sou · GVB347 · 2008-01-01 00:00:00 — Vervas analys på uppdrag av utredningen leder till slutsatsen att det i första hand är öppna standarder och gränssnitt som ska främ- jas, inte öppen programvara. En annan slutsats är att öppna pro- gramvaror i normalfallet måste ha egen kraft att klara sig på mark- naden. Undantagen är bl.a. applikationer som är särskild anpassade för svensk offentlig förvaltning, t.ex. barnomsorgsplanering, som i vissa fall kan behöva stöd för att få igång användningen. Ett sätt att återanvända egenutvecklade program är att statliga myndigheter kan bidra till det arkiv (repository) för öppna program som erbjuds av det s.k. . Även andra arkiv bör kunna användas för denna återanvändning. Statliga myndigheter bör bidra med egenutvecklade öppna pro- gram till och andra liknande programarkiv, under förutsättning att licensvillkoren i de enskilda fallen med- ger detta. En vägledning bör utarbetas som beskriver hur myndigheter bör agera vid anskaffande och utveckling av öppna programva- ror, inklusive upphandling av stödtjänster till dessa och hur de kan gå till väga för att underlätta återanvändning av de program som de tagit fram. En central expertfunktion för interoperabilitet och IT- standardiseringsfrågor vid Verva Den nya utvecklingen av IT-strukturen, som har accelererat , förutsätter en organisation med centrala experter och central samordning för att säkerställa en standardiserad upp- byggnad. De största centrala myndigheterna har redan börjat bygga upp sådan central expertis, och nätverk har skapats för samverkan mellan myndigheter. Vi föreslår att de centrala experterna på IT- standardiserings- och interoperabilitetsområdet hos Verva förstärks i motsvarande grad. Huvuduppgiften för Vervas expertfunktion är att vara en tak- funktion som ser till att frågor som hör samman med standarder och standardisering på e-förvaltningens område inte tappas bort i den offentliga decentraliserade organisationen utan att någon instans vid behov tar ansvar för initiativ, så att det finns en obruten ansvarskedja. Samordning kan göras frivillig och behöver inte regle- ras genom ytterligare föreskriftsrätt för Verva, utöver den som redan finns. kan den centrala funktionens roll vara att driva en viss konkret fråga för att skapa en teknisk specifikation som svarar mot behov i den offentliga förvaltningen. Verva har föreslagit begreppet gemensam specifikation för att uttrycka detta. Som stöd för arbetet med gemensamma specifikationer och för att samordna myndigheternas interoperabilitetsansvar kan Verva utveckla en gemensam interoperabilitetsstruktur. Det förutsätter dock att myndigheterna frivilligt efter förhandlingar kommer över- ens om att denna ska gälla som referensram. Inflytande från andra intressenter som näringslivet och intresse- organisationer kan ske på åtminstone två sätt. Dels bör Verva vända sig till en formell standardiseringsorganisation, t.ex. SIS, med en intresseförfrågan när så är lämpligt. Dels kan myndigheter själva välja att hantera IT-standardiseringsfrågor av relevans för sin sektor i särskilda grupper där myndigheterna tillsammans med andra intressenter bereder frågan. En viktig förutsättning för en fungerande expertfunktion är att den utövas i samarbete med bl.a. de myndigheter som har stora expertstaber och som har praktisk erfarenhet på fältet på IT-stan- dardiseringens område samt med näringslivet. En central kanslifunktion ska inrättas vid Verva för att utveckla och förvalta förutsättningarna för interoperabilitet dvs. ett interoperabilitets- och standardiseringskansli. Denna kansli- funktion ska samordna, förankra, publicera och underhålla de förvaltningsgemensamma specifikationerna samt ge metod- och expertstöd i IT-standardiseringsfrågor inom den offentliga för- valtningen, särskilt när det gäller begreppsstandarder. Som vägledning i detta arbete bör en form (arkitektur) för att främja interoperabilitet inom den offentliga förvaltningen utvecklas och förvaltas. En öppen webbaserad katalogtjänst bör skapas för de gemensamma kravspecifikationerna. Tekniska specifikationer och liknande krav för informations- hantering och informationsutbyte ska utvecklas i ett forum som är öppet för alla parter, t.ex. i SIS, när så är möjligt och lämpligt. Verva ska främja sådant standardiseringsarbete. Såväl på beställarsidan som på leverantörssidan kan det förekomma att enskilda aktörer ser ett behov av enighet om hur något ska vara beskaffat. Dock saknar kanske aktörerna kraft, tid eller kompetens att initiera ett arbete för att nå denna enighet. En funktion för samordning av kravställande inför upphand- lingar inom Verva bör hållas isär från Vervas arbete med ramavtals- upphandlingar för att de har olika fokus: I samordningen inför upphandlingar ligger tyngdpunkten på myndigheters intresse av att samordna sitt kravställande, medan utformningen av ramavtalen är en del av en upphandlingsprocess. En särskild funktion med ansvar för samordning inför den offentliga IT-upphandlingen bör inrättas vid Verva. Denna funktion ska arbeta för en samordning mellan myndigheter när det gäller gemensamma upphandlingskravsspecifikationer som sedan kan användas i kommande förfrågningsunderlag inom IT-området. Det finns en förväntan att e-handel ska komma igång av sig själv, men tröskeln har varit oväntat hög. Därför måste insatser göras för hela inköpsprocessen. För vissa delar av inköpsprocessen, upphandlingsdelen, kan det vara aktuellt för den offentliga sektorn att i samverkan med branschintressen ta fram gemensamma specifikationer med funk- krav på t.ex. processer, begrepps- och informationsstruk- tur. Förberedelser kan göras , och justeringar kan ske i takt med att förutsättningar i form av ny lagstiftning klarnar. Regeringen ska ge Verva i uppdrag att i samverkan med Kommuner och Landsting samt branschintressen utarbeta ett handlingsprogram för standardisering inom den del av den elektroniska inköpsprocessen som gäller upphandling. Förberedelser bör ske inom följande områden: