Good afternoon, Faustem, Bongeur, come in, hello.
Hello.
There we go.
It's absolutely wonderful to be here.
Thank you so much for coming to my presentation.
I really do appreciate it.
I know there are loads of great talks going on at the same time.
I am here to discuss this.
The lessons that I learned, open-sourcing the UK's COVID contact tracing app.
And how you can apply those lessons when you are open-sourcing your own very important work.
But first, I can't really talk about COVID the app without talking about COVID the disease.
And I need to take a moment to acknowledge the huge toll that this horrific disease is taken on all of us.
I'm sure everyone here has lost friends, family, co-workers and loved ones.
And I do invite you to take just a moment to reflect on all the people who really should be here at Faustem with us.
I am going to try and make this talk entertaining and interesting, but I do bear in mind that a lot of us will have been traumatized by this event.
By way of a content warning, obviously this talk contains discussion of disease and death and cyber bullying.
And it does feature some clips of British politicians, but I will warn you when those are coming up.
So let's talk apps.
Every country had their own app. The UK's app looked like this.
I'm sure yours looked reasonably similar.
And I'm sure everyone here at received a ping at some point saying, oh, you were near someone.
I know I did.
So in fact, this is the ping that I received on my phone.
That's a screenshot of my phone when someone near me had sneezed.
So I'm telling you this because I want to emphasize these are my personal recollections about a very strange time in my life and indeed in the world.
I was working for NHSX, which was a brand new startup type government department, which was trying to modernize technology in the UK's national health service.
And that's me just there.
There are the launch party for NHSX.
There were hundreds and hundreds of people working there.
I'm working on this project, all doing a fantastic job in incredibly difficult circumstances.
But I'm here to describe my memories, my experiences.
I don't want you thinking that this was the, the Terence Eden show.
It wasn't I was a small cog in a big machine, but hopefully a very useful cog.
This, this isn't a story about, I can't have to re emphasize it.
This isn't a story about one person alone in their bedroom coding away and doing something.
This is a story about everyone.
So the story starts about a year before the pandemic.
I had spent my time on knowing he laying the groundwork for what I was about to do.
By going around to conferences and speaking at events like this saying, hey open source, it's pretty good isn't it?
And, oh, if we're going to buy something for the NHS, we'd really like it to comply with open standards.
Open open open, that's all I said in every single meeting.
I literally made it a point whenever I was in a meeting to go, oh, could we open source that?
Or, oh, do we think we can release open data from this?
Does this comply with open standards?
People were probably sick to the back teeth of me being in meetings and saying open open source, open source.
But the, the whole point of this exercise was I was trying to normalize the idea of what open source was.
Lots of people haven't heard of it and when they do hear of it, it sounds weird, because it is weird.
But by saying again and again, hey, this is what we do.
Hey, we want to open source it.
It just builds up people's acceptance of the fact that as an organisation wanted to be open, which was fantastic.
And it led to lots of positive feedback people at conferences with blog and post on social media saying, oh, hey, look, they're going to be open.
That's fantastic. And I also presented internally as well, telling everyone inside what I'm telling you now that, hey, open source.
It's a pretty good idea.
And the end result was this, a culture change that made being closed impossible.
That's what you have to do. You have to do the work.
You've got to signal intent.
You've got to actually release stuff.
You've got to build consensus with your peers and treat them as equals.
That is how you build a culture of open source in an organisation, which I'm sure is exactly what Jack Dorsey would have said if it turned up.
Look at that. You're getting two talks for the price of one here.
So, by the time the pandemic struck, we were discussing, hey, look, do we need a contact tracing app?
There was no discussion about whether it should be open source or not.
Because, obviously, it's going to be open source. That guy, Sharon, is always talking about open source.
That's what we do, isn't it? That's the culture of this organisation we release in the open.
Yeah, yeah. We discussed where to host it and what license and technologies and all sorts of things.
But at no point, did anyone say, hmm, are you sure about open sourcing this?
The culture had changed. If you take nothing else away from this talk, it's this.
You have got to talk internally and externally and make people aware that open source is the way we do things in this organisation.
