Report of the Senate committee on Post Audit and Oversight (under the provisions of Section 63 of Chapter 3 of the General Laws, as most recently amended by Chapter 557 of the Acts of 1986) entitled "Open Standards, Closed Government:ITD's Deliberate Disregard for Public Process " (Senate, No. 2612). |
June 2006
Senator Marc R. Pacheco, Chair
Senator Susan C. Fargo, Vice Chair
Senator Robert A. Havern III
Senator Steven A. Baddour
Senator Richard T. Moore
Senator Steven C. Panagiotakos
Senator Robert L. Hedlund
It shall be the duty of the Senate Committee on Post Audit and Oversight (established under Section 63 of Chapter 3 of the General Laws) to oversee the development and implementation of legislative auditing programs conducted by the Legislative Post Audit and Oversight Bureau with particular emphasis on performance auditing. The Committee shall have the power to summon witnesses, administer oaths, take testimony and compel the production of books, papers, documents and other evidence in connection with any authorized examination or review. If the Committee shall deem special studies or investigations to be necessary, they may direct their legislative auditors to undertake such studies or investigations.
Jesse L. Stanesa
Director
The Committee would like to acknowledge the contributions from Senator Pacheco’s office, including Mary Wasylyk, Chief of Staff; Jessica Nordstrom, Policy Analyst; Kristen Green, General Counsel, and Meghan Reilly, Communications Director.
· Executive Summary ·
On August 29, 2005, the state’s Information Technology Division (“ITD”) issued a proposal to make sweeping changes to the state’s information technology infrastructure. The proposal, called the Enterprise Technical Reference Manual (“ETRM”) includes a provision that would make Massachusetts the first state in the country to require that all executive branch agencies use open standards for government documents. Open standards is a policy that increases interoperability of electronic documents and eliminates restrictive licensing agreements. The Senate Committee on Post Audit and Oversight (“Committee”), with the mandate to review state agency operations, reviewed the process by which ITD developed the ETRM. The Committee found that ITD was not aware of the cost of the ETRM, the impact it could have on the state’s public records, limitations on IT accessibility for persons with disabilities, that the agency excluded key governmental and advocacy groups, and that the proposal was issued in violation of state law.
Under the ETRM, all executive branch agencies in Massachusetts, with as many as 80,000 desktops, are required to comply with the new requirements by January 1, 2007. The Committee initiated the investigation of the ETRM in 2003 after a memo from then-Administration and Finance Secretary Eric Kriss directed ITD that “[e]ffective immediately, we will adopt… a comprehensive Open Standards, Open Source policy for all future IT investments….” Shortly thereafter, ITD began releasing a series of open standards policies, culminating in the ETRM, with little or no collaboration with the legislature, executive branch, constitutional officers, or advocacy groups who expressed concern with the ETRM. The Committee made the following key findings:
Key Findings
While the principles of open standards may offer the promise of decreased costs and greater interoperability of state documents, ITD did not pursue this policy in an open, collaborative or lawful manner. Based on these findings, the Committee makes the following recommendations:
Key Recommendations
· BACKGROUND ·
On
The initiative to adopt open
standards in
To gather additional information about the proposed policy, the Committee held an oversight hearing in December 2003. The Committee invited Secretary Kriss to testify at the hearing but Mr. Quinn represented the Administration instead. The Committee reviewed Secretary Kriss’s memo, the OS/OS policy, and the provision in the capital budget. ITD had released a Request for Responses on its OS/OS policy that was still open for public comments at the time the capital budget was released.
Committee members inquired whether the OS/OS policy created a procurement preference favoring non-proprietary software vendors and questioned the advisability of proceeding with a policy in the IT Bond Bill while the agency was still taking public comments on the RFP. Mr. Quinn commented that the OS/OS policy was designed to increase competition rather than exclude vendors, that the IT Commission endorsed this concept,[4] and that it would move forward conceptually while receiving public comments. After Mr. Quinn’s comments that this policy would provide savings to taxpayers, the Committee requested a cost-benefit analysis quantifying anticipated savings.
