Y2K

What's on the minds of government IT managers? Y2K conversion, contingency planning, embedded chips and possible litigation. Our panel of experts discusses Y2K. Answers have been edited for length. Complete answers appear on the Web site.

by , / October 31, 1998 0
Donald V. Evans
is director of the Department
of Information Systems and Telecommunications for
Montgomery County, Md.


Debra Clark Jones
is director of North Carolina's
Statewide Year 2000 Program
Management Office.


Steve E. Kolodney
is director of the Department of
Information Services in the state
of Washington


John A. Koskinen
is an assistant to President Clinton
and chair of the President's Council
on Year 2000 Conversion.


James G. Natoli
is director of State Operations
and chair of the Governor's Office
for Technology in New York.


Wendy W. Rayner
is chief information
officer of New Jersey.


Tom Ridge
is governor of Pennsylvania


Question One:
How is Y2K conversion affecting ongoing technology projects and new systems development in your jurisdication?
--------------------------------------------------------------------------------


Donald V. Evans
Executive leadership is having to make tough choices. Y2K conversion is causing decision-makers to consider halting the implementation of requirements generated by federal devolution and is delaying requirements generated by ever-growing citizen demands.


Debra Clark Jones
State agencies have been requested to prioritize year-2000 fixes over new development work to meet the year-2000 deadline. In many instances, resources have been pulled from ongoing technology projects and new systems development throughout the state of North Carolina to complete year-2000 remediation.


Steve E. Kolodney
State agencies were instructed by the Office of Financial Management to direct all available resources to resolving year-2000 issues before embarking on other non-critical or mandated systems projects. Significant new development has been suspended in many agencies while Y2K issues are resolved.


John A. Koskinen
Federal agencies are devoting significant resources to Y2K -- their top management priority. The Y2K problem is unique because the ultimate deadline, January 1, 2000, cannot be delayed. As such, agencies have had to make tough choices about how to best allocate resources to ensure that year-2000 remediation is completed on time. For many agencies, these choices have included delaying technology projects.


James G. Natoli
In July 1997, Governor Pataki issued an executive memorandum that identified year-2000 compliance as New York State's "number-one technology priority." The memo invokes a moratorium on new technology initiatives other than those mandated by statewide directives or law, until an agency can demonstrate year-2000 compliance. Agencies have been directed to suspend [technology initiatives] not considered essential.


Wendy W. Rayner
Y2K remediation is the number-one priority for New Jersey State Government. In February, I asked all Cabinet officers to observe a moratorium on all new and ongoing systems-development projects until all agency Y2K issues are addressed.


Tom Ridge
We have been able to manage our year-2000 conversions without allowing them to sidetrack our other leading IT efforts. Over the last three years, in addition to meeting all our year-2000 goals, we've also dramatically boosted the use of educational technology in schools through our Link-to-Learn initiative [and] initiated a pioneering project to outsource 18 state agencies' data centers.


Question Two:
Experts have warned for years that Y2K conversion should be completed by December so that system testing can occur during 1999. If government agencies aren't ready, what options still exist?
--------------------------------------------------------------------------------


Donald V. Evans
Don't reinvent the wheel. Use proven methods/approaches/tools specifically tailored for government (e.g., Year2000 Best Practices Manual from ). In conjunction with your Y2K assessment, projects should be closely monitored to determine if implementation will occur on time. For those projects deemed to be late, implement contingency plans and supply-chain analysis for alternative services delivery.


Debra Clark Jones
All [North Carolina] state agencies have been requested to complete remediation work by December 1998 so that 1999 could be a year of testing. In the case of systems which will not be completed, the Statewide Year 2000 Project Office is monitoring these systems to see what potential impacts could result and, where appropriate, verify that contingency planning is taking place.


Steve E. Kolodney
Most (90 percent or more) mission-critical systems for the state of Washington will complete system-testing by the end of 1998. The remaining systems will continue testing through 1999, with the vast majority completed by June 1999.


John A. Koskinen
The federal government's goal for completing mission-critical year-2000 work is March 1999, moved up from November 1999. But we are mindful of the possibility that not every system will make the deadline [and] have required agencies to develop contingency plans. We have also asked agencies to develop continuity-of-business plans for the failure of outside systems.