Don't make open source sound, esoteric and scary, even though open source is esoteric and scary, it just has to be normalized within your organisations.
So, the pandemic struck all the work that I'd been doing on a changing technology stopped and I was given a new mission,
which was this. It was Albert Hubbard who said that all you need to succeed is a definite plan and not enough time.
Well, we had a definite plan and the plan was, on the day that people get the live app into their hands, the source code needs to be released.
There we go. That's our plan. That's our deadline. Do we have enough time? No.
But having a deadline was the most important factor in getting this released. If we had said, ah, you know open source is great. No, we do want to open source it, but we'll think about that when it's done.
Can we just wait a bit and then, you know, we'll do it later. If we had said that, it would never have been open source.
In a large organisation, a decision deferred is a decision that never gets resolved because you can always push it back later.
But right from the start, we said internally, it is going to be open source. It has to be open source on this date.
We also said that externally, we signalled intent. We made announcement, we blocked about it, we posted on social media.
We even managed to get politicians to save the words open source to the press, which made it was imprinted in the press, which gives a huge amount of pressure internally.
Because once the boss has said, yes, of course it's going to be open source. You can't backtrack on that. You need to make binding commitments.
And obviously, that does increase the pressure on the team. And the pressure was absolutely enormous.
And it wasn't helped by a massive shift in our plan. So this is me when this happens smiling on the outside, hollow on the inside.
You've all been there. You start working on a project. It's going great. You're hitting all your KPIs, or your story points that Daniel, Gerritic, it's a falling wonderful.
And then the bug happens. Something goes wrong and all of your plans go out the window.
In our case, we had started developing our app long before Google and Apple had said, hey, we're going to do something around COVID.
We had something out and working, but there was a bug in it. I'm going to pass you on to the press conference, given by the UK Secretary of State for Health and Social Care.
And I'm going to put my mic to my laptop and let's hope this works.
Because of this testing, we discovered a technical barrier that every other country building their own app is also now hitting.
We found that our app works well on Android devices, but Apple software prevents iPhones being used effectively for contact tracing, unless you're using Apple's own technology.
I hope you all heard that. But that's weird, isn't it? That is a prime time press conference from the Secretary of State of Health, talking about software bugs on the news.
I mean, that doesn't happen in normal times. But so there was this bug.
If we had carried on with our own solution, it would have been less effective than if we had switched to Google Apple, expose your notification framework.
So we made this switch, which brings up this really interesting question. What does it mean when your country's health policy is controlled by Apple and Google?
Now, you can argue about whether politicians have our best interests at heart, but ultimately they are democratically accountable. You can vote them out.
Apple and Google are not democratically accountable. You can use freedom of information laws to get source code out of governments. You cannot get anything out of Apple and Google that they do not want you to have.
The original technology that we had worked. It worked really well. We did lots of testing with it, and it was good, but it wasn't good enough.
So we made a decision. We could have kept our app completely open source, completely under our control, or we could have said it needs to use this one proprietary thing.
The rest of it will be open source, but it needs to use this proprietary thing.
And sometimes you don't get to be ideologically pure. Ideological purity doesn't help. It never has. What you need is to get something out of the door and something that works.
We had stayed 100% open source, self-sovereign. Maybe more people would have died. That is the choice we made.
I don't know if it's the right choice. So what we're going to do is we're going to take a legally binding vote.
So I'm going to ask you to put your hands up if we were right to use Google Apple and use their proprietary stuff, or if we should have kept things self-sovereign and 100% open.
If we were right to use Google, that's quite a lot of hands, thank you, thank you. And hands up if we should say to 100% open not using anything.
Yeah, I see maybe like 5% of people. As I say, I don't know if we made the right choice, but every single open source project has to make a similar choice.
Do you use this proprietary library? Do you call that API, which is restricted? Do you run it on AWS or some cloud server, which isn't under your control?
These are the choices you make which bind you. And these are the choices which piss people off.
So I am, of course, talking about trolls. It is very easy to bully people online. It's quite fun too, apparently.
In a world of lockdown where everyone was feeling tense and frustrated, lots of people turned their obsessions to us and vented all their fears at us.
If you've read about the exe backdoor issue that happened last year, you will know it is terrifyingly easy to bully people in open source into doing the wrong thing.
