Since the referendum result in favour of leaving the European Union, BCS members have been in dialogue about the issues and opportunities that arise from this change in relationship between the UK and Europe. Much uncertainty remains, but there are a number of clear objectives for UK government, business, the IT profession and wider society to aim for. Most of the issues are not new, but are heightened, more urgent or modified as a result of this change of course.
We now have a choice; we could do what’s necessary to maintain the existing status quo, or we could seize this as an opportunity to make the much needed changes in our sector that would truly lead to the UK positioning itself as a digital world leader. Here we outline those opportunities available to the UK in this new Brexit context, underpinned by what should happen regardless within our sector that will ensure IT is good for society
Our primary conclusion is that the UK’s future success outside the EU will be underpinned by our choices on major digital issues.
The UK needs to make the right choices for a future that is:
1. Data-driven: we want to see the UK as an exemplar and innovator in a data age, with data protection equivalence with the EU as a minimum priority.
2. Digitally-capable: we want to see investment in our current and future workforce along with academia and research to match our ambitions. We also want to create a welcoming environment for the top global talent through the lowest possible barriers to working in the UK for practitioners and academics who meet professional standards in our sector disciplines.
3. Secure: we want to see cross-border cooperation on cyber security, together with a boost in UK participation in international standards development to ensure maximised UK capabilities and an integrated security strategy.
4. Connected: we want to see a world-leading infrastructure that matches our digital ambitions in every sector through strategic cooperation on communications, regulation and pricing beyond Brexit.
BCS is a charity, incorporated by Royal Charter, here to Make IT Good for Society, and a professional membership organisation. BCS is a politically-neutral organisation and home to members with diverse views and affiliations. The EU referendum result has set a new course for the UK. BCS is therefore eager to ensure that the right steps are taken to ensure that digital issues arising from exiting the EU are understood.
BCS has engaged in dialogue with members, consulted with stakeholders and revisited policy issues to capture the most important areas and develop a strategy after the Brexit vote. The majority of significant policy issues for the UK’s exit are still the subject of debate and speculation, so there is a great deal of uncertainty. Therefore, this dialogue must continue and these positions will continue to evolve. It is the aim of this report to give a snapshot of the situation and rather than simply react to events, to develop a picture of the choices the UK needs to make to meet its own aspirations in the digital arena.
A data-driven future
It is essential for the UK that data relationships between people, corporations and governments work for the common good. Data relationships underpin and increasingly define our citizenship as well as commerce and personal life. This is by its very nature a global issue and one where the UK has incredible opportunity to lead change, drive growth and support a fair society.
BCS wants to see:
· The UK becoming a leader and innovator in data protection. This sets data protection equivalence with EU regulations for the UK to be a minimum goal and high priority in Brexit negotiations.
· Members moving beyond a data protection compliance mind-set to seeing personal data relationships as a strategic opportunity.
· The UK investing in data frameworks that align social and commercial goals in order to become that innovator in data protection. A Royal Commission on personal data ecosystems would signal a major improvement in UK ambition as a leader in global data protection and exploitation.
The evidence of the importance of data to the UK is succinctly summed up by the House of Commons Science & Technology Select Committee report into big data:
A number of emerging technologies such as the ‘Internet of Things’ (the proposed development of the internet where everyday objects have network connectivity) are set to expand the availability and richness of data well beyond the vast amounts we have today. Data science, AI or cognitive computing will change what it is possible to detect, discover and infer from that data. The result is that the transformational ability of data is set to continue and expand with a fundamental impact on society.
The personal data ecosystem, how organisations, governments and individuals interact, is not building trust and value as it could. Trust in data usage is a much-debated issue,and current evidence supports a very troubling hypothesis, well-expressed by research from the University of Pennsylvania:
“A majority are resigned to giving up their data—and that is why many appear to be engaging in tradeoffs. Rather than feeling able to make choices, Americans believe it is futile to manage what companies can learn about them. Our study reveals that more than half do not want to lose control over their information but also believe this loss of control has already happened. By misrepresenting the American people and championing the tradeoff argument, marketers give policymakers false justifications for allowing the collection and use of all kinds of consumer data often in ways that the public find objectionable. Moreover, the futility we found, combined with a broad public fear about what companies can do with the data.”