En vägledning utarbetas om hur t.ex. mottagningsfunktio- nerna för anbud kan utformas. Terminologi och informationsstrukturer klarläggs redan från början i upphandlingsprocessen. För vissa delar av inköps- och upphandlingsprocessen utformas gemensamma kravspecifikationer med funktio- nella krav på t.ex. processer samt begrepps- och informa- tionsstruktur. Remit of the Inquiry The original remit of the IT Standards Inquiry, set by the Govern- ment in , was to submit proposals on ways of improving the coordination of IT standardisation. This applied both to the necessary coordination of standardisation work in response to EU decisions on standardisation and to internal coordination within the Swedish public administration. The Inquiry was also instructed to consider whether and how open software, i.e. applications based on open source software, should be promoted. In supplementary terms of reference issued in , the Inquiry was further instructed to consider and propose ways of speeding up the introduction of e-government, enhancing e- government security and promoting electronic procurement, and to examine the legal implications of open source software. A brief summary of the Inquirys findings is presented below. The title of the present report The Invisible Infrastructure is a reference to the fact that standards – including IT standards – are unnoticeable when they are in place and functioning properly. It is only when they are lacking that their absence is noticed and pro- blems arise. To a large extent, they are also invisible to those responsible for operations in the course of the decision-making process. Although operational decisions, e.g. procurement of e-ser- vices, often involve choosing standards, these do not seem to be taken separately or expressly, at least at this level, but are a tacit outcome of operational decisions of different kinds. The purpose of our report is therefore to make standards visible and to spot- light some of the consequences of their selection. Another basic observation we have made is that IT standards must be viewed in several aspects. IT standards in the public admi- nistration cannot be coordinated from a single vantage point or from within one and the same body. We have identified the follo- wing arenas for discussion of IT standardisation in the public sec- tor: Swedish coordination in response to EU decisions gaining an overall view of IT standardisation as an organisatio- nal system. Basically, the summary is structured into three levels: government responsibility for IT standardisation at national level and coordination at international level, responsibility for IT standardisation as part of the operational tasks of government agencies, municipal and county councils, public bodies concerned with standardisation, etc. The role of the and other government authorities responsible for developing common specifications for the public administration and the coordination of IT standardisation work. It should be noted that in certain areas, e.g. information security, our proposals could have been divided into a number of categories, to be dealt with at several levels. However, such issues are best addressed where their centre of gravity lies – primarily within the agencies operational responsibilities in the case of information security. However, we begin with a discussion of overall policy issues arising in connection with the choice of standards. Policies concerning choice of standards The Inquiry began by examining the various sets of standards cur- rently in place and how these are developed and applied in different types of organisation. The term standard was understood both in its everyday sense of a commonly accepted or approved example of something against which other things are judged or measured, and in a more specific sense, namely the outcome of a standardisation process. The term embraces all types of standards as well as agree- ments on how a thing is to be constituted, embodied in a specifica- tion. In its latest IT (2004/05:175), the Government has declared that the use of open standards should be promoted. Examples of the above include formal standards established by recognised EU standardisation bodies such as dardisation (), () and (). However, there are numerous other standards, some of which are essential to the operation of the internet, that meet stringent requirements of openness. All stan- dards exhibiting a reasonable degree of openness are normally referred to as open standards. Provisions governing the invoking of standards, where formal standards are the principal alternative, are set out in the current Public Procurement Act. Despite this, proprietary software appli- cations predominate in public procurement. Given the existence of effectively functioning open standards in a range of areas, efforts should be made to apply these in public procurement. Such an aim should also be reflected in framework procurement contracts. The need to refer to informal standards in regulations based on EU directives and procurement legislation can give rise to pro- blems. This is possible in principle provided it can be shown that the choice of standards is not discriminating. The legal position is unclear and requires further elucidation. However, should actively seek – and for its part adopt an interpretation that will make it possible in practice – to promote direct reference to IT standards developed by the Internet Task Force (IETF), the Organization for the Advancement of Structured Information Standards (OASIS), the World tium (W3C), (UN/CEFACT) and similar bodies. A number of other countries have laid down guidelines on the use of document formats based on formal standards, the so-called open document format. , , , and the US state of are examples of places where soft- ware formats for ordinary office documents used in public admi- nistration or to communicate with citizens, such as word proces- sing, spreadsheet and