Aug. 23, 2021

Building a Map to Navigate Digital Challenges in Policing

Building a Map to Navigate Digital Challenges in Policing

Wardley mapping, IT challenges in policing, and the importance of getting things done

This week, Ryan chats with Simon Clifford, former Director of Digital and Data for UK Policing, about the complexities of designing technology to enhance public protection and how to launch programs with greater agility.


  • How technology needs differ in policing vs the private sector
  • Simon's introduction to Wardley mapping, a business strategy technique for simplifying complex ideas
  • The core components of a Wardley map
  • How Simon used Wardley mapping to design a cybercrime programme and other projects
  • Delivering shorter term value and GCHQ boiling frogs
  • Use of AI recognition and body cam footage in policing
  • Smart speakers and privacy concerns
  • Reusing technology whenever possible

Meet Our Guest
Simon Clifford is the founder of Cliff 42, an IT service company working to improve public protection through digital. Prior to founding Cliff 42, Simon was the Director of Digital and Data for UK Policing, where he worked to transform policing to be able to adapt at pace through a holistic approach to technology and the business.

Get in touch with Simon:

Show Links
Follow us on Twitter: @thedwwpodcast 

Email us: 

Visit us: 

Subscribe to the podcast: click here
YouTube channel: click here


Ryan Purvis 0:00
Hello, and welcome to the digital workspace works podcast. I'm Ryan Purvis, your host supported by producer Heather Bicknell. In this series, you'll hear stories and opinions from experts in the field story from the frontlines, the problems they face and how they solve them. The years they're focused on from technology, people and processes to the approaches they took, they will help you to get to grips with the digital workspace inner workings.

Simon, welcome to the digital workspace podcast, you want to give us a quick introduction?

Simon Clifford 0:36
Yes, pleasure to be here. I'm Simon Clifford. I was formerly director different data for police ICT company that police digital service before that was already produced transformation for Northamptonshire police, and the police officers and Police and Crime Commissioner. So I've been in policing for the last five years, I've now left on set up my own company to support digital and public protection, corporate politics.

Ryan Purvis 1:00
Lovely. So we started chatting about the wardley mapping technique, which is only I wanted to sort of learn from you and then have you applied it. And then you can maybe do some more stories around being in the police world.

Simon Clifford 1:13
Well, I will absolutely and it's certainly distinct. I was in private industry prior to working in policing, I've got 20 plus years experience of that. And I'm being modest because I'm I'm an old boy. And yeah, I'm ultimately to 24 7365 it sounds trite to say it, but that that does taint everything you do. And equally, you can't say this is our target demographic or our target market. It is cradle to grave. So that colors what you do. And given that it's law enforcement, security is always front of mind. Because there are people that want to interrupt our core business. So there's lots of peculiarities in policing and public protection. And again, counter to a lot of listeners, I'm sure the private sector, we want less customers, not more. So ultimately, it's how do we do that? And certainly going into that space. You know, I was much like, I'm sure lots of people are listening, blind to a lot of what policing actually is, in terms of prepare and prevent stuff, people don't see that as much. And it's a large amount of what policing, policing is most effective when crime isn't happening. prevented it from happening, that's a really good thing. Clearly, we see that cars with blue lights, etc. But there are countless challenges in large governmental organizations, this is police, and this is other organizations. And those are cultural, technical, and many other things. And that's the challenge, you know, I'd like to I went in with a whole bunch of hubris thinking that I'm gonna identify problems that they've never even seen, because this was some of the stuff I was doing the private sector. And actually policing is full of things. It's no surprise is a problem. But it just struggles with a giving and nothing's priority, you know, that the classic you can't boil the ocean piece. But but absolutely How You Can not you know, how you d duplicate how you actually make progress. When you're talking about modernization of north of 200,000 people with national reach across incredibly complex, different business types. The structure is quite complex with a regional forces, we've got regional organized crime units, we've got the NCAA, and we've got external partners that are in some way or another involved in law enforcement, every corporate entity, every business certain scale has your anti fraud department or, or something looking into sort of criminality and ultimately, how we interact with that how we support local projects, etc. So it's a complicated base, and ultimately, kind of my job, to some extent, was trying to create some simple narratives to help actually inject some progress into some of these really challenging problems.

Ryan Purvis 4:10
What are your thoughts on the recent euro final, and people sort of running into the stadium? I mean, was there something that could have been prevented?

Simon Clifford 4:21
I mean, I mean, certainly outside, stepped on the terms of those inside, it's what I would say it's always a very delicate balance between over policing under policing. And, and equally there are very bizarre if you're a lay person, kind of things that happen because of police presence. So you know, if a lot of these plants turn up outside pubs, in some cases, a fire is more likely to break out than not, because the people are fighting it's full of bravado, they don't really want to find another piece of stuff as of If you get into the fight, that guy might kill me. So actually putting the police on the street, in some cases, even inside that piece, and again, putting people in for riot gear can be deemed as kind of confrontational by protesters. So, so there's a really delicate piece in terms of visibility of policing, but it's certainly not my specialty. You know, ultimately, I can tell you with absolute conviction that all the people I've worked with in policing, operational officers and civilians, you know, they want to keep keep the streets calm and, and prevent harm. It is very disappointing. What happened at the finals? In so many ways? But absolutely, even if we had won the game, what happened was happening on the street was very disappointing. Yeah, looking

Ryan Purvis 5:50
at the moments in Africa, so the same sort of thing, a bunch of people looting and stealing. And it's also disappointing because it's just the few we're in for the many. And that's, that's just not acceptable. And so as to how, across this, and have you used?

