The Department for Work and Pensions' Government Connect project has just issued an alert to councils 'strongly advising' them to review any Windows Mobile deployments for security reasons. The missive, included in this GC bulletin put out on 1 July, reads:

The current CESG policy/ guidance states that Windows Mobile version 6.1 is not deemed suitable to access, store or process RESTRICTED (IL3) data. This policy statement goes on to clarify that any such device can be used for data at IL2 and below, subject to extant HMG guidance & policy, such as Memo 35 (and the recently released Good Practice Guide 10).

Councils are strongly advised to review any current deployments of Windows Mobile in line with this guidance, with a view to ensuring such devices will only be used at IL2 and below, and that appropriate measures are applied to protect any sensitive data residing at the endpoint.

This note, I would guess, was prompted by a story I produced a few weeks ago for Public Sector Forums on how the Gov Connect project was forcing some councils to abandon or severely curtail 'mobile working' activity – hampering projects which, until recently, were providing councils with very real and substantial benefits.

For the uninitiated, Gov Connect is a £40m flagship Government IT project which, since 2005, has being trying - until lately with not much success - to connect all 470+ local authorities in England to a secure network called the GCSx.  This work is regarded as hugely important to Whitehall's Transformational Government agenda, as is apparent if you visit the GC website. The problem, however, was as of last year few councils had actually signed up to GC because they could see no business case.

Then last year the DWP effectively made Gov Connect mandatory.  In light of the Datagate controversy, it told councils they couldn't access its master database (and so process benefit claims) unless they used a secure 'approved' network. With the only such available network in England being Gov Connect, the business case was suddenly made overnight.  Recently, council IT departments and their suppliers have been working overtime to meet the security conditions for connecting to GCSx - part of which require authorities to adopt a new, secure mobile working policy.

That's a brief potted history. The latest fly in the ointment is that CESG, the Governments' IT security advisory body, ruled last year that devices running Microsoft's Windows Mobile are not safe to use for 'Restricted' data.  Meaning a lot of current systems being used by mobile workforces in local government are not allowed to connect to GSCx.  Leaving councils will apparently little option but to turn off mobile devices, ditch their existing IT equipment and meet the costs of buying and installing whatever is needed to stand behind new ones. (And we're talking tens of thousands of devices for some councils here).

Two things strike me about this latest DWP note.

a)  The Department is only asking councils to 'review' things and is NOT shouting 'Switch off your devices now!' – suggesting a softening of stance, and

b) It implies there are councils out there currently unaware of the Windows Mobile 'issue' – and who therefore may be in for an very unpleasant surprise,  given this news comes just two months before the deadline for all councils to be GC-compliant.

The wider ramification, not to be forgetten in all this,  is that the only 'approved' alternative to Windows Mobile available to government users in this scenario is the BlackBerry.  So has the Government (or rather CESG) helpfully handed RIM a public sector monopoly on a plate?

Latest article for Public Sector Forums:

Councils are being forced to turn off devices or meet the cost of purchasing and installing new IT equipment used for mobile working because they breach Government Connect's security standards.

A significant number of local authorities are finding current systems for running a mobile workforce aren't compliant with requirements set out in GC's mandatory Code of Connection.

The saga centres around a memo issued by CESG - the Government's IT security authority - which has ruled Microsoft's Windows  Mobile operating system (used in most PDAs and smartphones other than Blackberry) isn't approved for handling Restricted data at level 'IL3' .  Which stands for 'Impact Level 3', namely where disclosure could cause an individual 'substantial harm' - e.g.  the DWP's CIS master tax and benefits database.   According to CESG, tests had shown the risks of using Windows Mobile were 'too great'.

A security bulletin last year stated:

'After a thorough investigation... CESG has determined that the Windows Mobile 6.1 Operating System is not suitable to access, store or process RESTRICTED (IL3) data. For clarity, all earlier version of Windows Mobile are also unsuitable.'

The bulletin added:

'CESG has explored a number of potential mitigations to the issues, but has not been able to reduce overall risk to a level that it considers acceptable. Microsoft has been made aware of these concerns and is working to address them for future versions of the platform'.

The CoCo controls require all mobile working solutions and devices comply with guidance from CESG  alias 'Memo 35'.

Although it is understood a degree of uncertainty still exists over the interpretation of this, councils using Windows Mobile devices WON'T be allowed to connect their mobile devices to the Government Connect's GCSX secure network, which could mean previous gains made from mobile working will be undone.

Arguably then, a situation has arisen where a system - which at present offers councils limited value and likely to take years to deliver a Return on Investment (GC/GCSx) - is stopping those at the coal-face working efficiently and reaping the very real and substantial benefits of going mobile.

Whilst however this may be bad news on the one hand, it may well be for the best in the longer term.

In the words of one IT Manager whose council has 'fallen foul' of the CESG ruling (which is one way of looking at it) the matter seems to him a 'no-brainer'. He told us:

'When we submitted our CoCo Compliance document we described which devices we were using which platform, only to get a response from Government Connect saying something along the lines of 'not now you're not' and explaining the CESG decree.  In actual fact CESG are right.  Windows 6.1 isn't secure and Microsoft themselves admit this.'

He went on:

'We're therefore having to replace existing equipment with a Blackberry Enterprise Server that sits in front of the GCSx mail server and replace all existing handsets with Blackberries.  This is obviously financially painful which is the bad news.  It can't be denied though CESG's logic is sound.'

With 255 Councils now through their CoCo compliance evaluation and the remainder expected to have done so by the time GC closes down in September (see our story of last week) things look pretty bleak for Microsoft on the mobile front where councils are concerned.  As one pundit explained: 'It's very simple. Both Microsoft and RIM (the company behind Blackberry) had three years to ensure they would meet security standards for Government Connect; RIM made sure they did and Microsoft didn't bother. It's too late for them now, they've missed the boat.'

Feedback on this one would be appreciated.  Has your council found itself having to pick Blackberries and dump Windows 6.1? What do you make of the situation?

Responses please to ian@publicsectorforums.co.uk