While focused on the US, this hypothesis is consistent with findings of a BCS-commissioned YouGov poll.In addition, it supports findings from Wellcome, an independent health research foundation, that people were largely unaware of how their data is being used and there was a significant level of confusion about what personal data is and what it could achieve. Across every sector there is growing pressure on trust and data use. Research from Citizens Advice highlighted that UK consumers want:
· A fairer and more balanced data environment, with more visibility and openness about data flows as a whole and in particular with what information is collected about themselves.
· A more responsive system that enables easy ways to make decisions on how their information is used and to change their minds if their preferences change.
The UK’s data laws are currently based on a European Data Directive, which will be replaced in 2018 by the General Data Protection Regulations (GDPR). Irrespective of EU membership, any organisation that holds data on European citizens will need to comply with the GDPR. In order to maintain and grow a data industry and support all industries that interact with consumers it is essential that UK law is officially recognised as compatible or equivalent to European protections.
However, there is an opportunity to go further and set out as both an exemplar and an innovator in protecting the public’s data while also empowering business to use it safely and well. European regulations that will come into force in 2018 will not be the end-point of this journey, and they are in response to real issues of concern for the public.
Myriad government reports and legislative attempts, including the current Digital Economy Bill (DEB) and the recent report from the Office of the National Data Guardian, acknowledge the scope and impact of the disconnect and trust issues, but despite best endeavours have serially failed to reach firm conclusions with wide agreement. For example, the conclusion of the long-running consultation for the DEB stated:
“The sensitivities around the issue of data sharing require a sensible dialogue. The opportunities to transform public services afforded by technology and more effective use of the data already held by public bodies are great. Understanding privacy concerns and factoring them earlier into the policy development process may help realise some of those opportunities. However, wider consultation is required so that the views of more people and organisations can be heard to ensure proposals strike the right balance between preserving the privacy of citizens’ data and enabling public sector cross referencing of information before proposals are implemented.”
The conclusion is that no blueprint or roadmap yet exists that will lead to a data-driven future that is good for the public. Government needs to be brave and support the development of such a blueprint away from the pressures of short term political or operational considerations. This will require a mechanism such as a Royal Commission to elevate the discussion and reach some socially-acceptable and innovative frameworks that can be implemented by UK businesses, charities, and public services.
A digitally-capable future
From digital literacy to the most valuable digital talent, the UK’s growth and innovation is underpinned by the digital capability of its resident population. Every sector depends on it and from transportation, finance, retail, health to public services, future developments assume access to talent. Professionals in areas such as information security, data analytics, business architecture and analysis, software engineering and digital leadership are ubiquitously required. This is not only true in the IT industry itself, but also as a fundamental component of other sectors such as finance and healthcare. Consequently, the UK’s future will be constrained by its access to this talent.
This is also part of the calculus in location decisions for global digital businesses both large and small. A post-EU Britain will see a change in the competitive environment for talent and will be in need of a range of capabilities to enact changes as the UK leaves the EU, as well as to support future growth and ambitions. Access to non-UK talent is essential as part of a solution that also majors in investment in education and training for the existing UK workforce.
The UK’s world-class academic computing community is, through research, teaching and community involvement, one of the pillars of our economy and society. Academic research and innovation goes hand in hand with talent and capability. That community is under immediate threat because of the prospect of a changing environment outside the EU and must be protected. As one of the 35 professional engineering institutions that comprise the Engineering the Future alliance, together with the Royal Academy of Engineers and EngineeringUK, BCS supports the Alliance’s positions on a post-EU academic community in their ‘Engineering a Future Outside the EU’ 2016 report which urges government to seize the opportunity to solve the UK’s engineering skills crisis.