The Committee heard testimony
from two industry associations, Association for Competitive Technology and CompTIA,
regarding the cost of the proposal and the potential exclusion of proprietary vendors
in
In January 2004, ITD published and adopted the Enterprise Information Technology Acquisition Policy, which required agencies making IT investments consider all possible solutions, including “open standards compliant open source and proprietary software as well as open standards compliant public sector code sharing at the local, state and federal levels.”[5] In April 2004, ITD included an open standards requirement in the first version of the ETRM, which outlined the agency’s IT strategy, goals and tools.
It is important to note the distinction between open source and open standards. While “open standards” refers to the technical specification of a document, “open source” generally defines software with a license that does not restrict its redistribution through licensing fees, royalties or other limitations.[6] Open source software also must make available the source code, or underlying software blueprint, so that all end users are free to use, share or modify the product.[7] While certain desktop applications can be downloaded without acquisition costs, this software is not necessarily free as many companies sell a distribution version of operating systems or applications for a fee.[8] The original proposal by ITD required executive branch conversion to open source software and open standards, but subsequent proposals only required documents based on open standards, which is generally supported by open source software.
The ETRM is divided into five
categories, including the Information Domain which provides the requirements
for open standards. Open standards
refers to the technical specification or “make-up” for an electronic document. An open standard is generally required to be
defined by a standards organization or a consortium, resulting in a consensus
from industry vendors and experts. The
standard must also be available to the public for developing compliant
products, and implies that that an existing component in a system can be
replaced with that of another vendor.[9] In the ETRM, ITD defines principles for open
standards as “specifications that are based on an underlying open standard,
developed by an open community, affirmed and maintained by a standards body and
are fully documented and publicly available. It is the policy of the
ITD released a second draft, the ETRM v. 2.0, in May 2004 which did not include any document format requirements. Several months later ITD and Microsoft, a proprietary IT vendor, began negotiations on the licensing agreement to achieve a more accessible standard that complied with ITD objectives for open standards. In a January 2005 presentation to the Massachusetts Software Council, Secretary Kriss announced a tentative agreement to include other software programs, such as Microsoft, in executive branch operations.[11] The licensing agreement was noted in Governor Romney’s “Progress Report to the People of the Commonwealth,” which claimed that the state had reached a “groundbreaking agreement with Microsoft Corporation, [ensuring] full access to public records has been perpetually guaranteed without any license fees or restrictions.”[12] Several months later, ITD released the ETRM v. 3.0, which included MS Office XML along with the OpenDocument Format (ODF) as acceptable open formats.[13]
The ODF was specified as an
acceptable standard for office documents such as text documents, spreadsheets,
and presentations. The ODF was developed
in 2005 by the Organization for the Advancement of Structured Information
Standards (OASIS), a non-profit consortium of IT companies and was approved by ISO/IEC
international standards body in May 2006. [14] The ODF is presently supported by several
office applications, including OpenOffice, StarOffice, KOffice, and
No state government in the
After publishing the ETRM v. 3.0,
ITD received a “firestorm of negative comments” from the vendor community about
the inclusion of Office XML as an open standard and subsequently deleted the
entire section on data formats from the ETRM.[19] Linda Hamel, ITD General Counsel, noted that
while Microsoft made significant progress towards meeting ITD’s requirements
for an open standard, the agency determined that it was not “open enough.”[20] On
The Committee reviewed the final standard
and public comments and met with various industry groups, including Adobe,
·
During the December 2003
oversight hearing, the Committee invited testimony from several industry groups
and met with others to discuss, among other things, the cost of the proposal. All parties interviewed, including ITD, agreed
that a Total Cost of Ownership (“
At the 2003 hearing, the
Committee requested that Mr. Quinn provide a cost analysis of the proposed
ETRM. The Committee received no response
and again requested a cost analysis when the ETRM v. 3.5 was issued in August
2005. The Committee received a letter from
Mr. Quinn on
