The guardian

The guardian

Moving to technology-based information systems requires robust platforms. The challenges of maintaining data security are endless, says CYF’s chief information officer.

Although Allan Sainsbury’s three adult children have left home, he is far from free of responsibility. As chief information officer for the Department of Child, Youth and Family (CYF), Sainsbury and his 45-person IT team feel the pressure of ensuring the data in CYF systems is secure, well-maintained and has integrity.

You might say Sainsbury is committed to the wellbeing of more than 900,000 New Zealand children under the age of 17. “It doesn’t matter that we’re working in IT, when you become part of an organisation like this, you sign on to its values. That means believing in what CYF is doing,” says Sainsbury.

He says CYF IT systems must have the capacity to deliver information to its workers in a timely and robust way. Working within IT does not insulate CYF IT employees from the importance of what CYF is there to do.

Child, Youth and Family is the government agency with legal powers (granted through the Children, Young Persons and Their Families Act, 1989; the Adoption Act, 1955; the Adult Adoption Act, 1985; the Adoption Inter-country Act, 1997; and the Guardianship Act 1968) to intervene in domestic situations to protect children who are being abused or neglected or who may have behavioural problems.

The department works in conjunction with central agencies including justice, police, education and courts. It also assesses people wanting to adopt children and provides residential and care services for children.

The integrity of the IT systems CYF uses to gather and maintain the confidential data it collects is critical to the department’s performance. CYF currently receives between 34,000 and 35,000 case notifications per year from social workers and agents.

To facilitate its work, highly secure system access is required for 2250 head office and remote CYF staff across 60 sites around New Zealand. Added to that is the call centre system, which fields around 3000 calls each month through a national centre in Auckland and free phone lines running off a TelstraClear backbone.

Key challenges

CYF has high-quality data contained in its case management systems, and Sainsbury says the challenges of maintaining security and integrity and providing critical access for CYF’s 1800 distributed workers are endless.

“People don’t realise the volume of calls we handle or how many staff we have in the field. If you move a department like CYF from manual to technology-based information systems, then you must provide a robust platform.”

He says a key challenge is the requirement to deliver application access and IT services to remote sites.

“Remote staff need the same quality of access to CYF information as someone on the central network does – sometimes more so, because they’re in the field.”

However, while Sainsbury says reliable telecommunications are crucial to CYF needs, sending documents, graphic images and files over standard 56Kbit/s dial-up connections to remote CYF staff has become a problem.

“Our dial-up users interact with a client server application, so multiple protocols go back and forth, causing connectivity issues.”

Sainsbury is looking at both virtual private networks and voice over IP (VoIP) options. He says CYF already uses some of the latter. CYF has also joined forces with the Ministry of Social Development VoIP project to investigate how VoIP technology can be shared and call centre technology better used [see “Voice for free?” MIS March 2002].

The department is also evaluating GPRS (general packet radio service) and wireless systems to help sort out its remote access issues. “We’re looking at a fully encrypted wireless service and the practical aspects of covering our security and encryption needs. If it comes together, it will perform far better than dial-up.”

CYF caseworkers presently don’t require 24x7 access to core applications, but Sainsbury says the department will soon move to this type of extended service.

Heightened service

The core application CYF staff want to access is called Children Youth Residences Adoptions Services, creating an acronym with a certain Dickensian quality: ‘CYRAS’.

A Java-based case management application, CYRAS runs across an Oracle database. It was implemented to remove CYF’s reliance on the ageing SWIS social services application first implemented in the late 1980s.

Sainsbury describes SWIS as “an indexing and case note capture system for individual information”, rather than a full case management system working across families.

“We needed CYRAS, a full case management system, so we could provide CYF staff with a single record of services provided to an individual child or family. This also supports the department’s change of focus to family-based care.”

Initial planning for CYRAS occurred through 1997, with final development and deployment completed during 1999 and 2000. Sainsbury says CYRAS implementation was run as a business project outside of the CYF technology department and contracted out to Accenture through defined requirements.

