Thirty-Sixth Report - The Defence digital strategy

Despite the urgency and ambition of its digital strategy, the Department does not yet have a delivery plan to measure and track progress. The Department’s digital strategy sets out how it wants to share and exploit data effectively for information advantage and develop a skilled and empowered digital function by 2025. It will be difficult for the Department to achieve this given the scale of activity across more than 90 digital projects in its portfolio, its large legacy IT estate, and wide- ranging specialist skills shortages. The National Audit Office (NAO) report that the Department’s digital strategy is consistent with good practice, but that it lacks a complete delivery plan to measure its progress. Although the Department has plans in place for individual projects, it accepts that it needs to bring these plans together to show how they add up to the outcomes the Department wants. The Department is now working on a delivery plan that does this, which it intends to publish in April

The Department faces a considerable challenge to recruit the specialist digital skills that its strategy relies on. We have reported previously on the shortage of specialist digital skills in the marketplace and how many government departments are struggling to overcome this long-standing challenge. Indeed, the Department identifies getting the right skills as a key factor in whether it will succeed or fail to achieve its goals by 2025. The skills it needs are wide-ranging and include data analysis, cyber advisory, artificial intelligence, service manager and project delivery skills. The Department’s challenges include the limited pool of specialist skills in Corsham (where it bases its work on digital), its ability to compete in the market on pay, and 6 The Defence digital strategy waiting times of over 200 days on average for developed vetting security clearance. In response, the Department is trying to change how it recruits by rebranding itself as an innovative place to work with internal training opportunities, and by working differently with big technology companies and small and medium-size enterprises. The Department is positive about the impact this seems to be having and over the last 18 months reports meeting its target of recruiting 150 specialists. However, it wants to double this number next year, an objective that will be difficult to achieve. Recommendation: In its update to us in six months, the Department should also set out how it has changed its approach to recruitment and what quantified effect this has had.

The Department is struggling to deliver its largest, most transformational digital programmes. The Infrastructure and Projects Authority’s (IPA’s) most recent public reporting from March 2022 shows three of the Department’s major digital programmes have significant issues (‘amber’) and two are unachievable (‘red’). These are the Department’s most complex and transformational digital programmes, which it needs to get right if its strategy is to succeed. The Department accepts its performance up to now is worrying and that it needs to up-skill staff and think differently about processes and risk. In particular, the Department wants a more diverse mix of experience in its digital project delivery teams. By bringing in different skills and ways of thinking from industry, it hopes to become more confident at working in agile ways more appropriate to developing software. Although the Department recently intervened to pause its now red-rated Next Generation Core Networks programme, it still needs to get quicker at stopping and improving failing digital programmes. The Department has made some progress on the basics such as rolling out laptops and video conferencing in response to COVID-19. However, we are concerned by the continued lack of improvement in IPA assessments of the Department’s major digital programmes. Recommendations: • a) In its update to us in six months, the Department should also explain the actions it has taken to improve its performance in delivering major digital programmes. • b) When the Infrastructure and Projects Authority publishes its Annual Report in 2023, the Department should provide us with the latest delivery confidence ratings for its digital major programmes and explain how and why they have changed.

The Department’s budget is under considerable pressure, and this may make some planned, future digital activity unaffordable. As inflation rises, the purchasing power of the Department’s existing budget falls. The Department is starting to see pressure build on its pay settlements and in the cost of raw materials, meaning it may be hard to deliver its digital strategy as originally planned. The Department’s longer-term funding position will only become clearer following the refresh of the Integrated Review in 2023. In addition to its military importance, the Department is also turning to digital technology to deliver administrative efficiencies. The Department’s target is to make £1.4 billion of cash savings from digital technology The Defence digital strategy 7 by 2032–33 and it is confident it will achieve this. However, the Department says it will no longer compromise on the funding programmes needed to keep systems updated over their lifetimes, to ensure that the issues it faces with its current legacy estate do not reoccur. It will take time and commitment for this, and existing efforts to upgrade existing legacy systems and data, to make a difference. The Department says that because digital transformation is a top priority that it will try to protect funding for its digital portfolio. However, it will need to stick to this approach for many years in what is likely to be a challenging budgetary position. Recommendation: Following the next update to the Integrated Review, the Department should write to us explaining whether planned and actual spend on digital has changed and whether it has enough funding to deliver the strategy.

