sou · GOB324 · 2001-01-01 00:00:00 — The conclusions should be evaluated and adapted to the relevant conditions in each situation. The Commissions task has been to assume a leading role in the project which aimed to assure a safe conversion from 1999 to 2000. The operative focus has been on the infrastructure. In this context it should be noted that the Y2K conversion is regarded by experts as the largest civilian project ever in modern times. In addition, Y2K conversion has affected all countries. According to its directives, the Commission should ·serve as a conduit between the private sector and the public sector ·closely follow Y2K compliance work ·provide an ongoing assessment of how the work has progressed ·alert managers to any need for action, particularly regarding co- ordination between different sectors of society ·provide a continuous flow of information ·emphasize vital sectors in society 22 Summary and conclusions As late as in , 1999, fears of extensive disruption were voiced in several cases. Several public sector institutions and large companies reported delays. This was interpreted by outside as if the projects were not under control, which meant statements by these bodies were met with scepticism. The outcome of the conversion work was very satisfactory - the mission was accomplished. Without the contributions that were made, the situation would have become problematic. The successful outcome was also due to the fact that most parties were well staffed with IT experts and managers during the New Year, which meant that no major faults attributed to the Y2K issue were reported in . Only some minor faults in other services were noted, which was in line with the general assessment which the Millennium Commission delivered to the government in mid-October 1999 (the report is listed in appendix 5). The impressions were the same internationally. The positive outcome is the result of dedicated work in many public sector bodies, companies and other organizations. Responsibility for Y2K compliance and the correct functioning of IT systems rests with the relevant institutions and companies. No specific legislation for the Y2K project has been introduced apart from the central governments own activities. This has, however, been the case in other countries. In the , for instance, specific laws have been enacted to facilitate openness and exchanges of information between companies and other organizations. In other countries, Y2K compliance in small businesses has been subsidized. Everyone who encountered the Y2K issue noted that success was conditional on co-operation between the various parties. The Millennium Commission viewed such co-operation as a major task and followed through by working in networks for exchanging experiences and information which had been set up earlier. During the course of the work, we have co-operated closely with a large number of parties, mainly on a central level. Summary and conclusions 23 The co-operation forums which were established have functioned well. Respondents say participation in these networks has been the single most important activity they have been involved in. Interest in participating in the Millennium Commission networks has been substantial. It has been an important task to make companies, organizations and the general public aware of the Y2K problem and to point out the need to make operations Y2K compliant. The Millennium Commission carried out a number of public information campaigns and produced background material. Its staff participated in debates and radio and television programs. During the course of the work, a large number of seminars were conducted, featuring presentations by the Commission chairman and staff members. Two contradictory ways of addressing the problem have been proposed by various parties – to scare or to calm the public. As far as the Millennium Commission is concerned, the guiding principle has been to communicate the Y2K work in a factual and transparent . Jointly with other parties, the Millennium Commission has actively addressed the communication issue, consistently urging companies, organizations and public sector bodies to be rather than reactive. This strategy has contributed to a satisfactory outcome when it comes to shaping public opinion. An communications campaign is probably the reason why speculation and over-reaction among the public was largely absent. Information presented on Millennium Commission website has been regarded as highly valuable. The website has been termed by many as the best one in when it comes to the Y2K conversion. To clarify the compliance situation, independent status assessments were made. Public hearings were also arranged to highlight the situation in especially important sectors of society. The outcome of these activities has been valuable and constituted a precondition for the planning of other parties Y2K work. 24 Summary and conclusions The Commission notes that a number of efforts were made to spread myths regarding the Y2K issue. Such a myth was that the entire work had been unnecessary. The Commission notes, however, that vital parts of society would have ceased to function and that major problems would have arisen if the compliance work had not been carried out. Banks and large companies made the assessment that they would have coped for a few days or, in the best possible case, a week if measures had not been taken. Other vital parts of the national infrastructure would have encountered similar difficulties. The threat was a real one. It has often been suggested that the need of conversion work was invented by consultants to make money. The Millennium Commission has no evidence that this has been the case. It cannot be ruled out, however, that it has been in the interest of some consultants and experts to keep the issue alive. International research firms presented reports on the compliance situation and costs in various countries and