Independent review of Scottish Government's use of mobile messaging apps and non-corporate technology

14. Concluding thoughts

"The pandemic has been the world's largest ever compliance experiment…it was also the world's largest behavioural science experiment. Not just how people responded to governments, but also how governments responded."^[54] (Hunt, 2023, p.33)

14.1 It is precisely at times of stress that our values are tested. The Scottish Government has itself admitted that it has fallen short, and it was not alone.

14.2 Mistakes have been made and they reflect mistakes that were made across the UK.

14.3 Mistakes are understandable and can be forgivable, but not learning from them is not. This review has found that there were weaknesses in the policy drafting and implementation process. There were also very noticeable inconsistencies in individual compliance. This area touches on so many others, including legal and ethical, and which go to the heart of government.

14.4 The risks were, and remain, very real. Risks around new technologies may be novel but that is the environment we are now in, and will continue to be in. It must follow that we need to work hard to better understand, engage with, and proactively mitigate those risks because the Scottish Government will, like all governments, face tests and challenges again.

14.5 This review, and the recommendations it contains, highlights the need for changes to the policy approach as well as suggestions around updates to the codes. Those are, to a large degree, the most straightforward elements to deal with.

14.6 The more challenging task is to encourage cultural engagement and ethics-by-design with a view to building an organisation that understands its 'why;' one that identifies legal and ethical risks and moves proactively to deal with them, understanding with absolute clarity what is at stake. What is needed is to translate the words into action, not just because the policy document contains those words, but because those words reflect the values of the organisation and the individuals who work for it.

14.7 This task requires more creativity than it does financial resource but if fully embraced has the potential to change the way government sees itself and, in turn, how is seen by those it is there to serve.

14.8 Corporations across the world are making efforts to "broaden corporate purpose to include social purposes^[55]" (Hodges, 2022, p.37).

14.9 The private sector recognises the increasing public pressure to have a 'social conscience and purpose' and many struggle to articulate it (authentically). Working in the public sector means that, by definition, the conscience and purpose is 'oven-ready.'

14.10 It is hoped that this review and recommendations provide the opportunity to begin the re-set that has been spoken of, as well as some practical ideas and tools to support that process.

14.11 In a discussion held with one individual working for the Scottish Government, they said something simple but important: 'We have a story to tell.'

14.12 They do: every information and records management professional does. But is it a story that too often gets lost or overlooked. It is not one of articles of law or policy documents; it is a story which is profoundly human.

14.13 There is not a single area of government that is not touched by information, there is not a single individual working for government that does not have a role, and there is not a single citizen of Scotland that is not touched by the way their government handles information.

14.14 If we accept an environment where, if rules are easily circumvented, those rules are simply changed and flexed to allow for that, then we cannot be surprised if the seepage of trust that we see so often referred to continues. We must be clear-eyed about the trajectory we are on if that seepage is not repaired.

14.15 This must be a moment of reset, an opportunity to breathe new life into work that has already started. In the Progress Update Review (PUR) Report by National Records of Scotland, they commented that "[I]t is clear that Scottish Government continue[s] to take its records management seriously."^[56] This review has found no evidence otherwise, but what it has found is the existence of blind spots which lead to vulnerabilities across the organisation.

14.16 To respond effectively to that there will need to be a collective effort, led from the top, but understood and engaged with by every single individual who has the privilege of calling themselves a public servant.

14.17 The Scottish Government already know this. In the 2021 Information Management Review, it states that "records managers are not the only key players" and in the 2022 Information Strategy the question 'Who will make this happen?' is answered with 'All of us'. They are right because everyone who works in government is a key player (see Appendix 11).

14.18 New and emerging technologies increasingly require knowledge and skill that outstrips any one person's capabilities. That is not a reflection on those individuals, it is a reflection of the world in which we now live. The profound uncertainties we face, not least from rapid advances in technology, is simply an objective fact. Technologies are also developing at a pace. Policies, procedures, controls, and governance can often take time to catch up. That means we must do all we can to root behaviours in core values.