Simon Clifford 6:11
Yeah, so while the mapping I've had been, I adopted the concept of wardley, mapping a decade ago, that there was back back in sort of 2009 10. After sort of economic downturn, I kind of returned to England, having lived abroad for some years, and kind of threw myself into the whole meetup scene and sort of reconnected. And there's a lot of stuff going on around Shoreditch and type, etc. And there was one event called Cloud cat, which was talking about this widespread adoption of cloud back in 2009. And, and it was all it was organized in part by Simon Walter who invented wardley mapping. And he never promoted the technique, he just demonstrates that to simplify really complex paradigms. And ultimately, I'd always been at the sort of cutting edge bleeding edge of organizations trying to sort of get that next competitive budget, cetera, et cetera. And I just found it a very simple way of structuring and framing paradigms to non technical people. I didn't realize quite how revolutionary it was, at the time, it was almost Matter of fact that you're three. And this is, this is how you describe this. So I didn't realize that there was wasn't widely widely, widely accepted and no, good for five minutes. But I internalized it very, very quickly. It's a little bit like someone showing you how to play graphs. Now, once you've seen the rules, you've got the rules, it's not complicated to draw a competitive draft players is years and years of practice. And I think that's a good analogy for wardley mapping. But but but but certainly, it really came into it. So it helped me in my career advising businesses and private sector. But it really came into its own when I went into policing, partly because of the gap between business users executive management, and it in terms of the language barrier, you know, my my roles are pretty senior working with non technical, technical stakeholders, but that they kind of my tribe, I can talk talk to that. But actually, it's a non technical stakeholders really understanding that the depth of impact the technologies would have, you know, and COVID is a great example of that. All the technologies used COVID to do this type of thing, you know, teams or, or Cisco, or Skype, or any of these technologies, they have very narrow use cases pre prepared. And people are procuring things saying, Oh, well, we need this for teleconferencing. If we're doing a regional working group, we need to maybe I want to travel or if there's a sudden emergency meeting, we're gonna do we're gonna have some video conferencing, it's very 90s paradigm, wrong thinking this is transformations where we do business. And also it's a it's an element of resilience.

That is a big missed that was, and still is, to a large extent a bit a big missed opportunity, narrowing down through the process of ideation through to procurement, that you narrow down the scope based on the business case. And the business case, when you're actually in the business is just about saying, Well, what value premise Do we need to actually drop this into my use case? But typically, a lot of people in organization don't see the bigger picture. So all they can focus on is their narrow part of the business from from my perspective, and perhaps they look, you know, we don't want a different videoconference system for the C suite that we do for middle management. We don't want a different video conferencing platform. for for for corporate meetings as we do with public so that language of the day duplicating, increasing the scope is much more easily demonstrated in more the mapping but also just personally, there's there's a whole bunch of doctrines built into the thinking behind what In my opinion, again, it's very flexible. And it's not the only thing that I applied in terms of the thinking. But it's just useful to sort of as a skeleton to hang, thinking across and as a common language and common language as part of it. But things like open biasing towards open now challenging assumptions are literally wardley, mapping 101. But what's also very, very powerful about it is if you actually do a bit of a workshop, and I like shorter workshops, you know, an hour and a half, two hours is plenty. Yeah, all day or multi day are hard work for everybody, nobody's gonna go to those. But it's amazing what you can crack through in a wardley mapping session, where you're just saying, Look, just tell me top to bottom in plain language, what your what your requirements are, and then and then you can sort of go off speed and, and validate some technology, etc, etc. That's really, really helpful, because actually people placing whether something is sort of bespoke or custom built, or off the shelf, from their perspective, is incredibly, incredibly helpful. Because again, that lends to actual organizational language. So so so so what standard? What's standard language and policing is all about the trainings all around existing policing policies for within policing, that's completely normal. It's understanding the the different forms that you fill in with the statement and all charged decision, etc. Those are standardized common pieces of language that's really useful. So you want to explore those but but it's really helpful in terms of pushing against the bias towards parochialism. And one of the major challenges with power across policing is, is and by the way, it genuinely comes from the best of intentions. But while they serve our best intentions, the you know, every force wants to do the best they possibly can. But if they will do the best, they can in a different way, then you don't have any harmonization and pretty much any serious case review, you see where something's gone seriously wrong, it's because information was applied. And large time that's not because there's a lack of the key people are trying to protect individuals involved. The review is reviewing. It's just that there was a breakdown of the workflow in terms of the the information systems and authorities, etc, etc. And that's partly because of the over complexity due to sort of that protocols. And so when you're looking at sort of the national scale technologies, it's really helpful to bring people into a room from these different organizations. I mean, it's all policing to you and I in the public. But there's 43 Regional forces, there's the National Crime agency, there's regional ghost crime units, these are these are different things. It's seven things that make their own decisions. And that's just within policing. And then there's clearly a dependency, you know, to the CPS, core service, etc, etc. Yeah. Perfect, right.