BCS wants to see:
· The lowest possible barriers to working in the UK for practitioners and academics who meet appropriate professional standards in computing /IT/digital, together with continued funding of research which will ultimately shape our future society
· Our members and the sector continuing to promote personal and team development in organisations. Every individual needs to take responsibility for building and maintaining a welcoming, diverse and fair workplace. Long term talent planning must be on the organisational agenda.
· The UK needs to significantly increase public and private investment in educating the UK workforce in digital capability, with specific focus on information security, software development and data innovation. This will include supporting capabilities like the expansion of honours degree apprenticeships targeted at the existing workforce as well as new entrants.
The House of Commons Science & Technology Select Committee succinctly describes the UK’s problem with digital talent as follows:
The remarkable achievements of the BCS Computing at School community, the Shadbolt Review, and the very welcome investment in apprenticeships all support a more capable future for the UK. However, it is not clear that those already in work are sufficiently supported by their employers and government and if the UK is to meet its own needs then the existing workforce must be a larger part of the solution.
It is not yet clear how exiting the EU will affect the UK’s ability to make use of global talent, but the impact is likely to be either neutral or negative without other measures. By contrast, our member dialogues suggest that simply implementing regulatory changes from an EU exit could absorb a substantial portion of the talent currently available to the UK.
Specifically, in the IT security sector and related to points following below, the UK does not have enough home grown talent to drive growth in this sector. Recent survey figures from Intel Security and the Centre for Strategic and International Studies reveal that 82% of respondents (globally including the UK) believe there is a cyber security talent shortage. Free movement of EU professionals has been a major factor and if, after Brexit, British migration controls are equivalent to other world economies growth could stagnate. Currently, sponsored information security professionals are covered under the Tier 2 visa system and Brexit could result in a decrease in volumes of people allowed visa under this scheme.
If the UK is to have any ambition to be a leading and safe digital nation, the government and industry response needs to be commensurate both with that ambition and with the challenges of an EU exit.
A secure digital future
Personal, corporate and national online criminal activity continues to grow as a threat. To secure a fair society, protect our critical infrastructure and ensure the UK is an attractive place to do business, we need to maximise UK information security capability. The exit from the EU changes the international relationships and impacts priorities around information security. The UK would benefit from an integrated strategy to create a vibrant information security industry both for internal need and as an exported service. Part of how to achieve this is building talent amongst the existing workforce as well as new entrants, but this will also require investment in research, business, government capability and continued international cooperation.
It is encouraging that the Government’s National Cyber Security Strategy 2016-2021 says that we aim to reach our digital objectives with the continued cooperation with the EU, particularly in relation to cyber-security and intelligence in addition to incentivising the expansion of the UK’s cyber security sector. It is of critical importance to UK security that these intentions are acted upon, or the UK otherwise risks being increasingly vulnerable to online criminal activity at a time when they are increasing in frequency.
BCS wants to see:
· The protection and encouragement of cross-border working on cyber security together with a boost in UK participation in internationalstandards development.
· Members and organisations connecting information security strategy with talent planning. Make information security a focus for your development and encourage others to do likewise.
· The implementation of a UK strategy to build a vibrant information security sector along the line suggested in the National Cyber Security Strategy 2016-2021.
According to the Department for Culture, Media and Sport Sector Economic Estimates 2016, UK digital exports are worth over £30bn a year, 14.5% of all UK service exports and there is a need to ensure we continue to be a safe place to do business. In contrast to this, the cyber threat to our digital industry remains very real, with 65% of large firms detecting a cybersecurity breach in the last year with the average cost of a breach estimated at £2,620 across all businesses
The immediate effects of Brexit on cyber-security appear to be relatively limited. According to SAS Business Analytics, actual attacks in the wake of the vote have remained around average levels with a slight increase in ‘hacktivist’ style attacks, as opposed to more dangerous security breaches.