The Committee reviewed the document and questioned certain assumptions used in the analysis, including seemingly conservative estimates of training and consulting costs. The ETRM proposes an enterprise-wide implementation of technology that had never been deployed in a statewide branch of government and with which state agency Chief Information Officers (“CIOs”), who would likely lead the implementation, were not familiar.[25] The 2003 memo by Secretary Kriss to Mr. Quinn acknowledged that the “policy will take time, energy, and money. We have a large installed base of systems, many using obsolete technology, which cannot be quickly converted or replaced.”[26] In written testimony to ITD about the ETRM, Mr. John Beveridge, Deputy Auditor, IT Audit Division, Office of the Auditor of the Commonwealth, noted that “[t]he effort, considering the current IT environment, would be substantial” and inquired whether ITD had “considered starting this on a pilot basis, possibly something where the value could be tested?”[27] Committee research indicates that implementations of this scale carry risk for state governments and can cause operating problems and financial loss.[28]
The ETRM requires state agencies
to develop implementation plans that will allow them to configure existing
applications to save office documents in the ODF by
The Committee had additional concerns about the cost analysis, including a lack of licensing costs for legacy Microsoft programs in the proposed parallel IT systems, potentially high training cost projections for the new Microsoft Office 12 upgrade, ITD’s uncertainty about the number of desktops subject to the ETRM, and a lack of consultation with all state agencies about training costs.[30] The Committee also had questions about the cost and productivity comparisons of the two applications. Specifically, how will government performance be affected if Office 12 increases user functionality, while under the ETRM, ITD would eliminate excess functionality by tailoring desktop programs to the specific needs of the employees.[31]
Based on these concerns, the Committee forwarded ITD’s analysis to the Information Technology Division in the Office of the Auditor of the Commonwealth and requested an independent review of the proposal. This matter is presently under investigation by the Office of the State Auditor. Separately, ITD engaged a consulting firm in January 2006 to conduct a cost analysis of the ETRM and this investigation is also currently in progress.
·
Findings
1. ITD did not perform a cost analysis prior to the issuance of the ETRM v. 3.5 or prior versions of the ETRM. ITD did not respond to the Committee’s request in December 2003 for a cost analysis of the proposal.
2.
ITD did not have any implementation documents prior to
publishing the ETRM v. 3.5 on
3. The issuance of architecture standards can impact state spending, through IT Bond spending or agency operating budget, by tens of millions of dollars.
4. Cost analysis of IT applications should be based on the Total Cost of Ownership of the application to appropriately measure all potential expenditures and savings.
5. The IT Audit Division of the Office of the Auditor of the Commonwealth is presently reviewing ITD’s cost analysis submitted to the Committee in September 2005.
6. New Information Technology Division Director Louis Gutierrez engaged a consulting firm in January 2006 to develop a cost model and analysis to ascertain the costs of the ETRM v. 3.5.
Recommendations
1. ITD should include the IT Audit Division of the Office of the Auditor of the Commonwealth in the cost analysis review to add expertise and ensure objectivity of the engagement.
2. Prior to the issuance of future IT architecture standards, ITD should conduct a cost analysis and submit a copy to the Joint Committee on Technology and Economic Development, the House and Senate Committees on Ways and Means, the House and Senate Committees on Post Audit and Oversight, and the IT Audit Division of the Office of the Auditor of the Commonwealth.
· ACCESSIBILITY·
The citizens and businesses of
Following conversations with ITD and members of the IT vendor community and a program demonstration, the Committee was assured that taxpayers with applications that do not support the ODF would be able to correspond with executive branch agencies through an apparently simple conversion process. While training would be required, it is the understanding of the Committee that executive branch employees would save ODF documents in a different format[32] that would allow compatibility with other common software programs used by most citizens and businesses. ITD and industry vendors explained that this conversion process may create minor formatting changes, such as a logo or font, but will not affect document content. In circumstances where a conversion process could potentially interfere with the communication, including legal contracts, the user will maintain a parallel Microsoft application.[33]
During the review of the effect
of the ETRM on citizen services, the Committee learned of potential adverse
consequences for persons with disabilities.