Ryan Purvis 13:29
Yes. So I guess, having what's the so Walkman is from my understanding leases is two axes, where you've got your functionality basically going on one axes, you you cross, cross, calculate, I guess, to put that on the on the side, on the other axes to prioritize understanding that that's

Simon Clifford 13:52
exactly right. So across the bottom, it's basically talking about maturity. And again, this doesn't just talk to technology can talk to policy, it can talk to practice, etc, any of that stuff can be met. That's really again, that's really important. I'm sure I'll come back to it. But basically, everything comes from our point of Genesis, oh, I've got a bright idea. Wouldn't it be good if we could all work from home, right? Genesis idea? And then you go into custom bill, how would we actually build that, and you've done it a couple of times. So now you're using common components. And that moves into such a stage that we say, Well, actually, we've got something we call teams or, or Skype, and it's a product that you can actually pull it off the shelf, it'll come with those features, and then it becomes a utility, it's just become so ubiquitous to our lives. And to me that's that sounds like the journey of video comes to almost COVID doesn't it is just like, absolutely hardwired. This is a court on can't be in business without it. That's everything from electron, Sita, to phone lines, all those things. So that's sort of left to right, top to bottom. That is where you focus on proximity to us and Once again, a very important access. So the key key about polymath is positioning has meaning you can identify things by virtue, and thoughts. One way is if the top is, broadly the anchor, referred to as the anchor, but ultimately that means, you know, who is the study from what lens is this map representation? Well, clearly a map of some technology policing users, that relates to the public might be different from police, it might be different from police officers, police, civilian staff, etc, etc. So again, there's there's Because ultimately, it's about the proximity of the technology, I, if I talked to a smart speaker, I won't say her name, trigger off. That would be at the top because if I'm the user, and I want to have a query, the search enable technology, I would need an endpoint device that has a microphone. So the device would be right at the top of the map. And then you can accept while you need voice recognition that needs to connect to a server that needs to do a query and blah, blah, blah, would be going further and further down the stack. And ultimately, you know, if you wanted to host your own voice enabled querying device, yeah, where would that competed with that being on prem computer, would that be cloud computer, from, you know, our product or custom built server, that's a very special requirement in that because you need to do a budget as opposed to something else. And equally, from the left or right piece, there's some there's some really important, understanding that the position and gives you that actually, further to the left, it lends itself to agile, but agile isn't the solution to all things. With agile, there's a lot of inherent costs, you know, with rapid change. It's quite hard to scale, a rapidly changing environment, just from a training perspective, you know, if you're changing the builder software every day or every week, if you're an expert user, that's challenging you log in this morning, and it's different for what it was when you kind of you kind of want some stability. So So in terms of whilst it's fantastic in terms of rapid design evolution in Agile space, there are some things you want kind of stable, you don't want a new power plug every week, that you need to change all your electronic devices to plug into the wall with that wouldn't be healthy. That'd be kind of natural. So so the more to the right, the the lower cost and the more scalable something Yes. More to the left, the more flexible and responsiveness. And again, that's why the positioning has meaning because it informs the types of people that aren't Yeah, some people tend towards agile projects, some people tend to sort of Six Sigma projects. Actually, the mass shoot of the people is really key in breaking things down to small teams. So you know, we know this from sort of virgin or SEO, these organizations recognize small teams are enormously valuable. But the right people in those teams, you know, if you've got somebody who is completely focused on procurement processes, pace, isn't there top of their agenda, procurement processes. And on the right hand side, when you're spending 10 million pounds or more a large amount of money, private or public. You want to go through those steps, but equally, not at the cost of the wider benefit. Pennywise pound foolish? Yeah, yeah. Does that give you a bit of an overview that that's, that's clear?

Ryan Purvis 18:32
It does. You know, in my head, I'm trying to trying to apply it to a project. And I'm trying to think about what are the questions you ask, like, how do you start? And then how do you make sure you know, it's almost that all you do, right? You know, always have a negative image of this, right? Yes.