However, experts in the field of cybersecurity have speculated that any uncertainty surrounding changes in laws in this area have a “better than 50/50” chance of causing an increase in cybercrimeA recent poll by AlienVault revealed that more than a third of information security professionals fear that leaving the EU would make the UK more vulnerable to cyber-attacks and there are concerns about no longer benefitting from intelligence sharing with EU member states.
Continued involvement with European law enforcement agencies will therefore be particularly important for the UK relationship with Europol and the European Cybercrime Centre (see NIS below). Europol’s mandate is to support Law Enforcement Authorities throughout the EU under its obligations under the Data Protection Directive and other EU Regulations and might have to implement different mechanisms to share certain data with the UK outside the EU and vice versa.
Although we should also be looking at bilateral intelligence and activity agreements with individual European partners, the priority should be on forging new arrangements with the two agencies above. Additionally, economic effects could lead to loss of investment in UK capabilities thus making the UK a preferred target and jurisdictional issues caused by Brexit could increase complications.
The Network and Information Security (NIS) Directive (2016/1148/EU) which entered into force in August 2016 covers arrangements for dealing with network and information security and. the precautions taken by critical national infrastructures against disruption by failures of information and communications technologies. It also deals with resilience requirements on three classes of digital service with social and economic significance in search engines, cloud computing services and online marketplaces.
The requirements on EU Member States ,for example to have a national strategy and a network of Computer Security Incident Response Teams (CSIRTs), are very similar to the UK’s existing Cyber-Security Strategy. The biggest concern is that, on leaving the EU, the UK might lose access to the strategic cooperation group and the CSIRT network that the Directive creates. Since most NIS issues and incidents are international in scope, any reduction in information sharing would harm our ability to protect the UK’s citizens and services. Following Brexit, the UK would also cease to be a full member of Europol, and would need to agree associate membership status. This status is unlikely to allow the UK direct access to Europol investigative databases, to lead investigative teams or to participate in the management of Europol.
The Directive’s requirements on critical infrastructures are also likely to fit well with the existing work of the UK’s Centre for the Protection of National Infrastructure (CPNI) and the National Cyber-Security Centre (NCSC). The main change here appears to be the addition of DNS services (including top-level domain registries) and Internet Exchange Points to the traditional list of critical infrastructures. The Directive considers that most critical infrastructures will be provided within individual countries, so requires governments to determine which providers in each sector need to be within scope. The UK is likely to use its own risk assessment in making this decision, informed by the impact thresholds to be developed by the cooperation group.
However, the Directive takes the view that digital service providers are likely to be international, so the definition of these organisations and the requirements placed upon them need to be consistent across Europe. It is not clear what their impact on UK-based service providers might be. Providing resilient services should be in the interests of both users, (including businesses who depend on these platforms, and providers.
While the UK remains in the EU, we should endeavour to ensure that the Commission’s lower-level guidance does not make unreasonable demands of either of these groups. As the outcome of these discussions becomes clearer, the UK may consider whether it wishes to impose the requirements on digital service providers in the UK. Since the guidance is likely to set the expectations of service users across the EU, a choice not to adopt it could damage confidence in UK-based services.
A connected future
The ambitions of every sector and every domain important to our society depends on a level of future connectivity that we are not currently planning to deliver. Outside of the EU the UK’s infrastructure will be benchmarked against international competition for infrastructure and currently it does not benchmark well. The rationale and positive economic case for connectivity is unavoidable and clear. Yet despite this clarity, investment has been calibrated to the interests of the telecommunications sector, not the wider economy and public need and this needs to change.
BCS wants to see:
· Strategic cooperation on communications regulation and pricing that continues beyond Britain’s exit from the EU.
· A refreshed infrastructure strategy that includes clear government commitment to a significant change in the scale of investment and pace of roll-out of a mixture of fixed and mobile infrastructure (Fibre to the Premise, 4G) and investment in future connectivity (e.g. 5G).