Our number one job as a community has to be to find a way to keep ourselves safe and to keep our friends and colleagues safe.
Working in the open makes you a target.
Working in the open for the government makes you fair game in some people's eyes. And that is not a very comfortable position.
Here is a good example. So I'm going to show you a real tweet a couple of tweets.
These are real. I've likely redacted the names and filled around some details.
So at the bottom, someone asks a very reasonable question. Why is the UK building their own up? Perfectly reasonable question.
And this guy at the top says it's the old boys network. They're all detonions. It's sarcastic.
It's Dominic Cummings and Vote Leave. And it's all, that's all Bullocks. It's not true. It's rubbish.
But this is the worst thing about working in the open, especially on a large project.
People will just lie about you. They will make up stuff. They will push their own agenda out there.
And just for the record, I didn't go to the Eaton Public School. I went to a normal comprehensive.
I don't think anyone from Circa was on my team. I didn't see anyone from Vote Leave.
And yeah, they wouldn't even let me email Dominic Cummings. But apart from that, 100% accurate.
But paradoxically, this is the superpower of open source. Because it makes it so easy to see what's going on.
When someone says, oh, the government are going to track you with GPS everywhere you go.
You can say, well, look, there's a source code, mate. Show me where it does that. Oh, it doesn't.
Great. Now, that is nakedly cynical. But it is effective. My fully believe the open source is a moral good.
I'm public, money, public code. If the taxpayer has paid for it, the taxpayer should see the source code.
But from a really cynical point of view, open source means that you can cut off a huge number of complaints by saying, look, it's there.
Show me where the problem is.
Now, of course, we say it's going to be open source. And not everyone was satisfied with what we did.
So here's another genuine message from someone saying that they have 40 years over 40 years of software development.
Fifteen years of top-level Apache project management. And they can tell the difference between open source and a PR stunt. Thanks.
Here's the thing. If you work for the public sector, you can't reply in public to this. You just can't even.
If you work for a large company, you, your PR team do not want you replying to this message.
I know in your bio, it says, my views don't represent those of my employer, doesn't make a difference.
When I blocked people like this, they started complaining to my boss.
When I muted them, they instigated pylons. I get that in the early days of the pandemic, people were scared and frustrated, but it is really difficult to maintain enthusiasm for open source work when people are abusing you.
I mean, I had people writing blog posts, mentioning me by name saying how evil I was for working on this project.
I had people sending me really nasty direct messages saying how terrible all this was. It was absolutely awful time in my life.
And I'm so incredibly grateful to the support of my wife Liz for helping me through it because it was just, it was awful.
The lesson here is you have to protect your team members. You need to make sure that they know you are not listening to the rubbish being talked about them.
And you need to find a way to protect yourselves. And if you see your friends getting some abuse, check in on them.
Because it is heartbreaking to be pouring your heart out and building something that you hope is going to be wonderful and just to receive abuse like this.
I am being really down on social media.
Honestly, every message like this that we got, we had dozens which were supportive. People say, oh wow, it's open source, that's wonderful.
We took screenshots of every single one of those messages, put them in a big document and email them to our boss and to the politicians and said, look, people love that we're open source.
Ignore these people here, look how one look at the PR bonus that we are getting from being open source.
You've got to reflect that love back up the chains so that your managers will see and understand it.
Maybe, just maybe this guy has a point though, maybe. What is an open source?
Well, the easiest way to tell is to look at the license.
But no one will ever be happy with the license at YouTube. I would be delighted after this talk to discuss licenses with you.
The only stipulation I have is you need to buy me one beer per license you wish to discuss.
Internally, we had lots of discussions about what we were going to choose. And in the end, we went with the MIT license.
I love the MIT. Now, why did we choose the MIT? What the first?
And this is probably, I don't know if it's the most important, but other government departments use the MIT license.
So we didn't have to evaluate it. We could say, look, they've chosen it. They say it's okay. Great. Move on.
You do not want to be in long discussions about licenses. If you can point to someone else in your community who is already chosen that, that is half the battle.
It's good enough for them. It's good enough for us. The second point about the MIT license is, like, the government wasn't trying to make money off this app.