Simon Clifford 18:48
So So I give me an example. So early in my journey in policing, I went to New Hampshire police, I was there director of digital transformation that working for the PCC there who had a real focus on a digital agenda and was was recognizing as an elected piece of crime questions cyber crime being one of the areas that he recognized was he wasn't in the in the public Zeitgeist as much data as it is these days will be it could still I would argue not enough. So I set up a cyber cluster, the first cyber class of coming out of police headquarters. This is back in 2017. I think. And, and what we had is, you know, this is a function or temperatures, very geographically central to the country, the coastline is quite cheap. We got a lot of back office function. So we had small businesses SMEs and also corporate businesses, and we invited sort of people from their security teams come along, and we'd have people from policing so we can have this regular dialogue as is a regular monthly meeting. It still goes on to this day that happened that the customer Hello. And one of my early conversations was, yeah, what's it like? working here? Please? Do you report all your incidents? And the answer is no, absolutely not. Why not. But if you go online, online, they don't. They don't know how to respond. They say generation flawed and the action for is, is imperfect, because I want to be sensitive to my colleagues, former colleagues, but it's very lengthy, and it's very one size fits all in terms of the response. So whether you're, whether you're a cyber professional or Joe Schmo public the steps, you can go through exactly the same. And long story short takes 45 minutes to report and long story short, there's an overwhelming amount of traffic going in there. And a lot of extra jurisdiction, why it's very challenging for you can enforcement to do much with it, because it's coming out of Russia, or another status that's outside of our jurisdiction, it becomes inherently more complex. And again, there's, there's there's a law of diminishing returns going on there. So ultimately, it was about applying kind of the body mapping techniques is about understanding the user and the user was the reality of public protection or government is his money follows demand. In the best case, you have to be able to demonstrate the demand to say I need money to solve this problem. Because what problem, what's the measure? Or what's the metric that I'm actually wanting to spend money. So clearly, there's a there's a real negative consequence to people not recording cybercrime. But equally, you can see why they don't because they're being they're being attacked on a daily basis. And they'd rather spend the hour limiting the damage or stopping it happening again, then something that they do to help police out an organic return. So that so that was a problem that expanded upon and I use wardley mapping in terms of understanding what we needed to do.

What we need to do is have a really lean approach to getting incidents reported. And off the back of that using mapping, I broke down what what was the requirement, what was the benefit to place a claim. But fundamentally, from our side, if you if you do report that crime, and it does get picked up, it will go to actual fraud, and then we refer back out. And we put investigators on it. And that's old school police, in terms of they would come to your office, and they would look at computer drive downloads and log files, and then they're trying to do all that forensics. And that was an incredibly expensive process, especially when the Bob, it doesn't scale to cybercrime, and develops nine out of 10 times is going to come from extra jurisdiction, which means it kind of stops there, you know, we can send an email to another doctor. Right? At that point, it's pretty hard. And again, law of diminishing returns, we don't have infinite resources. So what we created was, ultimately the user need, we need the metrics are saying, a, what's the volume of actual cyberattacks? And be what's, you know, what is that extra jurisdictional piece, there's a lot of other countries that aren't UK. So, you know, we want to inform our, our partners and by the government to say that if you're, if you're going to go seafood, and if you're going to go to India, if you're gonna go to North Korea or whatever, be armed with the status and this, this level of threat is coming from you. So So, you know, wardley mapping was approached by which we could break down what the requirements would be allowed us to importantly, take a lot of technology that was basically off the shelf technology. And again, there's a, you know, tend towards off the shelf, use open standards. And again, I'm sure a lot of your listeners, this is very native stuff. It's just like, what's your take off? Yeah, in tech terms, it's what's your technology stack? And ultimately, it's a stack, it connects together seamlessly, what are the requirements and needs to do, but ultimately, when you're creating something that hasn't existed before, there's some particular user requirements around that in terms of, you know, making it, you know, what's the benefits of policing? Well, we want to capture it better. We want to focus our attention on the stuff that adds most value, and then ultimately, get a prosecution. So it needs to be submitted in log files, are not particularly friends that thing that they're just text on a server. You do get vexatious complaints in place, it's a minority, but we also always have to be critical. You have a critical eye to any report a crime. You know, not every rape report is, is true. Undoubtedly, most are but somehow vexatious. I'm angry with this, this, this formula, I'm gonna say the right way, because people do these terrible things. But likewise, you can apply this to your need, you know, you need really good, evidential kind of script. So So Craig's the system is basically But based on corporate seen products, which small businesses can't afford, but put a layer on top, and when you map that, it basically says this is our existing process, this is the stuff that you can't get off the shelf, you know that the stuff that makes a recommendation, the submittable, that the deallocates attack, etc, etc. And ultimately creative quid pro quo, because then again, working with the user, another core premise, within the wardley mapping doctrine or good practices, is understanding the need and ultimately one of the bigger needs was whilst whilst having very senior stakeholders come to this meeting, techies are often the analog one, we power the businesses. But technology is often not loved. And, and, and the security subset within that technology. grouping is love the least. Right? So. So when you're, if you're seizo, and you're asking for more money, your native language doesn't work well with your board. So actually, we picked up that as a requirement from their side effects. So So long story short, we were able to frame the user needs from the client side, either member of the public that we'd like to report, criminal incidents, make approach and approach was very, very, very simple to use. And the net result is something called police cyber alarm.