The Department is not yet able to share and exploit data across the Armed Forces and with partners effectively enough. Recent events including the COVID-19 pandemic and the war in Ukraine show the importance of responding in a nationally and internationally integrated way. As the character of warfare changes, the Department needs to better integrate its operations and increase its partnering with other government departments, industry, academia and international allies. This was starkly illustrated by the Chief Information Officer admitting digital technology could be a limiting factor in the optional operation of Ajax and Morpheus. How the Department will update its digital systems fast enough so that the operational capacity of any pieces of equipment will not be hampered by the lack of digital systems remains unclear. It is making progress toward this by building a common architecture and set of rules that the whole Department must follow. This could support working more closely with partners and sharing data securely, including at higher security classifications. However, the Department has not yet catalogued all its data and adoption of these common standards is at an early stage. The Department also must work in hostile environments including, for example, at sea with limited connectivity, or where adversaries may be trying to undermine its security or effectiveness. The Department estimates that currently 80% of its effort is on the fundamental technology, people and processes it needs to share data effectively. By 2025, the Department wants 80% of its effort to be on exploiting this data for benefit. For example, the Department is starting to gather data on equipment and people automatically for military planners to better assess its readiness to respond. Recommendation: The Department should set out in its April 2023 update to the digital strategy, how it will measure its progress in creating the ‘backbone’ and track its balance of effort between data enabl

On the basis of a report by the Comptroller and Auditor General, we took evidence from the Ministry of Defence (the Department) about the Defence digital strategy. The rapid advance of technology is changing the character of warfare, introducing a shifting and accelerating landscape of threats. The rapid deployment and exploitation of new technology is now at the very heart of the defence of the realm, and the urgency of this challenge is demonstrated by the current conflict in Ukraine.1

In its report, the NAO draws attention to the slow progress wider government and the Department have made with previous digital strategies.13 We wanted to know why the Department thinks its most recent strategy will succeed, given that it has been so difficult in the past. The Department reflected that it is now starting to understand how digital technology can affect its ability to win, and that this means it has become an agenda for the whole of Defence. The Department explained that, for the first time, it is tackling the challenge with the support and commitment of all its senior leadership.14 Nonetheless, it recognised that transforming the Department in the way it wants will require significant cultural change.15 The Department also said that its senior leadership team are meeting regularly to discuss priorities for the digital transformation of Defence, as part of a programme of work called ‘digital exploitation for Defence’ to help elevate the status of digital for Defence.16 We asked how the Department intends to work across all its technology and data, when the chief information officer (CIO) only controls £2.7 billion of its £4.4 billion spend on digital. The Department told us that Defence Digital’s finance director will soon have visibility of all significant digital business cases or investment decisions made across 16 Defence organisations. It hopes this will help de-duplicate and better coordinate its digital investments.17 Measuring progress

In its digital strategy, the Department sets itself three strategic outcomes to achieve. By 2025 it wants to share data seamlessly, use it effectively to gain advantage, and develop a 7 C&AG’s Report, para 2 8 Q 13 9 Ministry of Defence, digital strategy for Defence: Delivering the backbone and unleashing the power of Defence’s data, April 2021 10 Q 52 11 Q 66–69 12 Qq 12–13, 66–68; TDS0004 13 C&AG’s Report, para 1.13 14 Qq 57–60 15 Q 52 16 Q 60 17 Qq 19–20 10 The Defence digital strategy skilled and empowered cadre of digital specialists.18 The NAO reported that achieving this by 2025 is ambitious, given the scale of the challenge and persistent barriers to change. We got a sense of this scale as we discussed the Department’s portfolio of over 90 projects and major programmes, its large legacy IT estate, and wide-ranging specialist skills shortages. Therefore, we asked the Department if it will successfully achieve its strategy by 2025. The Department told us that it hopes it will be successful, but it may take longer if it cannot recruit the skilled people it needs.19

The NAO reported that the Department’s strategy is consistent with good practice across government. For example, its strategy recognises data as a strategic asset and that people and processes are as important as technology to successful digital change.20 However, the NAO also found that the Department lacks a complete picture of its progress against its strategy and recommended that the Department immediately create a clear delivery plan for the strategy. We asked the Department how it intends to measure its progress.21 The Department explained that it has plans and reporting in place for its individual projects, but agreed with the NAO’s recommendation, saying that it needs a single plan against which it can measure progress. The Department told us it wants to design a plan that will give clear outcome metrics the Department can measure against, to demonstrate internally and to us that it has improved.22 We wanted to know how the Department intends to provide transparency for Parliament and the public, so that we can assess the Department’s performance towards the ambitious targets it has set itself for