14.19 This review argues that the only meaningful way to respond to the reality of the risks and opportunities we face is to work collaboratively and towards a clear, shared objective. For those privileged to work in the service of the public, that collaborative work must be done with a steely focus on what the two words 'public' and 'service' really mean. It must also be done in the knowledge that all public servants have responsibilities that extend beyond sections of law or words in policy documents.

14.20 Time is precious, money is tight, and demands are great. But look at the time, money and demands expended on questions around MMAs. Doing things well takes time and effort. It also often costs money. Responding when things go wrong certainly takes time, effort, and money. It is for the leaders of the Scottish Government to now decide which they would rather engage their energies in doing.

14.21 Governments risk getting caught in a self-fulfilling downward spiral of a breakdown in trust with the people it is there to serve. Citizens will almost always take a broad view about trust and the actions of a few can impact the whole. This matter has impacted the whole, so responding to it must involve the whole.

14.22 The policy needs updating, but its failure was a symptom not a cause. This review and associated recommendations seek to look beyond the symptom to allow the Scottish Government to begin openly and honestly to address the cause. A commitment to do so is important for them, but more critically, it is important for the Scottish people. Trust can be repaired but that will not happen by accident or by default.

14.23 Advances in technology offer enormous opportunities. They also present new risks. It may not be possible to resist the trend, but we need to engage with it in a more informed and disciplined way.

14.24 There is no quick fix, but with commitment, time, and effort, the downward spiral can become a virtuous circle. That requires organisational purpose and values to be loud (and proud) as well as clear and consistent. Individuals who share those values will be incentivised to join the service and those already working in the service will feel motivated to stay and, importantly, feel recognised for their contribution.

14.25 We could all perhaps benefit from a reminder that complying with rules in the context of information held (by public services) is not about 'have to,' it is about 'get to.'

14.26 It is a privilege, it is a responsibility, and it is about service.

14.27 Everyone, regardless of seniority, is responsible and must take responsibility. Being senior does not exempt anyone. If anything, it is the opposite. The more senior, the more responsibility and accountability there must be.

14.28 These events need to be a wake-up call for all those working in government across the UK. The task now is to use this moment as an opportunity to change the trajectory. For the Scottish Government, the first step has been taken and I have been struck, in my conversations with people across the Scottish Government, by how genuine the desire for improvement seems to be.

14.29 This review has been intentionally short and has only skimmed the surface of the workings of the Scottish Government. This means that the experiences leading up to the review are still fresh in the minds of the organisation and the individuals within it. That is invariably the best time for action.

14.30 Looking to achieve better outcomes must be a priority. This will not be achieved by any one new policy or checklist, it will be achieved by a myriad of things, some of which are identified in this review, all of which are achievable. Often, the most effective change efforts are socially constructed.

14.31 The Scottish Government has a Director General and a Cabinet Secretary for Net Zero. Unlike other areas, this is an aspiration rather than simply a description of an operational area of activity. That sends a powerful message. Perhaps in the future there will be similar roles for P&E or Digital Ethics.

14.32 There is a moral imperative to reduce risks, there is also a financial imperative because mistakes are often costly. In the context of the public sector these two elements are largely indistinguishable.

14.33 It is inevitable that, due to the nature of this review, and the size of the Scottish Government, elements may have been missed. But it is the sincere hope of the reviewer that this review does, nonetheless, serve to support, energise, and build on the work that the Scottish Government has already started.

14.34 Done well, the Scottish Government has the opportunity to lead from the front on its ambitious work to be an Ethical Digital Nation, but only if it is an Ethical Government.

14.35 Because in the context of public service, it must never be forgotten that when the Scottish Government speak of 'outcomes,' that necessarily relates to the whole of Scotland and all the people in it.