James G. Natoli
As of June 1998, the state's "Top 40" priority systems that impact public health, safety and welfare are 73 percent compliant and are on schedule to be completed by January 1999. In addition, [New York State's] 330 high-priority systems are 48 percent compliant as of June 1998, and are on schedule to be completed by April 1999.


Wendy W. Rayner
All state agencies are required to test and return their mission-critical systems to production by March 1999. Notwithstanding the deadline and our plans for testing, each agency is required to develop a contingency plan in conjunction with its test plans. [If] a particular government system fails, we will deploy the associated contingency plan to ensure the continuation of business functions.


Tom Ridge
We have currently completed more than 98 percent of repairs to state agencies' computer programs that support essential state government services. That includes computer-program correction, testing and full implementation. We also are well along in the evaluation and repair of our PCs and embedded technologies. Contingency plans are being developed where necessary to safeguard public services from disruption.
November Table of Contents



Question Three:
Is lack of qualified personnel still a major bottleneck for Y2K conversion, and if so, what resources exist to get the job done?
--------------------------------------------------------------------------------


Donald V. Evans
Government's pay structure and recruitment procedures are two of the most inhibiting factors for getting qualified personnel. Those circumstances burden Y2K management with having to be extremely creative in acquiring resources while not losing precious project time. Contractor resources appear to be available if you are willing to pay more, and if warranty and liability are matched to the Y2K opportunity.


Debra Clark Jones
Finding qualified personnel is a key issue for IT jobs generally. The state is typical of most states in that turnover is significant, and compensation is not always the answer. The Year 2000 Conversion Project has not been impacted due to that turnover any more than any other major IT project. A large portion of our conversion efforts have been outsourced.


Steve E. Kolodney
Not really. We are seeing a stabilization of billing rates for programmers. Some agencies have been able to lock in fixed rates through 1999. Others are beginning to release programmers as work is completed. We may see shortages in isolated specialties such as C, C++, and Visual Basic.


John A. Koskinen
We have yet to experience shortages of qualified Y2K personnel within the federal government or in the contractors we are using. Various "Y2K tools" available in the marketplace have enabled agencies to reduce the amount of time and labor needed for fixing systems. Second, we've taken aggressive steps to make sure that agencies have access to necessary personnel resources for addressing steps.


James G. Natoli
NYS has instituted significant policy provisions to provide agencies with additional flexibility to manage personnel, technical and financial resources to accelerate compliance projects. These include hiring-freeze exemptions for IT and related Y2K positions, blanket authorization for
unrestricted overtime, waiving testing requirements for certain IT titles and the temporary re-employment of retirees.


Wendy W. Rayner
We are very fortunate in New Jersey in that we retained a significant portion of our qualified agency personnel to work on Y2K conversion. In addition, early on, we contracted with several vendors to supplement state staff, if necessary. These vendors are extremely helpful and we rely on them extensively.


Tom Ridge
Overtime pay for IT managers has been approved as a way to offer incentives to our in-house experts helping with code conversions. We also have gained approval to temporarily bring back retired state IT personnel who are most familiar with our legacy systems. Another innovation, our Invitation to Qualify (ITQ) process, has proven invaluable for pre-qualifying vendors.
November Table of Contents


Question Four:
What will happen if non-Y2K-compliant chips fail? How should state and local agencies confront this issue?
--------------------------------------------------------------------------------


Donald V. Evans
Use a proven methodology designed by embedded-systems experts (Year2000 Journal, May/June 1998) to make an assessment and to do the triage. A half-day training class to level-set the technical staff involved in the assessment will improve its quality; a general understanding of how embedded systems work and default will greatly minimize the effort associated with embedded chips.


Debra Clark Jones
In the most extreme cases, systems with faulty date logic in embedded chips will cease to operate. Since the number of systems to be evaluated is quite large, a triage approach should be taken to address the problem. Vendor research and product testing will be required to determine the compliance of individual or consolidated system components.


Steve E. Kolodney
Embedded systems failures could affect medical equipment, power generation and distribution, telecommunications and transportation systems, to name a few. Agencies should approach this just as they have Y2K problems in application systems -- inventory, identify mission-critical dependencies, test for compliance, request vendor assurances, and correct where necessary.