In
The Committee did not raise the
question of whether ITD violated disability law by issuing the ETRM, as
presented in ITD’s brief, but rather it reviewed the processes to ensure the
state’s technology is compliant with disability law. Presently, there is no requirement for ITD to
collaborate with advocates or state agencies representing disabled
persons. As a result, persons with
disabilities in
After posting the ETRM, ITD received public comments from members of the disability community, including Myra Berloff, Director of the Massachusetts Office on Disability (“MOD”), the Disability Policy Consortium (“DPC”), the Bay State Council for the Blind and more than a dozen workers with disabilities, expressing their concerns about the ETRM. MOD is the Commonwealth’s Americans with Disabilities Act coordinating agency with the mandate “to bring about full and equal participation of people with disabilities in all aspects of life.”[39] In testimony submitted to ITD, Ms. Berloff noted that she was not aware of the ETRM proposal until it was published for public comment in August.[40] Ms. Berloff commended ITD’s overall objectives, but stated:
The
proposed migration to an XML-based open standards approach, however, concerns
us. We are concerned that in reality it
may be an unintended step backward toward closing off access to government
information and government jobs for people with disabilities. As state government, we are obligated to
ensure that we can effectively communicate with people with disabilities. Although the
open source/open standards arena is no doubt making progress toward ensuring
access for people with disabilities, it is our understanding that it is
currently far less than fully usable for people who employ screen readers,
speech recognition and other complex alternative interfaces.[41]
Mr. Berrier, President of the Bay
State Council for the Blind, submitted testimony on
I [am] deeply
concerned at the potential effect open source programming would have on the
ability of people who are blind to access and use state systems and
documents. It is imperative that the
effect on people with disabilities be considered before such a change is
made. I am blind and I rely heavily on a
screen reader called JAWS and on Microsoft applications such as Word and
Excel. As a blind person, I do not have
the luxury of switching to other applications.
These work well with JAWS only because scripts have been meticulously
written to make them work.[42]
These comments were echoed in testimony submitted to ITD by other state employees with disabilities who expressed concerns about the compatibility of assistive technology with changes proposed by the ETRM. One such employee, Mr. Gerard Boucher, stated that “[w]e believe these changes would fly in the face of the Americans with Disabilities Act, possibly leading to a loss of employment for some state employees who are blind.”[43] Despite these public comments from MOD and the disability community, ITD made no accessibility related changes or policy announcements prior to the ETRM v. 3.5 publishing. ITD did make other “minor changes” to the standard and has in the past shown a willingness to respond to certain public comments, as it made its decision to exclude Office XML from ETRM v. 3.0 based on negative comments from the vendor community.
The Committee invited Ms. Berloff, Mr. Winske of the DPC, and Mr. Berrier to testify at the October 2005 oversight hearing. Ms. Berloff testified that she was concerned about the impact of ETRM on the disabled community, but that ITD has since included MOD in ETRM discussions. Ms. Berloff testified that Microsoft had become a good partner for assistive technology, but cautioned that the company required encouragement from MOD and there was a difficult transition period in the early 1990s. Ms. Berloff expressed similar concerns about the ETRM and the January 2007 deadline, but that she expected to be a partner in the ETRM development and implementation process to address the needs of the disability community.