We have reported previously that there is a large gap between the demand and supply of the digital specialists that government needs.24 We found that government is yet to make meaningful progress overcoming this long-standing challenge, which often leaves it reliant on contractors.25 We pressed the Department on this point and they concurred that the availability of technology skills continues to be a problem for the whole UK economy. We heard from the Department that its current digital workforce is a mixture of civilian, contractor, and military personnel and that it draws on a range of commercial and academic partners to supplement this.26 The Department also has the ability to draw on reservists, some of whom are digital specialists in civilian life and can provide those skills on a part-time basis.27 In its digital strategy, the Department notes that it has “fallen behind in accessing the specialist skills we need”.28 The Department identified that getting the further specialist skills it needs is a key factor affecting its likelihood of success in achieving the strategy’s goals by 2025.29 It told us these skills will include: architects; business analysts; cyber advisory risk specialists; data analysts; developers; delivery managers; infrastructure engineers; IT service managers; data science; experts in AI, robotics and cyber-security; and product managers.30

However, the National Audit Office reported that the Department finds it difficult to recruit and retain digital specialist talent.31 We were interested in what is stopping the Department from getting the skills it needs; for example, its ability to pay the market rate for digital specialists. The Department acknowledged that it does not expect to compete with the private sector on pay. However, the Department said it is starting to extend government’s common digital pay framework across the whole of Defence to help remove internal competition across the Department.32 We noted that around 60% of the Department’s digital jobs are based in Corsham and the Department acknowledged that it had “saturated the Corsham catchment area”, but felt it would be a big challenge over many years to move all its staff from there. The Department explained that it is looking to partner with other departments at different locations in the UK and is doing more remote and flexible working.33 The Department also suffers from lengthy security clearance waiting times, which on average are currently over 200 days for developed vetting clearances, 24 Committee of Public Accounts, Challenges in implementing digital change, Thirtieth Report of Session 2021–22, HC 637, 10 December 2021 25 Committee of Public Accounts, Challenges in implementing digital change, Thirtieth Report of Session 2021–22, HC 637, 10 December 2021 26 Q 14 27 Qq 34, 79–82 28 Ministry of Defence, digital strategy for Defence: Delivering the backbone and unleashing the power of Defence’s data, April 2021 29 Qq 24, 61 30 Q 76 31 C&AG’s Report, para 21 32 Qq 25–27 33 Qq 87–88 12 The Defence digital strategy making the on-boarding progress take too long in a competitive labour market. Although the Department agreed this is not good enough, it explained that it is working with the Cabinet Office, which is responsible for vetting services, to improve this.34

We asked how the Department intends to perform better than the market, which it needs to do if it is to overcome the lack of supply of digital specialists. The Department told us that it has focused heavily on its brand and giving people access to interesting and innovative areas of work to develop their skills.35 It found that emphasising this in its job adverts increased the number of applicants, in one case by up to 20 times.36 We were keen to understand how the number of applicants is changing. The Department’s written response stated the average number of applicants for Defence Digital roles increased from 3.6 in August 2022 to 6.1 in November 2022.37 As well as rebranding itself, the Department told us it must work in a very different way with UK industry. This would increasingly include working with both larger-scale high-tech organisations, and small and medium- sized entities (SMEs), which currently find it too expensive to work with the Department.38 The Department reported that it met its target to recruit 150 digital specialists over the last 18 months, but that it needs to recruit 300 more in the next 18 months.39 Performance delivering major digital programmes

One area where these resourcing challenges have become apparent is in Defence Digital’s track record of delivering major digital programmes. These are the Department’s most complex and transformational programmes, many of which are needed to replace older legacy systems, and which it needs to get right if its strategy is to succeed.40 However, the Infrastructure and Project Authority’s (IPA’s) most recent reporting from March 2022 showed that, of the five programmes which report publicly, three of the Department’s major programmes have significant issues (‘amber’) and two are unachievable (‘red’).41

