From Andrew Tranham

Dear Mr Taylor

FREEDOM OF INFORMATION ACT 2000 - INTERNAL REVIEW

1. I am writing in response to your e-mail dated 8 September 2010 in which you requested an internal review of your request for information under the Freedom of Information Act 2000 (the Act) about the Ministry of Defence (MOD)'s compliance with HMG Policy on the Procurement Process for IT Projects over £1M. I have now completed a full independent review of the handling of your request and the substance of the response you received. The purpose of the internal review is to consider whether the requirements of the Act have been fulfilled. The scope of the review is defined by Part VI of the Code of Practice under Section 45 of the Act, which can be found at: www.foi.gov.uk/reference/imprep/codepafunc.htm#partV1.

Handling

2. In conducting my review of the handling of your requests, I have focussed on the following requirements of the Act:

Your request, which was received on 2 August 2010, did not did not receive an acknowledgement or a reply until 8 September 2010, some 26 working days after your request was received. This was slightly outside the timescale set out in Section 10(1) of the Act; however, an apology and an explanation for the delay was provided in the reply.

Substance of the Reply

3. Your request for information was as follows:

“Existing UK HMG policy states that Open Source software should be considered along with proprietary software for IT procurement.

The policy was strengthen (sic) in 2009 to state that IT suppliers must show they have considered open source, and where it is not selected, to explain why.

http://www.cabinetoffice.gov.uk/media/409088/pffg­_coalition.pdf

Given the current tightening of budgets it is imperative that all Departments follow this policy.

Please can you state, for IT procurements currently in process today (31/07/2010) where the IT spend is likely to be over £1 million, where the above policy on Open Source has been applied, and where it hasn't.

In your response, please list each of the £1m+ projects and their purpose.”

4. In their reply, the DE&S Policy Secretariat Weapons (DE&S) explained that the majority of MOD IT systems, services and applications are procured commercially and therefore the MOD does not control the software which is used in the construct of such products and services. Therefore, the supplier, and not the MOD, will assess the appropriateness and the benefits of Open Source Software (OSS) against a range of criteria on a case by case basis. MOD does not carry out central audits of individual IT contracts to ensure that they contain a clause reflecting the Government Guidance's on the use of OSS or to ensure that contractors have complied with the guidance. The responsibility for overseeing that these requirements are achieved rests at individual project level and consequently I find, therefore, that the information you have requested is not held centrally by MOD.

5. During the course of this review I ascertained that there are currently 277 new and existing ICT projects with a value of over £1M, as at 31 July 2010. To identify the information MOD holds in the scope of your request would require the examination of the documentation relating to each project to determine whether OSS was considered, and whether or not such software was selected. It is realistic to say that to retrieve each file from the various departments of the MOD and to peruse it would take, on average, one hour per file which equates to a cost of £6,925. Additional time would also be incurred in collating the information to provide the information in a suitable format to meet the terms of your request. As explained by DE&S, this would exceed the cost limit of £600 by a considerable margin and as such Section 12(1) of the Act is engaged. As stated, Section 1(1) of the Act does not oblige a public authority to comply with a request if the authority estimates that the costs of complying with the request would exceed the appropriate limit.

6. Whilst Section 16 of the Act places a duty on a public authority to provide advice and assistance, so far as it is reasonable to do so, to persons who propose to make, or have made, requests for information, this review has not identified any realistic refinement which would bring your request within the cost limit, since the information you have requested is not held centrally. I note, however, that DE&S provided a helpful explanation of the procurement process which included an assurance that all software, whether proprietary

or open source, is evaluated and accredited by MOD before it can be used.

Conclusion

7. In conclusion I find that:

8. I trust this explains the MOD's position. If any aspect of this review is unclear, I should be happy to explain it. If you are dissatisfied with the review, you may make a complaint to the Information Commissioner under the provisions of Section 50 of the Act. Further details of the role and powers of the Commissioner can be found on his website at: www.ico.gov.uk. His address is:

Information Commissioner's Office

Wycliffe House

Water Lane

WILMSLOW

Cheshire

SK9 5AF

Fax: 01625 524510

Yours sincerely,

Signed

Andrew Tranham