At the hearing, Mr. Berrier and
Mr. Winske testified in opposition to the ETRM and provided a demonstration of
assistive technology and how implementation of the ETRM will prohibit accessibility
to these applications for workers with disabilities. Mr. Berrier testified that this policy would
increase unemployment among this group of workers. Mr. Berrier’s current level of access “far
exceeds anything that has been available in the past…. While the computer may
be an option for others, in many cases the technology represents the only way
people with disabilities have of accomplishing tasks, be they simple office
tasks or more complicated things.” Based
on prior experiences with ITD, Mr. Berrier cautioned the committee about
proceeding with a policy without assurances that it will meet the needs of the
disability community. “[L]ooking at
accessibility after a change has already taken placed [sic] is kind of like
building a house, and then deciding to put a wheelchair ramp in after you have
already built the porch, the driveway, the concrete steps, etc…. This relates
to people's ability to hold jobs; it speaks to our livelihoods. This issue relates directly to the civil
rights of people with disabilities.”[44]
During the hearing, Mr. Quinn acknowledged that ITD has “learned from the well informed community of persons with disabilities that there are currently no office applications supporting ODF that meet the current standards for the accessibility of such applications. We will not disenfranchise the community of the persons with disabilities.”[45] Mr. Quinn pledged to improve communication with the disability community in the continued development and implementation of the ETRM. While an accessibility working group did convene, ITD did not agree to meet with the DPC for several months until the Committee forwarded a letter on the DPC’s behalf to Secretary Trimarco in January 2006.
In November 2005, ITD drafted a Memorandum of Understanding (“MOU”) with MOD to ensure that the state’s IT policies incorporated the needs of the disabled community. For the past seven months, however, this MOU has been under review by ITD and, at the date of this report, has not been signed by all parties. While new ITD Director Louis Gutierrez informed the Committee that all sides are still working towards completion, the absence of this binding agreement provides no assurances of improved IT accessibility for the disabled community.
On
· ACCESSIBILITY ·
Findings
1. Despite public comments by the Massachusetts Office on Disability, advocates and state employees expressing accessibility concerns with the ETRM v. 3.5, the Information Technology Division did not delay its release, or make any changes or policy announcements prior to publishing the standard.
2. At the Committee’s October 2005 hearing, the Information Technology Division, the Massachusetts Office on Disability and representatives from the disability community testified that assistive technology is not readily compatible with applications that support the OpenDocument Format.
3. The Information Technology Division is not required to consult the Massachusetts Office on Disability and other disability advocacy groups in the development of the IT standards. The Massachusetts Office on Disability, which oversees compliance with state and federal disability laws, does not have authority to demand compliance of state IT standards or applications.
4. While no state agency tracks disability information on state employees, the Massachusetts Office on Disability “conservatively” reported that there are at least 1,400 state workers with disabilities, more than 1,000 of whom require some form of assistive technology. The Disability Policy Consortium testified that approximately 18-20% of the population has some form of disability, which would indicate there could be as many as 14,400 to 16,000 executive branch employees with disabilities.
5.
There is approximately 70% unemployment, and an even greater
problem of underemployment, among persons with disabilities in
6. The state has had a history of problems providing IT accessibility for persons with disabilities. The Virtual Gateway, the state’s web portal for health and human services, is not compatible with certain assistive technology. The state’s website, Mass.gov, contains documents and features that are not accessible for persons with disabilities.
7.
After more than seven months of negotiations, ITD has not
finalized a Memorandum of Understanding with the Massachusetts Office on
Disability and other human services agencies to ensure that future state IT
policies do not adversely affect the needs or rights of the disabled. Without an MOU or legislation, there is no
guarantee that state information technology applications in the Commonwealth will
be accessible for persons with disabilities.
8.
Although significant work remains, the new agency
leaders have demonstrated a more collaborative approach to the implementation
of IT policy. New
Recommendations
1.
ITD should delay the ETRM implementation date of
2. To protect the rights of persons with disabilities and to prevent litigation, ITD should act in consultation with the MOD to ensure that IT standards comply with state and federal disability mandates. This should be accomplished either through legislation or a Memorandum of Understanding between MOD, the ITD and other appropriate state human service agencies.
3.
To ensure accessibility for persons with disabilities, MOD
should report to the Office of the State Auditor and the Attorney General on compliance
of the state’s information technology systems with state and federal disability
laws.