We didn't need that sort of very restrictive, very viral GPL of it. We wanted people to use the source code.
So we didn't need to lock it down anyway. We just wanted to get it out.
But the third, and I think definitely the most important reason why we chose MIT, is that the MIT license is short.
It is really, really short. And when you are dealing with government lawyers who charge by the word, brevity is important.
It means that you can show it to anyone in your community and they can read it in a minute and go, yeah, no, I get that.
You cannot read a GPL in a minute. And if you take 10 minutes reading it, you still won't get it.
Is the MIT license the most ideologically sound, most free software Europe approved license in the world? I don't know.
But it was quick and easy for us to use and it meant that we can open source it.
So I'd like to take another entirely legally binding vote. I'm going to ask you to stick your hands up if we were right to choose MIT,
and then hands up if we should have chosen literally any other license. So hands up MIT was the best license for us to choose.
Okay, pretty good. Hands up if we should have chosen anything else.
Or I'd say about 75, 25 split there. If you would like to explain your choice of license, I'm very happy to remember one beer, one license.
Thank you. So we announced, hey, it's going to be MIT, and the internet had opinions.
If it was a GPL, we'd get the packet. MIT is a license of choice for people who do not understand open source and public goods.
So there, all of you people who put your hands up for MIT, you're wrong. This man on the internet says so.
I mean, maybe I don't understand these things only, spent half my life working on them.
But it highlights a really interesting lesson. We didn't talk about why we chose MIT. We did discuss it.
We had some good reasons for doing it, but we never publicly said why.
And when you don't explain your decisions, people will ascribe malice and incompetence when there is at best in difference and laziness.
You know, the license you choose, please, into the public's perception of what something is for.
So please, if you are going to choose a license, and I recommend you do, it's for STEM, say why you've chosen it.
People can disagree with you, but at least they can see your thought process.
And I'll take questions later. And incidentally, it doesn't give me any pleasure to say this whatsoever.
But this person is wrong. They were completely and utterly wrong, because we did release the back end and the front end and the test and the architecture diagrams and all the documentation.
And yes, the MIT does let you do that. So I highly recommend that as a software license.
But how do you explain what you're doing? How do you explain this, this concept of open source to normal people?
I had the number 10 Downing Street Press team asked me a brilliant question.
We were prepping to open source, and they said, why are you publishing two versions of the source code?
What you mean? Well, you've got one version of the source code for Android, and one version of the source code for iPhone. Why are they different?
That's a pretty good question, isn't it? I know. I'm very happy to turn this into a lecture on the architectural differences between those two platforms.
But you need to find something that can be condensed into a paragraph, which can then be regurgitated as a single sentence in the newspapers.
You need to find ways to bring people with you on this journey, so they understand what you're doing, why you're doing it.
And we had to justify all sorts of things. So we had to justify why we were hosting the source code on GitHub, which is owned by Microsoft.
We should have paid quite a lot of money to run and maintain our own GitHub instance, which would have been a waste of taxpayers money.
These choices you will never get right, but at least if you explain them openly, you might send a chance to justify them.
Look, this is incredibly vain, but I say it wasn't down to people in their bedroom. This is me in my bedroom. This is the moment that we open sourced the app on GitHub.
We'd been working in a private repository, and on release date I received contradictory messages. I had my boss saying, yeah, go go release.
And then they're boss saying, no, no, no, wait. And then my press team saying, where is it? We sent the press release. And then the number 10 press release team saying, no, no, you've got to wait.
It was, you know, it was a bit of a mess to be honest.
My lesson for you here is have a robust procedure that you have rehearsed beforehand. If you are going to release something, no who gets to say yes, we do it.
So who gets to copy and paste things from GitHub and paste them into to open sourced it. It was a bit of pandemic pandemonium, but I think, you know, it was our first time doing it. So I think we can be forgiven for that.
Anyway, people downloaded the app, and they could download the source code at the same time, and, you know, we released it.
And now it's a wonderful, people still weren't happy. So we announced, hey, everyone, you can get the source code, get hub.com, slash whatever, slash whatever.