John A. Koskinen
The failure of date-sensitive embedded chips could cause the equipment in which they operate to shut down or malfunction. State and local agencies should be confronting this issue by assessing the scope of the embedded-chip problem. They should also share information about this matter with each other and call attention to the embedded-chip issue in their ongoing Y2K outreach efforts.


James G. Natoli
Agencies are inventorying embedded systems utilizing a standardized checklist. Embedded systems are being prioritized based on the potential business risk. Unlike traditional IT systems, embedded systems are designed to be self-contained and are difficult to test. NYS has produced and distributed over 10,000 copies of our "Guide to Solving the Year 2000 Problem in NYS Local Government."


Wendy W. Rayner
We have worked hard to locate and address Y2K-affected embedded chips in state-government-owned equipment. If some embedded chips fail and create an emergency situation, the state has processes in place to quickly respond. We are working closely with the Emergency Management Section of the State Police to develop supplemental emergency-management procedures to handle Y2K-related emergencies.


Tom Ridge
Computer chips found in such devices as thermostats, security systems and traffic lights must be a critical component of any government agency's year-2000 action plan. In directing the development of an action plan for Pennsylvania state agencies, I instructed my staff to include the necessary time and resources to address both embedded chips and desktop technologies, which are frequently overlooked.
November Table
of Contents


Question Five:
Some futurists are predicting an economic downturn, even a recession, as the result of Y2K failures and ensuing litigation for damages. How can governments best prepare for litigation and liability issues?
--------------------------------------------------------------------------------


Donald V. Evans
First, organizations should fully disclose their Y2K-preparedness status. Second, follow industry-accepted Y2K methods (i.e. assessment, remediation, test and certification). Third, by following normal project management principles to manage a Y2K effort, the necessary documentation should be produced to show your organization performed due diligence. Also, your Y2K senior management team should be assigned a full-time legal representative.


Debra Clark Jones
Governments need to identify critical systems, direct resources to remediating or replacing those systems, provide for independent verification and validation of the remediation efforts, and document these efforts.


Steve E. Kolodney
Maintain a good record of steps taken to inventory and prioritize the problems that must be dealt with, fix and test those identified as mission-critical, build appropriate assurances into vendor contracts, and create contingency plans where that makes sense. Finally, they should consult frequently with their attorneys general.


John A. Koskinen
Governments have a valuable role to play in the liability area by helping to facilitate information-sharing on Y2K solutions. To help create an environment in which information-sharing can flourish, the administration earlier this year submitted to Congress the "Year 2000 Information Disclosure Act," which would make it easier for organizations to share information publicly and with each other.


James G. Natoli
Managing the risk of failures and potential liability is a critical component of NYS' year-2000 project. We have been working closely with our Attorney General's Office to develop and implement policies to mitigate potential liability and damages associated with the year 2000. NYS developed standardized year-2000 warranty language included in all new contracts and negotiated into over 150 existing state contracts.


Wendy W. Rayner
To ensure we are prepared to deal with the legal implications of Y2K, I formed a Y2K legal team. The team is currently exploring the possibility of proposing Y2K immunity legislation to address litigation and liability questions. We are also exploring the feasibility and applicability of business-continuity insurance policies.


Tom Ridge
My own keen interest in the year 2000 has been spurred by a recognition of the potential negative economic impacts that could result from disruptions to our computer networks. In cooperation with our Canada-Pennsylvania Partnership Council, my Pa2K initiative has sought to put clear and concise year-2000 information in the hands of public and private leaders, motivating
corrective action.
November Table of Contents


Question Six:
Has Y2K made it more feasible to reengineer processes and systems? Has political leadership gained a sense of the importance of IT? In short, is there a silver lining to any of these Y2K clouds?
--------------------------------------------------------------------------------


Donald V. Evans
Many silver linings have been produced, painfully, by Y2K. Because of Y2K, we now know more about the status of our entire infrastructure -- transportation, communications, IT, etc., than we've ever known before. CIOs with an enterprising view toward managing and solving Y2K have enhanced the IT profession. Executives have learned that IT must be treated like infrastructure -- with funded and systematic replacement cycles.


Debra Clark Jones
North Carolina has developed and used a business-impact model for communicating the magnitude of the Y2K problem. Rather than simply state "Application A will fail," we are able to communicate how many citizens, businesses, employees and how much revenue/expenditure will be impacted if Application A fails. This approach has helped to bridge the awareness gap between
business and
technology.