sectors, including . Surveys made by the Millennium Commission show that these allegations are based in part on insufficient data. The topic of embedded systems has been extensively discussed. During the initial phase of the Y2K conversion work, embedded system problems were portrayed as a major risk factor. Many experts claimed faults in such systems were the main threat. Through its networks, the Millennium Commission made major efforts to clarify which faults had been discovered and their effects. Despite these efforts, no significant faults were shown to have occurred. At every meeting, the Millennium Commission urged an especially high degree of openness on methods, results and experiences concerning embedded systems. It has, however, been difficult to create this transparency. Companies, institutions and other organizations have not initiated any co-operation to put pressure on suppliers or consultants. If the parties had done their part to eliminate uncertainty regarding, for instance, embedded systems, it would have been possible to save much time and resources or to them to vital areas. The situation has apparently been similar in most countries. The Millennium Commission notes that problems with embedded systems appear to have been exaggerated. They do not seem to have Summary and conclusions 25 had anything near the impact which was alleged by many during the work. A similar argument was made regarding personal computers. Judging from the reports made available to the Millennium Commission, it can be noted that faults in PCs have been few and easy to rectify. Many have called for the IT industry to display visibility and responsibility. It has been well known for a long time in the industry that IT systems and microchips would develop faults if no measures were taken. Some measures to rectify the problem were, however, with some exceptions, not taken until at a late stage. Even at the end of 1999, some suppliers gave that their products were Y2K compliant. Despite this, some of these products did not work at year- end. If the IT industry had given a coherent picture of what could be expected to happen, where the problems might arise and how they could be rectified, significant resources would have been saved. Several parties regarded it as self-evident that the IT industry body, and , should have assumed an role in the work since the problem was seen to have originated in the IT industry. The Millennium Commission notes that it would have been an advantage if the IT-industry had been more . On several occasions, the Millennium Commission has called for the participation of industry organizations. Two bodies have co-operated on a daily basis, the and the . These two have shown major commitment. But it has been more difficult to convince other industry bodies to take part. The conversion work would have been extensively simplified if industry organizations had been more . 26 Summary and conclusions The Y2K issue is an excellent example of how modern society is woven into cross-border networks. This has been especially evident in Europe in the power, gas and telecommunication sectors. Concern regarding major disruption was in many cases tangible as late as in , 1999. International co-operation links meant it was possible to quickly use experiences from other countries. In many cases, countries co-operated on an informal basis. This is viewed as the reason why so few faults were reported from a number of countries which were long regarded as lagging heavily in the conversion work. The most IT dependent countries, which had started early, were able to share their knowledge with others. It also became clear that the vital infrastructure is linked but, apparently, not as vulnerable as had been expected. No so-called domino effects were noted. The Millennium Commission has communicated the situation in when in contact with colleagues in other countries. On these occasions, information has also been obtained regarding how the Y2K work has been structured and conducted in these countries. This has contributed to the exceptionally low level of rumour-mongering and speculation in . Through the Ministry for Foreign Affairs, essentially all Swedish embassies had access to information. A number of embassies have also reported back on the situation to the Millennium Commission. International co-operation bodies have addressed the issue. The normal procedure has been to pull together data from mainly the member countries within the respective organization. In this context, it can be noted that companies, institutions and the general public in countries such as seem to have expected too much of the executive ability of these international bodies. This has been particularly evident regarding nuclear power safety in Central and Eastern Europe. The supranational body , the , did not have the survey and monitoring mandates that many had expected. The has apparently not communicated these circumstances sufficiently clearly. The Millennium Commission has noted that cultural differences between countries and continents have become clear in this issue. Parties in the have acted as if conditions in, for example, were similar to those in the U.S. It has been difficult to convince colleagues in the U.S. that they must make their assessments in the context of local conditions and not on stereotype views based on Summary and conclusions 27 In these circumstances, special attention must be paid to the culture with regard to IT dependency, competence, interest, climate, etc. The participation of consultants In late 1997, a survey was made where it was alleged, among other things, that the number of consultants would not be sufficient and that the larger would have priority. This would have meant many companies, especially small and medium-sized ones, would have been unable to have their operations made Y2K compliant. However, it became clear relatively soon that this scenario would not become