The open source of freedom

IT in the NHS is in a pickle, and it was in a pickle before the May 2017 Ransomware attacks. Here in Northern Ireland we were fortunately spared the problems that occurred in England, and a large part of the thanks for that has to go to our skilled and dedicated IT professionals in the HSC (what we call the NHS over here), who worked round the clock to protect our vital systems.

The pickle has a number of elements. Perhaps the most obvious, and certainly the one that has received the most comment, is our over-dependence on legacy software that often cannot run on modern operating systems. Many PCs in the NHS have to remain on Windows XP because they simply will not run on newer versions of Windows, and there is no easy way to get the software updated. Often these systems were procured poorly (no future-proofing built in), specified poorly, the original vendors have been bought over and the product "sunsetted", or the licences expired. So we have ended up needing to retain networked obsolete (and vulnerable) systems in order to keep running with business as usual.

Another element (and don't get me wrong - I actually like Microsoft, and in general I think they do a good job) is the fact that many NHS systems are nailed to Microsoft. And we pay for it big time. Think of all those Windows licences and MS Office licences that really (seriously) aren't all that necessary for vast swathes of our staff, but we're paying anyway. We're paying, as a health system, many millions of pounds (you really don't want to know how many millions) for the privilege of having one company provide the exclusive infrastructure that powers most of the NHS. This seems a bit weird, but wait - it gets worse.

This is the one that boils my piss, if you'll excuse the expression. There are known security flaws in Windows. Known. "Known to whom?" you might ask. Well, they're known to the United States National Security Agency, who use them in their cyber-warfare. Of course we small people and small organisations like the National Fecking Health Service are not told about them, but spies who are supposed to be protecting the "free world" are well aware of them. The community can't know about them because the source code is proprietary, so the only people who know about these flaws are Microsoft and the NSA. And the people within the NSA and hackers outside the NSA who may (who knows? They're hardly going to tell us) leak and steal these vulnerabilities respectively. Well, MS knew the particular flaws in this instance, so they had a patch in place to fix them. But since Windows XP is no longer supported (despite the fact that many organisations are still reliant on it), this wasn't released and wasn't applied, unless organisations actually bought it. The irony here is that from a functional perspective, XP was acting as its very own form of ransomware.

So it turns out that we can't trust our "allies" (under Trump, who is really surprised?) and we can't trust the folks who provide the OS of our computers, and we can't trust our staff to not click on some malicious link or attachment, so are we doomed to go on in this mode?

No. We need to sort this bloody mess out, and happily there are good people who have been working on precisely this. We need to break our exclusive dependence on Windows. Linux is an alternative operating system, and the most secure and stable version of this is Ubuntu. A version of Ubuntu, specifically tailored for potential NHS deployment, has been developed - NHSbuntu - incorporating full disk encryption and other security features. Plus, it's open source, so the community can inspect the code itself and any flaws can be patched rapidly without extortionate fees.

Secondly, initiatives like NHSbuntu encourage NHS/HSC staff to get intimately involved in the deployment and use of computer technology within their daily work - they shape the usage and the processes by which they deliver care. This is how we start fixing these problems. No longer are we mere recipients of IT care - we are partners. Holy cow - this sounds very much like the model of healthcare we are trying to now deliver - in partnership with our patients!

People sometimes worry about open source - if everyone can see it, everyone can see the vulnerabilities, right? The kicker is that there ARE more goodies than baddies, and the goodies tend to be single-minded geeks who want to get that dopamine hit of putting things right. The result is that the baddies have a really hard time keeping up. If you have a closed proprietary system, all you need is for the baddies to hack or infiltrate your vendor (or the NSA), and you are royally buggered. And the goodies can't access the code to develop a defence.

So initiatives like NHSbuntu and Open Source are a real boon for NHS/HSC security, and we should be using them more. There are other substantial advantages to this approach, particularly when coupled with an open data format which allows strong interoperability between health IT systems (see the marvellous RippleOSI project for an example). I believe we are on the cusp of a new revolution in health IT - one that promises much better security, functionality and user experience, as well as issuing a new challenge to Microsoft and the big vendors - join us!