Steve E. Kolodney
Yes -- many application systems will be retired as obsolete or not worth the effort to correct. In addition, agencies are improving their control and management of their computing environment, source-code versions and other skills that will improve their ability to build and maintain new applications in the future.


John A. Koskinen
The year-2000 problem is not without its silver linings. The problem has prompted managers to take a hard look at their systems and conduct comprehensive inventories. As a result of these system inventories, many of which have been first-time inventories, organizations have been able to retire systems that are no longer necessary, which will lead to greater efficiency.


James G. Natoli
The year 2000 has reinforced our dependence on technology and has demonstrated IT's critical role in delivering services. NYS had to conduct a thorough IT inventory [that] required NYS to make the necessary investment to refresh and upgrade older technology, replace legacy systems and devote
additional resources to IT. The primary focus has been on fixing systems, not re-engineering business processes.


Wendy W. Rayner
During the Y2K inventory and assessment phases, each executive-branch agency reviewed its current systems to determine whether to remediate, replace or discard a particular system. I strongly encouraged each agency to consider replacing antiquated legacy systems, if feasible, with new applications based on reengineered processes. Also, agency leadership is developing an increased appreciation of the importance of Y2K and related issues.


Tom Ridge
Our concerted response to the millennium bug has opened new lines of communications across state agencies and with federal agencies and third parties. But there is a greater benefit. The year 2000 has posed the largest technology challenge we have ever faced as an enterprise [and] brought lasting value by increasing recognition of technology's strategic potential to powerfully improve our competitive performance.
November Table of Contents


Question Seven:
At this point, what is government's biggest area of unresolved Y2K problems?
--------------------------------------------------------------------------------


Donald V. Evans
Embedded chips qualify as a major challenge. Y2K requires testing at a size and scope we are unaccustomed to. For example, how does one test a multijurisdictional, multistate, regionwide transportation, communications, public safety or health services system(s)? Few people recognize that state and local governments represent over 87,000 jurisdictions [and] have three times the workforce of federal.


Debra Clark Jones
The largest areas are third-party IT and third-party non-IT. Each has been prioritized below fixing custom IT applications. In the area of third-party IT, there are still many PCs running noncompliant vendor products, even though compliant versions exist. In the area of third-party non-IT, there are still many embedded chips for which compliance is unknown.


Steve E. Kolodney
Effective communication with the public regarding the effect, if any, on individuals or society during the rollover of 1999 to 2000. Lack of information could fan public fears, yet it is extremely difficult to predict a reasonable scenario.


John A. Koskinen
The biggest Y2K challenge for government is date-sensitive embedded chips. Since roughly 2 percent of the estimated 25 billion to 40 billion embedded chips are thought to be date-sensitive, it could pose a major problem for various functions that support service delivery. The challenge is the process of finding embedded chips, determining whether they are date-sensitive, and then reprogramming or replacing them.


James G. Natoli
New York State has identified over 700 external data-exchange dependencies with federal, state and local governments and the private sector for our "Top 40" priority systems alone. Many of our critical systems are dependent on these data exchanges, and it is critical that we verify that our exchange partners are compliant, and test these exchanges
thoroughly.


Wendy W. Rayner
We are well-aware of the problems faced by the executive branch and appropriate remediation and monitoring steps are under way. The biggest question is: Will we address everything that needs to be done in time? Also of concern is what we don't know. We have and will continue to give the Y2K project our utmost effort and attention.


Tom Ridge
As public stewards, government leaders need to do more to reach out to local communities so that they safeguard computer resources from possible disruptions. The Canada-Pennsylvania Partnership Council has produced an impressive array of year-2000 public awareness materials. These brochures, workbooks and other multimedia resources are being distributed throughout our local communities by the CAN2K program and the Pa2K program.
November Table of Contents


Question Eight:
Will Y2K issues be laid to rest on Jan. 1, 2000, or will they continue for a time? If so, what might they be and how can government prepare for them?
--------------------------------------------------------------------------------


Donald V. Evans
Project monitoring and assessment should indicate the most likely problem areas, and doing good supply-chain analysis and contingency planning should minimize those risks. Organizations should plan on funding their Y2K project office and some of its associated staff until approximately Jan. 1, 2001. Also, be prepared to arrange retainer agreements with certain key contractor personnel to help prepare for litigation.