presentation programs, must be based on At present, the few formats regarded as applicable that meet these requirements, are specific versions of the Portable Document Format (PDF) and the Open Document Format (ODF). In our view, public authorities should be able to receive all types of documents that normally occur in the market, are widely used by the general public and have been designed in accordance with technical specifications based on formal standards – referred to in everyday parlance as open document format. Whether authorities also choose to use the open document format in other contexts, i.e. when communicating with citizens, is, in our view, a matter for them. If authorities are to be required to offer open document formats in communications with citizens, the Government will need to ensure that support for the development of suitable pro- ducts is available in this area. Archives are currently drafting a regulation on technical specifications for automatic processing, i.e. document storage facilitated by IT. The regulation, which is concerned inter alia with the use of open document formats in the public administ- ration, is based on provisions in the Archives Act (1990:782) and the Archives Ordinance (1991:446). Prescribing the formats in which public authorities must save incoming or newly created electronic documents ensures that the former have access to the necessary software applications and can communicate with mem- bers of the public with their help. That the use of formal standards for electronic information management be promoted in the case of authorities accoun- table to the Government. That the Government also instruct the Administrative Deve- lopment Agency to attach particular importance to the long- term implications of using standards with a high degree of openness when drafting tender model specifications for fra- mework contracts. If this proposal is adopted, the agency sho- uld be required to report annually on progress in this area. That actively seek the adoption of an EU position on public procurement that allows reference to be made to other than formal standards. Such a position, which would apply at national as well as EU level, would make it possible in practice to refer to IT standards developed by the IETF, OASIS, W3C, UN/CEFACT and other, similar bodies that provide widely adopted standards but are not recognised in the sense unders- tood in Community law. That the Government commission the National Archives to issue regulations permitting authorities covered by the Archi- ves Act to store electronic documents which are in a widely used format based on standards provided by recognised stan- dards bodies. The Governments national responsibility Coordinating the preparation of EU standardisation matters Our remit includes drafting up proposals for coordinating the pre- paration of standards-related matters more effectively, in accor- dance with directive 98/34 EC. The purpose of the directive is to prevent national IT standards, regulations and administrative provi- sions from creating trade barriers and thereby restricting the free movement of goods, persons, services and capital in the single market. We have found that it is difficult for the Ministry for Foreign Affairs, which deals with these issues in collaboration with , to obtain supporting data and material on matters proceeding from the EU from the relevant sectors and experts in the public sector, despite efforts to create networks in government ministries and agencies. One reason for this may be the lack of a permanently established group of administrative offi- cers and experts, owing in turn to the varied nature of IT standar- disation issues and the fact that these are often so specific that the possible number of experts is always likely to be inadequate. We have attempted to solve this problem by proposing a network or council made up of people representing different activities and pur- suits in the community affected by IT standardisation. Such a net- work in our view could more easily locate the parties concerned and elicit opinions on the issue in question. That an IT standardisation council be set up with a view to improving the preparation of matters referred to in Directive 98/34 EC. The council should be composed of representatives of the most important government, municipal and county council authorities and organisations, people in the indu- stry/trade sector directly concerned with standardisation and other experts, e.g. from standardisation bodies, including the ITS and SEK, ministries, etc. As matters proposed for comi- tology procedures may also be standards-related, consideration should also be given to the inclusion of experts in such areas, e.g. from (). To ensure reasonably effective physical meetings with all present, the number of council members (excluding the chair) should not exceed 30. However, members will communicate principally via e-mail. Should the need arise, assessors with spe- cial expertise, would of course be able to take part in council meetings. The council would be tasked with assisting the Mini- stry for Foreign Affairs and in framing Swedish positions on international IT standardisation issues. It would also be required to take part in discussions and exchanges of information on issues relating to international IT standardisation. The administrative work – referring proposals for comment, receiving and collating comments from referral bodies and the administration of council affairs – could in our view be handled by a single officer. The councils composition, tasks and financing should be decided by a special agreement between the Government and the , in which case the council sho- uld form part of the latter organisation. If an agreement with the cannot be reached, however, the council should be established under , in which case its chair and members would be appointed by the latter. IT standardisation as an organisational system There is