The NAO report identified that Defence Digital’s project delivery has suffered from a lack of skilled and experienced personnel, immature project controls, and a culture focused on the approvals process rather than outcomes.42 The Department accepted that its performance up to now is worrying and that it needs to up-skill staff and think differently about processes and risk.43 In particular, the Department said that it wants a more diverse mix of experience in its digital project delivery teams. It hopes that by bringing in different skills and ways of thinking from industry, it can become more confident at working in agile ways that are more appropriate to developing software, as opposed to conventional defence items.44 BAE Systems, in its written evidence, argued that it is quicker and easier to iterate five versions of a digital product or service than it is 34 Qq 89–90; C&AG’s Report, paras 3.13–3.14 35 Qq 16, 86 36 Q 16 37 Qq 30–33; Letter from Laurence Lee CMG to PAC Chair Dame Meg Hillier, 18 November 2022 38 Q 16 39 Q 78 40 C&AG’s Report, para 17 41 Q 15; C&AG’s Report, para 18 42 C&AG’s Report, para 17 43 Qq 15, 70–71 44 Q 70 The Defence digital strategy 13 to be perfect first time.45 The Department also told us it is trying to think differently about management information and reporting, as well as wider peer challenge and review across its project delivery portfolio to make better use of the specialists it has.46

Nonetheless, we challenged the Department on its need to get better at stopping and improving failing digital programmes.47 The Department stated it had recently paused its core networks programme to make changes to its design before going out to the market.48 They also paused specific software components of the Morpheus programme (itself a sub- component of the Land Environment Tactical Communications and Information Systems (LE TacCIS) programme) as they did not believe these were being delivered appropriately.49 However, they stated that while there have been problems with one component part of Morpheus, they would still deliver continuous capability upgrades through this programme, and the over-arching LE TacCIS programme, over time.50

Similarly, the Department pointed out that where some programmes were rated red, there were elements of good progress on sub-programmes within them. While the IPA rated the Department’s MODNet Evolve programme red, the Department told us that 16 of its sub-programmes were either delivered or on track, with three remaining elements due to conclude over the next 18 months.51 It hopes to move the programme’s rating to amber in 2023.52 It also told us that the red-rated New Style of IT Base programme was responsible for the rollout of new IT during the Covid-19 pandemic, having now delivered 180,000 laptops across Defence, as well as collaboration tools for remote working and video conferencing.53 However, these are relatively basic IT items, and the technology the Department is ordering is becoming increasingly sophisticated.54

The Integrated Review, has, at its heart, much greater digital connectivity between military platforms, in order to achieve a significant force-multiplier effect, even with, in some cases, notably fewer units of increasingly high-tech equipment. For the Army, the much-delayed Morpheus programme is the ‘digital nervous system’ which is intended to allow its future (and upgraded) armoured vehicles and related platforms to communicate effectively, on a potentially high-intensity electronic, as well as physical, battlefield. The existing Bowman system is now growing old and may, in a few years be rendered insecure by advances in offensive cyber/cryptographic technology. The Committee was disappointed about the lack of progress on this highly expensive and vital component of the Defence Digital portfolio. The faltering Morpheus programme must now be ‘gripped’ and put firmly back on track, as a matter of urgency. 45 TDS0004 46 Q 71 47 Qq 70–71 48 Qq 22, 72–74 49 Q 75 50 Q 4 51 Q 71 52 Q 97 53 Qq 50, 71 54 Q 95 14 The Defence digital strategy 3 Funding and data Sustainability of funding

The NAO reported that the Department’s digital strategy was initially not fully funded, but the Department worked to identify ways to fund the strategy as well as reprioritise money to ensure that, as of its last budgeting cycle, it considered its strategy affordable.55 We put it to the Department that the impact of rising inflation means it can afford less with its existing budget. The Department explained that it was seeing cost pressures on pay settlements and raw materials both internally and in industry. As a result, it will be difficult to do all of its planned activity for the next financial year in full.56 However, the Department felt the longer-term trend for its spending will depend on the outcome of the refreshed Integrated Review in 2023.57 Given the severe pressure we feel the Department’s budget is under, we expressed concern that the money it has committed to digital might be subject to change.The Department reassured us that it can live within its means for the remainder of the current financial year and highlighted that digital transformation is the single top priority for senior leadership, who will want to protect the funding for it.58

The Department told us government sees digital technology as a way it can make services more affordable and that the Integrated Review in 2023 will inevitably focus on this.59 The Department hopes to use digital technology to transform how it runs itself and the Armed Forces, and has already assumed in its planning that it will achieve productivity improvements and cash savings.60 The NAO reported that the Department’s plans include a target to find £1.4 billion of cash from efficiency savings between 2023–24 and 2032–33, including £695 million from better supplier management. The Department appears to be on-track with this so far, but still needs to find £160 million more to meet its target.61 We asked the Department if it was realistic to find this much money through efficiency savings, such as those from better supplier management. The Department was confident that it will achieve its target because there are still economy of scale savings it can make. This is because it has not previously managed suppliers in a coordinated way and so it can increase its commercial leverage, and reduce prices, for example by buying software licences once for the whole Department.62

