Latest article for Public Sector Forums:

Councils are being forced to turn off devices or meet the cost of purchasing and installing new IT equipment used for mobile working because they breach Government Connect's security standards.

A significant number of local authorities are finding current systems for running a mobile workforce aren't compliant with requirements set out in GC's mandatory Code of Connection.

The saga centres around a memo issued by CESG - the Government's IT security authority - which has ruled Microsoft's Windows  Mobile operating system (used in most PDAs and smartphones other than Blackberry) isn't approved for handling Restricted data at level 'IL3' .  Which stands for 'Impact Level 3', namely where disclosure could cause an individual 'substantial harm' - e.g.  the DWP's CIS master tax and benefits database.   According to CESG, tests had shown the risks of using Windows Mobile were 'too great'.

A security bulletin last year stated:

'After a thorough investigation... CESG has determined that the Windows Mobile 6.1 Operating System is not suitable to access, store or process RESTRICTED (IL3) data. For clarity, all earlier version of Windows Mobile are also unsuitable.'

The bulletin added:

'CESG has explored a number of potential mitigations to the issues, but has not been able to reduce overall risk to a level that it considers acceptable. Microsoft has been made aware of these concerns and is working to address them for future versions of the platform'.

The CoCo controls require all mobile working solutions and devices comply with guidance from CESG  alias 'Memo 35'.

Although it is understood a degree of uncertainty still exists over the interpretation of this, councils using Windows Mobile devices WON'T be allowed to connect their mobile devices to the Government Connect's GCSX secure network, which could mean previous gains made from mobile working will be undone.

Arguably then, a situation has arisen where a system - which at present offers councils limited value and likely to take years to deliver a Return on Investment (GC/GCSx) - is stopping those at the coal-face working efficiently and reaping the very real and substantial benefits of going mobile.

Whilst however this may be bad news on the one hand, it may well be for the best in the longer term.

In the words of one IT Manager whose council has 'fallen foul' of the CESG ruling (which is one way of looking at it) the matter seems to him a 'no-brainer'. He told us:

'When we submitted our CoCo Compliance document we described which devices we were using which platform, only to get a response from Government Connect saying something along the lines of 'not now you're not' and explaining the CESG decree.  In actual fact CESG are right.  Windows 6.1 isn't secure and Microsoft themselves admit this.'

He went on:

'We're therefore having to replace existing equipment with a Blackberry Enterprise Server that sits in front of the GCSx mail server and replace all existing handsets with Blackberries.  This is obviously financially painful which is the bad news.  It can't be denied though CESG's logic is sound.'

With 255 Councils now through their CoCo compliance evaluation and the remainder expected to have done so by the time GC closes down in September (see our story of last week) things look pretty bleak for Microsoft on the mobile front where councils are concerned.  As one pundit explained: 'It's very simple. Both Microsoft and RIM (the company behind Blackberry) had three years to ensure they would meet security standards for Government Connect; RIM made sure they did and Microsoft didn't bother. It's too late for them now, they've missed the boat.'

Feedback on this one would be appreciated.  Has your council found itself having to pick Blackberries and dump Windows 6.1? What do you make of the situation?

Responses please to ian@publicsectorforums.co.uk