And oh, boy, men on the internet had opinions. Again, this is, this is an absolute genuine message that we received and then had to talk to the press team about.
GitHub is the shareware developers free for all programmers site. EG, the app was written by hobbyists.
There you go. All of you using GitHub for professional purposes. No, you're not. This man says so.
All right, it is kind of easy to laugh for people like this. But how do you explain to everyone what you are doing, why you were doing it, why you have chosen,
GitHub, why open source in the first place? Internally, it wasn't a battle, but we did find ourselves explaining it again and again.
Like, all the techies that we worked with get it, but we were dealing with lawyers and doctors and politicians and people who are really intelligent, excellent at their jobs,
but had never heard the words open source before. So, a lesson for you is, try and find the five minute presentation you can give to everyone to bring them up to speed on what we're doing, why you're doing it.
Let's take a moment to talk about history, get history specifically. So, I mentioned before, we initially developed in a closed repo and then we opened it.
We obviously had hundreds of people working on this, all doing individual commits, you know, Alice committed this line of code and Bob approved it great.
But we made the very difficult decision to squash our get history. Every time there was a new release of the app, we did a new full release of the source code. So, you could dip between them, but you couldn't see individually, Bob did this, Alice did that, so did that. Why did we do this?
First, and I feel very uncomfortable saying this, security by obscurity. It's not great, but we were terrified that someone would slip up, they would commit a key or a piece of debug code or something, and we just wouldn't have time to fix it.
We said, okay, every release, squash history, or sanitize it, make sure there's nothing bad in there, and push it out. Okay, you can disagree with me on that in a bit.
The second lead was the privacy of the people working on the app. So, we, none of us want to be the main character on social media, because we left out a semi colon on line 137, or anything like that.
The pressure on the team, as I said, was enormous. Do you want people saying, why isn't this person committing code at three o'clock in the morning?
Proper developers are fueled by Red Bull at three o'clock in the morning. No, no, we didn't want that. We wanted to keep our people safe. We also wanted to protect their identities from state sponsored attackers or targeted fishing attacks.
Things like that. So, again, we said, we will anonymise it. It will just be one big death.
Again, I don't know if that's the right thing to do. I'm happy to justify it, so I'm going to ask the audience one more time.
It's going to be hands up. We were right to squash the history, or hands up. We were wrong to squash and we should have been everything. So, hands up. We were right. That's very gratifying. Thank you.
Hands up. We were wrong. We should have done individual deaths quite a few. I would like sort of 10-25% there.
I fully respect your view on that. We can argue about it in the pub later.
So, comments are a natural part of source code. I really hope you will comment your code and make it nice and easy to read.
We all comment our code. Yes? Good. So, obviously, we want to leave comments in so that people can understand the app code.
But the problem we had is that programmers think they're funny.
We had to let them know that you mustn't put any comment in the source code that you want on the front page of a newspaper tomorrow.
I mean, I would love it if the Daily Mail ran with the headline.
Government insists on tabs over spaces and it's your children who are paying for it.
Just keep everything calm and you have people putting in sort of joky commits and comments and saying,
this bloody thing doesn't work or personal information. I need to tell Fred to fix that.
We just had to go through the tedious process of snipping some of them out.
But of course, the problem is that comments, even accurate comments, can be a bit misleading.
So, we had a process which had a load of sub-processes and sometimes they timed out and then you had to read.
This is incredibly boring. This is the comment that went with that.
When the signal is received, terminate all non-responsive children.
Do not log any data and spawn a YouTube run.
Now, I know what they're talking about and you know what they're talking about.
It doesn't, if you are seat in 5G COVID conspiracies, this doesn't look good, does it?
So, there we go. There we go. How do you make your code and your comments understandable to non-coders?
I mean, there is a limit to what you can do, but people are going to be reading through your code and they need to have an understanding of it.
You also need to think about, if someone were to maliciously misunderstand your comments, how could you prevent that?
One thing that we did was we had lots of Q&A, so people would write to their MPs, the members of parliament asking questions which got forwarded to us.
We did blog posts and we had comments and we also had to get up, we were wrong get up, so we had get up issues, people could raise issues and they could also raise technical questions.