at present no clear division of roles and responsibilities among the various actors concerned and thus no clearly designated body with overall responsibility for issues arising in connection with IT standardisation, task allocation and general financing. There are many actors involved: ministries, government agencies, The Authorities and Regions, muni- cipal and county councils, companies, industry/trade organisations and other cooperation bodies, the , , , etc. While it is in the interests of all the above that overall assess- ments are undertaken, no single player seems to have been assigned a sufficiently overarching role. What is needed is a cross-sectoral, inter-ministerial body tasked with monitoring the entire organisa- tional system for IT standardisation, especially that part of it con- cerned with the public sector. would be the obvious candidate for such a role. That the be assigned to inquire into the following matters in collaboration with and the : How can financing be arranged to improve access to stan- dards developed by , parti- cularly in the IT sphere, e.g. in cases where reference is made to standards prescribed in regulations? In what areas of the public sector can the Swedish Stan- dards Institute be advantageously employed to develop standards, e.g. requirements common to the public admi- nistration as a whole and concept standards? What changes in the working methods of would facilitate closer overall coope- ration between it and public authorities? The of a coordinated system of standards registers, requirements common to the public administra- tion as a whole, etc. with a view to meeting the need for a centrally administered standards inventory classified by area of application and providing an overview of the pur- pose and content of each standard. What other special inquiries should be undertaken to provide background data for proposals on how standardi- sation in general – with particular reference to IT standar- disation – can be made more efficient and effective? Implications for Swedish industrial policy With regard to electronic communications, i.e. IT delivered by the sector, the physical IT infrastructure and the services directly associated with it, the relationship between service design and development and the structure of the market has been clearly established, partly through a special law, the Electronic Communi- cations Act, whose main purpose is to safeguard competition in the market. and is the authority responsible for these matters. However, in the case of IT services higher up the value chain, e.g. e-government services, market functions and similar industrial policy issues are not accorded the same level of attention. Other examples of industrial policy issues and questions: should the main costs be borne by enterprises or the public sector? the degree of involvement by , the significance of IT standards for innovation and research, the need for more information on IT standards, in particular among SMEs, the need to boost competition, inter alia in the computer con- sultancy market, and between document formats through the introduction of open standards and open source code, growth promotion through wider use of IT standards, measures to prevent municipal and county councils from get- ting locked into supplier solutions. That the Government commission the for Economic and Regional Growth and to monitor industrial policy aspects of IT stan- dardisation, as follows: for Economic and Regional Growth: the importance of IT standards to small enterprises and their development in certain markets, and : the effect of standards on the market and competitiveness. These tasks can be assigned on a regular basis in the agencies annual appropriation directions. The agencies would be requi- red to submit outcome reports to the Government. That the for be assigned to continuously monitor the industrial policy implications of IT standardisation in the spheres of innovation and research. Agency responsibility for interoperability To ensure continued development of IT support in the public administration, it will be necessary to promote closer cooperation between and within agencies and municipal and county councils, and to focus on improving conditions for interoperability, that is effective methods of information exchange. We have provided a number of examples of the need, both in local government and among citizens, for interoperability between government agencies information systems. Above all, the terms and concepts used in IT applications must be standardised. Although enhancing interoperability is a costly undertaking, it enables wider use of IT. To ensure that interoperability is given due prominence in agency operations, each government agency should have an information exchange officer responsible for ensuring that effective methods and procedures for information exchange are in place. We mean by the latter everything contained within the con- cept of interoperability – a term unfortunately considered too alien to the Swedish language to be used in legislative contexts – inclu- ding responsibility for access, e.g. by people with disabilities. Interoperability must be embedded at all levels of the system – technical, semantic, organisational and judicial – as its absence at any one level could be sufficient to impair its overall effectiveness. The judicial level is included to emphasise that development of the legal system must keep pace with that of the other three levels if interoperability is to be realised in practice. In order to ensure a fair and reasonably uniform assessment of developments, all public actors should be required to map and document their collaboration with other agencies and, in particular, any opportunities for electronic information exchanges already taking place or that need to be introduced. At the , such a survey is already under way as part of its government assignment to coordinate the automation of case handling.