Canada's push to overhaul data centers and data management

When Corinne Charette was appointed chief information officer of the Government of Canada in May 2009, she quickly discovered her responsibilities ran wide and deep. Charette's broad experience certainly helps, having held executive and information technology positions at Transat A.T., FINTRAC, the Canadian Imperial Bank of Commerce, KPMG, IBM Global Services and Via Rail Canada. But the challenges are many. She spoke with GCN Editor-in-Chief Wyatt Kash recently about her focus on data centers, information management and the next generation of electronic government.

GCN: What are your top IT priorities right now for the Canadian government?

CHARETTE: We have a number of important priorities. I would say the top one of mine is a big push on horizontal initiatives across government to consolidate and renew the back-office systems as well as front-office systems — the ones that actually sustain or enable specific program delivery.

Because of fiscal constraint, demographic, workforce and other challenges, we’re looking to foster what we call clustering, which is a consolidation approach but not a centralization approach. For instance, we have a series of science departments that have clustered around a common HR solution. And we are trying to drive that model with a number of horizontal initiatives in finance, purchasing and so on.

In the HR space, we’re also working with one of our two major ERP solutions, customizing it to reflect our new common business processes for HR which will be used by all government departments and be reflected in a systems configuration which will become standard for the Government of Canada. So anybody (using an older system) will simply adopt this configuration, either for their own use – or by clustering with other departments and sharing…at a much-reduced cost. More importantly, it will also allow data interoperability of HR information across government.

What are some of your other priorities?

Another one is renewing our secure, online identification platform for the federal government. Canada was a pioneer in government online. We got out of the gate fast, enabling online service access securely. And that’s been great. But it’s a very fast-evolving technology. We are in the process of renewing that with a robust and a more cost-effective and more technologically flexible model. That’s a big effort because it’s used by more than 20 government departments and it is on a time-limited contract on our current platform.

Our third priority is in information management. We have a dated electronic-document record management platform, implemented independently across a government. But we also have departments which are still relying on file-and-print data stores or Outlook as an additional repository. So we are working on the roll out of our information management policy and record-keeping directive, with the view that four years from now we will have all government departments on a common, well-structured platform with good metadata, with a tie-in to our library and archival folks and digital repository, and with the ability to quickly and effectively determine — when information and documents are created — what information is of business value and must be kept, for how long, where and how?

Industry and governments are trying to reverse the growth of data centers. What steps are you taking?

We have, officially, about 140 data centers across the country running a wide range of applications. And we believe we have more single-purpose installations. There are a couple of issues with this. One, it’s very costly and secondly, with server virtualization and affordable bandwidth, it's no long necessary. So it’s a definite goal in Canada to reduce this dramatically over the next five years.

Do you have a target?

Well, for now it’s only a personal target, but I don’t see why we would have more than 10 across the country. It could be a little more than that. We’re doing this in three different waves. Right now, we’re at capacity. In some areas — for instance, in Ottawa, the national capital area — we have quite a concentration of data centers. And a lot of them are old and really taxed. So we have a very short-term remediation initiative to buy us time so that we’re able to continue until our two next initiatives come online over the next three to five years.

The second important initiative under way will have three agencies contracting individually in a shared facility, operated by the private sector, which will meet our Tier 3 [resiliency] requirements for data centers. We want to rely on the private sector more and more. This would be secure space outside of Ottawa proper, from a disaster recovery and a redundancy perspective — in another electricity grid…with space available starting January 2012.

And our third and most important initiative is we’ve just launched a cross-Canada study of all of our data centers to get a better handle on where they are, how much space is required and come up with a strategy to consolidate, over time. We’re looking to leverage the private sector’s expertise, as well as potentially partner with other provincial jurisdictions. It’s a capital intensive area and we’re not comfortable staying in this all by ourselves.

How do the prospects of cloud computing factor into your data center consolidation plans?

The federal government in Canada is very interested in cloud computing from two perspectives: One, from the perspective of a government-specific cloud [where] government departments — not all, but many — will go out and provision their own physical servers and/or create their own virtual servers. We believe that a governmentwide cloud would allow us to consolidate physical servers, which would have green sustainability benefits but will also help us to foster greater interoperability between systems and leverage expertise in virtualization, which is not necessarily available everywhere. We’re also looking at using public clouds outside of the government firewall, in cases where security is not an issue.

How are you approaching the need for better identity management and authentication?

Certainly at our federal level, secure employee access to government networks is already our standard policy and operating practice. And if we’re accessing government systems from outside of the firewall, it’s with PKI keys, so we’ll certainly continue that way. The challenge in Canada on identity management and authentication is to try to do what the U.S. Navy is doing, combining system and network access with physical access through a common, chip enabled card. We haven’t quite worked out the business case that’s required to do that but we are looking at it actively

From a citizen-to-government access, well, that’s our whole secure-channel, government online that we’re in the process of reprocuring — our next-generation online authentication services. The architecture [involves] a federated model with a broker that is able to accept secure external credentials. The problem we’ve been seeing is that the citizens who interact infrequently with government tend to forget their passwords. When they do, they turn around and reapply. It’s just inconvenient and inefficient.

What steps are you taking to make your systems more secure?

We’re tracking right along with the United States. Cybersecurity is a top priority for Canada and is addressed in Canada by two lead agencies. Cybersecurity of government systems is under my policy area and one of my responsibilities. Cybersecurity for Canada, writ large – for example when considering private-sector infrastructure and systems – is under the authority of Public Safety Canada. They are actively engaged in developing the cybersecurity strategy for Canada and it will reflect a lot of the same elements that the U.S. cybersecurity strategy has. We also work closely with Communications Security Establishment Canada, which is our equivalent of the NSA. They’re the ones that have the in-depth knowledge on the most current technology, different techniques and threats that may occur. And finally we have another center for Canada, out of the Department of National Defense, that monitors cyber activity and detects and reacts to incidents.

What else are you focused on?

Architecture is essential. But what’s important is also applying the architecture, as opposed to just conceptualizing it. So we are taking the government services reference model…and working at a more granular level on enterprise architecture for our information management program and security architecture for our security-related domain. We’ve got a long ways to go. We plan to roll out a series of pilots which support a common architectural platform and which will enable interoperability. It all starts with a strong, common enterprise architecture standard.