‘…while the Government’s broadband programme, BDUK, is on track to deliver access to 95% of premises with superfast services by the end of 2017, there is a serious public concern that the UK is not adequately investing in critical telecoms infrastructure. The UK is a laggard by international standards in providing fibre connectivity. This could result in a widening, not a narrowing, of the digital divide; especially as demand for faster services escalates after 2020’
There have been numerous reports in recent years that demonstrate the return on infrastructure investment and its value to the UK economy, and these only serve to heighten the importance of UK connective in a post Brexit world.
The UK Broadband Impact Study impact report, commissioned by the Department for Culture, Media and Sport (2013) estimated that the availability and take-up of faster broadband speeds will add about £17 billion to the UK's annual Gross Value Added (GVA) by 2024; and these interventions are projected to return roughly £20 in net economic impact for every £1 of public investment.
More recently we have seen the economic success of resulting from improved broadband connection demonstrated by London Small, Medium Sized Enterprises (SMEs) following take up of the Government's Broadband Connection Voucher Scheme. A recent report by Adroit Economics,commissioned by the Greater London Assembly, concluded that the scheme will enable London's SMEs to generate £2 billion of additional sales within the first two years, 32,000 new jobs and achieve just under £1 billion in cost savings. The report estimates that the economic return on investment of public funds into the scheme is an additional £23.67 of Gross Value Added for every £1 invested in the scheme.
The European Commission’s Digital Economy and Society Index ranks the UK 6thin the European Union behind Denmark, Netherlands, Sweden, Finland and Belgium. The UK is rated as part of a group of countries that are "lagging ahead" - scoring above the EU average but whose development is now "very slow" and as such is lagging in comparison to the progress of the EU as a whole. In terms of connectivity alone, the UK ranks 6th and falls behind the Netherlands, Belgium, Sweden, Luxembourg and Denmark.
Ofcom’s ‘International Communications Market Report’ 2015 finds that just 28% of UK mobile connections are 4G, compared with 45% in the US and 63% in South Korea. Additionally, 84% of the UK population have 4G mobile network availability from at least one provider, versus 98% in the US, 99% in Japan and 100% in South Korea.
Consequently, without a continued push on investment as happened at the origins of the BDUK programme, we could easily see many more EU nations bypass the UK in terms of connectivity, creating an inability to compete on a global scale. This could potentially be disastrous to attracting business to our shores.
[Infographic here – maybe with an excerpt at the start]
BCS is committed to being a welcome home to everyone who shares the organisation’s values and is prepared to submit to the code of conduct. Despite having a broad range of views, BCS members are demographically more likely to be ‘remainers’ than the general population, and are by their membership declaring a level of social responsibility and accountability. Members come from all quarters of the IT, computing and digital communities.
BCS has through surveys, dialogue and consultation gathered a wide range of inputs that are summarised below.
Confidence and emigration
Our ‘post-Brexit’ survey showed that our members confidence in the UK’s digital future had suffered because of the referendum, and the word ‘emigrate’ featured heavily in comments. While this is likely to be an emotional reaction to the result amongst ‘remainers’, and we do not expect this will be the sole factor in individuals choosing to leave the UK, it may affect the calculus. We also have anecdotal reports that this is seen as an opportunity to entice UK talent abroad, which is more likely to lead to increases in a ‘brain drain’.
Exit-related change programmes
The precise arrangements for leaving the EU will remain unknown for some time, but most scenarios will mean some level of change of operating environment for public services and commercial organisations. In regulated industries such as financial services, small changes in the operating environment can result in vast technical alterations to achieve compliance. Simple tweaks in tax, employment law, financial regulations etc. can spawn vast change programmes. In dialogue amongst members, many have expressed a great deal of alarm at what the summation of these programmes may look like. The level of multi-sector change combined with the level of digital integration could put us into unknown territory.