Now, has anyone who has ever managed a forum knows, technical questions quickly become political questions.
So, we had a code of conduct and I, unfortunately, was its ruthless enforcer.
So, this is me saying, no, sorry, we're going to stop this conversation here, locked and then very occasionally saying, sorry, your band, we're not having any more of this out you go.
This isn't what we want from this community.
This is an impossible balance to get right, I don't just mean pruning out the spam, you know, the obviously flaming comments.
Sometimes you have to go look, this is really interesting, but it is so off topic and distracting from here, we're going to stop it, take it elsewhere.
This moderation is a professional skill, it is a skill I do not possess.
And after a while of doing this, I went to my bosses and said, I can't do this, I am not good enough at this job.
So, we bought in professional moderators who professional social media, people who could answer questions and lock comments and things.
If you have a big or important repo, I thoroughly recommend getting professional moderators in.
If you can, do not get the the bluntest, most forthright code that you have to answer everything and get it.
For some things, it's great, but you do not necessarily want them waiting in on sensitive discussions.
Again, I am being down on social media.
The thing is, get hop was brilliant, it was fantastic, we got so many positive contributions, we got pull requests, we got bug reports, we had people saying, I've written to you on hack a one, I've disclosed something responsibly.
We were taking screenshots of all of these and sending them to our bosses and saying, look how wonderful it is, look how brilliant open sources and then just like that it was over.
One day, my phone pinged with that message and it was like a punch to the gut.
They were shutting down my project.
This was the biggest thing I had ever worked on, it is probably going to be the most important thing, I will ever work on and they were killing it.
I think whenever you work on a project, if it's big or small, you just want it to go on forever, right?
But if this up was still running today, it would have meant that we had failed.
You need to lay the groundwork for stopping your project, here's another lesson, who holds the API keys, what's the contract details, who can actually switch this up, what order do we need to turn things off, how do we do a graceful shutdown?
That is, I think, as important as how you start up your project.
Actually, I wasn't around to see that a few months after I clicked the button to make things open source, I returned to my old job in a different team.
But all the source code was open, so mission accomplished.
We're never going to be truly post pandemic, there is always going to be another disease.
We've got through a combination of vaccines and changed behaviour and lots of hand sanitizer, we've turned a corner.
And the app was part of that, the legacy of open sourcing this app was a mixture of things.
First and foremost, the app worked, it saved lives, it reduced the strain on the NHS and it continued to do so, all the time it was working.
And open sourcing was part of that. Now, it wasn't the be all an end all, even I recognized that.
But if it hadn't been open source, I think most people in this room would have told their friends and family, don't install that, you can't trust it.
I would have told friends and family, don't install it, you can't trust it.
And open source increased trust in the government and the health care service at a time when trust was low.
We now know much about how we're going to deal with the next pandemic.
We know what technology works, we know what measures don't work.
All of us, I'm sure, have learned lessons from this horrific experience.
And I hope one of the lessons that governments around the world have learned is that open source is a necessary part of any technological response.
I say around the world because I've given the UK perspective, but of course, loads of countries were doing this.
I spent hours on calls with people from all around the world who were going through exactly the same problems and we exchanged ideas and tips and strategies and yes we exchanged code as well.
Now, as far as I can tell, these are all the national COVID tracing apps which were based as open source about about a dozen, two dozen countries there.
And as you can see, they use a wide variety of technologies.
So, G-A-E-N is the Google Apple, notification explanation notification framework, Bluetooth, some people went with D-P-3-T and G-P-L range.
So, not everyone did the same choices we did earlier of saying yes, we were right to use Google Apple.
You can see not all of them used MIT, there's lots of, you know, there's some Apache, E-U-P-L.
Is there anyone from Latvia in the room?
Because I would love to know why Latvia chose Creative Commons attribution share alike.
For they can no shame, I will buy you a pint if you can explain that one to me.
I'm going to leave you with a couple of things.
So, this is a speech that the former Prime Minister, Rishi Sunak, gave just before the general election.
And this is, Rishi Sunak, the then Prime Minister saying, we are pro open source, open source drives innovation.