The Department has a substantial legacy technology estate, in part because it has not prioritised the investment needed to keep it up to date.63 Defence Digital, the organisation responsible for leading on the digital strategy, estimates it will cost £11.7 billion over 10 years to remediate just its own legacy systems.64 We asked the Department whether it was more cost effective to fix its legacy systems gradually, or simply to start afresh with a different approach. The Department explained that from now on it will ensure its programmes set aside money to keep systems up to date for life and comply with the rules of its future architecture. The Department said it is taking a risk-based approach to 55 Q 23; C&AG’s Report para 19 56 Q 11 57 Q 10 58 Q 23 59 Q 43 60 Q 67 61 Q 93; C&AG’s Report, paras 3.5–3.6 62 Qq 93–94; C&AG’s Report, para 3.6 63 Q 45 64 Q 47; C&AG’s Report, para 11 The Defence digital strategy 15 upgrading the legacy systems it already has and considers factors such as vulnerability to cyber-attack and the value of the data. However, the Department told us it will take time for this approach to result in a healthier, more current technology estate.65 Using data for advantage

The Department noted that one important challenge in the war in Ukraine is that not all of the various donated western equipment systems can be easily connected or exchange data. The Department told us that integrating different systems in different locations, quickly enough to keep up with the pace of technological innovation, is a challenge that all militaries now face.66 The Department also has to consider that adversaries may be looking to undermine its security or effectiveness, and that using digital technology reliably in a hostile environment brings its own challenges. For example, ships at sea may be regularly disconnected from support systems, delaying updates.67 The Department itself increasingly aims to join up military operations across land, air, sea, space and cyber, as well as work more closely with the rest of government, academia, industry and international partners.68 To do this, the Department describes in its digital strategy how it needs to share data through digital systems that connect to one another securely and easily.69

The Department is working toward this by developing common standards, technology architecture and ways of working. The NAO reported that the Department has set up its governance and controls well, but ensuring compliance with these common standards and approaches across the Department is a substantial task and at an early stage.70 The Department told us it is pleased with the progress it is making and that a network of chief information officers, working to common standards, should have the effect it wants across the devolved model of Defence.71 The Department estimated that currently around 80% of its effort goes on these basic enablers that it needs to put in place.72 For example, the Department told us it is now cataloguing all its data and who is steward of that data.73 By 2025, the Department wants to have fixed these ‘enablers’, so that it can instead put 80% of its effort into using the data for advantage.74 We asked the Department for an example of what this meant. The Department spoke about its ‘R2D2’ programme, which aims to bring datasets together so that military planners can understand the readiness of the Armed Forces at the push of a button.75

We asked the Department what it was doing to work more closely domestically and with international partners, such as NATO.76 The Department is creating shared architectures to help it work more closely and share data securely with other parts of government, including at higher security classifications, and explained that the COVID-19 pandemic 65 Qq 45–46 66 Q 12 67 Qq 95–96; C&AG’s Report, para 12; TDS0004 68 C&AG’s Report, para 10 69 Ministry of Defence, digital strategy for Defence: Delivering the backbone and unleashing the power of Defence’s data, April 2021 70 C&AG’s Report, para 15 71 Q 20 72 Q 18 73 Q 52 74 Q 18 75 Qq 53–55 76 Qq 34–44 16 The Defence digital strategy sped up the use of collaboration software.77 We wanted to know what discussions the Ministry of Defence has with other departments about using digital technology to work more closely, and if it has thought about where this might be most important, such as in crisis response.78 The Department felt that the technology to respond in a coordinated way to a domestic crisis exists now, but policy and seniors across government need to come together to solve those problems.79 The Department pointed to how it is taking part in the Cabinet Office’s central digital strategy and its digital and data board, which is bringing government together.80 Internationally, the Department told us it wants to take part in emerging conversations within NATO about data interoperability and common architectures.81 77 Q 34; Ministry of Defence, digital strategy for Defence: Delivering the backbone and unleashing the power of Defence’s data, April 2021 78 Qq 34–36, 41–43 79 Q 36 80 Q 42 81 Q 35 The Defence digital strategy 17