Appendices Appendix 1: OSI reference model 1 Appendix 2: Select Committee on Public Accounts First Report 3 Appendix 3: Internet and e-mail policies and guidelines 28 Appendix 4: The Internet and how it came into being 29 Appendix 5: Who manages the Internet 34 Appendix 6: Guidelines for data protection 37 APPENDIX 1: OSI REFERENCE MODEL The Open Systems Interconnection model is a standard reference model for communication between two end users in a network. OSI divides tele- communication into seven layers. The layers are in two groups. The upper four layers (4–7) are used whenever a message passes to or from a user. The lower three layers (1–3) are used when any message passes through the host computer to the upper layers. Messages destined for some other host are not passed up to the upper layers but are forwarded to another host. The seven layers are: 1 The physical layer conveys the bit stream through the network at the electrical and mechanical level (electrical pulses representing 0 and 1). It provides the hardware means of sending and receiving data on a carrier. 2 The data-link layer provides synchronisation for the physical level and furnishes transmission protocol knowledge and management. 3 The network layer handles the routing and forwarding of the data (sending it in the right direction to the right destination on outgoing 2Appendices transmissions and receiving incoming transmissions at the packet level). 4 The transport layer manages the end-to-end control (for example, deter- mining whether all packets have arrived) and error checking. It ensures complete data transfer. 5 The session layer sets up, coordinates and terminates conversations, exchanges and dialogues between the applications at each end. It deals with session and connection coordination. 6 The presentation layer, usually part of an operating system, converts incoming and outgoing data from one presentation format to another (for example, from a text stream into a popup window with the newly arrived text). Sometimes called the syntax layer. 7 The application layer is where communication partners and quality of service is identified, user authentication and privacy are considered, and any constraints on data syntax are identified. (This layer is not the application itself, although some applications may perform application layer functions.) The illustration by Catherine Werst, available at http://searchnetwork ing.techtarget.com/sDefinition/0,,sid7_gci523729,00.html, shows where commonly used Internet products and services fit within the model. The seven layers are related functions needed at each end when a message is sent from one party to another party in a network. This figure includes only Internet-related programs in the Network and higher layers. OSI can also be applied to other network environments. APPENDIX 2: SELECT COMMITTEE ON PUBLIC ACCOUNTS FIRST REPORT Annex A: Information technology projects examined by the committee of public accounts and the comptroller and auditor general Report Project Problems experienced Impact of problems Lessons 1 HC 812 The United Kingdom Although the From early 1999 the Departments must 1998–99 Passport Agency specification for the Passport Agency examine carefully the new computer system encountered full implications of In 1997 the Passport broadly mirrored the increasing difficulties the introduction of Agency let contracts processes and meeting demand for changes to IT to the private sector functions of the passports. systems, including to undertake some of existing system, it did The unit cost of the impact of any its activities and to incorporate more producing a passport policy changes that introduce a new sophisticated software in 1999–2000 is likely may affect demand computer system. The and technology. to be £15.50, for services. objective was to Agency staff found compared to the It is essential that improve the the system more Agency’s £12 target. bodies draw up efficiency of the complex to use and it Processing times contingency plans to passport issuing took some time for reached 50 days in cover the risk that the process and improve output to return to July 1999. The system will not be the security of the previous levels. problems received delivered on time. United Kingdom Most elements of widespread publicity Such plans should passport. The Agency the system and caused much include an assessment had planned to roll- development had anxiety for members of potential out the new been completed of the public. The compensation processing system to successfully prior to Agency’s telephone payments to all its offices within a launch, but project service became customers. tight timetable before delays meant that the overloaded, and the busy season, but productivity of the members of the this was postponed new system was not public had to visit following difficulties thoroughly tested by and queue at one of at the first two offices. the Agency prior to the Agency’s offices. In the spring and going live. The Agency summer of 1999 there The Agency’s roll employed additional were serious delays in out timetable was staff, and optimised processing passport short and allowed the efficiency of its applications by the little room for examination United Kingdom manoeuvre should processes, consistent Passport Agency, problems arise. The with the need to partly as a result of second office went maintain the integrity problems with the live despite the first and security of its implementation of office failing to meet issuing procedures. new IT driven the criterion of Only the introduction passport issuing output for continuing of emergency arrangements in the the roll-out. measures enabled the Liverpool and When the Agency Agency to reduce its Newport passport took its decision to backlog. offices. halt roll out it had no contingency plan. Despite considerable effort, at no point during early 1999 did 4Appendices Report Project Problems experienced Impact of problems Lessons the Agency process sufficient output to catch up on the rising backlog. 2a 46th Report The National Insurance The contract was to Delays in Departments should 1997–98 Recording System replace NIRS in one implementing NIRS2 ensure that they (NIRS) go, but by January in full have led to the understand fully the 1996, it became clear calculation of potential impact of NIRS supports the that Andersen thousands of short delay on their work of the Consulting had term and long term business and Contributions Agency 2b 22nd Report realised the system benefits on an customers. The by maintaining 1998–99 size and scope were interim or emergency Agency were not able details on over 65 bigger and more basis, and that to transfer the million National complex than payments to personal business risk of not Insurance accounts. originally thought. pension holders having the system in The system impacts They had therefore continue to be operation when on almost every adult concluded that delayed. By January required. in the country as it delivery of NIRS2 in 1999, for example, it It is essential that maintains details of accordance with the was estimated that bodies draw up contributions paid contract timetable potentially some contingency plans to and reflects their was not the best 172,000 pensioners cover the risk that the entitlement to approach. The could be being system will not be contributory benefits. company believed a underpaid in respect delivered on time. In May 1995 the phased approach of their SERPS by Such plans should Agency awarded a would bring less between £0.01 to include an assessment contract under the development risk to £100 a week. of potential Private Finance themselves and less In December 1998 compensation Initiative to Andersen business risk to the there were more than payments to Consulting to develop Agency. 1 million customers. a new system – NIRS2 Following a full amendments to the It is essential that – by February 1997. evaluation, the records of the self- there are clearly Agency accepted a employed requiring defined roles and proposal to vary the input to the responsibilities for the timetable. In 1998 Contributions Agency parties to the and 1999 there were National Insurance contract. serious delays and Recording System When a PFI problems with the (NIRS2). The contract purports to delivery of the Department was also have transferred the replacement National unable to register risk of late or non- Insurance Fund some individuals to delivery to the Recording System pay Class 2 self- contractor, during the extended employed Departments should transition and pilot contributions either ensure that the period. In our first by the Direct Debit or business implications report on this matter, quarterly payment of late delivery are we registered our method as a reflected in concern about delays consequence of the contractual penalties. in implementing delays in introducing Inadequate levels of NIRS2, weaknesses in the NIRS2 on-line compensation have contingency planning facilities. the effect of to minimise the Compensation has transferring risk back impact on the been paid out to both to the public sector. Appendix 2: Select committee on public accounts First Report5 Report Project Problems experienced Impact of problems Lessons customers and personal pension business of the providers and benefit Agency; and the recipients. We noted adequacy of that the compensation Contributions arrangements should Agency’s failure to Andersen be unable make timely rebate to deliver. payments to personal We expressed pension providers had surprise at the delay led to a loss of in the Contributions investment income to Agency deciding that customers of personal the replacement of pension schemes. We NIRS1 would be reported that the carried out using a Agency had agreed to PFI approach. This compensate these delay meant that the schemes, and through timescale allowed for them those receiving the PFI completion personal and was very short. It also occupational meant that the pensions, by an winning bidder had estimated £38 only 22 months to million.