It was eventually commissioned in November of 2000 and, because it was too complex to allow for pilots, was implemented following proof of concept. “We had initial teething problems, you always do. Despite the best scoping and workshopping in the world, IT systems will always need refinement. Our issues weren’t major, but there were some changes we made to better align CYRAS to CYF’s service needs,” says Sainsbury.

He says CYRAS has since delivered a heightened quality of service and more timely information to CYF staff and was a major thrust towards CYF owning something ‘high-tech’. Other business critical applications include financial, contract and human resource systems.

Sainsbury says merging SWIS with CYRAS was undertaken carefully.

“With outsourced help, we spent a considerable amount of effort ensuring the data maintained a high level of integrity.”

Keeping security close

Integrity is a word Sainsbury uses often. Despite his relaxed persona, he is well aware CYRAS contains constantly updated information about children at risk and confidential information about their families and situations. So, how secure is it from external and internal security breaches?

Sainsbury says CYF staff members are given very limited access to CYRAS. “It’s easy to know what you want to do and how you want to do it with an IT application, but security is mandatory with the type of personal information contained in CYRAS.”

While he cannot give away exact security measures, Sainsbury says CYRAS, along with other systems, is protected by a token-based security system with access dependent on role.

“It’s a tight framework. You have to be an approved user and who you are defines what you can see – whether you’re trying to access CYRAS through a dial-up connection or over the internal network.”

He says CYF does not outsource security. “That’s important. And it’s why being part of a big organisation can be useful.”

Deciding what information to place into CYRAS in the first place is also an important consideration. For example, how does CYF draw the line between essential data gathering and the demands of personal privacy and the Privacy Act?

Sainsbury says while the Privacy Act is absolute, the information CYF gathers about New Zealand children and their families is determined by acts of government applying specifically to CYF.

“Our governing act, Children, Young Persons and their Families Act 1989, applies, but we can’t breach other acts. We only have the right to hold information as is appropriate to individual or family case management.”

He says internal access to CYRAS information is only permitted at a case level, and the IT team monitors network logs to see which users are taking what actions and where.

He points out it is difficult to commit an offence against the Privacy Act if people are not able to access private information in the first place.

“Internally, we have role-based security and log in. It’s quite essential. And internal employees that do have access are covered by a strict code of conduct.”

Strategy and standard architecture

CYF IT strategies and planning are referenced against the Department’s ‘New Directions’ policies, formed following a 2001 directional analysis, undertaken by CYF in response to a number of independent reviews and reports. Among these was the Department’s own capability assessment.

The findings revealed Child Youth and Family had become a standalone, isolated agency, fragmented in its delivery of services. Specifically, connections between contracting and service delivery were not considered sufficient and the department was shown to be too focused on compliance and process rather than outcome.

The assessment revealed a need to join up authority and accountability as close to the service delivery point as possible, and to provide a proactive rather than reactive service and management approach.

Among the conclusions was a commitment to join and build alliances with communities to achieve better outcomes and to become strength-based, client-centred, and take a regional approach to delivery.

CYF’s IT strategic plan is therefore tied in with these goals.

“The strategic IT plan works as an enabler for CYF’s business plans and business drivers,” confirms Sainsbury.

He says government legislation impacts upon CYF’s IT operations and strategy in the same way as it does on all government departments.

Specifically, the Privacy and Official Information Acts have considerable impact, as case study information has to be stored and available over set periods of time. “We must be disaster recovery (DR)-capable. And we are – our DR system is based on core architecture and back-up sites, as well as contractual obligations for restoration.”

He says CYF outsources some DR functions. Datacom runs a full back-up of systems every 24 hours and tests it quarterly.

“Disaster recovery measures must tie into business requirements and what the business is willing to live with. The business must decide how much DR capability it is prepared to pay for.”