There must be a very high bar for any restrictions on open, I can't explain how weird this is
to see your Prime Minister speaking about open source positively in a bid for reelection.
I mean, all of this is like, we want AI to be open pro innovation pro, this is the Prime Minister saying we are pro open source and the app.
I'm sure, played a large part of that.
Now, in fairness, Rishi Sunak did lose that election and he did lose quite badly.
But I don't think it was a Tory party stance on Linux versus Windows, which caused that defeat.
And in the spirit of political neutrality, here's the current Prime Minister also talking about open source.
And there's a reason, Mr. AI, on the champions of open source, have just announced a UK office too.
That is the legacy of us managing to open source for COVID tracing app.
The words open source, spoken at the highest, are you waving at me or someone else?
Okay. That is the legacy of open source in this app.
The words open source being spoken at the highest level of government and being spoken about positively.
We are not relegated to page 500 of a trade treaty or we'll do a bit of open source to stay off competition concerns.
This is open source being seen as a force for good as something you want to mention in an election speech.
Something you want to say in a major speech about your new industrial strategy.
Open source is important and it's important to government.
And that legacy isn't mine, that legacy is yours.
It's every single person who has been in a meeting with a politician or written to their MP and said,
Why isn't this open source?
It's everyone who's responded positively on social media and said,
Oh, I'm so happy that this is open source, let me send a poll request.
It is the legacy of everyone who has started a project on GitHub or just ranted about it to their friends and family.
This is the lesson that I learned from open sourcing the UK's contact tracing app is that open source is not about code.
Open source is about community and it is community that saved the day.
So thank you very much indeed.
Thank you very much.
I thank you so much. I really appreciate that.
I think we do have some time for questions.
Remember, licensed questions do come with a mandatory one beer minimum.
There are two beers for that person as well.
Anything else I'm very happy to take questions?
I don't know if we've got anyone any questions.
I don't know if someone can run with a microphone.
There we go.
In the meantime, if anyone closer to the front has a question.
I see we've got one over there.
Do you want to shout out?
Within public sector institutions, what can we do to support other technical professionals in open source seeing their work?
That is a crucial point.
Lots of people don't know how to open source their work.
How to do is explain to the people working on this.
Not only why we were doing it, how they should behave in public as well.
One of the support we used to give, when I was in the public sector, I'm not there anymore,
was we told people that if they wanted to, they could use their real name on commits,
but if they didn't want to, they could make up a new GitHub profile and use that.
That's a balance to get right because some people want their name against big projects
to go and interview elsewhere.
They can say, look, that's me.
I don't want to receive any abuse for this.
I want to be anonymous.
A lot of the support is technical saying, okay, this is how we do it, but a lot.
Any cool amount is pastoral saying, this is how we will protect you.
This is how to keep yourself safe online as well.
Thank you.
There's a really good question.
I don't know where the microphone is.
It's up here.
Right, I'm also prepared to discuss for the price of a bear, if any bell to variety,
the MIT stuff, because I was there when that was actually decided in the broader
government.
No, the question I want to ask is, so I understand the reasons why we wanted to hide
the exact commits.
Do you think, however, not with saying that, it would have been more effective in some
of these things if you'd be able to open source it from earlier in the project.
We should have open source earlier in the project.
In an ideal world, yes.
But we weren't operating under ideal conditions.
We were rushing to get something ready.
We were testing it at a British military base with military personnel,
and so there was some hard-coded stuff in the original version.
I would have loved to have open source it literally from the beginning,
but there were very practical reasons why we couldn't.
The thing that I always sort of like in it, too,
is if you knew that a meteor was coming to hit London,
and you had to develop a meteor avoidance app,
you would probably want to keep it secret until you had announced it to the public.
Otherwise, it would be a bit upsetting to suddenly look going to get up and
discover, oh, look, the government knows that a meteor is coming down.
So in an ideal world, yes, it should have been open source from the beginning,
but ideology is trumped by practicality every time.
I think we would have struggled to get agreement to do it,
so the compromise was it will be done,
and the public announcements for it,
in exchange for it being private to start with.
But all that code is still available,
even from the earliest one you can go on and you can look through the history
back to the earliest commits.
So a good compromise, I think.