reality. One reason might have been that the method of interpretation, so called windowing, had been used to a larger extent than had been expected. In January, 1997, the government issued a directive (SFS 1997:30) stipulating a review of IT systems in government agencies ahead of the year 2000. Under the terms of this directive, the for Administrative Development was charged with assisting agencies with guidance and support and also to provide a continuous overview and overall assessments of the compliance situation in government agencies. In co-operation networks established by the Millennium Commission, it was noted that co-operation worked well on an agency level. However, the parties were of the opinion that they had to allocate too much effort on clarifying determine central government intentions. As a result, they stated a need for clear signals from the government, possibly of the same type that they regarded as having been communicated in countries such as and the . The parties were of the opinion that such signals would have permitted an earlier scheduling of the compliance work and would have facilitated the work. The basis for statements on the Y2K situation within primarily government agencies has been self-reporting. The agencies were not 28 Summary and conclusions directed to commission independent reviews. With a few exceptions, no such reviews were carried out. The Millennium Commission therefore conducted its own independent reviews and hosted public hearings to assess the situation. From an international perspective, such reviews have been relatively rare. The reviews highly facilitated the Millennium Commissions conclusions on the compliance situation in various areas. Self-reporting has not been a satisfactory method in an issue such as the present one, where confidence in assessments and statements plays a major role. Independent reviews are necessary to create confidence. Three main methods have been used to make systems and processes Y2K compliant. Many parties have replaced older systems and hardware with brand new products which are Y2K compliant. Others have used the method windowing and only a minority seem to have used the safe expansion method. In many cases, the time factor has been a decisive factor, which is why windowing has been used. The Millennium Commission notes that no major faults occurred in conjunction with the critical dates which had been identified. Without Y2K compliance, a large portion of activities in the country would have ceased to function or would have malfunctioned. Use of the interpretation method has postponed the conversion work for a number of years. For parties who have chosen this method, conversion work must thus continue. It is now important to conclude work in systems which have been rectified by means of an unsafe method. It is also important to take measures on the non-operation critical systems. In this context, it can be noted that research in various methodology choices for the Y2K conversion work would be valuable. Small and medium-sized businesses Throughout the work, the conversion situation in small and medium- sized businesses has been uncertain. The Millennium Commission thus initiated co-operation with various organizations to urge the launch and follow-through of the Y2K work and taking advantage of the background material which had been prepared. A number of surveys were also made regarding the conversion situation within this sector. Summary and conclusions 29 The Millennium Commission notes that disruption has been reported from this sector. IT systems are often exposed to disruption, which causes faults of various kinds. Many companies, institutions and other organizations have significant help desk operations and support departments to cope with these disruptions. Open documentation on normal disruption is, however, almost lacking. A certain amount of faults is apparently regarded as acceptable. The task of assessing allegations and reported faults would have been greatly facilitated if summaries and data on normal faults had been available or could have been assembled without exceptional effort. The lack of such reference data has caused uncertainty. The Millennium Commission sought to gain access to such data, but it turned out to be impossible to obtain such material. A lesson for the future is that the so-called normal background noise should be documented so that specific faults can be compared with the normal situation. IT is vulnerable and often exposed to disruption. This has consequences on a national scale, as society builds in a certain vulnerability through various dependencies which arise when information is assembled from various sectors of the economy. Safety issues have been at the forefront of the Y2K work. It has been necessary to make risk assessments and give priority to safety aspects, especially IT safety The need for continuity planning and readiness was especially noted during the autumn of 1999. The Millennium Commission proposes that the government and other parties should consider measures to maintain and enhance the safety philosophy which has now gained ground. IT safety issues should in the future be elevated to the managerial level. There are also reasons to, for instance, direct the for Civil Emergency Planning and other involved parties to continue their work on clarifying disruption preparedness among the public and various parties. It is likely that readiness levels should be increased among public sectors. 