In other words, a need exists for balance between disruption to workflow and a business continuity plan, for when systems go down. “We have to give our people the answers to questions like ‘How do I get that information back into the system when it comes back up?’ We do practise scenarios.”

CYF is also involved with the government’s e-business thrust, including e-procurement portal GoProcure. “We’re a government department, so we’re part of e-government. An agency like CYF participates in a number of inter-sector e-government initiatives,” says Sainsbury.

He says CYF is presently working with central government on its portal and metadata and is preparing itself for e-procurement. “When we upgrade any IT systems, we like to ensure we’re fully compliant.”

Sainsbury says CYF is very close to developing standard architectures for IT infrastructure, and has this under review. “We’re looking at all the options available to us. But, these days, you also have to consider the cost of supporting a standard architecture and its total cost of ownership.”

For example, he says an organisation can decide it needs a number of applications or offerings, but may then find the total cost of ownership (TCO) makes it too prohibitive to proceed.

“TCO can blow you out of the water. I don’t think there should necessarily be a sole architecture for any one organisation; a mix is sometimes more pragmatic.”

Whichever IT paths it selects, Sainsbury is passionate about the potential of CYF systems.

“We’ve got good projects and opportunities in the pipeline, and we own a fantastic network. We have capacity and a backbone most IT organisations would die for.”

Sainsbury has IT in his blood

CYF will undoubtedly be anxious to hold onto someone with Allan Sainsbury’s IT and business experience. He began his working life in the retail division of Mobil Oil before landing a job with its early technology group, thus launching himself into the world of IT management.

“There were 80 286 IBM XT computers at Mobil Oil in those days. If you were really lucky you got 64 megabytes of RAM and training on Lotus 1-2-3.”

He has been with CYF for two-and-a-half years, and was previously IT strategy manager for Land Information New Zealand, a position he held for more than two years.

Two of his three children have entered the IT industry: The eldest as a London-based systems engineer and the next born, Paul, as a database administrator for Statistics New Zealand. While third son Glenn is manager of a Wellington theatre complex, a passion for IT obviously runs in the family: Sainsbury’s wife works on an IT help desk.

Despite being nearer to retirement age than the average IT director (he sold his fishing boat to buy his first Radio Shack TRS80 computer in 1981), he doesn’t look as though he will be indulging in his hobbies full-time anytime soon.

He describes himself as being in excellent health with a passion for travel, fishing and family and says he still loves IT. “I’m closer to the dinosaurs in age than some, but I definitely still run the best flight simulator package at home.”

Sainsbury advises IT bosses who are sick of the IT industry to get out it, regardless of their age. “You have to like it and, personally, I think the opportunities today are wonderful. CIOs are only limited by their imaginations.” He says he enjoyed being involved at the beginning of the technological enablement of companies in New Zealand and that it was fun teaching people to use their first spreadsheet ever.

“But at the same time I wish I was starting just now. There are phenomenal opportunities out there.”

When he’s not busy helping maintain the data integrity of CYF systems, Sainsbury helps little old ladies cross the internet superhighway.

“I voluntarily train senior citizens to use the internet and sometimes build up old PCs for them. My great victory was a 71-year old lady who had never used a computer in her life. She rang me in the middle of a meeting one day to say she’d gotten into genealogy and email but got stuck on a virtual tour of the Louvre in Paris. That’s because she was using a Pentium 100 with 32 megabytes of RAM.”

Otago-born, Sainsbury says his sporting allegiances to the capital city are complicated: “The biggest conflict in my life is when the Highlanders are playing the Hurricanes.”

Rate your challenges

When interviewing IT directors, MIS asks them to rate the challenges of managing a project. Here, CYF’s chief information officer, Allan Sainsbury, rates his general project management challenges.

Most challenging

Strategy and planning

Keeping projects on time and on budget

Getting support of board and CEO

Getting support of other company stakeholders (including users)

Managing emergencies

Finding and motivating the right staff

Managing vendors

Selecting vendors

Least challenging

Join the CIO New Zealand group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Show Comments