I don't know where the microphone is. There we go.
Yeah, yeah, a really great presentation.
I'm curious how you handed contributions from outside
from the community and what do your experiences there?
How do we get contributions from the outside?
So yes, we had people raising bug reports on GitHub,
which was great. That's a valid contribution.
We had people doing UI changes and things in pull requests.
We did accept some pull requests,
but because of, you know,
if you're working on something which is sensitive for the government,
sometimes you do want to do my background checks on your developers
and things, so we didn't accept all of them.
What we did have was I think it was Hacker 1 for responsible disclosure,
and so we accepted a fair number of responsible disclosure,
which also came with patches and fixes there.
Someone wrote a wonderful blog post.
They submitted a pretty good security bug to us.
And we said, thank you very much and they went,
can I publish it?
Yeah, just let us push out the new version first.
We pushed out the new version and a few days later,
they wrote a blog post saying,
and it was really easy to contribute to a UK government open source thing.
Yes, so that got screen shot and sent up as well.
Thank you.
Hi.
Yeah.
And there's a few saying about the government kind of like talking
positive about open source was crazy cool.
And I was kind of wondering if you worry that that could fade with time
as like governments, interesting things, sometimes can.
And do you have any kind of stuff in mind for keeping it in their conscience
and making sure that this stays like goings down?
Fantastic question.
I mean, the UK government, at least, is staff,
with lots of people who get open source,
there's no longer work there, but they are pushing heavily.
What I would say to all of you is,
you've got to be the change that you want to see.
So, on one hand, star government repose on GitHub
and simple requests, right to your members of Parliament
or other elected officials and say, how happy you are
or say you really want this thing to be open source.
You've got to put the pressure on.
But I would also say, apply for jobs.
Go in there, do it yourself.
You know, the best way to make a change.
I mean, there's that meme of the person who gets a job,
does a one line fix and then leaves,
because how finally it's fixed.
I wouldn't go that far, but go in,
and you take for open source externally and internally.
That's probably the best way to keep this momentum up.
I've only got five minutes left,
so we'll take a couple more,
and then get set up for the next speaker.
Hi.
Thank you for your talk.
I had a question regarding the development
of applications in times of need,
so in times of really,
where you immediately need to release an application
like you did for a COVID.
I'm guessing this is a situation that's going to be more frequent
in the future, not necessarily due to COVID or pandemics,
but also due to other reasons,
like, for example, the kind of change,
and you had the sore ear in,
and great bit not too long ago.
You had a tornado in the coronal and so on.
So I can't quite hear you.
So are you talking about how rapidly we updated the code?
Sorry, I meant,
do you have suggestions for application developers
or even for the public sector to have the habits of deploying
very fast applications in times of need?
Yeah.
The best thing for people working in the public sector
to get things out in times of need is to,
well, there's two things.
One is have good frameworks,
so the UK government and the UK health service
have a design framework and design language,
which means that you couldn't sort of drag and drop
an app prototype and get it looking right.
And then the second thing is to practice.
At some point, you will almost certainly want to run
an exercise of,
let's imagine that the prime minister has announced
that we all need to have an app to track how much
swans are in our garden.
Great, how quickly could we do that?
And just do a sprint of how quickly can we develop something?
So I think it's that.
Make sure you've got the tools available.
Make sure you know how to use them.
I think that's time for one more question.
If there is one.
If you were doing it all again,
what would you have done differently?
If I could do it all again,
I wouldn't have taken the job in the first place.
It was stressful.
It was annoying.
It was far too much pressure for the entire team.
And it was, you know,
it is the best thing that I've ever done.
I think I'm.
What would I have done differently?
Nothing.
I mean, we should have telegraphed and we should have discussed
our reasoning, especially behind the licenses a bit more.
But you know what?
We got various high level government ministers to say the words open source
in press conferences and have it reported in the news.
We got the app out by the time everyone had it in their hands.
We kept open sourcing it.
Every time there was a new release.
We dealt with all the trolls.
We dealt with people contributing.
You know, if I wouldn't live through it all again,
but I don't think I would have changed anything.
Anyway, thank you so much for coming to my talk.
Thank you so much.
Cheers.