In a short-term and narrowly-defined way this could be good for the IT profession in terms of ensuring more than a decade of incredible demand for their services. However, this is not in the UK’s long term interests or that of the profession, and few BCS members are genuinely optimistic about this. The comparison is with the ‘Y2K’ bug, where a vast amount of investment in technical work led to the avoidance of an issue rather than adding value. It is better for the UK if the profession is pursuing changes that move businesses and public services forward and supporting exports.
This will be incredibly difficult to predict or influence, but an eye needs to be kept on the exit-related technical debt that is created for every organisation public and private. The main mitigations will be through a rapid step-change in talent planning and investment in people. Investments in infrastructure will also help offset this ‘exit-debt’ and potentially support more effective and efficient delivery and international collaboration.
Member comments have shown that some see little upside in the exit from the EU. However, others support the view that there are clear opportunities for economic and social progress – for example, on personal data – in a more independent legal and regulatory environment. This is set against the substantial power of the EU to regulate global digital business. In a post-EU Britain there will undoubtedly be positive opportunities. Despite some negativity, it is clear that there is a feeling of duty among BCS members to work towards a positive future for Britain between risk mitigation and making the most of new opportunities that arise.
Ethics and social good underpins any profession, so BCS is by its constitution committed to diversity and inclusion. The digital economy is highly international in its outlook and constituent parts. BCS members have a duty to support welcoming and inclusive environments. The IT profession can and should act as ambassadors for an open and inclusive UK that welcomes positive relationships with non-UK citizens and a diverse UK society.
 S&T Select Ctte (Commons) 4th Report - The big data dilemma – Feb 2016 http://www.publications.parliament.uk/pa/cm201516/cmselect/cmsctech/468/...
 The Trade-off Fallacy, University of Pennsylvania, June 2015. https://www.asc.upenn.edu/sites/default/files/TradeoffFallacy_1.pdf
 Wellcome Trust, Public Attitudes to Commercial Access to Health Data https://wellcome.ac.uk/sites/default/files/public-attitudes-to-commercial-access-to-health-data-summary-wellcome-mar16.pdf
 Fairness & Flexibility – Citizens Advice – July 2016 - https://blogs.citizensadvice.org.uk/wp-content/uploads/2016/07/Fairness-...
 Conclusions of civil society and public sector policy discussions on data use in government – March 2015 http://datasharing.org.uk/wp-content/uploads/sites/2/2015/03/20150327_Co...
 RAEng ‘Engineering a Future Outside the EU; securing the best outcome for the UK’ 2016 http://www.raeng.org.uk/publications/reports/engineering-a-future-outside-the-eu
 S&T Select Cttee (Commons) 2nd Report - Digital skills crisis – June 2016 http://www.publications.parliament.uk/pa/cm201617/cmselect/cmsctech/270/...
 Hacking the Skills Shortage 2016
HM Government, National Cyber Security Strategy 2016-2021 https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/567242/national_cyber_security_strategy_2016.pdf
 Department for Culture, Media and Sport Sector Economic Estimates 2016 https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/544103/DCMS_Sectors_Economic_Estimates_-_August_2016.pdf
 HM Government, Ipsos MORI, University of Portsmouth Cyber Security Breaches Survey 2016 https://www.gov.uk/government/uploads/system/uploads/attachment_data/fil...
 House of Commons Culture, Media and Sport Committee, 'Establishing world class connectivity throughout the UK', 2016, http://www.publications.parliament.uk/pa/cm201617/cmselect/cmcumeds/147/...
 UK Broadband Impact Study impact report, SQW, 2013, https://www.gov.uk/government/uploads/system/uploads/attachment_data/fil...
Faster broadband brings £3 million boost to London SMEs, Point-Topic, 2016, http://point-topic.com/faster-broadband-brings-3-billion-boost-london-smes/
 The Digital Economy & Society Index (DESI), European Commission, 2016, https://ec.europa.eu/digital-single-market/en/desi
 Ofcom ‘International Communications Market Report’ 2015 Page 15 and page 206 https://www.ofcom.org.uk/__data/assets/pdf_file/0020/31268/icmr_2015.pdf