anybody, anybody in the UK can use this technology, it can be applied for you, but please, it's paid for by police. It's free of charge. And ultimately, it just allows you to share log file data in real time you download the software, you sign up for the program, you know what it's collecting. There's no, there's no personal data about it. But ultimately, it will analyze those log files in real time for attack vectors. And ultimately, we can capture that information. And that is really harmful to us in terms of a if there's some serious criminality, investigating that criminality, taking it to court. And importantly, getting a lot of that scale of demand. And that's really, really helpful when you get these emerging new types of crime coming out, because it's about satiating the the demand, how can we quickly identify that there's a new service demand, again, which could never have been done that the required pace of cyber and actually being able to deploy effects? We can do this by creating this kind of sense network. Now, that couldn't have been achieved within a reasonable time scale timeline. And again, there were there were there were other projects that I became aware of, and after, I'd kind of built the stuff that had been in during the rounds that were just saying, is there a way we could get technology to identify international threats on its own, and some significant money was received and invested in different places to that and failed, because the approach was right on the cyber alarm pilot technology that is largely, it's mostly tweaked today, but it's largely what I built for five years ago. Best part of three, four months, that's including the whole internal internal process to get sign off. So we got an external sign off and built a solution in sub six months, this now rolled out technology that was only going to go from strength to strength. And, and that was because we didn't do that effort. We did the little thing that wasn't already out there. We reuse as as possible. And we and we, and again, this was 2017. And I thought, come on, I think big start small scale fast. I didn't coined that race. And it certainly wasn't fresh in 2017. But going out the gates and that this may fail, and if it fails, that's not wasted too much money. But if it succeeds, we don't just need a cyber response in Northamptonshire. We've got to think national. So from the outset, we said, well, how does this model in and again, that's where actually the the wider structure and the existing backbone police technology programs work? Well, because I pass it off, I'm shot with with with sovereign funding from from Northamptonshire, and then to extend the pilot to these millions region. We're trying for another year. I just connected into a national program that was already looking to invest in the stuff and they knew all the problems that have no idea in terms of dealing with the solutions or having no idea there was still struggling with with with some of the solution. This here is pre made. Solution we've already tested in one case, one county in this region, how about we expand out we did attempt successful and now that's a national rollout. And arguably, that could go out multinational. The principle is, there's no point in deploying technology if it's unaffordable. The principle is no, it's really more about the thematics approach of trying to do business, it's about being more competitive as your overarching piece or delivering new services for people like, but not trying to create something that's so far beyond the realms of possibility that will put you out of business putting all your all your profit into there forever. So you've got to sort of put a dose of pragmatism. But but but equally, I would argue that this is incredibly useful in sort of national program paradigms is that a lot of misinformed outdated thinking going into large scale procurement says we have to have one solution, which does all of these things? And you know, from from a small business outlook as well. Yeah, that's good enough for E RP is a good example. You know, you look at if it's a million pounds, it's a year project. Well, what does it actually do?

invoicing on a payroll, I get all those things, but little amounts of money, how about I just bought all those cheap things sorted together, and it gives me any RP for a 10th, or 100 cost from me as a businessman, wouldn't that be sensible. And that's where public sector needs to sort of wake up to, but it's one of those things that it's just not helpful to tell people, you're right, but I'm right, you're wrong, you have to come with you on the journey. And that really lends itself to the stakeholder piece, which is why mapping is so helpful, both from the user perspective, but also at the corporate, because there's a real distance between sort of sea level and the middle tier. So you might have great vision at the top, but it's implemented poorly, because, you know, lots of translations somewhere down like you can, you can bring people around the table much more effectively with techniques like this. And I wouldn't say, of all the map is perfect for everybody. But for people that go through the process, that's helpful. And that allows you to synthesize much high quality insights, and most importantly, get effective results. You know, I applied this technique to every project I was involved with. And I have a pretty good reputation in terms of actually delivering progress, consistently delivering programs on time, typically under budget, because the technique of just duplicating. I was always going on about, I want to know, I was really a real fan of not invented here, if somebody else has fixed this problem. And it's, and it's, it's and it's a former, it's got the oldest resorts, why would I want to try and reinvent that? Yeah, that still happens party much. Yeah,

Ryan Purvis 32:36
some banking examples where I remember meeting and you find out that you've got 25 tools to do the same thing. Bring the 26th one, because you know, that they've been enamored by one piece of functionality to bring, instead of paying back the 25, down to three or two, whatever the thing is, because,

