Memo 35 (and the recently released Good Practice Guide 10).

Councils are strongly advised to review any current deployments of Windows Mobile in line with this guidance, with a view to ensuring such devices will only be used at IL2 and below, and that appropriate measures are applied to protect any sensitive data residing at the endpoint.

This note, I would guess, was prompted by a story I produced a few weeks ago for Public Sector Forums on how the Gov Connect project was forcing some councils to abandon or severely curtail 'mobile working' activity – hampering projects which, until recently, were providing councils with very real and substantial benefits.

For the uninitiated, Gov Connect is a £40m flagship Government IT project which, since 2005, has being trying - until lately with not much success - to connect all 470+ local authorities in England to a secure network called the GCSx.  This work is regarded as hugely important to Whitehall's Transformational Government agenda, as is apparent if you visit the GC website. The problem, however, was as of last year few councils had actually signed up to GC because they could see no business case.

Then last year the DWP effectively made Gov Connect mandatory.  In light of the Datagate controversy, it told councils they couldn't access its master database (and so process benefit claims) unless they used a secure 'approved' network. With the only such available network in England being Gov Connect, the business case was suddenly made overnight.  Recently, council IT departments and their suppliers have been working overtime to meet the security conditions for connecting to GCSx - part of which require authorities to adopt a new, secure mobile working policy.

That's a brief potted history. The latest fly in the ointment is that CESG, the Governments' IT security advisory body, ruled last year that devices running Microsoft's Windows Mobile are not safe to use for 'Restricted' data.  Meaning a lot of current systems being used by mobile workforces in local government are not allowed to connect to GSCx.  Leaving councils will apparently little option but to turn off mobile devices, ditch their existing IT equipment and meet the costs of buying and installing whatever is needed to stand behind new ones. (And we're talking tens of thousands of devices for some councils here).

Two things strike me about this latest DWP note.

a)  The Department is only asking councils to 'review' things and is NOT shouting 'Switch off your devices now!' – suggesting a softening of stance, and

b) It implies there are councils out there currently unaware of the Windows Mobile 'issue' – and who therefore may be in for an very unpleasant surprise,  given this news comes just two months before the deadline for all councils to be GC-compliant.

The wider ramification, not to be forgetten in all this,  is that the only 'approved' alternative to Windows Mobile available to government users in this scenario is the BlackBerry.  So has the Government (or rather CESG) helpfully handed RIM a public sector monopoly on a plate?