Debra Clark Jones
Y2K issues will absolutely not be laid to rest on January 1, 2000. Many systems are using windowing techniques that will require system replacement or future window adjustments. Also, many operating systems are expected to have problems in 2038. As [for] preparing, much of the infrastructure (e.g., test environments, project management reports, IV&V audits, etc.) can continue to monitor completion of projects.


Steve E. Kolodney
There may be a wave of disruptions to nonmission-critical systems. Individually, these may not be significant, but the collective effect may be noticeable. Again, effective communication with the public might be the best way to prepare for this somewhat unavoidable event.


John A. Koskinen
It would be foolish to think that Y2K will not be with us after January 1, 2000. It is safe to assume that people will be repairing non-compliant systems well into the year 2000. Governments can prepare for this stage of the process by assessing the scope of the problem for nonmission-critical systems and beginning repairs as soon as possible.


James G. Natoli
NYS' 350 critical systems are on schedule to be compliant prior to the year 2000. But medium- and low-priority systems may not be brought into compliance prior to the year 2000. While these will not have an impact on the public services we provide, they can have an impact on efficient internal operations and productivity.


Wendy W. Rayner
I am sure we will continue to face Y2K-related issues well beyond January 1, 2000. System problems resulting from extensive Y2K remediation efforts will inevitably occur and will need to be resolved quickly. Legal issues related to Y2K may arise. Government must plan and budget for the reality of these continuing Y2K-related issues after January 1, 2000.


Tom Ridge
Year-2000 complications will continue well beyond the turn of the century. The situation will be especially dire for organizations that responded late to this threat and will be working under contingency plans while trying to still make their necessary year-2000 fixes after the new century arrives. Aggressive corrective action, open lines of communications with suppliers and customers, and educational outreach are key ingredients.
November Table of Contents


Question Nine:
In your jurisdiction, is there a contingency plan in case of widespread Y2K failure? Can we still go back to
manual systems?
--------------------------------------------------------------------------------


Donald V. Evans
We're building contingency plans for the most likely conditions based on actual project monitoring and assessment data along with business continuity data. Resources to build contingency plans are also scarce and must be wisely used. Computers have become ubiquitous in our processes and humans have never been trained to perform some of these. Therefore, an organization's ability to do things manually varies.


Debra Clark Jones
Several groups have talked about contingency plans for multiple concurrent disasters (as might be the case with year 2000). To our knowledge, however, no one has developed a documented widespread contingency case. There is general consensus that reversion to manual systems is not a feasible option in many cases due to lack of resources, facilities to house the resources and knowledge.


Steve E. Kolodney
We do not anticipate widespread failure. Contingency plans are constructed for certain key systems and applications that are particularly crucial. In some cases, these contingency plans involve manual operations. The emergency-management agencies are conducting preparatory exercises in the unlikely event they need to respond to problems in communities.


John A. Koskinen
Assuming such failures do occur, the federal response will undoubtedly consist of a multiagency effort to support the provision of emergency services. The challenge is knowing where such failures are likely to occur and, in many cases, we will not begin to have this information until the first
quarter of 1999.


James G. Natoli
NYS is developing contingency plans [that] may include using manual processes. We are working closely with our Department of Public Service and State Emergency Management Office to review statewide utility preparedness and emergency-response planning [for] year-2000 failures. The Department of Public Service is meeting with the state's major utilities that provide electric, gas, water and telecommunication services to evaluate their preparedness.


Wendy W. Rayner
Every executive-branch agency is developing extensive contingency plans for Y2K. These plans include disaster recovery, emergency management, business continuity, etc. It is important to note that failure of internal or external systems does not necessarily equate to manual processing. A temporary, less complex automated system (for example, Excel Spreadsheet, Access Database, or Radio Communication), may be the fallback contingency position.


Tom Ridge
Certainly, contingency planning has to be one element of a comprehensive year-2000 action plan. Step one should be to doggedly address your organization's year-2000 concerns, so that any potential problems are greatly minimized. However, recognizing the difficulty of anticipating all potential year-2000 complications, organizations need to review and revise contingency plans to make sure they will safeguard critical public services.
November Table of Contents