Simon Clifford 32:57
frankly, it's a great example, because it's such a highly profitable sector, you can hide in the private sector, you can hide a lot of technical failure in just right. And certainly, you know, how do you measure what's the right amount of money to spend on something? And certainly, that's something I've looked at within policing. So we spent about a billion and a half pounds a year on technology. That's that's everything. Kind of everything. It's a it's an agreed number of years ago, people hardware software, you know, the whole oversight, that's on the 12 and a half odd billion kind of spent? Yeah, so that's about 11.3 4.4%. Which, if you compare that to private sector, banking securities are typically at the upper end of that at about six 7% of their turnover is that suppose, but things like, you know, constructions in the light one the half, was mostly its materials and people but but but but if you take that one and a half billion say, Well, actually, we're 12. What do the masses it's best Delta bank, maybe half a billion pounds. And that and and that's compared to banking and security. And I'll tell you, we hemorrhage people all day long term bank. All bank fraud departments or like a former police officer, right? And yes, and no, we give them really high quality training. They are they are motivated to do good and they'll get 20 grand bump, pretty much out the gate, whatever else going across the corporate. So banking is paying more for its people, but it's still paying a large degree less. And that's partly because of duplication, outdated techniques. And again, it's not that we have bad people. It's not that we have bad thinking. It's about the frame of reference. It's what you can see it's Blinken visibility. And largely that's about security. That's about culture. You know, security, security, security, the first three, three questions you need to talk about when you're talking about technology in place, they are equally in terms of there was all kind of recognizing that, you know, if you wanted to do things quickly do them on your own. You want to do them right away, you don't get there, but slowly. And ultimately, lack of pace is a death knell to programs, because it just creates this expectation. That's Yeah. Yeah. So many programs are like, you know, this is gonna be amazing, this is going to make this all better. It's all going to be shiny and amazing. It'll be here in two years time. Yeah. And you pretty much know that you've already switched off most of the audience because particularly, and again, in policing, there's there's there's you guys in the corporate world in terms of people's people staying within within roles, but, but culturally, for certainly for for warranted officers. If you're going up the kind of going up the ranks. Certainly above certain ranks, there's an expectation that you understand the whole business, there's a lot of departments in placing Cisco that's crying to neighborhood policing. So there's a different unit. So if you're going up director and spectrum above, you're expected to have a good understanding of all the different areas of policing from the control rooms, a firearms, police, etc. So what happens is your cabinet tenure of maybe two years per job, so if you're 612 months into a role, you're only going to be there another 12 months, and then you'll be cycled out. If you are sitting now on a board that's gonna deliver in two years time, you show up, and you will read papers, and you'll give them your two pounds worth, but you're not going to, it's not going to impact the output the you're going to be responsible. You're paying it forward, right? And that's fine. But equally, something said, Look, by the way, you have this massive challenge, do you want to do well, and I'm going to drop something that's going to start actually give me positive impact within three months, the attitude completely changes, right. And I'd rather give something substantial, something less but quickly than normal. And it'd be two years away, because that two years will invariably slip to three and four and beyond. And there's countless examples of why across government and private sector.

Ryan Purvis 37:26
Yeah, that's exactly what's far away with this. It's easier to expand it or something. If he says, No, it's something that I appreciate about the agile approach where you're releasing something every week. And you experimented with it, as opposed to some sort of Big Bang, approach.

Simon Clifford 37:48
But it doesn't scale to under 20,000, offsets, right. You don't want to be releasing, you know, people that literally have a whole very full day, every single day, they come up with a plan and what they're doing is incredibly important, not knowing how to do something. So that's done wrong. That means that you can't actually get prosecutions on something very bad. That's unacceptable. So So it's about you know, going through prior, but just concatenating the timescales, concatenating, the expectation that fixing everything, and working to the thematic, how do we make AI and automation are really good examples of that. And certainly another element of the wardley map piece, and something that I've been really focused on over the last couple of years in policing. And also in with Michael, the money company, is about layering different strata within it. So So if you take the example of sublime or public contact or various other things, it's about like, here's our processes. Here's our technology. And that's it. That's very conventional. And there's a great report for people who want to know more, if you look on to search on Google, or any such thing for for gchp born frogs, and again, that talks about how Jesus using this technology to unpick really complex technologies years ago, and again, it was applying this technology and again, AWS uses this approach as well. But But ultimately, breaking breaking things down to small steps, but also understanding you know, when we talk about the cyber peace ledger when we talk about a whole bunch of consequence library there's different jurisdictions in terms of legality there's ethical postures to consider right so that can be mapped to you know, what is the maturity of the ethics around using automation AI in identify famous? Yeah, it's quite mature set set. Using gait analysis or facial recognition. A the technology is less mature, be the ethics Definitely not as mature as it should be. It's, it's more mature than it was two, three years ago. And some, some, some, some positions have come out of the Information Commissioner's Office. But again, you can map that in terms of its maturity evolution to only get more understood, not less. And that's helpful. But you know, when it's when everyone accepted, it's ethically okay to do use technology in this context here. You know, and, and from my perspective, once you identify that this is something that you kind of need to get to a good communicator starts, you know, from, from my perspective, using AI to identify weapons on CCTV is, is really good use of AI. But ultimately, there's 100,000 cameras across London, have identified some of these walking out with children on carbon, ak 47. You don't have eyes on 100,000 cameras simultaneously, I can pick that up and say, Hey, Bob, Mr. Operator, maybe you want to look at this, I think I've identified a demonstrate, I don't think many of the public will have a problem in us using artificial intelligence for that. I do think people in here would have a problem in terms of sort of a Chinese esque kind of monitoring of our whereabouts 24 seven, and those are poles apart the technologies in common. The applications, that's an ethical piece, and from my perspective, just get over the line, do the ethical consideration, make a call, make that broadcast and publish it? every police officer can go into that, and that links to some of the work I was doing around standards. And that sorts of technology and data standards, and again, make a much more open band aid for partners and technology provides that service better in terms of what is up a connectivity standards, but equally, what are our ethical standards and wider pockets? Because actually, we want the private sector to build better solutions for us. So we want to pick off the shelf wherever possible. If you know we have we have this money to spend, we've got the budget, let's just spend the benefit of a better public protection like

Ryan Purvis 42:00
facial recognition because I remember reading something about Clearview there was a company in the states that was doing their processing all the faces of Facebook or something. And the US various legal arms. Actually were not allowed to use it. Because of ethical issues, which I did agree with we caught on.