The enabling statute for the Senate Committee on Post Audit and Oversight mandates performance auditing “for the particular purpose of making an appraisal or evaluation of the … faithfulness of administrative compliance with the intent of legislation and administrative regulations affecting a specified agency of the commonwealth.”[47] Accordingly, the Committee reviewed the authority of agencies presently involved in setting IT policy for the Commonwealth, including ITD, the Secretary of the Commonwealth, and the Records Conservation Board (“RCB”).
In the October 2005 oversight hearing, Mr. Quinn and Ms. Hamel of ITD and Mr. Alan Cote, Supervisor of Public Records, Secretary of the Commonwealth, disagreed on ITD’s legal authority to unilaterally issue the ETRM. Generally, ITD is responsible for the ongoing IT operations in the executive branch and the Secretary of the Commonwealth and the RCB are responsible for, among other things, public records creation, retention, and preservation policies. As public records are increasingly created in electronic format, information technology and document management policies have become intermingled, creating uncertain legal authority for state agencies.
The Secretary is the state’s mandated keeper of public records and employs the state Supervisor of Public Records (“Supervisor”). The Supervisor was established in 1892 to “take necessary measures to put the records of the commonwealth, counties, cities or towns required by law and to secure their preservation”[48] and administers and enforces the state’s Public Record Law.[49] The Supervisor is arbiter of the manner in which public records are recorded and stored.[50]
The Records Conservation Board, created in 1920, is comprised of the state librarian, the Attorney General, the state comptroller, the Commissioner of Administration, the Supervisor of Public Records and the state archivist.[51] The RCB may “require all departments of the commonwealth to report to it what series of records they hold, to set standards for the management and preservation of such records, and to establish schedules for the destruction, in whole, or in part, and transfer to the archives or another appropriate division within the office of the state secretary, in whole, or in part, of records no longer needed for current business.” (Emphasis added).[52] The RCB’s authority applies to all documentary materials, “regardless of physical form or characteristics,” made by any state agency or governmental subdivision.[53]
The Information Technology Division has the mandate to carry out “the efficient and economical administration of [IT] systems within the executive departments including, but not limited to, setting information technology standards… reviewing and approving the planning, design, acquisition and operation of information technology systems, assessing the performance of information technology systems and operations…. ”[54] ITD has also been authorized to expend funds appropriated by the legislature in IT Bond bills, requiring any executive branch agency requesting new IT hardware or software to seek the approval of ITD.
The Supervisor, the RCB and ITD are granted identical authority in the Massachusetts Uniform Electronic Transactions Act (MUETA). The MUETA was adopted from a national model to ensure a uniform application of law for transactions between parties that rely on electronic means such as email and electronic signature.[55] Despite numerous meetings with the Mr. Cote about the ETRM, ITD issued the standard without the approval of the Secretary and without ever formally presenting it to the RCB[56], let alone receiving its approval. In a brief to the Committee, ITD asserted that it has “clear” legal authority for adoption of standards pertaining to electronic document formats for the executive branch. ITD’s claims may broadly be categorized as the following:
1. Legal Construction: ITD claims the legal construction of the three agencies, ITD, the Secretary of the Commonwealth, and the Records Conservation Board, favors authority of a more recently created centralized agency that oversees technology standards for the Commonwealth.
2. Lack of Jurisdiction: ITD claims that the Archivist, Secretary and RCB have no authority over the ETRM because the standard does not affect document creation, maintenance or destruction.
3. MUETA: ITD claims the MUETA was adopted to ensure collaboration on IT policies that affect state public records (which the ETRM does not) and was not a reorganization of the agencies that altered existing legal authority.
The Committee reviewed the brief, met with ITD’s General Counsel on several occasions and analyzed the enabling statutes and supporting case law for the three agencies and found questionable legal authority for ITD’s issuance of the ETRM standard based on the following:
Legal Construction
ITD argues that it has the
authority to set standards that may affect public records because it was
created subsequent to the Secretary and the RCB and the principles of legal
construction hold that the more recent and more specific statute governs. The Committee has several concerns about this
contention. First, the legal
construction of a more recent, more specific statute superseding a general rule
applies when two or more statutes conflict.
Doe v. Attorney General, 425