30 Summary and conclusions At most companies, institutions and other organizations, the Y2K conversion has been the largest project in modern times. It is quite clear that the conversion work has brought significant costs, and it is obvious that the costs could have been contained if the IT industry had launched the work early. During the course of the work, a number of efforts have been made to calculate costs for the conversion. The Millennium Commission notes that several methods have been used when making the calculations, which has made comparisons impossible. In public discussions, the argument has been made that costs for the conversion may only be booked as a negative entry. However, the Millennium Commission is of the opinion that the conversion has in many cases led to improved operation and efficiency – the conversion work has thus been an investment. The Y2K work has meant that managers had to commit themselves to the work in a conspicuous way. What was initially viewed as an IT issue has, in due course, become an operational issue. It has also become a matter of confidence in products and brands. The importance of strategic issues caused the Y2K work to be elevated to the managerial level. A large number of positive lessons have been learned from the Y2K work. Improved operation is expected to bring greater efficiency. The work should now be focused on utilizing these lessons and take advantage of them in the future. Measures should now be taken by parties to retain strategic IT issues on managerial level. A necessary precondition for the work has been to review and classify all systems, processes and products. Many older systems have been retired completely. The parties report that they have, for the first time, a complete review to work from. This will bring better operating quality in the future. The retirement of older systems and introduction of more efficient solutions has increased efficiency in operations. The Millennium Commission has held talks with trade union organizations to alert them to the issue and the measures that needed to Summary and conclusions 31 It was also then pointed out on these occasions that personnel involvement was a necessity, since the confidence and entire operations of companies and authorities was at stake. It has now been shown that the interest among trade unions was generally low. Through the Y2K work, several companies have discovered new and financially viable ideas and concepts. Examples include new support systems and safety systems. Several parties have stated that the regulatory framework is viewed as unclear regarding responsibility and powers in the preparatory work which was necessary for, among other things, co-operation between mainly county boards, municipalities and the defence forces. In this context, the concept of Severe Crisis Situations has been used. In order to rationalize the work in the future, it is important that the government explains the meaning of the regulatory framework and clarifies responsibility and powers in a situation which corresponds to the present one. Such work has been initiated. Many have sought to foresee when the next similar project may occur where experiences from the Y2K work can be of use. In the interviews which have been conducted, the euro conversion has been identified as such a project. This work affects the entire society and certain parties are of the opinion that it may be up to five times larger in scope than the Y2K conversion. This is especially evident within the financial sector. A number of smaller faults are expected to occur during especially the first half of 2000. The work must now continue to rectify these, conclude the conversion of non operation critical systems and rectify the systems which, during a transitory stage, have been managed through simplified measures. 1Uppdrag och planläggning av arbetet Enligt direktiven (dir. 1998:10) tillkallades en särskild delegation, Delegation för IT-omställning (N 1998:2), för att be- handla frågor rörande omställningen av datorer och system vars funk- tioner måste ses över . Direktiven beslutades vid rege- ringssammanträde . Uppgiften var att: ·vara samverkansorgan mellan privat och offentlig sektor ·löpande värdera hur arbetet fortskred ·uppmärksamma verksamhetsledningar på behovet av insatser fram- förallt när det gäller samordning över samhällssektorer ·lägga vikt på väsentliga samhällssektorer 2000-delegationen har haft ett kansli till förfogande. Vid kansliet har som mest arbetat sju personer. Kansliets uppgift har varit att driva det löpande arbetet. Ett nära samarbete har skett mellan kansliet och ordföranden. Ledamöterna har kontinuerligt fått del av de handlingar som kansliet utarbetat. Inriktning och aktiviteter har beslutats vid sammanträden med delegationen. På ett tidigt stadium konstaterade 2000-delegationen att ett framgångs- rikt arbete med att 2000-säkra samhället i samband med övergången till 34 Uppdrag och planläggning av arbetet förutsatte ett brett engagemang från många aktörer. Delega- tionen har koncentrerat arbetet på i huvudsak tre uppgifter Arbetet med 2000-omställningen planerades i sex faser. 1.Den första fasen sträckte sig från starten fram /1999. Arbetet fokuserades på att göra aktörer på alla nivåer i samhället medvetna om frågan. Det var den verksamhetsansvarige som ansvarade för arbetet. 2000-delegationens budskap var att sätta igång och driva på arbetet, göra riskbedömning och koncentrera arbetet på de verksamhetskritiska processerna. Aktörerna uppmana- des därför att dela med sig av erfarenheterna. Det var också viktigt att klarlägga hur omvärlden arbetade med 2000-problemet. 2.I fas två, , fokuserades arbetet på att klarlägga läget inom olika samhällssektorer med koncentration på infrastruk- turen. Huvudmålet var att tillse att aktörerna testade systemen och att öppet förmedla kunskap om 2000-läget. 3.I den tredje fasen, tredje kvartalet 1999, var huvudmålet att tydlig- göra 2000-läget i infrastrukturen och ge en bedömning av detta läge till hjälp för omvärldens anpassningsarbete. Att infrastrukturen fun- gerade var en förutsättning för att resten av samhället skulle fun- gera. 4.Fjärde kvartalet 1999, fokuserades på att tydliggöra behov av konti- nuitetsplanering och beredskapsplanläggning i olika verksamheter. 5.Under nyåret och tiden därefter har arbetet koncentrerats på att följa upp störningar och händelser .