Simon Clifford 42:23
Yeah, yeah. And again, this is where you need to unpick it again, this is not about me, I'm not professional ethicist, but you can place where ethics should be in the in the process, you know, you want to tick a box that says proper ethics has been looked at. And again, not the technology like saying we want to we want but a body worn video body worn video, the business case for that going through to policing and it's pretty much ubiquitous in UK police in our use case was fundamentally about what we call internet professional standards. I defending police officers from vexatious complaints, somebody gets arrested, they don't like being arrested. So they're gonna say the police officer hit me and treat me badly. So if you've got a video you can say this is from when he started in the van, nothing happened, those complaints dried up overnight. But equally if somebody did, that same video is going to be used to display that or remove the offset swipe. We don't want officers that act improperly like that. So that's a really good thing. However, it evolved into much greater things people were self improving. You know, we've got this government policy 20,000 cops, that means a lot more newish cops and and experienced officers will tell you there's only so much you get from the training a lot of what is being a police officer is experience of doing and in many cases people are police officers because they want to be good and effective and better and got really good quality police officers okay is that using this material to review how they how what their interaction was with with with with somebody that they've arrested so they can answer it? Yeah. So they can think Oh, good because again, when the and I hear this I've never done it. But you know when the adrenaline's up you know you forget what you said, but you've actually now got a perfect representation of ice and yeah, he said this I said that he said this I said that I could have done that better and it's something that was nowhere to be seen in the business case. Because it's actually not an improving quality.

Gerard McGovern 44:40
Yeah adjusted to the police in the UK were kept body cams like the

Simon Clifford 44:46
honoree absolutely very widespread. Yeah, body worn video. But again, that's what's the wide range IP is how long we retain it. We have something called MFI management of police information. And have videos within that. And again, depending on whether it's use for prosecution. If it's not then then the general practices, it's a little bit of 30 days, because you've retired 30 days in case a complaint comes in. Yeah, yeah. But then you believe it because not use evidentially.

Ryan Purvis 45:17
Did you hear that all sort of, you know, cloud environment with being processed by algorithms looking for things that that comes out of business at the time.

Simon Clifford 45:27
Now, this? Exactly. I love the way you're thinking that's exactly the way my mind thinks. But absolutely. That is incredibly contentious point by certain people. appropriately, we need to considered the negative consequences of that. But consider the maker position, you know, police say, you know,

what, former colleague, I was an active superintendent, taught me so much about policing, everyone to everyone is that for that? I'm one of the things is just this, this understanding that, you know, a police officer can take life to save a life, he can make a judgment to kill somebody to protect that person from killing somebody. And they have what they it's a lawful thing to do, as long as they can basically explain why that was the case. So, yeah, so ultimately. So ultimately, you know, we imbue on all of our of authority in our barns and officers, yeah, the Queen's wanted to deprive somebody else at the Liberty, that's a serious thing. But equally, the technology, we can't just assume that we can look at it for all other kinds of things. So so there's, you know, there's always a proportionality piece that comes into this. And this needs to evolve. And that, again, lends itself to the evolution of practice. Because again, I use the example of identifying guns. But you know, if you understand AI, it's just patent analysis. It's just say, I'm looking for an object that the AI doesn't know to go, you just trained it saying, these types of things that happen to be guns. Well, the same technology can be used to use your face or your haircut or your shirt or your logo, your license plate. So the blanket same police shouldn't use AI, it's the same way even for identifying guns in the street for morning terrorist attack like Paris, wouldn't it be good to be able to shut that down pretty quickly? Oh, yeah. Well, in that case, well, is it blanket or not? Now you give them one reason why it's appropriate. But equally you kind of need to unpick that.

Ryan Purvis 47:34
Yeah, that's one of those sort of criticisms of the Amazon devices is that they have to listen to you in order to trigger. Which means they are, in theory, hearing what you're saying, even if they're not recording and they could be. Yeah, I think Kevin Kelly's stuff, it wasn't called the 12 inch realities or something, one of those things is your data is going to go in the cloud. And it's going to be used, it's up to you to decide how much of that you want to be there. I think that's,

Simon Clifford 48:06
yeah, I'm no super specialist on hands. And I don't want to pick them out particularly, but just, you know, smart speakers. It has to be listening for the trigger word. And that is I understand kept locally, only triggered activation work. That's certainly the line that they've been putting out and, and likewise, increasingly on phone devices as well. But you know, autopia also translate with Google, all these types of things that's done on the device, you know, whether you trust or not that they're secretly taking, that there's a lot that's a lot of data if you take in real life.

Gerard McGovern 48:44
Right, exactly. That I mean, I've not explained to my parents,

Simon Clifford 48:47
this case, all of that chatter, quite frankly, I mean, even if you justify it, but but but again, it's a lack of understanding people just emotionally jump to conclusions, if you say, like this. But you know, policing is explainable. We do this, because we've made this decision. We think this is a proportionate. There's, there's, there's checks and balances.

Ryan Purvis 49:12
No, and that's it. I mean, I've tried to explain that my laws and my parents that didn't, you know, these devices are doing these things a certain way they wouldn't be doing accepted an industry if they were not doing that, of course, in that stage where they actually were taking their recordings to a centralized place where contractors were actually reviewing the data. But as I say, there's almost there's a convenience residue introduced off our app so well, I'm happy for them to hear my recordings. As long as it's it's better. And I'm not talking about the things that I'm worried about the recording. Yeah.

Simon Clifford 49:54
What I would say is government issues. technology isn't isn't in a vacuum. Okay, and this is what this is one of the really major things that people miss, you know, jumped on the morning terrorist tagging using identify. But equally cybercrime, malware you know romance fraud, all these types of things, no software on your device that's waiting for you to sell your house, you can sit there for multiple years waiting for that transaction so you can see and take your money, right and your What do you want us to protect you against that? Because ultimately the attack vector is enabled because you're using this technology, laptops and phones and stuff? Do you want police to protect you in that part of your life or just say I saw penalty policing out there because that is where criminality is moving to, has moved to. And it's a multi billion pound pound dollar business. And if we just say it's off limits, we're basically saying everything digital is the wild wild west, good luck. And I don't want to live in that world.

Ryan Purvis 50:54
And I saw an article the other day saying that there's actually VC funders for ransomware teams. So you know, that's become an industry on its own. And further to that, I actually was reading something that people that have taken out an insurance for will use your cyber insurance really, from being hacked to being wrenched away, the premiums are going up by three 400%. Because it's just happening so often.

Simon Clifford 51:24
And what it covers and what it covers, I mean, it may be able to cover your technology will uncover your restoration data, it's certainly won't recover your the loss of value in your organization if it's publicly listed. Right. So again, there's, that's one of those areas that there is so much ground to cover. And we're not aiming at a target, we're standing still, the threat vectors is evolving super rapidly below, I'm conscious of time, but I don't want to leave this on our dollar. But the reality is we have enormous resources, a billion and a half, but it's a lot of money. And that's just in the UK. And we work very close with Five Eyes partners and wider, wider partners, Europeans, your opponents, etc, etc. We just need to get better exercise and spending that money well and sharing good practice. And certainly that's what I'm focused on in the private sector, because ultimately, government is recognizing the public sector as a partner in this. And certainly, I'm trying to help catalyze how that works together. I did project earlier this year with Kevin office. And again, just to reassure people below this is across 80,000 us around a cause multi agency. So it's a real example of technologies being used for environmental resilience. So yeah, big snow storm off, we have some other issues as a platform as a geospatial platform. But now Kevin offers high helped work with some technology pros, very large, global technology providers, I prefer not to use their name. Everybody knows who they are, knows this organization by sharing geospatial data around traffic incidents so that crowdsource data can actually be used to to allow us to identify accidents quicker and getting people responding to people with ambulances a million services through that technology. But the important point of that, other than its inherent value, is the approach that we took was wherever possible reusing technology, and we had goodwill from the private sector organization provide that data for free. And we entirely reuse existing technology. So the net cost of that project rolling out to every police force, Fire Service ambulance service in the country, with a net incremental total of zero. We did it in sub two months, we enhanced that capability across the piece that does us. Bad news travels fast. Doesn't even notice. Yeah, there are examples were using this technology, encrypting incredibly powerful words. And that is a tip of the iceberg where we can take this stuff.

Ryan Purvis 54:01
Fantastic, it's a great place to leave it. If someone wants to get in contact with you will be the best way to do that.

Simon Clifford 54:07
You can just come to the website, Cliff 42. That's the number 40 or just email me Simon accurate 40

Ryan Purvis 54:17
Where does the 42 come from?

Simon Clifford 54:20
So it's about avoiding going off click effects of situational awareness. And actually, it's about asking better questions. Well, the ultimate question I'd like the universe, everything is what the answer is 42. It's not the answer. It's about asking the right questions.

Ryan Purvis 54:35
Super. Well, thank you guys for having us your time today. And it's been great to listen to.

Thank you been a pleasure. Thank you for listening, today's episode, and the big news app producer, editor. Thank you, Heather. for your hard work for this episode. Please subscribe to the series and rate us on iTunes or the Google Play Store. Follow us on Twitter at the DW w podcast. The show notes Some telescopes will be available on the website WWW dot digital workspace that works. Please also visit our website www dot digital workspace works and subscribe to our news. And lastly, if you found this episode useful, please share with your friends and colleagues

Transcribed by

Simon CliffordProfile Photo

Simon Clifford


Ability to see the big picture of complex technology environments, finding the sweet spot to drive transformational change.
This mostly involves harnessing data, through cloud compute with AI and ML.
Currently driving innovative projects in Policing, including Digital 101, and Cyber Alarm.
Drawing on over 20 years experience of leading digital projects. - Twitter: @simonaclifford
Specialities: Digital strategy, ArtificiaI Intelligence, Machine learning, Cloud, Serverless, Transformational Change, Project Development, Stakeholder Engagement, Disruptive Innovation, Blue Ocean strategy, Public sector, Commercial engagement.
Subject Areas: Cyber, Cloud, Data, AI/ML, Bots, Analytics, Digital Engagement, Wardley Maps